06_境外及港澳台调查报告_part13.md

06_境外及港澳台调查报告 · 整合分片 part13

本片含 83 份报告。

FD07398 ｜ 2012_美国_RAR1202.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train Red Oak, Iowa April 17, 2011

Accident Report NTSB/RAR-12/02 PB2012-916302

National Transportation Safety Board

NTSB/RAR-12/02 PB2012-916302 Notation 8400 Adopted April 24, 2012

Railroad Accident Report Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train Red Oak, Iowa April 17, 2011

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2012. Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train, Red Oak, Iowa, April 17, 2011. Railroad Accident Report NTSB/RAR-12/02. Washington, D.C.

Abstract: On April 17, 2011, about 6:55 a.m. central daylight time, eastbound BNSF Railway coal train C-BTMCNM0-26, BNSF 9159 East, travelling about 23 mph, collided with the rear end of standing BNSF Railway maintenance-of-way equipment train U-BRGCRI-15, BNSF 9470 East, near Red Oak, Iowa. The accident occurred near milepost 448.3 on main track number two on the Creston Subdivision of the BNSF Railway Nebraska Division. The collision resulted in the derailment of 2 locomotives and 12 cars. As a result of collision forces, the lead locomotive’s modular crew cab was detached, partially crushed, and involved in a subsequent diesel fuel fire. Both crewmembers on the striking train were fatally injured. Damage was in excess of $8.7 million.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, D.C. 20594 (800) 877-6799 or (202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2012-916302 from:

National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Railroad Accident Report i Contents Figures ............................................................................................................................... iii Acronyms and Abbreviations ......................................................................................... iv Executive Summary ...........................................................................................................v 1. Factual Information ...............................................................................................1 1.1 Accident Synopsis ....................................................................................................1 1.2 Preaccident Events ...................................................................................................2 1.2.1 MOW Equipment Train (Struck Train) ...........................................................2 1.2.2 Striking Coal Train ..........................................................................................3 1.2.3 The Collision ....................................................................................................6 1.2.4 Injuries .............................................................................................................7 1.2.5 Damage ............................................................................................................8 1.2.6 Wreckage .........................................................................................................8 1.3 Personnel Information ............................................................................................14 1.3.1 Engineer of Striking Train .............................................................................14 1.3.2 Conductor of Striking Train ...........................................................................14 1.3.3 Work-Rest Cycles of Crew of Striking Train ................................................15 1.3.4 Engineer of Struck Train ................................................................................15 1.3.5 Conductor of Struck Train .............................................................................15 1.3.6 Work-Rest Cycles of Crew of Struck Train ...................................................15 1.4 Track and Site Information ....................................................................................16 1.5 Method of Operations ............................................................................................17 1.5.1 Grade Signal Description ...............................................................................17 1.6 Train Information ...................................................................................................19 1.6.1 Striking Train Locomotives ...........................................................................19 1.6.2 Last 10 Cars on Struck Train .........................................................................22 1.7 Meteorological Information ...................................................................................24 1.8 Medical Information ..............................................................................................24 1.8.1 Striking Train Engineer..................................................................................24 1.8.2 Striking Train Conductor ...............................................................................24 1.8.3 Toxicological Information .............................................................................25 1.9 Tests and Research .................................................................................................26 1.9.1 Postaccident Signal System Inspection and Testing ......................................26 1.9.2 Track ..............................................................................................................26 1.9.3 Mechanical Tests and Inspections .................................................................26 1.9.4 Sight-Distance Observations ..........................................................................27 1.9.5 Cellular Telephone Use..................................................................................28 1.9.6 Event Recorders .............................................................................................28 1.9.7 Emergency Response .....................................................................................32 1.9.8 Other Information ..........................................................................................34 1.9.9 Postaccident Actions ......................................................................................38

NTSB Railroad Accident Report ii 2. Analysis .................................................................................................................40 2.1 Introduction ............................................................................................................40 2.2 Striking Train Crew Performance ..........................................................................41 2.2.1 Work Schedule Factors ..................................................................................41 2.2.2 Medical Factors ..............................................................................................43 2.2.3 Crew Actions Leading up to Collision...........................................................44 2.3 Fatigue....................................................................................................................45 2.3.1 Fatigue Education at BNSF ...........................................................................45 2.3.2 Fatigue Management and Rail Safety Improvement Act of 2008 .................46 2.3.3 Locomotive Alerters ......................................................................................50 2.4 Restricted Speed Accidents....................................................................................59 2.4.1 Recent Restricted Speed Accidents ...............................................................59 2.4.2 Restricted Speed and Positive Train Control .................................................61 2.5 Crash Performance .................................................................................................63 2.5.1 BNSF Locomotive 9159 ................................................................................63 2.5.2 Locomotive Crashworthiness Standards ........................................................63 2.6 Emergency Response .............................................................................................64 2.7 Locomotive In-Cab Video and Audio Recorders ..................................................64 2.8 Safeguarding Electronic Data for Accident Investigations ....................................67 3. Conclusions ...........................................................................................................70 3.1 Findings..................................................................................................................70 3.2 Probable Cause.......................................................................................................72 4. Recommendations ................................................................................................73 4.1 New Recommendations .........................................................................................73 4.2 Previously Issued Recommendations ....................................................................74 4.3 Previously Issued Recommendations Reclassified in this Report .........................75 4.4 Recommendations Reiterated in this Report..........................................................76

1. Appendixes....................................................................................................................78
2. 1

Appendix A: Investigation .....................................................................................78 5.2 Appendix B: BNSF Key to Signal Aspects and Indications ..................................79 5.3 Appendix C: BNSF 9159 Event Recorder Data from 6:36 a.m. to the 6:55 a.m. Collision .................................................................................................................80 5.4 Appendix D: Medications Referenced in Report ...................................................82 5.5 Appendix E: Restricted Speed Accidents Since April 2011 ..................................83

NTSB Railroad Accident Report iii Figures Figure 1. Accident location. ............................................................................................................1 Figure 2. Track map of accident area. .............................................................................................3 Figure 3. Track profile between MP 453 and MP 447....................................................................4 Figure 4. Event recorder data from locomotive of striking train. ...................................................5 Figure 5. Alerter alarm events from striking train locomotive event recorder during last 15 minutes before collision. ..................................................................................................................6 Figure 6. Wreckage including lead locomotive of striking train. ...................................................7 Figure 7. View of wreckage from highway overpass facing east. ..................................................9 Figure 8. View of wreckage from highway overpass facing west. ...............................................10 Figure 9. Wreckage diagram (not to scale). ..................................................................................11 Figure 10. Side view of front end of EMD SD70ACe locomotive, the same type of locomotive as striking train lead locomotive, BNSF 9159. ...........................................................12 Figure 11. Upended striking train locomotive (BNSF 9159) modular operating cab...................13 Figure 12. Creston subdivision of BNSF Nebraska division. .......................................................16 Figure 13. Eastbound intermediate grade signal 24504 with G Plate. ..........................................18 Figure 14. Illustration of EMD SD70Ace locomotive (same type as striking train locomotive) with white boxes indicating the points where the isolated cab attaches to the underframe. ....................................................................................................................................20 Figure 15. Exemplar EMD SD70ACe locomotive (same type as striking train locomotive) with modular cab............................................................................................................................21 Figure 16. Exemplar HZGX clip car. ............................................................................................23 Figure 17. Exemplar scorpion-equipped flatcar. ...........................................................................23 Figure 18. Intact exemplar crashworthy event recorder memory module. ...................................30 Figure 19. Fire-damaged memory module recovered from BNSF 9159. .....................................30 Figure 20. Exemplar video recorder hard drive enclosure (orange case). ....................................31 Figure 21. Fire-damaged video recorder hard drive enclosure from BNSF 9159. ......................32 Figure 22. Red Oak Fire Department applying foam after collision. ...........................................33

NTSB Railroad Accident Report iv Acronyms and Abbreviations AAR Association of American Railroads Amtrak National Railroad Passenger Corporation BMI Body mass index BNSF BNSF Railway CP Control point EMD Electro-Motive Diesel, Inc. ERP Employee review process ETMS Electronic Train Management System FIRE Functionally Integrated Railroad Equipment FRA Federal Railroad Administration GCOR General Code of Operating Rules IC Incident commander MOW Maintenance of way MP Milepost NOC Network operations center NPRM Notice of Proposed Rulemaking NTSB National Transportation Safety Board psi Pounds per square inch PTC Positive train control ROFD Red Oak Fire Department RSAC Rail Safety Advisory Committee RSIA Railroad Safety Improvement Act TPOB Tons per operative brake UP Union Pacific Railroad

NTSB Railroad Accident Report v Executive Summary On April 17, 2011, about 6:55 a.m. central daylight time, eastbound BNSF Railway coal train C-BTMCNM0-26, BNSF 9159 East, travelling about 23 mph, collided with the rear end of standing BNSF Railway maintenance-of-way equipment train U-BRGCRI-15, BNSF 9470 East, near Red Oak, Iowa. The accident occurred near milepost 448.3 on main track number two on the Creston Subdivision of the BNSF Railway Nebraska Division. The collision resulted in the derailment of 2 locomotives and 12 cars. As a result of collision forces, the lead locomotive‘s modular crew cab was detached, partially crushed, and involved in a subsequent diesel fuel fire. Both crewmembers on the striking train were fatally injured. Damage was in excess of $8.7 million. The National Transportation Safety Board determines that the probable cause of the accident was the failure of the crew of the striking train to comply with the signal indication requiring them to operate in accordance with restricted speed requirements and stop short of the standing train because they had fallen asleep due to fatigue resulting from their irregular work schedules and their medical conditions. Contributing to the accident was the absence of a positive train control system that identifies the rear of a train and stops a following train if a safe braking profile is exceeded. Contributing to the severity of collision damage to the locomotive cab of the striking coal train was the absence of crashworthiness standards for modular locomotive crew cabs. The safety issues identified during this accident investigation are as follows:  Train crew fatigue  Positive train control regulations and design  Crashworthiness of modular locomotive cabs  Survivability of electronic data As a result of this accident investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Association of American Railroads, and the BNSF Railway. The National Transportation Safety Board also reiterates recommendations previously issued to the Federal Railroad Administration.

NTSB Railroad Accident Report 1

• Factual Information

1. 1

Accident Synopsis On April 17, 2011, about 6:551 a.m. central daylight time, eastbound BNSF Railway2 (BNSF) coal train C-BTMCNM0-26, BNSF 9159 East, collided with the rear end of standing BNSF maintenance-of-way (MOW) equipment train U-BRGCRI-15, BNSF 9470 East, near Red Oak, Iowa. (See figure 1.) The accident occurred on a curve near milepost (MP) 448.3 on main track number two (track two) on the Creston Subdivision of the BNSF Nebraska Division. The striking coal train was travelling about 23 mph when it struck the standing MOW equipment train. Figure 1. Accident location. As a result of the collision, the two lead locomotives of the striking train derailed along with the first two coal cars. The modular crew cab on the lead locomotive of the striking train was detached, partially crushed, and involved in a subsequent diesel fuel fire. Seven additional coal cars were also damaged but did not derail. The 10 rear cars of the struck train derailed. Both the engineer and the conductor on the striking train were fatally injured in the collision. The crew on the locomotive of the struck train reported non-life-threatening injuries. Damages were estimated at more than $8.7 million. The

1 All times in this report are central daylight time. 2 The BNSF Railway was created on September 22, 1995, from the merger of Burlington Northern Inc. (parent company of Burlington Northern Railroad) and Santa Fe Pacific Corporation (parent company of the Atchison, Topeka and Santa Fe Railway). On February 12, 2010, the BNSF became a subsidiary of Berkshire Hathaway, Inc.

NTSB Railroad Accident Report 2

weather at the time of the accident was reported as 5 miles‘ visibility, with mist at Red Oak airport, which is about 3 1/2 miles east of the accident location. Event recorder data from the lead locomotive of the striking train indicate that before the collision, train speed increased and the throttle was decreased as the train crested a hill west of the accident site. The last throttle reduction occurred 1 minute 53 seconds before impact. The train‘s brakes were not applied before impact. 1.2 Preaccident Events 1.2.1 MOW Equipment Train (Struck Train) The engineer and the conductor of the struck MOW equipment train went on duty in Lincoln, Nebraska, at 1:15 a.m., and their train departed about 3:15 a.m. Investigators interviewed the crew and were told that up until the collision, the trip was unremarkable. At railroad control point3 (CP) 4580, the MOW equipment train entered track two behind two eastbound coal trains, neither of which was involved in this collision. The MOW equipment train stopped at a red stop signal4 at CP 4535 (MP 453.5) because two coal trains were ahead on track two and the first had stopped at the end of the multiple tracks at CP McPherson (MP 447.5). (The milepost numbers were decreasing in an eastward direction). (See figure 2.)

3 A control point is a location on the railroad where the train dispatcher can control train movements by setting routes. CP 4580 is a point where a single track diverges eastward into two main tracks. 4 See appendix B for illustrations and explanations of signal aspects and indications.

NTSB Railroad Accident Report 3

Figure 2. Track map of accident area. The first uninvolved coal train received a proceed signal and entered the single track east of CP McPherson. The second uninvolved coal train then moved eastward on track two and stopped at CP McPherson. The MOW equipment train followed, having received a yellow approach signal at CP 4535. The MOW equipment train then encountered a red (restricting) ―grade signal‖5 at MP 450.38 and continued at restricted speed6 until stopping about 300 feet behind the second uninvolved coal train. While these two trains were stopped at the east end of the multiple tracks on track two, Amtrak (National Railroad Passenger Corporation) No. 6 (the California Zephyr) passed them going eastward on main track number one (track one) about 6:22 a.m. The second uninvolved coal train then received a signal to proceed east and followed Amtrak No. 6. The MOW equipment train then moved up to CP McPherson and stopped at the red stop signal. 1.2.2 Striking Coal Train The engineer and the conductor of the striking coal train went on duty in Lincoln, Nebraska, at 2:31 a.m. After completing the required airbrake test, their train departed about 3:45 a.m.

5 A grade signal is used on an incline (grade) where it may be difficult to restart a stopped train, and it permits trains to pass a red aspect without stopping but requires further movement to be at restricted speed. 6 Restricted speed on the BNSF requires operating prepared to stop short of a train ahead within one-half the range of vision, not to exceed 20 mph.

NTSB Railroad Accident Report 4

While the two uninvolved coal trains and the MOW equipment train were on track two between CP 4580 and CP McPherson, the striking coal train was stopped at Balfour (MP 467.9) on track two. About 6:08 a.m., Amtrak No. 6 passed the striking coal train on the adjacent track, and the Amtrak engineer told NTSB investigators that he was able to see the crewmember on the conductor‘s side of the striking coal train‘s lead locomotive. He reported that the crewmember he had observed was in a reclining position.7 After it was passed by Amtrak No. 6, the striking coal train received a signal to proceed eastward. It moved onto the single main track at CP 4664 and then entered the multiple main tracks at CP 4580 on track two. Maximum authorized track speed at the accident location was 79 mph for passenger trains and 60 mph for freight trains. The striking coal train was further restricted to 45 mph because its tons per operative brake (TPOB) exceeded 100 (actual TPOB was 142.5). Signal indications can further restrict train speeds. Based on event recorder data and dispatcher records, the striking coal train‘s trip was without incident before it reached the crest of the grade about 2 miles before the collision. Figure 3 shows 6 miles of the track profile in the area of the collision and includes the positions of the signals, the peak of the grade, and the two trains involved in this accident about 15 minutes before the collision.

Figure 3. Track profile between MP 453 and MP 447.

7 BNSF operating rules permit one crewmember to nap while stopped waiting to be met or passed by another train.

NTSB Railroad Accident Report 5

Signal system recorder data indicated that the striking coal train passed a yellow approach signal at CP 4535 and then the red ―restricting‖ grade signal at MP 450.38 that protected the rear end of the standing MOW equipment train. Locomotive event recorder data indicated that the striking coal train had passed CP 4535 while moving about 30 mph in throttle position 1. The striking coal train‘s speed reduced to about 12 mph, and its throttle was in position 7 when the train passed the red restricting grade signal at MP 450.38 approaching the top of the 0.6-percent grade. The speed reduction was consistent with the signal indication, grade, tonnage, and the amount of power the engineer had applied. Until reaching MP 449.4 the striking coal train engineer maintained the speed at between 11 and 12 mph using throttle adjustments. As the striking coal train crested the grade, train speed increased from 11 mph to 23 mph at the point of collision. There were several throttle adjustments during the last 15 minutes of the trip as shown in figure 4, but no activity was detected during the last 1 minute 53 seconds. At impact, the throttle was in throttle position 4, and brakes had not been applied. Figure 4 was developed from event recorder data from the striking train‘s lead locomotive and shows when the engineer manipulated the controls of the locomotive between CP 4535 and the point of collision. The event recorder data is shown in tabular form at appendix C.

Figure 4. Event recorder data from locomotive of striking train.

NTSB Railroad Accident Report 6

Data from the striking train‘s (BNSF 9159) event recorder show that during the 15 minutes prior to the collision, the striking train‘s lead locomotive alerter alarmed three times after periods of engineer inactivity and was reset using the alerter reset button after a strobe displayed for 5 seconds and an audible alarm sounded for an additional 2 to 3 seconds. The collision occurred 1 minute 53 seconds after a throttle movement, and the alerter would have been due to alarm in about 7 seconds had the collision not occurred. Figure 5 shows the alerter alarm events that occurred during the last 15 minutes before the collision.

Figure 5. Alerter alarm events from striking train locomotive event recorder during last 15 minutes before collision. 1.2.3 The Collision The striking coal train collided with the rear car of the standing MOW equipment train about MP 448.3. The rear car of the MOW equipment train was almost immediately crushed, derailed, and displaced to the north of the track. Several other pieces of derailed equipment came to rest on track one. (See figure 6.) At the same time as the collision, the signal circuit on track one registered a track occupancy indication at the BNSF Network Operations Center (NOC) in Fort Worth, Texas. Based on locomotive event recorder and signal system recorder data, the time of the collision was a few seconds after 6:55 a.m.

NTSB Railroad Accident Report 7

Figure 6. Wreckage including lead locomotive of striking train. The striking train continued about 690 feet after the initial impact. The locomotive event recorder data indicated that following impact, the train speed dropped from 23 mph to 21 mph, and then the emergency brakes applied because of collision damage. The event recorder data indicated that neither the engineer nor the conductor activated the brakes before or after impact. The crew on the MOW equipment train told investigators that while waiting at CP McPherson, they felt a strong impact that shoved their train forward; locomotive event recorder data from the MOW equipment train showed a movement of about 17 feet. The engineer said he knew that they had been rear-ended by another train. When he observed the rear of his train, he said, he saw a large smoke plume and fire, and he called

1. He left the cab and went toward the rear of the train. When he neared the rear of his

train, he saw that the lead locomotive of the striking coal train (BNSF 9159) was on fire. 1.2.4 Injuries Both crewmembers on the striking coal train were fatally injured. The engineer and the conductor on the MOW equipment train reported back and neck pain and sought medical treatment. No emergency responders were injured. Red Oak Fire Department photo

NTSB Railroad Accident Report 8

1. 2.5 Damage

Total damage was estimated at more than $8.7 million and is detailed in table 1. Table 1. Estimated damage. Equipment and Other Costs Estimated Damage Coal train $1,157,482 MOW train 195,411 MOW equipment on flatcars 5,140,000 Track 898,593 Wreckage removal and cleanup 875,386 Miscellaneous labor costs 79,288 Highway overpass 380,000 Total $8,726,151

1. 2.6 Wreckage

Struck Train. The last car (the 34th car behind the locomotive) on the MOW equipment train, Herzog clip car8 HZGX-150, was the first car struck by locomotive BNSF 9159. The clip car was derailed and displaced near the point of collision to the north side of track two and caught fire. The clip car was folded roughly in half by collision forces. The powered wheel set from the clip car lodged at the base of the snow plow of the striking locomotive and was carried to the point of rest. The next to the last car in the MOW equipment train was BNSF 927022 (the 33rd car), an 89-foot-long flatcar equipped with a Kershaw ―Scorpion Ramp,‖ which is a ramp that unfolds so that MOW equipment can roll on and off a flatcar, called a scorpion car. The struck end of this scorpion car overrode and came to rest on top of BNSF 9159 with the scorpion ramp extended across the top of the locomotive. The scorpion car was partially bent lengthwise, top toward the bottom, 20 feet from the ―A‖ end9 of the car. One truck assembly from this car came to rest on top of the short hood10 assembly of BNSF 9159, toward the left side of the locomotive. The other truck assembly, along with a wheel set, came to rest in front of BNSF 9159.

8 A clip car is maintenance-of-way equipment that installs clips that secure the rails to the tie plates on the ties. 9 Each end of a freight car is designated as either the A or the B end. The hand brake is typically located on the B end. 10 The locomotive short hood is a structure at the leading end of the cab containing the collision posts and the forward access door. It is further defined in the Association of American Railroads Manual of Standards and Recommended Practices, Standard S-580, revision 2005, ―Locomotive Crashworthiness Requirements,‖ which is a standard incorporated by reference in Title 49 Code of Federal Regulations 229.205.

NTSB Railroad Accident Report 9

The next four cars (the 29th through the 32nd cars behind the locomotive) were 89-foot-long flatcars loaded with MOW equipment that were derailed and displaced to the north side of track two near the Highway M 37 overpass. (See map in figure 2 and figures 7 and 8.) Much of the cargo on these cars (MOW equipment) broke free from securements and was scattered along the right-of-way.

Figure 7. View of wreckage from highway overpass facing east. Red Oak Fire Department photo

NTSB Railroad Accident Report 10

Figure 8. View of wreckage from highway overpass facing west. The next three cars (26th through 28th) also were 89-foot-long flatcars that were loaded with MOW equipment. These cars, along with the scorpion flatcar, came to rest lying against each other and overriding each other and leaning against the front end of the lead locomotive of the striking train. (See figure 9.) Trucks, wheel sets, and MOW equipment were scattered along the north and south sides of the tracks. Positioned in front of the snow plow of the lead locomotive of the striking train, BNSF 9159, from east to west, were the following:  One powered wheel set from the clip car  One truck frame from the clip car  One wheel set from the clip car  One truck assembly from BNSF flatcar 927022 (the 33rd car) Red Oak Fire Department photo

NTSB Railroad Accident Report 11

The last car to derail (25th) on the MOW equipment train was also an 89-foot-long flatcar loaded with MOW equipment. It derailed upright and generally in line with the track.

Figure 9. Wreckage diagram (not to scale). Striking Train. The lead locomotive of the striking coal train, BNSF 9159, sustained extensive frontal damage. (See figure 10.) It derailed, but the unit stayed upright and generally in line with the track. About 16 feet of the front end of BNSF 9159 was compromised as a result of the collision. The short hood and collision posts, normally positioned perpendicular to the deck, were pushed and deflected at an angle of about 35° to 40° in the direction of the cab. The end plate, snow plow, anti-climber,11 short hood, and collision posts were severely damaged and deformed. A major impact area was identified on the front door frame of the operating cab. The frame was found to be split at the top right. The inner doorway, or vestibule, floor area had indications of severe loading and was bent rearward and upward.

11 Anti-climbers are located at the ends of adjoining cars in a train and are designed to engage when subjected to large compressive (buff) loads to prevent override.

NTSB Railroad Accident Report 12

Figure 10. Side view of front end of EMD SD70ACe locomotive, the same type of locomotive as striking train lead locomotive, BNSF 9159. The modular cab of the locomotive sustained a substantial loss of occupied space. The cab was separated from the deck of the locomotive, and the bottom half of the cab rotated up just over 90 degrees. (See figure 11.) The cab was crushed at the rooftop, and the left rear corner of the cab was crushed in. The side walls remained intact to the point of the window line, which is about 4 feet from the roof. The underside of the cab was relatively intact and undamaged. The entire cab had extensive fire exposure and damage.

NTSB Railroad Accident Report 13

Figure 11. Upended striking train locomotive (BNSF 9159) modular operating cab. The rear of the cab module abuts the electrical locker. The general condition of the electrical locker indicated that it had been subjected to severe longitudinal forces, and it was crushed at the upper right side. The locker became separated from the floor mounting system and was pushed back more than 2 feet. The interior of the cab was severely damaged by fire.12 The general condition of the modular cab attachment fixtures indicated that they had been subjected to severe vertical forces and shear. The rear posts were broken along the welds that hold the cylindrical posts to the deck. The forward-mounted floor brackets had indications of deep scoring on the inboard sides in a manner consistent with vertical loading. The modular cab assembly was examined, revealing the remaining volume of survivable space to be an estimated 65 cubic feet. Both the engineer‘s and the conductor‘s sides of the cab were severely damaged and burned. The engineer‘s seat was sheared from the floor mounts, and the control panel was bent downward and inward. The conductor‘s seat remained attached, and the desk area was crushed toward the floor.

12 The flatcars that overrode the locomotive carried MOW equipment with diesel fuel tanks. cab module Red Oak Fire Department photo

NTSB Railroad Accident Report 14

The 5000-gallon fuel tank mounted to the underframe at the bottom plate was not compromised. The left side of the tank had minor scraping along the sidewall. The second locomotive on the striking coal train, BNSF 6133, also derailed but stayed upright and generally in line with the track. Collision damage was much less severe and involved primarily raking damage along the right (north) side from the derailed flatcars and the MOW equipment from the cars. The diesel fuel tank on BNSF 6133 was punctured on the right rear corner of the sidewall/end plate, and leaking diesel fuel caught fire. The first two loaded coal cars (cars 1–2) derailed upright and came to rest in line with the track. These two cars and the next seven (cars 3–9) were damaged by raking action along their sides from derailed cars and freight. 1.3 Personnel Information 1.3.1 Engineer of Striking Train The 48-year-old engineer was hired by the BNSF on July 14, 1997. His seniority date as an engineer was March 15, 1999. He had passed rules examinations on a regular basis and was current in his engineer‘s certification. His most recent recertification was on July 10, 2008. Other than three brief periods in Kansas City, Missouri, and once in Lincoln, Nebraska, he had primarily worked out of Creston, Iowa, since May 2003. He had five disciplinary actions on his record including one for excessive speed and another related to noncompliance with Form B13 track bulletin requirements. The other three disciplinary actions were considered less serious and involved train handling and absenteeism. The engineer had been placed on an employee review process (ERP)14 on March 11, 2009. He was in the ERP program at the time of the accident. The engineer‘s supervisor told investigators that the engineer‘s performance had improved and that he was a candidate for removal from the program. 1.3.2 Conductor of Striking Train The 48-year-old conductor was hired as a brakeman by the BNSF on November 22, 2004. Her seniority date as an engineer was January 21, 2007. She was certified as a locomotive engineer but was working as a conductor. Her seniority date as a

13 Form B track bulletins are issued to establish work zones on the right-of-way. 14 The BNSF ERP is intended to help employees work the remainder of their careers without an accident or injury. When an employee‘s record indicates that individual assistance is needed, the supervisor contacts the employee and conducts an ERP session. Criteria for selection of employees for the ERP include injury history, human factor rail equipment incidents, operations testing failures, new employees with incidents or injuries, and supervisor awareness of performance concern. Employees in this program are tested more frequently on train operations, have their event recorder tapes reviewed, and meet with their supervisors on a regular basis.

NTSB Railroad Accident Report 15

conductor was March 14, 2005. She had one disciplinary action on her record: ―Excess speed in restricted speed.‖ At the time of this event, she was working as a conductor. 1.3.3 Work-Rest Cycles of Crew of Striking Train Both the engineer and the conductor were called for duty on Sunday, April 17, 2011, at 1:01 a.m., and they went on duty at 2:31 a.m. (the accident trip) in Lincoln, Nebraska. They both had been off duty for 12 hours 1 minute and had stayed at an away-from-home lodging facility provided by the railroad. The day before the accident (Saturday, April 16), the engineer was called for duty at 3:02 a.m.; went on duty at 4:30 a.m.; traveled from Creston, Iowa, to Lincoln, Nebraska; and went off duty at 2:30 p.m. Between April 11 and April 15, he had marked off (taken himself off) the call list for union business and for taking an engineer recertification examination. Also on Saturday, April 16, the conductor was called for duty at 3:00 a.m.; went on duty at 4:30 a.m.; traveled from Creston, Iowa, to Lincoln, Nebraska; and went off duty at 2:30 p.m. On Friday, April 15, the conductor was on duty from 2:25 a.m. to 2:10 p.m. On Thursday, April 14, she worked from 3:10 a.m. to 1:10 p.m. 1.3.4 Engineer of Struck Train The 43-year-old engineer was hired in 1994 as a conductor trainee. Since April 16, 1995, he had worked as an engineer. His engineer certification was current. 1.3.5 Conductor of Struck Train The 26-year-old conductor was hired by the BNSF on February 2, 2004. His seniority date as a locomotive engineer is August 6, 2006. 1.3.6 Work-Rest Cycles of Crew of Struck Train The engineer was called for duty on April 17, 2011, in Lincoln, Nebraska, at 12:05 a.m. and went on duty for the accident trip at 1:15 a.m. The day before the accident (Saturday, April 16), he was called at 12:31 a.m.; went on duty at 2:00 a.m.; traveled from Creston, Iowa, to Lincoln, Nebraska; and went off duty at 1:45 p.m. The day before (Friday, April 15) he had the day off. The engineer had been off duty from April 11 through April 15. The conductor also was called for duty for the accident trip on Sunday, April 17, 2011, in Lincoln, Nebraska, at 12:05 a.m. and went on duty at 1:15 a.m. The day before (Saturday, April 16) he was called at 12:30 a.m., went on duty at 2:15 a.m., and traveled from Creston, Iowa, to Lincoln, Nebraska. He went off duty at 1:45 p.m. and stayed at a local hotel. On Thursday, April 14, he was called at 8:21 p.m. and went on duty at 9:50 p.m. He was on duty until 10:15 a.m. on Friday, April 15.

NTSB Railroad Accident Report 16

1. 4

Track and Site Information The Creston Subdivision is located on the Nebraska Division and begins at Creston, Iowa, and continues westward to Lincoln, Nebraska. (See figure 12.) The railroad in the vicinity of the accident is multiple main track territory. The maximum timetable speed on the Creston Subdivision is 60 mph for freight trains, 79 mph for passenger trains, and 45 mph for trains exceeding 100 TPOB.

Figure 12. Creston subdivision of BNSF Nebraska division. There are two main tracks at the accident site. The bulk of the train traffic in that area is made up of coal trains. Loaded coal trains travel east from the Powder River Basin to various utility power plants in the midwest and east; empty coal trains move west. Generally, loaded coal trains are routed on track two, as was the case in this accident. Other freight trains also operate on this route as do Amtrak trains. Amtrak passenger trains No. 5 and No. 615 operate daily, connecting Chicago with the San Francisco Bay area. The collision occurred near the east end of a 10.6-mile length of parallel tracks between CP 4580 and CP McPherson. There are crossovers near the midpoint at CP 4535. (See figure 2.)

15 Amtrak No. 5 operates westbound; No. 6 operates eastbound.

NTSB Railroad Accident Report 17

1. 5

Method of Operations Train operations on this portion of the BNSF were governed and authorized by traffic control system signal indications under the control of a train dispatcher located at the Network Operations Center (NOC) in Fort Worth, Texas. Train dispatchers at the NOC set routes at each control point that establish the priorities for, and control, train movements. Typically, intermediate signals are positioned between control points that govern the use of discrete signal blocks. At the accident site there were two main tracks, each signaled for train movements in both directions. The crews were governed by the General Code of Operating Rules (GCOR),16 Sixth Edition, effective April 7, 2010. The territory was designated the BNSF Nebraska Division, Creston Subdivision. At the time of the accident, the current timetable was Nebraska Division Timetable No. 7, effective May 12, 2010. Intermediate signals are located on both main tracks at MP 450.38 about midway between the crossovers at CP 4535 (MP 453.4) and CP McPherson (MP 447.5). The last signal the striking coal train passed before the accident was intermediate signal 24504.17 This consisted of a three-position color-light display with a G plate18 and a number plate attached to the signal mast. (See figure 13.) Signal system data indicated that this signal was displaying a red (restricting) aspect. There were no slow orders, track bulletins, or other advisories in effect between the grade signal and the point of collision. No speed or stop signal enforcement (positive train control system) is installed in this area. The locomotive engineer is responsible for train speed management and stopping at appropriate locations in accordance with operating rules and signal indications. 1.5.1 Grade Signal Description GCOR rule 9.1.13, Signal Aspects and Indications, illustrates many signal aspects that are called ―restricting,‖ including flashing red, lunar, and a solid red intermediate signal with a G plate and a number plate attached to the mast. For all these signal aspects, their indication is ―proceed at restricted speed.‖ When a train encounters an intermediate signal displaying a red aspect and that has a G plate, the train is not required to stop but must reduce speed to restricted speed before passing the signal. The GCOR restricted speed rule (Rule 6.27, Movement at Restricted Speed) is quoted below:

16 The GCOR is a standard book of operating rules used by many railroads in the United States. It was developed by a committee composed of railroads that adopted the GCOR, and it is updated periodically by the committee. Each railroad that adopts the GCOR remains free to modify specific rules to better suit its individual operating characteristics. 17 Signals between control points are called intermediate signals. These signals provide information about the track ahead but do not convey movement authority. 18 A G plate is a small sign reading ―G‖ that is attached to a signal mast. The G stands for grade; signals are located on grades where it is prudent to avoid stopping a train on an upgrade because restarting may be difficult and result in a stall or a break in two.

NTSB Railroad Accident Report 18

When required to move at restricted speed, movement must be made at a speed that allows stopping within half the range of vision short of: • Train. • Engine. • Railroad car. • Men or equipment fouling the track. • Stop signal. Or • Derail or switch lined improperly. When a train or engine is required to move at restricted speed, the crew must keep a lookout for broken rail and not exceed 20 [mph]. Comply with these requirements until the leading wheels reach a point where movement at restricted speed is no longer required.

Figure 13. Eastbound intermediate grade signal 24504 with G Plate.

NTSB Railroad Accident Report 19

1. 6

Train Information The striking coal train consisted of 130 loaded coal cars, weighed 18,529 tons, and was 7,122 feet long. It had two locomotives on the head end and one locomotive on the rear end.19 The struck MOW equipment train consisted of 21 loaded cars and 13 empty cars, weighed 2,635 tons, and was 3,170 feet long with one locomotive on the head end. The rear portion of the train included flatcars with various types of self-powered MOW equipment as cargo. 1.6.1 Striking Train Locomotives BNSF 9159. The lead locomotive of the striking train, BNSF 9159, was an Electro-Motive Diesel (EMD) SD70ACe manufactured in March 2008. (See figures 14 and 15.) This unit is a six-axle, two-truck,20 4300-horsepower, diesel-electric locomotive. The locomotive measures about 74 feet long, 10 feet wide, and 16 feet high. It weighs about 420,000 pounds. The design incorporates a modular operator‘s cab at the front end of the unit and has a fabricated steel underframe that extends the length of the unit, upon which the diesel engine and alternator components are mounted (aft of the operator‘s cab). The modular cab is bolted in place at its rear floor underside on two hollow cylindrical posts about 10 inches in diameter that are welded to the top plate of the locomotive. Welded atop these sections are square plates, or flanges, on which the rear section of the cab is bolted. The two rear cab mounting points are fitted with torsional bushings that establish a pivot point about the rear floor axis of the cab. The front of the modular cab rests on two coil springs located behind the short hood about 5 feet 10 inches above the underframe top plate behind the short hood. Adjustment cups at each spring are used to control the clearance from cab to underframe and to equalize spring compression. Adjacent to each spring are hydraulic shock absorbers designed to dampen vibrations.

19 This configuration of locomotives (two in front/one on rear) is commonly referred to as distributed power. The locomotive engineer in the lead locomotive typically controls all of the distributed power locomotives in the train, and this was the case at Red Oak. 20 Wheel-axle sets are held in place in frames, and these assemblies are referred to as trucks.

NTSB Railroad Accident Report 20

Figure 14. Illustration of EMD SD70Ace locomotive (same type as striking train locomotive) with white boxes indicating the points where the isolated cab attaches to the underframe. On the underside of the modular cab at its front are two double shear pin joints. This system includes two brackets welded to the top plate and two brackets welded to the underside of the cab floor. These joints are designed as a clearance fit;21 a 1-inch-diameter hardened steel pin passes through a wide (2-inch) hole in the deck-mounted bracket. When questioned, EMD stated that this design acted as a loosely coupled fastening system. Other fixtures include stinger assemblies, or oversized turnbuckles, and dampers. These additional fixtures limit the lateral motion of the operating cab assembly sitting on the deck of the locomotive.

21 A clearance fit provides clearance between a shaft and a hole and permits relative freedom of motion of the two—axially, radially, or both.

NTSB Railroad Accident Report 21

Figure 15. Exemplar EMD SD70ACe locomotive (same type as striking train locomotive) with modular cab. A fuel tank with a capacity of about 5,000 gallons is located (suspended from the underframe) between the truck assemblies. BNSF 9159 was built following a crashworthiness design standard prescribed in the Association of American Railroads (AAR) Manual of Standards and Recommended Practices, Standard S-580, revised 2005. AAR Standard S-580 is incorporated by reference in Title 49 Code of Federal Regulations (CFR) 229.225 for all locomotives built after January 2009. Selected design requirements in Standard S-580, for wide-nose locomotives, are listed below:  Impact-resistant fuel tank  Underframe designed to withstand a longitudinal load of 1 million pounds  Collision posts  Anti-climbers designed to withstand a vertical force of 100,000 pounds

NTSB Railroad Accident Report 22

AAR Standard S-580 also includes crashworthiness requirements for other types of locomotives, including narrow-nose locomotives. For narrow-nose locomotives, the standard includes crashworthiness requirements for operator cab corner posts, but S-580 does not contain such requirements for wide-nose locomotives. AAR Standard S-580 does not contain any criteria related to operating cabs—conventional22 or modular (isolated)—for wide-nose locomotives. Additionally, BNSF 9159 was constructed to meet fuel tank performance standards prescribed in AAR Standard S-5506, revised 2001, ―Performance Requirements for Diesel Electric Locomotive Fuel Tanks,‖ which is a standard incorporated by reference in 49 CFR 229.205. BNSF 6133. The second locomotive of the striking train, BNSF 6133, was a General Electric ES44AC built in November 2006. This unit is a six-axle, two-truck, 4400-horsepower, diesel-electric locomotive. The crew cab on this model locomotive (unoccupied at the time of the accident) is of nonmodular design. BNSF 6133 measures about 73 feet long, 10 feet wide, and 15 1/2 feet high, and it weighs about 415,000 pounds. A fuel tank with a capacity of about 5,000 gallons is located (suspended from the underside of the underframe) between the truck assemblies. BNSF 6133 also was manufactured to AAR S-580 crashworthiness standards and S-5506 fuel tank performance standards in effect at the time of manufacture. 1.6.2 Last 10 Cars on Struck Train The last car of the struck train, the 34th car, was the HZGX-150, a clip car. (See figure 16.) This was the first car struck by locomotive BNSF 9159 in the collision. It is a diesel-engine-powered self-propelled unit that can be coupled into a train for transport. It has a 300-gallon fuel tank. This car was manufactured by Herzog Railroad Services, Inc.; weighed 177,000 pounds; and was 54 feet long.23

22 A conventional operating cab is permanently attached to the supporting frame of the locomotive, thus becoming a single unit. 23 Information from Universal Machine Language Equipment Register, or UMLER.

NTSB Railroad Accident Report 23

Figure 16. Exemplar HZGX clip car. The second to the last car in the struck train was BNSF 927022. This was a scorpion car: an 89-foot flatcar with a folding loading ramp attached to the end of the car. (See figure 17.) The scorpion ramp was composed of six segments tied together with pin joints and hydraulic rams. The ramp unfolds so that MOW equipment can roll on and off the flatcar. When the ramp is fully open and extended, it is 52 feet 8 inches long. The ramp is powered by a diesel engine and has an 11.5-gallon fuel tank. The hydraulic fluid tank had a 25-gallon capacity. This car weighed 155,400 pounds.

Figure 17. Exemplar scorpion-equipped flatcar.

NTSB Railroad Accident Report 24

The next eight derailed cars in the MOW equipment train were 89-foot-long flatcars with MOW equipment secured to them as cargo. 1.7 Meteorological Information On April 17 at 6:55 a.m., the weather at Red Oak Airport, which is about 3 1/2 miles east of the accident site, was reported as misty with a temperature of 30° F and visibility of 5 miles. The accident occurred in daylight; sunrise that day was at 6:40 a.m. The crew of the struck train described the visibility in the area as good at the time of the collision. 1.8 Medical Information 1.8.1 Striking Train Engineer The BNSF medical records for the engineer of the striking coal train indicated that his most recent hearing and vision tests were on March 21, 2011. Although the hearing test indicated that he had some loss of hearing in both ears for high-pitched sounds (that is, whistles, birds, some speech sounds), he still met the Federal Railroad Administration (FRA) hearing acuity requirements in 49 CFR 240.121. His vision examination indicated that he did not wear glasses for distance or reading and his color vision was normal. NTSB investigators obtained the engineer‘s medical records from his personal physician. His last visit to this physician was on May 6, 2009. On that date, he weighed 228 pounds and he was about 67 inches tall. His body mass index (BMI)24 was 35.7. He had had Type 2 diabetes for several years and had been prescribed repaglinide; glyburide and metformin; and pioglitazone.25 He had been prescribed valsartan for high blood pressure. He also had been prescribed ezetimibe and simvastatin, and rosuvastatin, for high cholesterol. (See appendix D for medications discussed in this report and their indications.) There was no indication in the records provided that he had undergone a sleep study. 1.8.2 Striking Train Conductor The conductor‘s BNSF medical records indicated that she had sustained an injury on November 4, 2010 (and was subsequently out of service for several months). These records also indicated that she had ―impingement problem shoulder‖ and that she required surgery. The BNSF records indicated she could return to work, to full duty with

24 Body mass index is a relationship between weight and height that is associated with body fat and health risk. BMI is calculated by dividing weight in kilograms by height in meters squared. Obesity is defined as a BMI of 30 and above. (Source: National Institutes of Health) 25 Repaglinide; glyburide and metformin; and pioglitazone are medications prescribed to treat Type 2 diabetes.

NTSB Railroad Accident Report 25

no restrictions, on March 18, 2011. The November 4, 2010, records also indicated that she was regularly taking valsartan for high blood pressure and pramipexole for restless legs syndrome. She returned to work on March 21, 2011, and had been released to full unrestricted duty. Her hearing tests conducted on May 5, 2010, indicated that her hearing was normal. She passed her vision test on April 3, 2009. NTSB investigators obtained the conductor‘s medical records from her personal physician. Investigators also noted various medications that were recovered from her locker after the accident. The following information is based on information from these two sources. The conductor‘s medical records indicated that she was 64 1/4 inches tall and weighed 221 pounds on November 8, 2010. Her BMI was 37.6. She was noted to be hypertensive on November 8, 2010, with a blood pressure of 140/88. The records indicated that she was being treated for high blood pressure with both metoprolol and valsartan. In addition, she was being treated for restless legs syndrome with ropinirole, an anti-Parkinson‘s disease medication. Medications found in her locker included temazepam (used to treat insomnia), which had been prescribed on March 9, 2011. She also had diphenhydramine, an over-the-counter sedating antihistamine, in her locker. Her medical records indicated that she had been prescribed venlafaxine (an antidepressant). Her snoring history was not available. There was no indication in the records provided that she had undergone a sleep study. 1.8.3 Toxicological Information In accordance with Federal regulations, the engineer and the conductor of the struck train were required to provide postaccident blood and urine specimens, which they did at a hospital in Creston, Iowa. The Montgomery County, Iowa, coroner collected specimens from the engineer and the conductor of the striking train. The specimens from crewmembers of both trains were negative for illegal drugs and ingested alcohol. NTSB investigators requested additional toxicological analyses on the striking train crew‘s specimens be conducted at the Civil Aeronautical Medical Institute in Oklahoma City, Oklahoma. The conductor‘s toxicological results showed that valsartan (a prescription medication used to treat high blood pressure) had been detected in the urine and the blood. Results for the engineer showed that chlorpheniramine (used to treat symptoms related to allergies and the common cold) had been found in the urine but not in the blood. In addition, ranitidine (used to treat ulcers and gastroesophageal reflux disease, also known as GERD) was found in both his blood and his urine. The Montgomery County coroner conducted autopsies on the two crewmembers of the striking coal train. The toxicological analysis of the engineer‘s heart blood revealed ranitidine, 100 ng/mL, and caffeine. The autopsy report concluded that he died of ―blunt force injuries to the head and thermal injuries.‖ The toxicological analysis of the conductor‘s heart blood revealed no detectable concentrations of drugs on a

NTSB Railroad Accident Report 26

comprehensive drug panel. The only positive result was for caffeine. The report concluded that the cause of death was ―blunt force injuries of the head.‖ The report also stated, ―Other significant: thermal injuries.‖ The coroner also conducted toxicological tests for the presence of carbon monoxide on both crewmembers on the striking train, and these tests were negative. 1.9 Tests and Research 1.9.1 Postaccident Signal System Inspection and Testing Investigators conducted postaccident field inspections and testing of the signal system. The inspections found no indications of tampering or vandalism that would interfere with the operation of the signal system. Relay positions were found to be in accordance with the physical location of the accident trains and the displayed signal aspects. Investigators did not identify any exceptions with either the design or the operation of the signal system. Minor signal system damage was observed as a result of the collision. Investigators collected and reviewed BNSF signal system maintenance records for the accident area. The records indicated that all signal tests and inspections had been conducted in accordance with BNSF requirements and Federal regulations. Signal trouble reports for the previous 3 months were also reviewed, and no exceptions were noted. 1.9.2 Track The two main tracks at the accident site are generally parallel and run east and west. The northern track is designated track one, and the southern track is track two. On both tracks, 136-pound continuous welded rail was laid on wood ties set in ballast and held in place with spikes and tie plates. Annual traffic on track two totals 94 million gross tons and on track one, 23 million gross tons. Visual inspection of track in the accident area did not reveal any anomalies except those associated with damage from the collision and derailment. 1.9.3 Mechanical Tests and Inspections On the morning of April 18, 2011, investigators inspected all the cars of the striking coal train where they came to rest. Three minor exceptions were noted, none of which could have prevented train brakes from applying. To test the brakes, the brake pipe was charged to 90 pounds per square inch (psi), and after the air had equalized, a 20-psi brake application was made. The brakes on all 130 cars applied as designed.

NTSB Railroad Accident Report 27

Maintenance Records. A review of the maintenance and inspection records for the lead locomotive on the striking train (BNSF 9159) indicated that all the required FRA and BNSF inspections were current. There were no unrepaired defects that would have rendered the unit unfit for service including exhaust fumes leaking into the control compartment. Locomotive Control Positions. The leading locomotive of the striking train sustained severe crush and thermal damage during the collision and subsequent fire. The control positions on the engineer‘s side of the operating compartment could not be physically verified. There was also extensive damage on the conductor‘s side, but investigators were able to observe that the conductor‘s emergency brake valve had not been activated. Locomotive event recorder data also indicated that the conductor‘s emergency brake valve had not been activated before impact. Preaccident Inspections. BNSF records indicate that on the morning of the accident, BNSF car inspectors completed the required brake tests and mechanical inspections on the striking coal train at Lincoln, Nebraska, with no defects reported. Metallurgical Examinations - Forward Cab Retention Pins. Investigators from the NTSB‘s Materials Laboratory conducted a postaccident examination of locomotive BNSF 9159 in Havelock, Nebraska. Pieces of the two forward cab retention pins were taken to the NTSB laboratory in Washington, D.C., for further examination. The retention pins are part of the loosely coupled fastening system of the isolated operating cab on the EMD SD70ACe locomotive as described in section 1.6.1 of this report. Both retention pins were fractured through the thickness about midway along the shank. The fracture features on both pins were consistent with overstress of surface-hardened steel under a bending load. The retention pin dimensions were within the EMD-specified tolerances. The metallurgical composition of the pins was evaluated, and the material was identified as carbon steel; manganese levels were within the compositional ranges of the carbon steels that EMD specified for this part. Hardness values were generally consistent with the specified material, although surface hardness was slightly below specification in one pin that showed evidence of heat damage. 1.9.4 Sight-Distance Observations Investigators conducted sight-distance observations to determine the visibility of the two signals leading up to the accident site and to examine the visibility of the rear clip car of the standing train. The weather conditions during these observations were similar to those described by the crew of the struck train at the time of the accident. The signals were set to display the same aspects (yellow approach at CP 4535, red restricting at intermediate grade signal 24504) as were displayed to the striking train. An exemplar clip car was positioned on the curve at the point of collision with an end-of-train device

NTSB Railroad Accident Report 28

attached.26 Observers were positioned in the cab of a locomotive of the same type as BNSF 9159. The observation locomotive was operated by a BNSF engineer who regularly works this territory. He was instructed to note the location where he could clearly see the yellow approach signal at CP 4535, the red restricting signal 24504, and the standing clip car. Observers then confirmed these locations. The observations were conducted within an hour of the time of day that the accident had occurred. Sight-distance measurements were taken from the locomotive distance counter. Table 2 lists the distances recorded during these observations. During the sight-distance observations, investigators were stationed at various signal locations to observe signal displays while the test train traversed the accident area. No anomalies were observed. Table 2. Sight-distance observations. Observable Feature Distance Observed (feet) Yellow approach signal at CP 4535 4658 Red restricting grade signal 24504 3147 Exemplar clip car placed at point of impact 1364 1.9.5 Cellular Telephone Use Investigators obtained the cellular phone records of the engineers and the conductors of both the struck train and the striking train. These records indicated that the crewmembers of both trains were not using their cell phones for verbal communication or for texting during the accident trips. While off duty on April 16, 2011, the engineer of the striking train made several outgoing calls, the majority of them between 3:51 and 4:17 p.m. The last call he made that day using his cell phone was at 6:46 p.m. There was no record of any calls made by the conductor on the day before the accident. 1.9.6 Event Recorders Railroad Signal Event Recorders. Investigators collected information from the event recorders at four signal locations: CP McPherson; intermediate grade signal 24504; CP 4535; and the BNSF NOC in Fort Worth, Texas. An examination of the signal data was conducted with no exceptions noted.

26 An end-of-train device is mounted on the rear of the rear car of a train and is connected to the air brake system. It provides information to the engineer about air brake system pressure. It is also reflective and has a flashing light controlled by a photo cell In the Red Oak accident, the flashing light was not operating at the time of the collision because of the amount of ambient light.

NTSB Railroad Accident Report 29

Locomotive Event Recorders. The locomotive on the struck train and the three locomotives on the striking train were all equipped with event recorders. Data from the struck train was downloaded and reviewed on scene. The data confirmed that the train was stopped at the time of collision and that the collision forces moved the locomotive forward about 17 feet. Data from the event recorders from the second and third locomotives on the striking train also were downloaded and reviewed on scene. On board the lead locomotive on the striking train, BNSF 9159, was a functionally integrated railroad equipment (FIRE) computer that monitored and recorded a number of operating parameters including those required by FRA event recorder regulations in 49 CFR 229.135. The FIRE computer also controlled the in-cab operating displays viewed by the locomotive engineer. Event recorder data were simultaneously stored in the FIRE computer memory and on a hard drive in a certified27 U.S. Department of Transportation crashworthy event recorder memory module. (See figure 18.) Because of extensive collision and fire damage to the lead locomotive, the FIRE computer on BNSF 9159 was destroyed. However, although it had been damaged by fire, the crashworthy event recorder memory module was recovered and shipped to the NTSB laboratory in Washington, D.C. (See figure 19.) The crash-hardened memory module case was opened, and the memory board was removed. Event recorder data were downloaded directly from the memory board to a computer.

27 Title 49 CFR 229.135 requires that the manufacturer, in this case Bach-Simpson, certify that the memory module meets standards contained in Appendix D to Part 229.

NTSB Railroad Accident Report 30

Figure 18. Intact exemplar crashworthy event recorder memory module.

Figure 19. Fire-damaged memory module recovered from BNSF 9159.

NTSB Railroad Accident Report 31

Locomotive Cab Video Recorders. The lead locomotive of the striking train, BNSF 9159, had a Wabtec Video Trax model forward-facing video recorder. The recorder hard drive enclosure was located in the wreckage, successfully recovered, and shipped to the NTSB laboratory in Washington, D.C. The enclosure and its contents were in poor condition because of the fire. (See figures 20 and 21.) Video data is stored on a hard drive within the enclosure. The hard drive was removed and transported to a vendor specializing in hard drive data recovery. After an examination and attempts to repair the damaged hard drive, it was determined that the hard drive was damaged beyond repair and its contents were unrecoverable. Forward-facing video recorders are not required by regulation.

Figure 20. Exemplar video recorder hard drive enclosure (orange case).

NTSB Railroad Accident Report 32

Figure 21. Fire-damaged video recorder hard drive enclosure from BNSF 9159. 1.9.7 Emergency Response The Montgomery County Sheriff‘s emergency dispatch logs indicate that a 911 call reporting the collision was received at 6:57 a.m. Six additional 911 calls reporting the collision were received over the next few minutes including a call from the BNSF NOC at 7:03 a.m. At that time, BNSF train traffic was suspended through the accident area. Emergency dispatch logs show that the first fire unit arrived at 7:10 a.m. Investigators interviewed the Red Oak fire chief, who served as incident commander (IC), and a volunteer firefighter, who served as liaison officer with the BNSF. The IC said that the emergency responders‘ first contact on scene was with the crew of the struck train, who said that the two crewmembers on the striking train may have jumped before the impact. A thorough search of the area, conducted by three different teams, did not locate either crewmember. The IC described first encountering diesel fires in three areas: (1) at the front of the lead locomotive of the striking train, (2) at the second locomotive of the striking train, and (3) at the Herzog clip car that had been struck in the collision, near the point of collision (the fire fed by a large diesel fuel tank). He described a small leak from the fuel

NTSB Railroad Accident Report 33

tank of BNSF 915928 and a much larger leak from the fuel tank on BNSF 6133.29 He also noted evidence of a flash fire on the west side of the highway overpass. The IC reported that it took about 2 hours to fully extinguish all the fires. Fire suppression began about 7:15 a.m., using 50 gallons of class A foam30 at 1.5 percent concentration. (See figure 22.) A supply of class B foam arrived on scene about 30 minutes into the response, and 150 gallons were consumed at 3 percent concentration. Fire suppression was complete about 9:15 a.m.

Figure 22. Red Oak Fire Department applying foam after collision. The Red Oak Fire Department (ROFD) liaison officer indicated that cooperation, communication, and support from the BNSF were ―very good.‖ Safety briefings were

28 A detailed postaccident examination of the BNSF 9159 did not reveal a breach in the fuel tank. There were a number of damaged diesel tanks from the MOW equipment on the flatcars that may have fed this fire. 29 Postaccident examination of BNSF 6133 confirmed a fuel tank breach. See section 1.2.6, ―Wreckage,‖ in this report. 30 Class A foam is designed for fires of combustible material. Class B foam is designed for flammable liquid fires. Red Oak Fire Department photo

NTSB Railroad Accident Report 34

held at appropriate points during the course of the emergency response, and BNSF personnel were responsive with information and resources. The IC reported that the pileup of cars and equipment on top of BNSF locomotive 9159 was judged to be too precarious and unsafe for ROFD personnel to attempt to reach the location of the crew‘s bodies. The BNSF‘s contractor was tasked with removing and/or shoring up equipment to make access safe. During removal of one of the last railroad cars from on top of BNSF 9159, the cab module was displaced and ended up on the south side of the locomotive. When the cab module was stabilized, hydraulic rams were used to open the skylight area of the roof of the cab module to provide access to the cab. The bodies of the striking train‘s crew were located about 4:09 p.m. and were removed about 4:38 p.m. The IC led the recovery team and indicated that the cab roof was crushed to the tops of the seats and there was open space between the floor and the seat tops. The crew‘s bodies were transported to Ankeny, Iowa, for autopsy following the Montgomery County coroner‘s instructions. The IC reported that the ROFD had participated in annual training with the BNSF and that he felt the ROFD was well prepared for a response to a railroad accident of this type. He noted that based on prior familiarization training, he was able to shut down the diesel engine on the second locomotive, BNSF 6133, that was still idling when the ROFD arrived at the scene. No emergency responders were injured during this incident. 1.9.8 Other Information Locomotive Crashworthiness and Fuel Tank Standards. In 1997 the FRA tasked the Railroad Safety Advisory Committee (RSAC)31 to ―investigate and develop, if necessary, crashworthiness specifications to ensure the integrity of the locomotive cab in accidents resulting from collisions such as highway-rail crossing accidents, sideswipes, and shifted loads.‖32 RSAC reviewed accident data from 1995 to 1996 and resolved the data pool into 23 types of accidents. Of these 23 types, RSAC selected five accident scenarios that encompassed the range of collisions that it believed the FRA intended for the investigation of crashworthiness specifications. The scenarios included the following:  In-line collision involving a train with two locomotives in the lead in which the second locomotive overrides the lead (the first) locomotive  In-line head-on collision of two trains in which one opposing locomotive overrides the other

31 Established by the FRA in 1996, RSAC provides a forum for consensus rulemaking. Representatives include railroads, labor organizations, suppliers, state agencies, and manufacturers. 32 FRA RSAC Task 97-1.

NTSB Railroad Accident Report 35

 Grade-crossing collision with a highway vehicle hauling logs in which the principal impact is on the window area of the locomotive  Oblique collision of a locomotive with an intermodal trailer  Oblique collision of a locomotive with a freight car Many modifications to the design of locomotives were investigated, tested, and compared with baseline locomotive designs. The modifications included shelf couplers, anti-climbers, modified collision posts, and increased strength of the window structure and the short hood. The modifications deemed most likely to improve locomotive integrity were strengthened window structures, collision posts, and short hoods, depending on the collision scenario. The AAR S-580 standard provides crashworthiness design criteria for all new locomotives used in occupied service and requires specific features to be incorporated into the equipment, such as underframe strength, collision post strength, anti-climbers on each end, emergency egress, and emergency lighting and interior requirements. The AAR S-5506 standard provides performance design criteria for all locomotives equipped with external fuel tanks and requires specific features to be incorporated into the design, such as structural strength requirements to improve crashworthiness in the event of minor derailments, a jackknifed locomotive, side impact collisions, and sideswipes, and to resist penetration and control spills. The FRA adopted both AAR S-580 and AAR S-5506 as regulatory requirements33 in a final rule on August 28, 2006. No locomotives with modular type crew cabs were in service at that time. Positive Train Control: BNSF Railway Electronic Train Management System. Positive train control (PTC) refers to technology that is capable of preventing train-to-train collisions, overspeed derailments, movement through an improperly lined switch, and injuries to or the deaths of workers on the right-of-way within work zones resulting from unauthorized train incursions. PTC systems vary widely in complexity and sophistication based on their level of automation and functionality, their system architecture, the wayside system upon which they are based (for example, non-signaled, block signal, cab signal), and their degree of train control. Before October 2008, various railroads were voluntarily installing PTC systems. However, the Rail Safety Improvement Act of 2008 (RSIA)34 mandated the widespread installation of PTC systems by December 31, 2015.

33 49 CFR 229.205 and 229.217. 34 Signed on October 16, 2008, as Public Law 110-432.

NTSB Railroad Accident Report 36

Currently, all affected railroads are pursuing the development and implementation of PTC in accordance with their PTC implementation plans, which are required by the RSIA, and that have been approved by the FRA. Railroads are adapting their individual PTC systems to maximize interoperability.35 The BNSF Railway, Union Pacific Railroad, Norfolk Southern Railway, and CSX Transportation are leading the interoperability effort with technology based on the Electronic Train Management System (ETMS) for rail traffic outside of the Northeast Corridor. Amtrak is undertaking a similar effort for rail traffic in the Northeast Corridor using the Advanced Civil Speed Enforcement System. The FRA has issued regulatory requirements for PTC systems on railroads that fall under RSIA as well as rail carriers that are continuing to implement PTC voluntarily. The FRA is also providing support through a combination of project safety oversight, technology development, and financial assistance. The BNSF has received FRA approval for full revenue deployment of its ETMS Version 1 on 35 subdivisions and has received type approval and system certification for the use of ETMS Version 6. The BNSF and the FRA are working together on testing a further enhanced version of ETMS on additional subdivisions, taking an incremental development step toward interoperability. The ETMS is an overlay type36 of system that enforces movement authority and speed restrictions for ETMS-equipped trains. This system works in conjunction with the existing methods of operation, including using input from the signal system to mitigate potential human error. At the time of this accident, ETMS was not installed at the accident site or on the locomotives. However, because both passenger and freight trains use this line, the BNSF is working on implementing ETMS on the Creston Subdivision before December 31, 2015, as mandated by the RSIA. When installed on the Creston Subdivision, ETMS will establish signals as targets.37 In the ETMS, a red restricting grade signal will be a target that requires restricted speed. The ETMS is designed to enforce the upper limit of restricted speed, which is 20 mph on the BNSF. As currently designed, upon reaching 3 mph over the 20-mph restriction (23 mph), a visual alarm will be displayed and an audible alarm sounded. If the engineer does not take action to reduce speed, a full service penalty brake application will be applied automatically to bring the train to a stop.

35 Interoperability is needed because railroads often operate their trains on tracks of other railroads. 36 The ETMS overlays the existing control system and enforces that system‘s requirements, instead of serving as a stand-alone control system that replaces the existing control system. 37 A target is a location where a train-handling action must be taken (stop or reduce speed). If no action is taken, the system provides a visual and audible warning. If the engineer does not take action, the system intervenes to apply braking automatically and bring the train to a stop.

NTSB Railroad Accident Report 37

A red stop signal at CP McPherson will also be a target. The ETMS will calculate a safe braking profile for a train and automatically stop a train short of a stop signal if the engineer does not take action to slow and then stop the train. As currently designed, the rear of a standing train will not be an ETMS target. Locomotive Alerters. BNSF road locomotives are equipped with an electronic alertness device that is called an ―alerter.‖ Alerters are designed to assist in maintaining the vigilance of the crewmembers in the locomotive cab and to apply train brakes should the device fail to detect activity. Alerters are programmed to detect engineer activity such as control lever movements, horn use, and several other parameters. When no activity is detected for a predetermined time, the alerter goes into an alarm sequence. BNSF representatives told investigators that almost all of their road locomotives are equipped with alerters and that all new locomotives are ordered with alerters. The following is the BNSF description and instructions provided in the Air Brake and Train Handling Rules, effective April 7, 2010: 104.12 Electronic Alertness Device An electronic alertness device stops the train with a service rate brake application if the engineer does not respond properly. It functions as follows:

1. The device begins functioning when locomotive brake cylinder pressure

falls below 25 psi.

1. At this point, the device monitors the operator‘s alertness.
2. It resets when the operator changes the position of or operates one of

these locomotive controls:  Throttle  Horn  Bell  Dynamic Brake, or  Device reset button  Radio transmit (on some alerter types)

NTSB Railroad Accident Report 38

• If the device is not reset within the reset cycle (varies relative to speed):

 A warning light flashes.  A warning horn sounds off and on for 10 seconds and then continuously for 10 seconds.

• If the device is not reset within 20 seconds after the warning light and

horn begin operating, the train brakes will automatically be applied at a service rate (Penalty Brake). The instructions make reference to a ―reset cycle,‖ (4, above). EMD locomotives, like the one on the head end of the striking train, have a reset cycle that works as follows: alerter inactivity is about 120 seconds for speeds from 0 to 40 mph. For speeds greater than 40 mph, the following formula is used to establish the time in seconds: 120 × (40/Speed in mph) The General Electric model specifications for the locomotives that BNSF uses have a reset cycle that works as follows: alerter inactivity is about 120 seconds for speeds from 0 to 20 mph. For speeds greater than 20 mph, the following formula is used to establish the time in seconds: 2,400/Speed in mph Because the striking coal train‘s speed did not exceed 40 mph, the alerter was designed to cycle (and alarm) about every 120 seconds for more than a 30-minute period before the time of the collision. This would have included the time after the striking train had passed the red restricting grade signal that required restricted speed operation. During the 15 minutes prior to the collision, the striking train alerter alarmed three times after periods of engineer inactivity and each time was reset using the alerter reset button after a strobe displayed for 5 seconds and an audible alarm sounded for an additional 2 to 3 seconds. The collision occurred 1 minute 53 seconds after a throttle movement, and the alerter would have been due to alarm in about 7 seconds had the collision not occurred. 1.9.9 Postaccident Actions On April 25, 2011, the BNSF issued a safety briefing document that was used with operating employees systemwide in briefing sessions about the factual circumstances of this accident and to review and emphasize the safety-critical nature of restricted speed requirements. The BNSF Nebraska Division implemented a pilot locomotive in-cab communication program—Reduce Exposure and Control Train (REACT)—that requires NTSB Railroad Accident Report 39

crewmembers to stay in the cab of the locomotive and to focus communications only on immediate responsibilities for safe train operation within 1 mile of the end of train authority limits. The purpose of this program is to heighten the crew‘s situational awareness during operations that are particularly critical for safety. Typically, the last mile before the end of train authority limits requires either operation at restricted speed or preparation for a full stop within the mile. This pilot program was introduced to labor leaders and union safety representatives with BNSF management marathons38 given to operating employees during September 2011. In the Red Oak accident, the end of the authority limit for the striking coal train was CP McPherson, at MP 447.5. The collision occurred about MP 448.3, which is 0.8 mile from CP McPherson, thus it was within the last mile before the end of the authority limit.

38 BNSF ―marathons‖ refer to meetings in which management conducts briefings on new programs or initiatives for operating employees. The sessions usually last for 36 continuous hours or three 8-hour sessions on consecutive days and involve meeting with train crews as they come on duty.

NTSB Railroad Accident Report 40

• Analysis

1. 1

Introduction This analysis includes discussion of the following safety issues identified in this report:  Train crew fatigue  Positive train control regulations and design  Crashworthiness of modular locomotive cabs  Survivability of electronic data This introductory section discusses those elements of the investigation that the NTSB determined were not factors in the accident. The balance of the analysis addresses the factors that were found to have caused or contributed to the accident, or to have contributed to its severity. The track, the signal system, the locomotives, and the rail cars were inspected and tested to the extent possible, and no defects were noted. Further, the striking coal train had received the required air brake tests and inspections before it departed Lincoln, Nebraska, before the accident, and no discrepancies were noted. Signal system data and postaccident tests and inspections indicated that the signals were functioning properly at the time of the collision. Sight-distance observations indicated that all signals were clearly visible. A standing exemplar rear car of the struck MOW equipment train was also clearly visible. The accident occurred in daylight with dry weather, and no visibility problems were reported. The coroner provided specimens taken from the deceased engineer and conductor. The crew on the standing train provided required postaccident toxicological specimens. All of the test results on these specimens were negative for illegal drugs and ingested alcohol. Medical records for the deceased engineer and conductor indicated that their vision and hearing were within the limits required for their positions. The MOW equipment train was standing at a stop signal on a track that it was authorized to occupy. NTSB Railroad Accident Report 41

Investigators obtained telephone records of personal cellular telephones belonging to both train crews. The records indicated that no calls or texts were initiated or received during the accident trip by the crewmembers of either train. The NTSB therefore concludes that the following were not factors in the accident: the condition of the track, railcars, or signal system; the weather; the visibility of signals; the use of cellular telephones by crewmembers; the vision and hearing of the crew; illegal drug or alcohol use, the actions of the train dispatcher and the crew of the MOW equipment train; or the mechanical condition of the locomotives of the striking coal train. 2.2 Striking Train Crew Performance After passing the red restricting grade signal, the crew of the striking train had ample opportunity to slow and stop their train to avoid a collision. However, neither crewmember applied the train‘s brakes to slow or stop the train despite the fact that the standing train ahead was visible for 43 seconds leading up to impact. During nearly 2 minutes before it struck the standing train, the train travelled nearly 3,344 feet. During this time, the striking coal train‘s speed increased because of the descending grade, and event recorder data indicate that no control inputs were made. Investigators examined the crew‘s work schedule factors, medical histories, and activities captured by the event recorder to better understand why the crewmembers took no action to stop the coal train before impact. 2.2.1 Work Schedule Factors During the week leading up to the accident, the engineer worked both day and night schedules. On the day of the accident, the engineer went on duty at 2:31 a.m. The day before, he was on duty from 4:30 a.m. to 2:30 p.m. He had not been called for duty on the 2 previous days. Although investigators were unable to determine his off-duty activities and rest periods during those days, it is likely that he was awake during the day and slept at night. During the 3 days immediately prior to that, he was on duty during the daytime for engineer recertification and official union activities. It is thus likely that for several days leading up to the day before the accident, the engineer was awake during the daytime hours and slept at night. Adjusting to different sleep schedules can take several days, depending on the difference between the previous and the current schedule.39 During this time, people often suffer from sleep disruption while trying to sleep during a different time of day, leading to a sleep-deprived state. On the day of the accident, the engineer probably was still adjusting to a nighttime work schedule after spending several days sleeping at night. Consequently, he may have experienced short-term sleep loss resulting in acute fatigue. The conductor had worked a nighttime work schedule over the 4 days leading up to the accident. Studies have found that the sleep quality of night shift workers, and

39 Information from the National Institutes of Health.

NTSB Railroad Accident Report 42

consequently their alertness levels, is generally inferior to those of people who work a normal (daytime) schedule.40 Thus the conductor‘s alertness level also may have been affected by her recent nighttime work schedule. The accident occurred at 6:55 a.m., just after sunrise, at a time of day when the crew may have been experiencing reduced alertness as a result of their circadian rhythms. Circadian rhythms are physical, mental, and behavioral changes that follow a roughly 24-hour cycle, responding primarily to light and darkness. They influence sleep-wake cycles, hormone release, body temperature, and other important bodily functions. Circadian rhythms and alertness levels are typically at their lowest between 3:00 a.m. and 5:00 a.m. and continue to rise for several hours after this. During these low periods, physiological and mental functioning are reduced and human performance is most degraded. Although the accident occurred about 2 hours after what is typically the lowest point in circadian rhythms, the crew were still at a relatively low point in this cycle and may have continued to be less alert and experiencing fatigue. Both the conductor and the engineer had worked irregular schedules for several weeks leading up to the accident. During this time, work start times often varied significantly from day to day for both crewmembers. Over the last month before the accident, the conductor, who had been on duty for 12 of the last 13 days before the accident, had start times that varied on consecutive days so that her start time was between 1 and 8 hours earlier or later than her start time on the previous day. For instance, on April 7, 8, and 9, her work start times were 2:16 p.m., 10:15 p.m., and 4:40 p.m., respectively. Similarly, for the engineer, over the last month his work start times often varied by several hours on consecutive days. For example, on April 8, 9, and 10, his shift start times were 12:40 a.m., 2:00 p.m., and 9:21 a.m., respectively. Changing work start and end times can make achieving adequate sleep more difficult. That is, irregular work schedules tend to disrupt a person‘s normal circadian rhythms and sleep patterns, which in turn can lead to chronic fatigue. Moreover, studies of train accidents have shown that very irregular schedules contributed to the accidents by producing sleep loss and fatigue.41 Therefore, the NTSB concludes that the striking coal train conductor‘s and the engineer‘s irregular work schedules contributed to their being fatigued on the morning of the collision. On the day before the accident, the crew operated their train from 4:30 a.m. to 2:30 p.m. and spent the night in a nearby hotel. After crews arrive at their terminals, sometimes they can get a reasonable estimate of their next on-duty time and attempt to adjust their sleep schedules to get sufficient sleep before their departure. For the striking coal train engineer in particular, who in the last few days was keeping a daytime schedule, getting adequate sleep before the start of his next shift would have been difficult. That is, rather than going to bed at nighttime, he would have to go to bed in the

40 G. Richardson and H. Malin, ―Circadian Rhythm Sleep Disorders: Pathophysiology and Treatment,‖ Journal of Clinical Neurophysiology, vol. 13, no. 1, January (1996), pp. 17–31. 41 W. Maynard and G. Brogmus, ―Shiftwork, work scheduling and safety: How much is too much,‖ 10th Annual Applied Ergonomics Conference (2007).

NTSB Railroad Accident Report 43

afternoon in order to receive sufficient sleep. This phase advance42 of several hours and would have resulted in significant sleep latency43 and shortened total sleep time.44 Moreover, because of the significant variability in their work schedules that had occurred often during the last month, the need of both crewmembers to adjust to significant phase advances may have resulted in a cumulative sleep debt. 2.2.2 Medical Factors Although the conductor had never undergone a sleep study, she had several risk factors for obstructive sleep apnea (OSA), including a BMI45 of 37.5, a history of hypertension, and long periods of sitting.46 OSA is a disorder characterized by repeated episodes of upper airway obstruction that results in recurrent arousals during sleep. The ―apnea‖ in OSA refers to a cessation of airflow that lasts at least 10 seconds. The cessation of airflow occurs when the muscles in the back of the throat fail to keep the airway open, despite efforts to breathe. Several studies have shown an association between BMI and the risk of OSA.47 Significant OSA is present in 40 percent of obese people.48 The conductor‘s BMI placed her within this risk group. The conductor was also being treated for high blood pressure with two prescription medications, but she still was hypertensive. OSA is associated with high blood pressure.49 Since people with sleep apnea tend to be sleep deprived, they often suffer from sleepiness and a wide range of other symptoms such as difficulty concentrating, depression, learning and memory difficulties, and falling asleep while at work, on the phone, or driving. Left untreated,

42 A phase advance is a backward shift in the 24-hour sleep-wake cycle. For example, shifting from an 11:00 p.m. to 7:00 a.m. sleep phase to an 8:00 p.m. to 4:00 a.m. sleep phase. 43 Sleep latency is the amount of time it takes to fall asleep after the lights have been turned off. 44 (a) S. Folkard and J. Barton, ―Does the ‗Forbidden Zone‘ for Sleep Onset Influence Morning Shift Sleep Duration?,‖ Ergonomics, vol. 36, no. 1–3 (January 1993), pp. 85–91. (b) T. Monk and others, ―Inducing Jet-Lag in Older People: Directional Asymmetry,‖ Journal of Sleep Research, vol. 9 (2000), pp. 101–116. (c) R. Manfredini and others, ―Circadian Rhythms, Athletic Performance, and Jet Lag,‖ British Journal of Sports Medicine, vol. 32 (1998), pp. 101–106. 45 Obesity is defined as a BMI of 30 and above, according to the National Institutes of Health. People who fall into the BMI range of 25 to 34.9 and have a waist size of over 40 inches for men and 35 inches for women are considered to be at especially high risk for health problems. 46 A joint task force of the American College of Chest Physicians, American College of Occupational and Environmental Medicine, and the National Sleep Foundation developed screening recommendations for drivers with possible OSA. Five major categories were identified. Additional evaluation was recommended for commercial drivers who had two or more of the following: A BMI > 35; a neck circumference greater than 17 inches for men and 16 inches for women; and hypertension (new, uncontrolled, or unable to control with less than two medications). 47 T. Young, P.E. Peppard, and S. Taheri, ―Excess weight and sleep-disordered breathing,‖ Journal of Applied Physiology, 99(4), Oct. (2005), pp. 1592–9 contains a list of studies that show the association between BMI and OSA risk. 48 A.N. Vgontzas and others, ―Sleep apnea and sleep disruption in obese patients,‖ Archives of Internal Medicine, vol. 154, no. 15, Aug 8 (1994), pp. 1705–11. 49 F.J. Nieto and others, ―Association of Sleep-Disordered Breathing, Sleep Apnea, and Hypertension in a Large Community-Based Study,‖ Journal of the American Medical Association, vol. 283, no. 14 (2000), pp. 1829–1836.

NTSB Railroad Accident Report 44

OSA can result in other clinical consequences including disturbed sleep, excessive sleepiness, high blood pressure, heart attack, congestive heart failure, cardiac arrhythmia, stroke, or depression.50 The conductor was treated for restless legs syndrome (a movement disorder that typically interferes with sleep) with ropinirole. Ropinirole is a medication for Parkinson‘s disease that sometimes results in sleepiness in Parkinson‘s patients. Additionally, she had been prescribed a medication for insomnia. Thus, it appears that she was not sleeping well, which may have resulted in her being fatigued. The conductor also had been prescribed an antidepressant medication. Lack of sleep has been linked to depression.51 The engineer had never undergone a sleep study, although he, too, had several risk factors associated with OSA: a BMI of 35.7; his gender (men are twice as likely as women to have sleep apnea); and job duties that required prolonged sitting. In addition, he had type 2 diabetes. Recent reports have indicated that the majority of patients with type 2 diabetes also have OSA.52 The NTSB concludes that based on their medical histories, both crewmembers on the striking coal train were at high risk for sleep disorders and fatigue. 2.2.3 Crew Actions Leading up to Collision Based on the indication of the clearly visible red (restricting) signal located almost 2 miles before the point of collision, the crew was required to operate their train at restricted speed—a speed that allowed the train to be stopped within one-half the range of vision short of another train, not to exceed 20 mph. Operating at restricted speed, they should have reduced speed and come to a stop short of the standing train. The crew, however, made no attempt to slow or stop the train during the last 1 minute 53 seconds before impact. As the striking train continued to travel around a curve, the operating crew would have been able to see the clearly visible car at the rear of the MOW train from more than 1/4 mile away (about 46 seconds before impact). This provided adequate time for them to apply emergency brakes that may have stopped, or at least slowed, their train before impact. However, despite having enough time to take action, the crew made no attempt to apply the brakes or stop their train to avoid the collision. During the last 15 minutes of the trip and while the striking train was approaching the standing MOW equipment train, the engineer reset the alerter by pressing the reset button three times after prompting by a lengthy strobe and audible alarm sequence.53

50 Information from the National Sleep Foundation. 51 N. Tsuno, A. Bessett, and K. Ritchie, ―Sleep and depression,‖ Journal of Clinical Psychiatry, vol. 66, no. 10 (2005), pp. 1254–1269. 52 E. Tasali, B. Mokhlesi, and E. Van Cauter, ―Obstructive sleep apnea and type 2 diabetes: interacting epidemics,‖ Ches, vol. 133, no. 2, Feb. (2008), pp. 496–506. 53 When the alerter system does not detect engineer activity, it will alarm (strobe light followed by horn). The alarm can be silenced by moving a control lever or by pressing the reset button.

NTSB Railroad Accident Report 45

These resets were initiated only after 5 seconds of flashing strobe and an additional 2 to 3 seconds of an increasingly louder audible alarm. The reset button requires less attentiveness than actually manipulating the controls of the engine. The operational documents issued to the crew of the striking coal train were reviewed. There were no speed restrictions, track bulletins, or other advisories in effect that would have required the crew‘s attention as their train crested the grade and approached the standing train. However, since the last signal required the striking coal train to operate at restricted speed, the 25-mph speed restriction did not apply to this train. Investigators could not identify any job-related activity that would have distracted the crew from focusing on operating the train in accordance with the restricting signal indication and preparing to stop short of a standing train ahead. Investigators considered the possibility that both the engineer and the conductor were impaired by fatigue at the time of the accident. In general, fatigue results in a reduction in alertness, longer reaction times, memory problems, poorer psychometric coordination, and less efficient information processing.54 Fatigue also could lead to the onset of an episode of microsleep, in which a person enters a sleeping period that lasts from a few seconds to as long as half a minute, becomes unresponsive, and fails to respond to outside information.55 However, given the crew‘s failure to attempt to slow or stop the train for nearly 2 minutes despite explicit warnings, it is likely that the crew was impaired by more than temporary fatigue-related loss of focus or an episode of microsleep. The NTSB concludes that based on the conductor‘s and the engineer‘s irregular work schedules, their medical histories, and their lack of action before the collision, both crewmembers on the striking coal train had fallen asleep due to fatigue. 2.3 Fatigue 2.3.1 Fatigue Education at BNSF In 2004, the BNSF developed a computer (and later, a web-based) fatigue training program, ―The Science of Sleep and Fatigue,‖ that was available to all BNSF employees.56 This training could be taken at a BNSF facility or at the employee‘s home. There are currently no Federal regulations requiring railroads to provide fatigue educational programs, nor does the BNSF require its employees to take this training. At the time of the accident, 239 BNSF employees, or about 1 percent,57 had voluntarily

54 I.D. Brown, ―Driver fatigue,‖ Ergonomics, vol. 36 (1994), pp. 298–314. 55 M.R. Rosekind and others, ―Alertness Management in Long-Haul Flight Operations,‖ in Proceedings of the 39th Annual Corporate Aviation Safety Seminar (St. Louis, Missouri: Flight Safety Foundation, 1994), pp. 167–178. 56 The BNSF stated that a significant portion of the information in this training program was originally developed by NASA for the aviation industry and later adapted to other safety-sensitive industries, including the railroad industry. 57 The fatigue training program is designed for the people (about 20,000) who work in the BNSF transportation department.

NTSB Railroad Accident Report 46

completed the fatigue training program. Neither the conductor nor the engineer of the coal train had taken this training. Investigators reviewed the BNSF training program and believe that it presents valuable and scientifically based information that would benefit railroad employees operating in safety-critical positions. The information presented in the BNSF‘s fatigue training program encourages people who are at risk of suffering from OSA or other sleep disorders to consult a physician. As stated previously, neither the engineer nor the conductor of the striking train had undergone a sleep study, although both were at risk for sleep apnea. The NTSB has a long history of making recommendations in all modes of transportation to reduce the likelihood of fatigue-related accidents. In the railroad industry, the scope of the NTSB‘s recommendations have included requiring railroads to use scientifically based principles when assigning work schedules; requiring railroads to design work schedules to minimize irregular and unpredictable work-rest cycles; establishing requirements that limit train crewmember limbo time; developing a standard medical form that includes questions about sleep problems; requiring serious and potentially impairing medical conditions to be reported to and evaluated by the carrier; and requiring railroads to develop fatigue awareness training. The NTSB concludes that had the two crewmembers on the striking coal train completed the BNSF‘s fatigue training program, they would have had the opportunity to learn that they were at risk for sleep disorders, particularly obstructive sleep apnea, and the computer-based training program would have displayed a message advising them to consult with a physician. Therefore, the NTSB recommends that the BNSF require all employees and managers who perform or supervise safety-critical tasks to complete fatigue training on an annual basis and document when they have received this training. 2.3.2 Fatigue Management and Rail Safety Improvement Act of 2008 Congress enacted the Rail Safety Improvement Act of 2008 (RSIA) following the September 12, 2008, head-on collision between a passenger train and a freight train in Chatsworth, California.58 The RSIA requires the Secretary of Transportation to require that most passenger and freight railroads develop fatigue management plans. The RSIA gives railroads 4 years after enactment of the law in which to develop these plans, which must include methods to manage and reduce fatigue experienced by railroad employees in safety-related positions and to reduce the likelihood of accidents, incidents, injuries, and fatalities caused by fatigue. There are several elements to the RSIA‘s fatigue

58 Collision of Metrolink Train 111 With Union Pacific Train LOF65–12, Chatsworth, California, September 12, 2008, Railroad Accident Report NTSB/RAR-10/01 (Washington, D.C.: National Transportation Safety Board, 2010). http://www.ntsb.gov

NTSB Railroad Accident Report 47

management plan requirements, many of which are relevant to this accident.59 Three of these elements are listed here and discussed below: Employee education and training on the physiological and human factors that affect fatigue, as well as strategies to reduce or mitigate the effects of fatigue, based on the most current scientific and medical research and literature. Opportunities for identification, diagnosis, and treatment of any medical condition that may affect alertness or fatigue, including sleep disorders. Scheduling practices for employees, including innovative scheduling practices, on-duty call practices, work and rest cycles, increased consecutive days off for employees, changes in shift patterns, appropriate scheduling practices for varying types of work, and other aspects of employee scheduling that would reduce employee fatigue and cumulative sleep loss. In a December 19, 2011, letter, the FRA advised the NTSB that it is ―currently in the process of drafting guidance for railroads to develop Fatigue Management Plans as part of a larger railroad risk reduction program.‖ The guidance is expected to be issued in early 2013. The FRA also has recently formed an RSAC working group to provide advice on developing fatigue management plans. Employee Education and Training on Fatigue. The NTSB believes that fatigue education and training should be required on a recurring basis for all railroad employees operating in safety-critical functions. The NTSB previously has recommended, and continues to strongly support, fatigue education and training for railroad employees. An RSAC working group on passenger hours of service, formed as a result of the RSIA, recommended that employees be required to take training on fatigue every 3 years. While the BNSF and many other railroads have developed fatigue training programs, most do not require their employees to take this type of training. An effective and comprehensive fatigue training program should cover the broad range of causation factors, countermeasures, and mitigation strategies; personal strategies for maintaining alertness (such as strategic napping); and medically based sleep disorders such as OSA that can affect a crewmember‘s ability to receive adequate sleep. The FRA and the Volpe National Transportation Systems Center are currently collaborating to develop a fatigue website for freight and passenger train crews. The website, which is expected to be launched in May 2012, is designed to appeal to a typical train operating employee—male, middle-aged, possibly overweight, who remains seated for long hours and often works unpredictable schedules. The website will offer text and video links to discussions of topics related to sleep and fatigue including scientific information about fatigue; practical strategies to deal with fatigue; and information on sleep disorders, such as OSA, insomnia, and restless legs syndrome. Railroads providing

59 Title 49 United States Code (U.S.C.), chapter 201, subchapter II, section 20156. ―Railroad safety risk reduction program.‖

NTSB Railroad Accident Report 48

passenger service are required by 49 CFR Part 228 to provide train operating employees with initial and refresher fatigue awareness training. The FRA advised the NTSB that fatigue awareness training requirements for freight operations will be discussed by the RSAC working group addressing fatigue management plans. Identification, Diagnosis, and Treatment of Medical Conditions Affecting Fatigue. Based in large part on the NTSB recommendations made after the 2001 train collision in Clarkston, Michigan,60 the FRA formed an RSAC working group on medical standards for safety-critical personnel. The NTSB safety recommendations from the Clarkston accident investigation are the following: To Canadian National Railway: Require all your employees in safety-sensitive positions to take fatigue awareness training and document when employees have received this training. (R-02-23) To the FRA: Develop a standard medical examination form that includes questions regarding sleep problems and require that the form be used, pursuant to 49 CFR Part 240, to determine the medical fitness of locomotive engineers; the form should also be available for use to determine the medical fitness of other employees in safety-sensitive positions. (R-02-24) Require that any medical condition that could incapacitate, or seriously impair the performance of, an employee in a safety-sensitive position be reported to the railroad in a timely manner. (R-02-25) Require that, when a railroad becomes aware that an employee in a safety- sensitive position has a potentially incapacitating or performance- impairing medical condition, the railroad prohibit that employee from performing any safety-sensitive duties until the railroad‘s designated physician determines that the employee can continue to work safely in a safety-sensitive position. (R-02-26) The first working group meeting was held on December 12–13, 2006, 5 1/2 years ago. The purpose of the working group was to enhance the safety of railroad employees and the public by establishing standards and procedures for determining the medical fitness for duty of personnel engaged in safety-critical functions. A physicians‘ task force, established by the working group, has been working since May 2007 on developing medical guidelines that will be used to provide consistent criteria for determining the medical fitness for duty of those in safety-critical positions. The task force has been compiling a list of medical conditions that can cause sudden incapacitation

60 Collision of Two Canadian National/Illinois Central Railway Trains Near Clarkston, Michigan, November 15, 2001, Railroad Accident Report NTSB/RAR-02/04 (Washington, D.C.: National Transportation Safety Board, 2002). http://www.ntsb.gov

NTSB Railroad Accident Report 49

and serious impairments of hearing and vision, determining the elements to be included in a health history form that covered employees will complete, and determining the medical criteria (standards) that a covered employee must meet to be certified. A draft Notice of Proposed Rulemaking (NPRM) was developed by the FRA and presented to the working group. The original target date for publishing the NPRM was December 2009. This NPRM was never published. It is disturbing that such an important railroad safety issue is taking this long to address. The FRA recently has advised the NTSB that a regulation to address medical fitness for duty of railroad safety critical personnel is no longer being considered because of the high cost to railroads. Instead, the FRA indicated that it will produce nonmandatory recommendations for the industry. The RSAC working group will be reconvened at some future date to finalize these recommendations. Obstructive sleep apnea will be addressed separately as part of the fatigue management regulation currently in development. The NTSB is disappointed that the FRA will not promulgate a requirement to ensure that operating employees in safety-sensitive positions are medically fit for duty. The NTSB concludes that had the requirements described in Safety Recommendations R-02-24, -25, and -26 been in place, this crew would likely have been identified as at high risk for sleep disorders, which may have led to appropriate medical intervention. Therefore, the NTSB recommends that the FRA require railroads to medically screen employees in safety-sensitive positions for sleep apnea and other sleep disorders. Additionally, the NTSB recommends that the BNSF medically screen employees in safety-sensitive positions for sleep apnea and other sleep disorders. The NTSB also reiterates Safety Recommendations R-02-24, -25, and -26 to the FRA and hopes that the FRA will take prompt action. Scheduling Practices for Employees. The NTSB previously has recommended incorporating scientifically based principles when creating work schedules. The NTSB is cognizant of several biomathematical models of fatigue and performance either currently used or proposed for use in various modes of transportation, including aviation and railroads, to help predict the risk of incidents caused by crewmember fatigue based on work schedules and opportunities to sleep. Biomathematical models of fatigue attempt to predict the effects of various work patterns on job performance. They also consider scientific input about the relationship among working hours, sleep, and employee performance. The FRA is advocating the use by commuter and passenger railroads of models that the FRA indicated have been validated and calibrated, such as the Fatigue Avoidance Scheduling Tool and the Fatigue Audit InterDyne Model.61 The RSIA does not specify the role of the FRA in evaluating the railroad industry‘s use of biomathematical models of fatigue and performance. The NTSB is aware, however, of some general limitations regarding the use of these models. For instance, in general, biomathematical models have been calibrated to represent a population average rather than real-time fatigue levels of a specific

61 The FRA has conducted an evaluation of six of the most recognized alertness models and is currently funding a project to develop a method of correlating the results among models.

NTSB Railroad Accident Report 50

individual.62 It is unclear how individual differences (such as age, sex, and operating experience) may affect the output of these models. Additionally, biomathematical fatigue models predict risk factors for an average healthy person; thus, the output may not accurately predict the risks to a crewmember who may have medical conditions or otherwise not be fully fit for duty. The NTSB further recognizes that biomathematical models may not consider all factors affecting fatigue such as workload (mental or physical, high or low cognitive demand), the operating environment (including lighting, temperature, and noise level), and pharmacological agents, for example, caffeine and changes in adrenaline levels due to stressors. Other factors that may not be represented in biomathematical models include stressors in the workplace (that is, time pressure, social friction) and aspects of the work (such as monotony and repetitive motion).63 Studies have pointed out the need for additional research to determine whether one or more of these work-related factors are important alone or in interaction with sleep/wake cycles and circadian dynamics, especially for risk-focused models.64 The NTSB notes that several studies have concluded that fatigue model predictions cannot be the sole means upon which fatigue risk management operational decisions are made.65 The NTSB concludes that because biomathematical models of fatigue are relatively new to the railroad industry, the use of this technology should be evaluated for its effectiveness within the context of railroads‘ fatigue management plans through independent scientific peer review. Therefore, the NTSB recommends that the FRA establish an ongoing program to monitor, evaluate, report on, and continuously improve fatigue management systems implemented by operating railroads to identify, mitigate, and continuously reduce fatigue-related risks for personnel performing safety-critical tasks, with particular emphasis on biomathematical models of fatigue. 2.3.3 Locomotive Alerters Locomotive alerter technology was developed to provide a countermeasure to operator fatigue and incapacity.66 Alerters in use on North American railroads have evolved from a ―deadman pedal‖67 to the type of activity-based alerter installed on the striking coal train locomotive. The current type of alerter commonly in use on North American railroads detects engineer activity through control handle movements. When activity is not detected for a predetermined time interval, an alarm is activated that

62 Biomathematical Fatigue Modeling in Civil Aviation Fatigue Risk Management, Australian Government Civil Aviation Safety Authority Human Factors Section, March 2010. 63 D. Dinges, ―Critical Research Issues in Development of Biomathematical Models of Fatigue and Performance,‖ Aviation, Space, and Environmental Medicine, vol. 75, no. 3, section II, March (2004). 64 D. Dinges references relevant studies. 65 D. Dinges references relevant studies. 66 C.M. Oman and A.M. Liu, Locomotive In-Cab Alerter Technology Assessment, Man Vehicle Laboratory Report #07.30 (Cambridge, MA: Massachusetts Institute of Technology, 2007) provides a good historical overview. 67 A deadman pedal is a device that was used on some early diesel and electric locomotives. The engineer was required to keep the pedal depressed to keep the locomotive moving. If the pedal was released while the locomotive was in motion, braking was automatically activated.

NTSB Railroad Accident Report 51

can be reset by manipulating a reset button or moving a control handle. The alerter time interval is typically programmed to be speed dependent, with the alerter set to alarm at a shorter time interval at higher speeds. Previous Alerter Recommendations. The NTSB has investigated dozens of railroad accidents over the decades in which crew alertness was a causal factor, and it has repeatedly examined the role of locomotive alerter technology. In its investigation of the collision of two Consolidated Rail Corporation (Conrail) freight trains in 1988,68 the NTSB found that the accident was caused by the sleep-deprived condition of the crew and their consequent failure to comply with a signal. After examining the role of alerters in that accident, the NTSB concluded that had the locomotive of the striking train ―been equipped with a state-of-the-art alertness device, the train would have been stopped and the collision would have been avoided.‖ In the collision of two Norfolk Southern Railway freight trains at Sugar Valley, Georgia,69 on August 9, 1990, the crew of one of the trains failed to stop at a signal. The NTSB concluded that the engineer of that train was probably experiencing an episode of microsleep or was distracted. Postaccident testing indicated that as the train approached the stop signal, the alerter would have begun an alarm cycle. The NTSB concluded that the engineer ―could have cancelled the alerter system while he was asleep by a simple reflex action that he performed without conscious thought.‖ As a result of the investigation, the NTSB made the following recommendation to the FRA: In conjunction with the study of fatigue of train crewmembers, explore the parameters of an optimum alerter system for locomotives. (R-91-26) The FRA responded to this recommendation on June 28, 1993, stating that it had ―awarded two contracts to develop proposals to modify the existing alerter systems so that they cannot be reset by reflex action.‖ In a follow-up letter dated August 12, 1997, the FRA told the NTSB that although a proposal for a prototype had been developed, the contractor had told the FRA that it ―could not see a market for the device large enough to justify its further development.‖ The FRA told the NTSB that it believed that the lack of a market was a result of the FRA‘s own ―announced determination‖ to support positive train separation technology. As a result, the NTSB classified Safety Recommendation R-91-26 ―Closed—Unacceptable Action‖ on November 4, 1997.

68 Head-end Collision of Consolidated Rail Corporation Freight Trains UBT-506 and TV-61 Near Thompsontown, Pennsylvania, January 14, 1988, Railroad Accident Report NTSB/RAR-89/02 (Washington, D.C.: National Transportation Safety Board, 1989). http://www.ntsb.gov 69 Collision and Derailment of Norfolk Southern Train 188 with Norfolk Southern Train G-38 at Sugar Valley, Georgia, August 9, 1990, Railroad Accident Report NTSB/RAR-91/02 (Washington, D.C.: National Transportation Safety Board, 1991). http://www.ntsb.gov

NTSB Railroad Accident Report 52

As a result of an investigation into a July 2, 1997, sideswipe collision between two Union Pacific Railroad (UP) freight trains in Delia, Kansas,70 the NTSB concluded that ―had the striking locomotive been equipped with an alerter, it may have helped the engineer stay awake while his train traveled through the siding.‖ As a result of its investigation, the NTSB made the following recommendation to the FRA: Revise the Federal regulations to require that all locomotives operating on lines that do not have a positive train separation system be equipped with a cognitive alerter system that cannot be reset by reflex action. (R-99-53)71 In an April 28, 2000, letter, the FRA told the NTSB that it had issued regulations requiring that ―each passenger train not equipped with a positive train separation system be equipped with a working dead man or alerter.‖ Although this was an important safety improvement, the FRA‘s regulations neglected to address the critical components of Safety Recommendation R-99-53. The FRA‘s regulations applied only to passenger trains, and they did not require the installation of cognitive alerters. On September 25, 2000, the NTSB responded that it was disappointed that the FRA‘s new safety standards applied only to passenger locomotives and not to freight locomotives. The NTSB classified Safety Recommendation R-99-53 ―Closed—Reconsidered‖ on August 6, 2002, after concluding that the type of cognitive alerter envisioned at the time the recommendation was issued did not exist. As a result of its investigation of the Delia accident, the NTSB also recommended that the UP Install a cognitive alerter system that cannot be reset by reflex action on all locomotives that operate on lines that do not have a positive train separation system. (R-99-59) In a response dated October 31, 2000, the UP told the NTSB that the alerters it was installing on some existing locomotives and on new locomotives were ―cognitive … [and] considered to be state-of-the-art in the industry.‖ The UP letter added that although ―the level of cognition is not optimal, there are no more sophisticated alerters available in the market today.‖ Based on the UP‘s response, the NTSB classified Safety Recommendation R-99-59 ―Closed—Acceptable Alternate Action‖ on April 24, 2001. The most recent NTSB recommendations relating to locomotive alerters were made as a result of an investigation into a head-on collision between two freight trains

70 Collision Between Union Pacific Freight Trains MKSNP-01 and ZSEME-29 near Delia, Kansas, July 2, 1997, Railroad Accident Report NTSB/RAR-99/04 (Washington, D.C.: National Transportation Safety Board, 1999). http://www.ntsb.gov 71 Currently, all alerters are reset by reflex action or manipulation of the train controls. In 1999, a cognitive alerter was considered to be an alerter that would have required more than a simple reflex action from the crew.

NTSB Railroad Accident Report 53

near Anding, Mississippi.72 In that accident, the northbound train overran a stop signal at high speed, likely as a result of fatigue-related inattention. The resulting head-on collision claimed the lives of all crewmembers on both trains. The controlling locomotive on the overrunning train was not equipped with an alerter. The NTSB noted that There was a 4-minute time period after passing the approach signal during which the alerter would have activated four to five times. It seems unlikely that the engineer could have reset the alerter multiple times by reflex action without any increase in his awareness. Therefore, an alerter likely would have detected the lack of activity on the part of the engineer and sounded an alarm that could have alerted one or both crewmembers. Based on the Anding collision investigation, the NTSB made recommendations on alerters to the FRA and to all Class I railroads. To the FRA: Require railroads to ensure that the lead locomotives used to operate trains on tracks not equipped with a positive train control system are equipped with an alerter. (R-07-1) In an NPRM published in the Federal Register on January 12, 2011,73 the FRA provided notice of its intent to revise existing railroad locomotive safety standards, including regulations on alerters. The NPRM section on alerters proposes to require locomotives that operate over 25 mph to be equipped with an alerter meeting specified performance standards. One of the performance standards relates to the requirement that the alerter will reset in response to at least three different commands. The FRA describes the intent of the reset requirements as follows: Utilizing several different reset options for the warning timing cycle increases the effectiveness of the alerter, as it would require differentiated cognitive actions by the operator. This will help prevent the operator from repeating the same reset many times as a reflex, without having full awareness of the action. The NPRM public comment period closed on March 14, 2011. On April 9, 2012, the FRA published a final rule in the Federal Register74 revising 49 CFR 229.140, adding the requirement for alerters on freight trains to the locomotive safety standards. The new regulation requires that a locomotive placed in service on or after June 10, 2013, be equipped with a functioning alerter when used as a controlling locomotive and if operated in excess of 25 mph. Petitions for reconsideration must be received on or before

72 Collision of Two CN Freight Trains, Anding, Mississippi, July 10, 2005, Railroad Accident Report NTSB/RAR-07/01 (Washington, D.C.: National Transportation Safety Board, 2007). http://www.ntsb.gov 73 76 Federal Register (January 12, 2011), pp. 2400–2238. 74 77 Federal Register (April 9, 2012), pp. 21312–21357.

NTSB Railroad Accident Report 54

June 8, 2012. As with all of the FRA‘s regulatory requirements, the requirements related to alerters are minimum Federal safety requirements that do not prohibit railroads from doing more to improve railroad safety. Based on industry meetings, the NTSB understands that the industry is considering establishing industry requirements that would be more restrictive than the Federal requirements. The NTSB fully supports such an effort by the industry. Based on the intent of the requirements of the locomotive safety standards, accordingly, Safety Recommendation R-07-1 is classified ―Closed—Acceptable Action.‖ To All Class I Railroads: Ensure that alerters are installed on all your lead locomotives used to operate trains on tracks not equipped with a positive train control system. (R-07-8) This recommendation has been closed for five of the seven Class I railroad recipients. Table 3 shows all the recipients of the recommendation, the current classification of the recommendation, and the date the recommendation was closed, if applicable. Table 3. Safety Recommendation R-07-8 Status. Recipient/Class I Railroad Current Classification Date Closed BNSF Closed—Reconsidered October 5, 2007 Canadian National Railway Company Closed—Acceptable Action June 22, 2011 Canadian Pacific Railway Open—Acceptable Response N/A CSX Transportation Closed—Acceptable Action May 11, 2010 Kansas City Southern Railway Company Open—Await Response N/A Norfolk Southern Corporation Closed—Reconsidered February 29, 2008 Union Pacific Railroad Closed—Reconsidered August 19, 2010

The Kansas City Southern Railway Company‘s entire road locomotive fleet is equipped with alerters. Therefore, this recommendation to Kansas City Southern Railway Company is classified ―Closed—Acceptable Action.‖ The Canadian Pacific Railway‘s entire main line fleet of 6-axle locomotives is equipped with alerters. Some 4-axle locomotives used in yard service and operating in road switcher service on the Canadian Pacific Railway‘s U.S. lines are not equipped with alerters. Also, all new 4-axle locomotives purchased are equipped with alerters including the replacements for the 4-axle fleet. The recommendation to the Canadian Pacific Railway remains ―Open—Acceptable Response.‖

NTSB Railroad Accident Report 55

Although the NTSB considers a safety-redundant PTC system (not alerters) to be the preferred method for preventing collisions, it recognizes that there will be tracks that are not PTC equipped on many miles of the U.S. railroad network. Even had PTC been in place at the location of the Red Oak accident, the current PTC designs will not always prevent restricted-speed collisions. The circumstances of this accident demonstrate that collisions in the 20 mph range can have catastrophic consequences. Additionally, freight trains carrying hazardous materials can have a devastating effect on communities should the materials be released as a result of an accident, even at restricted speeds. Alerters will remain an important safety device that can prevent unsafe train operation after an engineer becomes unresponsive for a prolonged period of time. Alerters and the Red Oak Collision. In the Red Oak accident, since train speed before the collision was less than 40 mph for more than 20 minutes, the alerter alarmed at about 2-minute intervals if no engineer activity was detected. The Red Oak collision occurred at a time when restricted speed was required. Safe operation at restricted speed requires maximum crew vigilance and alertness. The alerter installed on the striking train in the Red Oak accident was programmed to alarm after about 2 minutes with no activity detected. At higher speeds, it was programmed to have a shorter alarm cycle. Railroad restricted speed is not a numerical value. The restricted speed rule on most railroads starts with the phrase, ―… movement must be made at a speed that allows stopping within half the range of vision short of ….‖ This phrase is followed by a list of potential hazards such as train, engine, and railroad car. To ensure the safe operation of following trains, this performance portion of the restricted speed rule must be stressed rather than the importance of any maximum speed limit (20 mph on the BNSF). Several recent rear-end collisions of railroad trains in which crewmembers failed to operate their trains at the required restricted speed are discussed in this report in section 2.4.1. The operation of the striking coal train in the vicinity of the grade signal at a speed of 11 to 12 mph is more consistent with the operational intent of restricted speed (stopping in one-half the range of vision). Visibility was good, and the train brakes were functioning properly. Had this speed been maintained and had the crew been alert to the clearly visible standing MOW equipment train, they could easily have stopped short and prevented the accident. Therefore, the NTSB concludes that had the crew of the striking coal train been alert and operated their train in accordance with restricted speed requirements, the collision would have been prevented. Previously, the NTSB has noted that alerter reset and even minor locomotive control adjustments can occur during microsleep. The following excerpt from the NTSB‘s report on the collision of a Union Pacific freight train with a BNSF freight train at Macdona, Texas,75 explains this phenomenon.

75 Collision of Union Pacific Railroad Train MHOTU-23 With BNSF Railway Company Train MEAP- TUL-126-D With Subsequent Derailment and Hazardous Materials Release, Macdona, Texas, June 28, 2004, Railroad Accident Report NTSB/RAR-06/03 (Washington, D.C.: National Transportation Safety Board, 2006). http://www.ntsb.gov

NTSB Railroad Accident Report 56

That the [Macdona] engineer could have remained sufficiently alert to make train control inputs and yet be unable to respond to vitally important signal indications may be explained by the fact that making such inputs and manipulating the alerter are highly practiced, nearly reflexive, motor responses that require only lower level cognitive effort. During the engineer‘s transition from wakefulness into the normal perceptual disengagement of unintended sleep, his capacity for information processing would have been severely compromised. Thus, he could have been able to continue the reflexive control activities while being unable to perform the higher level cognitive tasks of extrapolating information from the signal indications. In the Red Oak collision, the last throttle change occurred 1 minute 53 seconds before impact. After that throttle change, the train travelled 3,344 feet and speed increased from 18 to 23 mph. The rear car of the standing train was visible for 1,364 feet. During the last 1,364 feet of travel, there was no recorded activity by the engineer and the train speed increased from 20 to 23 mph. The rear of the standing train would have been visible to the crew of the striking train for about 43 seconds. The event recorder indicated that neither the engineer nor the conductor applied the brakes before impact. The alerter had sounded three times in a period of 12 minutes, and the engineer had silenced (reset) the alerter after each alarm, but the alerter was not effective in that the engineer did not respond by controlling train speed and stopping the train before the collision. The emergency brakes applied only as a result of collision damage to the airbrake system. The FRA‘s requirement that alerters be installed on passenger trains and the NPRM to require alerters on freight trains operating above 25 mph will have positive safety benefits. However, it is appropriate to revisit the need for technology that is more effective, particularly during safety-critical operations such as restricted speed. PTC as currently designed will allow restricted speed movements on tracks carrying both freight (including hazardous materials) and passenger trains. At the time of the Red Oak collision, the alerter was programmed to activate about every 2 minutes if no engineer activity was detected. While the train was operating at about 20 mph, it travelled nearly 3,520 feet between each cycle.76 The use of restricted speed to allow following trains to enter a block of track occupied by another train is a common and necessary railroad operating practice. Given the limitations of existing alerter technology, it is prudent for railroads to examine the possible role of technology to assist crews in maintaining vigilance as well as to result in intervention when lapses in vigilance occur. Restricted speed is a high-risk railroad operation usually involving following or conflicting movements with the potential for collisions. According to event recorder data, the Red Oak alerter functioned according to specifications and the engineer reset the alerter when it activated. During the critical last 1 minute 53 seconds before impact, no control inputs were made by the crew nor were they required by the alertness device installed on BNSF 9159.

76The following formula was used to determine this distance: ((20 x 5,280 feet) / 3600 seconds) x (120 seconds) = feet traveled in 2 minutes.

NTSB Railroad Accident Report 57

During the last 15 minutes before impact, there were three alerter alarms that were acknowledged by the engineer only after a 5-second strobe was followed by several seconds of audible warning. In previous railroad accident investigations, the NTSB has concluded that a risk of alerters is that they can be reset by reflex action, as if they were ―snooze alarms.‖ The most likely explanation for the striking train engineer‘s waiting to take action until the audible alarm sounded is that the engineer was asleep, and he was not aware of the alerter alarm until the audible component roused him. If the engineer was asleep, the audible portion of the alerter alarm may have roused him long enough to reset the alarm but not long enough to take continued action to control the train, thus defeating the safety function of the alerter: stopping the train when an engineer becomes incapacitated. This reveals a limitation of alerters: they do not mitigate fatigue but are a last resort to stop a train when an engineer becomes incapacitated and inactive for a prolonged period. Limitations of Alerters. The FRA Collision Analysis Working Group77 found that nearly 30 percent of collisions over a 5-year period involved lack of alertness as a probable contributing factor. In those collisions, about 70 percent of the locomotives involved were equipped with alerters. Oman and Liu78 cite a study by an unidentified major freight railroad indicating that its trains experienced four alerter-induced penalty braking events79 during the first 6 months of 2006. They extrapolate this number to the U.S. railroad network and estimate that there would have been several dozen such alerter-induced penalty brake applications in a 12-month period. They conclude, ―clearly, conventional alerters are not preventing all fatigue and alertness related accidents.‖ Most important, current alerter technology does not address the underlying cause of fatigue-related inattention: fatigue. A sleeping engineer who is roused by the alerter remains fatigued and is still at higher risk of having an accident. There are a number of initiatives aimed at addressing fatigue before a crew goes on duty. Fatigue training, medical monitoring, and schedule analysis are all proactive approaches that are mandated by the RSIA. Although addressing fatigue before a fatigued crew is called on duty is a preferred approach, the Red Oak collision and the other fatigue-related accidents investigated by the NTSB suggest that a broader technological approach is needed to help identify fatigued train crews once they go on duty. The optimum strategy is to address fatigue, but alerter devices will remain one element of a risk-mitigation strategy, and other

77 Collision Analysis Working Group Final Report (Washington, D.C.: U.S. Department of Transportation, Federal Railroad Administration, 2006). 78 C.M. Oman and A.M. Liu, Locomotive In-Cab Alerter Technology Assessment, Man Vehicle Laboratory Report #07.30, excerpted from Development of Alternative Locomotive In-Cab Alerter Technology: Final Technical Report (Cambridge, MA: DOT Volpe National Transportation Systems Center, 2006). 79 An alerter-induced penalty brake event, or brake application, occurs when an engineer fails to respond to visual and audible warnings for up to 25 seconds, causing the alerter system to stop the train.

NTSB Railroad Accident Report 58

technological methods for detecting and addressing fatigued crews on duty need to be explored. Larger railroads now use technology to monitor engineer train handling performance, in some cases on a near real-time basis. Typically, this is achieved by computer-driven analysis of event recorder data. Exception reports are produced and communicated to managers when certain criteria are met such as emergency braking or fuel-inefficient throttle use. These systems allow timely communication with crews to investigate certain events and to identify the need to provide training and coaching to improve performance where warranted. FRA researchers have previously suggested80 using event recorder data as an evaluation tool to assess the effectiveness of fatigue management interventions. The NTSB believes that this same approach may have value for identifying fatigued engineers proactively. Event recorder and alerter data inputs could be used to develop a ―fatigue signature‖ that could result in management intervention. An alerter-induced penalty brake application is one element of such a signature. As geographic databases are created to support PTC, it will be possible, for example, to coordinate locations of grade crossings with whistle use; when a locomotive whistle is not sounded at a crossing, it is often an indicator of crew inattentiveness. In the future, if railroads implement the NTSB‘s recommendations on inward-facing video cameras,81 image analysis technology could be used to activate an in-cab alerter device when an engineer appears to have fallen asleep on a moving train, and also to provide an alert to a dispatch center to trigger a timely intervention. The NTSB concludes that locomotive alerters only detect engineer inactivity and should not be used as a substitute for an effective fatigue mitigation strategy. Therefore, the NTSB recommends that the FRA conduct research on new and existing methods that can identify fatigue and mitigate performance decrements associated with fatigue in on-duty train crews. The NTSB further recommends that the FRA require the implementation of methods that can identify fatigue and mitigate performance decrements associated with fatigue in on-duty train crews that are identified or developed in response to the previous recommendation.

80 M. Coplen and D. Sussman, ―Fatigue and alertness in the United states (sic) railroad industry part II: Fatigue research in the Office of Research and Development at the Federal Railroad Administration,‖ Transportation Research Part F, January 15, 2001. 81 Collision of Metrolink Train 111 With Union Pacific Train LOF65–12, Chatsworth, California, September 12, 2008, Railroad Accident Report NTSB/RAR-10/01 (Washington, D.C.: National Transportation Safety Board, 2010). http://www.ntsb.gov

NTSB Railroad Accident Report 59

1. 4

Restricted Speed Accidents 2.4.1 Recent Restricted Speed Accidents Beginning with the Red Oak accident, from April through August 2011, five rear- end collisions of railroad trains occurred in which crewmembers failed to operate their trains at the required restricted speed: (1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011. Details of these accidents and an additional restricted speed accident that occurred January 6, 2012, are at appendix E. Information obtained by NTSB investigators indicates that the train crews in the five 2011 accidents failed to operate their trains at the required restricted speeds. Two of the accidents resulted in crewmember fatalities. Four of the accidents occurred on railroad lines over which Amtrak passenger trains operate. Because these accidents occurred on different railroads and under different circumstances, the NTSB is concerned that noncompliance with restricted speed requirements may be an issue affecting a broad segment of the U.S. railroad industry. During train operations, the signal system or train dispatcher can often provide safe separation between trains moving in either the same direction or the opposite direction. However, there are times when trains must be authorized to occupy the same sections of track. In these cases, safe train operation relies solely on crewmember compliance with the railroad‘s restricted speed requirements. The NTSB believes all railroads should be informed about the circumstances identified in these accidents. In addition, the NTSB believes all railroads should emphasize adequate training and ensure the compliance of train crews operating at restricted speeds. Therefore, on January 23, 2012, the NTSB issued safety recommendations to the Association of American Railroads (R-11-8) and to the Brotherhood of Locomotive Engineers and Trainmen and the United Transportation Union (R-11-10):

Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear- end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011—to urge your members to undertake a review of their operations to identify the potential for similar occurrences and to take appropriate mitigating actions. (R-11-8) On January 12, 2012, the AAR sent an e-mail to the Class 1 railroad officers responsible for rule compliance. In addition, the AAR held a conference call the following day with representatives from each of the Class 1 railroad safety departments

NTSB Railroad Accident Report 60

and further reviewed the occurrences of the five aforementioned train accidents. As a result, AAR staff reviewed the substantive elements of Safety Recommendation R-11-8 with the AAR Risk Management Working Committee that consists of senior safety and risk managers on all of the Class 1 railroads. Consequently, Safety Recommendation R-11-8 to the AAR is classified ―Closed—Acceptable Action.‖ Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear- end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011—to do the following: • Emphasize to your members the importance of operating their trains in accordance with restricted speed operating rules. • Urge your members to work with their employers to identify the potential for similar occurrences and to take appropriate mitigating actions. (R-11-10) The United Transportation Union published an article in its February 2012 issue of the UTU News urging unions, their members, carriers and the FRA to work collaboratively to ensure compliance with speed restrictions by train and engine crews. The article included the following addressing restricted speed: Typically, these requirements include being prepared to stop within one-half the range of vision. Complete understanding of, and strict compliance with, restricted speed requirements are absolutely mandatory to prevent catastrophic train collisions. In addition, the Brotherhood of Locomotive Engineers and Trainmen (BLET) printed a similar editorial in its March 2012 Locomotive Engineers & Trainmen News noting, ―Emphasize to your members the importance of operating their trains in accordance with restricted speed operating rules.‖ BLET National President Dennis R. Pierce advised the NTSB in a March 2, 2012, letter that he would be making BLET members aware of the rear-end collisions and the need to refocus on operating at restricted speed. He wrote, ―I fully agree that operating trains in strict accordance with restricted speed operating rules is a job-saver and a lifesaver.‖ He continued— BLET members work in one of the most safety-critical environments in the world, and their increased focus on restricted speed operations in light of these accidents is part of the professional performance of their duties that we intend to stress. Therefore Safety Recommendation R-11-10 issued to the BLET and the United Transportation Union is classified ―Closed—Acceptable Action.‖

NTSB Railroad Accident Report 61

Also on January 23, 2012, the NTSB issued safety recommendations to the Federal Railroad Administration (R-11-6 and -7), to the Association of American Railroads (R-11-9), and to the American Short Line and Regional Railroad Association (R-11-8 and -9). The recommendations are listed in section 4.2, ―Previously Issued Recommendations.‖ 2.4.2 Restricted Speed and Positive Train Control In this accident, had a PTC or Electronic Train Management System82 (ETMS) been installed on the Creston Subdivision, it would have established the red restricting grade signal as a target and the system would have enforced the upper limit of restricted speed (20 mph on the BNSF). An ETMS onboard locomotive display unit would have shown a ―restricted speed fence‖ (that is, diagonal lines on the display) and would have required restricted speed. Upon reaching 3 mph over the 20-mph restriction (23 mph),83 a visual alarm would have been displayed and an audible alarm would have sounded. If the engineer did not take action to reduce speed, a full service penalty brake application would have been applied automatically, bringing the train to a stop. If the ETMS had been installed on the Creston Subdivision, as currently designed it would have conveyed a visual and audible warning to the crew when a speed of 23 mph was detected. In this accident, after passing the red restricting grade signal, had the ETMS been installed, it would have identified the next target as the stop signal at CP McPherson. The ETMS system would have sounded a warning based on the braking profile of the train and initiated automatic braking to stop the train before it reached the CP McPherson stop signal (not the rear of the standing MOW train). The stopped train that stood between the grade signal and the CP McPherson stop signal would not have shown up on the display of the approaching coal train. As the ETMS is currently designed, the rear end of the standing train would not have been a target. The NTSB, therefore, concludes that had the PTC/ETMS currently in development been installed on the Creston Subdivision, it most likely would not have prevented this accident because it does not identify the rear end of a standing train as a target and because it allows following movements at up to 23 mph. The NTSB emphasized the importance of preventing accidents when trains are operated at restricted speed in its response to the FRA‘s NPRM, ―Positive Train Control Systems,‖ that was published in the Federal Register on July 21, 2009. The FRA had mentioned that PTC technology does not protect following trains proceeding at restricted speed into an occupied block (the circumstances in this accident at Red Oak). The NTSB‘s comments on the proposed rulemaking included the following:84

82 ETMS is the system the BNSF is installing to comply with the regulatory requirement for PTC. 83 Event recorder data indicate that the striking train‘s speed increased from 22 mph to 23 mph about 5 seconds before impact. 84 NTSB, Office of the Chairman, To U.S. Department of Transportation, Docket Management Facility, Attention: Docket No. FRA-200800132, Notice No. 1, August 18, 2009.

NTSB Railroad Accident Report 62

Train-to-Train Collisions at Restricted Speed Although the NTSB recognizes that proposed PTC requirements will prevent high-speed collisions, the NTSB also recognizes that railroads may need to move trains at restricted speeds and, as noted in Subpart I, train-to-train collisions at restricted speeds could still occur. Current PTC systems do not track the location of the rear end of each train and do not use the rear location as a target to determine where following trains must stop. The NTSB urges the FRA and the railroads to work on developing technology that will improve the prevention of rear-end collisions at restricted speeds and to incorporate that technology into existing PTS systems as it becomes available. After receiving the NTSB‘s concerns, the FRA continued to focus on the absolute speed limit when addressing restricted speed and collision avoidance. The following is an excerpt from the FRA‘s final rule addressing train-to-train collisions that was published in the Federal Register on January 15, 2010: To avoid rear end collisions, available PTC technology does not always locate the rear-end of each train, but instead relies on the signal system to indicate the appropriate actions. In this example the PTC system would display ―restricted speed‖ to the locomotive engineer as the action required and would enforce the upper limit of restricted speed (i.e., 15 or 20 miles per hour, depending on the railroad). This means that more serious rear end collisions will be prevented, because the upper limit of restricted speed is enforced.85 According to FRA accident data for rear-end train collisions,86 from 2001 until April 2011 there were 16 collisions attributed to ―failure to comply with restricted speed or its equivalent not in connection with a block or interlocking signal.‖ The FRA accident data for the same time period indicate that there were 42 collisions caused by ―failure to comply with restricted speed in connection with the restrictive indication of a block or interlocking signal.‖ The collision at Red Oak falls in the second group. Because the PTC designs that are being deployed are not required to detect the rear of a train as a target, restricted speed collisions can continue to occur. Therefore, the NTSB concludes that the PTC designs that are being deployed and the FRA‘s final rule on the application of PTC are unlikely to prevent future restricted speed rear-end collisions similar to the 58 rear-end collisions reported to the FRA over the last 10 years or the collision at Red Oak because train speeds at the upper limit of restricted speed are allowed. The NTSB recommends that the FRA require the use of PTC technologies that will detect the rear of trains and prevent rear-end collisions.

85 Federal Register vol. 75, no. 10 (January 15, 2010), p. 2610. 86 Information obtained from website of the Federal Railroad Administration Office of Safety Analysis http://safetydata.fra.dot.gov/OfficeofSafety/ (accessed February 6, 2012).

NTSB Railroad Accident Report 63

1. 5

Crash Performance 2.5.1 BNSF Locomotive 9159 Investigators examined the crash performance of BNSF 9159 to understand how the substantial damage occurred. They also evaluated the adequacy of existing locomotive crashworthiness standards in light of the locomotive damage seen in the Red Oak collision. During the collision sequence, the clip car at the rear end of the struck train immediately folded, derailed, and was displaced north of the track. A powered axle and truck from that car along with other train equipment became lodged in front of the snow plow of BNSF 9159, forming a ramp in front of the locomotive. The next car in the struck train, an 89-foot flatcar outfitted with a specialized loading ramp (scorpion car), rode up and over the trapped equipment in front of BNSF 9159, overrode the locomotive anti-climber, and collided with the modular operating cab. The collision forces lifted and rotated the modular operating cab toward the rear, shearing and separating it from its attachment points. When the modular operating cab separated and rolled rearward, the short hood and collision posts no longer provided the protection intended by the crashworthiness design standards. The cab was then crushed at the rooftop as it rolled into the electrical locker, and the forward-facing window frame was folded forward over the top of the cab. The side walls remained relatively intact below the window line. Diesel fuel from the scorpion car leaked onto the front end of BNSF 9159 and caught fire. Several other flatcars overrode the scorpion car before the striking train came to a stop. The detachment and upending of the cab module and subsequent crushing action exerted forces on the cab occupants that would not have been present had the cab remained fixed to the deck. Because the operating cab rotated into the electrical locker, the rear door was crushed. The NTSB concludes that because the isolated locomotive cab module detached from the deck of the locomotive and was subsequently rotated and crushed, the crew could not have survived. 2.5.2 Locomotive Crashworthiness Standards BNSF 9159 was constructed to meet the crashworthiness standards in AAR Standard S-580, ―Locomotive Crashworthiness Requirements.‖ This standard is incorporated by reference in 49 CFR 229.205 and is applicable to all locomotives built after January 2009. EMD supplied documentation on the structural design and analysis of this model locomotive that confirmed BNSF 9159 was in compliance with these regulatory requirements. However, AAR Standard S-580 does not specifically address modular (isolated) wide-nose locomotive operating cabs like the cab on BNSF 9159. Current crashworthiness requirements are design standards. Design standards fix requirements under prescribed conditions, which are not necessarily related to the variety of conditions that could occur in a collision. They were based on specific accident scenarios and on locomotive designs in use at the time of their development. In

NTSB Railroad Accident Report 64

comparison, performance standards attempt to define equipment performance requirements. For example, maintaining survivable space in a control compartment following a collision is a performance standard; prescribing the strength of a collision post in front of the control compartment is a design standard. Modular cabs are very effective at reducing crew noise and vibration exposure, which can have a safety benefit. There are about 562 isolated cab locomotives operating in North America. Cab integrity is vital to crew safety in a variety of accident scenarios including train-train collisions, train-motor vehicle collisions, and train derailments in which a locomotive overturns. There are no crashworthiness criteria for modular cabs in the existing standards. The NTSB concludes that although the current locomotive crashworthiness standards include a procedure to validate alternative locomotive crashworthiness designs that are not consistent with any FRA-approved locomotive crashworthiness design standard, this requirement was not effective in identifying the modular operating cab as an alternate design. Consequently, the NTSB recommends that the FRA revise 49 CFR Part 229 to ensure the protection of the occupants of isolated locomotive operating cabs in the event of a collision. Make the revision applicable to all locomotives, including the existing fleet and those newly constructed, rebuilt, refurbished, and overhauled, unless the cab will never be occupied. Finally, to address future locomotive designs, the NTSB recommends that the FRA revise 49 CFR Part 229 to require crashworthiness performance validation for all new locomotive designs under conditions expected in a collision. The NTSB also recommends that the AAR revise its Standard S-580 to provide protection for the occupants of isolated operating cabs in the event of a collision, and make the revision applicable to all locomotives, including those newly constructed, rebuilt, refurbished, and overhauled. 2.6 Emergency Response The engineer of the struck train activated the 911 emergency response system about 6:57 a.m. The collision occurred in a rural area almost 8 miles from the responding fire department. Logs indicate that responders arrived on scene about 13 minutes after the call. The first on-scene priorities were locating the crew of the striking train and fire suppression. Communication and coordination between responders and the BNSF was described as very good. Therefore, the NTSB concludes that the emergency response to the accident was timely and appropriate. 2.7 Locomotive In-Cab Video and Audio Recorders The NTSB has long advocated in-cab recording devices in order to better understand crew activities leading up to serious accidents. As a result of its investigation of the collision between a Maryland Rail Commuter train and an Amtrak train near

NTSB Railroad Accident Report 65

Silver Spring, Maryland, on February 16, 1996,87 in which no operating crewmembers survived, the NTSB was unable to determine whether certain crewmember activities leading up to the accident may have contributed to the accident. Consequently, the NTSB recommended that the FRA Amend 49 Code of Federal Regulations Part 229 to require the recording of train crewmembers‘ voice communications for exclusive use in accident investigations and with appropriate limitations on the public release of such recordings. (R-97-9) After its investigation of another railroad accident with no surviving crewmembers that occurred in 1999 in Bryan, Ohio, the NTSB reiterated Safety Recommendation R-97-9 to the FRA. The FRA responded that it … has reluctantly come to the conclusion that this recommendation should not be implemented at the present time. … [The] FRA appreciates that, as time passes and other uses are found for recording media that may create synergies with other public and private purposes, the Board‘s recommendation may warrant re-examination. Based on this response and further meetings, the NTSB classified Safety Recommendation R-97-9 ―Closed—Unacceptable Action.‖ Since the refusal by the FRA to act on the recommendation regarding in-cab recorders, the NTSB has continued to investigate accidents in which such recorders would have provided valuable information to help determine probable cause and develop safety recommendations. As a result of its investigation of the July 10, 2005, collision of two CN freight trains in Anding, Mississippi,88 the NTSB made the following safety recommendation to the FRA: Require the installation of a crash- and fire-protected locomotive cab voice recorder, or a combined voice and video recorder, (for the exclusive use in accident investigations and with appropriate limitations on the public release of such recordings) in all controlling locomotive cabs and cab car operating compartments. The recorder should have a minimum 2-hour continuous recording capability, microphones capable of capturing crewmembers‘ voices and sounds generated within the cab, and a channel to record all radio conversations to and from crewmembers. (R-07-3) Most recently, as a result of the investigation into the Chatsworth, California, head-on collision between a Metrolink commuter passenger train and a Union Pacific freight

87 Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation Amtrak Train 29, near Silver Spring, Maryland, on February 16, 1996, Railroad Accident Report NTSB/RAR-97/02 (Washington, D.C.: National Transportation Safety Board, 1997). http://www.ntsb.gov 88 NTSB/RAR-07/01. http://www.ntsb.gov

NTSB Railroad Accident Report 66

train,89 the NTSB reclassified Safety Recommendation R-07-03 ―Closed—Unacceptable Action/Superseded.‖ In that investigation, the NTSB noted that In all too many accidents, the individuals directly involved are either limited in their recollection of events or, as in the case of the Chatsworth accident, are not available to be interviewed because of fatal injuries. In a number of accidents the NTSB has investigated, a better knowledge of crewmembers‘ actions before an accident would have helped reveal the key causal factors and would perhaps have facilitated the development of more effective safety recommendations. The NTSB reclassified Safety Recommendation R-07-3 ―Closed—Unacceptable Action/Superseded‖ when it issued Safety Recommendation R-10-1 to the FRA: Require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings to verify that train crew actions are in accordance with rules and procedures that are essential to safety as well as train operating conditions. The devices should have a minimum 12-hour continuous recording capability with recordings that are easily accessible for review, with appropriate limitations on public release, for the investigation of accidents or for use by management in carrying out efficiency testing and systemwide performance monitoring programs. (R-10-1) The NTSB also issued the following Safety Recommendation to the FRA: Require that railroads regularly review and use in-cab audio and image recordings (with appropriate limitations on public release), in conjunction with other performance data, to verify that train crew actions are in accordance with rules and procedures that are essential to safety. (R-10-2) Recommendations R-10-1 and R-10-2 are currently classified as ―Open—Acceptable Response.‖ The rear-end collision near Red Oak again demonstrates the need for in-cab recording devices to better understand (and thereby prevent) serious railroad accidents that claim the lives of crewmembers, passengers, and the public. While video recorders will assist in the investigation of accidents, their value in preventing accidents cannot be overstated. As highlighted in the discussion about the limitations of alerters in section 2.3.3, installation of inward-facing cameras can also assist railroads in monitoring rules compliance and identifying fatigued engineers. Such monitoring can lead to interventions before an accident occurs.

89 NTSB/RAR-10/01. http://www.ntsb.gov

NTSB Railroad Accident Report 67

Based on medical records, work-rest histories, and event recorder data, investigators determined that the crewmembers of the striking coal train had fallen asleep just before the collision. However, without visual evidence of the crewmembers‘ actions during the trip, additional information about the crewmembers‘ performance was not available for investigators. Thus this accident again demonstrates the need for inward-facing video and audio recorders in the cabs of locomotives. The NTSB, therefore, concludes that had an inward-facing video and audio recorder been installed in the cab of the locomotive of the striking train, additional valuable information about the train crew‘s actions before the collision would have been available. Based on the important safety and investigative role of inward-facing video and audio monitoring devices, the NTSB reiterates Safety Recommendations R-10-01 and -02. 2.8 Safeguarding Electronic Data for Accident Investigations The NTSB has long advocated the capture and preservation of onboard locomotive operational data to assist in accident investigations. In the derailment of a Louisville and Nashville freight train in Pensacola, Florida, on November 9, 1977, the NTSB recommended that the FRA Promulgate regulations to require locomotives used in trains on main tracks outside of yard limits to be equipped with operating event recorders. (R-78-44) The FRA responded that ―such regulations are not appropriate‖ and, in a subsequent communication, that ―any safety benefit … is significantly exceeded by the cost of installation and maintenance.‖ The FRA wrote to the NTSB in 1985 that it believed that the intent of the recommendation was being accomplished without regulation and that ―Federal involvement is neither justified or necessary.‖ Based on this response, the NTSB classified Safety Recommendation R-78-044 ―Closed—Unacceptable Action‖ on November 29, 1985. In its investigation of the rear-end collision between two Union Pacific Railroad freight trains in Hermosa, Wyoming, on October 16, 1980, the NTSB made the following safety recommendation to the AAR: Encourage member railroads to install or relocate event recorders so as to lessen the likelihood of their becoming damaged in an accident. (R-81-50) The NTSB classified Safety Recommendation R-81-50 ―Closed—Acceptable Action‖ on December 30, 1982. After the NTSB‘s first recommendation on event recorders in 1978, recorder and data storage technology improved and railroads began to install locomotive event recorders in much greater numbers. By the 1990s, most railroads were installing event recorders on their locomotives.

NTSB Railroad Accident Report 68

In 1988 Congress passed legislation requiring the FRA to promulgate event recorder regulations, and the requirement for event recorders on all lead locomotives of trains operating above 30 mph became effective in 1995. However, recorder data remained susceptible to damage during accidents, and their value in accident investigation was compromised in many cases. In its investigation of a head-on collision between two Union Pacific freight trains in Devine, Texas, that occurred on June 22, 1997, the NTSB found that the event recorders on both lead locomotives were destroyed and that critical operational data were lost. The NTSB made the following safety recommendation to the FRA: Working with the industry, develop and implement event recorder crashworthiness standards for all new or rebuilt locomotives by January 1, 2000. (R-98-30) The FRA utilized RSAC to help develop language for an NPRM. Eventually, a regulation requiring crashworthy event recorder memory modules was promulgated and became effective October 1, 2005. In correspondence dated October 26, 2005, the NTSB stated its preference for stricter recorder survivability standards that would meet the European Organization for Civil Aviation Equipment standard.90 The NTSB noted that the regulatory standards issued by the FRA are less stringent. Nonetheless, the NTSB classified safety recommendation R-98-30 ―Closed—Acceptable Action.‖ In a letter dated October 26, 2005, the NTSB further noted that … it will continue to monitor this situation and offer recommendations as a result of its (future) accident investigations to improve the effectiveness of crashworthiness standards and survivability of event recorders. In the Red Oak accident, data from the forward-facing video recorder on the BNSF 9159 did not survive the collision and subsequent fire because it was not housed in a crashworthy memory module. However, on the same locomotive, event recorder data stored in a certified U.S. Department of Transportation crashworthy memory module did survive and was available to investigators, allowing them to better understand the circumstances of the accident. The NTSB concludes that because the FRA developed standards and regulations for certified U.S. Department of Transportation crashworthy event recorder memory modules in response to the NTSB‘s prior recommendations, and a crashworthy event recorder was installed on the accident locomotive, information about this accident was available that otherwise would have been destroyed. Forward-facing video cameras are not required by regulation. The BNSF and many other railroads are voluntarily installing forward-facing video cameras as a good safety practice that allows railroads to obtain factual information and to verify conditions

90 While this is an aviation standard, it is based on fire temperatures more consistent with diesel fuel fires than the 750° C (1400° F) contained in 49 CFR 229.135(b). For example, the locomotive diesel fire following the Anding, Mississippi, collision was estimated to have reached well over 1000° C.

NTSB Railroad Accident Report 69

related to incidents involving trespassers, highway-rail grade crossings at grade, and other accidents. These cameras have obvious value for accident investigation and prevention. In the Red Oak accident, this type of video data was not available because the recorder data was not stored in a crashworthy memory module and was lost to collision and fire damage. The NTSB believes that it would be a good safety practice for railroads to ensure that data from these voluntarily installed cameras be safeguarded. The NTSB concludes that because data from voluntarily installed locomotive video cameras are typically not stored in crashworthy memory modules, important operational and safety data are at risk of being lost following an accident. Addressing this risk provides an opportunity for the industry to revisit the best methods to preserve electronic data. As the NTSB has noted, the current regulatory standards allow enclosures to be designed to withstand temperatures as low as 750° C (1400° F), while diesel fires can burn at much higher temperatures. Therefore, the NTSB recommends that the AAR develop a standard that specifies the use of suitable crash-protected memory modules for all new and existing installations of onboard video and audio recorders. The memory modules should meet or exceed the survivability criteria specified in 49 CFR 229.135 Appendix D, Table 2.

NTSB Railroad Accident Report 70

• Conclusions

1. 1

Findings

• The following were not factors in the accident: the condition of the track,

railcars, or signal system; the weather; the visibility of signals; the use of cellular telephones by crewmembers; the vision and hearing of the crew; illegal drug or alcohol use, the actions of the train dispatcher and the crew of the maintenance-of-way equipment train; or the mechanical condition of the locomotives of the striking coal train.

• The striking coal train conductor‘s and the engineer‘s irregular work

schedules contributed to their being fatigued on the morning of the collision.

• Based on their medical histories, both crewmembers on the striking coal train

were at high risk for sleep disorders and fatigue.

• Based on the conductor‘s and the engineer‘s irregular work schedules, their

medical histories, and their lack of action before the collision, both crewmembers on the striking coal train had fallen asleep due to fatigue.

• Had the two crewmembers on the striking coal train completed the BNSF‘s

fatigue training program, they would have had the opportunity to learn that they were at risk for sleep disorders, particularly obstructive sleep apnea, and the computer-based training program would have displayed a message advising them to consult with a physician.

• Had the requirements described in Safety Recommendations R-02-24, -25,

and -26 been in place, this crew would likely have been identified as at high risk for sleep disorders, which may have led to appropriate medical intervention.

• Because biomathematical models of fatigue are relatively new to the railroad

industry, the use of this technology should be evaluated for its effectiveness within the context of railroads‘ fatigue management plans through independent scientific peer review.

• Had the crew of the striking coal train been alert and operated their train in

accordance with restricted speed requirements, the collision would have been prevented.

• Locomotive alerters only detect engineer inactivity and should not be used as

a substitute for an effective fatigue mitigation strategy. NTSB Railroad Accident Report 71

• Had the positive train control/Electronic Train Management System currently

in development been installed on the Creston Subdivision, it most likely would not have prevented this accident because it does not identify the rear end of a standing train as a target and because it allows following movements at up to 23 mph.

• The positive train control designs that are being deployed and the Federal

Railroad Administration‘s final rule on the application of positive train control are unlikely to prevent future restricted speed rear-end collisions similar to the 58 rear-end collisions reported to the Federal Railroad Administration over the last 10 years or the collision at Red Oak because train speeds at the upper limit of restricted speed are allowed.

• Because the isolated locomotive cab module detached from the deck of the

locomotive and was subsequently rotated and crushed, the crew could not have survived.

• Although the current locomotive crashworthiness standards include a

procedure to validate alternative locomotive crashworthiness designs that are not consistent with any Federal Railroad Administration-approved locomotive crashworthiness design standard, this requirement was not effective in identifying the modular operating cab as an alternate design.

• The emergency response to the accident was timely and appropriate.
• Had an inward-facing video and audio recorder been installed in the cab of the

locomotive of the striking train, additional valuable information about the train crew‘s actions before the collision would have been available.

• Because the Federal Railroad Administration developed standards and

regulations for certified U.S. Department of Transportation crashworthy event recorder memory modules in response to the National Transportation Safety Board‘s prior recommendations, and a crashworthy event recorder was installed on the accident locomotive, information about this accident was available that otherwise would have been destroyed.

• Because data from voluntarily installed locomotive video cameras are

typically not stored in crashworthy memory modules, important operational and safety data are at risk of being lost following an accident. NTSB Railroad Accident Report 72

1. 2

Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the failure of the crew of the striking train to comply with the signal indication requiring them to operate in accordance with restricted speed requirements and stop short of the standing train because they had fallen asleep due to fatigue resulting from their irregular work schedules and their medical conditions. Contributing to the accident was the absence of a positive train control system that identifies the rear of a train and stops a following train if a safe braking profile is exceeded. Contributing to the severity of collision damage to the locomotive cab of the striking coal train was the absence of crashworthiness standards for modular locomotive crew cabs.

NTSB Railroad Accident Report 73

• Recommendations

As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations: 4.1 New Recommendations To the Federal Railroad Administration: Require railroads to medically screen employees in safety-sensitive positions for sleep apnea and other sleep disorders. (R-12-16) Establish an ongoing program to monitor, evaluate, report on, and continuously improve fatigue management systems implemented by operating railroads to identify, mitigate, and continuously reduce fatigue-related risks for personnel performing safety-critical tasks, with particular emphasis on biomathematical models of fatigue. (R-12-17) Conduct research on new and existing methods that can identify fatigue and mitigate performance decrements associated with fatigue in on-duty train crews. (R-12-18) Require the implementation of methods that can identify fatigue and mitigate performance decrements associated with fatigue in on-duty train crews that are identified or developed in response to Safety Recommendation R-12-18. (R-12-19) Require the use of positive train control technologies that will detect the rear of trains and prevent rear-end collisions. (R-12-20) Revise Title 49 Code of Federal Regulations Part 229 to ensure the protection of the occupants of isolated locomotive operating cabs in the event of a collision. Make the revision applicable to all locomotives, including the existing fleet and those newly constructed, rebuilt, refurbished, and overhauled, unless the cab will never be occupied. (R-12-21) Revise Title 49 Code of Federal Regulations Part 229 to require crashworthiness performance validation for all new locomotive designs under conditions expected in a collision. (R-12-22) NTSB Railroad Accident Report 74

To the Association of American Railroads: Revise Association of American Railroads Standard S-580 to provide protection for the occupants of isolated operating cabs in the event of a collision, and make the revision applicable to all locomotives, including those newly constructed, rebuilt, refurbished, and overhauled. (R-12-23) Develop a standard that specifies the use of suitable crash-protected memory modules for all new and existing installations of onboard video and audio recorders. The memory modules should meet or exceed the survivability criteria specified in Title 49 Code of Federal Regulations 229.135 Appendix D, Table 2. (R-12-24) To the BNSF Railway: Require all employees and managers who perform or supervise safety-critical tasks to complete fatigue training on an annual basis and document when they have received this training. (R-12-25) Medically screen employees in safety-sensitive positions for sleep apnea and other sleep disorders. (R-12-26) 4.2 Previously Issued Recommendations As a result of this accident investigation and four similar accidents, the National Transportation Safety Board issued the following safety recommendations on January 12, 2012: To the Federal Railroad Administration: Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, advise all railroads of the occurrences of the following five recent rear-end collisions of freight trains in which crewmembers failed to operate their trains at the required restricted speed: (1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011. (R-11-6) Through appropriate and expeditious means, inform your inspectors of the details of these accidents to ensure railroads‘ compliance with restricted speed requirements. (R-11-7)

NTSB Railroad Accident Report 75

To the American Short Line and Regional Railroad Association Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear-end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011—to urge your members to undertake a review of their operations to identify the potential for similar occurrences and to take appropriate mitigating actions. (R-11-8) To the Association of American Railroads and the American Short Line and Regional Railroad Association Examine the effectiveness of your member railroads‘ restricted speed and compliance programs. (R-11-9) 4.3 Previously Issued Recommendations Reclassified in this Report To the Federal Railroad Administration: Require railroads to ensure that the lead locomotives used to operate trains on tracks not equipped with a positive train control system are equipped with an alerter. (R-07-1) Safety Recommendation R-07-01, previously classified ―Open—Acceptable Action,‖ is reclassified ―Closed—Acceptable Action.‖ To All Class I Railroads: Ensure that alerters are installed on all your lead locomotives used to operate trains on tracks not equipped with a positive train control system. (R-07-8) Safety Recommendation R-07-8 issued to the Kansas City Southern Railway Company, previously classified ―Open—Await Response,‖ is reclassified ―Closed—Acceptable Action.‖ To the Association of American Railroads: Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear- end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and

NTSB Railroad Accident Report 76

(5) DeKalb, Indiana, on August 19, 2011—to urge your members to undertake a review of their operations to identify the potential for similar occurrences and to take appropriate mitigating actions. (R-11-8) Safety Recommendation R-11-8 issued to the Association of American Railroads is classified ―Closed—Acceptable Action.‖ To the Brotherhood of Locomotive Engineers and Trainmen and the United Transportation Union: Through appropriate and expeditious means, such as issuing and posting advisory bulletins on your website, use the occurrences of five recent rear-end collisions of freight trains—(1) Red Oak, Iowa, on April 17, 2011, (2) Low Moor, Virginia, on May 21, 2011, (3) Mineral Springs, North Carolina, on May 24, 2011, (4) DeWitt, New York, on July 6, 2011, and (5) DeKalb, Indiana, on August 19, 2011—to do the following: • Emphasize to your members the importance of operating their trains in accordance with restricted speed operating rules. • Urge your members to work with their employers to identify the potential for similar occurrences and to take appropriate mitigating actions. (R-11-10) Safety Recommendation R-11-10 is classified ―Closed—Acceptable Action.‖ 4.4 Recommendations Reiterated in this Report To the Federal Railroad Administration: Develop a standard medical examination form that includes questions regarding sleep problems and require that the form be used, pursuant to 49 CFR Part 240, to determine the medical fitness of locomotive engineers; the form should also be available for use to determine the medical fitness of other employees in safety-sensitive positions. (R-02-24) Require that any medical condition that could incapacitate, or seriously impair the performance of, an employee in a safety-sensitive position be reported to the railroad in a timely manner. (R-02-25) Require that, when a railroad becomes aware that an employee in a safety- sensitive position has a potentially incapacitating or performance- impairing medical condition, the railroad prohibit that employee from performing any safety-sensitive duties until the railroad‘s designated physician determines that the employee can continue to work safely in a safety-sensitive position. (R-02-26)

NTSB Railroad Accident Report 77

Require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings to verify that train crew actions are in accordance with rules and procedures that are essential to safety as well as train operating conditions. The devices should have a minimum 12-hour continuous recording capability with recordings that are easily accessible for review, with appropriate limitations on public release, for the investigation of accidents or for use by management in carrying out efficiency testing and systemwide performance monitoring programs. (R-10-1)

Require that railroads regularly review and use in-cab audio and image recordings (with appropriate limitations on public release), in conjunction with other performance data, to verify that train crew actions are in accordance with rules and procedures that are essential to safety. (R-10-2)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: April 24, 2012

NTSB Railroad Accident Report 78

• Appendixes

1. 1 Appendix A: Investigation

The NTSB was notified of the collision between the two BNSF trains near Red Oak, Iowa, on the morning of April 17, 2011, and investigators arrived on scene later that day. The investigator-in-charge and other investigative team members were launched from Washington, D.C.; Los Angeles; and Chicago. There was no Board Member on scene. Investigative groups were formed to study operations, mechanical equipment, track, signals, human performance, locomotive crashworthiness, and data recorders. Parties to the investigation were the Federal Railroad Administration, the BNSF Railway, the Brotherhood of Locomotive Engineers and Trainmen, Electro Motive Diesel, Inc., and the United Transportation Union. NTSB Railroad Accident Report 79

1. 2 Appendix B: BNSF Key to Signal Aspects and Indications

NTSB Railroad Accident Report 80

1. 3 Appendix C: BNSF 9159 Event Recorder Data from

6:36 a.m. to the 6:55 a.m. Collision

Time Activity Speed (mph) Distance Traveled Since Last Activity 6:36:11 - 6:36:14 Throttle 3 to 2 to 1 34 (Start near CP 4535) 6:38:25 Throttle 1 to 2 27 5,801 feet 6:38:33 Throttle 2 to 3 27 245 feet 6:40:22 – 6:40:42 Locomotive horn pattern sounded by engineer

3,928 feet 6:40:48 Alerter reset by alerter reset button 22 192 feet 6:40:54 Throttle 3 to 4 21 186 feet No activity for 2 minutes 2 seconds 6:42:56 - 6:43:02 Alerter alarm begins, 7-second duration: 5 seconds flashing light then 2 seconds light & horn Alerter reset by alerter reset button 16 3,400 feet 6:43:05 Throttle 4 to 5 16 69 feet 6:44:02 - 6:44:05 Throttle 5 to 4 to 5 14 1,283 feet 6:44:22 Throttle 5 to 6 13 338 feet 6:46:10 Throttle 6 to 7 12 1,999 feet 6:47:07 No activity passing grade signal 13

No activity for 2 minutes 1 seconds 6:48.11 - 6:48:18 Alerter alarm begins, 8-second duration: 5 seconds flashing light then 3 seconds light & horn Alerter reset by alerter reset button 13 2,224 feet 6:48:55 Throttle 7 to 6 13 689 feet 6:49:00 Manual sande begins 13 93 feet 6:49:42 Throttle 6 to 5 12 752 feet 6:50:48 Throttle 5 to 6 10 1,053 feet a Manual sand refers to sand deposited on the rails to provide traction that is manually controlled by the engineer.

NTSB Railroad Accident Report 81

Time Activity Speed (mph) Distance Traveled Since Last Activity 6:51:00 Manual sand ends 11 186 feet No activity for 2 minutes 2 seconds 6:53:02 - 6:53:09 Alerter alarm begins, 8-second duration: 5 seconds flashing light then 3 seconds light & horn Alerter reset by alerter reset button 17 2,452 feet 6:53:11 Throttle 6 to 5 18 52 feet 6:53:12 Throttle 5 to 4 18 27 feet No activity for 1 minute 53 seconds 6:55:05 Collision 23 3,344 feet

NTSB Railroad Accident Report 82

1. 4

Appendix D: Medications Referenced in Report

Generic Name (Brand Name) Medication Use Chlorpheniramine An antihistamine used to relieve red, itchy, watery eyes; sneezing; itchy nose or throat; and runny nose caused by allergies, hay fever, and the common cold. Diphenhydramine An antihistamine used to relieve red, irritated, itchy, watery eyes; sneezing; and runny nose caused by hay fever, allergies, or the common cold. Diphenhydramine is also used to relieve coughing caused by minor throat or airway irritation. Diphenhydramine is also used to prevent and treat motion sickness, and to treat insomnia. Ezetimibe and simvastatin (Vytorin) Used to treat high cholesterol in adults and children who are at least 10 years old. Glyburide and metformin (Glucovance) Used to treat type 2 diabetes (non-insulin dependent). Metoprolol (Lopressor) Used alone or in combination with other medications to treat high blood pressure. Pioglitazone (Actos) Used with a diet and exercise program and sometimes with other medications to treat type 2 diabetes. Pramipexole (Mirapex) Used to treat the symptoms of Parkinson’s disease and is also used to treat restless legs syndrome. Ranitidine (Zantac) Used to treat ulcers and gastroesophageal reflux disease (also known as GERD), a condition in which backward flow of acid from the stomach causes heartburn and injury of the food pipe (esophagus). It is also used to treat conditions where the stomach produces too much acid. Repaglinide (Prandin) Used to treat type 2 diabetes (a condition in which the body does not use insulin normally and, therefore, cannot control the amount of sugar in the blood). Ropinirole (Requip) Used alone or with other medications to treat the symptoms of Parkinson’s disease. It is also used to treat restless legs syndrome (RLS or Ekbom Syndrome). RLS is a condition that causes discomfort in the legs and a strong urge to move the legs, especially at night and when sitting or lying down. Rosuvastatin (Crestor) Used to lower cholesterol and triglycerides (types of fat) in the blood. Temazepam (Restoril) Used on a short-term basis to treat insomnia (difficulty falling asleep or staying asleep). Valsartan (Diovan) Used alone or in combination with other medications to treat high blood pressure. Venlafaxine (Effexor) Used to treat major depressive disorders, anxiety, and panic disorders.

NTSB Railroad Accident Report 83

1. 5

Appendix E: Restricted Speed Accidents Since April 2011

May 21, 2011, Low Moor, Virginia: CSX Transportation freight train H75221 collided with stopped CSX Transportation freight train G88219 in Low Moor, Virginia, which is about 170 miles west of Richmond, Virginia. The trains were operating in double-main track territory. Each train had an engineer and a conductor. No crewmember reported an injury as a result of the collision. The locomotive of the striking train derailed, and the last car on the struck train—a grain car—derailed. Train G88219 had stopped to wait for another train. Train H75221 had two locomotives, one loaded car, and nine empty cars; it was operating eastbound on a restricted signal indication. Train H75221 was descending a grade and had reached a speed of 21 mph, although the restricted speed for the railroad was 15 mph. The conductor said that as train H75221 passed through a curve, he saw the rear car of standing train G88219. The engineer placed the train into emergency braking about 259 feet before the point of collision. At impact, the train was traveling about 13 mph. At the time of the accident, the weather was partly cloudy, and the temperature was 75° F. Damages are estimated at $150,000. May 24, 2011, Mineral Springs, North Carolina: Northbound CSX Transportation freight train Q19423 struck the rear of northbound CSX Transportation freight train Q61822 in Mineral Springs, North Carolina, about 8 miles south of the CSX Transportation Monroe Yard. The striking train was traveling about 48 mph at the time of the collision, considerably faster than the mandated 15-mph restricted speed. The striking train consisted of 12 intermodal cars, and the struck train consisted of 9 general manifest cars. Each train had two crewmembers—an engineer and a conductor—who were in the lead locomotives. The engineer and the conductor of the striking train were fatally injured. The engineer and the conductor of the struck train sustained minor injuries. The two locomotives of the striking train were engulfed in a subsequent fire. Damages are estimated at $1.6 million. July 6, 2011, DeWitt, New York: Eastbound CSX train Q 366-05 with 2 locomotives and 58 cars (40 loaded cars and 18 empty cars) struck the rear of CSX train L 156-05 in DeWitt, New York. Both crewmembers on the striking train were transported to a local hospital where they received medical attention and were released. The two locomotives and the lead car of the striking train and the rear three cars of the struck train derailed. In response, local officials evacuated the surrounding area, including several businesses, and closed nearby roads because of the large amount of diesel fuel that was spilled by the lead locomotive of the striking train. August 19, 2011, DeKalb, Indiana: Westbound Norfolk Southern train 925C347 with 2 locomotives and 21 loaded cars struck the rear of Norfolk Southern train 359B249, which was stopped at milepost CD366 near DeKalb, Indiana. The collision caused nine cars on the rear of the struck train and both locomotives of the striking train to derail. There were

NTSB Railroad Accident Report 84

no injuries. Both tracks of the main line were blocked, delaying other freight traffic and scheduled Amtrak (National Railroad Passenger Corporation) passenger service. January 6, 2012, Westville, Indiana: A CSX transportation freight train collided with the rear end of a standing CSX freight train on main track No. 2 at MP BI 224.5. Moments after the injured crew of striking train escaped from the locomotive, another CSX freight train operating on main track No. 1 struck the derailed equipment obstructing their track. As a result of both collisions, the rearmost seven cars of standing train were derailed and 5 locomotives and 18 cars were derailed from the two striking trains. The engineer and the conductor on first striking train were the only crewmembers that were seriously injured. It was clear and 54° F at the time of the accident. The estimated damage was $3.9 million.

FD07399 ｜ 2012_美国_SS1201.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2012 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

The Safety of Experimental Amateur-Built Aircraft

Safety Study NTSB/SS-12/01 PB2012-917001

National Transportation Safety Board

NTSB/SS-12/01 PB2012-917001 Notation 8413A Adopted May 22, 2012

Safety Study The Safety of Experimental Amateur-Built Aircraft

National Transportation Safety Board

490 L‘Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2012. The Safety of Experimental Amateur-Built Aircraft. Safety Study NTSB/SS-12/01. Washington, DC. Abstract: Experimental amateur-built (E-AB) aircraft represent nearly 10 percent of the U.S. general aviation fleet, but these aircraft accounted for approximately 15 percent of the total—and 21 percent of the fatal—U.S. general aviation accidents in 2011. Experimental amateur-built aircraft represent a growing segment of the United States‘ general aviation fleet—a segment that now numbers nearly 33,000 aircraft. The National Transportation Safety Board undertook this study because of the popularity of E-AB aircraft, concerns over their safety record, and the absence of a contemporary and definitive analysis of E-AB aircraft safety. The study employed several different methods and data collection procedures to carefully examine this segment of U.S. civil aviation. This comprehensive approach resulted in a detailed characterization of the current E-AB aircraft fleet, pilot population, and associated accidents. Areas identified for safety improvement include expanding the documentation requirements for initial aircraft airworthiness certification, verifying the completion of Phase I flight testing, improving pilots‘ access to transition training and supporting efforts to facilitate that training, encouraging the use of recorded data during flight testing, ensuring that buyers of used E-AB aircraft receive necessary performance documentation, and improving aircraft identification in registry records.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2012-917001 from:

National Technical Information Service 5301 Shawnee Road Alexandria, Virginia 22312 (800) 553-6847 or (703) 605-6000

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB The Safety of Experimental Amateur-Built Aircraft iii Contents Contents ........................................................................................................................................ iii Figures ........................................................................................................................................... vi Tables ............................................................................................................................................ ix Abbreviations and Definitions ......................................................................................................x Federal Aviation Administration (FAA) Documents and Regulations .................................. xii Executive Summary ................................................................................................................... xiv Recommended Safety Actions ..................................................................................................... xiv What the NTSB Found in This Study ........................................................................................xv Airworthiness Certification and Flight Testing of the E-AB Aircraft ...........................................xv Availability and Quality of Transition Training .......................................................................... xvi Guidance for Purchasers of Used E-AB Aircraft ........................................................................ xvii FAA and NTSB Data Limitations ............................................................................................... xvii

1. Introduction ...............................................................................................................................1
2. 1 Background ...............................................................................................................................4
3. 1.1 The FAA‘s Definition of an E-AB Aircraft ....................................................................4
4. 1.2 Registration and Certification of an E-AB Aircraft ........................................................6
5. 1.3 Flight Testing During Phase I .........................................................................................8
6. 1.4 Continuing Airworthiness of the E-AB Aircraft—Phase II ...........................................9
7. Accident Trends Across the Decade ......................................................................................10
8. 1 Aircraft Fleet and Activity ......................................................................................................11
9. 2 Accidents as a Function of Aircraft Age .................................................................................12
10. 3 Comparison of Accident Characteristics ................................................................................14
11. 4 Accident Pilot Demographics .................................................................................................17
12. 5 Limitations in the Analysis of Retrospective Data .................................................................19
13. The Calendar Year 2011 Case-Series of E-AB Aircraft Accidents ....................................20
14. 1 Characteristics of the 224 E-AB Aircraft Accidents Occurring in 2011 ................................22
15. 1.1 E-AB Aircraft Built by Owner Versus E-AB Aircraft Bought Used ...........................25
16. 2 Accident Pilot Demographics .................................................................................................28
17. 3 E-AB Aircraft Characteristics Requiring FAA Certificate Endorsements .............................32
18. 4 Characteristics of Builders and Their Aircraft ........................................................................33
19. 5 Airworthiness Certification and Transition Training ..............................................................34
20. 5.1 E-AB Aircraft Purchased Used .....................................................................................35
21. 6 Accidents as a Function of Airframe Hours ...........................................................................36
22. 7 Accidents During Phase I Flight Testing ................................................................................37
23. 8 Accidents During the First Flight for E-AB Aircraft Built by Owner ....................................39
24. 9 Accidents During the First Flight for E-AB Aircraft Bought Used ........................................40

NTSB The Safety of Experimental Amateur-Built Aircraft iv

1. The EAA Survey of E-AB Aircraft Owners and Builders ..................................................43
2. 1 Respondent Demographics .....................................................................................................45
3. 2 E-AB Aircraft Makes ..............................................................................................................50
4. 3 E-AB Aircraft Characteristics Requiring FAA Certificate Endorsements .............................51
5. 4 The E-AB Aircraft Building Process ......................................................................................52
6. 5 Transition Training .................................................................................................................58
7. 6 Flight Test and Certification ...................................................................................................59
8. 7 Owners of E-AB Aircraft Bought Used ..................................................................................61
9. Analysis and Discussion ..........................................................................................................64
10. 1 Key Findings ...........................................................................................................................64
11. 2 Opportunities to Improve Safety During Initial Certification .................................................65
12. 2.1 Airworthiness Certification of E-AB Aircraft ..............................................................65
13. 2.2 Functional Test Requirements ......................................................................................67
14. 2.3 Flight Test Plan .............................................................................................................68
15. 3 Opportunities to Improve Safety During Phase I Flight Test .................................................69
16. 3.1 Phase I Flight Testing of E-AB Aircraft .......................................................................69
17. 3.2 Accidents During Phase I Flight Testing ......................................................................71
18. 3.3 Loss of Control During Phase I Flight Testing .............................................................72
19. 3.4 Phase I Test Pilot Qualifications ...................................................................................72
20. 3.5 Additional Persons Onboard During Phase I Flight Testing ........................................73
21. 3.6 Completion of Phase I Flight Testing ...........................................................................75
22. 3.7 Use of Recorded Data for Phase I Flight Testing and Continued Airworthiness .........76
23. 4 Training and Information to Prevent Loss of Control in Flight ..............................................77
24. 4.1 Transition Training .......................................................................................................77
25. 4.2 Barriers to E-AB Aircraft Transition Training .............................................................78
26. 4.3 Providing Information to Purchasers of Used E-AB Aircraft ......................................80
27. 5 Accurate Identification of Amateur-Built Aircraft .................................................................82
28. Conclusions ..............................................................................................................................85
29. 1 Findings...................................................................................................................................86
30. Recommendations ...................................................................................................................88

Appendix A: NTSB Aviation Accident Data Validation ..........................................................91 Appendix B: E-AB Aircraft Accident Supplementary Data Form .........................................95 Appendix C: Expanded Analysis of Amateur-Built Aircraft Accident Data, Calendar Year 2011..............................................................................................................................................102 E-AB Aircraft Makes ...................................................................................................................102 Appendix D: Amateur-Built Aircraft Survey..........................................................................107 Appendix E: Expanded Results of Experimental Aircraft Association Survey of E-AB Aircraft Owners and Builders. .................................................................................................120 Appendix F: Experimental Amateur-Built Study Cases, Calendar Year 2011 ...................125

NTSB The Safety of Experimental Amateur-Built Aircraft v Appendix G: Canadian Minister’s Delegate – Recreational Aviation Form C14E Fuel Flow Test Report .................................................................................................................................142 Appendix H: Special Light-Sport and Experimental Light-Sport Airworthiness Certificates and Sport Pilot Airmen Certificate ..........................................................................................143 Light-Sport Aircraft Definition ....................................................................................................143

NTSB The Safety of Experimental Amateur-Built Aircraft vi Figures Figure 1. Comparison of accident rates per 1,000 E-AB and non-E-AB aircraft for the 2001–2010 period. ...............................................................................................................................................2 Figure 2. Comparison of accident rates per 100,000 flight hours for E-AB and non-E-AB aircraft for the 2001–2010 period. ...................................................................................................3 Figure 3. The standard build kit for Van's RV-7 airplane. ..............................................................5 Figure 4. The quick-build kit of Van's RV-7 airplane. ...................................................................6 Figure 5. Registering and certifying an E-AB aircraft, according to FAA AC 20-27G. ................7 Figure 6. Number of active E-AB and non-E-AB aircraft annually from 2001 to 2010. .............11 Figure 7. FAA-reported number of hours flown for E-AB and non-E-AB aircraft annually from 2001 through 2010. ...............................................................................................................12 Figure 8. Cumulative distribution of airframe hours of E-AB and non-E-AB aircraft involved in accidents from 2001 through 2010; 8,072 accident aircraft with available airframe hours information. ....................................................................................................................................13 Figure 9. Distribution of accidents involving E-AB and non-E-AB aircraft involving the 10 most common CAST/ICAO occurrence categories from 2001 through 2010. .........................15 Figure 10. Distribution of fatal accidents involving E-AB and non-E-AB aircraft involving the 10 most common occurrence categories from 2001 through 2010. .........................................16 Figure 11. Median accident pilot age for E-AB and non-E-AB aircraft, 2001–2010. ..................18 Figure 12. Locations of the 224 E-AB aircraft accidents occurring in the United States during calendar year 2011. .............................................................................................................21 Figure 13. CAST/ICAO occurrence categories for E-AB accident aircraft, 2011. ......................24 Figure 14. Phase of flight for the 227 aircraft involved in the 2011 E-AB aircraft accidents. .....25 Figure 15. CAST/ICAO occurrence categories for E-AB aircraft built by owner versus E-AB aircraft bought used, 2011. ..................................................................................................26 Figure 16. Years since certification for E-AB aircraft built by the owner versus those bought used. ...................................................................................................................................27 Figure 17. Years that the accident E-AB aircraft has been owned by the current owner. ............28 Figure 18. Age distributions of accident pilots who had built their E-AB aircraft and those who had bought them used. ...........................................................................................................29

NTSB The Safety of Experimental Amateur-Built Aircraft vii Figure 19. Highest pilot certificate for accident pilots who bought used E-AB aircraft and those who built their E-AB aircraft. ...............................................................................................30 Figure 20. Total flight hours for accident pilots who built their E-AB aircraft and those who bought used E-AB aircraft (based on data from 175 of 227 accident pilots). ...............................31 Figure 21. Total E-AB aircraft flight hours for those who built their aircraft and those who bought used aircraft (based on data from 155 of 227 accident pilots). ..........................................32 Figure 22. Cumulative proportion of built-by-owner and bought used E-AB aircraft as a function of airframe hours. ............................................................................................................37 Figure 23. CAST/ICAO occurrence category for the 2011 E-AB accidents during Phase I of the flight test program. ...............................................................................................................38 Figure 24. Airframe hours at time of accident. .............................................................................39 Figure 25. Method of E-AB aircraft ownership by type of aircraft. .............................................44 Figure 26. Years since certification for E-AB aircraft built by the respondent versus E-AB aircraft bought used by respondents (based on 4,082 survey responses). .....................................45 Figure 27. Respondent age by method of E-AB aircraft ownership. ............................................46 Figure 28. Highest pilot certificate by method of E-AB aircraft ownership. ................................47 Figure 29. Years of pilot experience by method of E-AB aircraft ownership. .............................48 Figure 30. Total Flight Hours by E-AB aircraft method of ownership. ........................................49 Figure 31. Total E-AB aircraft flight hours by method of ownership. .........................................50 Figure 32. Type Building Project by E-AB aircraft method of ownership. ..................................51 Figure 33. Engine choices among E-AB aircraft builders. ...........................................................54 Figure 34. The location at which the E-AB aircraft was, or is being, built. .................................56 Figure 35. Sources of builder assistance. ......................................................................................57 Figure 36. Individuals performing inspections during the building process. ................................58 Figure 37. Issuer of airworthiness certificates reported by 2,597 of the 3,103 respondents who had completed their E-AB aircraft. ........................................................................................60 Figure 38. Sources of assistance in developing Phase I test plans for the 3,103 respondents who had built their E-AB aircraft. .................................................................................................61

NTSB The Safety of Experimental Amateur-Built Aircraft viii Figure 39. Total hours of flight experience for respondents who purchased used E-AB aircraft (1,132 of 1,151 reporting this information). ......................................................................63 Figure A1. Changes in the annual U.S. civil general aviation accident and fatal accident records for E-AB aircraft, 2001–2010. ..........................................................................................92 Figure A2. Revised amateur-built aircraft accident rate following NTSB accident data validation, 2001–2010....................................................................................................................93 Figure A3. Revised amateur-built aircraft fatal accident rate following NTSB accident data validation, 2001–2010....................................................................................................................94 Figure C1. Types of E-AB accident aircraft built by owners and bought as used, 2011. ...........102 Figure C2. Type of E-AB aircraft building project for aircraft built by owners and those bought used. .................................................................................................................................103 Figure C3. E-AB accident aircraft makes built by owners. ........................................................104 Figure C4. E-AB accident aircraft makes bought used. .............................................................105 Figure C5. Number of previous owners for accident E-AB aircraft bought used. .....................106 Figure E1. Kit manufacturers reported by survey respondents. .................................................120 Figure E2. Kit models for the Van's, Lancair, Glasair and Zenith aircraft kits reported in the survey. ....................................................................................................................................121 Figure E3. Plans-built aircraft designs reported by survey respondents. ....................................122 Figure E4. Years to complete for the 3,095 respondents reporting this information. ................123 Figure E5. Total build hours for the 1,648 respondents reporting this information. ..................124 Figure H1. Chart illustrating an increase in the proportion of accident aircraft meeting the weight limitation of light-sport aircraft, following the 2004 effectiveness date of the light-sport aircraft and sport pilot rule. ........................................................................................150 Figure H2. Chart illustrating an increase in the proportion of accident pilots of E-AB aircraft without a First, Second, or Third Class medical following the 2004 effective date of the light-sport aircraft and sport pilot rule. ..............................................................................151

NTSB The Safety of Experimental Amateur-Built Aircraft ix Tables Table 1. Accident aircraft displaying design features that would require specific training or logbook endorsements. ..................................................................................................................33 Table 2. Characteristics of accident E-AB aircraft built by owners. .............................................34 Table 3. Characteristics of accident E-AB aircraft bought used. ..................................................36 Table 4. Characteristics of the 10 accidents in 2011 that occurred during the first test flight of the newly built E-AB aircraft. ...................................................................................................40 Table 5. Accidents involving the first flight after purchase of E-AB aircraft bought used. .........42 Table 6. Aircraft design features and corresponding pilot certificate endorsements. ...................52 Table 7. Principal characteristics of the kit-built, plans-built and original design E-AB aircraft built or being built by survey respondents. .......................................................................55 Table 8. Source of transition training reported by respondents who had completed their E-AB aircraft. .................................................................................................................................59 Table 9. Characteristics of the E-AB aircraft bought used by survey respondents. ......................62

NTSB The Safety of Experimental Amateur-Built Aircraft x Abbreviations and Definitions Aviation Safety Inspector (ASI) Federal Aviation Administration (FAA) employees who provide oversight of operations or maintenance in commercial or general aviation. Maintenance safety inspectors hold an FAA Mechanic Certificate and have experience involving maintenance and repair of airframes, powerplants, and systems. They have responsibility for certifying airworthiness and the issuing of airworthiness certificates. Commercial Assistance Provider An individual or corporation that assists in the building of an E-AB in exchange for compensation. Demonstration Flight Pre-project test flights provided by kit manufacturers or other E-AB owners. Designated Airworthiness Representative (DAR) An individual appointed by the FAA to perform examination, inspection, and testing services necessary to the issuance of certificates. DARs authorized to issue special airworthiness certificates for the purpose of operating amateur-built aircraft must possess current knowledge relating to the fabrication, assembly, and operating characteristics of amateur-built aircraft. DARs are not FAA employees, and they may charge for their services. Experimental Aircraft Association (EAA) The EAA was established in 1953 by a small group of individuals interested in building their own aircraft. It has grown to an organization of nearly 170,000 members that exists to promote sport aviation and amateur builders. The EAA also provides a variety of technical instruction and support programs for aircraft owners and builders. Its headquarters are in Oshkosh, Wisconsin. Experimental Aircraft Association (EAA) Flight Advisor An EAA member volunteer who assists the owner/builder or buyer of a used E-AB plan the first flight, find an instructor, and suggest additional training in the aircraft. Experimental Aircraft Association (EAA) Technical Counselor An EAA member volunteer who is an experienced aircraft builder, restorer, or mechanic, and who provides builders with the technical advice on building or restoring E-AB aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft xi Experimental Amateur-Built (E-AB) Aircraft An aircraft, the major portion of which has been assembled by a person, or persons, who undertook the project for the sole purpose of self-education or recreation. General Aviation Operations An aviation operation that is operating under any part of the Federal Aviation Regulations, except Title 14 Code of Federal Regulations (CFR) Parts 121, 135, or 129. Kit Built E-AB An aircraft that is constructed from a manufactured kit that may include some major sub-assemblies and pre- assembled parts. These kits still require that the amateur builder perform more than one-half of the fabrication and assembly tasks in order to meet the "51 percent" rule. Letter of Deviation Authority (LODA) A letter issued by the Administrator of the FAA that allows the owner of an E-AB to offer his/her aircraft for compensation or hire for the purpose of flight instruction. Original Design E-AB An aircraft constructed based on plans designed completely by the owner/builder without the purchase of major sub-assemblies or pre-assembled kit components. Phase I Flight Test The flight testing phase following issuance of a special airworthiness certificate for operation of an amateur-built aircraft. Operating limitations issued for this phase restrict operation to a sparsely populated geographic area and prohibit the carrying of passengers. Phase II Flight Phase II begins when the builder/owner certifies that flight testing has been completed. The geographic limitations are generally relaxed and non-revenue passengers may be carried. Plans Built E-AB An aircraft constructed from raw materials according to published blueprints or plans prepared by an individual or commercial entity other than the owner/builder. Transition Training The training a pilot receives when beginning to fly an unfamiliar aircraft. This training is meant to familiarize the pilot with the systems and structures of the aircraft to a point that he/she can competently operate the aircraft on his/her own.

NTSB The Safety of Experimental Amateur-Built Aircraft xii Federal Aviation Administration (FAA) Documents and Regulations FAA Advisory Circulars (AC) AC 20-27G Titled, Certification and Operation of Amateur-Built Aircraft, this AC provides information about FAA regulations and procedures for airworthiness certification of equipment for the purpose of operating amateur-built aircraft. AC 90-89A Titled, Amateur-Built Aircraft and Ultralight Flight Testing Handbook, this AC provides suggestions and safety-related recommendations to assist amateur and ultra-light builders in developing individualized aircraft flight test plans. AC 90-109 Titled, Airmen Transition to Experimental or Unfamiliar Airplanes, this AC provides information and guidance to owners and pilots of experimental airplanes and to flight instructors who teach in experimental airplanes. This AC also contains training recommendations for pilots of experimental airplanes in a variety of groupings based on performance and handling characteristics. FAA Orders Order 8130.2G This order establishes FAA procedures for airworthiness certification of aircraft and related equipment. The procedures contained in this order apply to FAA ASIs, and persons or organizations with delegated authority to issue airworthiness certificates and related approvals. Order 8130.35 This order created the Amateur-Built Aircraft National Kit Evaluation Team (NKET) and established methodology to determine whether kits, as manufactured, allow the builder to meet the major portion requirement. Order 8900.1 This order stipulates that aircraft holding an experimental certificate may not be used to provide flight training for compensation or hire, unless a Letter of Deviation Authority is issued. Title 14 Code of Federal Regulations (CFR) 14 CFR 21.191(g) FAA regulation establishing the experimental airworthiness certificate for the purpose of operating amateur-built aircraft, including the major portion build requirement of amateur-built aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft xiii 14 CFR 21.193 FAA regulation prescribing the procedures and document submission requirements for applicants for an experimental airworthiness certificate. 14 CFR 47.31 FAA regulation prescribing requirements for the registration or re- registration of U.S. civil aircraft. 14 CFR 65.104 FAA regulation prescribing the eligibility, privileges, and limitations of the FAA repairman certificate for the primary builder of an amateur-built aircraft. 14 CFR 91.319 FAA regulation prescribing operating limitations of aircraft having experimental airworthiness certificates.

NTSB The Safety of Experimental Amateur-Built Aircraft xiv Executive Summary Experimental amateur-built (E-AB) aircraft represent nearly 10 percent of the U.S. general aviation fleet, but these aircraft accounted for approximately 15 percent of the total—and 21 percent of the fatal—U.S. general aviation (GA) accidents in 2011. Experimental amateur-built aircraft represent a growing segment of the United States‘ general aviation fleet—a segment that now numbers nearly 33,000 aircraft. The National Transportation Safety Board (NTSB) undertook this study because of the popularity of E-AB aircraft, concerns over their safety record, and the absence of a contemporary and definitive analysis of E-AB aircraft safety. The study employed several different methods and data collection procedures to carefully examine this segment of U.S. civil aviation. This comprehensive approach resulted in a detailed characterization of the current E-AB aircraft fleet, pilot population, and associated accidents. Four sources of data formed the basis of this study. First, the NTSB performed a retrospective analysis of accident and activity data over the last decade to compare the accident experience of E-AB aircraft with that of similar non-E-AB aircraft used in similar GA flight operations. Second, the NTSB conducted in-depth investigations of all E-AB aircraft accidents during 2011, which provided a case-series of accidents for more detailed analysis. Third, a broad survey of the community of aircraft owners and builders was conducted by the Experimental Aircraft Association (EAA) in July and August 2011, and the data were made available to the NTSB for analysis to understand the population of E-AB aircraft builders and owners. Finally, discussions with EAA representatives, Federal Aviation Administration (FAA) officials, E-AB aircraft builders and owners, kit manufacturers, and representatives of E-AB aircraft type clubs provided insights on E-AB aircraft safety issues and solutions. Recommended Safety Actions In response to the findings of this study, the National Transportation Safety Board issued 12 recommendations to the Federal Aviation Administration and 4 recommendations to the Experimental Aircraft Association. The recommendations include expanding the documentation requirements for initial aircraft airworthiness certification, verifying the completion of Phase I flight testing, improving pilots‘ access to transition training and supporting efforts to facilitate that training, encouraging the use of recorded data during flight testing, ensuring that buyers of used E-AB aircraft receive necessary performance documentation, and improving aircraft identification in registry records.

NTSB The Safety of Experimental Amateur-Built Aircraft xv What the NTSB Found in This Study The study compared the accident experience of E-AB aircraft with that of similar non-E-AB general aviation aircraft over the last decade. A detailed analysis was also conducted of the 224 accidents, involving 227 E-AB aircraft, that occurred during 2011.1 These analyses revealed the following factors defining E-AB aircraft accidents:  E-AB aircraft account for a disproportionate number of total accidents and an even more disproportionate share of fatal accidents when compared with similar non-E-AB aircraft conducting similar flight operations.  Accident analyses indicate that powerplant failures and loss of control in flight are the most common E-AB aircraft accident occurrences by a large margin and that accident occurrences are similar for both new and used aircraft.  Structural failures have not been a common occurrence among E-AB aircraft.  In comparison with similar non-E-AB aircraft, a much higher proportion of accidents involving E-AB aircraft occur early in the operational life of the aircraft.  A similarly large proportion of E-AB aircraft accidents occur shortly after being purchased by a subsequent owner. For example, 14 of the 224 study accidents during 2011 occurred during the first flight by a new owner of a used E-AB aircraft. Through further analysis of the accident record and the results of an EAA survey of E-AB aircraft owners and builders, the study also found:  The majority of E-AB aircraft are now built from commercial kits, rather than from purchased plans or original designs.  Pilots of E-AB aircraft, whether involved in accidents or not, have similar, or higher, levels of total aviation experience than pilots of non-E-AB aircraft engaged in similar general aviation operations.  Pilots of E-AB accident aircraft, on average, had significantly less flight experience in the type of aircraft they were flying than pilots of non-E-AB aircraft. Finally, study analyses identified the following key issue areas to explain these findings and recommended actions to improve E-AB aircraft safety. Airworthiness Certification and Flight Testing of the E-AB Aircraft E-AB aircraft safety is largely managed by the community of E-AB aircraft builders, owners, and kit manufacturers rather than by FAA regulatory requirements. A primary focus of

1 Three of the 224 accidents involved collisions between two E-AB aircraft, accounting for a total of 227 E-AB aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft xvi FAA regulations governing the E-AB aircraft building process seeks to ensure that the major portion of the construction work is done by the builder. Airworthiness certificates are granted to the E-AB aircraft builder by the FAA based only on a review of documentation and a one-time inspection of the aircraft after it has been completed. Unlike foreign civil aviation authorities‘ standards, there is no requirement for pre-approval of the project or in-process inspections of materials and workmanship. However, the study found that a large proportion of E-AB aircraft accidents involving loss of engine power could be reduced by requiring documentation of a functional test of aircraft fuel system as part of the initial airworthiness certification. As part of the airworthiness certification process, E-AB aircraft are assigned operating limitations specifying how and where the aircraft can be flown. E-AB aircraft operating limitations specify two phases of operation: Phase I, which is applicable to the flight test period and Phase II, which governs normal operations once testing is complete. Builders of E-AB are required to certify that the flight test has been completed with an entry in the aircraft logbook. Although FAA guidance materials are explicit in advising the builder that the objective of the flight test is to carefully map the performance envelope of the aircraft and develop an aircraft flight manual, neither a flight test plan nor documentation of its accomplishment, in the form of an aircraft flight manual, are required to be submitted to, reviewed, or accepted by an FAA Aviation Safety Inspector (ASI) or FAA Designated Airworthiness Representative (DAR). The study found that verifying the completion of Phase I flight testing through a review of the flight test records and resulting aircraft flight manual by an FAA ASI or DAR could ensure the adequacy of E-AB aircraft flight testing prior to engaging in normal Phase II flight operations. Glass cockpit avionics, which are capable of recording aircraft and engine performance data, have been shown to be useful in the accomplishment of flight test objectives. A majority of EAA survey respondents who were in the process of building their E-AB aircraft equipped their aircraft with such instrumentation, and 35 percent of the owner-built E-AB aircraft involved in accidents during 2011 were equipped with glass cockpit avionics. The study found that FAA guidance does not address the use of data recordings from avionics or other electronic devices as part of an E-AB aircraft flight test program, potentially limiting the use of an important data source in a critical aspect of the demonstration of the E-AB aircraft‘s airworthiness. The Phase I flight test period is uniquely challenging for pilots who must learn the handling characteristics of an unfamiliar aircraft while also managing the challenges of the flight test environment and procedures. Of the 224 E-AB aircraft accidents during 2011 included in this study, 32 included aircraft in the Phase I flight testing period, suggesting that pilots would benefit from additional training in the safe performance of E-AB aircraft flight test operations. Current Phase I operating limitations preclude anyone ―not essential to the purpose of flight‖ from flying in the aircraft during flight testing. The study determined that consideration should be given to permit an additional pilot in cases where test circumstances could be performed more safely and more effectively with a second qualified pilot on board. Availability and Quality of Transition Training Both the accident analyses and extensive discussions with EAA members, kit manufacturers, and E-AB aircraft builders emphasized the importance of the builder receiving appropriate and sufficient transition training to develop proficiency with the new type of aircraft

NTSB The Safety of Experimental Amateur-Built Aircraft xvii prior to flying his/her E-AB aircraft. These discussions identified challenges in finding appropriate training aircraft and instructors. Their scarcity, in part, is a result of the difficulty in obtaining an exception to the FAA regulation prohibiting a qualified instructor who owns an E-AB aircraft from charging students for instruction in that aircraft. The study determined that pilots would benefit from improved guidance regarding transition training in E-AB aircraft. Guidance for Purchasers of Used E-AB Aircraft Purchasers of used E-AB aircraft face particular challenges in transitioning to the new aircraft, which are aggravated by the absence, in many cases, of the sort of comprehensive aircraft flight manual that would be available to the owner of a non-E-AB aircraft. The study found that, because there is no review of flight test results, not all builders create an aircraft flight manual or performance documentation for their aircraft. Absent that documentation, the purchaser of a used E-AB aircraft is not provided with sufficient information to understand the aircraft‘s controllability throughout all maneuvers, to detect any hazardous operating characteristics, or to understand emergency procedures. FAA and NTSB Data Limitations Finally, the study identified shortcomings in the FAA‘s Civil Aircraft Registry that affect the conduct of safety analyses and hamper notification of aircraft owners when aircraft- or engine-specific safety issues are discovered.

NTSB The Safety of Experimental Amateur-Built Aircraft 1

1. Introduction

Experimental amateur-built (E-AB) aircraft represent a significant, and growing, proportion of the General Aviation fleet in the United States and around the world. According to the FAA‘s 2010 General Aviation and Part 135 Activity Survey, they account for nearly 10 percent of general aviation aircraft, and 4 percent of the hours flown in general aviation. Despite a decade-long decline in overall general aviation flight activity, the E-AB segment has grown both in numbers of aircraft and flight activity during this period. E-ABs have experienced a disproportionate number of accidents relative both to their proportion of the general aviation fleet, and their share of general aviation flight activity. The overall E-AB aircraft accident rate per 1,000 aircraft is nearly twice that of comparable2 non-E-AB aircraft, and the fatal accident rate is between 2.5 and 3 times higher. Figure 1 shows that these differences have remained relatively constant across the last decade. Considered as a function of hours of flight activity, the accident rate disparity between E-AB aircraft and non-E-AB aircraft has also been consistently wide. The total E-AB aircraft accident rate per 100,000 flight hours was between 2.5 and 3 times that of non-E-AB aircraft between 2001 and 2010, and the fatal accident rate was approximately 4 times greater, on average, than that of non-E-AB aircraft. The comparative accident rates per 100,000 flight hours are shown in Figure 2.

2 The comparison group selected to most closely match E-AB aircraft included all single-engine, piston-powered airplanes; piston-powered helicopters; balloons; and gliders that were not certificated as experimental amateur-built aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 2

Figure 1. Comparison of accident rates per 1,000 E-AB and non-E-AB aircraft for the 2001-2010 period.

1. 07
2. 54
3. 26
4. 91

0 2 4 6 8 10 12 14 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Accidents per 1,000 Aircraft Calendar Year Total and Fatal Accident Rates per 1,000 Aircraft, 2001–2010 E-AB total Non-E-AB total E-AB fatal Non-E-AB fatal

NTSB The Safety of Experimental Amateur-Built Aircraft 3

Figure 2. Comparison of accident rates per 100,000 flight hours for E-AB and non-E-AB aircraft for the 2001–2010 period. These differences in accident risk for E-AB aircraft have been widely noted in the aviation community. Former FAA Administrator Randy Babbitt told a Sun‘N Fun audience3 in 2010, that amateur-built aircraft have ―too high an accident rate‖, and that ―they account for 10 percent of the GA fleet, but 27 percent of accidents.‖ Aviation analysts such as Wanttaja,4,5 have also recognized the elevated accident risk for amateur-built aircraft, while pointing out flaws in both registration and accident data that may affect these analyses. Believing there to be a strong basis for a safety concern, the National Transportation Safety Board (NTSB) undertook this study to identify, and provide an in-depth assessment of, the salient issues that affect this important segment of the U.S. general aviation fleet. A necessary context for this study is the unique regulatory environment, within U.S. civil aviation, in which these aircraft are built and operated.

3 Grady, Mary ―FAA Administrator Babbitt Takes in Sun‘N Fun,‖ April 14, 2010, AVWeb. 4 Wanttaja, Ron, Homebuilt Aircraft Safety: 1998-2006, Kitplanes, October, 2008. 5 Wanttaja, Ron, Amateur-Built Accident Report: Reviewing the Past Five Years, EAA Sport Aviation, Vol. 6, No. 4, April, 2012, 30–35. 21.17 9.49 5.27 1.56 0 5 10 15 20 25 30 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Accidents per 100,000 Flight Hours Calendar Year Total and Fatal Accident Rates per 100,000 Flight Hours, 2001–2010 E-AB total Non-E-AB total E-AB fatal Non-E-AB fatal

NTSB The Safety of Experimental Amateur-Built Aircraft 4 1.1 Background Most of the aircraft used in general aviation operations in the United States are built under a type certificate issued to the manufacturer upon demonstration of compliance with 14 Code of Federal Regulation (CFR) Part 23. General aviation operations also include, however, aircraft within one of several categories of the type of special airworthiness certificate6 known as experimental. Most experimental airworthiness certificates are issued to amateur-built aircraft. These aircraft are built, or assembled, by hobbyists or amateur builders. 1.1.1 The FAA’s Definition of an E-AB Aircraft The FAA first identifies an aircraft as amateur-built when it is registered with the FAA Registration Branch.7 FAA regulations allow for aircraft constructed from an amateur builder‘s original design, purchased plans, or pre-fabricated kit, to be registered as an E-AB aircraft provided that the builder (or builders) demonstrate that he or she has fabricated or assembled over one-half of the aircraft. While FAA Advisory Circular (AC) 20-27G provides general guidance to amateur builders regarding the planning and construction of an E-AB aircraft and refers builders to technical support available from the EAA and others, its principal focus is to communicate and ensure compliance with the ―major proportion‖ or ―51-percent‖ rule, namely: The major portion of the aircraft is defined as more than 50 percent of the fabrication and assembly tasks, commonly referred to as the ―51-percent rule.‖ For example, an amateur-built kit found on the FAA List of Amateur-Built Aircraft Kits has 40 percent of the fabrication/assembly completed by the kit manufacturer. In order to be eligible for an experimental amateur-built airworthiness certificate, and per the major portion rule, the fabrication and assembly tasks that may be contracted out (for hire) to another individual (or builder/commercial assistance center) needs to be less than 10 percent. The experimental amateur-built category was first adopted in Civil Aeronautics Manual 18 in 1952, and early E-AB aircraft were primarily the original designs of their builders or aircraft built from plans shared between builders. The first kits, which consisted of factory-fabricated components and sub-assemblies, were introduced in the 1970s and kit-built E-AB aircraft now constitute the largest proportion of experimental aircraft. The FAA publishes, on its website, a listing of kits that have been evaluated and found eligible in meeting the ‗major portion‘ requirement of 14 CFR 21.191(g). The FAA also issued Order 8130.35, which created the Amateur-Built Aircraft National Kit Evaluation Team (NKET) and established a standard

6 Per 14 CFR 21.175(b), the special airworthiness certificate categories include primary, restricted, limited, light-sport, and provisional airworthiness certificates, special flight permits, and experimental certificates. The special light-sport and experimental light-sport certificates were added in 2004. Light-sport aircraft are manufactured, or built from kits, that conform to the ASTM International consensus standard rather than a type certificate. Appendix G contains further descriptions of light-sport aircraft. 7 Ford, Edsel W. Jr. ―Breaking the Code,‖ FAA Aviation News, Sept 22, 2011. 8 U.S. Department of Commerce, Civil Aeronautics Administration, Civil Aeronautics Manual 1: Certification, Identification and Marking of Aircraft and Related Products, October, 1952.

NTSB The Safety of Experimental Amateur-Built Aircraft 5 methodology to determine whether kits, as manufactured, allow the amateur builder to meet the major portion requirement. There is no FAA evaluation of the airworthiness of kits. Some kit manufacturers offer both standard kits and so-called quick-build kits to reduce the time required to complete the E-AB aircraft project. For example, Van‘s Aircraft Company,9 offers both standard build and quick-build kits for several of its models and claims that quick-build kits cut building time by 35–40 percent. Figure 3 shows the standard Van‘s kit for its RV-7, a 20-foot, 4-inch-long, two-seat, tailwheel airplane with a wing span of 25 feet. Figure 4 shows the quick-build kit for the same airplane. The FAA lists both as meeting the ―51-percent‖ rule.

Figure 3. The standard build kit for Van's RV-7 airplane.

9 http://www.vansaircraft.com/public/kit-qb.htm.

NTSB The Safety of Experimental Amateur-Built Aircraft 6

Figure 4. The quick-build kit of Van's RV-7 airplane. 1.1.2 Registration and Certification of an E-AB Aircraft Figure 5, from FAA AC 20-27G, details the steps a builder must follow to register and certify an E-AB aircraft. This AC provides general advice to the builder regarding FAA regulations and invites the builder to contact the applicable Manufacturing Inspection District Office or Flight Standards District Office if he/she requires further guidance. There is no requirement for pre-registration of the aircraft building project, and the builder is advised to complete the registration forms for the new aircraft 60 to 120 days before the construction is expected to be completed.

NTSB The Safety of Experimental Amateur-Built Aircraft 7

Figure 5. Registering and certifying an E-AB aircraft, according to FAA AC 20-27G. As a part of his/her registration application, the builder must provide a notarized Affidavit of Ownership for Experimental Aircraft (AC Form 8050-88), which identifies the aircraft and engine (if the aircraft is powered) and records the builder‘s attestation that he/she has complied with the major portion rule. No inspection of the aircraft is conducted at this stage.

NTSB The Safety of Experimental Amateur-Built Aircraft 8 Amateur-built aircraft do not receive FAA type design approval but instead are issued a special airworthiness certificate in the experimental category following submission of an Application for Airworthiness Certificate10 and the successful completion of an FAA airworthiness inspection and documentation review, which is conducted either by an ASI or a DAR. In addition to satisfying the major portion requirement, E-AB builders must provide evidence that the aircraft complies with acceptable aeronautical standards and practices. The ASI or DAR will conduct an inspection of the completed aircraft as well as a review of the builder‘s documentation of the building process, which may include construction logs, photographs, and reports of inspections by EAA Technical Counselors. Following successful completion of the inspection of the aircraft and the documentation review, the ASI or DAR will issue an airworthiness certificate11 and a set of operating limitations that are unique to the aircraft and become part of the special airworthiness certificate. Two sets of operating limitations are typically established at the time the airworthiness certificate is issued. Phase I operating limitations are associated with an initial flight testing period during which the aircraft must be subjected to operational testing to demonstrate that it meets the requirements of 14 CFR 91.319(b) (i.e., the aircraft is controllable throughout its normal range of speeds and throughout all the maneuvers to be executed and the aircraft has no hazardous operating characteristics or design features). Once the Phase I period has been completed, the Phase II operating limitations go into effect for an indefinite period, unless a major modification is made to the aircraft. Therefore, Phase I operating limitations can be described as applicable to flight testing, and Phase II can be described as normal operation of an E-AB aircraft. 1.1.3 Flight Testing During Phase I FAA Order 8130.2G provides guidance for applicants to show compliance with 14 CFR 91.319(b) after the airworthiness certificate is issued by developing and executing an explicit flight test program in accordance with FAA AC 90-89A12 or comparable guidance. The order identifies two purposes for this test program: (1) They ensure the aircraft has been adequately tested and determined to be safe to fly within the aircraft’s s flight envelope. (2) The flight test data is used to develop an accurate and complete aircraft flight manual and to establish emergency procedures. The length of this Phase I flight test period is not established by regulation, but FAA Order 8130.2G recommends a minimum Phase I test period of 25 hours for aircraft equipped with type-certificated engine/propeller combinations and a minimum of 40 hours for aircraft with non-type-certificated engine, propeller, or engine/propeller combinations.13 There is

10 FAA Form 8130-6, Application for Airworthiness Certificate. 11 FAA Form 8130-7, Special Airworthiness Certificate. 12 Federal Aviation Administration Advisory Circular, AC 90-89A. Amateur-Built Aircraft and Ultralight Flight Testing Handbook, FAA, Washington, D.C. 1995. 13 Type-certificated engines and propellers have been manufactured according to an FAA type certificate, non-certificated engines and propellers have not.

NTSB The Safety of Experimental Amateur-Built Aircraft 9 no requirement that the test plan be presented to, or reviewed by, the FAA when the airworthiness certificate and Phase I operating limitations are issued. Operating limitations issued with the airworthiness certificate restrict the Phase I test flights to a geographic area that avoids populated areas or busy airspace. During Phase I, only those persons essential to safe flight may be carried in the aircraft. Usually this is interpreted to preclude other than solo operations. The completion of Phase I flight test requirements is self-certified by the builder with an entry in the aircraft logs. There is no requirement for the FAA to review or confirm the flight test data intended to demonstrate that the aircraft was ―safe to fly within the aircraft‘s flight envelope‖ or that ―an accurate and complete aircraft flight manual‖ had been developed. 1.1.4 Continuing Airworthiness of the E-AB Aircraft—Phase II After Phase I flight testing is certified as complete by the E-AB aircraft owner, the more liberal Phase II operating limitations become effective. In Phase II, the geographical restrictions are relaxed and non-revenue passengers are permitted. Ordinarily the Phase II operating limitations are assigned for an unlimited time period. An experimental amateur-built aircraft may be piloted in Phase II by individuals holding a private pilot or higher certificate.14 The operating limitations of Phase II require an annual condition inspection, which is recorded in the aircraft logbook. Unlike type-certificated aircraft, there is no restriction on who may perform maintenance on an E-AB aircraft, other than major changes. The annual condition inspection requirement may be carried out by the aircraft builder, if he/she holds a repairman certificate15 for that aircraft. Otherwise the condition inspection must be performed by an appropriately-rated FAA-certificated mechanic. The repairman certificate is unique to the aircraft and its builder and does not transfer with the sale of the E-AB aircraft.

14 Certain aircraft that are sport pilot eligible may be piloted by individuals holding a sport pilot certificate. 15 Title 14 CFR 65.104 defines the eligibility, privileges, and limitations of a repairman certificate—experimental aircraft builder. The original builder of an E-AB aircraft may apply for a repairman certificate, authorizing him or her to perform condition inspections in accordance with the operating limitations of the aircraft he or she constructed. The repairman certificate is specific to the individual and aircraft and does not transfer with the sale of an aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 10

1. Accident Trends Across the Decade

NTSB aviation accident investigation records were used to compare the accident history of amateur-built aircraft with comparable non-E-AB aircraft from 2001 through 2010. An extensive review was conducted of these data to ensure that accident-involved aircraft were correctly identified as E-AB aircraft or non-E-AB aircraft.16 In particular, aircraft identified as having special light-sport, experimental light-sport,17 or other categories of experimental airworthiness certificates were removed from the amateur-built aircraft accident data.18 Because general aviation operations include a wide range of aircraft types, a subset of general aviation operations and aircraft was selected to provide comparisons to the E-AB aircraft accident record and exposure data. The bulk of the E-AB aircraft fleet is comprised of single-engine, piston-powered airplanes, but it also includes other categories of aircraft such as helicopters, balloons, gliders, and gyroplanes.19 Therefore, the comparison group selected to most closely match E-AB aircraft includes all single-engine, piston-powered airplanes; piston-powered helicopters; balloons; and gliders that are not certificated as experimental amateur-built. This group included aircraft with both standard category and light-sport airworthiness certificates. Similarly, the activity and accident records associated with the comparison aircraft were limited to personal and business flights to most closely match the activity of E-AB aircraft20 that are built for personal education and recreation and are restricted from operating for compensation or hire.21 Throughout the remainder of this chapter, the two groups of aircraft will be referred to as the ―E-AB‖ and ―non-E-AB‖ aircraft groups.

16 Previous analyses, such as Cook, Mark, 2010. Commentary: ―Homebuilt Aircraft Safety Picture Blurred by Bad Data,‖ Kitplanes, March, 2010, have criticized the accuracy in identifying amateur-built aircraft. NTSB staff worked with the FAA to validate the airworthiness certification of aircraft involved in general aviation accidents from 2001 through 2010, resulting in a net reduction of the number of E-AB accidents during the period. 17 Title 14 CFR 1.1 defines the design and performance characteristics of a group of simple, small, lightweight, low-performance aircraft; identified as light-sport aircraft. Title 14 CFR 21.190 also prescribes requirements for the issuance of a special airworthiness certificate for light-sport category aircraft. A detailed discussion of light-sport aircraft and associated aircraft and airworthiness certification is included in appendix H of this report. 18 A summary of the methodology and results of the data validation effort is included in Appendix A of this report. 19 The 2,134 accident aircraft from 2001 through 2010 validated as E-AB aircraft included 97 helicopters, 75 gyroplanes, 16 gliders, and 4 balloons. 20 Although the non-E-AB group was limited to personal and business flights, the E-AB accident aircraft were reportedly engaged in a variety of activities other than personal flying, including business, flight instruction, and air show or air racing. In addition, there were 39 non-E-AB aircraft that were engaged in activities other than personal or business flying but are included in some analyses in this section because they were involved in ground or midair collision accidents with E-AB aircraft. 21 This approach likely underestimates active aircraft and flight activity and, therefore, overestimates accident rates associated with the comparison group of non-E-AB aircraft. However, this conservative approach was selected to avoid overestimating the increased risks associated with amateur-built aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 11 2.1 Aircraft Fleet and Activity Exposure data obtained from the FAA‘s annual General Aviation and Part 135 Activity Survey were used to calculate accident rates per 100,000 flight hours, which provided normalized comparisons of E-AB and non-E-AB aircraft accident experiences. Figure 6 shows the estimated active aircraft and Figure 7 shows the annual flight hours from 2001 through 2010 for E-AB and non-E-AB aircraft.

Figure 6. Number of active E-AB and non-E-AB aircraft annually from 2001 to 2010.

1. 8
2. 7
3. 7
4. 3

0 20 40 60 80 100 120 140 160 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Active Aircraft (thousands) Calendar Year Estimated Active E-AB and Non-E-AB Aircraft in the U.S., 2001–2010 Non-E-AB E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 12

Figure 7. FAA-reported number of hours flown for E-AB and non-E-AB aircraft annually from 2001 through 2010. 2.2 Accidents as a Function of Aircraft Age Previous comparisons of E-AB aircraft accident rates to other segments of general aviation22 have sought explanations for the substantially elevated accident rates, either as a proportion of the active aircraft fleet or of flight hours.23 One observation is that much higher proportions of E-AB aircraft accidents occur early in the operational life of the aircraft, particularly during the Phase I flight test as a condition of airworthiness certification. Figure 8 compares the cumulative distributions of accident aircraft from 2001 through 2010 at various points in the total airframe lifespan (in hours) for E-AB and non-E-AB aircraft. Direct comparison of the airframe hours at the time of the accident is difficult because of the likely differences in the operational history of the two groups of aircraft. However, the large difference in the number of E-AB aircraft accidents occurring very early in the operational life of the aircraft suggests underlying differences between the two fleets of aircraft. For example, 152 of

22 Wanttaja, Ron. Examining Homebuilt Aircraft Accidents, 2010. 23 See, for example FAA Advisory Circular 90-109, http://www.faa.gov/documentLibrary/media/Advisory_ Circular/90-109.pdf.. 11.7 7.7 0.8 0.9 0 2 4 6 8 10 12 14 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Flight Hours (millions) Calendar Year Hours Flown by E-AB and Non-E-AB Aircraft, 2001–2010 Non-E-AB E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 13 the 1,622 accident E-AB aircraft (9 percent) with airframe data had fewer than 10 airframe hours at the time of the accident, compared with only 18 of the 6,450 non-E-AB aircraft (.3 percent) with airframe data. This is despite a total fleet of, and number of accidents involving, non-E-AB aircraft being several times greater than that of E-AB aircraft.

Figure 8. Cumulative distribution of airframe hours of E-AB and non-E-AB aircraft involved in accidents from 2001 through 2010; 8,072 accident aircraft with available airframe hours information. Although these differences in accumulated airframe hours might suggest differences in airworthiness between the two groups of aircraft, they may also be influenced by differences in the way the aircraft are operated and maintained and by the pilots who fly them. 12 18 64 184 622 956 102 152 288 551 1,265 1,523 1,622 0 200 400 600 800 1,000 1,200 1,400 1,600 1,800 < 5 <10 <40 <100 <500 <1000 Total with hour data Accident Aircraft Airframe Hours Cumulative Distribution of E-AB and Comparison Accident Aircraft Airframe Hours, 2001–2010 Non-E-AB E-AB 6,450

NTSB The Safety of Experimental Amateur-Built Aircraft 14 2.3 Comparison of Accident Characteristics An analysis of the accident occurrences and associated phases of flight provides further insight. E-AB and non-E-AB aircraft accident characteristics were summarized using a coding structure developed by the Commercial Aviation Safety Team (CAST) and the International Civil Aviation Organization (ICAO) that are useful in describing the characteristic circumstances of aviation accidents.24 For ease of aggregate analysis and interpretation, the NTSB identifies one of the CAST-ICAO Common Taxonomy Team (CICTT) event codes as the defining event for each accident and that is the categorization used in this report to characterize accident circumstances. Each accident occurrence can also be associated with a CICTT phase code, identifying the phase of flight during which an accident occurred. Figure 9 compares E-AB and non-E-AB aircraft groups relative to the defining event for all accidents investigated between 2001 and 2010. Figure 10 compares the percentage of fatal accidents in each major event category for E-AB and non-E-AB aircraft during this period.

24 The CAST/ICAO Common Taxonomy Team (CICTT), comprised of U.S. and international government and industry experts, has developed consensus coding of aircraft accident occurrences categories and associated phases of flight. CICTT occurrence and phase of flight definitions and usage notes can be found at the CICTT website: http://www.intlaviationstandards.org/.

NTSB The Safety of Experimental Amateur-Built Aircraft 15

Figure 9. Distribution of accidents involving E-AB and non-E-AB aircraft involving the 10 most common CAST/ICAO occurrence categories from 2001 through 2010.

1. 4%
2. 8%
3. 9%
4. 0%
5. 8%
6. 9%
7. 0%
8. 1%
9. 7%
10. 0%
11. 8%
12. 0%
13. 6%
14. 8%
15. 4%
16. 8%
17. 5%
18. 7%
19. 1%
20. 2%

0% 5% 10% 15% 20% 25% Midair Collision Runway Excursion Weather Related Runway Contact System/Component (Non- Powerplant) Fuel Related Loss of Control on Ground Collision With Objects or Terrain Loss of Control in Flight System/Component (Powerplant) Percentage of Accidents CAST/ICAO Occurrence Category Top 10 Accident Occurrence Categories for E-AB and Non-E-AB Aircraft, 2001–2010 E-AB Non-E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 16

Figure 10. Distribution of fatal accidents involving E-AB and non-E-AB aircraft involving the 10 most common occurrence categories from 2001 through 2010. Powerplant failures and loss of aircraft control in flight were the most common accident events for E-AB aircraft, while collisions with objects or terrain and loss of control on ground were the most common accident events for the non-E-AB aircraft. A noticeably larger proportion of E-AB aircraft accidents and fatal accidents involved system failures (either powerplant or non-powerplant). The difference in accident event types, and the typical impact forces involved with those events, identifies an important source of the historic difference in the fatal accident rates for E-AB aircraft. 0.3% 1.7% 1.0% 4.0% 16.0% 5.9% 3.6% 25.4% 8.5% 29.7% 0.9% 0.9% 1.8% 2.2% 3.3% 6.0% 8.9% 14.1% 15.2% 43.9% 0% 10% 20% 30% 40% 50% Low Altitude Operation Unknown Loss of Control on Ground Midair Collision Weather Related Fuel Related System/Component (Non- Powerplant) Collision With Objects or Terrain System/Component (Powerplant) Loss of Control in Flight Percentage of Accidents CAST/ICAO Occurrence Category Top 10 Fatal Accident Occurrence Categories for E-AB and Non-E-AB Aircraft, 2001–2010 E-AB Non-E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 17 Loss of aircraft control in flight was the most common event in fatal accidents for both groups of aircraft, but E-AB aircraft experienced a noticeably greater proportion of loss of control in flight events than the non-E-AB aircraft group. There is also a noticeable difference between the fatal accident histories of the two groups related to weather, with weather-related accident events being much less common for E-AB aircraft. This likely reflects differences in aircraft usage associated with a smaller proportion of E-AB aircraft certified for flight in instrument meteorological conditions. 2.4 Accident Pilot Demographics Accident records were reviewed to gain a better understanding of the role of the pilot in the accident history. Pilots of E-AB aircraft involved in accidents between 2001 and 2010 were older (median age was 57 years) than the accident pilots of non-E-AB aircraft (median age was 53 years).25 Figure 11 shows the median age of accident pilots involving these two groups of aircraft each year from 2001 through 2010. Accident pilots of E-AB aircraft were consistently older than those of comparison aircraft and the difference increased slightly over the period.

25 This difference was statistically significant (Mann-Whitney U = 6848562.0, N (non-E-AB aircraft) = 7,975, N (E-AB aircraft = 2,104), p < 0.001).

NTSB The Safety of Experimental Amateur-Built Aircraft 18

Figure 11. Median accident pilot age for E-AB and non-E-AB aircraft, 2001–2010. The E-AB aircraft accident pilots had more total flying time (median flight hours were 1,000 hours) than the non-E-AB aircraft pilots (median flight hours were 810 hours),26 and a slightly higher proportion of E-AB aircraft pilots held commercial or airline transport pilot certificates. These results indicate that pilots of E-AB aircraft have similar, or higher, levels of total aviation experience than pilots of comparable aircraft engaged in similar general aviation operations. However, E-AB aircraft accident pilots had less than half (median flight hours were

26 This difference was statistically significant (Mann-Whitney U = 7248897.5, N (non-E-AB aircraft) = 7,824, N (E-AB aircraft = 2,024), p < 0.001). 53 53 56 57 58 57 57 58 60 61 50 52 51 52 52 52 54 54 54 55 10 20 30 40 50 60 70 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Median Age (years) Calendar Year Median Age of E-AB and Non-E-AB Aircraft Accident Pilots, 2001–2010 E-AB Non-E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 19 61 hours) of the time in the accident aircraft type than did the pilots of non-E-AB accident aircraft (median flight hours were 152 hours).27 2.5 Limitations in the Analysis of Retrospective Data The use of historical accident data alone is insufficient to provide a comprehensive analysis of E-AB aircraft safety issues. Several important matters cannot be resolved. For example, these data do not reliably identify whether the pilot of the accident-involved E-AB aircraft was the builder, the owner, or someone else. Nor do these accident data reliably identify whether the accident flight occurred during the flight test of the aircraft. The accident records also do not distinguish between owner/operator-built aircraft and E-AB aircraft that have been purchased used. Further, available data fail to provide a description and understanding of the broader population of E-AB aircraft and aviators who are not involved in accidents. In an effort to overcome these data limitations, the NTSB analyzed two additional datasets for this study, a detailed case-series dataset of E-AB aircraft accidents investigated by the NTSB during 2011 and a survey of amateur aircraft builders and operators that was conducted by the EAA. These are the subject of the following chapters. Additionally, staff visited manufacturers of E-AB aircraft kits, interviewed FAA officials and contractors, participated in discussions with the General Aviation Joint Steering Committee, and held numerous discussions with officials and members of the EAA, including its Homebuilders Aircraft Council. NTSB staff also reviewed industry and government training resources applicable to E-AB aircraft construction, certification, and oversight, such as the FAA‘s Initial Amateur-Built and Light-Sport DAR Seminar training course covering mandatory DAR training for amateur-built or light-sport certification,28 and the EAA‘s RV Assembly, SportAir workshop.29

27 This difference was statistically significant (Mann-Whitney U = 3759648.5, N (non-E-AB aircraft) = 6,819, N (E-AB aircraft = 1,604), p < 0.001). Statistical test results are provided here to illustrate differences between the characteristics of the two groups of accident pilots. A similar pattern of E-AB aircraft pilot experience was observed in the 2011 accident data, but no similar comparisons were evaluated through statistical testing. 28 The purpose of this course is to ensure that DARs understand FAA expectations, regulations, policy, procedures, forms, records, and any issues unique to amateur-built and light-sport aircraft. FAA inspectors also attend this course. 29 This is one of a group of similarly organized workshops offered by the EAA on topics pertaining to the assembly and operation of amateur-built aircraft such as the Code of Federal Regulations regarding amateur-built aircraft, tools required during assembly, workshop requirements, insurance, engine and propeller selection, and flight testing. The RV assembly workshop curriculum included a classroom presentation followed by ―hands-on‖ sheet metal projects, including a small airfoil section patterned after a Van‘s Aircraft Company RV wing intended to include the majority of skills necessary to build the aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 20

1. The Calendar Year 2011 Case-Series of E-AB

Aircraft Accidents In order to facilitate a fuller understanding of the circumstances of E-AB aircraft accidents, beyond that possible from the historical record, the NTSB conducted detailed investigations of all 224 E-AB aircraft accidents involving 227 E-AB aircraft during calendar year 2011.30 These detailed investigations employed the supplementary data form shown in appendix A. This form was completed for each of these accidents to collect additional information on aircraft performance, builder and pilot characteristics, and other factors to augment the data routinely collected in NTSB accident investigations. In addition, FAA airworthiness certification files and FAA registration files were obtained for each of the accident aircraft for which such files were available.31 Fifty-four of the 224 accidents were fatal, claiming the lives of 67 of the 300 individuals carried aboard the accident aircraft.32 Figure 12 shows the locations of these accidents in the continental United States. The complete list of accidents is shown in appendix F.

30 Three of the 224 accidents involved collisions between two E-AB aircraft, accounting for a total of 227 E-AB aircraft. 31 Two accidents involved unregistered aircraft for which such files were not available. 32 At the time of this report, 40 percent of the 227 accidents did not yet have published probable cause statements.

NTSB The Safety of Experimental Amateur-Built Aircraft 21

Figure 12. Locations of the 224 E-AB aircraft accidents occurring in the United States during calendar year 2011. An analysis of these accidents illustrates several important characteristics and features. The most notable is that powerplant failure and loss of control in flight were the most common factors associated with E-AB aircraft accidents occurring in 2011, the same pattern seen among E-AB aircraft accidents occurring between 2001 and 2010. Additional review of the 2011 accident data provided detail about E-AB accident aircraft and pilots not available from review of the 2001–2010 accident records. Some of the more interesting findings are summarized below. It was found that:  A larger proportion of E-AB aircraft accidents in 2011 involved used E-AB aircraft compared with accidents involving aircraft owned by the original builder.  A high proportion of these used E-AB aircraft accidents occurred shortly after being purchased.  There were a greater number of accidents occurring during the first flight by the new owner of a used E-AB aircraft compared with the first flight of a newly built aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 22  Loss of control in flight was the most common occurrence for first flights of both newly built and newly purchased aircraft. Other key findings associated with the detailed E-AB aircraft accidents occurring in 2011 are provided below. 3.1 Characteristics of the 224 E-AB Aircraft Accidents Occurring in 2011 Figure 13 plots the CICTT33 codes for the 227 E-AB aircraft involved in 224 accidents during calendar year 2011. Powerplant failures were observed in 57 of the accident aircraft, including 8 fatal accidents—by far the leading type of occurrence. Most (53 of 57) of the powerplant failures involved airplanes, the remaining 4 accidents involved helicopters. Type-certificated aircraft engines failed in 40 percent of these accidents, 37 percent involved non-type-certificated aircraft engines, and 23 percent of the powerplant failures occurred in automotive conversion engines. Of the 49 engines for which the origin could be established, 57 percent were new (including one that had been ―mothballed‖ for 60 years) and 33 percent were overhauled or factory reconditioned. The remaining 10 percent were used engines that had not been overhauled.34 A wide variety of failures were observed in these powerplant-involved accidents. These include:  A bearing on a builder-designed secondary shaft of a Rotorway helicopter equipped with a new non-type-certificated aircraft engine froze, causing a fatal accident.  An improperly installed coolant hose fitting failed on an airplane powered by a new Subaru automotive conversion engine, causing engine overheating and loss of power.  Loose, or cross-threaded, spark plugs on a type-certificated Continental engine that had been overhauled by an FAA certified mechanic, and on a factory-reconditioned Rotax aircraft engine led to two accidents.  The rupture of an oil supply line because of abrasion from an improperly positioned hose clamp led to the failure of a new Jabiru engine. In many cases, the investigator was only able to determine that the engine had experienced total or partial loss of power for undetermined reasons. Loss of control in flight was the next highest overall occurrence and accounted for the most fatal occurrences. Half of the loss of control accidents occurred on takeoff or initial climb. In a number of these accidents, insufficient takeoff speed, early rotation, or too steep a climb on

33 International Civil Aviation Organization, Common Taxonomy Team, Aviation Occurrence Categories – Definitions and Usage Notes, October 2008. 34 Among the population of E-AB aircraft accidents in 2011, 50 percent of the aircraft used type-certificated aircraft engines, 34 percent used non-type-certificated aircraft engines, 15 percent used automotive conversion engines, and 1 percent were unpowered gliders. For the engines whose origin could be determined, 60 percent were new, 29 percent were overhauled, and 11 percent were used.

NTSB The Safety of Experimental Amateur-Built Aircraft 23 takeoff led to aerodynamic stalls and loss of control. In at least two cases, pilots admitted that their aircraft was at or over maximum gross weight, resulting in compromised climb performance, aerodynamic stall, and loss of control. Inadequate airspeed management on approach and landing also led to aerodynamic stall and loss of control in a number of other accidents. In one instance, a pilot was surprised on takeoff when the tail came up more quickly than he expected on the first flight of the tailwheel airplane that he had built, and he flew the aircraft into a nose-high stall and lost control. The 64-year-old student pilot had never flown a tailwheel airplane before and did not have a tailwheel endorsement. The next most common accident occurrences were loss of control on the ground, abnormal runway contact, and failures of systems or components other than the powerplant. Three of these accidents were fatal. Controlled flight into terrain accounted for five fatal and five non-fatal accidents.

NTSB The Safety of Experimental Amateur-Built Aircraft 24

Figure 13. CAST/ICAO occurrence categories for E-AB accident aircraft, 2011. Figure 14 summarizes the phase of flight of the 227 aircraft at the time of the accident occurrence in 2011. Landing was the phase of flight most often associated with E-AB aircraft accidents, although only one of these accidents was fatal. As indicated previously, many of the 0 20 40 60 System/Component Failure (Powerplant) Loss of Control in Flight Loss of Control on Ground Abnormal Runway Contact System/Component Failure (Non-Powerplant) Fuel Related Collision on Takeoff or Landing Controlled Flight Into Terrain Midair Collision Ground Collision Low Altitude Operation Runway Excursion Runway Incursion (Vehicle, Aircraft, Person) Unknown Undershoot/Overshoot Windshear/Thunderstorm Other Abrubt Maneuver Fire/Smoke (Non-Impact) Runway Incursion (Wildlife) Unintentional Flight into IMC Accident Aircraft CAST/ICAO Occurrence Category CAST/ICAO Occurrence Categories for E-AB Accident Aircraft, 2011 (Includes one Midair collision between two E-AB aircraft, and two Runway Incursion accidents between two E-AB aircraft) Total Fatal

NTSB The Safety of Experimental Amateur-Built Aircraft 25 loss of control in flight accidents occurred during takeoff and initial climb or during approach and landing.

Figure 14. Phase of flight for the 227 aircraft involved in the 2011 E-AB aircraft accidents. 3.1.1 E-AB Aircraft Built by Owner Versus E-AB Aircraft Bought Used More than one-half (125 of 227) of the aircraft involved in accidents during 2011 had been bought used rather than having been built by their current owner.35 Figure 15 compares CAST/ICAO occurrence categories for the accidents involving E-AB aircraft built by their owners compared with those purchased used. The two groups of accident aircraft appear similar with respect to the types of accidents in which they were involved.

35 By comparison, 23.5 percent of survey respondents reported owning a used E-AB aircraft. The FAA‘s aircraft registry does not include the detail necessary to determine this breakdown for all E-AB aircraft. 1 31 42 36 27 19 60 3 4 0 5 13 12 12 8 1 0 4 0 10 20 30 40 50 60 70 Standing Takeoff Initial Climb En Route Maneuvering Approach Landing Taxi Unknown Accident Aircraft CAST/ICAO Phase of Flight CAST/ICAO Phase of Flight for E-AB Accident Aircraft, 2011 Total Fatal

NTSB The Safety of Experimental Amateur-Built Aircraft 26

Figure 15. CAST/ICAO occurrence categories for E-AB aircraft built by owner versus E-AB aircraft bought used, 2011. Figure 16 shows the age of the accident aircraft (years since certification) for both the built-by-owner and bought-used aircraft. As might be expected, the accident E-AB aircraft that had been bought used, were older than those built by the owner at the time of the accident. The median years since certification was 14 for the accident aircraft purchased used, compared with 3 years for those built by the owners. Figure 17 presents a slightly different picture. This figure plots the years that the accident aircraft has been owned by the two groups of owners. The two distributions are very similar and, in fact, the median time owned for the accident aircraft bought used was 2 years, compared with 3 years for the aircraft built by their owners. 0 5 10 15 20 25 30 35 System/Component Failure (Powerplant) Loss of Control in Flight Loss of Control on Ground Abnormal Runway Contact System/Component Failure (Non-Powerplant) Fuel Related Collision on Takeoff or Landing Controlled Flight Into Terrain Midair Collision Ground Collision Low Alltituide Operation Runway Excursion Runway Incursion (Vehicle, Aircraft, Person) Unknown Undershoot/Overshoot Other Windshear/Thunderstorm Abrupt Maneuver Fire/Smoke (Non-Impact) Runway Incursion (Wildlife) Unintended Flight Into IMC Accident Aircraft CAST/ICAO Occurrence Category CAST/ICAO Occurrence Categories for E-AB Aircraft Built by Owner Versus E-AB Aircraft Bought Used, 2011 Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 27

Figure 16. Years since certification for E-AB aircraft built by the owner versus those bought used.

19 18 10 8 11 20 16 2 1 1 7 4 31 79 0 10 20 30 40 50 60 70 80 90 <1 year 1–2 years 2–3 years 3–4 years 4–5 years 5–10 years

10 years

Accident Aircraft Years Since Certification Years Since Airworthiness Certification for Accident E-AB Aircraft Built by Owner Versus Those Bought Used Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 28

Figure 17. Years that the accident E-AB aircraft has been owned by the current owner. 3.2 Accident Pilot Demographics The median age of accident pilots who had bought used E-AB aircraft was 62 years (ranging from 20–88), while for those who had built their aircraft the median age was 58 (ranging from 16–83). Figure 18 shows the age distribution for these two groups of accident pilots. 19 18 10 8 11 20 16 23 32 17 10 12 24 7 0 5 10 15 20 25 30 35 <1 year 1–2 years 2–3 years 3–4 years 4–5 years 5–10 years

10 years

Accident Aircraft Years Owned Number of Years That the Accident E-AB was Owned by the Current Owner, 2011 Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 29

Figure 18. Age distributions of accident pilots who had built their E-AB aircraft and those who had bought them used. As shown in Figure 19, most accident pilots held private pilot or higher certificates, whether they had built their E-AB aircraft or bought it used. The two groups were also similar in total flight hours. The distribution of total flight hours are shown in Figure 20, and the total hours in the accident aircraft are shown in Figure 21. The bought-used group showed slightly more experience with a median of 1,550 total flight hours, compared with 1,248 hours for the pilots who had built their E-AB aircraft. Relative to experience in flying the accident E-AB aircraft, those who had built their E-AB aircraft had somewhat more time in the aircraft (median equals 100 hours) than those who had bought their aircraft used (median equals 70 hours). 2 33 57 9 52 58 0 10 20 30 40 50 60 70 <40 40–59

59

Accident Pilots Age Age of Accident Pilots Who Built E-AB Aircraft and Those Who Bought Used E-AB Aircraft, 2011 Built E-AB Bought Used-EAB

NTSB The Safety of Experimental Amateur-Built Aircraft 30

Figure 19. Highest pilot certificate for accident pilots who bought used E-AB aircraft and those who built their E-AB aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 31

Figure 20. Total flight hours for accident pilots who built their E-AB aircraft and those who bought used E-AB aircraft (based on data from 175 of 227 accident pilots).

0 3 6 9 15 19 8 4 2 14 1 7 6 13 15 10 8 9 6 20 0 5 10 15 20 25 Accident Pilots Total Flight Hours Total Flight Hours of Accident Pilots Who Built Their E-AB Aircraft and Those Who Bought Used E-AB Aircraft, 2011 Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 32

Figure 21. Total E-AB aircraft flight hours for those who built their aircraft and those who bought used aircraft (based on data from 155 of 227 accident pilots). 3.3 E-AB Aircraft Characteristics Requiring FAA Certificate Endorsements E-AB aircraft vary considerably with respect to structural and performance characteristics, some of which require specific training or a pilot logbook endorsement. Section 61.31(f) of 14 CFR stipulates that ground and flight training and an endorsement in the pilot‘s logbook are required to operate as the pilot-in-command of an airplane with an engine exceeding 200 horsepower. Section 61.31(i) of 14 CFR stipulates that pilots must receive training and a logbook endorsement to operate tailwheel airplanes. Finally, retractable landing gear is one of the characteristics of a complex airplane,36 requiring an endorsement under section 61.31(e). Table 1 shows the percentage of accident aircraft bought used and built by the owner with each of these design features that would have required specific training or a logbook endorsement. Unfortunately, data on whether these logbook endorsements were held were not available for most accident pilots.

36 A ―complex‖ airplane is defined in 14 CFR 61.1(b)(3) as having retractable landing gear, flaps, and a controllable pitch propeller. 4 14 4 6 1 0 4 9 18 10 6 17 8 2 2 4 8 16 16 6 0 2 4 6 8 10 12 14 16 18 20 None 1–9 10–19 20–29 30–39 40–49 50–99 100–199 200–499

499

Accident Pilots Flight Hours in the E-AB Aircraft Total Hours of Experience in the Accident Aircraft for Pilots Who Built Their E-AB and Those Who Bought the Aircraft Used Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 33 Table 1. Accident aircraft displaying design features that would require specific training or logbook endorsements. Aircraft Feature Built by Owner Used E-AB Aircraft Engine >200 HP 18% 11% Tailwheel Equipped 40% 54% Retractable Landing Gear 12% 11% Total Accident Aircraft 102 125 Few accident aircraft met the ―high performance‖ definition of being powered by engines of more than 200 horsepower and even fewer would have required a complex aircraft endorsement by virtue of being equipped with a retractable landing gear. However, nearly half of the accident aircraft were equipped with tailwheel landing gear. 3.4 Characteristics of Builders and Their Aircraft NTSB investigators were able to gather a limited amount of information on the building experiences and building choices of the 102 accident E-AB aircraft owners who had built their aircraft. Approximately 80 percent of the aircraft built by owners of accident aircraft were kit- built and 19 percent were plans-built. Only one accident involved an aircraft that was an original design. Most of the accident aircraft were built at the owner‘s home and/or in an airport hangar. A small number (less than 10 percent) were constructed at a kit manufacturer‘s factory or in a commercial aircraft service facility. Most were individual, rather than group, projects. About 14 percent of builders received assistance from EAA Technical Counselors and about 9 percent received assistance from aircraft kit manufacturers. About 12 percent reported receiving assistance from various friends, while 25 percent claimed to have received no assistance during their building project. Only 24 percent of these 102 builders reported having had their work inspected by EAA Technical Counselors, DARs, aircraft mechanics, or other experts during the building project. Table 2 summarizes the principal characteristics of the accident E-AB aircraft built by the owners by the type of building project.

NTSB The Safety of Experimental Amateur-Built Aircraft 34 Table 2. Characteristics of accident E-AB aircraft built by owners. Aircraft Characteristic Kit-Built Plans-Built Original Design Engine Type Type-Certificated Aircraft Engine 46% 48% 100% Non-Type-Certificated Aircraft Engine 38% 26% 0% Automotive Conversion 16% 26% 0% Propeller Type Fixed Pitch 43% 69% 0% Ground Adjustable 24% 19% 0% Constant Speed 33% 12% 100% Avionics Conventional 61% 87% 100% Glass Cockpit 39% 13% 0% Landing Gear Configuration Tailwheel 39% 44% 100% Tricycle 52% 56% 0% Other 9% 0% 0% Landing Gear Type Fixed 90% 79% 100% Retractable 10% 21% 0% Number of Seats One 5% 26% 100% Two 83% 63% 0% Three or More 12% 11% 0% Total Accident Aircraft 82 19 1 The single accident involving an original design E-AB aircraft was a single seat, tailwheel airplane with a type-certificated aircraft engine, constant-speed propeller, and conventional avionics. Most kit-built and plans-built aircraft were two-seat, fixed tricycle gear aircraft with aircraft engines (type-certificated or non- certificated) and conventional avionics. 3.5 Airworthiness Certification and Transition Training Of the 102 accident aircraft built by the owners, 2 were unregistered and 2 had incomplete certification records. Certification records of the remaining 98 accident aircraft showed that FAA inspectors had issued an airworthiness certificate for 43 aircraft and DARs had issued the certificate for the remaining 54 aircraft. In most cases (83 of 98), the Phase I flight test period prescribed for these aircraft was 40 hours within a restricted test area and constrained by an explicit set of operating limitations. For 14 of the 97 accident aircraft, a Phase I requirement of 25 hours was established, while 1 accident aircraft was assigned a 50 hour requirement.

NTSB The Safety of Experimental Amateur-Built Aircraft 35 Investigators determined the identity of the person performing the first test flight for 73 of the 102 accident aircraft built by the owner. In most of these cases (84 percent), the builder was the test pilot.37 In the remaining cases for which information was available, the first test flight was performed by a more experienced pilot, frequently a friend of the builder. Only 9 of the 102 accident aircraft builders reported having been subject to a requirement for transition training. In most cases, that requirement was imposed by their insurance company. Fifty-six of these builder/owners were issued repairman certificates that authorized them to perform required aircraft condition inspections, and an additional 12 owners held an FAA airframe and powerplant certificate, which also permitted them to perform both maintenance and inspections. 3.5.1 E-AB Aircraft Purchased Used A total of 125 of the accident E-AB aircraft had been bought used. Most (119 of 125) were airplanes, 3 were gyroplanes, 2 were gliders, and 1 was a helicopter. Table 3 summarizes the important characteristics of the used accident E-AB aircraft, separated by kit-built, plans-built, and original design.

37 References to ―test pilot‖ throughout the report are intended to reflect the individual who performed the test flight and do not imply any specific level of qualifications.

NTSB The Safety of Experimental Amateur-Built Aircraft 36 Table 3. Characteristics of accident E-AB aircraft bought used. Aircraft Characteristic Kit-Built Plans-Built Original Design Engine Type Type-Certificated Aircraft Engine 43% 72% 100% Non-Type-Certificated Aircraft Engine 45% 8% 0% Automotive Conversion 12% 15% 0% Other/None 0% 5% 0% Propeller Type Fixed Pitch 51% 69% 100% Ground Adjustable 22% 8% 0% Constant Speed 27% 18% 0% Avionics Conventional 82% 86% 100% Glass Cockpit 18% 14% 0% Landing Gear Configuration Tailwheel 48% 67% 100% Tricycle 49% 26% 0% Other 3% 7% 0% Landing Gear Type Fixed 86% 95% 100% Retractable 14% 5% 0% Number of Seats One 6% 28% 0% Two 89% 59% 100% Three or More 5% 13% 0% Total Accident Aircraft 84 39 2 Most of the accident E-AB aircraft that had been bought used were two-seat, kit-built airplanes with aircraft engines (either type-certificated or non-type-certificated) and conventional avionics. Roughly equal numbers of these airplanes were equipped with tricycle and tailwheel landing gear. The majority of the 39 plans-built aircraft purchased used were similarly equipped, including the only two E-AB gliders involved in accidents during 2011. 3.6 Accidents as a Function of Airframe Hours Airframe hours were available for 67 of the 102 E-AB aircraft built by their owners and for 76 of the 125 E-AB aircraft that had been bought used. Figure 22 shows the cumulative percentages of each group of accident aircraft as a function of total airframe hours since manufacture. It is notable, but not unexpected, that substantially greater proportions of the built-by-owner aircraft were involved in accidents relatively soon after completion. Nearly 50 percent of the built-by-owner aircraft had less than 50 airframe hours at the time of the 2011

NTSB The Safety of Experimental Amateur-Built Aircraft 37 accident, compared with approximately 10 percent of the E-AB aircraft that had been bought used.38

Figure 22. Cumulative proportion of built-by-owner and bought used E-AB aircraft as a function of airframe hours. 3.7 Accidents During Phase I Flight Testing Thirty-four of the calendar year 2011 accidents occurred during the Phase I flight test period required for the airworthiness certification of newly built E-AB aircraft. Thirty-one of these aircraft were built by their owner at the time of the accident, while two had been sold as used aircraft before completing the Phase I flight test period. Most (30 of 34) of these aircraft were airplanes and four were gyroplanes. Twenty-four were kit-built, 9 were plans-built, and 1 was built from an original design. Eight of the Phase I accidents were fatal. Figure 23 shows the CAST/ICAO occurrence category for these accidents, all of which involved a single aircraft.

38 Insufficient data were available to compare the number of Phase I hours flown by the current owner for those aircraft that were bought used. 0 10 20 30 40 50 60 70 80 90 100 < 5 5 to 9 10 to 19 20 to 29 30 to 39 40 to 49 50 to 99 100 to 499

499

Cummulative Percentage of Accidents Airframe Hours Cummulative Proportion of Accident E-AB Aircraft Built by Owner and Bought Used at Increasing Airframe Hours, 2011 Built E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 38

Figure 23. CAST/ICAO occurrence category for the 2011 E-AB accidents during Phase I of the flight test program.

All 11 of the Phase I aircraft that suffered powerplant failures were airplanes, comprising 6 kit-built, 4 plans-built, and 1 original design. Four of the aircraft that suffered powerplant failures were equipped with type-certificated aircraft engines, two were equipped with non-type-certificated aircraft engines, and five were equipped with automotive conversion engines. Ten of the 34 Phase I accidents involved loss of control in flight. Eight of these accidents involved airplanes and two accidents involved gyroplanes. Six of these aircraft were kit-built and four were built from published plans. A requirement for 40 Phase I flight test hours had been established for 33 of the builders, and one was assigned a 25-hour requirement when their airworthiness certificate was issued. Figure 24 shows the total airframe hours accumulated at the time of the accident for each of the 34 Phase I accident aircraft. 0 2 4 6 8 10 12 System/Component Failure (Powerplant) Loss of Control in Flight System/Component Failure (Non-powerplant) Abnormal Runway Contact Collision on Takeoff or Landing Fuel Related Loss of Control on Ground Windshear or Thunderstorm Other Accident Aircraft CAST/ICAO Occurrence Category CAST/ICAO Occurrence Categories of E-AB Aircraft Accidents During Phase I Flight testing, 2011 Total Fatal

NTSB The Safety of Experimental Amateur-Built Aircraft 39

Figure 24. Airframe hours at time of accident. The E-AB aircraft builder was the accident pilot in 29 of the 34 accidents. Two of the accident aircraft were piloted by individuals who had bought the aircraft used during its Phase I test period, two were piloted by individuals recruited to perform the flight test, and one was piloted by the builder‘s spouse. The accident pilot was alone in the aircraft in 32 of the accidents, but a second individual was aboard the aircraft in 2 of the accidents, including 1 accident that was fatal to both individuals. It could not be determined whether the second individual was performing an explicit flight test function in either of those cases. The builder had performed the first test flight of the aircraft in 29 of the 34 E-AB aircraft accidents, including the 8 accidents that occurred on the first test flight. 3.8 Accidents During the First Flight for E-AB Aircraft Built by Owner Ten of the 224 E-AB aircraft accidents during calendar year 2011 occurred during the first flight of the aircraft, including the 8 Phase I aircraft mentioned previously as well as the 2 unregistered aircraft without airworthiness certificates. Seven of these aircraft were airplanes and three were gyroplanes. Seven were kit-built aircraft, and three were plans-built aircraft. Nine 0 10 20 30 40 50 60 70 80 90 100

<11 <13 <15 <17 <19 <21 <23 <25 <27 <29 <31 <33 <35 Cummulative Percent of Aircraft Airframe Hours Cumulative Proportion of Phase I E-AB Accidents with Less Than 35 Airframe hours

NTSB The Safety of Experimental Amateur-Built Aircraft 40 of the ten test pilots were the aircraft builder, while the other test pilot was a certificated flight instructor who had been commissioned to perform the test flight. Five of the builders/test pilots held a private pilot certificate, three held a commercial pilot certificate (including the certificated flight instructor performing the test flight), one held an air transport pilot certificate, and one held a student certificate. Table 4 summarizes the first flight accidents investigated during calendar year 2011. Table 4. Characteristics of the 10 accidents in 2011 that occurred during the first test flight of the newly built E-AB aircraft. NTSB Case

Aircraft Category Aircraft Type Occurrence Category Phase Test Pilot ERA11LA208 Airplane JTD Minimax Collision During Takeoff/Landing Takeoff Builder ERA11LA213 Airplane Volksplane VP1 System/Component Malfunction or Failure (Powerplant) Initial Climb Builder CEN11CA336 Gyroplane KB3 Gyroplane Collision During Takeoff/Landing Takeoff Builder CEN11FA346 Airplane Cassutt III Other Initial Climb Builder CEN11LA432 Airplane Zenith CH-750 Loss of Control in Flight Take Off Builder CEN11LA488 Airplane Volksplane VP1 System/Component Malfunction or Failure (Powerplant) Initial Climb Certified Flight Instructor CEN11FA537 Airplane E-Racer Loss of Control in Flight Maneuvering Builder ERA11LA459 Airplane Pegazair STOL 100 Loss of Control in Flight Initial Climb Builder CEN12LA013 Gyroplane Calidus Autogyro Loss of Control on Ground Landing Builder CEN12CA029 Gyroplane American Autogyro Sparrow Hawk System/Component Malfunction or Failure – (Non-Powerplant) Takeoff Builder

1. 9 Accidents During the First Flight for E-AB Aircraft Bought Used

Fourteen of the E-AB aircraft accidents in 2011 involved used aircraft being flown for the first time by their new owners. Five were fatal accidents, killing six occupants. All of these aircraft were airplanes, 11 kit-built and 3 plans-built. The accident pilot was the second owner of six of these airplanes, but two had had 2 previous owners, and five had had 3 or more previous owners. The new owner was the pilot-in-command in nine of these accidents, and was aboard the

NTSB The Safety of Experimental Amateur-Built Aircraft 41 aircraft with a flight instructor in one case, and with a more experienced pilot in another. Two of the accidents involved the ferry flight of E-AB aircraft by commercial pilots, and one occurred during an evaluation flight conducted for the potential purchaser of a used E-AB aircraft by an air transport-rated pilot. Six of the nine owners piloting their aircraft held private pilot certificates, one held a commercial certificate, one held an air transport pilot certificate, and one new owner did not hold a pilot certificate. Table 5 summarizes the accidents involving the first flight of E-AB aircraft bought used that were investigated during 2011.

NTSB The Safety of Experimental Amateur-Built Aircraft 42 Table 5. Accidents involving the first flight after purchase of E-AB aircraft bought used. NTSB Case

Aircraft Category Aircraft Type Occurrence Category Phase Pilot CEN11CA326 Airplane Quickie Q2 System/Component Malfunction or Failure – (Non-Powerplant) Maneuvering Owner ERA11LA336 Airplane Kitfox II Loss of Control in Flight Initial Climb Friend CEN11FA434 Airplane Lancair 320 Loss of Control in Flight Approach Ferry Pilot CEN11LA455 Airplane Rans S-17 Loss of Control in Flight Initial Climb Owner ERA11CA432 Airplane Rans S-6S Abnormal Runway Contact Takeoff Owner ERA11FA463 Airplane Quad City Ultralight Challenger II Controlled Flight into Terrain Maneuvering Owner CEN11FA597 Airplane Lancair 235 Loss of Control on Ground Takeoff Owner CEN11FA616 Airplane Christen Eagle II System/Component Malfunction or Failure (Powerplant) Initial Climb Owner CEN11LA669 Airplane Vans RV-10 System/Component Malfunction or Failure (Powerplant) En Route Owner ERA12LA011 Airplane Rand Robinson KR-2 Loss of Control in Flight Initial Climb Owner CEN12CA081 Airplane Davis DA-2A Loss of Control on Ground Landing Owner ERA12CA096 Airplane Loehle P-5151 Windshear/Thunderstorm Approach Evaluation Pilot CEN12LA102 Airplane Rans S-12 Loss of Control in Flight Approach Certified Flight Instructor WPR11CA321 Airplane Thorp T-211 Fuel Related En Route Ferry Pilot

NTSB The Safety of Experimental Amateur-Built Aircraft 43

1. The EAA Survey of E-AB Aircraft Owners and

Builders Past evaluations of E-AB aircraft safety have been limited by the lack of background information about E-AB aircraft builders, pilots, and owners. In order to establish a better understanding of this population, the EAA conducted a voluntary, anonymous web-based survey of E-AB aircraft owners from July 15 through August 31, 2011. The EAA shared the resulting anonymous data with the NTSB to support this study. The survey, shown in appendix B, collected demographic and flying experience information from respondents as well as detailed information about their E-AB aircraft and their experiences building, testing, and flying them. The survey data were analyzed by the NTSB and the results are reported in this chapter. The EAA promoted the survey with e-mail invitations to its members and announcements in the EAA e-Hotline electronic newsletter. In addition, the NTSB mailed 22,000 postcards to E-AB aircraft owners listed on the FAA‘s aircraft registry, encouraging them to participate in the EAA survey. Other members of the E-AB aircraft community, including Van‘s Aircraft Company, publicized the EAA survey and encouraged participation. The EAA received more than 5,000 responses to the survey and a total of 4,923 responses were considered sufficiently complete to support data analysis. Survey respondents indicated whether they had already built an E-AB aircraft, were currently building their E-AB aircraft, or had purchased a used E-AB aircraft. Figure 25 shows the distribution of respondents among these categories by the kind of E-AB aircraft they owned.

NTSB The Safety of Experimental Amateur-Built Aircraft 44

Figure 25. Method of E-AB aircraft ownership by type of aircraft. Most (97 percent) of the aircraft described by respondents were airplanes, while the other 3 percent included helicopters, gyroplanes, gliders, balloons, and powered parachutes. The majority (63 percent) of respondents had already built the airplane that they described in the survey, while 24 percent had bought a used E-AB aircraft, and 13 percent were currently building their E-AB aircraft. Figure 26 shows the years since certification for the respondents who built their E-AB aircraft and for those that bought used E-AB aircraft. As might be expected, respondents reporting on E-AB aircraft that they had built described a somewhat newer set of aircraft than did those who reported on E-AB aircraft that they had bought used. 1,129 3,019 646 28 88 13 0 500 1,000 1,500 2,000 2,500 3,000 3,500 Bought Used E-AB Built My E-AB Currently Building E-AB Respondents Method of Ownership Method of E-AB Aircraft Ownership by Type of Aircraft Airplane All Other Aircraft

NTSB The Safety of Experimental Amateur-Built Aircraft 45

Figure 26. Years since certification for E-AB aircraft built by the respondent versus E-AB aircraft bought used by respondents (based on 4,082 survey responses). 4.1 Respondent Demographics The median age of respondents who had bought used E-AB aircraft was 60 years, for those who had already built their E-AB aircraft it was 62 years, and for those currently building their E-AB aircraft it was 56 years. Figure 27 shows the age distribution for these groups of respondents. Nearly 36 percent of respondents who reported their occupation indicated that they were retired. 2% 10% 10% 9% 7% 8% 25% 19% 10% 0 1% 2% 3% 4% 3% 21% 34% 33% 0 5 10 15 20 25 30 35 40 <1 1 2 3 4 5 6–10 11–20

20

Percentage of Respondents Years Since Certification Years Since Certification of E-AB Aircraft Bought Used Versus Built by Owner Built My E-AB Bought Used E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 46 . Figure 27. Respondent age by method of E-AB aircraft ownership. Figure 28 shows the highest pilot certificate held by method of E-AB aircraft ownership for the respondents who provided that information. The majority of respondents held a private pilot certificate, and the type of certificate was relatively uniform across the three groups. 2% 36% 61% 6% 41% 53% 11% 49% 40% 0 10 20 30 40 50 60 70 <40 Years 40–59 Years

59 Years

Percentage of Respondents Respondent Age Respondent Ages by Method of E-AB Aircraft Ownership Built My E-AB Bought Used E-AB Currently Building E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 47

Figure 28. Highest pilot certificate by method of E-AB aircraft ownership.

Figure 29 shows the distribution of total years of pilot experience for each of the method of ownership groups, while Figure 30 shows the total flight hours for each of the groups. Median years of pilot experience for respondents who built their E-AB aircraft was 33 years, for those who bought used E-AB aircraft it was 31 years, and for those currently building their E-AB aircraft it was 23 years. Median total flight hours were 1,311 for respondents who had built their E-AB aircraft, 1,350 hours for those who had bought used E-AB aircraft, and 550 hours for those currently building an E-AB aircraft. Hours of total E-AB aircraft flying experience for the groups are summarized in Figure 31. Here, there is a distinct difference between the ―built my E-AB‖ (median total flight hours was 279 hours) and ―bought used E-AB‖ (median total flight hours was 200 hours) groups on the one hand, and the ―currently building my E-AB‖ group (median total flight hours was 0 hours) on the other, suggesting that this was the first E-AB aircraft experience for most of those currently building such aircraft.

14% 25% 59% 2% 18% 23% 50% 9% 10% 20% 58% 11% 0 10 20 30 40 50 60 70 Airline Transport Pilot Commercial Pilot Private Pilot Lesser Certificate Percentage of Respondents Highest Pilot Certificate Highest Pilot Certificate By Method of E-AB Aircraft Ownership Built My E-AB Bought Used E-AB Currently Building E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 48

Figure 29. Years of pilot experience by method of E-AB aircraft ownership.

0 5 10 15 20 25 30 35 40 45 50 0 1 2 3 4 5–9 10–19 20–39

40

Percentage of Respondents Years of Pilot Experience Years of Pilot Experience by Method of E-AB Aircraft Ownership Built My E-AB Bought Used E-AB Currently Building E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 49

Figure 30. Total Flight Hours by E-AB aircraft method of ownership.

0 5 10 15 20 25 Percentage of Respondents Total Flight Hours Proportion of Respondents in Various Flight Hour Categories by Method of E-AB Ownership Built My E-AB Bought Used E-AB Currently Building E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 50

Figure 31. Total E-AB aircraft flight hours by method of ownership. 4.2 E-AB Aircraft Makes Broadly speaking, an E-AB aircraft project can be characterized as an original design, where the builder creates the design and plans for a unique aircraft, fabricates the various parts, and assembles them as a one-of-a-kind aircraft; a plans-built project, where the builder fabricates the aircraft parts from raw materials (referred to as ―miscellaneous parts‖ on FAA Form 8050-88) and assembles them according to published plans; or a kit-built project, where the builder assembles the aircraft from a kit consisting of prefabricated parts. Figure 32 shows the number of respondents who reported each of these types of building projects by method of E-AB aircraft ownership. 0 10 20 30 40 50 60 70 None 1–9 10–19 20–29 30–49 50–99 100–199 200–299 300–499

499

Percentage of Respondents Total E-AB Flight Hours Flight Hours in E-AB by Method of E-AB Ownership Built My E-AB Bought Used E-AB Currently Building E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 51

Figure 32. Type Building Project by E-AB aircraft method of ownership. Kit-built projects clearly dominate among respondents who have already built their aircraft, bought the aircraft used, or are currently building the aircraft, although a significant number of aircraft in each group are built from published plans. A much smaller number of respondents in each group described an original design. Overall, respondents reported 171 different E-AB aircraft kits accounting for approximately 75 percent of the aircraft in the survey. Appendix E provides additional detail about the manufacturers and models of aircraft built by survey respondents and details of their building process. 4.3 E-AB Aircraft Characteristics Requiring FAA Certificate Endorsements Considering only the 4,794 airplanes described by survey respondents, table 6 shows the percentage of aircraft in each of the E-AB aircraft groups (bought used, already built, or currently being built) displaying the design features for which the FAA requires additional training or endorsements. This table also shows the percentage of owners within those subsets of E-AB aircraft who possess the respective FAA endorsements to their pilot certificate. Some of the owners of these aircraft would not be required to possess a particular endorsement if they had acquired appropriate experience prior to the date that each of these requirements was established. 2% 19% 79% 3% 31% 66% 5% 27% 68% 0 10 20 30 40 50 60 70 80 90 Original Design Plans-Built Kit-Built Percentage of Respondents Build Project Type Type of E-AB Building Project by Method of E-AB Ownership Built My E-AB Bought Used E-AB Currently Building My E-AB

NTSB The Safety of Experimental Amateur-Built Aircraft 52 Table 6. Aircraft design features and corresponding pilot certificate endorsements. Reported Aircraft Design Features Used E-AB Built My E-AB Building My E-AB Engine >200HP 9% 13% 19% Tailwheel Equipped 61% 48% 46% Retractable gear 12% 13% 17% Approved for aerobatics 51% 43% 39% Reported Pilot Certificate Endorsements Used E-AB Built My E-AB Building My E-AB Owners with a high performance endorsement 92% 87% 59% Owners with a tailwheel endorsement 91% 92% 69% Owners with a complex endorsement 81% 72% 56% Only 10 percent to 20 percent of respondents reported the engine horsepower of their aircraft to be above 200, but 92 percent of the respondents who had bought used E-AB aircraft and 87 percent of the respondents who built their E-AB aircraft reported having high performance endorsements to their pilot certificates. Some respondents likely had logged time in high performance aircraft prior to August 4, 1997, and would not be required to possess this endorsement. A substantial proportion of the aircraft described by survey respondents were tailwheel airplanes, and more than 90 percent of owners of these aircraft reported having a tailwheel endorsement. Respondents who had logged time in tailwheel airplanes prior to April 15, 1991, would not be required to have this endorsement. From 12 percent to 17 percent of the respondents‘ aircraft were equipped with retractable landing gear. Most respondents who built their E-AB aircraft (72 percent) or bought it used (81 percent), as well as 56 percent of those building their E-AB aircraft, had an endorsement for complex aircraft. Finally, a large proportion of the aircraft were reported by their owners to be approved for aerobatic maneuvers. The FAA approval for this function is reflected in the airworthiness certificate issued for E-AB aircraft. 4.4 The E-AB Aircraft Building Process The 3,107 respondents who had already completed building their E-AB aircraft (or sometimes several) and the 659 respondents who were currently building an E-AB aircraft provided important insights into the building process. These respondents also indicated that they were aware of the support available from the E-AB aircraft community and that they utilized these resources.

NTSB The Safety of Experimental Amateur-Built Aircraft 53 Of the respondents who had built, or were currently building, their E-AB aircraft, 77 percent had purchased a kit, 20 percent had built, or were building, from published plans, and 3 percent had developed original designs. Of the kit builders, 45 percent reported that they used a kit to save money and 39 percent reported that they used a kit to obtain aircraft performance advantages. Similar results were reported by the plans-built respondents, with 46 percent using published plans to save money and 29 percent using published plans to obtain aircraft performance advantages. Among the 104 respondents who had developed original designs, only 27 percent used an original design to save money and 25 percent used an original design to obtain aircraft performance advantages. Among kit builders, 56 percent had received at least one demonstration flight before they bought their kit. About 35 percent of the demonstrations were provided by the kit manufacturer and 25 percent were provided by private individuals. About 32 percent of the respondents who built, or were building, their aircraft from plans had received a demonstration before they undertook their project, most from private individuals. Eleven percent of respondents creating their own designs had a pre-project demonstration from private individuals. Figure 33 shows the choice of engine among the 3,567 powered aircraft built, or being built, by survey respondents. Most aircraft across all three types of construction were powered by either type-certificated or non-type-certificated versions of traditional aircraft engines. However, 21 percent of the original design aircraft and 20 percent of the plans-built aircraft used converted automobile engines.

NTSB The Safety of Experimental Amateur-Built Aircraft 54

Figure 33. Engine choices among E-AB aircraft builders. Table 7 summarizes the principal equipment characteristics of the 2,898 kit-built, 753 plans-built, and 104 original design aircraft reported by survey respondents. The percentages reported in the table are based on the total responses to each survey item, and the number of responses varies slightly between variables as a function of missing responses to some questions. Most plans-built (80 percent) and original design (55 percent) aircraft were equipped with fixed-pitch propellers, while more kit-built aircraft were equipped with constant-speed propellers (44 percent) than fixed-pitch (37 percent) propellers. Most original design and plans-built aircraft utilized conventional flight instruments, but there is a roughly even split between conventional instruments (54 percent) and glass cockpit avionics (46 percent) in kit-built E-AB aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 55 Table 7. Principal characteristics of the kit-built, plans-built and original design E-AB aircraft built or being built by survey respondents. Aircraft Characteristic Kit Built Plans Built Original Design Propeller Fixed Pitch 37% 80% 55% Ground Adjustable 18% 7% 19% Constant Speed 44% 13% 26% Avionics Conventional 54% 84% 75% Glass Cockpit 46% 16% 25% Landing Gear Configuration Tailwheel 42% 62% 67% Tricycle 56% 36% 30% Other 2% 2% 3% Landing Gear Type Fixed 89% 77% 82% Retractable 11% 23% 18% Number of seats One 4% 25% 33% Two 85% 62% 45% Three or more 11% 12% 22% A large proportion of plans-built (62 percent) and original design (67 percent) E-AB aircraft are equipped with tailwheel landing gear, while the majority (56 percent) of kit-built E-AB aircraft are equipped with tricycle gear. Few E-AB aircraft are equipped with retractable landing gear. Most respondents reported two-seat aircraft, with much smaller numbers of respondents reporting single-seat aircraft or aircraft with more than two seats. Figure 34 shows where the E-AB aircraft were built, or are being built. Most aircraft, whether kit-built, plans-built or original designs, are genuine ―homebuilt‖ projects, with an airport hangar the next most frequent building location.

NTSB The Safety of Experimental Amateur-Built Aircraft 56

Figure 34. The location at which the E-AB aircraft was, or is being, built. Builders have access to a variety of sources of building assistance as they complete their aircraft. Figure 35 shows the sources of assistance that were utilized by the three groups of builders. Help and advice from other builders was the most frequently sought source of assistance by all three categories of builders. Kit manufacturers provided support to purchasers of their kits and sometimes to builders of plans-built projects. EAA Technical Counselors provided assistance to significant numbers of builders in each category, and builders also sought the assistance of certified airframe and powerplant mechanics. Building Facility Used During Build by Project Type Kit-Built (2,995 Respondents) 63.0% (1,888) 33.3% (998) Manufacturer Factory 2.8% (83) Airport Hangar Builder’s Home 76.3% (566) Airport Hangar Plans-Built (742 Respondents) 75.5% (71) 23.4% (22) Original Design (94 Respondents) Builder’s Home Commercial Factory 0.9% (26) Commercial Facility 0.4% (3) 23.3% (173) Builder’s Home Airport Hangar Commercial Facility 1.0% (1)

NTSB The Safety of Experimental Amateur-Built Aircraft 57

Figure 35. Sources of builder assistance. Inspections during the building process also are an important source of support to builders, and Figure 36 identifies categories of individuals who provided this service to the three categories of builders. EAA Technical Counselors were the most frequently used inspectors during the building process, followed by other E-AB aircraft builders. Significant numbers of respondents also reported inspections by aircraft mechanics and FAA inspectors. Builder Assistance Provided During Build by Project Type Kit-Built (5,288 Respondents) Other E-AB Builder 29.7% (1,572) 17.8% (941) Aircraft Mechanic (A&P) EAA Technical Counselor 25.0% (1,321) 27.5% (1,454) Kit Manufacturer Other E-AB Builder 43.4% (447) 23.3% (240) Aircraft Mechanic (A&P) EAA Technical Counselor 26.1% (269) Kit Manufacturer 7.2% (74) Plans-Built (1,030 Respondents) Other E-AB Builder 45.7% (37) 28.4% (23) Aircraft Mechanic (A&P) EAA Technical Counselor 24.7% (20) Kit Manufacturer 1.2% (1) Original Design (81 Respondents)

NTSB The Safety of Experimental Amateur-Built Aircraft 58

Figure 36. Individuals performing inspections during the building process.

E-AB aircraft builders can be certified repairmen, who are then authorized to conduct required annual aircraft condition inspections. Most E-AB aircraft builders, including 86 percent of kit builders, 78 percent of plans builders, and 77 percent of original designers, reported having such certification.39 4.5 Transition Training Survey respondents who had completed their E-AB aircraft were asked about the training that they had completed that was specific to the transition to their new aircraft. Table 8 shows the proportion of each group of E-AB aircraft builders who had received transition training before their first flight in their new aircraft and the sources of that training.

39 On the basis of 2,607 respondents reporting this information. Inspecting Authority Performing Inspection During the Building Process by Project Type Kit-Built (4,077 Respondents) Other E-AB Builder 28.0% (1,142) 24.2% (985) Aircraft Mechanic (A&P) EAA Technical Counselor 32.2% (1,314) 15.6% (636) FAA Inspector 27.2% (270) 24.4% (243) 25.3% (251) Plans-Built (994 Respondents) 20.7% (18) 31.0% (27) 18.4% (16) Original Design (87 Respondents) 23.1% (230) Other E-AB Builder Aircraft Mechanic (A&P) EAA Technical Counselor FAA Inspector 29.9% (26) Other E-AB Builder Aircraft Mechanic (A&P) EAA Technical Counselor FAA Inspector

NTSB The Safety of Experimental Amateur-Built Aircraft 59 Table 8. Source of transition training reported by respondents who had completed their E-AB aircraft. Source of Transition Training Kit-Built Plans-Built Original Design Had training prior to first flight 64% 37% 24% Kit manufacturer 13% 0% 0% Owner of same aircraft 21% 13% 0% Owner of similar aircraft 10% 7% 9% Owner of different aircraft 10% 2% 0% Certificated flight instructor 26% 14% 10% Total number of respondents 2452 578 70 The majority (64 percent) of kit–builders reported some type of transition training prior to their first flight, but this training came from a variety of sources. Only 37 percent of the plans-built and 24 percent of the original design groups reported specific transition training before their first flight. Insurance policies required such transition training for 37 percent of kit builders, 15 percent of the plans builders, and only 3 percent of the original designers. Many respondents (15 percent kit, 27 percent plans, and 37 percent original design) were self-insured, so this requirement did not apply. 4.6 Flight Test and Certification Figure 37 shows the percentage of respondents who applied for airworthiness certification of their E-AB aircraft to ASIs or DARs to initiate the flight test requirement.

NTSB The Safety of Experimental Amateur-Built Aircraft 60

Figure 37. Issuer of airworthiness certificates reported by 2,597 of the 3,103 respondents who had completed their E-AB aircraft. A somewhat higher proportion of kit builders sought airworthiness certification from DARs than from FAA airworthiness inspectors, while the opposite was true of plans-builders and original designers. Of the 2,475 respondents reporting their Phase I flight test requirement, 68 percent of builders were assigned to a 40-hour Phase I flight test period by the FAA and 22 percent were required to complete 25 hours of Phase I flight test. Only a few respondents reported less than 25- or more than 40-hour requirements.40 Most builders reported having either ―very detailed‖ or ―somewhat detailed‖ flight test plans, but the survey did not ask for specifics of the test plans.

40 FAA guidance suggests that a 10-hour test period is sufficient for certain aircraft such as balloons and gliders. 59.7% 34.5% 33.3% 39.8% 64.9% 66.7% 0.4% 0.6% 0.0% 0 10 20 30 40 50 60 70 Kit-Built Plans-Built Original Design Percentage of Respondents Project Type Source of Airworthiness Certification by E-AB Aircraft Build Project Type (2,549 Respondents) DAR FAA Not yet issued

NTSB The Safety of Experimental Amateur-Built Aircraft 61 Figure 38 shows the sources of support used by these 3,103 builders in developing their Phase I test plans. The various sources of support are not mutually exclusive, and it is likely that reference to FAA AC 90-89A was a part of many of these test plans.

Figure 38. Sources of assistance in developing Phase I test plans for the 3,103 respondents who had built their E-AB aircraft. Finally, 79 percent of respondents who had completed building their E-AB aircraft reported performing the first test flight themselves, while 12 percent had hired a test pilot, and 9 percent had asked a friend or more experienced pilot to perform the test flight. 4.7 Owners of E-AB Aircraft Bought Used A total of 1,151 survey respondents reported owning an E-AB aircraft that they had purchased used. Most (98 percent) were airplanes. Kit-built aircraft accounted for 762 25% 22% 6% 49% 22% 5% 14% 39% 16% 3% 41% 6% 3% 13% 53% 16% 3% 27% 1% 6% 7% 0% 10% 20% 30% 40% 50% 60% Percentage of Respondents Assistance Source Sources of Assistance in Developing Phase I Flight Test Plan by E-AB Aircraft Build Project Type (3,103 Respondents) Kit-Built Plans-Built Original Design

NTSB The Safety of Experimental Amateur-Built Aircraft 62 (66 percent) of these aircraft, while 357 (31 percent) were plans-built, and 32 (3 percent) were original designs. Table 9 summarizes the characteristics of these aircraft. Table 9. Characteristics of the E-AB aircraft bought used by survey respondents. Aircraft Characteristic Kit-Built Plans-Built Original Design Propeller Fixed Pitch 42% 81% 62% Ground Adjustable 21% 5% 14% Constant Speed 37% 14% 24% Avionics Conventional 77% 96% 96% Glass Cockpit 23% 4% 4% Landing Gear Configuration Tailwheel 51% 81% 55% Tricycle 47% 19% 41% Other 2% % 4% Landing GearType Fixed 87% 90% 86% Retractable 13% 10% 14% Number of seats One 7% 34% 41% Two 87% 64% 55% Three or more 6% 2% 4% About 60 percent of respondents reported having received at least one demonstration flight before they purchased their used E-AB aircraft. Very few reported that cost (4 percent) or performance (2 percent) were their primary motivations for buying their E-AB aircraft. Figure 39 shows the total hours of flying that these respondents had logged.

NTSB The Safety of Experimental Amateur-Built Aircraft 63

Figure 39. Total hours of flight experience for respondents who purchased used E-AB aircraft (1,132 of 1,151 reporting this information).

0 20 40 60 80 100 120 140 160 180 Respondents Flight Hours Total Flight Hours for Respondents Who Purchased Used E-AB Aircraft by Orginial Build Project Type (1,132 Respondents) Kit-Built Plans-Built Original Design

NTSB The Safety of Experimental Amateur-Built Aircraft 64

1. Analysis and Discussion

Comparisons of accident occurrences and aircraft characteristics indicate that the E-AB aircraft accident record during 2011 was similar to that of the preceding ten-year period. Comparisons of accident records and the EAA‘s survey results indicate that the population of E-AB aircraft and of E-AB aircraft owners involved in accidents is similar, in most respects, to the larger population of E-AB aircraft and E-AB aircraft owners included in the survey. The average E-AB aircraft owners are older, relatively high-time pilots with private pilot or higher certification compared with other general aviation pilots. The E-AB aircraft fleet, as identified by accident and survey information, is increasingly dominated by kit-built airplanes. 5.1 Key Findings The pattern of study results identifies several safety-critical issues that, if addressed, could improve the E-AB aircraft accident record and better prepare pilots to operate E-AB aircraft. Study results indicate:  The largest proportion of E-AB aircraft accidents involved loss of control in flight and powerplant failures, and loss of control in flight has been the greatest contributor to fatal E-AB aircraft accidents.  More than one-half of the E-AB aircraft accidents investigated in 2011 were aircraft that had been purchased used, rather than built by the current owner.  A large proportion of accidents occurs early in the operating life of a new E-AB aircraft, or shortly after being purchased by a new owner.  During 2011, more E-AB aircraft accidents occurred during the first flight by a new owner of a used E-AB aircraft than during the first flight of a newly-built aircraft.  The most common accident occurrence for first flights of both newly-built and newly purchased aircraft was loss of control in flight. As a group, the E-AB accident aircraft did not experience a large number of structural failures or problems related to the strength of a particular aircraft‘s structure. Rather, the occurrences of aircraft system and component malfunctions and failures were most often associated with non-structural systems and components and were typically unique to the accident aircraft. However, the prevalence of accidents involving loss of engine power represents a fleet-wide safety concern for E-AB aircraft. Powerplant malfunctions and failures early in the operational life of a new aircraft include installation or system integrity issues that could be reduced by additional functional testing prior to flight. Powerplant accidents could be further reduced by using recorded data, when available, to monitor the condition and performance of the aircraft engine. Loss of control accidents may result from the unique aircraft controllability and design characteristics of a particular E-AB aircraft and because pilots may be inadequately prepared to

NTSB The Safety of Experimental Amateur-Built Aircraft 65 manage these unique flight characteristics. Accidents may also occur during flight testing if pilots are not prepared for the unique demands of flight testing, or do not follow safe flight test procedures. The safety of flight testing could also be improved by pilots developing and following a detailed flight test plan tailored to the aircraft and using all available information to evaluate and document the aircraft‘s performance during the flight test. Accidents involving subsequent owners of E-AB aircraft could be improved by ensuring that they are provided with the information necessary to safely operate their aircraft. The prevalence of loss of control in flight could be reduced by ensuring that all pilots are adequately trained prior to engaging in flight test operations or transitioning to an unfamiliar E-AB aircraft. The finding that E-AB aircraft accident pilots had significantly more total experience but significantly less experience in the accident aircraft type provides further support for the potential safety benefits of transition training. Finally, the study identified deficiencies in aircraft registration information and accident records pertaining to E-AB aircraft. Future efforts to assess E-AB aircraft safety and to act on identified safety concerns could be greatly improved by addressing these record-keeping deficiencies. 5.2 Opportunities to Improve Safety During Initial Certification The pattern of results in this study identified areas for safety improvement that could be addressed during initial airworthiness certification. These include additional functional testing of aircraft systems to reduce instances of loss of engine power early in the operational life of a new aircraft, and submission of a detailed flight test plan to systematically assess aircraft airworthiness and flight characteristics, and development of a detail aircraft flight manual. 5.2.1 Airworthiness Certification of E-AB Aircraft The United States imposes far less regulatory and safety oversight of E-AB aircraft than other countries,41 particularly prior to issuing an airworthiness certificate. Canadian regulations require the filing of a letter of intent before the project is started, a pre-covering inspection during the building process that ensures that methods of fabrication and workmanship adhere to aviation quality standards, and a final inspection.42 As part of the final inspection, the Canadian builder is required to report the results of a functional test of the aircraft‘s fuel system to ensure that adequate fuel is supplied to the engine in all flight attitudes and to test the integrity of the

41 How Other Countries Address Sophisticated and High-Performance Amateur-Built Aircraft, FAA Memorandum, May 12, 2011. 42 Part V – Airworthiness Manual Chapter 549 – Amateur-Built Aircraft, Canadian Aviation Regulations 2010-1, Revised February 17, 1998.

NTSB The Safety of Experimental Amateur-Built Aircraft 66 fuel supply to the powerplant. The requirement for pre-cover inspections43 was removed from U.S. regulations in 1990.44 In the United States, oversight of an E-AB aircraft effectively begins with the submission of the FAA Form 8130-6, Application for Airworthiness Certificate (Amateur-Built) when the project is completed.45 FAA AC 20-27G provides broad guidance relative to building E-AB aircraft and the application for, and issuance of, an airworthiness certificate permitting the operation of an amateur-built aircraft. An airworthiness certificate for operating amateur-built aircraft may be issued either by an ASI or a DAR upon review of FAA Form 8130-6 (along with a certification that the major portion rule was met and a validation of aircraft registration), review of builder documents, and completion of an airworthiness inspection. Although much of the guidance for documentation review provided in Order 8130.2G is focused on establishing compliance with the major portion requirement, FAA Order 8130.2G, section 4102.d identifies FAA responsibilities at the time of certification to include: (1) ensuring that the aircraft is complete and all documentation is sufficient, (2) examining evidence that appropriate weight and balance measurements have been made to establish most forward and aft center of gravity locations under empty and maximum gross weight conditions; and (3) ensuring that the completed weight and balance report is available in the aircraft along with other applicable placards and markings. Section 4102.g stipulates that the ASI‘s or DAR‘s inspection, at a minimum, will determine that:  The ID plate meets the requirements of 14 CFR 45.11, as applicable.  The information on the ID plate matches the information on FAA Form 8130-6 and Aeronautical Center Form 8050-3.  The aircraft nationality and registration marks are in accordance with 14 CFR Part 45, subpart C.  The flight control system, engine(s), propeller(s), pitot static system, and associated instruments operate properly.  The cockpit instruments are appropriately marked and needed placards are installed and placed for easy reference.  System controls are appropriately placed, clearly marked, provide for easy access and operation, and function as intended by the amateur builder/owner.

43 A ―pre-cover inspection‖ is an inspection conducted before the structural framework of the aircraft is ―covered‖ with skin or other components. 44 FAA, Amateur-Built Aircraft Aviation Rulemaking Committee Final Report, February 14, 2008. 45 See discussion of E-AB airworthiness certification in chapter 1.

NTSB The Safety of Experimental Amateur-Built Aircraft 67  An emergency locator transmitter is installed, if required.46  All explosive devices used in ballistic parachutes are clearly marked and identified. 5.2.2 Functional Test Requirements Among the list of items identified in FAA Order 8130.2G to be determined during inspection for initial airworthiness certification are requirements that the flight controls, engine, and propeller operate properly and that applicants are required to submit a weight and balance report. However, no specific functional testing is currently required. Analyses of E-AB aircraft accidents from 2001 through 2011 identify powerplant malfunctions and failures as the most common E-AB aircraft accident occurrence and second most common fatal accident occurrence overall, and the most common accident occurrence during Phase I flight testing. Results of the EAA survey of E-AB aircraft owners and builders and the accident record also highlight the wide variety of powerplants installed in E-AB aircraft, making powerplant-specific safety improvement efforts more difficult. Investigations of many of the E-AB aircraft accidents during 2011 included in this report are still ongoing at the time of writing. However, there are examples among the completed cases that illustrate the potential safety benefit of requiring builders to conduct, and report the results of, a functional test of the aircraft‘s fuel system prior to certification. On April 27, 2011, in Minford, Ohio, an experimental amateur-built Chang RV-10 airplane was substantially damaged during an emergency landing following an in-flight fire. The aircraft was in the Phase 1 flight test phase and had accumulated about 4 hours flight time when the accident occurred. The pilot reported that he had noticed low fuel pressure during the accident flight and activated the fuel boost pump, after which the fuel pressure returned to within normal limits. As the airplane approached the intended destination airport, the pilot smelled smoke and observed a fire in front of his right foot. He discharged a fire extinguisher, which put out the fire; however, the cabin filled with smoke. He closed the fuel valve and opened the pilot‘s side door. The door separated and some of the smoke dissipated. The pilot made an emergency landing in a pasture, during which the fuselage and right wing were damaged. A postaccident examination of the engine revealed a loose fuel line fitting at the mechanical fuel pump. The fire occurred along the lower fuselage skin in the center console area, which ran forward to aft between the pilot and copilot seats. The lower fuselage skin was burned through as a result of the in-flight fire. The NTSB determined the probable cause of this accident to be a loose fuel line fitting, which caused a fuel leak and subsequent in-flight fire.47 The 2001–2010 accident cases include additional examples involving loss of engine power during the first few hours of operation of a newly built aircraft. Some of the fuel system

46 Title 14 CFR 91.207(f) includes several exemptions to the requirements for U.S.-registered civil airplanes to be equipped with an emergency locator transmitter. Examples include single-person aircraft, aircraft engaged in flight instruction within a 50 nautical mile radius of the originating airport, or aircraft engaged in flight operations incident to design and testing. 47 NTSB accident case number CEN11CA321.

NTSB The Safety of Experimental Amateur-Built Aircraft 68 design and installation problems found in these cases include incorrectly installed fuel lines,48 crimped vent lines,49 system leaks,50 and a fuel system that did not provide adequate fuel pressure to maintain engine power.51 The NTSB concludes that a functional test of the aircraft fuel system could identify design deficiencies, leaks, and malfunctions prior to flight that would prevent fuel system- and powerplant-related accidents early in the operational life of an aircraft. For example, Canadian regulations and guidance for E-AB aircraft certification stipulate that a fuel flow test must be conducted, and a form reporting on the methods and result of this test be submitted during final airworthiness inspection.52 The prevalence of E-AB aircraft powerplant malfunctions and failures would be reduced with the implementation of a similar functional test as part of the airworthiness certification process. Therefore, the NTSB recommends that the FAA revise 14 Code of Federal Regulations 21.193, FAA Order 8130.2G, and related guidance or regulations, as necessary, to define aircraft fuel system functional test procedures and require applicants for an airworthiness certificate for a powered experimental, operating amateur-built aircraft to conduct that test and submit a report of the results for FAA acceptance. 5.2.3 Flight Test Plan FAA AC 90-89A provides extensive guidance to the E-AB aircraft builder for the development and execution of the flight test program, and it begins by stating the primary objectives of the flight test program: a. The most important task for an amateur-builder is to develop a comprehensive FLIGHT TEST PLAN. This PLAN should be individually tailored to define the aircraft‘s specific level of performance. It is therefore important that the entire flight test plan be developed and completed BEFORE the aircraft‘s first flight. b. The objective of a FLIGHT TEST PLAN is to determine the aircraft‘s controllability through-out all the maneuvers and to detect any hazardous operating characteristics or design features. This data should be used in developing a FLIGHT MANUAL that specifies the aircraft‘s performance and defines its operating envelope.53 EAA survey respondents who had achieved airworthiness certification were asked how detailed their flight plans were—37 percent claimed to have a ―very detailed‖ plan, while an additional 47 percent claimed a ―somewhat detailed‖ plan, and 16 percent indicated a ―somewhat informal‖ test plan. No consistent evidence of the existence or quality of flight test plans was available in accident investigation records or FAA certification files for the E-AB aircraft involved in accidents during 2011.

48 For example, see NTSB accident case number LAX04LA132. 49 For example, see NTSB accident case number CEN09CA382. 50 For example, see NTSB accident case number LAX02LA256. 51 For example, see NTSB accident case number LAX07LA220. 52 Refer to Appendix G for a copy of the Canadian fuel flow test report form. 53 FAA AC 90-89A, Amateur-Built Aircraft and Ultralight Flight Testing Handbook, May 24, 1995.

NTSB The Safety of Experimental Amateur-Built Aircraft 69 FAA Order 8130.2G does not require that a builder‘s flight test plan be reviewed by the ASI or DAR. In marked contrast, the United Kingdom‘s CAP 65954 lists the following actions (among others) that the builder must satisfy before being issued a Permit to Fly for Test:55  Have produced and have agreed by the CAA‘s Design and Production Standards Division Test Pilot your proposed flight test programme,  Have agreed with the CAA‘s Test Pilot the competency and suitability of the person(s) who will be undertaking the test flying,  Have agreed with the CAA‘s Test Pilot and the Regional Office Surveyor the arrangements for the management of your flight test program, and  Have produced a preliminary flight manual for the aircraft. Absent a review and assessment of the flight test program by the FAA, the adequacy of the flight test program stipulated in Order 8130.2G cannot be ascertained or ensured. Therefore, the NTSB recommends that the FAA revise 14 Code of Federal Regulations 21.193, FAA Order 8130.2G, and related guidance or regulations, as necessary, to require applicants for an airworthiness certificate for experimental, operating amateur-built aircraft to submit for FAA acceptance a flight test plan that will (1) ensure the aircraft has been adequately tested and has been determined to be safe to fly within the aircraft‘s flight envelope and (2) produce flight test data to develop an accurate and complete aircraft flight manual, and to establish emergency procedures and make a copy of this flight test plan should be made a part of the aircraft‘s certification file. 5.3 Opportunities to Improve Safety During Phase I Flight Test The high proportion of E-AB aircraft accidents occurring early in the operational life of the aircraft, particularly during the first flight, provides evidence for the potential for safety improvements during Phase I flight testing. An area identified for improvement includes making sure that pilots are adequately prepared and capable of conducting flight test operations. The data collected during flight testing and the documentation of flight test results also provides safety-critical information to subsequent aircraft owners and pilots. Additional safety benefits can be had for E-AB aircraft builders and subsequent owners by ensuring that a detailed flight test plan is completed and an aircraft flight manual is created during Phase I testing. 5.3.1 Phase I Flight Testing of E-AB Aircraft Based on the review of the required forms and documents and the inspection of the aircraft, the ASI or DAR will issue a Special Airworthiness Certificate (FAA Form 8130-7) for the Category/Designation – Experimental, and the Purpose – Operating Amateur-Built Aircraft,

54 CAP 659 Amateur Built Aircraft: A Guide to Approval, Construction and Operation of Amateur Built Aircraft, UK Civil Aviation Authority, Aircraft Certification Department, Safety Regulation Group, November 2005. 55 Comparable to the U.S. Phase I authorization granted with the E-AB Airworthiness Certificate.

NTSB The Safety of Experimental Amateur-Built Aircraft 70 ordinarily with an ―unlimited‖ expiration.56 The ASI or DAR will also issue a set of operating limitations for both a Phase I flight test period and Phase II operations, when the flight test period has been completed and recorded in the aircraft logbook. Airworthiness records were reviewed for 223 of the 227 E-AB aircraft involved in accidents during 2011. Most of these files contained copies of Forms 8130-6 and 8130-7, documentation of the major portion requirement, and Phase I and Phase II operating limitations. Relatively few records contained documentation of weight and balance calculations and other details of the aircraft‘s construction that had supported the issuance of the airworthiness certificate.57 The operating limitations issued with the Special Airworthiness Certificate for Operating Amateur-Built Aircraft include three main restrictions during Phase I: (1) All flights must be limited to a specifically defined geographic area over open water or sparsely populated areas having light air traffic, (2) the aircraft must be limited to the specified geographic area for an assigned number of hours, and (3) ―no person may be carried in the aircraft during flight unless that person is essential to the purpose of flight.‖ Under current regulations, Phase I is completed when the builder/owner has self-certified his or her compliance by recording the following, or a similarly worded statement, in the aircraft logbook or records [bolded text appears in the original]: I certify that the prescribed flight test hours have been completed and the aircraft is controllable throughout its normal range of speeds and throughout all maneuvers to be executed, has no hazardous operating characteristics or design features, and is safe for operation. The following aircraft operating data has been demonstrated during the flight testing: speeds VSO ____, VX __, and VY__, and the weight _____ and CG location _____ at which they were obtained. When this logbook endorsement is accomplished, the aircraft enters Phase II for an unlimited duration, the restriction on carrying passengers is removed, and the specific geographic restrictions of Phase I are replaced with the following: This aircraft is prohibited from operating in congested airways or over densely populated areas unless directed by air traffic control, or unless sufficient altitude is maintained to effect a safe emergency landing in the event of a power unit failure, without hazard to persons or property on the ground. FAA Order 8130.2G states that the period of assignment to the Phase I test period should be a minimum of 25 hours for E-AB aircraft with type-certificated engine/propeller combinations and that a minimum of 40 hours is required for any non-type-certificated engine/propeller combination or for any type-certificated engine/propeller combination that has been modified in any way. The recommended Phase I flight testing period for gliders, balloons, and ultralight

56 Expiry limits of E-AB airworthiness certificates changed, in most cases, to unlimited duration in 1979. 57 Current FAA airworthiness records associated with E-AB aircraft do not normally include information such as flight test plans, an aircraft flight manual, or a Pilot‘s Operating Handbook.

NTSB The Safety of Experimental Amateur-Built Aircraft 71 vehicles is ten hours. The order also states that any major change to an E-AB aircraft requires the return to Phase I limitations for a minimum of five hours. The Order does not cite a basis for these guidelines, although FAA AC 90-89A describes a broad flight test program that includes a pre-flight phase with inspections and taxi tests, the important first flight, and subsequent periods of testing dictated by a series of test objectives. 5.3.2 Accidents During Phase I Flight Testing Thirty-four of the E-AB aircraft accidents investigated during 2011 involved aircraft being operated in Phase I, ostensibly undergoing flight testing. Eight of these accidents occurred on the first test flight.58 Unfortunately, no information is available from these accidents regarding the flight test plan that was presumably being followed. An example of an accident involving an E-AB aircraft in Phase I flight testing occurred on July 16, 2011, at 1930 eastern daylight time, when an amateur-built Dixon Volksplane VP-1, collided with a barn following a partial loss of engine power on takeoff from the Jackson County Airport in Jackson, Michigan. The pilot received minor injuries and the airplane was substantially damaged. The 14 CFR Part 91 flight was operating in visual meteorological conditions without a flight plan. The flight was originating at the time of the accident.59 The pilot reported he was making the first flight in the airplane, which was built by someone else. He stated that he inspected the airplane and paperwork and believed the airplane was satisfactory to fly. The pilot was cleared for takeoff on runway 32 and the winds were calm. He stated that the takeoff roll seemed sluggish, but he thought it was due to the warm outside temperature. The airplane lifted off about halfway down the 4,000-foot-long runway. He stated that the airplane was significantly left-wing heavy, but he was able to maintain control by applying right aileron. The airplane was out of ground effect when he reached the end of the runway, at which point the airspeed and engine power were decreasing very slowly. The pilot made a shallow turn in an attempt to land on runway 26. The engine continued to lose power and the airplane stalled at tree top height. The left wing contacted a pole barn, which spun the airplane around prior to it contacting the ground, resulting in substantial damage to the wings and fuselage. The Volkswagen engine was equipped with dual carburetors and an oil cooler. The mixture control setting was preset and was not adjustable from the cockpit. The airplane owner stated that he performed a teardown inspection on the engine following the accident and he was not able to identify any mechanical failures/malfunctions that would have resulted in the loss of engine power. No further engine examination was performed and the reason for the loss of power was not determined.60

58 Two additional first-flight accidents involved unregistered aircraft with no airworthiness certification. 59 NTSB accident case number CEN11LA488. 60 The NTSB determined the probable cause of this accident (NTSB accident case number CEN11LA488) to be a partial loss of engine power during initial climb after takeoff for undetermined reasons.

NTSB The Safety of Experimental Amateur-Built Aircraft 72 Two of the 34 E-AB aircraft accidents involving aircraft operating in Phase I had been bought used before the Phase I testing period had been completed. Therefore, the new owner would have been required to complete the Phase I flight test requirements before conducting normal operations. In both of these cases, the purpose of the accident flight was described to the NTSB investigator as familiarization with the newly purchased aircraft, rather than performance of flight test activities. In one of these cases, this was the new owner‘s first flight. In neither of the cases had a new application for airworthiness certification been filed, or had a new Airworthiness Certificate for Operation of Amateur-Built Aircraft been issued. FAA Order 8130.2G is explicit in stating that the airworthiness certificate is transferred upon the sale of the aircraft and that ―there is no FAA inspection required after transfer of an aircraft with its airworthiness certificate, unless it is determined that revised operating limitations are necessary.‖61 It is not clear how, or by whom, such a determination that revised limitations are necessary would be made. The NTSB concludes that such transfers of ownership, and thus responsibility for the completion of flight test requirements during Phase I, do not ensure an opportunity for the FAA to review and accept the continuing appropriateness of Phase I operating limitations and requirements for the new owner of the aircraft.62 5.3.3 Loss of Control During Phase I Flight Testing Loss of aircraft control in flight made a particularly large contribution to accidents early in the life of the aircraft involved in the 2011 case studies. Four of the eight fatal E-AB aircraft accidents during Phase I flight testing in 2011 were associated with loss of control in flight. The NTSB concludes that the Phase I flight test period is uniquely challenging for most pilots because they must learn to manage the handling characteristics of an unfamiliar aircraft while also managing the challenges of the flight test environment, including instrumentation that is not yet calibrated, controls that may need adjustment, and possible malfunctions or adverse handling characteristics. FAA AC 90-89A, Amateur-Built Aircraft and Ultralight Flight Testing Handbook,63 provides guidance for flight testing amateur-built aircraft and offers safety-related recommendations to assist amateur builders in developing individualized aircraft flight test plans. 5.3.4 Phase I Test Pilot Qualifications The aircraft builder was the test pilot in 29 of the 34 Phase I accidents during 2011. The majority (62 percent) of the 34 test pilots held a private pilot certificate, while 27 percent held commercial pilot certificates. The median age of these pilots was 62 years, the median hours of total flight time was 1,000 hours, and the median hours of experience in the accident make and model was 4 hours. Forty-four percent of these pilots had had no prior mechanical or building experience, 24 percent claimed previous E-AB aircraft building experience, 20 percent were A&P mechanics, and 12 percent reported military aviation experience. FAA AC 90-89A states that Phase I flight test requirements should be performed by pilots who are ―rated, current and

61 FAA Order 8130.2G, Section 4102i. 62 This issue is considered further in a later section of this report, ―Providing Information to Purchasers of Used E-AB Aircraft.‖ 63 http://www.faa.gov/library/manuals/aircraft/media/ac90-89a.pdf.

NTSB The Safety of Experimental Amateur-Built Aircraft 73 competent in the same category and class as the aircraft being tested.‖64 Test pilot flight time requirements suggested by FAA AC 90-89A are:

1. 100 hours of solo time before flight testing a kit plane or an aircraft built from a

time-proven set of plans.

1. 200 hours of solo time before flight testing a ‗one-of-a-kind‘ or high-performance

aircraft.

1. A minimum of 50 recent takeoffs and landings in a conventional (tailwheel aircraft) if

the aircraft to be tested is a tail dragger. FAA AC 90-89A also recommends that the builder attach the same budgetary and time priority to obtaining and maintaining pilot competence as is assigned to the building project, if he or she intends to perform the test pilot functions. The NTSB concludes that the E-AB aircraft safety record could be improved by providing pilots with additional training and guidance to safely perform Phase I test pilot functions. The EAA periodically offers a Sport Aviation Workshop titled Test Flying and Developing Pilot Operating Handbook. The focus of this course is to assist the builder/pilot to safely explore the aircraft‘s flight envelope, gather and interpret flight test data and develop the aircraft flight manual. The EAA‘s Flight Advisor Program also provides support to the builder/pilot in developing and executing a flight test program. Therefore, the NTSB recommends that the FAA and the EAA identify and apply incentives to encourage owners, builders, and pilots of E-AB aircraft to complete flight test training, such as that available in the Experimental Aircraft Association‘s Test Flying and Developing Pilot Operating Handbook, prior to conducting flight tests of E-AB aircraft. 5.3.5 Additional Persons Onboard During Phase I Flight Testing On September 27, 2011, at 1915 eastern daylight time, an Owen model Vans RV-10 airplane, N499RV, was substantially damaged during a forced landing and post-impact ground fire near Marietta, Ohio. The pilot and passenger sustained serious injuries. The local flight departed Mid-Ohio Valley Regional Airport, near Parkersburg, West Virginia, at 1855. According to the pilot, the purpose of the flight was to familiarize himself with the experimental amateur-built airplane. The pilot-rated passenger had contributed in the assembly of the airplane and subsequently completed about 20 hours of flight testing on the airplane before the accident flight. The pilot stated that after departure he completed 15–20 minutes of basic flight maneuvers before returning to the departure airport. After receiving a clearance from the tower controller, he reduced engine power to initiate a descent from 3,000 feet mean sea level. The passenger suggested using a higher engine power setting during the cruise-descent. As the pilot slowly increased engine power, they heard a loud bang from the engine and oil began covering the windscreen. He noted that the engine continued to run erratically, but engine speed could not be controlled using the throttle or propeller controls. The pilot relinquished control of the aircraft to the passenger, who had more experience in the accident airplane, and a forced

64 http://www.faa.gov/library/manuals/aircraft/media/ac90-89a.pdf.

NTSB The Safety of Experimental Amateur-Built Aircraft 74 landing was made to a nearby wooded area. The airplane was extensively damaged during a post-impact ground fire. In this and one other Phase I accident during 2011, there were two individuals aboard the accident aircraft, in apparent conflict with the operating limitation that, ―During the flight testing phase, no person may be carried in this aircraft during flight unless that person is essential to the purpose of flight.‖ In the other Phase I accident with two persons on board, the second individual was described as a copilot/observer who was involved with the building of the aircraft. While FAA Order 8130.2G does not precisely define ―essential to the purpose of flight,‖ it is generally understood that this provision does not encompass training of the E-AB aircraft builder. The position taken by the EAA in response to a question posed to its home-builders website was as follows:65 We concur with the FAA that during all flight testing only the test pilot is allowed in the aircraft. We have yet to see a homebuilt aircraft that requires a co-pilot. If flight data needs to be recorded, make use of a tape recorder or other recording device to record flight data, e.g., airspeeds, engine instrument readings, etc. While it is true that virtually all E-AB aircraft are single pilot aircraft, it is likely that the safety and efficiency of some Phase I flight test activities would be enhanced by the presence, in the cockpit, of two qualified pilots. Results of accident data analyses, FAA guidance materials, and the qualitative feedback from subject matters experts, such as the EAA Builder‘s Council, indicate that even experienced pilots are at a particularly high risk of accidents early in the life of a new E-AB aircraft. Some builders have sought the assistance of another pilot to assist in the flight test process, but FAA Order 8130.2G currently prohibits anyone other than the pilot to occupy an aircraft during the Phase 1 flight test period. The NTSB agrees with the EAA position that transition training should not be combined with Phase I flight testing requirements. However, the NTSB believes that the safety of E-AB aircraft flight testing could be improved for some pilots and flight test circumstances if a qualified second pilot was authorized to accompany the pilot for the purpose of flight testing and not training. Other countries specify provisions for more than one pilot to occupy an aircraft during flight testing. For example, the U.K.‘s CAP 659 advises that: If you need an additional crewmember for a particular flight test, then specify this in your flight test programme and have it agreed by the CAA‘s Test Pilot and the [Regional Office] Surveyor. When agreed, we will list this need in the operating limitations on your Permit to Fly for Test. FAA AC 20-27G contains language similar to this statement from CAP 659; however, no related guidance is provided to ASIs or DARs in Order 8130.2G. Providing pilots with a clearly defined policy regarding authorizing the presence of a second pilot would enhance flight safety during portions of the flight test program that simultaneously demand high levels of piloting skill and the capture of necessary flight test data. Therefore, the NTSB recommends that the FAA

65 http://members.eaa.org/home/homebuilders/faq/3Pilot%20Checkouts%20during%20the%20flight%20test% 20period.html.

NTSB The Safety of Experimental Amateur-Built Aircraft 75 revise Order 8130.2G, and related guidance or regulations, as necessary, to clarify those circumstances in which a second qualified pilot could be authorized to assist in the performance of flight tests when specified in the flight test plan and Phase I operating limitations. 5.3.6 Completion of Phase I Flight Testing FAA Order 8130.2G states that an explicit flight test program must be accomplished before E-AB aircraft are issued an airworthiness certificate and Phase I operating limitations can enter the less restrictive Phase II operating limitations. Showing Compliance to 14 CFR 91.319(b).66 The applicant should be advised that after the experimental amateur-built airworthiness certificate has been issued, they must show compliance to 14 CFR 91.319(b). This is done by developing a flight test program that addresses the requirements, goals, and objectives of each test flight. The flight test program should be developed in accordance with AC 90-89, Amateur-Built Aircraft and Ultralight Flight Testing Handbook, or its equivalent in scope and detail. Flight test programs serve two purposes: They ensure the aircraft has been adequately tested and determined to be safe to fly within the aircraft‘s flight envelope. The flight test data is used to develop an accurate and complete aircraft flight manual and to establish emergency procedures. The owner/builder‘s self-endorsement in the aircraft logbook and maintenance records, stating that the prescribed flight hours were completed, is the only explicit evidence that the aircraft has been shown to comply with 14 CFR 91.319(b). There is no requirement that the ASI or DAR confirm this claim. The UK‘s CAP 659, in comparison, provides that:  Once the flight test programme has been completed and the CAA‘s Test Pilot has accepted your flight test results, the Design Surveyor needs to be informed so that he can finalise any design approvals outstanding for your aircraft. He will also liaise with our Test Pilot to ensure that your flight manual is acceptable to us.  When the Design Surveyor has completed and issued any outstanding design approvals and the flight manual has been approved, the RO Surveyor will issue the full Permit to Fly67 for your aircraft In addition to the guidance provided by FAA AC 90-89A, the EAA, many kit manufacturers, and type clubs also provide guidance and training directed toward the

66 Title 14 CFR 91.319(b) prescribes operating limitations of aircraft having experimental airworthiness certificates. The FAA may authorize changes to the operating limitations of 14 CFR 91.319 through special operating limitations issued to an individual aircraft. 67 Comparable to the authorization provided by the U.S. Phase II operating limitations.

NTSB The Safety of Experimental Amateur-Built Aircraft 76 development and conduct of a flight test plan and the preparation of an aircraft flight manual. One of EAA‘s Sport Aviation Workshops, for example, is a two-day course titled Test Flying & Developing Pilot Operating Handbook.68 FAA AC 90-89A advises builders that: It is imperative a flight manual describing the anticipated performance of the aircraft be written by the aircraft builder/kit manufacturer. The manual will be revised several times during the flight test phase until it accurately reports the aircraft‘s performance. The NTSB concludes that because no mechanism, other than the builder‘s self-certification, currently exists to ensure that the aircraft has been adequately tested and determined to be safe to fly within the aircraft‘s flight envelope or that the flight test data is used to develop an accurate and complete aircraft flight manual and to establish emergency procedures, it is likely that these flight test objectives are not achieved for some E-AB aircraft. The NTSB further concludes that the risk of E-AB aircraft accidents could be reduced by verifying that all E-AB aircraft are adequately tested according to a flight test plan, and that the resulting test data are used to create an accurate and complete aircraft flight manual. Therefore, the NTSB recommends that the FAA revise Order 8130.2G, and related guidance or regulations, as necessary, to require the review and acceptance of the completed test plan documents and aircraft flight manual (or its equivalent) that documents the aircraft‘s performance data and operating envelope, and that establishes emergency procedures, prior to the issuance of Phase II operating limitations. 5.3.7 Use of Recorded Data for Phase I Flight Testing and Continued Airworthiness FAA AC 90-89A describes, in general terms, the tests to be performed to explore the aircraft‘s flight envelope but does not prescribe specific parameters to be measured or data to be collected. Since FAA AC 90-89A was published on May 24, 1995, a number of technological improvements to such data collection have been introduced. Citing these data recording capabilities in its 2010 safety study of the introduction of glass cockpit avionics into light aircraft,69 the NTSB concluded, ―Some glass cockpit displays include recording capabilities that have significantly benefited accident investigations and that provide the general aviation community with the ability to improve equipment reliability and the safety and efficiency of aircraft operations through data analyses.‖ Similarly, a number of manufacturers make electronic flight information systems and primary flight displays that provide capable and sophisticated electronic recording of aerodynamic and engine parameters that can greatly facilitate the collection of data needed to carefully map the E-AB aircraft‘s flight envelope and performance characteristics. Glass cockpit avionics were reported by 16 percent of EAA survey respondents who had bought used aircraft, 35 percent of respondents who had finished their E-AB aircraft, and 58 percent of respondents

68 http://www.sportair.com/schedule.html. 69 National Transportation Safety Board. 2010. Introduction of Glass Cockpit Avionics into Light Aircraft. Safety Study NTSB/SS-10/01. Washington, DC. Available: http://www.ntsb.gov/doclib/safetystudies/SS1001.pdf.

NTSB The Safety of Experimental Amateur-Built Aircraft 77 who were in the process of building their aircraft. Among the 2011 accident aircraft, 34 percent of the built-by-owner aircraft were equipped with glass cockpit instruments compared with 14 percent of the bought-used accident aircraft. Van‘s Aircraft, for example, publishes a flight test data template and sample flight test data for RV-12 on their website, based on the data-recording capabilities of the Dynon EFIS systems that are included with this kit. The NTSB concludes that data obtained from glass cockpit avionics, electronic flight instruments, or other recording devices can significantly enhance the efficient accomplishment of flight test objectives, as well as the monitoring of parameters important to the continuing airworthiness of the E-AB aircraft, provided that they are demonstrated to be precise and reliable, record at sufficiently high sampling rates, and are easily downloaded by the aircraft owner. Therefore, the NTSB recommends that the FAA revise AC 90-89A, Amateur-Built Aircraft and Ultralight Flight Testing Handbook, to include guidance for the use of recorded flight data for the purposes of flight testing and maintaining continued airworthiness of experimental aircraft. The NTSB further recommends that once developed, the FAA revise Order 8130.2G, and related guidance or regulations, as necessary, to include provisions for the use of electronic data recordings from electronic flight displays, engine instruments, or other recording devices in support of Phase I flight testing of E-AB aircraft to document the aircraft performance data and operating envelope and develop an accurate and complete aircraft flight manual. The NTSB also recommends that the EAA work with its membership, aircraft kit manufacturers, and avionics manufacturers to develop standards for the recording of data in electronic flight displays, engine instruments, or other recording devices to be used in support of flight tests or continued airworthiness of E-AB aircraft. 5.4 Training and Information to Prevent Loss of Control in Flight As previously noted, the largest proportion of fatal E-AB aircraft accidents has historically involved loss of aircraft control in flight. The study identified several opportunities to reduce loss of control accidents by improving pilots‘ access to training prior to flying an E-AB aircraft, and ensuring that pilots have the performance information necessary to safely operate their E-AB aircraft. 5.4.1 Transition Training The FAA and the EAA, as well as several E-AB aircraft kit manufacturers and aircraft type clubs, strongly encourage specific training for pilots transitioning to E-AB aircraft and provide information and resources to support this training. Transition training is needed to prepare E-AB aircraft pilots for the unique handling characteristics of their aircraft. According to the EAA, the network of advisors comprising its Flight Advisor program, 70 …helps with everything from finding the right instructor and planning a first flight to determining the types of additional training needed. More than 500 flight

70 http://www.eaa.org/flightadvisors/.

NTSB The Safety of Experimental Amateur-Built Aircraft 78 advisors council members considering purchasing an aircraft, preparing for flight in a newly built or restored aircraft, or looking to transition to a high performance or unfamiliar aircraft. In the summer of 2011, representatives of the EAA, pilot groups, and owner type clubs announced the intention to form a coalition to improve safety. One of the planned efforts is to specifically seek out pilots transitioning to new aircraft to notify them of model-specific safety information and how to obtain transition training.71 In March 2011, the FAA also published AC 90-109, Airmen Transition to Experimental or Unfamiliar Airplanes, to be used as a guide for pilots flying an aircraft for the first time, with an emphasis on amateur-built experimental aircraft. Analysis of responses to the EAA survey of E-AB aircraft owners and builders indicates that 1,499 (58 percent) of the 2,583 respondents who built their E-AB aircraft and who answered the question reported some type of transition training prior to their first flight. In contrast, NTSB investigators found evidence of a transition training requirement—typically from an aircraft insurance company—for only 19 (8 percent) of the 227 pilots of E-AB accident aircraft investigated in 2011. While the lack of evidence for transition training or an insurance training requirement on the basis of accident investigation records may underestimate the actual incidence of such training (particularly for fatal accidents where the pilot could not be interviewed), the reported proportion is strikingly low. The NTSB concludes that the difference between the EAA survey respondents and the 2011 accident pilots suggests that pilots who did not seek training were overrepresented in the accidents, and that E-AB aircraft accidents involving of loss of aircraft control could be reduced if more pilots received transition training. 5.4.2 Barriers to E-AB Aircraft Transition Training During focus group discussions with NTSB investigators during EAA AirVenture 2011, members of the EAA Builder‘s Council stressed the importance of transition training for any pilot transitioning from one type of aircraft to another. They noted that this is particularly true of E-AB aircraft, which frequently have different handling characteristics than the type-certificated aircraft with which pilots may be familiar.72 Members of the Builder‘s Council referenced regulations regarding the use of experimental aircraft that limit pilot‘s access to transition training. Specifically, they referred to limitations in 14 CFR 91.319, which states: (a) No person may operate an aircraft that has an experimental certificate—(1) For other than the purpose for which the certificate was issued; or (2) Carrying persons or property for compensation or hire. As referenced in that limitation, 14 CFR 21.191 states that experimental certificates are issued for the following purposes:

71 http://www.airventure.org/news/2011/110729_type_clubs.html. 72 The need for focused transition training was the object of recommendations A-99-007 and A-99-009, which were issued in 1999, and classified ―Closed—Acceptable Action‖ in 2000 and 2001 respectively. These recommendations resulted from the NTSB investigation (LAX98FA008) of an accident on October 12, 1997, near Pacific Grove, California, involving an experimental amateur-built Adrian Davis Long-EZ. The aircraft was piloted by singer John Denver, who was fatally injured as a result of the accident.

NTSB The Safety of Experimental Amateur-Built Aircraft 79  Research and development.  Showing compliance with regulations.  Crew training.  Exhibition.  Air racing.  Market surveys.  Operating amateur-built aircraft.  Operating primary kit-built aircraft.  Operating light-sport aircraft (LSA). Guidance to FAA inspectors in FAA Order 8900.173 explicitly states that the term ―crew training‖ in section 21.191 does not permit for-hire pilot flight training. The inspector guidance in FAA Order 8900.1 further states: Use of Experimental Aircraft for Flight Training. Persons may receive, and provide compensation for, flight training in an aircraft holding an experimental certificate issued for any of the purposes specified in section 21.191. Other than the person receiving flight training, the operation must not involve the carriage of persons or property for compensation or hire or be prohibited by the aircraft‘s operating limitations. Flight Instructors. Flight instructors may receive compensation for providing flight training in an experimental aircraft, but may not receive compensation for the use of the aircraft in which they provide that flight training unless in accordance with a LODA issued under section 91.319(h) and as described in paragraph 3-293. An experimental aircraft owner may not rent an experimental LSA to a person for the purpose of conducting solo flight. Experimental Aircraft Owners. Owners of experimental aircraft may receive, and provide compensation for, flight training received in their aircraft. An owner of an experimental aircraft may not receive compensation for the use of their aircraft to provide flight training except in accordance with a LODA issued under [section] 91.319(h) and described in paragraph 3-293. An owner of an experimental LSA may not rent the experimental LSA to a person for the purpose of conducting solo flights.

73 FAA Order 8900.1, Flight Standards Information Management System (FSIMS) CHG 155, May 24, 2011, Use of Aircraft Issued Experimental Certificates in Flight Training for Compensation or Hire, http://fsims.faa.gov/wdocs/8900.1/v03%20tech%20admin/chapter%2011/03_011_001.pdf.

NTSB The Safety of Experimental Amateur-Built Aircraft 80 The LODA mentioned in this section is referencing a Letter of Deviation Authority. Title 14 CFR 91.319(h) permits the FAA to issue a LODA to an applicant for the purpose of conducting flight training. A LODA permits the holder to provide flight training for compensation in an experimental aircraft which the holder provides. Based on discussions with members of the EAA Builder‘s Council, E-AB aircraft builders, kit manufacturers and type club representatives, the NTSB concludes that the guidance currently available to qualified E-AB aircraft owner/instructors to obtain a LODA to conduct flight training is deficient and variable from one FAA region to another. Based on discussions, the NTSB concludes that the difficulty of finding suitable E-AB aircraft and instructors available for training presents a barrier to pilots seeking transition training. Therefore, the NTSB recommends that the FAA develop and publish an advisory circular, or similar guidance, for the issuance of a LODA to conduct flight instruction in an experimental aircraft, to include sample documentation and sample training materials. The NTSB also recommends that the EAA create and publish a repository of voluntarily provided information regarding holders of LODAs to conduct flight instruction in experimental aircraft. The NTSB acknowledges that the development of guidance materials and related regulatory actions will likely require considerable time. However, voluntary efforts such as the planned creation of a coalition of kit manufacturers could assist in the promotion of transition training in the interim. Therefore, the NTSB recommends to the FAA and the EAA that they complete planned action74 to create a coalition of kit manufacturers, type clubs, and pilot and owner groups and (1) develop transition training resources and (2) identify and apply incentives to encourage both builders of E-AB aircraft and purchasers of used E-AB aircraft to complete the training that is developed. 5.4.3 Providing Information to Purchasers of Used E-AB Aircraft On August 25, 2011, at 1856 eastern daylight time, a Nichols model Lancair 235 airplane, N777BN, was substantially damaged when it impacted trees and terrain during initial climb from Newark-Heath Airport, Heath, Ohio. The pilot was fatally injured. The airplane was registered to and operated by a private pilot, under the provisions of 14 CFR Part 91. Daytime visual meteorological conditions prevailed for the flight, which was operated without a flight plan. The local flight was originating at the time of the accident. A witness stated that the airplane appeared to be ―very unstable‖ after it became airborne, alternately rolling right and left while remaining only a few feet above the runway. The witness noted that he did not believe the pilot had control of the airplane. The airplane then turned left and proceeded off the runway directly toward the witness‘s position. The witness noted that the airplane continued to fly erratically, with continuous pitch, yaw, and roll changes, and cleared a row of hangars by approximately 10 feet. The airplane continued in a climb to 100–150 feet above the ground before it banked sharply to the left and entered a nose-down descent into trees.

74 http://www.airventure.org/news/2011/110729_type_clubs.html.

NTSB The Safety of Experimental Amateur-Built Aircraft 81 The experimental amateur-built airplane had accumulated 1,131 hours since being issued an airworthiness certificate on August 10, 1990. The pilot reportedly had not flown the airplane since he purchased it from the original builder on September 14, 2010.75 In FAA AC 90-109, regarding pilots transitioning to unfamiliar aircraft, the FAA states: Current accident analysis indicates that subsequent owners and/or pilots of experimental airplanes, during initial flight time, have a higher accident rate than that of the original owner/pilot. Therefore, the recommendation is that the subsequent owners/pilots of experimental airplanes receive airplane-specific training before operating the airplane. Fifty-five percent (125 of 227) of the 2011 accident aircraft had been bought used, but it was not possible, on the basis of available data, to determine if the risk was higher for this group than for the original builders of E-AB aircraft. FAA AC 90-109 goes on to state: The new buyer of an experimental airplane may not fully understand the challenges of transitioning to a new airplane, particularly one which has characteristics outside his or her previous aviation experience. The NTSB concludes that purchasers of used E-AB aircraft face particular challenges in transitioning to the unfamiliar E-AB aircraft. Like builders of new E-AB aircraft, they must learn to manage the unique handling characteristics of their aircraft, but they must also learn the systems, structure, and equipment without the firsthand knowledge afforded to the builder. In this regard, FAA AC 90-109 states that, to become familiar and competent in the new airplane, pilots should follow an organized methodology that includes the systems, procedures, performance, and limitations applicable to their aircraft. However, this guidance includes a caution that: Even in simple airplanes of a similar design or even the same model, the innovation of individual designers and builders may cause problems for a pilot new to the airplane. Pilots of type-certificated aircraft have access to the applicable aircraft and systems information in the Pilot’s Operating Handbook developed by the airplane manufacturer, which contains the FAA-approved aircraft flight manual. However, unless the original builder of an E-AB aircraft creates similar materials during the course of aircraft flight testing, a subsequent owner may not have the detailed aircraft information necessary to support safe operation during transition to the aircraft and subsequent operation of the aircraft. The NTSB concludes that accident case studies included in this report indicate that not all builders of E-AB aircraft create a detailed aircraft flight manual during Phase I flight testing. For example, on March 29, 2011, about 1630 eastern daylight time, an experimental amateur-built Hrosik Aventura II, N5842, was substantially damaged during a collision with terrain after takeoff from Thunderbird Air Park, Crescent City, Florida. The certificated sport

75 NTSB investigation case number CEN11FA597.

NTSB The Safety of Experimental Amateur-Built Aircraft 82 pilot sustained a minor injury. In a written statement, the pilot said the purpose of the flight was to position the amphibious airplane at the Sun ‗n Fun Fly-In so that it could be offered for auction. According to the FAA inspector, there was no checklist for the airplane, no placarded V-speeds in the cockpit, and no color-coded airspeed range markings on the airspeed indicator.76 As discussed earlier in this chapter, the development of a detailed aircraft flight manual is an intended product of E-AB aircraft flight testing. The NTSB concludes that absent an appropriate aircraft flight manual, purchasers of used E-AB aircraft are not provided with sufficient information to understand the aircraft‘s controllability throughout all maneuvers, to detect any hazardous operating characteristics, or to understand emergency procedures. Therefore, the NTSB recommends that the FAA revise 14 Code of Federal Regulations 47.31 and related guidance or regulations, as necessary, to require the review and acceptance of aircraft operating limitations and supporting documentation as a condition of registration or re-registration of an experimental amateur-built aircraft. The NTSB also recommends that the FAA revise Order 8130.2G, and related guidance or regulations, as necessary, to include provisions for modifying the operating limitations of aircraft previously certificated as experimental, operating amateur-built, such as returning the aircraft to Phase I flight testing, as necessary, to address identified safety concerns or to correct deficiencies in the aircraft flight manual or equivalent documents. 5.5 Accurate Identification of Amateur-Built Aircraft Finally, the study found problems related to the accurate identification of amateur-built aircraft, and the aircraft make and model, that currently make effective E-AB aircraft safety oversight difficult. Section 501(a) of the Federal Aviation Act of 1958, as amended, codified at section 44102(b) of title 49, United States Code, requires registration as a condition to the operation of any applicable aircraft, and this Statutory requirement is implemented by the 14 CFR Parts 47 and 49 that include regulations for aircraft registration and related documentation. Title 14 CFR 49.11 establishes the FAA Aircraft Registry as the official custodian of U.S. aviation aircraft records. The FAA Flight Standards Service, Civil Aviation Registry, Aircraft Registration Branch is responsible for the review, evaluation, and development of any new or amended regulations pertaining to aircraft registration and recording of documents contained in 14 CFR Parts 47 and 49. The registry provides information to FAA Aviation Safety Inspectors and NTSB investigators to support aviation safety activities and provides statistics for aviation safety analyses. Registry records are also a source of aircraft owner contact information to publicize aircraft- or fleet-specific safety programs or safety concerns.77 The registry maintains a publicly available database containing fields identifying each U.S. registered aircraft by its current registration number, its unique airframe serial number, and characteristics like category and engine type. Aircraft type is identified in the registry with the combination of two fields, aircraft manufacturer and aircraft model, and the FAA uses the

76 NTSB investigation case number ERA11LA228. 77 http://www.faa.gov/about/office_org/headquarters_offices/avs/offices/afs/afs700/reg_responsibilities/.

NTSB The Safety of Experimental Amateur-Built Aircraft 83 combination of these details to assign a manufacturer-model code that is also recorded in the registry. For type-certificated aircraft, the manufacturer field identifies the aircraft builder and the model field indicates the model and series. For example, the Registry database fields for a common type-certificated light aircraft would be Cessna Aircraft Company for the manufacturer and 172S for the model. When registering a new E-AB aircraft, the aircraft owner/builder must submit:  An Affidavit of Ownership for Experimental Aircraft, AC Form 8050-88,78 establishing ownership and the formal description of the aircraft. The model name and serial number provided on this form by the builder, along with the builder‘s name, becomes the official aircraft description.  An Aircraft Registration Application, AC Form 8050-1,79 containing the same aircraft description provided on the affidavit.  And, if more than 50 percent of your amateur-built aircraft was built from a kit, the owner must also include a kit bill of sale from the kit manufacturer. Unlike a type-certificated aircraft, when a builder registers an amateur-built aircraft he or she is free to choose a manufacturer and model name to identify their aircraft regardless of the aircraft design. For example, the builder of an experimental amateur-built kit, such as a Van‘s Aircraft RV-9 kit, may register the aircraft as John Doe for the manufacturer and Model 1 for the model. The design of the original kit would not be identifiable from the registry database record, even though the kit bill of sale is required to be submitted during registration and is retained in the registry‘s records. As discussed in chapter 3 and appendix C of this report, incorrect identification of E-AB aircraft in NTSB accident records has affected the tracking and analysis of E-AB aircraft safety issues and the problem has increased since the introduction of the Special Light-Sport and Experimental Light-Sport certification categories. The ability to accurately identify E-AB aircraft built from a kit or from plans of a recognized design would be greatly improved if the FAA Civil Aircraft Registry database were modified to capture aircraft manufacturer, make, and model.80 Although the terms are often used interchangeably, manufacturer and make are not synonymous. With regard to aircraft, ―make‖ identifies an aircraft design and ―manufacturer‖ identifies the entity that constructs an aircraft. As applied to the previous example, the addition of make information would allow identification of the previous example John Doe Model 1 as being a Van‘s Aircraft kit. The addition of aircraft make information to the FAA Civil Aircraft Registry database would also improve the identification of type-certificated aircraft that are produced by more than one manufacturer. The CAST/ICAO Common Taxonomy Team (CICTT) has developed

78 http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/media/8050-88.pdf. 79 http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_registry/faa_customer_service_ forms/##ACForm8050-1. 80 The NTSB identified similar concerns regarding identification of E-AB aircraft kits owners in its August 29, 1997, Safety Recommendation letter to the FAA (A-97-53, ―Closed—Acceptable Action,‖ December 1998).

NTSB The Safety of Experimental Amateur-Built Aircraft 84 business rules for the identification of aircraft. The CICTT aircraft make/model/series taxonomy has been included in the ECCAIRS81 software suite used by ICAO and aviation safety authorities worldwide to manage safety data and is used to identify aircraft in the International Registry of Mobile Assets.82 The inability to identify the aircraft design in the FAA Civil Aircraft Registry limits the ability to conduct safety analyses and hampers notification of aircraft owners in the event that an aircraft- or engine-specific issue is ever identified. The NTSB concludes that accurate identification of experimental amateur-built aircraft would greatly improve the ability to assess the continued safety of experimental aircraft and identify design-specific safety issues. Therefore, the NTSB recommends that the FAA revise the Civil Aircraft Registry database to include a means of identifying aircraft manufacturer, make, model, and series—such as the aircraft make, model, and series classification developed by the CAST/ICAO Common Taxonomy Team—that unambiguously identifies the aircraft kit or plans design as well as the builder of the aircraft.

81 European Coordination Centre for Accident and Incident Reporting Systems (ECCAIRS) is a cooperative network of international Transport Authorities and Accident Investigation Bodies. The project is being managed by the Joint Research Centre (JRC) of the European Commission. The ECCAIRS Reporting System, developed by the JRC, is a software suite used for reporting, analysis, and sharing of safety data. For additional information, see: http://eccairsportal.jrc.ec.europa.eu/. 82 The International Registry operates under the legal framework of the Cape Town Convention and the Aircraft Protocol adopted on the 16th of November 2001 at Cape Town. It provides for the registration and protection of ‗international interests‘ that are recognized by all ratifying states, of which the United States of America is included. Aircraft and aircraft engines eligible for International Registry recording include airframes that are type certificated to transport at least eight persons including crew or goods in excess of 2,750 kilograms (6,050 pounds); helicopters that are type certificated to transport at least five persons including crew or goods in excess of 450 kilograms (990 pounds); jet propulsion aircraft engines with at least 1,750 pounds of thrust or its equivalent; and turbine-powered or Piston-powered aircraft engines with at least 550 rated take-off horsepower or its equivalent. For more information see: http://www.internationalregistry.aero.

NTSB The Safety of Experimental Amateur-Built Aircraft 85

1. Conclusions

Experimental amateur-built aircraft represents a growing segment of the United States‘ general aviation fleet. A review of the accident record indicates that E-AB aircraft account for a disproportionate number of total accidents, and an even more disproportionate share of fatal accidents when compared to similar non-E-AB aircraft conducting similar flight operations. By conducting a comprehensive review of E-AB aircraft safety, using a variety of information sources, this study was able to characterize the aircraft, builder, and pilot populations; assess safety resources and management; and identify areas for recommended improvement. The airworthiness certification and maintenance of E-AB aircraft are managed according to a different regulatory and policy framework than non-E-AB aircraft. The experimental nature of amateur-built aircraft is evident in the wide range of powerplants, equipment, and design features found in these aircraft. Accident analyses indicate that powerplant failures and loss of control in flight are the most common accident occurrences by a large margin, and that accident occurrences are similar for both new and used aircraft. However, it is notable that structural failures have not been a common occurrence among E-AB aircraft. Accidents involving equipment failures or build problems are instead frequently associated with unique decisions made by an individual owner or builder. The majority of new E-AB aircraft are now built from commercial kits, a fact that has likely contributed to an overall improvement in the design and construction of E-AB aircraft. Kit manufacturers also represent a potential source of valuable construction, flight testing, operation, and maintenance information. The community of E-AB aircraft builders and owners is actively involved in their own safety oversight and management. Builder groups, aircraft type clubs, kit manufacturers, and industry associations provide a wealth of training and guidance materials to pilots and builders. The FAA has also published guidance materials to assist builders, to promote thorough flight testing of E-AB aircraft, and to encourage pilots to seek necessary transition training. Pilots of E-AB aircraft, whether involved in accidents or not, have similar, or higher, levels of total aviation experience than pilots of non-E-AB aircraft engaged in similar general aviation operations. However, pilots of E-AB aircraft, on average, had significantly less flight experience in the type of aircraft they were flying. The difference in type-specific experience is likely due to the uniqueness of the aircraft they are flying. The prevalence of accidents involving E-AB aircraft very early in their operational life, or after being purchased by a new owner, highlights the need for training and information to safely operate these unique aircraft.

NTSB The Safety of Experimental Amateur-Built Aircraft 86 6.1 Findings

1. The risk of E-AB aircraft accidents could be reduced by verifying that all E-AB aircraft are

adequately tested according to a flight test plan, and that the resulting test data are used to create an accurate and complete aircraft flight manual.

1. Data obtained from glass cockpit avionics, electronic flight instruments, or other recording

devices can significantly enhance the efficient accomplishment of flight test objectives, as well as the monitoring of parameters important to the continuing airworthiness of the E-AB aircraft, provided that they are demonstrated to be precise and reliable, record at sufficiently high sampling rates, and are easily downloaded by the aircraft owner.

1. A functional test of the aircraft fuel system could identify design deficiencies, leaks, and

malfunctions prior to flight that would prevent fuel system- and powerplant-related accidents early in the operational life of an aircraft.

1. Accident case studies included in this report indicate that not all builders of E-AB aircraft

create a detailed aircraft flight manual during Phase I flight testing.

1. Absent a review and assessment by the FAA, the adequacy of the flight test program

stipulated in Order 8130.2G cannot be ascertained or ensured.

1. The Phase I flight test period is uniquely challenging for most pilots because they must learn

to manage the handling characteristics of an unfamiliar aircraft while also managing the challenges of the flight test environment, including instrumentation that is not yet calibrated, controls that may need adjustment, and possible malfunctions or adverse handling characteristics.

1. The E-AB aircraft safety record could be improved by providing pilots with additional

training resources to safely perform Phase I test pilot functions.

1. The safety of E-AB aircraft flight testing could be improved for some pilots and flight test

circumstances if a qualified second pilot was authorized to accompany the pilot for the purpose of flight testing and not training.

1. Because no mechanism, other than the builder‘s self-certification, currently exists to ensure

that the aircraft has been adequately tested and determined to be safe to fly within the aircraft‘s flight envelope or that the flight test data is used to develop an accurate and complete aircraft flight manual and to establish emergency procedures, it is likely that these flight test objectives are not achieved for some E-AB aircraft.

1. The difference between the EAA survey respondents and the 2011 accident pilots suggests

that pilots who did not seek training were overrepresented in the accidents, and that E-AB aircraft accidents involving loss of aircraft control could be reduced if more pilots received transition training.

1. The difficulty of finding suitable E-AB aircraft and instructors available for training presents

a barrier to pilots seeking transition training.

NTSB The Safety of Experimental Amateur-Built Aircraft 87

1. The FAA guidance currently available to qualified E-AB aircraft owner/instructors to obtain

a Letter of Deviation Authority to conduct flight training is deficient and variable from one FAA region to another.

1. Purchasers of used E-AB aircraft face particular challenges in transitioning to the unfamiliar

E-AB aircraft. Like builders of new E-AB aircraft, they must learn to manage the unique handling characteristics of their aircraft and learn the systems, structure, and equipment, but without the firsthand knowledge afforded to the builder.

1. Transfers of ownership, and thus responsibility for the completion of flight test requirements

during Phase I, do not ensure an opportunity for FAA review and acceptance of the continuing appropriateness of Phase I operating limitations and requirements for the new owner of the aircraft.

1. Absent an appropriate aircraft flight manual, purchasers of used E-AB aircraft are not

provided with sufficient information to understand the aircraft‘s controllability throughout all maneuvers, to detect any hazardous operating characteristics, or to understand emergency procedures.

• Accurate identification of experimental amateur-built aircraft would greatly improve the

ability to assess the continued safety of experimental aircraft and identify design-specific safety issues. NTSB The Safety of Experimental Amateur-Built Aircraft 88

1. Recommendations

As a result of its safety study, the National Transportation Safety Board makes the following recommendations: To the Federal Aviation Administration:

Revise 14 Code of Federal Regulations 21.193, Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to define aircraft fuel system functional test procedures and require applicants for an airworthiness certificate for a powered experimental, operating amateur-built aircraft to conduct that test and submit a report of the results for Federal Aviation Administration acceptance. (A-12-28)

Revise 14 Code of Federal Regulations 21.193, Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to require applicants for an airworthiness certificate for experimental, operating amateur-built aircraft to submit for Federal Aviation Administration acceptance a flight test plan that will (1) ensure the aircraft has been adequately tested and has been determined to be safe to fly within the aircraft‘s flight envelope and (2) produce flight test data to develop an accurate and complete aircraft flight manual and to establish emergency procedures and make a copy of this flight test plan part of the aircraft‘s certification file. (A-12-29)

Identify and apply incentives to encourage owners, builders, and pilots of experimental amateur-built aircraft to complete flight test training, such as that available in the Experimental Aircraft Association‘s Test Flying and Developing Pilot Operating Handbook, prior to conducting flight tests of experimental amateur-built aircraft. (A-12-30)

Revise Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to clarify those circumstances in which a second qualified pilot could be authorized to assist in the performance of flight tests when specified in the flight test plan and Phase I operating limitations. (A-12-31)

Revise Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to require the review and acceptance of the completed test plan documents and aircraft flight manual (or its equivalent) that documents the aircraft‘s performance data and operating envelope, and that establishes emergency procedures, prior to the issuance of Phase II operating limitations. (A-12-32)

Revise Federal Aviation Administration Advisory Circular 90-89A, Amateur-Built Aircraft and Ultralight Flight Testing Handbook, to include guidance for the use of recorded flight data for the purposes of flight testing and maintaining continued airworthiness of experimental aircraft. (A-12-33)

NTSB The Safety of Experimental Amateur-Built Aircraft 89 Revise Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to include provisions for the use of electronic data recordings from electronic flight displays, engine instruments, or other recording devices in support of Phase I flight testing of experimental amateur-built aircraft to document the aircraft performance data and operating envelope and develop an accurate and complete aircraft flight manual. (A-12-34)

Develop and publish an advisory circular, or similar guidance, for the issuance of a Letter of Deviation Authority to conduct flight instruction in an experimental aircraft, to include sample documentation and sample training materials. (A-12-35)

Complete planned action to create a coalition of kit manufacturers, type clubs, and pilot and owner groups and (1) develop transition training resources and (2) identify and apply incentives to encourage both builders of experimental amateur-built aircraft and purchasers of used experimental amateur-built aircraft to complete the training that is developed. (A-12-36)

Revise 14 Code of Federal Regulations 47.31 and related guidance or regulations, as necessary, to require the review and acceptance of aircraft operating limitations and supporting documentation as a condition of registration or re-registration of an experimental amateur-built aircraft. (A-12-37)

Revise Federal Aviation Administration Order 8130.2G, and related guidance or regulations, as necessary, to include provisions for modifying the operating limitations of aircraft previously certificated as experimental, operating amateur-built, such as returning the aircraft to Phase I flight testing, as necessary, to address identified safety concerns or to correct deficiencies in the aircraft flight manual or equivalent documents. (A-12-38)

Revise the Civil Aircraft Registry database to include a means of identifying aircraft manufacturer, make, model, and series—such as the aircraft make, model, and series classification developed by the CAST/ICAO Common Taxonomy Team—that unambiguously identifies the aircraft kit or plans design as well as the builder of the aircraft. (A-12-39)

To the Experimental Aircraft Association:

Identify and apply incentives to encourage owners, builders, and pilots of experimental amateur-built aircraft to complete flight test training, such as that available in the Experimental Aircraft Association‘s Test Flying and Developing Pilot Operating Handbook, prior to conducting flight tests of experimental amateur-built aircraft. (A-12-40)

NTSB The Safety of Experimental Amateur-Built Aircraft 90 Work with your membership, aircraft kit manufacturers, and avionics manufacturers to develop standards for the recording of data in electronic flight displays, engine instruments, or other recording devices to be used in support of flight tests or continued airworthiness of experimental amateur-built aircraft. (A-12-41)

Create and publish a repository of voluntarily provided information regarding holders of Letters of Deviation Authority to conduct flight instruction in experimental aircraft. (A-12-42)

Complete planned action to create a coalition of kit manufacturers, type clubs, and pilot and owner groups and (1) develop transition training resources and (2) identify and apply incentives to encourage both builders of experimental amateur-built aircraft and purchasers of used experimental amateur-built aircraft to complete the training that is developed. (A-12-43)

NTSB The Safety of Experimental Amateur-Built Aircraft 91 Appendix A: NTSB Aviation Accident Data Validation NTSB staff reviewed records in the NTSB Aviation Accident Database83 to verify the aircraft airworthiness classification information relative to ―Experimental – Amateur-Built.‖ The NTSB Aviation Accident Database currently includes data fields to record aircraft airworthiness certificate type and category, such as ―Standard – Normal‖ or ―Special – Experimental.‖ However, the airworthiness data field does not include the additional level of detail necessary to distinguish between ―Special – Experimental – Amateur-Built‖ and other categories of Experimental certificates such as ―Exhibition‖, ―Air Racing‖, or ―Research and Development.‖ An additional yes/no field in the NTSB database, titled ―Homebuilt,‖ has historically been used to identify amateur-built accident aircraft. Although the field is intended to readily identify amateur-built aircraft, a summary review of NTSB database records reveals numerous cases in which the homebuilt field value was reported as ―yes‖ for aircraft with a special airworthiness certificate, but not in the amateur-built category. Errors and misapplications of the homebuilt code lead to an inaccurate assessment of the accident risk for amateur-built aircraft. In coordination with the FAA and the EAA, the NTSB used to the following methodology to validate the homebuilt yes/no data in the NTSB Aviation Accident Database records.  NTSB accident records from 2001 through 2010 were matched with archived, historic FAA aircraft registry records84 using aircraft registration, serial number, make, and model information, as available.  Aircraft airworthiness certificate data and the homebuilt yes/no field in the NTSB database were compared with the manufacturer model code85 and airworthiness certificate data in the FAA aircraft registry database to identify inconsistent data elements in either system.  Copies of the original aircraft airworthiness and registration documents were used to validate the amateur-built status of those aircraft with missing or inconsistent FAA registry and/or NTSB accident database records.

83 The NTSB maintains a database for the storage, retrieval, and management of information associated with its aviation accident/incident investigations. The NTSB Aviation Accident Database is comprised of 15 data tables, with approximately 350 data fields. The database currently contains approximately 70,000 cases, and approximately 2,000 new cases are generated each year. 84 The FAA aircraft registry database contains the records of all U.S. civil aircraft maintained by the FAA, Civil Aviation Registry, Aircraft Registration Branch, AFS-750. The aircraft registry database is available for public download from the FAA website at: http://www.faa.gov/licenses_certificates/aircraft_certification/aircraft_ registry/releasable_aircraft_download/. 85 The FAA assigns a seven-digit code to each aircraft at the time of registration to identify the aircraft manufacturer, model, and series. The first three characters correspond to the manufacturer, the fourth and fifth characters refer to the model, and the sixth and seventh refer to the aircraft series.

NTSB The Safety of Experimental Amateur-Built Aircraft 92 This methodology resulted in the verification of 2,077 accident aircraft as E-AB aircraft, changes to indicate that 324 accident aircraft with missing or incorrect records are not E-AB aircraft, and changes to indicate that 46 accident aircraft with missing or incorrect records were, in fact, E-AB aircraft. The airworthiness status of an additional 138 accident aircraft could not be verified because they were unregistered, foreign registered, or did not have the necessary records on file for review. In sum, the number of accident aircraft identified as E-AB aircraft in the NTSB records from 2001–2010 decreased by 278. However, not all of these cases are included in the United States civil general aviation accident record tabulations86. Figure A1 illustrates changes in the annual U.S. civil general aviation accident and fatal accident records from 2001 through 2010 for cases involving E-AB aircraft.

Figure A1. Changes in the annual U.S. civil general aviation accident and fatal accident records for E-AB aircraft, 2001–2010. The greatest number of E-AB aircraft data corrections were to accident records spanning 2007 to 2009, suggesting that data errors increased with the introduction of the special light-sport aircraft category of airworthiness certificates in 2005 and the registration of ―fat ultralights‖ and two-seat ultralights previously exempted under a training provision of 14 CFR Part 10387. The

86 U.S. civil aviation accidents, as defined by 49 CFR Part 830.1, include accidents that involve U.S.-registered civil aircraft and certain public aircraft of the United States ―wherever they occur.‖ General aviation includes any civil aircraft operation that is not covered by 14 CFR Parts 121 or 135; or by Part 129, which applies to foreign air carriers; or non-U.S. commercial operations. 87 See http://www.faa.gov/aircraft/gen_av/light_sport/. 3 -3 3 1 -9 -5 -28 -48 -34 -12 1 -3 -1 0 -4 -1 -7 -9 -7 -3 -60 -40 -20 0 20 40 60 Accidents Calendar Year Results of NTSB Amateur Built Accident Data Validation, 2001-2010 E-AB Accidents Fatal E-AB Accidents

NTSB The Safety of Experimental Amateur-Built Aircraft 93 special light-sport aircraft (S-LSA) and experimental light-sport aircraft (E-LSA) fleets increased rapidly during this period, and these aircraft were subsequently involved in more accidents. A review of these aircraft-related data errors in the FAA and NTSB databases suggests initial misunderstandings among aircraft owners, inspectors, and investigators about this new aircraft classification. In other cases, identification was made more difficult because some popular aircraft models are available in E-AB, S-LSA, and/or E-LSA versions. The net reduction in accident E-AB aircraft results in a slight reduction in calculated accident rates when compared with annual FAA estimates of E-AB aircraft flight hours.88 Figure A2 illustrates the previous and revised U.S. civil general aviation accident rate for E-AB aircraft annually from 2001 through 2010, and Figure A3 shows the E-AB aircraft fatal accident rate.

Figure A2. Revised amateur-built aircraft accident rate following NTSB accident data validation, 2001–2010.

88 Flight activity of general aviation and nonscheduled Part 135 operations is estimated using the annual General Aviation and Part 135 Activity Survey. This voluntary survey is sent to registered aircraft owners. http://www.faa.gov/data_research/aviation_data_statistics/general_aviation/.‖

NTSB The Safety of Experimental Amateur-Built Aircraft 94

Figure A3. Revised amateur-built aircraft fatal accident rate following NTSB accident data validation, 2001–2010.

NTSB The Safety of Experimental Amateur-Built Aircraft 95 Appendix B: E-AB Aircraft Accident Supplementary Data Form

NTSB The Safety of Experimental Amateur-Built Aircraft 96

NTSB The Safety of Experimental Amateur-Built Aircraft 97

NTSB The Safety of Experimental Amateur-Built Aircraft 98

NTSB The Safety of Experimental Amateur-Built Aircraft 99

NTSB The Safety of Experimental Amateur-Built Aircraft 100

NTSB The Safety of Experimental Amateur-Built Aircraft 101

NTSB The Safety of Experimental Amateur-Built Aircraft 102 Appendix C: Expanded Analysis of Amateur-Built Aircraft Accident Data, Calendar Year 2011 Most of the 227 E-AB aircraft involved in the 224 accidents investigated during 2011 were airplanes. Figure C1 shows the types of aircraft involved in accidents during 2011.

Figure C1. Types of E-AB accident aircraft built by owners and bought as used, 2011. E-AB Aircraft Makes Figure C2 shows the manner in which the accident E-AB aircraft were built for those bought used and those built by their owners. The majority of accident aircraft, whether built by the owner or bought used, were built from kits, fewer were built from plans, and only three were built from original designs. Figure C3 shows the principal ―makes‖ of E-AB aircraft built by their owners, and Figure C4 shows the principal ―makes‖ of E-AB aircraft bought used. A large variety of aircraft kits and published plans are represented in both groups of aircraft. Kit manufacturers Van‘s Aircraft Company, Zenith Aircraft Company, Lancair, Kitfox Aircraft, and Rans Aircraft accounted for significant numbers of aircraft in both groups. The E-AB aircraft make is identified for each accident aircraft in appendix F.

NTSB The Safety of Experimental Amateur-Built Aircraft 103

Figure C2. Type of E-AB aircraft building project for aircraft built by owners and those bought used.

NTSB The Safety of Experimental Amateur-Built Aircraft 104

Figure C3. E-AB accident aircraft makes built by owners.

23 12 6 4 3 3 51 0 10 20 30 40 50 60 Van's Aircraft Zenith Aircraft Company Lancair Kitfox Aircraft Glasair Aviation Murphy Aircraft All Other Makes Accident Aircraft Make (Kit Manufacturer) Makes of Accident Aircraft Built by Owner, 2011

NTSB The Safety of Experimental Amateur-Built Aircraft 105

Figure C4. E-AB accident aircraft makes bought used.

17 8 7 6 6 4 4 4 4 3 62 0 10 20 30 40 50 60 70 Van's Aircraft Lancair Rans Designs Avid Aircraft Kitfox Aircraft Aviat Aircraft Glasair Aviation Original Design Sonex Aircraft Zenith Aircraft Company All Other Makes Accident Aircraft Bought Used Makes (Kit Manufacturer) of Accident Aircraft Makes of Accident E-AB Aircraft Bought Used

NTSB The Safety of Experimental Amateur-Built Aircraft 106 Figure C5 shows the number of previous owners of these aircraft. Less than 50 percent had had only one previous owner, and more than 20 percent had been bought and sold more than four times since they were built.

Figure C5. Number of previous owners for accident E-AB aircraft bought used.

54 31 12 11 7 10 0 10 20 30 40 50 60 1 2 3 4 5 6 or more Accident Aircraft Number of Previous Owners Number of Previous Owners for Accident E-AB Aircraft Bought Used, 2011

NTSB The Safety of Experimental Amateur-Built Aircraft 107 Appendix D: Amateur-Built Aircraft Survey 1.How many years have you been a certificated pilot? (enter whole numbers)

1. What is the highest certificate you hold?

o Student o Sport o Recreational o Private o Commercial o Airline Transport (ATP) 3.What ratings or other certificates do you hold? [Mark all that apply]  Single-engine Land  Single-engine Sea  Multi-engine Land  Multi-engine Sea  Instrument  Rotorcraft (helicopter/gyroplane)  Lighter than air  Flight Instructor (CFI, CFII, MEI)  Mechanic (A&P)  Repairman  Other (please specify)

1. What additional endorsements have you obtained? [Mark all that apply]

 High performance  Complex  Tail wheel  High altitude  None – or Not applicable  Other (please specify)

YOUR CURRENT AMATEUR-BUILT AIRCRAFT

NTSB The Safety of Experimental Amateur-Built Aircraft 108 If you do not currently own or own multiple amateur-built aircraft please answer the remainder of the survey questions using your most recently owned or purchased amateur-built aircraft.

1. How many hours have you logged as Pilot in Command (PIC) over the following time periods

for both all aircraft and your current amateur-built aircraft (E-AB)? TotalHrsLast YearLast 90 days All Aircraft Current E-AB Aircraft

1. Approximately how many landings have you made in the last 90 days?

All Aircraft Current E-AB Aircraft

1. What type of amateur-built aircraft do you currently own?

Make Model Year Certified

1. Your amateur-built aircraft is a:

o Airplane o Glider o Helicopter o Gyrocopter o Lighter than Air o Weight-Shift o Power Parachute The following questions are intended to provide more detail about your current amateur-built aircraft.

1. Which of the following best describes your current amateur-built aircraft?

o Standard Factory kit o Quick Build kit o Plans built o Original Design o Other (please specify)

NTSB The Safety of Experimental Amateur-Built Aircraft 109

1. How many total hours on the airframe and engine? (enter whole number)

Airframe Engine

1. What year was the airworthiness certificate issued?

• What type of engine is in your current amateur-built aircraft?

o Traditional Aircraft engine (including non-certified variants) o Other Production-type four-stroke aircraft engine (Jabiru, Rotax 912, etc.) o Production-type two-stroke aircraft engine (Rotax 582, 2SI, etc.) o Volkswagen o Subaru o Honda o Ford o Corvair o GM (other than Corvair) o GEO o Suzuki o Other o Two-stroke conversion o Not Applicable o Other (please specify):

• What is the specific make, model and horsepower of your engine?

Make Model Horsepower

• Was your engine …

o New o Used (not overhauled) o Overhauled by an A&P o Overhauled by a non-A&P o Other (specify) NTSB The Safety of Experimental Amateur-Built Aircraft 110

1. What was the extent of the overhaul?

o Complete o Top only

1. What is the specific make and model of your propeller?

Make Model

1. Your propeller is…

o Wood o Metal o Composite

1. Your propeller is…

o Fixed o Ground Adjustable o Constant Speed

1. What type of instruments/avionics in your aircraft?

o Conventional primary flight instruments o Glass cockpit primary flight display

1. What type of landing gear configuration does your aircraft have?

o Tricycle o Tail wheel o Floats o Amphibian o Other (specify)

1. Your landing gear is …

o Fixed o Retractable

1. What is the wing span, wing area and max gross weight of your amateur- built aircraft?

Wing Span (ft) Wing Area (sq. ft) Max Gross Weight (lbs)

NTSB The Safety of Experimental Amateur-Built Aircraft 111

1. What are the stall and max speeds (in knots) of your amateur-built aircraft?

VS VSO VA VNE

1. Is your aircraft approved for aerobatics?

o Yes o No

1. Any restrictions (please specify)

• Do you conduct aerobatics in your aircraft?

o Yes o No

• What is the number of seats in your current amateur-built aircraft?

o 1 o 2 o 3 o 4 o 5 or more

• What type of restraints are installed in your aircraft?

o Lap Belt only o 3 point shoulder harness o 4 point harness o 5 point harness o Other (please specify)

• What other safety related equipment is installed in your current amateur-built aircraft?

o Airbag o Ballistic parachute o Other (please specify) NTSB The Safety of Experimental Amateur-Built Aircraft 112

1. Did you do an introductory or demo flight of your current model of amateur-built aircraft

before obtaining one? o Yes o No

1. Who provided the introductory or demo flight?

o Kit manufacturer o Private Owner o Other (please specify)

1. Did you receive flight training for your current amateur-built aircraft before your first flight

as pilot in command of your aircraft? o Yes o No

• Who conducted the training?

o Kit Manufacturer o Private Owner of same type of aircraft o Private Owner of similar type of aircraft o Private Owner of different type of aircraft o CFI o Other (please specify)

• Did you receive flight training for your current amateur-built aircraft after your first flight as

pilot in command of your aircraft? o Yes o No

• Who conducted the training?

o Kit Manufacturer o Owner of same type of aircraft o Owner of similar type of aircraft o Private Owner of different type of aircraft o CFI o Other (please specify) NTSB The Safety of Experimental Amateur-Built Aircraft 113

1. Did your insurance company require any special transition training to insure your current

amateur-built aircraft? o Yes o No o N/A-Self insured

1. How many hours of training did the insurance company require? How many did you

complete? Required Completed Hours of dual instruction Hours of solo instruction

Did you build your current amateur-built aircraft? o Yes o No (skip to Q55)

Did you completely build the aircraft or purchase it as a completed aircraft or a partially completed project? o Built myself o Purchased partially completed project o Purchased completed aircraft

Why did you choose to build rather than purchase a completed aircraft (other than for educational or recreational purposes)? o To save money o Performance advantages o Other (please specify)

The following questions are about your building experience

1. Why did you choose to build rather than purchase a completed aircraft (other than for

educational or recreational purposes)?  To save money  Performance advantages  Other (please specify)

NTSB The Safety of Experimental Amateur-Built Aircraft 114

1. How long did it take you to complete your current amateur-built aircraft?

Years Months Total Hours

1. How many aircraft (including your current amateur-built aircraft) have you built?

Do you have a repairman certificate for your current amateur-built aircraft? o Yes o No

Where was your aircraft built? (check all that apply)  Kit manufacturer onsite factory assist  Commercial aircraft service facility  Hangar  Owner‘s home

Did you receive technical assistance from any of the following during the building of your aircraft? (check all that apply)  EAA Technical Counselor  Kit Manufacturer  A & P  Other Builder(s)

How many inspections by others were performed during the build? (Enter 0 if none)

Who were the inspections performed by? (check all that apply)  EAA Technical Counselor  FAA inspector  A&P  Other builders

NTSB The Safety of Experimental Amateur-Built Aircraft 115

1. What type (if any) of training or experience in aircraft building techniques did you receive

before or during your building process?

 Assisted on another aircraft build  Attended kit manufacturer workshop  Attended EAA SportAir workshop  Attended workshops at AirVenture or other events  Other The following questions are about your flight test and airworthiness certification process

1. The airworthiness certificate was issued by

o FAA o DAR

1. Who performed the first test flight?

o Builder o Hired flight test pilot o Other (please specify)

1. How many Phase 1 test hours were required and completed?

Required Completed

• How detailed would you say was your flight test plan?

o Very Detailed o Somewhat Detailed o Somewhat Informal

• What sources (if any) did you use in the development of your flight test plan?

 Self-Developed only  EAA Flight Advisor  EAA Sport Air Flight testing Course  FAA Test flight Advisory Circular AC-90-89A  Kit Manufacturer training program  First Flight Video  Type Club/Owners Group  Other NTSB The Safety of Experimental Amateur-Built Aircraft 116

1. Has your current amateur-built aircraft been modified from the original design

specifications? o Yes o No o Don't Know

1. In which areas has your current amateur-built aircraft been modified? [Mark all that apply]

 Fuel Systems  Airframe Design  Canopy/Door Mechanisms  Safety Harness  Control Systems  Powerplant  Other (please specify)

• Who made the modifications? (If owner/builder holds a current A&P certificate select FAA

certified mechanic) Builder Owner Other Than Builder FAA Certified Mechanic Don't Know Other NA Fuel Systems o o o o o o Airframe Design o o o o o o Canopy/Door Mechanisms o o o o o o Safety Harness o o o o o o Control System o o o o o o Powerplant o o o o o o Other o o o o o o

NTSB The Safety of Experimental Amateur-Built Aircraft 117

1. Why were the modifications made?

• After the modifications were completed did you conduct any formal test flight(s)?

o Yes o No

• Have you received or found service instructions or bulletins related to the airframe since the

purchase of your kit/plans? o Yes o No

• Have they been completed?

o Yes o No

• How did you hear about them?

 From FAA.Gov web site  From kit producer  Owners Forum/website  Type Club  General Aviation Press (e.g. Aero-News, AV-Web, etc.)  Other

• Have you received or found service instructions or bulletins related to the powerplant or

propeller since they were purchased? Correct Deficiency Improve Handling Improve Performance Other Reason NA Fuel Systems o o o o o Airframe Design o o o o o Canopy/Door Mechanisms o o o o o Safety Harness o o o o o Control Systems o o o o o Powerplant o o o o o Other o o o o o

NTSB The Safety of Experimental Amateur-Built Aircraft 118 o Yes o No

1. Have they been completed?

o Yes o No

1. How did you hear about them?

 From FAA.Gov web site  From kit producer  Owners Forum/website  Type Club  General Aviation Press (e.g. Aero-News, AV-Web, etc.)  Other The following questions are for analysis purposes only. They represent information that might provide insight into some of the answers to the questions on the survey.

1. What is your age?

• What is your approximate annual household income?

o Less than $50,000 o Between $50,000 and $75,000 o Between $75,000 and $100,000 o Between $100,000 and $150,000 o Between $150,000 and $200,000 o $200,000 or more

• Please indicate your highest level of education.

o High School or less o Vocational/Technical o College o Graduate/Professional School NTSB The Safety of Experimental Amateur-Built Aircraft 119

1. Please select the category that most closely describes your occupation.

o Professional/Technical o Sales/Service o Craftsman/Hourly Employee o Self Employed Prof/Tech o Self Employed Sales/Marketing o Self Employed Craftsman o Self Employed Other o Admin/Managerial o Clerical/Office o Not Employed o Military o Student o Retired

NTSB The Safety of Experimental Amateur-Built Aircraft 120 Appendix E: Expanded Results of Experimental Aircraft Association Survey of E-AB Aircraft Owners and Builders. Figure E1 shows the breakdown of kit-built aircraft by manufacturer. Kits manufactured by Vans Aircraft Company accounted for 43 percent of these aircraft, with other manufacturers accounting for much smaller proportions of respondents‘ aircraft.

Figure E1. Kit manufacturers reported by survey respondents.

1638 247 235 225 136 125 120 76 52 45 34 31 29 27 24 23 598 0 200 400 600 800 1000 1200 1400 1600 1800 Van's Aircraft Lancair Glasair Aviation Zenith Aircraft Company Kitfox Aircraft Sonex Aircraft Rans Designs Quad City Aircraft Velocity Aircraft Avid Aircraft Wag-Aero Group Kolb Aircraft Murphy Aircraft Pulsar Aircraft RotorWay International Bede Corp All Other Kits Number of Respondents Kit Manufacturers Reported by Survey Respondents

NTSB The Safety of Experimental Amateur-Built Aircraft 121 Figure E2 shows the specific models of the aircraft kits produced by the four leading kit manufacturers reported by the survey respondents.

Figure E2. Kit models for the Van's, Lancair, Glasair, and Zenith aircraft kits reported in the survey.

Twenty-three percent of respondents reported aircraft that were built according to published plans, rather than assembled from manufactured kits. Respondents reported 140 18 181 246 225 136 200 258 51 24 177 91 30 110 27 42 58 4 36 58 27 114 144 81 0 50 100 150 200 250 300 Van's RV-3 Van's RV-4 Van's RV-6 Van's RV-6A Van's RV-7 Van's RV-7A Van's RV-8 Van's RV-8A Van's RV-9 Van's RV-9A Van's RV-10 Van's RV-12 Lancair 200/235/320/360 Lancair ES Lancair Legacy Lancair IV/IV-P Lancair Evolution Glasair I Glasair II Glasair III GlaStar Zenith Zodiac CH601/650 Zenith STOL CH701/750/801 Number of Respondents Frequency of Kit Models for Respondents Reporting Van's, Lancair, Glasair, and Zenith Aircraft Kits

NTSB The Safety of Experimental Amateur-Built Aircraft 122 distinct published plans. The distribution of plans-built aircraft makes, or designs, is shown in

Figure E3.

Figure E3. Plans-built aircraft designs reported by survey respondents. The largest of the plans-built aircraft makes is the Burt Rutan Long-EZ. A very large number of other published plans are also reflected in the survey responses. The original design category comprises 136 unique one-off designs described by a small subset of survey respondents. Figure E4 shows the years taken to complete the E-AB aircraft project for the respondents who had finished building their aircraft. The median years to complete the aircraft was 4 years, but there was considerable variation. Figure E5 shows the total hours reported by these respondents to complete their E-AB aircraft. The median was 2,000 hours, but again, there was considerable variation. 107 69 59 53 53 43 40 40 33 32 31 29 26 26 25 46 0 20 40 60 80 100 120 Rutan Long-EZ Cozy Pitts Special Rutan Varieze Thorp Steen Aero Lab Starduster Pietenpol Wittman Tailwind Monnett Acro Sport Bushby/Mustang Aeronautics Bowers Rand Robinson Ace Aircraft All Other Plans Respondents Reporting Plans-Built Aircraft Principal Plans-Built Aircraft Designs

NTSB The Safety of Experimental Amateur-Built Aircraft 123

Figure E4. Years to complete for the 3,095 respondents reporting this information.

576 959 1,286 1,533 1,799 2,307 2,447 103 158 219 267 320 469 578 19 31 36 40 45 61 70 0 500 1,000 1,500 2,000 2,500 3,000 year years years years years <10 years <20 years Cummulative Completed Aircraft Completion Time Completion Time by E-AB Aircraft Build Type Kit-Built Plans-Built Original Design

NTSB The Safety of Experimental Amateur-Built Aircraft 124

Figure E5. Total build hours for the 1,648 respondents reporting this information.

95 296 764 1,162 1,294 1,337 1,390 14 32 95 162 192 210 230 8 9 17 22 22 25 28 0 200 400 600 800 1,000 1,200 1,400 1,600 <500 ,000 ,000 ,000 ,000 ,000 <10,000 Cumulative Completed Aircraft Building Hours Cummulative Hours Expended by Respondents Building their E-AB Aircraft by Build Type Kit-Built Plans-Built Original Design

NTSB The Safety of Experimental Amateur-Built Aircraft 125 Appendix F: Experimental Amateur-Built Study Cases, Calendar Year 2011 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11CA086 1/1/2011 Torrance, CA Nonfatal N322RV Airplane Vans RV4 Built Landing Abnormal Runway Contact CEN11CA143 1/2/2011 Carlisle, AR Nonfatal N876KF Airplane Kitfox III Purchased Used Landing System/ Component Failure – Non- Power WPR11CA088 1/4/2011 Homedale, ID Nonfatal N90TY Airplane Kitfox IV Built Takeoff Abnormal Runway Contact CEN11CA165 1/25/2011 Terlingua, TX Nonfatal N947RG Airplane Kitfox III Purchased Used Takeoff Loss of Control on Ground WPR11CA110 1/26/2011 Toutle, WA Nonfatal N92LW Airplane Cuby Purchased Used Landing Abnormal Runway Contact WPR11CA112 1/28/2011 Buckeye, AZ Nonfatal N8053R Airplane Rans S-6 Built En Route System/ Component Failure – Non- Power ANC11CA011 1/29/2011 Anchorage, AK Nonfatal N9015U Airplane Got Rocks Purchased Used Landing Loss of Control on Ground CEN11CA166 1/29/2011 Wellington, CO Nonfatal N15XP Glider Rutan Solitaire Purchased Used Landing Undershoot/ Overshoot CEN11LA168A 1/29/2011 Burlington, IA Nonfatal N200BE Airplane Zenith Aircraft Company 601XL Built Landing Runway Incursion - Vehicle CEN11LA168B 1/29/2011 Burlington, IA Nonfatal N602CB Airplane Model-1 Purchased Used Landing Runway Incursion - Vehicle ERA11CA153 1/30/2011 Crescent City, FL Nonfatal N324AL Airplane Arion Aircraft Lightning Purchased Used Landing Abnormal Runway Contact WPR11CA130 2/9/2011 Wilsonville, OR Nonfatal N238MA Airplane Glastar Purchased Used Landing Abnormal Runway Contact

NTSB The Safety of Experimental Amateur-Built Aircraft 126 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11CA134 2/12/2011 Groveland, CA Nonfatal N17AJ Airplane Christen Eagle II Purchased Used Landing Loss of Control on Ground ERA11LA142 2/13/2011 Dawsonville, GA Nonfatal N351E Airplane Lancair 320 Purchased Used Maneuvering Fuel Related ERA11LA150 2/17/2011 Stetson, ME Nonfatal N213 Airplane Kolb MK III Purchased Used En Route System/ Component Failure – Powerplant WPR11FA147 2/26/2011 Milford, UT Fatal N989TT Airplane Lancair 360 Purchased Used En Route Unintended Flight in IMC ERA11CA177 3/3/2011 Indian Trail, NC Nonfatal N788Q Airplane Kitfox IV Built Takeoff Abnormal Runway Contact WPR11FA153 3/4/2011 Myrtle Creek, OR Nonfatal N4374K Airplane Kitfox IV-1200 Built Initial Climb Windshear/ Thunderstorm WPR11FA155 3/7/2011 Newberry Springs, CA Fatal N122B Airplane Rand Robinson KR-2 Purchased Used En Route System/ Component Failure – Non- Power WPR11FAMS1 3/11/2011 Unknown, AZ Fatal N650RV Airplane Vans RV6 Built Unknown Unknown ERA11CA195 3/19/2011 Gainesville, FL Nonfatal N109BX Airplane Christen Eagle II Purchased Used Approach Loss of Control in Flight ERA11LA197 3/19/2011 Lincoln, AL Nonfatal N192AB Helicopter Rotorway Exec Purchased Used En Route System/ Component Failure – Powerplant ERA11LA208 3/19/2011 Clinton, SC Fatal None Airplane JTD Mini-Max Built Takeoff Collision on Takeoff or Landing WPR11CA171B 3/19/2011 Arlington, WA Nonfatal N11NL Airplane Rutan Long-EZ Built Standing Ground Collision CEN11CA242 3/21/2011 Ferris, TX Nonfatal N1317L Airplane Aero Adventure Aventura Purchased Used Landing Loss of Control in Flight ERA11LA213 3/25/2011 Calhoun, GA Nonfatal N770VP Airplane Volksplane VP-1 Built Initial Climb System/ Component Failure – Powerplant ERA11LA228 3/29/2011 Crescent City, FL Nonfatal N5842 Airplane Aero Adventure Aventura II Built Initial Climb Loss of Control in Flight

NTSB The Safety of Experimental Amateur-Built Aircraft 127 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11LA180 4/1/2011 Cedar City, UT Nonfatal N613HH Airplane Avid Flyer Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11LA281 4/2/2011 Brookfield, MO Nonfatal N6313T Airplane Avid Mark IV Purchased Used Landing System/ Component Failure – Non- Power ERA11FA222 4/3/2011 Chesapeake, VA Fatal N164T Airplane Lancair 360 Purchased Used Initial Climb Fuel Related WPR11LA187 4/5/2011 El Centro, CA Nonfatal N128CF Airplane Zenith Aircraft Company STOL CH701 Built Landing System/ Component Failure – Powerplant WPR11LA193 4/8/2011 Temple Bar, AZ Nonfatal N320BB Airplane Lancair 360 Purchased Used En Route System/ Component Failure – Powerplant WPR11LA205 4/10/2011 Ramona, CA Nonfatal N611JB Airplane Bushby/Mustang Aeronautics Midget Mustang Purchased Used Initial Climb System/ Component Failure – Non- Power CEN11CA282 4/12/2011 Davenport, IA Nonfatal N701YB Airplane Zenith Aircraft Company STOL CH701 Built Takeoff System/Comp onent Failure – Non-Power WPR11LA199 4/14/2011 Winchester, CA Nonfatal N632DR Airplane Zenith Aircraft Company STOL CH750 Built En Route System/ Component Failure – Powerplant ERA11CA248 4/15/2011 Baltimore, MD Nonfatal N57CW Airplane Lancair 320 Built Landing Abnormal Runway Contact WPR11LA202 4/16/2011 Marana, AZ Nonfatal N107JL Airplane Rans S-12 Purchased Used En Route System/ Component Failure – Powerplant CEN11FA299 4/17/2011 San Angelo, TX Fatal N38RC Airplane Christen Eagle II Purchased Used Maneuvering Low Altitude Operation CEN11FA300 4/21/2011 Elk City, OK Fatal N7804C Airplane Wittman Tailwind W-8 Purchased Used Maneuvering Loss of Control in Flight ERA11CA256 4/21/2011 Locust Grove, GA Nonfatal N190GE Airplane Vans RV8 Built Takeoff Loss of Control on Ground

NTSB The Safety of Experimental Amateur-Built Aircraft 128 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11LA305 4/23/2011 Massillon, OH Nonfatal N614S Helicopter Rotorway Exec Built En Route System/ Component Failure – Powerplant WPR11CA206 4/23/2011 Heber, UT Nonfatal N5491W Airplane Team Rocket F1 Built Landing Loss of Control on Ground WPR11LA207 4/23/2011 Marsing, ID Nonfatal N59TD Airplane Vans RV7A Built Initial Climb System/ Component Failure – Powerplant CEN11CA321 4/27/2011 Minford, OH Nonfatal N718PF Airplane Vans RV10 Built En Route System/ Component Failure – Non- Power CEN11FA310 4/29/2011 Pulaski, WI Fatal N701MJ Airplane Zenith Aircraft Company STOL CH701 Built Initial Climb Loss of Control in Flight ERA11CA279 4/30/2011 Somerset, PA Nonfatal N145HF Airplane Avid Flyer Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11FA312 5/1/2011 Elephant Butte, NM Fatal N89MM Airplane Kitfox Speedster Purchased Used En Route Loss of Control in Flight WPR11LA216 5/1/2011 Livermore, CA Nonfatal N998RV Airplane Vans RV8 Built Landing Abrupt Maneuver CEN11CA314 5/2/2011 Kansas City, MO Nonfatal N50KP Airplane Lancair Legacy Built Landing Undershoot/ Overshoot CEN11LA316 5/3/2011 Blue Springs, NE Fatal N103EB Gyroplane Rotor Flight Dynamics Dominator Built Initial Climb Collision on Takeoff or Landing CEN11FA319 5/4/2011 Shreveport, LA Fatal N914KM Airplane Europa XS Purchased Used En Route Loss of Control in Flight ERA11LA282 5/4/2011 Palm Coast, FL Nonfatal N705AP Airplane D'Apuzzo Senior Aero Sport D- 260 Purchased Used En Route System/ Component Failure – Powerplant CEN11CA326 5/5/2011 Albuquerque, NM Nonfatal N314JF Airplane Quickie Aircraft Quickie Q2 Purchased Used Maneuvering System/ Component Failure – Non- Power ERA11FA285 5/6/2011 Richlands, NC Fatal N23PH Airplane Lancair Legacy Built En Route Fuel Related

NTSB The Safety of Experimental Amateur-Built Aircraft 129 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11FA324 5/7/2011 Conroe, TX Fatal N913RA Airplane S.A.Ravin Aircraft 500 Built Initial Climb Fire – Non- Impact ERA11LA300 5/13/2011 Tidioute, PA Nonfatal N433UB Airplane Zenith Aircraft Company STOL CH701 Built Approach Other CEN11CA336 5/14/2011 Scott, LA Nonfatal None Gyroplane KB3 Gyroplane Built Takeoff Collision on Takeoff or Landing ERA11CA311 5/17/2011 Taccoa, GA Nonfatal N1150 Airplane Ace Aircraft Corben Junior Ace Purchased Used Landing Loss of Control on Ground WPR11FA230 5/18/2011 Pioneer, CA Fatal N121J Airplane Lancair Legacy Purchased Used En Route Controlled Flight Info Terrain CEN11CA354 5/21/2011 Albuqurque, NM Nonfatal N79BC Airplane Lancair 320 Purchased Used Landing Loss of Control on Ground WPR11LA233 5/21/2011 Cody, WY Nonfatal N52VC Airplane Vans RV6A Purchased Used En Route Controlled Flight Info Terrain CEN11FA346 5/22/2011 Erie, CO Fatal N420FH Airplane Cassutt III Built Initial Climb Other CEN11LA361 5/22/2011 Colorado Springs, CO Nonfatal N457CF Airplane Pitts S1S Purchased Used Landing Abnormal Runway Contact WPR11LA234 5/24/2011 Puyallup, WA Nonfatal N34NH Airplane Zenith Aircraft Company STOL CH701 Built Landing Loss of Control in Flight CEN11LA367 5/30/2011 Sioux City, IA Nonfatal N204TJ Airplane Cozy MK III Built Maneuvering System/ Component Failure – Powerplant ERA11LA325 6/3/2011 Merritt Island, FL Nonfatal N434JC Airplane Comp Air CA-4 Built Landing Abnormal Runway Contact WPR11CA249 6/3/2011 Heron, MT Nonfatal N316BR Airplane Smith Aviation Super Cub Built Landing Abnormal Runway Contact CEN11CA377 6/4/2011 Dexter, NM Nonfatal N820RC Airplane Vans RV6A Purchased Used Landing Collision on Takeoff or Landing CEN11LA371 6/4/2011 Edgewood, NM Nonfatal N514R Airplane Vans RV9A Built Takeoff Runway Excursion

NTSB The Safety of Experimental Amateur-Built Aircraft 130 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11LA374 6/4/2011 Minneapolis, MN Nonfatal N242RM Airplane Progressive Aerodyne SeaRey Built Initial Climb System/ Component Failure – Non- Power WPR11CA247 6/4/2011 Bellingham, WA Nonfatal N118PS Airplane Nieuport 11 Purchased Used Landing Loss of Control on Ground CEN11CA410 6/6/2011 Canon City, CO Nonfatal N238W Airplane Glasair Glastar Built Approach System/ Component Failure – Powerplant CEN11CA389 6/10/2011 Oakwood, OK Nonfatal N25LC Airplane Vans RV6A Built Landing Collision on Takeoff or Landing ERA11LA336 6/10/2011 Scarborough, ME Nonfatal N915PK Airplane Kitfox II Purchased Used Initial Climb Loss of Control in Flight CEN11LA384 6/12/2011 Azle, TX Nonfatal N6ZY Airplane Lancair 360 Built En Route System/ Component Failure – Powerplant ERA11CA339 6/12/2011 Bennettsville, SC Nonfatal N444YB Airplane Rans S-10 Purchased Used Takeoff Runway Excursion WPR11FA258 6/12/2011 Aguila, AZ Nonfatal N189SB Airplane Murphy Moose Built Maneuvering System/ Component Failure – Powerplant CEN11CA395 6/13/2011 Moriarity, NM Nonfatal N81DN Airplane Rutan Long-EZ Purchased Used Landing Loss of Control on Ground CEN11LA385 6/13/2011 Coalgate, OK Nonfatal N80WW Airplane Vans RV6A Built En Route System/ Component Failure – Powerplant CEN11CA411 6/18/2011 Gardner, KS Nonfatal N563 Airplane Sonex Purchased Used Approach Undershoot/ Overshoot WPR11FA268 6/19/2011 Tehachapi, CA Fatal N851LT Airplane Thorp T-18 Purchased Used En Route Controlled Flight Info Terrain ERA11CA355 6/20/2011 Carthage, NC Nonfatal N4209F Airplane CGS Aviation Hawk Arrow Purchased Used Approach System/ Component Failure – Powerplant

NTSB The Safety of Experimental Amateur-Built Aircraft 131 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11LA280 6/22/2011 Sheridan, WY Nonfatal N4546Y Airplane Vans RV8 Built Landing Loss of Control on Ground CEN11CA423 6/24/2011 Angel Fire, NM Nonfatal N678VR Airplane Vans RV8 Purchased Used Landing Loss of Control on Ground CEN11LA419 6/25/2011 Gwinn, MI Nonfatal N16DV Airplane Pietenpol Air Camper Built Landing Loss of Control on Ground ERA11FA360 6/26/2011 Andalusia, AL Fatal N289DH Airplane Barracuda Built Approach Loss of Control in Flight ERA11LA361B 6/26/2011 Pompano Beach, FL Nonfatal N484BD Airplane Cozy MK IV Built Taxi Ground Collision WPR11LA289 6/26/2011 West Glacier, MT Nonfatal N397JL Airplane Fly Fisher Purchased Used Initial Climb System/ Component Failure – Powerplant WPR11LA291 6/27/2011 Moses Lake, WA Nonfatal N9103L Airplane Quad City Ultralight Challenger II Purchased Used Maneuvering System/ Component Failure – Powerplant CEN11LA432 6/28/2011 Gladewater, TX Nonfatal N751WB Airplane Zenith Aircraft Company CH750 Built Takeoff Loss of Control in Flight CEN11FA431 6/29/2011 Howell, MI Fatal N8AL Airplane Thorp T-18 Purchased Used Approach Loss of Control in Flight CEN11FA433 6/29/2011 Neshkoro, WI Fatal N12911 Airplane Quad City Ultralight Challenger II Built Initial Climb System/ Component Failure – Powerplant CEN11LA429 6/29/2011 Oshkosh, WI Nonfatal N56PK Airplane Wittman Tailwind W-8 Built Initial Climb System/ Component Failure – Powerplant CEN11CA439 6/30/2011 Sisterdale, TX Nonfatal N6917 Airplane B-2 Purchased Used Maneuvering Controlled Flight Info Terrain CEN11FA434 6/30/2011 Yukon, OK Fatal N358MA Airplane Lancair 320 Purchased Used Approach Loss of Control in Flight

NTSB The Safety of Experimental Amateur-Built Aircraft 132 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11FA436 6/30/2011 Ottumwa, IA Fatal N773RY Airplane 773 Racer Built En Route System/ Component Failure – Powerplant CEN11LA449 6/30/2011 Leander, TX Nonfatal N59VA Airplane Vans RV9A Purchased Used Landing System/ Component Failure – Powerplant ERA11CA373 6/30/2011 Gray Coourt, SC Nonfatal N67KL Airplane Zenith Aircraft Company CH601 Built En Route System/ Component Failure – Powerplant CEN11LA455 7/1/2011 Toledo, OH Nonfatal N433GC Airplane Rans S-17 Purchased Used Initial Climb Loss of Control in Flight ERA11FA374 7/2/2011 Calhoun, GA Fatal N6PX Airplane Sonex Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11FA443 7/3/2011 Port O'Connor, TX Fatal N11001 Airplane Lancair IV P Built En Route Loss of Control in Flight ERA11LA400 7/4/2011 Fort Drum, FL Nonfatal N3226N Airplane Vans RV4 Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11CA454 7/6/2011 Decker, IN Nonfatal N25VK Gyroplane Rotary Air Force RAF 2000 Purchased Used Landing Abnormal Runway Contact ANC11LA060 7/7/2011 Sterling, AK Nonfatal N18YX Airplane Sonex Waiex Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11LA464 7/7/2011 East Liverpool, OH Nonfatal N7808M Airplane DerJager D 1X Purchased Used Approach Loss of Control in Flight CEN11FA469 7/9/2011 Dudley, MO Fatal N113RB Airplane Monnett Sonerai II Built Unknown Loss of Control in Flight WPR11CA321 7/10/2011 Cedar City, UT Nonfatal N2015U Airplane Thorp T-221 Purchased used En Route Fuel Related CEN11LA490 7/13/2011 Peyton, CO Nonfatal N61262 Airplane Darrow AL-6 Purchased Used En Route System/ Component Failure – Powerplant

NTSB The Safety of Experimental Amateur-Built Aircraft 133 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11LA481 7/15/2011 Jackson, MI Nonfatal N122DG Gyroplane Rhino II Built Takeoff Loss of Control in Flight ERA11LA403 7/15/2011 Batavia, NY Nonfatal N113SM Airplane Murphy Rebel Elite Purchased Used Initial Climb Loss of Control in Flight CEN11CA486 7/16/2011 Paxton, IL Nonfatal N9040W Airplane Zenith Aircraft Company STOL CH701 Purchased Used Takeoff Loss of Control in Flight CEN11LA488 7/16/2011 Jackson, MI Nonfatal N341MD Airplane Volksplane VP-1 Built Initial Climb System/ Component Failure – Powerplant WPR11FA333 7/17/2011 Glendale, OR Fatal N701RD Airplane Zenith Aircraft Company STOL CH701 Purchased Used Takeoff System/ Component Failure – Powerplant WPR11CA341 7/19/2011 SAN JOSE, CA Nonfatal N411TM Airplane Starduster Starduster Too SA- 300 Purchased Used Landing Ground Collision CEN11CA521 7/20/2011 Jamestown, ND Nonfatal N343A Airplane Glasair II Built Landing Loss of Control on Ground CEN11LA527 7/22/2011 Ashtabula, OH Nonfatal N240JS Airplane Quickie Aircraft Quickie Q2 Built Takeoff System/ Component Failure – Powerplant ERA11LA418 7/24/2011 Hartford, KY Nonfatal N164BF Airplane Vans RV6 Built En Route Fuel Related CEN11LA506 7/25/2011 Oshkosh, WI Nonfatal N559RD Gyroplane Rotor Flight Dynamics Dominator Purchased Used Takeoff Loss of Control in Flight CEN11LA514 7/25/2011 Monroe City, MO Nonfatal N20JE Airplane Vans RV4 Purchased Used Approach System/ Component Failure – Powerplant WPR11LA364 7/26/2011 Sedona, AZ Nonfatal N671T Airplane Express Aircraft Company Series 2000 Built Landing Abnormal Runway Contact CEN11LA530 7/28/2011 Fort Worth, TX Nonfatal N114DC Airplane Vans RV4 Purchased Used En Route Fuel Related CEN11LA539 7/29/2011 Salem, IA Nonfatal N115RH Airplane Cavalier SA102.5 Purchased Used Maneuvering System/ Component Failure – Powerplant

NTSB The Safety of Experimental Amateur-Built Aircraft 134 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11CA353 7/29/2011 Sheridan, WY Nonfatal N742RJ Airplane Vans RV7A Built Takeoff Loss of Control in Flight CEN11FA528 7/30/2011 Springfield, OH Fatal N453WB Airplane Wright B Flyer Built En Route System/ Component Failure – Powerplant ERA11CA432 7/30/2011 Huntington, WV Nonfatal N434WM Airplane Rans S-6S Purchased Used Takeoff Abnormal Runway Contact CEN11FA537 7/31/2011 Big Rock, IL Fatal N345JM Airplane E-Racer Built Maneuvering Loss of Control in Flight WPR11CA358 7/31/2011 Yamhill, OR Nonfatal N30456 Airplane Avid Mark IV Built Landing System/ Component Failure – Non- Power WPR11LA371 8/2/2011 Republic, WA Nonfatal N3135J Airplane Kolb Twinstar II Built Landing Loss of Control on Ground CEN11LA546 8/4/2011 Reedsburg, WI Fatal N340BR Airplane Quad City Ultralight Challenger II Built Takeoff Loss of Control in Flight CEN11CA550 8/5/2011 Colorado Springs, CO Nonfatal N675RE Airplane Vans RV6A Purchased Used Landing Abnormal Runway Contact ERA11CA440 8/5/2011 Frostproof, FL Nonfatal N13LN Airplane Arion Aircraft Lightning Built Initial Climb Loss of Control in Flight CEN11LA553 8/6/2011 Metone, IN Nonfatal N128BH Helicopter Eagle R&D Helicycle Built Landing System/ Component Failure – Powerplant ERA11CA442 8/6/2011 Farmingdale, NY Nonfatal N723AD Airplane Arion Aircraft Lightning Built Landing Loss of Control on Ground WPR11LA373 8/6/2011 Chino Hills, CA Nonfatal N162CT Helicopter Rotorway Exec Built En Route System/ Component Failure – Powerplant ERA11LA444 8/7/2011 Paducah, KY Nonfatal N462WP Airplane Vans RV7A Built Initial Climb System/ Component Failure – Powerplant

NTSB The Safety of Experimental Amateur-Built Aircraft 135 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code WPR11CA399 8/12/2011 Dubois, WY Nonfatal N56WY Airplane CubCrafters Carbon Cub Purchased Used En Route Controlled Flight Info Terrain CEN11LA573A 8/13/2011 Conroe, TX Fatal N16DD Airplane Vans RV8 Built Maneuvering Midair Collision CEN11LA573B 8/13/2011 Conroe, TX Fatal N189DK Airplane Vans RV6 Built Maneuvering Midair Collision CEN11LA671 8/13/2011 Lake Jackson, TX Nonfatal N7167S Airplane Fisher Flying Products Horizon 2 Purchased Used Takeoff System/ Component Failure – Powerplant CEN11LA672 8/13/2011 Bryan, TX Nonfatal N53QB Airplane Slip Stream International Genesis Purchased Used Initial Climb Loss of Control in Flight ERA11CA455 8/13/2011 Abingdon, VA Nonfatal N376CG Airplane Just Aircraft Highlander Built Takeoff Runway Excursion CEN11LA596 8/17/2011 Columbia, IL Nonfatal N284E Airplane Jabiru SP170 Purchased Used Landing System/ Component Failure – Non- Power ERA11FA463 8/17/2011 Ransom Township, PA Fatal N6613Z Airplane Quad City Ultralight Challenger II Purchased Used Maneuvering Controlled Flight Info Terrain ERA11LA459 8/17/2011 Maysville, NC Nonfatal N523RE Airplane Pegazair STOL 100 Built Initial Climb Loss of Control in Flight WPR11FA392 8/18/2011 Moore, ID Fatal N559Y Glider Briegleb BG-12B Purchased Used Landing Loss of Control in Flight WPR11LA405 8/18/2011 Snohomish, WA Nonfatal N701BZ Airplane Zenith Aircraft Company STOL CH701 Built Landing Abnormal Runway Contact CEN11LA591 8/20/2011 Delaware, OH Nonfatal N2631B Gyroplane American Autogyro Sparrow Hawk Purchased Used Initial Climb Abnormal Runway Contact ERA11CA477 8/20/2011 Bessemer, AL Nonfatal N2997G Airplane Pitts S1C Purchased Used Landing Loss of Control on Ground ERA11CA478 8/20/2011 Smithville, TN Nonfatal N52CH Airplane Avid Mark IV Purchased Used Takeoff Loss of Control on Ground ERA11FA468A 8/20/2011 Hammonton, NJ Fatal N71DM Airplane Lancair IV-P Built Maneuvering Midair Collision

NTSB The Safety of Experimental Amateur-Built Aircraft 136 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11LA588 8/21/2011 La Porte City, IA Nonfatal N540AF Airplane Murphy Rebel Elite Built Maneuvering System/ Component Failure – Non- Power ERA11CA471 8/24/2011 Ocala, FL Nonfatal N250CH Airplane Glasair I TD Purchased Used Landing System/ Component Failure – Non- Power CEN11FA597 8/25/2011 Heath, OH Fatal N777BN Airplane Lancair 235 Purchased Used Takeoff Loss of Control on Ground WPR11LA436 8/25/2011 Mile Hi Landing Strip, ID Nonfatal N727WW Airplane Performance Air PA-18 Purchased Used Landing Abnormal Runway Contact ERA11LA473 8/26/2011 Carlton, NY Nonfatal N246CV Airplane Zenith Aircraft Company STOL CH701 Built Maneuvering Fuel Related WPR11LA412 8/28/2011 Albany, OR Nonfatal N642DW Airplane Vans RV6A Built En Route System/ Component Failure – Powerplant CEN11LA618 9/2/2011 Marion, IL Nonfatal N100VY Airplane Sonex Waiex Built Initial Climb System/ Component Failure – Powerplant ERA11LA483 9/3/2011 Hollywood, FL Nonfatal N241BD Airplane Vans RV6A Purchased Used Takeoff System/ Component Failure – Powerplant WPR11CA433 9/3/2011 Kanab, UT Nonfatal N17S Airplane Glasair III Purchased Used Landing System/ Component Failure – Non- Power CEN11FA616 9/4/2011 Seward, NE Fatal N88CE Airplane Christen Eagle II Purchased Used Initial Climb System/ Component Failure – Powerplant ERA11CA482 9/4/2011 Memphis, TN Nonfatal N36V Airplane Questair Venture Built Landing System/ Component Failure – Non- Power WPR11FA428 9/4/2011 Caldwell, ID Fatal N624JS Airplane Kitfox Series 7 Built Initial Climb Loss of Control in Flight WPR11FA429 9/4/2011 Kanab, UT Fatal N9DZ Airplane Rutan Long-EZ Built En Route Unknown

NTSB The Safety of Experimental Amateur-Built Aircraft 137 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code ERA11CA485 9/5/2011 Beaufort, NC Nonfatal N334JH Airplane Glasair SHA Built Initial Climb Fuel Related CEN11FA634 9/7/2011 Winfield, KS Fatal N554JR Airplane Vans RV7A Built Unknown Loss of Control in Flight ERA11CA487 9/10/2011 Panama City, FL Nonfatal N407HK Airplane Thorp T-18 Built Landing Collision on Takeoff or Landing WPR11LA451 9/12/2011 Lancaster, CA Nonfatal N2WL Airplane White Lightning WLAC-1 Purchased Used Approach System/ Component Failure – Powerplant WPR11FA450 9/15/2011 West Jordan, UT Fatal N641JC Airplane Vans RV6A Purchased Used Approach Loss of Control in Flight WPR11FA453 9/15/2011 Reno, NV Nonfatal N521XD Airplane Questair Venture Built Initial Climb System/ Component Failure – Powerplant CEN11LA658 9/18/2011 Lancaster, TX Nonfatal N98D Airplane Vans RV8 Built Landing System/ Component Failure – Non- Power CEN11FA652 9/19/2011 Socorro, NM Fatal N91TX Airplane New Century Aerosport Radial Rocket Purchased Used Maneuvering Loss of Control in Flight ERA11LA519 9/19/2011 Okeechobee, FL Nonfatal N79GH Airplane Bakeng Deuce Purchased Used Landing Abnormal Runway Contact WPR11LA459 9/19/2011 Greenleaf, ID Nonfatal N77VW Airplane Steen Aero Lab Skybolt Purchased Used Maneuvering System/ Component Failure – Non- Power WPR11LA461 9/22/2011 Wells, NV Nonfatal N49S Airplane Breezy RLU-1 Purchased Used Maneuvering Controlled Flight Info Terrain CEN11CA665 9/23/2011 Lyons, WI Nonfatal N6YC Airplane Vans RV6 Purchased Used Landing Abnormal Runway Contact CEN11FA663 9/23/2011 Plainwell, MI Fatal N54WB Airplane Thorp T-18 Built Approach Collision on Takeoff or Landing CEN11CA667 9/24/2011 Lemars, IA Nonfatal N29RT Airplane Tandem Rocket Built Maneuvering Loss of Control in Flight

NTSB The Safety of Experimental Amateur-Built Aircraft 138 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN11LA415 9/24/2011 Lafayette, LA Nonfatal N211KF Airplane Kitfox IV Purchased Used Landing System/ Component Failure – Powerplant WPR11LA477A 9/24/2011 West Jordan, UT Nonfatal N23UT Airplane Starduster Starduster Too SA- 300 Purchased Used Taxi Ground Collision ERA11FA504 9/25/2011 Sanford, NC Fatal N360TV Airplane Velocity RG Purchased Used Initial Climb System/ Component Failure – Powerplant CEN11LA669 9/27/2011 Marietta, OH Nonfatal N499RV Airplane Vans RV10 Purchased Used En Route System/ Component Failure – Powerplant WPR11FA474 9/29/2011 Chualar, CA Fatal N42GP Airplane Zivko Aeronautics Edge 540 Purchased Used Maneuvering Low Altitude Operation CEN11CA679 9/30/2011 Hays, KS Nonfatal N384JP Airplane Murphy Moose Built En Route System/ Component Failure – Non- Power ERA11FA512 9/30/2011 Falls of Rough, KY Fatal N43KH Airplane Glasair III Purchased Used Maneuvering System/ Component Failure – Powerplant CEN12CA003 10/1/2011 Riley, KS Nonfatal N2417T Airplane Rans S-7 Purchased Used Takeoff Fuel Related CEN12CA005 10/2/2011 Brush, CO Nonfatal N287BM Airplane Bushby/Mustang Aeronautics Mustang II Built Taxi Loss of Control on Ground WPR12FA001 10/4/2011 West Jordan, UT Fatal N91BV Airplane Pulsar 582 Purchased Used Initial Climb Loss of Control in Flight CEN12LA008 10/5/2011 Versailles, MO Nonfatal N9144E Airplane Kolb MK III Purchased Used Initial Climb System/ Component Failure – Powerplant ERA12FA006 10/5/2011 Hedgesville, WV Fatal N747HW Airplane Arion Aircraft Lightning Built Initial Climb Loss of Control in Flight CEN12FA010 10/6/2011 Holland, MI Fatal N2935R Airplane Quickie Aircraft Q200 Built Approach Collision on Takeoff or Landing ERA12CA010 10/6/2011 Sebastian, FL Nonfatal N67WR Airplane Velocity RG Purchased Used Landing Collision on Takeoff or Landing

NTSB The Safety of Experimental Amateur-Built Aircraft 139 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code ERA12LA011 10/6/2011 Wytheville, VA Fatal N7026G Airplane Rand Robinson KR-2 Purchased Used Initial Climb Loss of Control in Flight CEN12LA013 10/7/2011 Thompsonville, MI Nonfatal N455BW Gyroplane AutoGyro Calidus Built Landing Loss of Control on Ground WPR12CA006 10/10/2011 Diamond, WA Nonfatal N132LL Airplane Bushman Purchased Used Landing Abnormal Runway Contact CEN12LA014 10/11/2011 Traverse City, MI Nonfatal N4595P Airplane Zenith Aircraft Company 601XL Built Initial Climb System/ Component Failure – Powerplant WPR12CA005A 10/11/2011 Madera, CA Nonfatal N506DC Airplane Vans RV4 Built Maneuvering Midair Collision WPR12CA005B 10/11/2011 Madera, CA Nonfatal N427EF Airplane Vans RV8 Purchased Used Maneuvering Midair Collision WPR12LA009 10/13/2011 San Rafael, CA Nonfatal N762S Airplane Pietenpol Air Camper Purchased Used Takeoff System/ Component Failure – Powerplant CEN12CA027 10/14/2011 Breaux Bridge, LA Nonfatal N610EC Airplane Vans RV8 Purchased Used Landing Collision on Takeoff or Landing CEN12CA029 10/15/2011 Blair, NE Nonfatal N29HT Gyroplane American Autogyro Sparrow Hawk Built Takeoff System/Comp onent Failure – Non-Power WPR12LA013 10/15/2011 Susanville, CA Nonfatal N4077B Airplane Avid Flyer Purchased Used Takeoff System/ Component Failure – Powerplant CEN12CA026 10/16/2011 Terrell, TX Nonfatal N331EJ Airplane Volksplane VP-1 Purchased Used Initial Climb Loss of Control in Flight ERA12CA043 10/17/2011 Grantham, NC Nonfatal N25WS Airplane Aerosport Scamp Purchased Used Approach Collision on Takeoff or Landing ERA12LA045 10/18/2011 Woodrow, WV Nonfatal N5456C Airplane Bearhawk Purchased Used Maneuvering System/ Component Failure – Powerplant CEN12CA035 10/21/2011 Hibbing, MN Nonfatal N43280 Airplane Avid Mark IV Purchased Used En Route System/ Component Failure – Powerplant

NTSB The Safety of Experimental Amateur-Built Aircraft 140 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code ERA12FA018 10/22/2011 Washington, GA Fatal N75654 Airplane Sonex Waiex Purchased Used Maneuvering System/ Component Failure – Non- Power ERA12FA021 10/23/2011 Lexington, NC Fatal N795DB Airplane Cozy MK IV Purchased Used Approach Fuel Related CEN12LA049 10/29/2011 Vienna, OH Nonfatal N486LB Airplane Pietenpol Air Camper Purchased Used Initial Climb System/ Component Failure – Powerplant ERA12CA055 10/30/2011 Folkston, GA Nonfatal N968TP Airplane Vans RV10 Built En Route Fuel Related ERA12FA057 11/1/2011 Taylorsville, GA Fatal N262MA Airplane Vans RV6 Purchased Used Unknown Unknown ERA12LA100A 11/6/2011 Abingdon, VA Nonfatal N62HS Airplane Vans RV6 Purchased Used Landing Runway Incursion - Vehicle ERA12LA069 11/9/2011 Nashua, NH Nonfatal N220RG Airplane Vans RV8 Built Landing Abnormal Runway Contact WPR12CA033 11/9/2011 San Carlos, AZ Nonfatal N5089Q Airplane Thatcher CX4 Purchased Used Takeoff Loss of Control on Ground CEN12LA071 11/17/2011 Clinton, AR Nonfatal N274 Airplane Zenith Aircraft Company CH602 Purchased Used Takeoff System/ Component Failure – Non- Power ERA12CA078 11/20/2011 Bunn, NC Nonfatal N6844B Airplane Kitfox IV-1200 Purchased Used Landing Abnormal Runway Contact CEN12CA081 11/23/2011 Center, TX Nonfatal N808F Airplane Davis DA-2A Purchased Used Landing Loss of Control on Ground ERA12CA088 11/25/2011 Quinton, VA Nonfatal N816BA Airplane Vans RV7A Purchased Used Initial Climb Fuel Related ERA12LA087 11/27/2011 Hernando, FL Nonfatal N1321 Airplane Smith Miniplane DSA-4 Purchased Used En Route System/ Component Failure – Powerplant ERA12CA094 12/1/2011 Caroleen, NC Nonfatal N295JS Airplane Team Rocket F1H Purchased Used Takeoff Runway Incursion - Animal ERA12FA093 12/1/2011 Fulton, NY Fatal N865JT Airplane Wittman Tailwind W-10 Built Approach Fuel Related ERA12CA096 12/4/2011 Courtland, AL Nonfatal N212WE Airplane Loehle Aircraft Company P5151 Purchased Used Approach Windshear/ Thunderstorm

NTSB The Safety of Experimental Amateur-Built Aircraft 141 NTSB case ID Date Location Severity Registra- ++tion ++ Aircraft Built or Used CICTT phase code CICTT event code CEN12LA102 12/8/2011 Festus, MO Nonfatal N7138K Airplane Rans S-13 Purchased Used Approach Loss of Control in Flight WPR12FA059 12/10/2011 Surprise, AZ Fatal N724WD Airplane Vans RV7A Built En Route Loss of Control in Flight WPR12FA062 12/10/2011 Armistead, CA Fatal N948RC Airplane Vans RV8 Built Maneuvering Low Altitude Operation ERA12FA107 12/11/2011 Somerville, TN Fatal N347DS Airplane Rans S-7 Purchased Used Takeoff Other ERA12CA124 12/26/2011 Simsbury, CT Nonfatal N435AB Gyroplane Aerial Gyroplane Built Takeoff Loss of Control in Flight ERA12CA129 12/30/2011 Mansfield, MA Nonfatal N344MK Airplane Jabiru Calypso Purchased Used Landing Loss of Control on Ground

NTSB The Safety of Experimental Amateur-Built Aircraft 142 Appendix G: Canadian Minister’s Delegate – Recreational Aviation Form C14E Fuel Flow Test Report

NTSB The Safety of Experimental Amateur-Built Aircraft 143 Appendix H: Special Light-Sport and Experimental Light-Sport Airworthiness Certificates and Sport Pilot Airmen Certificate Effective September 1, 2004, the Federal Aviation Administration (FAA) defined characteristics describing a category of simple, small, lightweight, low-performance aircraft; identifying them as light-sport aircraft. Along with defining this group of aircraft, the FAA created new airworthiness categories and certification procedures for aircraft meeting the light-sport definition. Specifically, two categories of special airworthiness certificate were created, special light-sport aircraft (S-LSA) which include aircraft manufactured according to an industry consensus standard rather than a type certificate, and experimental light-sport aircraft (E-LSA), which includes provisions for kit-built versions of S-LSA aircraft, S-LSA re-certificated as experimental, and a temporary provision to allow migration of so-called ―fat ultralights‖ that included aircraft that did not conform to 14 CFR Part 103 and that were previously unregistered into the category of E-LSA aircraft. At the same time, the FAA created a new sport pilot airmen certificate(s), with associated operating limitations that granted privileges to operate aircraft meeting the light-sport aircraft definition. The sport pilot certificate was envisioned as less expensive and less restrictive entry to pilot certification for purpose of personal recreation. As a tradeoff, the operating limitations of the sport pilot certificate are more restrictive with regard to the aircraft that can be flown, the number of passengers carried, and the time of day during which they could operate. In particular, pilots exercising the privileges of the light-sport certificate are restricted to aircraft meeting the definition of light-sport aircraft. It is important to note that this not only includes aircraft with an S-LSA or E-LSA airworthiness certificates, but any aircraft meeting the definition shown in the next section. For example, aircraft with a standard or experimental airworthiness certificate may be flown by a pilot exercising the privileges of the sport pilot certificate. The most notable of the differences introduced with the sport pilot certificate is the option to use a current driver‘s license to meet the airmen medical certification requirements, and the extension of this option to pilots holding other levels of airmen certification so long as they adhere to the aircraft and operating limitations of the sport pilot certificate. For example, this change is related to E-AB aircraft in that a pilot holding a private, commercial, or air transport pilot airmen certificate may operate an E-AB or type-certificated aircraft that conforms to the definition of a light-sport aircraft (as opposed to the airworthiness certification of S-LSA or E-LSA) using a valid driver‘s license to meet the medical certification requirements, so long as they adhere to operating limitations of the sport pilot airmen certificate. Light-Sport Aircraft Definition Title 14, Code of Federal Regulations, section 1.1 includes the following definition of light sport aircraft:

NTSB The Safety of Experimental Amateur-Built Aircraft 144 Light-sport aircraft means an aircraft, other than a helicopter or powered-lift that, since its original certification, has continued to meet the following: (1) A maximum takeoff weight of not more than— (i) 1,320 pounds (600 kilograms) for aircraft not intended for operation on water; or (ii) 1,430 pounds (650 kilograms) for an aircraft intended for operation on water. (2) A maximum airspeed in level flight with maximum continuous power (VH) of not more than 120 knots CAS under standard atmospheric conditions at sea level. (3) A maximum never-exceed speed (VNE) of not more than 120 knots CAS for a glider. (4) A maximum stalling speed or minimum steady flight speed without the use of lift-enhancing devices (VS1) of not more than 45 knots CAS at the aircraft's maximum certificated takeoff weight and most critical center of gravity. (5) A maximum seating capacity of no more than two persons, including the pilot. (6) A single, reciprocating engine, if powered. (7) A fixed or ground-adjustable propeller if a powered aircraft other than a powered glider. (8) A fixed or feathering propeller system if a powered glider. (9) A fixed-pitch, semi-rigid, teetering, two-blade rotor system, if a gyroplane. (10) A nonpressurized cabin, if equipped with a cabin. (11) Fixed landing gear, except for an aircraft intended for operation on water or a glider. (12) Fixed or retractable landing gear, or a hull, for an aircraft intended for operation on water. (13) Fixed or retractable landing gear for a glider.

Special Light-sport Aircraft and Experimental Light-sport Aircraft Airworthiness Certification Title 14, Code of Federal Regulations, section 21.190 includes the following regulations pertaining to certification of special light sport aircraft:

NTSB The Safety of Experimental Amateur-Built Aircraft 145 21.190 Issue of a special airworthiness certificate for a light-sport category aircraft. (a) Purpose. The FAA issues a special airworthiness certificate in the light-sport category to operate a light-sport aircraft, other than a gyroplane. (b) Eligibility. To be eligible for a special airworthiness certificate in the light-sport category: (1) An applicant must provide the FAA with— (i) The aircraft's operating instructions; (ii) The aircraft's maintenance and inspection procedures; (iii) The manufacturer's statement of compliance as described in paragraph (c) of this section; and (iv) The aircraft's flight training supplement. (2) The aircraft must not have been previously issued a standard, primary, restricted, limited, or provisional airworthiness certificate, or an equivalent airworthiness certificate issued by a foreign civil aviation authority. (3) The aircraft must be inspected by the FAA and found to be in a condition for safe operation. (c) Manufacturer's statement of compliance for light-sport category aircraft. The manufacturer's statement of compliance required in paragraph (b)(1)(iii) of this section must— (1) Identify the aircraft by make and model, serial number, class, date of manufacture, and consensus standard used; (2) State that the aircraft meets the provisions of the identified consensus standard; (3) State that the aircraft conforms to the manufacturer's design data, using the manufacturer's quality assurance system that meets the identified consensus standard; (4) State that the manufacturer will make available to any interested person the following documents that meet the identified consensus standard: (i) The aircraft's operating instructions. (ii) The aircraft's maintenance and inspection procedures. (iii) The aircraft's flight training supplement.

NTSB The Safety of Experimental Amateur-Built Aircraft 146 (5) State that the manufacturer will monitor and correct safety-of-flight issues through the issuance of safety directives and a continued airworthiness system that meets the identified consensus standard; (6) State that at the request of the FAA, the manufacturer will provide unrestricted access to its facilities; and (7) State that the manufacturer, in accordance with a production acceptance test procedure that meets an applicable consensus standard has— (i) Ground and flight tested the aircraft; (ii) Found the aircraft performance acceptable; and (iii) Determined that the aircraft is in a condition for safe operation. (d) Light-sport aircraft manufactured outside the United States. For aircraft manufactured outside of the United States to be eligible for a special airworthiness certificate in the light-sport category, an applicant must meet the requirements of paragraph (b) of this section and provide to the FAA evidence that— (1) The aircraft was manufactured in a country with which the United States has a Bilateral Airworthiness Agreement concerning airplanes or Bilateral Aviation Safety Agreement with associated Implementation Procedures for Airworthiness concerning airplanes, or an equivalent airworthiness agreement; and (2) The aircraft is eligible for an airworthiness certificate, flight authorization, or other similar certification in its country of manufacture.

Title 14, Code of Federal Regulations, sections 21.191(i) and 21.193(e) include the following regulations pertaining to certification of special light-sport aircraft, with 14 CFR 21.191(i)(1) being the provision by which the ―fat-ultralights‖ could be certified as E-LSA: 21.191 (i) Operating light-sport aircraft. Operating a light-sport aircraft that— (1) Has not been issued a U.S. or foreign airworthiness certificate and does not meet the provisions of §103.1 of this chapter. An experimental certificate will not be issued under this paragraph for these aircraft after January 31, 2008; (2) Has been assembled— (i) From an aircraft kit for which the applicant can provide the information required by §21.193(e); and

NTSB The Safety of Experimental Amateur-Built Aircraft 147 (ii) In accordance with manufacturer's assembly instructions that meet an applicable consensus standard; or (3) Has been previously issued a special airworthiness certificate in the light-sport category under §21.190.

1. 193 (e) In the case of a light-sport aircraft assembled from a kit to be certificated in

accordance with §21.191(i)(2), an applicant must provide the following: (1) Evidence that an aircraft of the same make and model was manufactured and assembled by the aircraft kit manufacturer and issued a special airworthiness certificate in the light-sport category. (2) The aircraft's operating instructions. (3) The aircraft's maintenance and inspection procedures. (4) The manufacturer's statement of compliance for the aircraft kit used in the aircraft assembly that meets §21.190(c), except that instead of meeting §21.190(c)(7), the statement must identify assembly instructions for the aircraft that meet an applicable consensus standard. (5) The aircraft's flight training supplement. (6) In addition to paragraphs (e)(1) through (e)(5) of this section, for an aircraft kit manufactured outside of the United States, evidence that the aircraft kit was manufactured in a country with which the United States has a Bilateral Airworthiness Agreement concerning airplanes or a Bilateral Aviation Safety Agreement with associated Implementation Procedures for Airworthiness concerning airplanes, or an equivalent airworthiness agreement.

Title 14, Code of Federal Regulations, section 61.315 include the following regulations pertaining to the sport pilot airmen certificate: 61.315 What are the privileges and limits of my sport pilot certificate? (a) If you hold a sport pilot certificate you may act as pilot in command of a light-sport aircraft, except as specified in paragraph (c) of this section. (b) You may share the operating expenses of a flight with a passenger, provided the expenses involve only fuel, oil, airport expenses, or aircraft rental fees. You must pay at least half the operating expenses of the flight. (c) You may not act as pilot in command of a light-sport aircraft:

NTSB The Safety of Experimental Amateur-Built Aircraft 148 (1) That is carrying a passenger or property for compensation or hire. (2) For compensation or hire. (3) In furtherance of a business. (4) While carrying more than one passenger. (5) At night. (6) In Class A airspace. (7) In Class B, C, and D airspace, at an airport located in Class B, C, or D airspace, and to, from, through, or at an airport having an operational control tower unless you have met the requirements specified in §61.325. (8) Outside the United States, unless you have prior authorization from the country in which you seek to operate. Your sport pilot certificate carries the limit ―Holder does not meet ICAO requirements.‖ (9) To demonstrate the aircraft in flight to a prospective buyer if you are an aircraft salesperson. (10) In a passenger-carrying airlift sponsored by a charitable organization. (11) At an altitude of more than 10,000 feet MSL or 2,000 feet AGL, whichever is higher. (12) When the flight or surface visibility is less than 3 statute miles. (13) Without visual reference to the surface. (14) If the aircraft: (i) Has a VH greater than 87 knots CAS, unless you have met the requirements of §61.327(b). (ii) Has a VH less than or equal to 87 knots CAS, unless you have met the requirements of §61.327(a) or have logged flight time as pilot in command of an airplane with a VH less than or equal to 87 knots CAS before April 2, 2010. (15) Contrary to any operating limitation placed on the airworthiness certificate of the aircraft being flown. (16) Contrary to any limit on your pilot certificate or airman medical certificate, or any other limit or endorsement from an authorized instructor.

NTSB The Safety of Experimental Amateur-Built Aircraft 149 (17) Contrary to any restriction or limitation on your U.S. driver's license or any restriction or limitation imposed by judicial or administrative order when using your driver's license to satisfy a requirement of this part. (18) While towing any object. (19) As a pilot flight crewmember on any aircraft for which more than one pilot is required by the type certificate of the aircraft or the regulations under which the flight is conducted.

Title 14, Code of Federal Regulations, section 61.303(b) include the following regulations pertaining to the driver‘s license medical provision: 61.303 (b) A person using a U.S. driver's license to meet the requirements of this paragraph must— (1) Comply with each restriction and limitation imposed by that person's U.S. driver's license and any judicial or administrative order applying to the operation of a motor vehicle; (2) Have been found eligible for the issuance of at least a third-class airman medical certificate at the time of his or her most recent application (if the person has applied for a medical certificate); (3) Not have had his or her most recently issued medical certificate (if the person has held a medical certificate) suspended or revoked or most recent Authorization for a Special Issuance of a Medical Certificate withdrawn; and (4) Not know or have reason to know of any medical condition that would make that person unable to operate a light-sport aircraft in a safe manner.

The present study did not specifically attempt to assess the impact of the regulatory changes related to light-sport aircraft and sport pilot airmen certificate; however, there is evidence of those effects in the accident record. Figure H1 illustrates the increase in the proportion of accident aircraft meeting the weight definition of light-sport aircraft and Figure H2 illustrates the increase in proportion of E-AB aircraft accidents without a first, second, or third class medical. In the absence of associated data, it can be assumed that these findings are indicative of an increase in activity related to pilots exercising the sport pilot provision. They do not, however, assess the specific risk of these changes in regulation.

NTSB The Safety of Experimental Amateur-Built Aircraft 150

Figure H1. Chart illustrating an increase in the proportion of accident aircraft meeting the weight limitation of light-sport aircraft, following the 2004 effectiveness date of the light-sport aircraft and sport pilot rule.

Proportion of Accident Aircraft with Maximum Gross Weight Category 1,320 Pounds or Less, 2001-2010

NTSB The Safety of Experimental Amateur-Built Aircraft 151

Figure H2. Chart illustrating an increase in the proportion of accident pilots of E-AB aircraft without a First, Second, or Third Class medical following the 2004 effective date of the light-sport aircraft and sport pilot rule.

0% 10% 20% 30% 40% 50% 60% 70% 80% 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 Percentage of E-AB Accident Pilots Calendar Year Distribution of E-AB Accident Pilots by Medical Certificate, 2001–2010 None/Sport Pilot Class1 Class2 Class3 Unknown

FD07400 ｜ 2013_美国_AAR1301.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Loss of Control Sundance Helicopters, Inc. Eurocopter AS350-B2, N37SH Near Las Vegas, Nevada December 7, 2011

Accident Report NTSB/AAR-13/01 PB2013-103890

National Transportation Safety Board

NTSB/AAR-13/01 PB2013-103890 Notation 8371A Adopted January 29, 2013

Aircraft Accident Report Loss of Control Sundance Helicopters, Inc. Eurocopter AS350-B2, N37SH Near Las Vegas, Nevada December 7, 2011

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2013. Loss of Control, Sundance Helicopters, Inc., Eurocopter AS350-B2, N37SH, Near Las Vegas, Nevada, December 7, 2011. Aircraft Accident Report NTSB/AAR-13/01. Washington, DC.

Abstract: This report discusses the December 7, 2011, accident involving a Sundance Helicopters, Inc., Eurocopter AS350-B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip, which crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire.

The safety issues identified in this accident are the improper reuse of degraded self-locking nuts, maintenance personnel fatigue, the need for work cards with delineated steps, and the lack of human factors training for maintenance personnel. Safety recommendations concerning these issues are addressed to the Federal Aviation Administration.

The National Transportation Safety Board is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2013-103890 from:

National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of Board reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Aircraft Accident Report i Contents Figures ........................................................................................................................................... iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary .......................................................................................................................v

1. The Accident .............................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Personnel Information ................................................................................................................3
4. 2.1 The Pilot ...........................................................................................................................3
5. 2.2 Maintenance Personnel ....................................................................................................4
6. 2.2.1 The Mechanic.....................................................................................................5
7. 2.2.2 The Quality Control Inspector ...........................................................................5
8. 2.2.3 The Check Pilot..................................................................................................6
9. 3 The Helicopter’s Flight Control System ....................................................................................7
10. 4 Wreckage Information ...............................................................................................................8
11. 5 Company Information ................................................................................................................9
12. 5.1 Maintenance Program Information ..................................................................................9
13. 5.1.1 Most Recent Maintenance ................................................................................10
14. 5.1.2 Fore/Aft Servo Installation Procedures ............................................................10
15. 6 Self-Locking Nut Reuse Guidance ..........................................................................................11
16. 7 Federal Aviation Administration Oversight.............................................................................13
17. Investigation and Analysis ....................................................................................................14
18. 1 Scenarios Evaluated to Explain the Loss of Control ...............................................................14
19. 2 Probable Bolt Loss Scenario ....................................................................................................15
20. 3 Postmaintenance Inspections ...................................................................................................18
21. 3.1 Quality Control Inspections ...........................................................................................18
22. 3.2 External Check Procedures ............................................................................................19
23. 4 Misinterpretation of TOPS Audit Requirements .....................................................................20
24. Safety Issues ............................................................................................................................23
25. 1 Improper Reuse of Degraded Self-Locking Nuts ....................................................................23
26. 2 Maintenance Human Factors ...................................................................................................24
27. 2.1 Maintenance Personnel Fatigue .....................................................................................25
28. 2.1.1 Effects of Fatigue on Maintenance ..................................................................27
29. 2.1.2 Lack of Maintenance Personnel Duty-Time Limitations.................................28
30. 2.2 Need for Work Cards With Delineated Steps ................................................................29
31. 2.3 Lack of Human Factors Training for Maintenance Personnel .......................................32
32. Conclusions .............................................................................................................................34
33. 1 Findings....................................................................................................................................34
34. 2 Probable Cause.........................................................................................................................35

NTSB Aircraft Accident Report ii

1. Recommendations ..................................................................................................................36
2. 1 New Recommendations ...........................................................................................................36
3. 2 Previously Issued Recommendation Reiterated in This Report ..............................................36
4. 3 Previously Issued Recommendation Reclassified in This Report ...........................................36

Board Member Statements .........................................................................................................38

1. Appendix ...................................................................................................................................41

NTSB Aircraft Accident Report iii Figures Figure 1. Accident flightpath (depicted in yellow) overlaid with the prescribed Twilight tour route (depicted in green). ..........................................................................................................2 Figure 2. Photograph of the main helicopter wreckage. .................................................................3 Figure 3. Schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly. ..........................................................................................................................7 Figure 4. Photograph showing the nut and split pin of the fore/aft servo input rod connection hardware visible through the cutout of the ice shield (about eye level for a pilot inspecting the left MGB area). ..............................................................................................10 Figure 5. Photograph showing the nuts, upper input rod bolts, and washers removed from N340SH and N351WM next to a new bolt and nuts. ....................................................................17

NTSB Aircraft Accident Report iv Abbreviations and Acronyms A&P airframe and powerplant AC advisory circular AMM aircraft maintenance manual BFF before first flight CFR Code of Federal Regulations FAA Federal Aviation Administration FAAST FAA Safety Team FSDO flight standards district office GCW Grand Canyon West Airport GMM general maintenance manual IA inspection authorization lbf pound-force MGB main gear box NPRM notice of proposed rulemaking NTSB National Transportation Safety Board POI principal operations inspector QC quality control RFM rotorcraft flight manual SMS safety management system TOPS Tour Operators Program of Safety

NTSB Aircraft Accident Report v Executive Summary On December 7, 2011, about 1630 Pacific standard time, a Sundance Helicopters, Inc., Eurocopter AS350-B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip, crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire. The helicopter was registered to and operated by Sundance as a scheduled air tour flight under the provisions of 14 Code of Federal Regulations (CFR) Part 135. Visual meteorological conditions with good visibility and dusk light prevailed at the time of the accident, and the flight operated under visual flight rules. The helicopter originated from Las Vegas McCarran International Airport, Las Vegas, Nevada, about 1621 with an intended route of flight to the Hoover Dam area and return to the airport. The helicopter was not equipped, and was not required to be equipped, with any on-board recording devices. The accident occurred when the helicopter unexpectedly climbed about 600 feet, turned about 90° to the left, and then descended about 800 feet, entered a left turn, and descended at a rate of at least 2,500 feet per minute to impact. During examination of the wreckage, the main rotor fore/aft servo, one of the three hydraulic servos that provide inputs to the main rotor, was found with its flight control input rod not connected. The bolt, washer, self-locking nut, and split pin (sometimes referred to as a “cotter pin” or “cotter key”) that normally secure the input rod to the main rotor fore/aft servo were not found. The investigation revealed that the hardware was improperly secured during maintenance that had been conducted the day before the accident. The nut became loose (likely because it was degraded)1 and, without the split pin, the nut separated from the bolt, the bolt disconnected, and the input rod separated from the linkage while the helicopter was in flight, at which point the helicopter became uncontrollable and crashed. The safety issues identified in this accident include the following:  Improper reuse of degraded self-locking nuts. Although Eurocopter and the Federal Aviation Administration (FAA) publish guidance on the reuse of self-locking nuts, the investigation revealed that Sundance Helicopters’ maintenance personnel were reusing nuts that did not meet the criteria specified by Eurocopter and FAA guidance. Federal regulations require that any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the Eurocopter AS350-B2 helicopter, the first locking device is the self-locking nut and the second one is the split pin. The improper reuse of a degraded self-locking nut on critical flight control components is a safety hazard because it negates the safety benefits of one of the two required locking devices. Reinforcing the

1 Throughout the report, the term “degraded” means that the nut was degraded beyond reuse specifications.

NTSB Aircraft Accident Report vi importance of maintenance personnel properly following manufacturer and FAA self-locking nut reuse guidance would help ensure that nuts without locking ability are not being reused. In response to the National Transportation Safety Board’s (NTSB) concerns on this matter, the FAA Safety Team (FAAST)2 published a general aviation maintenance alert on its website at http://faasafety.gov in November 2012 and distributed the alert to over 239,000 mechanics and pilots via its e-mail registry. The NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization (IA) renewal training. This information will be included in IA renewal training clinics throughout the United States in 2013. In addition, the FAA will publish an Aviation Maintenance Alert (Advisory Circular 43-16A) in early 2013 related to helicopter maintenance issues.  Maintenance personnel fatigue. Both the mechanic and the quality control inspector, who inspected the maintenance work completed the day before the accident, were likely fatigued during the December 6 shift, in part, because they had insufficient time to adjust to working an earlier shift than normal. The mechanic and inspector’s performance was degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the inadequate postmaintenance inspection of the accident helicopter, respectively. If the work shifts of the maintenance personnel had been consistent, a major source of their fatigue could have been mitigated.  Need for work cards with delineated steps. In addition to the degradation of the mechanic’s and inspector’s performance due to fatigue, the maintenance documentation did not clearly delineate specific inspection steps, which can allow these tasks to be more vulnerable to error through human factors. Using work cards that clearly delineate the steps to be performed and critical areas to be inspected to support both the maintenance and inspection tasks is one way to mitigate inadvertent errors of omission in the performance and verification of maintenance tasks, especially tasks involving critical flight controls.  Lack of human factors training for maintenance personnel. Although the FAA has developed substantial guidance for the industry about maintenance human factors and has repeatedly stressed the importance of human factors training, there is still no requirement for human factors training for maintenance personnel involved in air carrier operations. The NTSB notes that on May 21, 2012, the FAA issued a notice of proposed rulemaking (NPRM) proposing that repair stations operating under 14 CFR Part 145 provide human factors training relevant to aviation maintenance for employees performing maintenance, preventive maintenance, alterations, or inspection functions. However, if adopted, the rule would not require

2 FAAST’s mission is to improve the nation’s aviation safety record by conveying safety principles and practices through training, outreach, and education. FAAST managers and program managers are responsible for establishing meaningful alliances and encouraging continual growth of a positive safety culture within the aviation community.

NTSB Aircraft Accident Report vii maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs to receive human factors training. This investigation has shown that providing human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, to all maintenance personnel would help reduce the likelihood of human error in aviation maintenance. The NTSB determines that the probable cause of this accident was Sundance Helicopters’ inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable. Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow. Contributing to the inadequate postmaintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow. As a result of this investigation, the NTSB makes safety recommendations to the FAA, reiterates a previous recommendation to the FAA, and reclassifies a previous recommendation to the FAA.

NTSB Aircraft Accident Report 1

1. The Accident
2. 1 History of Flight

On December 7, 2011, about 1630 Pacific standard time,3 a Sundance Helicopters, Inc.,4 Eurocopter AS350-B2 helicopter, N37SH, operating as a “Twilight tour” sightseeing trip,5 crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada.6 The pilot and four passengers were killed, and the helicopter was destroyed by impact forces and postimpact fire. The helicopter was registered to and operated by Sundance as a scheduled air tour flight under the provisions of 14 Code of Federal Regulations (CFR) Part 135. Visual meteorological conditions with good visibility and dusk light prevailed at the time of the accident, and the flight operated under visual flight rules. The helicopter originated from Las Vegas McCarran International Airport, Las Vegas, Nevada, about 1621 with an intended route of flight to the Hoover Dam area and return to the airport.7 The helicopter was not equipped, nor required to be equipped, with any on-board recording devices.8 Radar data obtained from the FAA showed the helicopter following the prescribed Twilight tour route easterly out of the airport traffic area and then turning to the southeast toward the Hoover Dam. According to the radar data, the helicopter was level at 3,500 feet at a groundspeed of about 120 knots. About 1 minute before impact, radar data showed the helicopter climbing to 4,100 feet, turning about 90° to the left, and then slowing after the turn. The climb and left turn are not part of the Twilight tour flight route. Radar data then showed the helicopter descending to 3,300 feet and tracking a northeasterly course for about 20 seconds, until it entered a left turn and descended at a rate of at least 2,500 feet per minute to impact. The last received radar target was about 1/8 mile from the accident site. See figure 1 for the accident flightpath overlaid with the Twilight tour route.

3 Unless otherwise indicated, all times in this report are Pacific standard time based on a 24-hour clock. 4 Sundance was acquired by Air Methods, Inc., in December 2012. 5 The Twilight tour is a standardized nonstop sightseeing tour of the Hoover Dam and the Las Vegas strip at sunset. The departure time from Las Vegas McCarran International Airport is set to make the return to the airport about 15 to 30 minutes after official sunset. 6 The accident occurred on the helicopter’s fourth flight of the day. The helicopter was flown on one check flight and two tour flights (one by the check flight pilot and one by the accident pilot) before the accident flight, accumulating about 3.5 hours of flight time with six engine cycles. Neither the accident pilot nor check pilot noted any controllability issues during these flights. 7 The NTSB public docket for this accident investigation is available online at http://www.ntsb.gov/investigations/dms.html. 8 As a result of the NTSB’s investigation of the July 27, 2007, fatal accident involving two Eurocopter AS350-B2 electronic news gathering helicopters that collided in flight in Phoenix, Arizona, the NTSB issued Safety Recommendations A-09-9 through -11 to the FAA on February 9, 2009, which asked the FAA to mandate image recorder equipage on all turbine-powered, nonexperimental, nonrestricted-category aircraft. On June 11, 2012, the NTSB classified Safety Recommendations A-09-9 through -11 “Closed―Unacceptable Action” because the FAA stated that it was unable to determine a quantitative benefit for mandating image recorder equipage, and, therefore, would not do so. For more information about this accident, see Midair Collision of Electronic News Gathering Helicopters, KTVK-TV Eurocopter AS350B2, N613TV, and U.S. Helicopters, Inc., Eurocopter AS350B2, N215TV, Phoenix, Arizona, July 27, 2007, Aircraft Accident Report NTSB/AAR-09/02 (Washington, DC: National Transportation Safety Board, 2009), available online at http://www.ntsb.gov.

NTSB Aircraft Accident Report 2 Figure 1. Accident flightpath (depicted in yellow) overlaid with the prescribed Twilight tour route (depicted in green). The helicopter crashed in a ravine between Henderson, Nevada, and Lake Mead.9 The helicopter impacted the terrain in a nose-low attitude on an approximate north-easterly heading. The cockpit area and predominate helicopter structure were found in the immediate wreckage area. A large amount of the structure forward of the horizontal stabilizer was consumed by postimpact fire. See figure 2 for a photograph of the main helicopter wreckage.

9 Because access to the accident site was moderately difficult, the National Park Service helped NTSB investigators reach the accident site. Following the accident, Sundance Helicopters slightly altered some of its air tour flight routes to provide quicker access to relatively flat terrain in the event of an unscheduled landing.

NTSB Aircraft Accident Report 3

Figure 2. Photograph of the main helicopter wreckage. 1.2 Personnel Information 1.2.1 The Pilot The pilot, age 31, was hired by Sundance Helicopters on June 8, 2009. He held a commercial pilot certificate, issued March 23, 2007, with rotorcraft-helicopter and instrument ratings. He also held a flight instructor certificate with a rotorcraft-helicopter rating and a ground instructor certificate. The pilot held a second-class FAA medical certificate, issued June 1, 2011, with no limitations. According to Sundance and pilot records and interviews with his wife and father, the pilot had never been involved in any previous accidents, and he had never been subject to disciplinary action at work. According to Sundance Helicopters and pilot records, the pilot had accumulated 3,174 total flight hours, including 1,360.6 hours as pilot-in-command in AS350 helicopters. He had flown 128.2, 36, and 4.4 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident flight. Sundance records indicated that the pilot was certificated in accordance with federal regulations and current and qualified in accordance with Sundance’s training requirements, which included special training in helicopter air tour flights in the vicinity of Las Vegas and the Grand Canyon. The pilot was off duty on December 4 and 5, 2011. On December 6 (the day before the accident), the pilot was on duty from 0700 to 1715, during which time he logged 4.4 hours of flight time. On the day of the accident, he arrived on duty about 1230 and planned to log off duty

NTSB Aircraft Accident Report 4 about 1715. About 1330, he flew a tour to the Grand Canyon in the accident helicopter, accumulating 1.4 hours of flight time. During the accident flight, he accumulated 0.3 hour of flight time. His wife described the pilot’s activities during the 3 days preceding the accident as routine, and she stated that he had closely approximated his typical schedule of going to bed about 2200 and waking up about 0645 during this period. During postaccident interviews, the six passengers who had flown with the accident pilot on the previous tour stated that the pilot was in a good mood, happy, and chatty during the trip. They added that at no time did he make any of them feel unsafe, that he seemed capable and appeared to have very good control over the helicopter, and that they never sensed any mishandling or “misbehaving” of the helicopter during the flight. They indicated that they were flown on a predetermined route. Sundance Helicopters tracks its flights using a satellite-based tracking system called “Spidertracks.”10 A review of the Spidertracks data of the air tour routes flown by the pilot in the 2 weeks before the accident indicated that he consistently flew the prescribed routes with no deviations from company operating procedures. A review of the accident flight’s Spidertracks data showed the helicopter being flown on the Twilight tour route as usual until the sudden altitude and heading deviations occurred. A search of FAA records revealed no accident or incident history or enforcement actions regarding the pilot. The FAA’s Civil Aerospace Medical Institute in Oklahoma City, Oklahoma, performed forensic toxicology on specimens from the pilot. The toxicology report indicated that no ethanol, carbon monoxide, cyanide, or drugs were detected in the tested specimens. The National Transportation Safety Board’s (NTSB) review of company records, preaccident activities, and medical histories revealed no evidence of fatigue or of any medical or behavioral conditions that might have adversely affected the pilot’s performance during the accident flight. 1.2.2 Maintenance Personnel Four mechanics who typically worked together completed maintenance on the helicopter the day before the accident. Of these four mechanics, one replaced the fore/aft servo, one replaced the tail rotor, one replaced the engine, and one conducted a quality control (QC) inspection of the maintenance after it was completed. See section 2.3.1 for more information about this inspection. In addition, a check pilot, who conducted a postmaintenance flight check and a tour flight on the morning of the accident, performed a Before First Flight (BFF) check (an external inspection of the helicopter). See section 2.3.2 for more information about this inspection. This section focuses on the actions of the mechanic who installed the fore/aft servo, the inspector, and the check pilot.

10 The flight tracks are viewed on http://spidertracks.com by Sundance-authorized personnel and are used by Sundance management and safety personnel to ensure the consistency and quality of the tour flights. The reporting rate is either 8 minutes or 20 kilometers, whichever is most frequent.

NTSB Aircraft Accident Report 5 1.2.2.1 The Mechanic The mechanic holds an airframe and powerplant (A&P) mechanic certificate, which he received in December 2008. In June 2011 (6 months before the accident), he was hired by Sundance Helicopters without any previous helicopter maintenance work experience. Before working at Sundance, the mechanic had 1 year of experience maintaining various general aviation airplanes and 1 year of experience maintaining business jets. The mechanic’s training at Sundance Helicopters included indoctrination training, during which he learned records and maintenance procedures and how to read the Eurocopter manuals, and on-the-job training from other Sundance maintenance personnel. He had not attended any helicopter-specific training at the time of the accident. The mechanic estimated that in his 6 months at Sundance, he had completed about six fore/aft servo installations before installing the fore/aft servo on the accident helicopter. The mechanic was normally scheduled to work 4 days of 11-hour shifts followed by 3 days off duty and then 3 days of 12-hour shifts followed by 4 days off duty. He stated that he typically reported to work about 1200. He added that he normally went to bed about 0200 and awoke about 1030 and that he maintained approximately the same rest schedule on his days off for consistency. The mechanic was scheduled to be off duty December 4, 5, and 6, 2011. On December 4, he awoke between 1200 and 1400. He went to bed between 0000 and 0200 on December 5. On the afternoon of December 5, he was contacted to report to work on December 6. He stated that, therefore, he went to bed about 2200 instead of his normal 0200. He reported that he did not fall asleep until close to 0000, that he awoke about 0500, and that he felt “good” when he awoke. He reported to work about 0550 on December 6 and was assigned the fore/aft servo replacement on the accident helicopter. He stated that he had no difficulty performing the task, that the workload was normal, and that he did not feel rushed. He completed his shift about 1830. See section 3.2.1 for a discussion about the role of the fore/aft servo mechanic’s fatigue in this accident. 1.2.2.2 The Quality Control Inspector The mechanic who inspected the preaccident maintenance was designated as a QC inspector for Sundance Helicopters about 6 months before the accident.11 The inspector holds an A&P mechanic certificate, which he received in February 2002. In November 2010, the inspector was hired by Sundance. Before working at Sundance, he had about 2 years’ experience

11 According to the Sundance General Maintenance Manual, section 4.9.2, “Qualifications,” the QC inspector must hold a mechanic certificate with A&P ratings; have 3 years’ experience within the past 6 years maintaining aircraft as a certified mechanic, including, at the time of appointment, as QC inspector; have experience maintaining the same category and class of aircraft that the certificate holder uses; have 3 years’ experience within the past 6 years repairing aircraft, including 1 year in the capacity of approving aircraft for return to service; be knowledgeable of all company auditing, evaluation, and reporting procedures, the aircraft manufacturer’s maintenance manual, inspection and maintenance specifications, and applicable Federal Aviation Regulations; and have completed required company training. At the time of the accident, the QC inspector was working on obtaining an FAA inspection authorization.

NTSB Aircraft Accident Report 6 maintaining commercial aircraft and about 7 years’ experience maintaining civilian (nonmilitary) helicopters. The inspector was also one of three lead mechanics who directed the maintenance being performed in the hangar when management was not present. A review of Sundance Helicopters records revealed that in June 2011, the QC inspector (acting as a mechanic) failed to properly re-install the chin bubble on one of Sundance’s helicopters.12 A formal root cause analysis of the event conducted by Sundance stated that the inspector’s perception of the need to expedite the repair to avoid aircraft downtime was a contributing factor leading to this failure and that in his attempt to expedite the repair process, he failed to reference the appropriate aircraft maintenance documents that detailed the task of installing the chin bubble. The NTSB randomly selected and reviewed eight maintenance log sheets signed off by the inspector that covered a period of about 4 months before the accident to look for any discrepancies or overlooked items. In addition, the NTSB reviewed all 11 inspections completed by the inspector within the 30 days before the accident for any discrepancies or overlooked items. No instances of discrepancies or overlooked items were identified during the NTSB’s review. The inspector was also on the 4-days-on, 3-days-off and 3-days-on, 4-days-off schedule and typically reported to work about 1200. He stated that he typically went to bed on his days off about 2200 or 2300 but that he woke up every day about 0730 or 0800. The inspector was scheduled to be off duty December 4, 5, and 6, 2011. He went to bed on December 4 about 0000 and awoke about 0800 on December 5. On the afternoon of December 5, he was contacted to report to work on December 6. Therefore, he went to bed about 2100 on December 5. He awoke about 0400 on December 6 and reported to work about 0530. He reported that he did not have trouble sleeping and felt rested. He completed the inspection and ground run of the helicopter about 1800, at the end of a 12-hour shift. See section 3.2.1 for a discussion about the role of the inspector’s fatigue in this accident. 1.2.2.3 The Check Pilot The check pilot holds an A&P mechanic certificate, which he received in 2000. The check pilot was hired by Sundance Helicopters in February 2010 as a line pilot. At the time of the accident, he had accumulated about 2,400 total flight hours, including about 1,500 hours in rotorcraft and about 900 hours in airplanes. He worked for 6 years as a helicopter mechanic on Robinson helicopters before joining Sundance as a pilot. He had conducted about 10 to 12 flight checks at Sundance before the accident.

12 The chin bubble separated during transition from hovering to taxi and the helicopter immediately landed without further incident. The reinstallation of the chin bubble was not required to be inspected.

NTSB Aircraft Accident Report 7 1.3 The Helicopter’s Flight Control System The Eurocopter AS350-B2 helicopter is equipped with a single three-blade main rotor system and a two-blade tail rotor for antitorque and heading control. The helicopter is equipped with a mechanical flight control system assisted by a hydraulic tail rotor servo and three hydraulic servos installed on the main rotor: two lateral servos, which transfer the lateral inputs to the nonrotating swashplate (roll), and one fore/aft servo, which transfers the fore and aft inputs to the nonrotating swashplate (pitch). The system is controlled by pilot-actuated control inputs using the cyclic, collective, and antitorque pedals. The collective and cyclic inputs are transferred to the helicopter’s main rotor system via control rods interconnected by bellcranks and levers. The control linkages are routed beneath the main cabin and aft to the mixing unit. Pilot movements of the collective and cyclic controls are transferred to the mixing unit, which apportions the commands through the appropriate servo control input rod to a servo input rod assembly. Each of the three main rotor servos has three connections: one connection is at the lower end of the servo and is fixed to the main rotor transmission case, another connection is at the upper end of the servo and is secured to the nonrotating swashplate, and the third connection is the servo control input rod that supplies pilot commands to extend or retract the servo. See figure 3 for a schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly. Figure 3. Schematic of the main rotor servo assembly and the fore/aft main rotor servo’s input rod assembly.

NTSB Aircraft Accident Report 8 The servo control input rod is connected to the servo input lever with a bolt, washer, and self-locking castellated (slotted) nut that has a full-circle nylon locking element. The nut is safetied using a split pin (sometimes referred to as a “cotter pin” or “cotter key”), which engages the nut slots and a hole through the bolt threads and prevents the unthreading of the nut. All of the components are made of cadmium-plated steel. In Eurocopter’s certification document, EC 130, “Flight Controls Failure Mode Effects and Criticality Analysis,” Eurocopter indicated that the loss of control of the fore/aft servo would most likely result in a catastrophic failure of the helicopter (a loss of flight control from which a pilot could not recover).13 According to 14 CFR 27.607, any removable fastener whose loss could jeopardize the safe operation of the helicopter must incorporate two separate locking devices. For the Eurocopter AS350-B2 fore/aft servo input rod, the first locking device is the self-locking nut, and the second one is the split pin. In accordance with the Eurocopter Standard Practices Manual, section 1.5.1.2, “JOINING: Assembling by Bolts and Nuts,” the self-locking nut is installed on the bolt and torqued to the minimum specification. The nut is further tightened (up to the maximum specified) until the hole in the bolt threads aligns with a slot on the nut. The split pin is then inserted through the nut and bolt, and the pin’s tangs are bent open 90° or more around the nut. 1.4 Wreckage Information At the accident site, the fore/aft main rotor servo’s control input rod was found disconnected from the input lever, and the connection hardware (bolt, washer, self-locking nut, and split pin) was not found. The fore/aft servo connection hardware also was not found during subsequent comprehensive and detailed examinations of the wreckage and engine.14 (The NTSB notes that the main rotor transmission area of the helicopter is not sealed. Therefore, if the connection hardware separates during flight, it most likely would not be contained.) The control input rods for both of the main rotor lateral servos and the tail rotor servo were found properly connected to their respective servo input levers. The fore/aft servo’s control input rod was found in two pieces: one piece was an approximate 14-inch section of the upper input rod end that was found disconnected from the fore/aft servo input lever, and the other piece was an approximate 3-inch section of the lower end of the input tube that was found correctly attached to its linkage. Examination of the 14-inch section of the upper input rod end revealed no visible elongation of the bolt hole. The separation points on both sections of the input rod were consistent with overload/impact damage.

13 The NTSB notes that the certification document was not issued and not required at the time of AS350 certification but that AS350 and EC130 helicopters have a similar design. 14 During these examinations, smaller pieces were examined by hand, and sifters and a large magnet were used to separate the pieces for better identification. Larger sections of wreckage, including the engine, were examined to determine whether any pieces of the connection hardware might have fallen inside these sections. In addition, approximately 56 pounds of melted metal were sent to the NTSB’s materials laboratory for radiographic (x-ray) inspection.

NTSB Aircraft Accident Report 9 1.5 Company Information At the time of the accident, Sundance Helicopters employed 50 pilots and operated 22 helicopters, including 4 Eurocopter EC130-B4, 1 AS350-BA, and 17 AS350-B2 helicopters. Sundance averaged about 53 tour flights and 90 shuttle flights to Grand Canyon West Airport (GCW)15 daily during the peak season and 35 tour flights and 40 shuttle flights to GCW daily during the off season (when the accident occurred). In 2011, Sundance operated about 31,350 flight hours and transported over 200,000 passengers. In 2010, Sundance operated about 28,029 flight hours and transported over 175,000 passengers. On September 20, 2003, a Sundance Helicopters Eurocopter AS350-BA helicopter was involved in a fatal accident near GCW. The helicopter was being operated on a short shuttle route between GCW and a landing site beside the Colorado River. The route from the airport to the river landing site was via a narrow canyon called Descent Canyon. On the pilot’s 11th flight through Descent Canyon that day, the helicopter hit a near vertical wall and was destroyed by the impact and subsequent fire. The NTSB determined that the probable cause of the accident was, in part, “the pilot’s disregard for safe flying procedures and misjudgment of the helicopter’s proximity to terrain.” The report also stated that Sundance and the FAA conducted inadequate surveillance of air tour operations in Descent Canyon.16 In response to that accident, Sundance Helicopters made many changes to its operations and procedures, including, but not limited to, adopting a zero-tolerance safety policy (any pilot caught operating outside of Sundance policy guidelines is terminated immediately), revising its pilot selection process, hiring a new training captain who rewrote and implemented a new training syllabus with a strong emphasis on thoroughness and safety, and forbidding any type of “thrill flight” and making it well known that any indication of that type of flying would result in immediate termination. Further, in January 2011, Sundance Helicopters implemented a safety management system (SMS), which included adding a director of safety who focuses full time on managing the SMS. 1.5.1 Maintenance Program Information Except for component overhauls, all maintenance performed on Sundance helicopters is conducted at Sundance Helicopters’ maintenance base in Las Vegas. About 60 days before the accident, Sundance moved its maintenance activity to a new hangar, which provides more space, better lighting, and, according to maintenance personnel, an improved work environment.

15 GCW is about 65 nautical miles east of Las Vegas, Nevada. 16 For more information, see Crash of Sundance Helicopters, Inc., Aerospatiale AS350BA, N270SH, Near Grand Canyon West Airport, Arizona, September 20, 2003, Aircraft Accident Brief NTSB/AAB-07/03 (Washington, DC: National Transportation Safety Board, 2007), available online at http://www.ntsb.gov.

NTSB Aircraft Accident Report 10 1.5.1.1 Most Recent Maintenance The most recent maintenance performed on the accident helicopter was completed on December 6, 2011 (the day before the accident) and included a 100-hour inspection17 and the replacement of the tail rotor servo, the engine, and the main rotor fore/aft servo with a new (zero hour) unit. 1.5.1.2 Fore/Aft Servo Installation Procedures The fore/aft servo is located just below the main rotor system, and its installation includes an ice shield that is attached to the top of the servo and that has a cutout for viewing the nut and split pin of the input lever connection when the left main gear box (MGB) cowl is opened for access, as shown in figure 4. The ice shield was installed on the fore/aft servo and is not required to be removed during installation of the fore/aft servo on the helicopter. However, the shield may be removed to provide more clearance around the input rod connection hardware and reinstalled after the servo is installed. Figure 4. Photograph showing the nut and split pin of the fore/aft servo input rod connection hardware visible through the cutout of the ice shield (about eye level for a pilot inspecting the left MGB area).

17 A 100-hour inspection is completed every 100 flight hours and includes a combination of visual, condition, and measurement checks throughout the helicopter, as specified in the 100-hour checklist contained in the Eurocopter Aircraft Maintenance Manual.

NTSB Aircraft Accident Report 11 According to Eurocopter’s Aircraft Maintenance Manual (AMM), chapter 67, “Rotors Control,” subsection 4-1, “Removal/Installation―Main Rotor Servocontrols” (reference number 67-32-00, 4-1), the following procedures should be followed when installing the fore/aft servo:  Connect upper ball end of servocontrol to stationary swashplate o Check that there are spacer bushings o Offer-up servocontrol, actuator downwards, install pin,[18] washers, and nut o Torque the nut o Safety nut with cotter pin  Connect lower ball end of servocontrol to MGB flared housing o Install pin, washer, and nut o Torque the nut o Safety nut with cotter pin  Connect input rod to servocontrol distributor o Install pin, washer, and nut o Torque the nut o Safety nut with cotter pin During postaccident interviews, Sundance Helicopters’ mechanics described the fore/aft servo installation area as accessible, and no difficulties were noted related to the normal fore/aft servo installation procedures. The mechanic stated that during the replacement of the fore/aft servo, he replaced the servo’s upper rod end, reassembled it, and torqued and safetied everything, including securing the input rod connection with a split pin. (However, as noted previously, no split pin was found in the wreckage.) He stated that he then connected the hydraulic lines and retorqued all of the rod ends back to the flight controls. The mechanic estimated that he had performed this process six times before the installation of the fore/aft servo on the accident helicopter and stated that he did not encounter any difficulties during the installation on the day of the accident. He stated that although he normally removes the ice shield, he could not recall whether he removed it during the fore/aft servo installation. 1.6 Self-Locking Nut Reuse Guidance The Eurocopter Standard Practices Manual provides guidance regarding the reuse of hardware on its helicopters.19 Specifically, regarding the reuse of nuts, section 1.4.2, “Criteria for Re-Using Dual Locking Nuts,” states the following: Prior to re-using the nuts:  Make sure nylon lock is not excessively damaged.

18 In the AMM, in each case, the statement “install pin” means to install the bolt. 19 Other helicopter manufacturers also have guidance regarding the reuse of nuts. Bell Helicopter guidance on its light helicopters notes that “if measured tare torque value is less than the minimum listed, the lock nut must be replaced.” Sikorsky Aircraft Corporation provides similar guidance regarding torque values and replacement of reused self-locking nuts on its light helicopters.

NTSB Aircraft Accident Report 12  Fit the nut by hand: o If nut can easily be tightened, it is to be discarded o If nut is hard and cannot be tightened by hand, it may be reused (In a workshop, the minimum locking torque value can be read using a torque wrench). The manual provides a chart indicating that if the self-locking nut can be hand tightened, it is not to be reused. Eurocopter does not require that the nut be replaced when the bolt is replaced, unless the nut does not meet the torque limits. In addition, Advisory Circular (AC) 43.13-1B, “Acceptable Methods, Techniques, and Practices―Aircraft Inspection and Repair,” section 7-64, “Self-Locking Nuts,” states, “After the nut has been tightened, make sure the bolt or stud has at least one thread showing past the nut. DO NOT reuse a fiber or nylon lock nut if the nut cannot meet the minimum prevailing torque values.”20 During postaccident interviews, the mechanic indicated that when determining whether a nut can be reused, he removes it, cleans it, and then inspects it for any cracks, damage, or discoloration. The mechanic indicated that he then threads the nut on the bolt to see if it will thread all the way down, and if he is able to turn the nut down to where the shank is visible, he replaces the nut. In the case of the accident helicopter, he deemed the hardware airworthy. When asked when or if hardware could be reused, the inspector responded that the Eurocopter Standard Practices Manual provides guidance on when the hardware can be reused. He reported that based on his personal experience, if the nut can be threaded all the way on by hand, it cannot be reused because it has lost its entire locking feature. In 2009, Sundance Helicopters began requiring written requests for controlled hardware,21 such as the bolt and nut used for the fore/aft servo connection. Before 2009, Sundance did not require such documentation (nor is this documentation required by the FAA). A review of Sundance maintenance records for the accident helicopter dating back to July 9, 2001, revealed no record of the fore/aft servo connection hardware having been requested. However, the NTSB notes that before the implementation of hardware tracking, the hardware could have been replaced but not documented. Therefore, at the time of the accident, Sundance required mechanics to complete a parts form to request new hardware. However, no such form was completed, and the mechanic indicated that the hardware was reused. If the form had been completed, it would have been included in the maintenance records as documentation that new hardware had been used. The NTSB notes that following the accident, Sundance Helicopters issued a Quality Alert Notice, which stated that an initial replacement of the connection hardware, including the bolt, washer, and self-locking nut, was to be accomplished at the next scheduled inspection for each

20 The “prevailing torque value” is the torque required to overcome the self-locking feature of the nut. Eurocopter guidance and AC 43.13-1B start listing minimum prevailing torque values for reused self-locking nuts with a thread size larger than the thread size of the accident nuts. 21 According to Sundance Helicopters, controlled hardware is hardware specific to the maintenance being performed and is inventoried by the logistics department. Uncontrolled hardware does not require a written request and is readily available to maintenance personnel.

NTSB Aircraft Accident Report 13 helicopter with over 5,000 flight hours and that replacement of the hardware was to be accomplished at each 5,000 flight hours thereafter. Further, the alert notice stated that any time an input rod is disconnected from any of the servos, the nut must be replaced with a new nut. 1.7 Federal Aviation Administration Oversight Sundance Helicopters’ operating certificate is managed by the FAA Las Vegas Flight Standards District Office (FSDO). At the time of the accident, the principal operations inspector (POI) was responsible for six Part 135, one Part 141, one Part 137, and two Part 133 operators. The POI did not have an assistant POI assigned, but he stated that he did not think that this impacted his effectiveness. He characterized Sundance operations personnel as compliant and professional in the conduct of flight operations. He stated in a postaccident interview that he conducted visits often, most of which were unannounced. He further stated that if discrepancies were found, Sundance management cooperatively and proactively corrected the issues and that the company had implemented a viable and functioning SMS program that had helped to identify risk areas. A review of the FAA Program Tracking and Reporting System showed a total of 84 entries related to Sundance in the year before the accident but none were relevant to the accident. In the 3 years before the accident, the FAA’s principal maintenance inspector had changed four times and the principal avionics inspector had changed three times. The Las Vegas FSDO manager reported that no principal maintenance inspector was assigned from April to September 2011 due to a shortage in office staffing but that surveillance was completed by other office inspectors. A review of the maintenance surveillance records showed that three administrative items, one fuel facility inspection, and one followup on a company incident were completed from April to September 2011.

NTSB Aircraft Accident Report 14

1. Investigation and Analysis
2. 1 Scenarios Evaluated to Explain the Loss of Control

The NTSB evaluated the most likely scenarios for why the helicopter experienced a loss of control during the accident flight: (1) jamming or obstructions in any of the servos, (2) hydraulic system failure,22 (3) other system failures (a failure not involving the fore/aft servo connection hardware) that could have resulted in the same flight profile, or (4) the disengagement of the fore/aft servo bolt in flight. As explained below, the most likely scenario is the fourth scenario. The four servos were sent to the Meggitt Control Systems facility in Coventry, United Kingdom, for detailed examination by Meggitt personnel under NTSB supervision. An initial inspection revealed that all four servos were severely damaged by impact forces and, therefore, could not be functionally tested. The four servos were torn down and examined, and the examinations did not reveal any indications of a failure condition (jamming or obstructions in any of the servos) that would have affected the operation of the servo. Further, a review of the helicopter maintenance log revealed no indications of problems on any of the four servos. No evidence was found indicating that a preimpact loss of hydraulic pressure occurred. A loss of hydraulic pressure is indicated to the pilot by a red HYD alert light and an audible tone. If this occurs, the flight controls can be operated manually. In addition, the hydraulic system has an accumulator backup that allows the hydraulics to be used for a period of time to establish as level an attitude as possible and a safe speed.23 According to the Eurocopter Rotorcraft Flight Manual (RFM), “Emergency Procedure: Loss of Hydraulic Pressure,” if a loss of hydraulic pressure occurs, the pilot should keep the aircraft at a more or less level attitude and avoid abrupt maneuvers. The RFM advises the pilot to set the indicated airspeed to within 40 to 60 knots (hydraulic failure safety speed) before turning off the hydraulics via the hydraulic cutoff switch located on the collective. The pilot may then continue flight without hydraulic assistance to land as soon as possible by making an approach over a clear and flat area and a no-hover/run-on landing.24 Therefore, if a loss of hydraulic pressure had occurred, the expected response would be to maintain straight and level flight and to decrease airspeed; however, the radar data showed the helicopter climbing, followed by a sharp left turn. Although the radar data show the helicopter slowing after the left turn, the data are not sufficient to determine if the decrease in groundspeed was the pilot’s response to a loss of hydraulic pressure or as a result of the climb.

22 During the 100-hour inspection, the mechanic removed and reinstalled the hydraulic belt. During the BFF check of the helicopter, the check pilot found that the hydraulic belt was loose. A dayshift mechanic readjusted the hydraulic belt. 23 The accumulator backup consists of a pressurized nitrogen cylinder that provides pressure to the system for about 30 seconds to 3 minutes depending on how aggressively or frequently the pilot manipulates the controls. Once at the specified speed, the pilot reverts to manual control per the emergency checklist. 24 The loss of hydraulic pressure emergency procedure is a basic helicopter training item, and the RFM indicates the pilot should memorize the procedure.

NTSB Aircraft Accident Report 15 Although Eurocopter stated that some other disconnection in the mechanical flight control system could have potentially resulted in the same radar track, no preimpact disconnects were identified in the flight control system during the on-site examination other than the fore/aft main rotor servo control input. Eurocopter also stated that a main rotor servo slide seizure could result in a flight profile similar to the very beginning of the accident sequence but that no such seizure has ever been reported. Further, an emergency procedure exists for such an event that, if properly executed, would allow a pilot to regain full control of the helicopter and land it safely. Due to the lack of detailed information about the flight profile and the load on the servo control (for example, there were no cockpit voice recorder or flight data recorder data and the radar data were limited), the NTSB and Eurocopter could not conduct a performance (flight controls) analysis of the helicopter’s motion during the accident flight. However, Eurocopter stated that the servo input lever is set on a slight retracting position during cruise flight to counteract a tension flight load applied on the front servo control. Therefore, if the disconnection occurred during the cruise phase of flight and taking into account a slight and progressive increasing of tension flight load applied on the front servo control, the climb of the helicopter as shown in the FAA radar data could be expected. Further, as previously noted, the loss of control of the fore/aft servo would result in a loss of flight control from which a pilot could not recover. Microscopic examinations of the fore/aft servo’s attachment area, including the rod end and the clevis area, at the NTSB’s materials laboratory did not reveal any marks indicating that the connection hardware was present at the time of impact. However, evidence, including resolidified aluminum found covering one of the two input rod attachment holes in the fore/aft servo clevis area and resolidified plastic found covering the pilot control input rod end, indicates that the connection hardware was not securing the control input rod to the input lever at the time of the postimpact fire. Regardless, the bolt was present and the control input rod was attached to the fore/aft servo’s input lever at the beginning of the accident flight because proper functioning of the control input rod is necessary for takeoff. Therefore, the NTSB concludes that the bolt connecting the control input rod to the fore/aft servo’s input lever must have been present at the start of the flight to allow normal flight up until the time of the catastrophic upset, but it was not present immediately before the impact and postimpact fire. Further, based on the evidence, the NTSB concludes that the most likely explanation for the in-flight loss of control is that the fore/aft servo bolt disengaged in flight, which resulted in the separation of the control input rod to the fore/aft servo’s input lever, rendering the helicopter uncontrollable. 2.2 Probable Bolt Loss Scenario The NTSB evaluated the following four scenarios to help determine the likely explanation for how the connection hardware became disengaged in flight: (1) the bolt was sheared by in-flight or impact forces; (2) the bolt fractured for other reasons, such as fatigue or embrittlement; (3) the self-locking nut became separated from the bolt, allowing the bolt to work its way out of the joint due to normal in-flight vibratory forces; or (4) the self-locking nut and split pin were not installed during the servo installation. As explained below, the most likely

NTSB Aircraft Accident Report 16 scenario is the third scenario. The other three scenarios were not supported by the evidence. For detailed information about all four scenarios evaluated by the NTSB, see the appendix. In the high-vibration environment of helicopter operation, a degraded self-locking nut could become loose and unthread by vibration until it falls off the bolt. As noted, in accordance with 14 CFR 27.607, the nut has two separate locking devices (the self-locking nut and split pin) to prevent this. In a March 7, 2012, letter to the NTSB, Eurocopter stated that if there were no split pin behind an airworthy self-locking nut and the nut was correctly torqued, the nut should not loosen and unthread. Following the accident, Sundance Helicopters’ mechanics inspected all of the company’s Eurocopter AS350 helicopters to ensure that the fore/aft servo hardware was connected and safetied properly. All of the fore/aft servos were found properly connected and safetied with split pins. Additionally, the connection hardware for each of the three main rotor servos on all company helicopters that had 5,000 or more total flight hours was removed and examined. About half of the self-locking nuts from the 13 helicopters examined by the time of the NTSB’s visit to the Sundance facility on January 11, 2012,25 were determined to have no locking capability, and about half of the bolts had wear markings on the shanks.26 Examinations of the bolts could not determine where the markings on the bolt shanks originated. Sundance Helicopters provided the NTSB with self-locking nuts from two of the examined helicopters (N340SH and N351WM) that could be easily and fully tightened or loosened on the accompanying bolts with finger pressure. This indicates that the nuts from the two helicopters were not suitable for reuse because new nuts restrict movement by hand after two to three turns. In addition, torque measurements found that the turning resistance of the nuts on the bolts was about 1 in-lbf (inch pound force) or less in both directions. Figure 5 shows the nuts, upper input rod bolts, and washers removed from N340SH and N351WM next to a new bolt and nuts.

25 The NTSB visited Sundance’s facility to conduct interviews, examine maintenance records, and review maintenance procedures. 26 Of the additional helicopters examined after the NTSB’s visit, Sundance Helicopters reported that the bolts were deemed airworthy but that the nuts were not checked; however, all of the nuts and bolts on all of its helicopters’ fore/aft servos have since been replaced.

NTSB Aircraft Accident Report 17 Figure 5. Photograph showing the nuts, upper input rod bolts, and washers removed from N340SH and N351WM next to a new bolt and nuts. On the basis of this evidence, the NTSB concludes that at the time of the accident, Sundance Helicopters was not following Eurocopter and FAA self-locking nut reuse guidance, which led to the repeated improper reuse of degraded nuts on its helicopters. The NTSB repeatedly measured the peak tightening (on) and loosening (off) torque on four new test self-locking nuts to compare locking torque. Measurements were made by fixing a calibrated27 dial-indicating torque wrench in a fixture and tightening and loosening the new nut-bolt combination while recording the peak torque. The nuts were tightened until all bolt threads were engaged by the test nut. The nuts were loosened until the locking portions of the nuts disengaged. The tightening-loosening (on-off) cycle was repeated at least 10 times for the four test nuts. The first application of the nut resulted in the highest resistance torque (4.0 to 4.5 in-lbf) with generally lower torque values with successive on-off cycles. After 10 cycles, the average torque values dropped by almost half.

27 Calibration was performed by testing the torque wrench with a known weight suspended at a measured distance and comparing the dial indication to the calculated value.

NTSB Aircraft Accident Report 18 If the split pin was installed improperly or not at all, no backup mechanism for a self-locking nut with degraded locking ability was in place to secure the input rod to the fore/aft servo. Eurocopter stated that even if the bolt and nut were improperly torqued or the nut was degraded, the split pin should have prevented the loss of the nut. With the pin installed properly, the self-locking nut can only be removed with very high torque shearing of the pin; however, it is highly improbable that this occurred because the magnitude and direction of the forces needed to shear the pin are not present during controlled operation or normal vibrational loading. However, if the split pin is installed without properly spreading the tangs, the pin can fall out with little effort. Eurocopter stated that this scenario would result in a loss of an improperly torqued or degraded nut after a “short period of time.” In summary, for the bolt to have been able to work its way out of the joint, the following must have occurred:  The nut-tightening torque must have been overcome.  The running resistance of the nylon locking feature must have been overcome.  The split pin must have been missing. The NTSB concludes that the fore/aft servo bolt most likely disengaged because the split pin was installed improperly or it was not installed and a self-locking nut that was either degraded or not torqued was used when the fore/aft servo was replaced. This allowed the nut to unthread and separate from the bolt. 2.3 Postmaintenance Inspections 2.3.1 Quality Control Inspections Sundance Helicopters General Maintenance Manual (GMM)28 requires independent inspections of specific maintenance actions by designated company QC inspectors. Specifically, the Sundance GMM, section 7.3, “Quality Control Inspection System,” states the following:

1. The following maintenance procedures require a company assigned inspector

to sign, initial or stamp to approve for return to service; a. All maintenance functions requiring a safety. (safety wire, split pin etc.) b. Prior to installation of cowlings or panels that would cover a safety or work procedure. c. Any maintenance procedure involving a flight control or drive train assembly. d. Reassembly of a component. e. Installation of engines, main gearbox or tail rotor gearbox.

28 Sundance Helicopters was not required to have a GMM because only Part 121 and Part 135 operations that operate aircraft with 10 or more seats are required to have GMMs. However, the company voluntarily implemented a GMM to standardize its maintenance processes and procedures and to supplement its operations specifications.

NTSB Aircraft Accident Report 19 f. Installation of all fuel lines, hydraulic lines and oil lines. (Rigid or Flexible).

1. The assigned QC inspector will review all work packages for completeness to

include insuring there are no open blocks. After review the inspector will sign, initial or stamp the cover sheet as indicated.

1. The assigned QC inspector will review all serviceability tags to ensure correct

information and will sign, initial or stamp the component serial number verification block. Nine Sundance maintenance personnel are certified to perform company-required QC inspections. As noted, after the maintenance tasks were completed on the accident helicopter, a QC inspector inspected the work. During postaccident interviews, the inspector stated that the specific items that needed to be inspected were “anything that requires a safety or a split pin, all pipes and lines.” He was unable to think of any other inspection items. He indicated that when he inspects items, he physically touches things and looks everything over. The inspector reported that when he inspects a fore/aft servo installation, he looks “for the two safeties on both the rod ends, the two split pins on the mount hardware, and the safety holding the two bolts that hold the accumulator assembly to the servo.” He specifically stated that he inspected the fore/aft servo input rod, hardware, and split pin and marked them with a torque pen29 and that he inspected the hydraulic lines that connect to the manifold. He reported that the items to be inspected are easy to access and are not blocked by other components. The inspector stated that he did not find any problems during the inspections. Despite these statements, as discussed previously, the evidence indicates that the split pin was installed improperly or was not present. The inspector estimated that it took about 40 to 45 minutes to complete the postmaintenance ground run and checks with the mechanic’s assistance. During the ground run, the mechanic, in part, ensured that there were no leaks and checked the servos to ensure that they were not binding. No problems were identified. The inspector stated that the ground run was completed about 1800. He then completed the paperwork, which readied the helicopter for the maintenance operational check flight the following morning. 2.3.2 External Check Procedures As part of its normal daily operations, Sundance Helicopters conducts external checks of its operating helicopters in accordance with the Eurocopter AS350-B2 RFM. According to the RFM, daily checks must be conducted in accordance with standard helicopter practices and the

29 During QC inspector recurrent training, inspectors are instructed to mark all safeties and line installations with a torque pen, and each inspector is designated a specific color. However, due to fire damage, no torque pen evidence could be found on the helicopter wreckage.

NTSB Aircraft Accident Report 20 appropriate manufacturer’s recommendations by qualified maintenance personnel or a specially trained pilot. These checks include, but are not limited to, the following:  A BFF check, which is the preflight check pilots are expected to complete before the first flight of each day. Additionally, Sundance Helicopters had expanded Eurocopter’s External Checks checklist (Sundance Helicopters AS350B2 Flight Manual Expanded External Checks Checklist, dated February 9, 2011) to include additional items, such as requiring pilots to open all cowlings and visually inspect the MGB and engine areas, to enhance safety. If a helicopter has undergone any maintenance activity, pilots are required to visually inspect any serviced components.  A turn-around check, which is used for checks between flights on the same day. The turn-around check consists of checking the vital fluids, rapidly inspecting the main and tail rotor blades, securing all cargo, and properly latching all doors and cowlings. Before conducting a check flight, a check pilot conducts a BFF check and, if any discrepancies are noted, coordinates with maintenance to take corrective action. After completing the check flight, the pilot records the check in the helicopter logbook. As noted, a Sundance check pilot conducted a postmaintenance check flight in the accident helicopter on the morning of the accident. Before the check flight, he conducted a BFF check, and after the check flight, he performed another BFF-type check.30 The left MGB cowl was not opened, nor was it required to be, during the turn-around checks between each flight throughout the remainder of the day. During postaccident interviews, the check pilot stated several times that he saw nothing in the left MGB cowl area during his preflight inspection that indicated that the helicopter was not in a condition to fly. He stated that if he thought that a split pin or anything was not installed as he would expect it to be, he would immediately stop the preflight inspection and consult maintenance personnel. However, as stated previously, the split pin either was installed improperly or not present, and the check pilot did not note any discrepancy in this area. The NTSB concludes that the mechanic, inspector, and check pilot each had at least one opportunity to observe the fore/aft servo self-locking nut and split pin; however, they did not note that the split pin was installed improperly or not present. 2.4 Misinterpretation of TOPS Audit Requirements Sundance Helicopters is a member of the voluntary Tour Operators Program of Safety (TOPS). The TOPS program outlines management requirements, pilot qualifications and training, maintenance practices, support personnel training, and minimum equipment for aircraft and requires members to “establish and enforce standards to ensure that safety is the primary consideration for all air tour operations.” TOPS requirements go beyond the current requirements

30 The check pilot opened the MGB cowl area after the maintenance operational check even though it was not required.

NTSB Aircraft Accident Report 21 applicable to most air tour operations because nearly all helicopters used for air tour operations have 10 or fewer seats, which exempts them from a substantial portion of the Part 135 maintenance program requirements.31 Under the TOPS program, members agree to annual independent safety audits, which are conducted by independent evaluators who are paid by TOPS through members’ annual fees. In July 2011, TOPS conducted an audit of Sundance Helicopters. The audit indicated that Sundance met the TOPS standards, including one specifying that maintenance personnel should have 3 years of experience maintaining helicopters or have undergone helicopter manufacturer training before being employed with a TOPS operator. However, the investigation revealed that the mechanic and two additional mechanics employed at Sundance during the audit did not meet the TOPS standard for experience or training. According to the TOPS auditor who performed the Sundance Helicopters audit, when an audit is performed, the operator makes all employee records and training histories available to the auditor. He stated that about 25 percent of the records are audited. In initial interviews, TOPS personnel indicated that auditors are trained to evaluate all pilot and maintenance personnel employment records and training histories, not just a percentage of those records. In later conversations, TOPS personnel indicated that they initially misspoke and that auditing a sampling of the records was an approved procedure. The specifics of TOPS’ auditing procedures were not defined in the TOPS guidance at the time of the Sundance audit. On June 12, 2012, the Sundance Helicopters director of maintenance indicated in an e-mail that the company’s understanding of the TOPS requirements was that the operator must meet the experience and factory training requirements “collectively,” rather than its staff members having to individually meet the requirements. Additionally, he reported that the maintenance department had undergone yearly TOPS audits with no issues identified. The NTSB concludes that Sundance Helicopters did not meet the TOPS audit requirements because Sundance’s director of maintenance misinterpreted the TOPS maintenance standards regarding training and qualifications of mechanics. NTSB staff discussed these findings with TOPS personnel in May 2012. In response, TOPS formed an auditing committee, including auditors with more extensive maintenance backgrounds, to evaluate its auditing processes. At its October 2012 board meeting, TOPS discussed the issue regarding the misinterpretation of the mechanics’ experience requirement with its members and auditors and the auditing committee’s findings. TOPS has formalized its audit sampling procedures for maintenance and flight personnel in its 2013 audit program, incorporated this information into its annual auditor training and orientation, and revised its audit-related checklists. In addition, TOPS indicated that it will distribute any additional pertinent information about its auditing procedures to its members at the Helicopter Association International’s annual conference, Heli-Expo, in Las Vegas, Nevada, in March 2013.

31 According to 14 CFR 135.1, for many air tour operations conducted as nonstop sightseeing flights, only Part 91 maintenance regulations are applicable. Further, many maintenance requirements exist in Part 135 that apply only to helicopters with 10 or more seats.

NTSB Aircraft Accident Report 22 The NTSB notes that on June 12, 2008, as a result of its investigation of the March 8, 2007, accident involving a Eurocopter AS350-BA operated by Heli-USA Airways, Inc., as an air tour flight, which crashed into terrain following a loss of control while landing at Princeville Airport, Princeville, Hawaii,32 the NTSB issued Safety Recommendations A-08-36 through -38, asking TOPS to do the following. Coordinate with Tour Operators Program of Safety members to set requirements for establishing and maintaining a system for continuously analyzing the performance and effectiveness of their inspection and maintenance programs to ensure that all maintenance is performed with the utmost regard for quality and safety. (A-08-36) Expand the Tour Operators Program of Safety’s safety audit program to ensure that operators implement an effective maintenance quality assurance program. (A-08-37) Work with the Federal Aviation Administration to establish appropriate guidance for Tour Operators Program of Safety members on how to develop and implement appropriate inspection and maintenance quality assurance programs.33 In response to Safety Recommendations A-08-36 through -38, TOPS updated its annual audit. The NTSB expressed concern that the updated audit only checks that a maintenance quality assurance program is in place but that it does not include standards to properly assess the effectiveness of the program. Currently, TOPS is working with the FAA to develop special emphasis areas so that both members and auditors can determine the effectiveness of a maintenance quality assurance program and to draft an AC that will include best practices for air tour operators and information on accreditation programs available to commercial air tour operators. As a result of these actions, the NTSB stated that Safety Recommendations A-08-36 through -38 remained classified “Open―Acceptable Response” on July 12, 2012.

32 More information about this accident, NTSB case number NYC07MA073, is available online at http://www.ntsb.gov/aviationquery/index.aspx. 33 As a companion to Safety Recommendation A-08-38, the NTSB also issued Safety Recommendation A-08-35, which asked the FAA to “work with independent safety programs, such as the Tour Operators Program of Safety, to establish appropriate guidance for their members on how to develop and implement appropriate inspection and maintenance quality assurance programs and to encourage operators to participate in these voluntary programs.” On November 6, 2012, the NTSB classified Safety Recommendation A-08-35 “Open―Acceptable Response” pending review of a proposed AC that will include best practices for air tour operators and information on accreditation programs available to commercial air tour operators.

NTSB Aircraft Accident Report 23

1. Safety Issues
2. 1 Improper Reuse of Degraded Self-Locking Nuts

As discussed in section 2.2, NTSB nut torque measurements showed that reusing self-locking nuts leads to a decrease in their locking capability (prevailing torque value). This investigation demonstrated that if a self-locking nut with a degraded locking ability is used and if the split pin is installed improperly or not at all, no backup mechanism is in place to secure the input rod to the fore/aft servo. Another recent aircraft accident was found to be related to self-locking nuts coming loose, demonstrating that the reuse of nuts with a degraded locking ability affects airplanes as well as rotorcraft. On September 16, 2011, an accident occurred involving an experimental, single-seat North American P-51D at Reno/Stead Airport, Reno, Nevada.34 The investigation determined that deteriorated self-locking nuts (the nuts’ insert material was badly deteriorated to the extent that screw-retaining torque could not be maintained) resulted in loose tab attachment screws and fatigue cracking in one screw, which allowed for undesirable movement of the trim tabs and a reduction of stiffness in the elevator (pitch) trim control system. Based on the condition of the nut inserts, the screws likely needed to be tightened several times over the course of the airplane’s recent racing career, providing the ground crew with an indication of a recurrent problem and opportunities to identify and replace the deteriorated hardware. The NTSB determined that the probable cause of this accident was, in part, “the reduced stiffness of the elevator trim tab system that allowed aerodynamic flutter to occur at racing speeds. The reduced stiffness was a result of deteriorated locknut inserts that allowed the trim tab attachment screws to become loose and to initiate fatigue cracking in one screw sometime before the accident flight.” Despite manufacturer and FAA guidance that clearly states that if a self-locking nut does not meet the prevailing minimum torque value, it is not to be reused, these accidents indicate that maintenance personnel are not properly following the provided guidance and are reusing self-locking nuts that do not meet the minimum prevailing torque value. Reinforcing the importance of following manufacturer and FAA nut reuse guidance would help ensure that degraded self-locking nuts are not being reused improperly. The NTSB concludes that because a self-locking nut’s locking ability degrades with use, it is critical that maintenance personnel follow manufacturer and FAA self-locking nut reuse guidance to prevent the improper reuse of degraded nuts. The NTSB believes that this finding indicates that information about the safety hazards associated with improperly reusing degraded self-locking nuts needs to be shared throughout the aviation community and that maintenance inspectors need to be reminded about proper self-locking nut reuse procedures to prevent the improper reuse of degraded nuts. In response to

34 For more information, see Pilot/Race 177, The Galloping Ghost, North American P-51D, N79111, Reno, Nevada, September 16, 2011, Aircraft Accident Brief NTSB/AAB-12/01 (Washington, DC: National Transportation Safety Board, 2012), available online at http://www.ntsb.gov.

NTSB Aircraft Accident Report 24 the NTSB’s concerns on this matter, the FAA Safety Team (FAAST) published a general aviation maintenance alert on its website at http://faasafety.gov in November 2012 and distributed the alert to over 239,000 mechanics and pilots via its e-mail registry. The NTSB provided accident case study data related to maintenance errors to FAAST for inclusion in its inspection authorization (IA) renewal training. This information will be included in IA renewal training clinics throughout the United States in 2013.35 In addition, the FAA will publish an Aviation Maintenance Alert36 (Advisory Circular 43-16A) in early 2013 related to helicopter maintenance issues. 3.2 Maintenance Human Factors The NTSB evaluated the human factors issues that could have affected the performance of the maintenance personnel. During the investigation, the NTSB determined that the maintenance personnel were not under any time pressure to complete the required work on the day of the 100-hour maintenance inspection, nor were any issues identified with the environment of the hangar, such as lighting or temperature, that would have adversely affected performance. To rule out systemic occurrence of maintenance errors by the maintenance personnel involved in this accident, the NTSB conducted a review of Sundance Helicopters records. As stated in section 1.2.2.2, the review showed that in June 2011, the QC inspector (acting as a mechanic) failed to properly re-install the chin bubble on one of Sundance’s helicopters, and Sundance determined that his perception of the need to expedite the repair to avoid aircraft downtime was a contributing factor leading to this failure. To evaluate whether this event was representative of the QC inspector’s work, the NTSB randomly selected and reviewed eight maintenance log sheets signed off by the inspector that covered a period of about 4 months before the accident and reviewed all 11 inspections completed by the inspector within the 30 days before the accident. No instances of discrepancies or overlooked items were identified during the NTSB’s review. Further, there were no recorded issues or problems for the mechanic and no reports from his managers of any previous problems. This section discusses the following safety issues associated with maintenance human factors that affected the maintenance personnel: the role of human fatigue, the need for improved maintenance documentation (work cards with delineated steps), and the lack of human factors training for maintenance personnel.

35 An IA held by an aviation mechanic expires every odd-numbered year on March 31. IA holders also must meet the yearly training requirements of 14 CFR 65.93. To meet these training requirements, mechanics with an IA can attend a refresher course provided by FAA FSDOs or outside vendors. The refresher courses provide information directly related to aircraft maintenance, inspection, repairs, and alterations, as well as some nontechnical subjects. 36 Aviation Maintenance Alerts are published monthly and provide the aviation community with an economical means to exchange service experiences and to assist the FAA in improving aeronautical product durability, reliability, and safety.

NTSB Aircraft Accident Report 25 3.2.1 Maintenance Personnel Fatigue Because the maintenance errors in this accident largely center on the mechanic and the QC inspector, the NTSB evaluated the role of fatigue for these individuals. As discussed previously, on December 5, both the mechanic and the inspector were contacted to report to work on an off-duty day (December 6) to perform the 100-hour inspection, which was maintenance work that needed to be conducted in addition to the work being conducted by the regularly scheduled maintenance crew. Sundance Helicopters’ director of maintenance explained that it was not unusual for the company to contact maintenance personnel on their off-duty days to schedule helicopter maintenance. The following table shows the mechanic’s and inspector’s normally scheduled shift, the shift they were originally scheduled for on December 6, and the actual shifts they worked. Table. The mechanic’s and inspector’s normal shift schedules, the shift they were originally scheduled for on December 6, and actual shifts they worked. Personnel Normal Shift Shift Originally Scheduled for December 6 Actual December 6 Shift Mechanic 1200 to 2300 Off duty 0550 to 1846 Inspector 1200 to 2300 Off duty 0531 to 1855 The mechanic reported that he normally went to bed about 0200 and awoke between 1000 and 1200, obtaining at least 8 hours of sleep regularly. He stated that the night before the 100-hour inspection, he went to bed about 2200; however, he had difficulty falling asleep until about 0000. He awoke on December 6 about 0500. Therefore, the reported evidence indicates that the mechanic slept for about 5 hours the night before the maintenance was conducted,37 and he had slept a total of about 21 hours in the 72 hours before the maintenance was conducted. His bedtime was not consistent, and his sleep time fluctuated in length during this period. Further, his work shift on the day of the maintenance began about 6 hours earlier than his regularly scheduled shifts. This evidence suggests that the mechanic did not have an adequate amount of sleep on the night preceding the maintenance38 and that he did not have sufficient time to adjust to a shift change for an early morning shift instead of his regular 1200 shift.39 The QC inspector reported that he normally went to bed about 2200 or 2300 and awoke about 0730 or 0800 every day, obtaining at least 8.5 hours of sleep. Therefore, the reported evidence indicates that the QC inspector slept for about 7 hours the night before the maintenance

37 Evidence exists showing that a 2-hour sleep debt can produce performance decrements comparable to those produced by a blood alcohol level of 0.045 percent and that a 4-hour sleep debt can produce performance decrements comparable to a blood alcohol level of 0.095 percent. For more information, see T. Roehrs, E. Burduvali, A. Bonahoom, et al., “Ethanol and Sleep Loss: A ‘Dose’ Comparison of Impairing Effects,” Sleep 26, no. 8 (2003): 981-985. 38 For more information, see N. Goel, H. Rao, J. Durmer, and D. Dinges, “Neurocognitive Consequences of Sleep Deprivation,” Seminars in Neurology 29, no. 4 (2009). 39 For more information, see P.S. Della Rocco and T.E. Nesthus, “Shiftwork and Air Traffic Control: Transitioning Research Results to the Workforce,” in Human Factors Impacts in Air Traffic Management, eds. B. Kirwan, M.D. Rodgers, and D. Schaefer (Burlington, Vermont: Ashgate Publishing Company, 2005).

NTSB Aircraft Accident Report 26 inspection and that he slept a total of about 15 hours in the 48 hours before the maintenance inspection. His work shift on the day of the inspection began about 6 hours earlier than his regularly scheduled shift. Further, he completed the inspection on the accident helicopter when he had been awake for about 14 hours. Research shows that adjusting for changes to an early morning shift (phase advance) takes longer than adjusting from a day shift to a night shift (phase delay).40 Both the mechanic and the inspector would have had to attempt to compensate for this, and inconsistency in work shift has been shown to be a factor associated with the development of fatigue.41 For the mechanic, the change in shift was associated with a limited sleep opportunity as compared to his normal amount of sleep obtained, which would have contributed to the development of fatigue.42 For the inspector, the long duty day would have contributed to the development of fatigue.43 An NTSB safety study found that flight crewmembers who were awake for more than 12 hours made more procedural errors, tactical decision errors, and errors of omission than those awake less than 12 hours.44 These findings can be extrapolated to other areas in which individuals work beyond 12 hours. In addition, an analysis of self-reported maintenance incidents conducted by the Bureau of Air Safety Investigation, Australia, showed that maintenance incidents were more frequent as the shift progressed.45 In accident investigations, factors commonly examined for evidence related to fatigue are cumulative sleep loss, amount of recent sleep, continuous hours of wakefulness, circadian disruption, time of day, time on task, individual variation, and sleep disorders. Scientific research consistently demonstrated that adequate sleep is necessary to sustain performance.46 The effects of fatigue are particularly prevalent when these factors overlap. The evidence in this accident shows that the maintenance crew met at least two of the criteria for susceptibility to the debilitating effects of fatigue. Therefore, the NTSB concludes that, because both the mechanic and the inspector had insufficient time to adjust to working an earlier shift than normal, they were experiencing fatigue during the December 6 shift. In addition, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue.

40 J. Reason and A. Hobbs, “Managing Maintenance Error: A Practical Guide” (Burlington, Vermont: Ashgate Publishing Company, 2003), 32. 41 For more information, see Proceedings from the 83rd Annual Scientific Conference, “Aircrew Fatigue―A Review of Fatigue Risk Management” (Atlanta, Georgia: Aerospace Medical Association, 2012). 42 For more information, see FAA Human Factors Guide for Aviation Maintenance and Inspection (2008), available online at http://www.hf.faa.gov/hfguide/index.html. 43 For more information, see Review of Flightcrew-Involved, Major Accidents of U.S. Air Carriers, 1978 Through 1990, Safety Study NTSB/SS-94/01 (Washington, DC: National Transportation Safety Board, 1994). 44 See NTSB/SS-94/01. 45 For more information, see Human Factors in Airline Maintenance: A Study of Incident Reports, Department of Transport and Regional Development, Bureau of Air Safety Investigation, Australia (1997). 46 Department of Transportation, Federal Aviation Administration, 14 CFR Parts 117, 119, and 121. Docket No: FAA-2009-1093, “Flightcrew Member Duty and Rest Requirements.”

NTSB Aircraft Accident Report 27 3.2.1.1 Effects of Fatigue on Maintenance The evidence indicates that both the mechanic and the inspector were likely experiencing fatigue during the shift in which the maintenance was performed and that they both made errors during their shift. For example, the mechanic did not properly secure the fore/aft servo connection hardware and did not properly install the hydraulic belt,47 and the inspector did not detect that these errors had been made. All of these errors are consistent with the known effects of fatigue. Fatigue can adversely affect performance in various ways that have been demonstrated in scientific research and accident investigations.48 For example, fatigue associated with sleep loss, shift work, and long duty cycles can lead to increased difficulty in sustaining and directing attention, memory errors, and resultant lapses in performance.49 Performance may not be universally degraded, but individuals show increased variability in performance as a result of these lapses. Sleepiness can be differentiated into two components: physiological, which is the result of sleep loss, and subjective, which is an individual’s introspective self-report regarding their level of sleepiness. However, factors such as caffeine or stimulating environments can affect an individual’s subjective rating of sleepiness and mask their level of physiological sleepiness. Therefore, an individual may not be aware of his or her actual level of physiological sleepiness.50 Interruptions are an inherent part of the maintenance environment and fatigue’s effects on attention and memory can lead to interruption-induced omissions if appropriate controls are not in place to ensure steps have been completed.51 In this accident, the specific sequence of events that led to the maintenance errors on the part of the mechanic and the inspector cannot be determined. However, the fundamental characteristic of the errors made is one of omission – that is, a step was not performed or not

47 As part of the 100-hour inspection, the mechanic also removed the hydraulic belt and then reinstalled it. During his initial BFF check, the check pilot noted that the tension on the belt for the hydraulic pump was loose. After a dayshift mechanic checked and retightened the hydraulic belt, the check pilot re-inspected the belt, completed his preflight check, and then proceeded with the check flight. 48 For the scientific research, see G.P. Kruger, “Sustained Work, Fatigue, Sleep Loss, and Performance: A Review of the Issues,” Work and Stress 3 (1989): 129-141; and F.H. Previc and others, “The Effects of Sleep Deprivation on Flight Performance, Instrument Scanning, and Physiological Arousal in Pilots,” The International Journal of Aviation Psychology 19, no. 4 (2009): 326-346. For the accident investigations, see Crash During Attempted Go-Around After Landing, East Coast Jets Flight 81, Hawker Beechcraft Corporation 125-800A, N818MV, Owatonna, Minnesota, July 31, 2008, Aircraft Accident Report NTSB/AAR-11/01 (Washington, DC: National Transportation Safety Board, 2011); and Collision with Trees and Crash Short of Runway, Corporate Airlines Flight 5966, British Aerospace BAE-J3201, N875JX, Kirksville, Missouri, October 19, 2004, Aircraft Accident Report NTSB/AAR-06/01 (Washington, DC: National Transportation Safety Board, 2006), available online at http://www.ntsb.gov. 49 J.A. Caldwell, “Fatigue in the Aviation Environment: An Overview of the Causes and Effects as Well as Recommended Countermeasures,” Aviation, Space, and Environmental Medicine 68 (1997): 932-938. 50 M.R. Rosekind, K.B, Gregory, D.L Miller, E.L. Co, and J.V. Lebacqz, Analysis of Crew Fatigue Factors in AIA Guantanamo Bay Aviation Accident (Washington, DC: National Aeronautics and Space Administration, 1994). 51 The fore/aft servo mechanic assisted the engine mechanic more than once during the engine swap. Although it cannot be determined with certainty at what point throughout his duty day he was assisting the engine mechanic, it is possible that interruptions and distractions were introduced into his work during the fore/aft servo installation. For more information, see A. Chaparro and L.S. Groff, Human Factors Survey of Aviation Maintenance Technical Manuals, 16th Human Factors in Aviation Maintenance Symposium (San Francisco, California: April 2 to 4, 2002).

NTSB Aircraft Accident Report 28 performed properly, whether that step involved installation of the securing hardware (mechanic) or the inspection of the hardware (inspector). Available evidence indicates that both the mechanic and inspector were experiencing fatigue, and the known effects of fatigue can lead to the type of errors that they made. Therefore, the NTSB concludes that both the mechanic’s performance and the inspector’s performance probably were degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively. However, it is important to note that other recognized human factors can also contribute to maintenance errors; accordingly, fatigue cannot singularly explain the maintenance errors related to this accident. 3.2.1.2 Lack of Maintenance Personnel Duty-Time Limitations The NTSB has had longstanding concerns about the effects of fatigue on maintenance personnel. On September 9, 1997, as a result of the May 11, 1996, accident in which a McDonnell Douglas DC-9-32 operated by ValuJet Airlines, Inc., as ValuJet flight 592 crashed into the Everglades swamp shortly after takeoff from Miami International Airport, Miami, Florida,52 the NTSB issued Safety Recommendation A-97-71, which asked the FAA to do the following: Review the issue of personnel fatigue in aviation maintenance; then establish duty time limitations consistent with the current state of scientific knowledge for personnel who perform maintenance on air carrier aircraft. The NTSB notes that on November 17, 1997, in response to Safety Recommendation A-97-71, the FAA stated that its data suggested that night shift and/or mixing of day/night work schedules affect performance more than an extended length of duty time but that no current definitive studies were available to evaluate these parameters as comparative measurements. The FAA stated that it was going to expand its human factors research program to include studies regarding duty length and shift scheduling and that at the conclusion of this research, it would implement appropriate policy or regulatory change. The NTSB notes that in the 15 years since the issuance of Safety Recommendation A-97-71, the FAA has conducted additional research regarding the effects of duty length and shift scheduling as factors contributing to fatigue.53 Fatigue has been linked to a decrease in cognitive performance, including reduced attention (for example, overlooked and/or misplaced sequential task elements, preoccupation with single tasks, and breakdowns in systematic

52 For more information, see In-Flight Fire and Impact With Terrain, Valujet Airlines Flight 592, DC-9-32, N904VJ, Everglades, Near Miami, Florida, May 11, 1996, Aircraft Accident Report NTSB/AAR-97/06 (Washington, DC: National Transportation Safety Board, 1997), available online at http://www.ntsb.gov. 53 For more information, see FAA Fatigue Management Symposium, Partnerships for Solutions (Vienna, Virginia: June17-19, 2008), available online at http://www.faa.gov/about/office_org/headquarters_offices/a vs/offices/afs/afs200/media/aviation_fatigue_symposium/aviation_fatigue_symposium.pdf and C.A. Hackworth, J.O. Banks, K.A. Holcomb, W.B. Johnson, and J.J. Hiles, Aviation Safety Inspector’s (ASIs) Maintenance Human Factors Survey, Memorandum Internal FAA Report, FAA Civil Aerospace Medical Institute (Oklahoma City, Oklahoma: 2007).

NTSB Aircraft Accident Report 29 scanning ability) and diminished memory (for example, inaccurately recalling operational events, forgetting peripheral tasks, and reverting to “old” habits).54 However, the FAA has not taken any regulatory actions in these areas. As a result, on October 7, 2009, the NTSB classified Safety Recommendation A-97-71 “Open―Unacceptable Response” pending the issuance of duty-time requirements. Because the Sundance inspector’s fatigue was caused, in part, by extended duty time, the NTSB continues to believe that establishing duty-time limitations is a key strategy to reducing the risk of fatigue-related errors in aviation maintenance.55 The NTSB notes that an even more robust base of scientific knowledge and industry best practices exists on which to formulate such rules than existed when Safety Recommendation A-97-71 was issued. As a result, the NTSB concludes that sufficient scientific research on fatigue and knowledge of industry practices currently exists from which to establish duty-time limitations for maintenance personnel that would help reduce the risk of fatigue-related errors in aviation maintenance. Therefore, the NTSB recommends that the FAA establish duty-time regulations for maintenance personnel working under 14 CFR Parts 121, 135, 145, and 91 Subpart K that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness. Because of the FAA’s inactivity, the NTSB classifies Safety Recommendation A-97-71 “Closed―Unacceptable Action/Superseded” and classifies Safety Recommendation A-13-01 “Open―Unacceptable Response.” 3.2.2 Need for Work Cards With Delineated Steps It is likely that the maintenance personnel’s performance was also affected by human factors that have been identified through research to affect the reliability of maintenance and inspections. For example, research suggests that even well-trained, experienced mechanics can inadvertently fail to detect a defect. These failures can occur for various reasons, including the inherent challenges associated with conducting systematic visual inspections, complacency

54 For more information, see B. Sian and J. Watson, Study of Fatigue Factors Affecting Human Performance in Aviation Maintenance, chapter 11 (Washington, DC: Federal Aviation Administration, 1999). 55 The need to address deficiencies in flight crew duty limitations by incorporating contemporary scientific knowledge on human fatigue factors was on the NTSB’s Most Wanted List for many years. In January 2012, the FAA updated duty and rest requirements for pilots by issuing final rule 14 CFR Parts 117, 119, and 121: “Flightcrew Member Duty and Rest Requirements.” The rule incorporates scientifically based information to recognize the universality of factors that lead to fatigue in most individuals and helps to regulate these factors to protect against flightcrew members in passenger operations from accumulating dangerous amounts of fatigue. For more information, see http://www.faa.gov/regulations_policies/rulemaking/recently_published/media/2120-AJ58-FinalRu le.pdf.

NTSB Aircraft Accident Report 30 and expectations, overreliance on memory for performing tasks or identifying critical areas for inspection, and interruptions (which are common in the maintenance environment).56 Using documentation that clearly delineates the steps to be performed and critical areas to be inspected to support the maintenance and inspection task is one way to mitigate these factors. For example, having clearly delineated steps can help prevent errors associated with interruptions because they aid maintenance personnel’s notation of steps completed and steps remaining, and clearly identifying critical areas helps in the preparation and execution of the task or inspection by directing personnel’s attention to these areas. The documentation used by Sundance Helicopters’ maintenance personnel for the fore/aft servo replacement included the paperwork for the 100-hour inspection. This paperwork listed the servo replacement task as an item to be accomplished with a reference to the AMM subsection, “4-1 Removal/Installation―Main Rotor Servocontrols” (reference number 67-32-00, 4-1), which contains a listing of the tools, parts, and delineated sequential steps required to accomplish the task. According to Sundance’s GMM, maintenance procedures requiring the installation of a safety device (for example, a split pin or a safety wire), such as the fore/aft servo replacement, were also required to have an inspector sign off to approve the helicopter for return for service. However, even though the fore/aft servo replacement task had delineated sequential steps to follow, including several in which installing a safety was required, the company’s 100-hour inspection paperwork had only one place for the inspector to sign off for the overall fore/aft servo installation rather than individual places for the inspector to sign off for each step.57 Work cards (also known as “job cards”) contain specific instructions for accomplishing a maintenance task and are derived from the AMM guidance. They are designed as self-contained documentation to be used by maintenance personnel in the preparation, performance, and verification of a maintenance task and are designed with usability as a key objective. For example, critical steps are well marked, cautions are noted, blocks are available for recording critical parameters such as torque values, and parallel columns are provided for both mechanics and inspectors to verify completion of related groupings of steps in the task. Work cards, which are used much like checklists are used in the cockpit, can help to ensure that steps in a maintenance task have been performed and protect against errors. A work card for the fore/aft servo replacement that incorporated Sundance Helicopters’ inspection policy from its GMM would likely have expanded upon steps in the AMM to include at least discrete (separate and distinct) verification blocks for the steps requiring safeties. As a result, both the

56 FAA-H-8083-30 “Aviation Maintenance Handbook Addendum,” chapter 14, “Human Factors,” states the following, “Complacency is a human factor in aviation maintenance that typically develops over time. As a technician gains knowledge and experience, a sense of self-satisfaction and false confidence may occur. A repetitive task, especially an inspection item, may be overlooked or skipped because the technician has performed the task a number of times without ever finding a fault. The false assumption that inspection of the item is not important may be made. However, even if rare, a fault may exist. The consequences of the fault not being detected and corrected could cause an incident or accident. Routine tasks performed over and over allow time for the technician’s mind to wander, which may also result in a required task not being performed.” 57 In addition, no documents required the mechanic to verify completed steps or record critical parameters such as torque values.

NTSB Aircraft Accident Report 31 inspector and the mechanic would have had additional directive aids to help ensure completion of all steps for the task. Work cards can be developed by the operator or the aircraft manufacturer. Although work cards are not required, AC 120-16E, “Air Carrier Maintenance Programs,” chapter 3, “Air Carrier Maintenance Manual,” section 302, “Major Sections of the Typical Air Carrier Maintenance Manual,” b. “Work Cards,” states the following: Work cards, while not a regulatory requirement, have evolved as a best practice. Work cards are considered part of your air carrier manual and the air carrier maintenance program. They are the “what to do” and the “how to do it” part of your airworthiness responsibility. Work cards are used as a simple means of complying with regulations for performing maintenance, as well as maintenance recordkeeping. Work cards provide detailed, concise procedural instructions that organize and control your maintenance activities while providing a means to ensure that your maintenance activities comply with your air carrier maintenance manual. It is an easy way to make sure maintenance, as well as other personnel are following your procedures. The second primary function is to document your maintenance activities, providing a means to comply with your air carrier maintenance recordkeeping requirements. The FAA also has guidance available to aid in the development of work cards.58 Further, in FAA Order 8900.1, “Flight Standards Information Management System,” volume 3, “General Technical Administration,” chapter 43, “Evaluate Continuous Airworthiness Maintenance Program/Revision,” dated October 29, 2010, the FAA encourages its inspectors to develop work cards, giving special attention to work cards involving required inspections and flight control systems, and to include delineated tasks with individual inspection sign-off requirements for postrigging verification. The circumstances of this accident illustrate that the reliability of inspections of critical flight system components can be affected by a number of inherent human factors. Although some manufacturers and operators have established best practices for the development and use of work cards to help protect against human errors in maintenance, aviation safety could be improved through a more widespread application of these best practices. The NTSB concludes that the use of work cards can help prevent and trap errors in the performance and verification of maintenance tasks. Therefore, the NTSB recommends that the FAA encourage operators and manufacturers to develop and implement best practices for conducting maintenance under 14 CFR Parts 135 and 91 Subpart K, including, but not limited to, the use of work cards for maintenance tasks, especially those involving safety-critical functions, that promote the recording and verification of delineated steps in the task that, if improperly completed, could lead to a loss of control.

58 For example, see C.G. Drury, FAA Human Factors Guide for Aviation Maintenance and Inspection, chapter 6, “Procedures and Technical Documentation,” which can be found online at http://www.hf.faa.gov/hfguide/06/06.pdf.

NTSB Aircraft Accident Report 32 3.2.3 Lack of Human Factors Training for Maintenance Personnel Currently, federal regulations do not require maintenance personnel to receive human factors training. However, some foreign authorities do require human factors training for their maintenance personnel and have developed human factors guidance and curriculums that address various issues, including fatigue.59 The NTSB has not previously made a specific recommendation that maintenance personnel should be provided human factors or fatigue training. However, on March 5, 2004, as a result of the January 8, 2003, accident in which a Raytheon (Beechcraft) 1900D, operated by Air Midwest (doing business as US Airways Express) as flight 5481, crashed shortly after takeoff from runway 18R at Charlotte-Douglas International Airport, Charlotte, North Carolina,60 the NTSB issued Safety Recommendation A-04-16, which asked the FAA to do the following: Require that 14 Code of Federal Regulations Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. On June 18, 2004, the FAA agreed that a human factors component should be part of a maintenance training program and stated that it would address this recommendation via future guidance and rulemaking on air carrier maintenance training programs. On October 12, 2005, the NTSB stated that its recommendation for a human factors program was broader than simply providing human factors training to maintenance personnel and, therefore, classified Safety Recommendation A-04-16 “Open―Unacceptable Response.” Subsequent FAA correspondence on Safety Recommendation A-04-16 described the development and availability of guidance material on maintenance human factors and outreach activities in this area. On February 15, 2011, the FAA reasserted its position that the best strategy to address this recommendation was through a requirement for initial and recurrent training in maintenance human factors. The FAA further stated that it had initiated the Air Carrier Maintenance Training Program rulemaking project to develop a notice of proposed rulemaking (NPRM) proposing to require the approval of air carrier maintenance training programs and set clear training standards that include comprehensive human factors training. On July 7, 2011, the NTSB acknowledged that training could be an effective component of a human factors program but stated that pending a requirement for air carriers to implement comprehensive human factors programs, Safety Recommendation A-04-16 would remain classified “Open―Unacceptable Response.” On November 16, 2011, the FAA stated that the NPRM addressing air carrier maintenance training programs that includes comprehensive human factors training and FAA approval of maintenance training programs was expected to be published by June 30, 2012. On March 6, 2012, the NTSB reiterated its position and classification of Safety Recommendation

59 For example, see European Aviation Safety Authority Regulation Part 145 Section ANNEX II, Section 30 (e). 60 For more information, see Loss of Pitch Control During Takeoff; Air Midwest Flight 5481, Raytheon (Beechcraft) 1900D, N233YV, Charlotte, North Carolina, January 8, 2003, Aircraft Accident Report NTSB/AAR-04/01 (Washington, DC: National Transportation Safety Board, 2004), available online at http://www.ntsb.gov.

NTSB Aircraft Accident Report 33 A-04-16. Therefore, although the FAA has developed substantial guidance for the industry about maintenance human factors in the almost 9 years that have elapsed since Safety Recommendation A-04-16 was issued and has repeatedly stressed the importance of human factors training as a way to address the intent of this recommendation, there remains no requirement for human factors training for maintenance personnel involved in air carrier operations. On November 6, 2012, the FAA provided an update stating that it expected to issue the NPRM sometime in 2013. The NTSB notes that the FAA issued an NPRM on May 21, 2012, proposing that repair stations operating under 14 CFR Part 145 provide human factors training relevant to aviation maintenance for employees performing maintenance, preventive maintenance, alterations, or inspection functions.61 However, if adopted, the rule would not require maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs to receive human factors training. The FAA has also developed guidance, which contains sample educational materials, that addresses human factors affecting maintenance personnel, including ways to prevent fatigue during maintenance activities, in its online resources addressing human factors in maintenance and inspection.62 As discussed in section 3.2.1.2, one strategy to prevent human error in maintenance resulting from fatigue is through the implementation of duty-time limitations. Another important strategy to help reduce the risk of fatigue-related errors in maintenance is to train and educate maintenance personnel through human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue. The NTSB concludes that all maintenance personnel would benefit from receiving human factors training, including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, which would help to reduce the likelihood of human errors in aviation maintenance. Because comprehensive human factors programs could reduce the likelihood of human error in aviation maintenance, the NTSB reiterates Safety Recommendation A-04-16. Further, the NTSB recommends that the FAA require that personnel performing maintenance or inspections under 14 CFR Parts 121, 135, 145, and 91 Subpart K receive initial and recurrent training on human factors affecting maintenance that includes a review of the causes of human error, including fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue.

61 See “Repair Stations; Proposed Rule” published at 77 Federal Register 30054-30086 on May 21, 2012. 62 For example, see https://hfskyway.faa.gov/hfskyway/fatiguehome.aspx.

NTSB Aircraft Accident Report 34

1. Conclusions
2. 1 Findings
3. The bolt connecting the control input rod to the fore/aft servo’s input lever must have

been present at the start of the flight to allow normal flight up until the time of the catastrophic upset, but it was not present immediately before the impact and postimpact fire.

1. The most likely explanation for the in-flight loss of control is that the fore/aft servo bolt

disengaged in flight, which resulted in the separation of the control input rod to the fore/aft servo’s input lever, rendering the helicopter uncontrollable.

1. The fore/aft servo bolt most likely disengaged because the split pin was installed

improperly or it was not installed and a self-locking nut that either was degraded or not torqued was used when the fore/aft servo was replaced. This allowed the nut to unthread and separate from the bolt.

1. The mechanic, inspector, and check pilot each had at least one opportunity to observe the

fore/aft servo self-locking nut and split pin; however, they did not note that the split pin was installed improperly or not present.

1. Because a self-locking nut’s locking ability degrades with use, it is critical that

maintenance personnel follow manufacturer and Federal Aviation Administration self-locking nut reuse guidance to prevent the improper reuse of degraded nuts.

1. At the time of the accident, Sundance Helicopters was not following Eurocopter and

Federal Aviation Administration self-locking nut reuse guidance, which led to the repeated improper reuse of degraded nuts on its helicopters.

1. Sundance Helicopters did not meet the Tour Operators Program of Safety (TOPS)

audit requirements because Sundance’s director of maintenance misinterpreted the TOPS maintenance standards regarding training and qualifications of mechanics.

1. Because both the mechanic and the inspector had insufficient time to adjust to working an

earlier shift than normal, they were experiencing fatigue during the December 6 shift. In addition, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue.

1. Both the mechanic’s performance and the inspector’s performance probably were

degraded by fatigue, which contributed to the improper securing of the fore/aft servo connection hardware, the improper installation of the hydraulic belt, and the incomplete maintenance inspection of the accident helicopter, respectively.

NTSB Aircraft Accident Report 35

1. Sufficient scientific research on fatigue and knowledge of industry practices currently

exists from which to establish duty-time limitations for maintenance personnel that would help reduce the risk of fatigue-related errors in aviation maintenance.

1. The use of work cards can help prevent and trap errors in the performance and

verification of maintenance tasks.

1. All maintenance personnel would benefit from receiving human factors training,

including training on the causes of fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue, which would help to reduce the likelihood of human errors in aviation maintenance. 4.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was Sundance Helicopters’ inadequate maintenance of the helicopter, including (1) the improper reuse of a degraded self-locking nut, (2) the improper or lack of installation of a split pin, and (3) inadequate postmaintenance inspections, which resulted in the in-flight separation of the servo control input rod from the fore/aft servo and rendered the helicopter uncontrollable. Contributing to the improper or lack of installation of the split pin was the mechanic’s fatigue and the lack of clearly delineated maintenance task steps to follow. Contributing to the inadequate postmaintenance inspection was the inspector’s fatigue and the lack of clearly delineated inspection steps to follow.

NTSB Aircraft Accident Report 36

1. Recommendations
2. 1 New Recommendations

The National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Establish duty-time regulations for maintenance personnel working under 14 Code of Federal Regulations Parts 121, 135, 145, and 91 Subpart K that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and other factors shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness. (A-13-01) (Supersedes Safety Recommendation A-97-71 and is classified “Open―Unacceptable Response”) Encourage operators and manufacturers to develop and implement best practices for conducting maintenance under 14 Code of Federal Regulations Parts 135 and 91 Subpart K, including, but not limited to, the use of work cards for maintenance tasks, especially those involving safety-critical functions, that promote the recording and verification of delineated steps in the task that, if improperly completed, could lead to a loss of control. (A-13-02) Require that personnel performing maintenance or inspections under 14 Code of Federal Regulations Parts 121, 135, 145, and 91 Subpart K receive initial and recurrent training on human factors affecting maintenance that includes a review of the causes of human error, including fatigue, its effects on performance, and actions individuals can take to prevent the development of fatigue. (A-13-03) 5.2 Previously Issued Recommendation Reiterated in This Report Safety Recommendation A-04-16, to the FAA, is reiterated in section 3.2.3 of this report. Require that 14 Code of Federal Regulations Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. 5.3 Previously Issued Recommendation Reclassified in This Report Safety Recommendation A-97-71, to the FAA, is classified “Closed―Unacceptable Action/Superseded” in section 3.2.1.2 of this report. The recommendation is superseded by Safety Recommendation A-13-01 above. Review the issue of personnel fatigue in aviation maintenance; then establish duty time limitations consistent with the current state of scientific knowledge for personnel who perform maintenance on air carrier aircraft. (A-97-71)

NTSB Aircraft Accident Report 37

Member Rosekind filed the following concurring statement on February 5, 2013. BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: January 29, 2013

NTSB Aircraft Accident Report 38 Board Member Statements Member Mark R. Rosekind, Concurring Member Rosekind filed the following concurring statement on February 5, 2013; Chairman Hersman, Vice Chairman Hart, and Members Sumwalt and Weener joined in the statement: On December 7, 2011, a Sundance Helicopters, Inc., helicopter operating on a “Twilight Tour” sightseeing trip crashed in mountainous terrain about 14 miles east of Las Vegas, Nevada. The pilot and four passengers were killed, and the helicopter was destroyed. The safety issues identified in this accident investigation included the fatigue experienced by both the mechanic and the quality control inspector. For both individuals, fatigue was due to insufficient time to adjust to working an earlier shift than normal. Also, the mechanic had an inadequate amount of sleep and the inspector had a long duty day, both of which also contributed to the development of their fatigue. The investigation found that their performance was degraded by fatigue, which contributed to securing the fore/aft servo connection improperly, and their failure to identify this deficiency in the post-maintenance inspection of the accident helicopter. Maintenance Personnel Duty Limits – Long Overdue Addressing the need for maintenance personnel duty limits is not a new issue. The NTSB has had longstanding concerns about the effects of fatigue on all safety-critical operations including maintenance. Over 15 years ago, the Board issued Safety Recommendation A-97-71 that asked the FAA to review fatigue in aviation maintenance personnel and then establish duty-time limitations consistent with the current state of scientific knowledge. This recommendation resulted from a 1996 accident in which ValuJet flight 592 crashed into the Everglades shortly after takeoff from Miami International Airport. The crash was caused, in part, by the aircraft inspector’s fatigue due to extended duty time. The FAA subsequently responded to the NTSB that because of a lack of scientific data in this area, it would expand its human factors research program to include studies regarding duty length and shift scheduling. At the conclusion of this research, the FAA was to implement an appropriate policy or regulatory change. In that decade and a half since the issuance of Safety Recommendation A-97-71, the FAA has conducted additional research regarding the fatigue effects of duty length and shift scheduling with results that show substantial decreases in cognitive performance, reductions in attention, and degradations in memory. Even with this additional information, the agency has not acted to address this issue or the 15-year old NTSB recommendation. As a result, at the Sundance Helicopter accident Board Meeting, Safety Recommendation A-97-71 was classified “Closed―Unacceptable Response/Superseded” and was superseded by a new safety recommendation A-13-01 that was classified as “Open―Unacceptable Response.” In the intervening 15 years, there is an even more robust base of scientific knowledge and industry best practices to substantiate the fact that duty-time limitations are a critical strategy for

NTSB Aircraft Accident Report 39 reducing the risks of fatigue in aviation maintenance. Much of this science led to, and is the basis for, the FAA’s new hours of service rules for flight crews that were issued in December 2011. Fatigue is fatigue and a tired maintenance employee suffers from the same performance decrements experienced by a tired pilot. The alertness of both is crucial to safe aircraft operations. As the FAA said in its hours of service rule, “Fatigue threatens aviation safety because it increases the risk of pilot error that could lead to an accident.” This is particularly a concern for crews that fly “…on the back side of the clock.” Maintenance personnel can easily be substituted here for “pilot” and “crew;” fatigue creates parallel risks to flight safety for all humans involved in any aspect of operations. The time is long overdue for the FAA to issue duty-time regulations for maintenance personnel that take into consideration factors such as start time, workload, shift changes, circadian rhythms, adequate rest time, and data shown by recent research, scientific evidence, and current industry experience to affect maintenance crew alertness. Human Factors Training―Critical Complement to Duty Limits Duty limits are necessary to ensure maintenance personnel alertness and operational safety, but they alone are insufficient. A comprehensive and complementary strategy for reducing the risks of fatigue in aviation maintenance must go beyond duty limits and include human factors training for all maintenance personnel. Based on the Sundance helicopter accident, the NTSB recommended that this human factors training be required, and include fatigue education and training on: (1) the causes of fatigue; (2) its effects on performance; and (3) actions individuals can take to prevent the development of fatigue. Like duty limits, this training is long overdue. As a result of the 2003 US Airways Express flight 5481 crash at Charlotte-Douglas International Airport, the NTSB issued Safety Recommendation A-04-16 for the FAA to require that Part 121 air carriers implement comprehensive human factors programs to reduce the likelihood of human error in aviation maintenance. In the intervening nine years, the FAA has developed substantial guidance for the industry about maintenance human factors and has repeatedly stressed the importance of human factors training as a way to address the intent of this recommendation. Yet there remains no requirement for human factors training for maintenance personnel involved in air carrier operations. Safety Recommendation A-04-16 remains classified “Open – Unacceptable Response.” Even though the FAA issued a notice of proposed rulemaking last year that would someday require repair stations to provide human factors training for employees performing maintenance, preventive maintenance, alterations, or inspection functions, these regulations would not include maintenance personnel working for Part 121 and 135 operators or Part 91 Subpart K programs. Based on the Sundance Helicopter accident, the NTSB reiterated Safety Recommendation A-04-16. The Sundance investigation illustrates that human factors training for ALL aircraft maintenance classifications, including the type of fatigue training outlined above, is essential for

NTSB Aircraft Accident Report 40 reducing the likelihood of human error in aviation maintenance. The nine-year old outstanding, unacceptable status of Safety Recommendation A-04-16 on human factors training needs action. Conclusion Aircraft maintenance personnel have an invaluable role in safe aircraft operations, with their work often conducted “behind the scenes.” This Sundance helicopter accident highlights that their work is equally important to the work performed by the more visible pilot and flight crew. It is unacceptable that the duty limits and training opportunities for maintenance personnel have not kept pace with what is required of their other industry colleagues. No matter how accomplished and professional the Sundance helicopter pilot was, the deficiencies in the fore/aft servo connection―in part due to maintenance personnel fatigue―resulted in an unrecoverable crash. By acting on the NTSB Safety Recommendations on duty limits and human factors training in this report, the industry can make real progress to prevent future accidents of this kind and the resulting loss of life. Maintenance errors have been the cause of numerous tragedies over the course of aviation history, and it is unacceptable to wait another decade or more before regulations, duty-time limitations, and human factors training fully recognize and address the known safety gaps.

NTSB Aircraft Accident Report 41

1. Appendix

NTSB Analysis of Possible Bolt Loss Scenarios Scenario 1. Shearing of the Bolt If the bolt was sheared either during operation or impact, the high loads needed to shear the bolt would be expected to cause elongation or deformation of the clevis holes on the servo; however, no such evidence was found.63 Further, if the bolt was sheared, scrape marks might have been left on the inside surfaces of the clevis from the fragments of the bolt being forcibly dragged out of it; however, no such evidence was found. Further, if shearing occurred during impact, it is likely that at least pieces of the bolt or other parts of the connection hardware would have been found at the accident scene because the deformation in the bolt pieces would not allow the pieces to be easily liberated. As noted in this report, no pieces of the fore/aft servo connection hardware were found. To further investigate the possibility of the bolt shearing, Eurocopter supplied the NTSB with its calculations of the ultimate structural load capacity of several components. These calculations showed that the weakest component in the servo input area was the input rod. If loaded in compression, a buckling failure would be expected at a load of about 3,752 lbf. Physical examinations of the input rod did not reveal any indications of a buckling failure. The input rod is also the weakest member under tension loads with a calculated tensile capacity of 6,775 lbf. These compare to the calculated minimum double shear load of 7,868 lbf for the bolt. The clevis fracture load was estimated64 to be at least 6,700 lbf for one side and 13,400 lbf for both sides. For control system design, 14 CFR 27.397 (a)(2) specifies a limit pilot force of 100 pounds for fore and aft motion of stick controls. Eurocopter reports a force ratio of 1:5.12 from the collective to the servo input. Therefore, a 100-lbf pilot input to the collective would result in a 512-lbf load into the input rod and bolt, which is a force at least 7 times less than that required to cause these components to fail. Therefore, although the magnitude of the loads needed to break the bolt and the clevis could easily have been generated by impact forces, it is well beyond the capability of the pilot. It could be argued that 14 CFR 27.397 does not realistically describe a helicopter’s collective lever, which requires an upward motion, and that a pilot under duress could exert a much greater load. The FAA Human Factors Design Standard65 presents static muscle strength

63 The NTSB notes that the tight fit of the bolt in the clevis hole would limit the deformation of the hole. The differential hardness of the components is a large factor in determining the locations of damage with the softer component typically showing the majority of the damage. In this case, the bolt is the softer component; therefore, it would be expected to have accumulated the most damage. However, as noted, this piece was not found for examination. 64 The estimation was based on a measured cross section of the lug (0.1 inch x 0.338 inch) and a conservative 100,000 pounds per square inch tensile strength. 65 V. Ahlstrom and K. Longo, Human Factors Design Standard (HF-STD-001) (Atlantic City International Airport, New Jersey: Federal Aviation Administration, William J. Hughes Technical Center, 2003).

NTSB Aircraft Accident Report 42 data that closely represent the motion of a collective lever. The data show that a 95th-percentile male in weight can produce a peak force of 246 lbf, or only about 33 percent of the force needed to buckle the input rod and only 16 percent of the force needed to shear the bolt. Scenario 2. Fracturing of the Bolt A second scenario to remove the bolt would be for the bolt to fracture in a low-deformation mode, such as fatigue or an embrittlement process. Eurocopter reported no history of bolt fatigue or embrittlement. However, following the fracture, the separated bolt pieces must still exit the joint to fully disengage the input rod from the servo. The process of bolt extraction could occur by either energetic extraction or progressive movement. For energetic extraction, sufficient energy would have to be released by the fracture process to rapidly eject the bolt pieces out of the joint without damage. Although some fracture processes can generate these kinds of energies, it is very unlikely in this instance because normal input rod loads are low and limited by the pilot’s control force ability and the leverage associated with the linkage, and the assembly torque (strain) is relatively low. Slower progressive extraction might leave physical evidence, such as edge deformation of the clevis holes, and no such damage was found. Scenario 3. Nut Separating From the Bolt The nut could separate from the bolt by (1) shearing of the nut or bolt threads, (2) fracturing of the nut, or (3) unthreading of the nut, all of which presume the use of a degraded nut and the lack or loss of the split pin for the bolt to separate from the joint. A self-locking nut that was not torqued could also unthread from the bolt. To shear the nut or bolt threads, axial loads must be applied to the bolt. However, the only significant axial loads are from the tightening torque on the bolt. These are estimated to be between 475 and 1,600 lbf, well below the estimated 4,000 lbf load needed to shear the nut or bolt threads; therefore, shearing of the nut or bolt threads is unlikely. With little or no load on the nut, hydrogen embrittlement from processing is one of the few possible nut fracture modes. However, like the bolt, the nut has a low probability of fracture due to its low hardness. Further, Eurocopter reported no history of nut fractures. In the normal high-vibration environment of the helicopter, the nut could also become loose and unthread by vibration until it falls off the bolt. In accordance with 14 CFR 27.607, the nut has two separate locking devices (the self-locking nut and split pin) to prevent this. In a March 7, 2012, letter to the NTSB, Eurocopter stated that if there was no split pin behind an airworthy self-locking nut and the nut was correctly torqued, the nut should not loosen and unthread. However, the turning resistance (locking capability) of the nut is degraded with repeated use as demonstrated by the minimal locking capability found on half of the nuts removed from Sundance Helicopters’ in-service helicopters after the accident. If the split pin was installed improperly or not at all, there would be no backup mechanism for a nut with a degraded locking ability to secure the input rod to the fore/aft servo. Eurocopter stated that even if the bolt and nut were improperly torqued and the nut’s locking ability was degraded, the split pin should have prevented the loss of the nut. With the pin installed properly, the nut can only be removed with very high torque shearing of the pin, but it is

NTSB Aircraft Accident Report 43 highly improbable that this occurred. However, if the split pin is installed without properly spreading the tangs, the pin can fall out with little effort. Eurocopter stated that this scenario would result in a loss of the nut after a “short period of time.” Scenario 4. Nut and Split Pin Not Installed The shortest path to a disconnect of the bolt from the joint would be if the nut and split pin were not installed at all, which would only require enough time and vibration for the bolt to work its way out of the joint. However, with a properly installed servo, the fore/aft servo nut and split pin are clearly visible for inspection when the left MGB cowl is open, and this area of the helicopter was inspected at least twice on the day of the accident. Although the QC inspector and check pilot most likely did not notice the improperly installed or missing split pin, it is more likely that they would have noticed a missing nut and split pin. Further, it is unlikely that the helicopter could have flown safely for 3.5 hours before the accident if neither of these components had been installed.

FD07401 ｜ 2013_美国_AAR1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Crash Following Loss of Engine Power Due to Fuel Exhaustion Air Methods Corporation Eurocopter AS350 B2, N352LN Near Mosby, Missouri August 26, 2011

Accident Report NTSB/AAR-13/02 PB2013-104866

National Transportation Safety Board

NTSB/AAR-13/02 PB2013-104866 Notation 8479 Adopted April 9, 2013

Aircraft Accident Report Crash Following Loss of Engine Power Due to Fuel Exhaustion Air Methods Corporation Eurocopter AS350 B2, N352LN Near Mosby, Missouri August 26, 2011

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, DC 20594

National Transportation Safety Board. 2013. Crash Following Loss of Engine Power Due to Fuel Exhaustion, Air Methods Corporation, Eurocopter AS350 B2, N352LN, Near Mosby, Missouri, August 26, 2011. Aircraft Accident Report AAR-13/02. Washington, DC: NTSB.

Abstract: This report discusses the August 26, 2011, accident involving a Eurocopter AS350 B2 helicopter, N352LN, which crashed following a loss of engine power as a result of fuel exhaustion near the Midwest National Air Center, Mosby, Missouri. The pilot, flight nurse, flight paramedic, and patient were killed, and the helicopter was substantially damaged by impact forces.

Safety issues identified in this accident include the following: distraction due to nonoperational use of portable electronic devices during flight and ground operations; the lack of Air Methods Operational Control Center involvement in decision-making; inadequate guidance on autorotation entry procedures; the need for simulator training of helicopter emergency medical services pilots; and the lack of a flight recorder. As a result of this investigation, the National Transportation Safety Board makes safety recommendations to the Federal Aviation Administration (FAA) and Air Methods Corporation, reiterates previous recommendations to the FAA, and reiterates and reclassifies a previous recommendation to the FAA.

The National Transportation Safety Board is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The National Transportation Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of National Transportation Safety Board publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2013-104866 from:

National Technical Information Service 5285 Port Royal Rd. Springfield, VA 22161 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Aircraft Accident Report i

Contents Figures ........................................................................................................................................... iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary ..................................................................................................................... vi

1. The Accident ...............................................................................................................................1
2. 1 The History of Flight .................................................................................................................1
3. 1.1 Events Before the Accident Flight ...................................................................................1
4. 1.2 The Accident Flight .........................................................................................................4
5. 2 Wreckage Information ...............................................................................................................7
6. 3 Pilot Information ......................................................................................................................10
7. 3.1 Work/Rest/Sleep History ...............................................................................................11
8. 4 Helicopter Information.............................................................................................................13
9. 4.1 Eurocopter AS350 B2 Fuel System ...............................................................................14
10. 4.2 Fuel Quantity Calculations ............................................................................................16
11. 4.3 Engine Failure Emergency Procedure ...........................................................................16
12. 5 Tests and Research ...................................................................................................................17
13. 5.1 Fuel System Component Examination ..........................................................................17
14. 5.2 Certification Flight Tests for Controllability Following Engine Failure .......................18
15. 5.3 Simulator Flight Evaluations .........................................................................................19
16. 6 Company Information ..............................................................................................................19
17. 7 Autorotation Guidance .............................................................................................................22
18. Investigation and Analysis ......................................................................................................24
19. 1 General .....................................................................................................................................24
20. 2 Pilot’s Actions During Preflight and Departure for the Hospital ............................................24
21. 3 Pilot’s Decision to Continue the Mission ................................................................................25
22. 4 Pilot Human Factors ................................................................................................................27
23. 4.1 Distraction Due to Text Messaging During Flight and Ground Operations ..................27
24. 4.2 Fatigue ...........................................................................................................................31
25. 5 Lack of Operational Control Center Involvement in Decision-Making ..................................33
26. 6 Autorotation Guidance and Training .......................................................................................36
27. 6.1 Loss of Engine Power and Autorotation Entry ..............................................................36
28. 6.2 Inadequate Guidance on Autorotation Entry Procedures ..............................................37
29. 6.3 Need for Simulator Training of Helicopter Emergency Medical Services Pilots .........39
30. 7 Lack of Flight Recorder ...........................................................................................................41
31. Conclusions ...............................................................................................................................44
32. 1 Findings ....................................................................................................................................44
33. 2 Probable Cause.........................................................................................................................45

NTSB Aircraft Accident Report ii

• Recommendations ....................................................................................................................46

1. 1 New Recommendations ...........................................................................................................46
2. 2 Previously Issued Recommendations Reiterated in This Report .............................................47
3. 3 Previously Issued Recommendation Reiterated and Reclassified in This Report ...................48

Board Member Statements .........................................................................................................49 References .....................................................................................................................................53 NTSB Aircraft Accident Report iii

Figures Figure 1. Map showing locations of STJ, GPH, Harrison County Community Hospital, Liberty Hospital, and the accident site. ........................................................................................... 2 Figure 2. Photograph of the cockpit of an exemplar helicopter. .................................................... 3 Figure 3. Flight track of the last few miles of the accident flight showing radar data (red dots) and Air Methods satellite tracking system data (blue dots). ........................................................... 7 Figure 4. Photograph of the accident site. ...................................................................................... 8 Figure 5. Diagram showing the estimated impact attitude of the helicopter. ................................ 9 Figure 6a. Timeline of the pilot’s communications from 1400 to 1700. ..................................... 12 Figure 6b. Timeline of the pilot’s communications from 1700 to the accident about 1841. ....... 13 Figure 7. Diagram of the instrument panel, the fuel quantity gauge, and the caution/warning annunciator panel. ......................................................................................................................... 15 Figure 8. Photograph of the fuel system component examination setup. .................................... 17 Figure 9. Air Methods flight risk assessment risk matrixes at the time of the accident. ............. 21 Figure 10. Airflow through the main rotor system during normal, powered flight and during autorotation. .................................................................................................................................. 22

NTSB Aircraft Accident Report iv

Abbreviations and Acronyms AC advisory circular agl above ground level AirCom Air Methods Communication Center CFR Code of Federal Regulations CRM crew resource management CVR cockpit voice recorder CYA conform your aircraft EMS emergency medical services EUROCAE European Organization for Civil Aviation Equipment FAA Federal Aviation Administration FDR flight data recorder FTD flight training device GOM general operations manual GPH Midwest National Air Center HEMS helicopter emergency medical services InFO Information for Operators LARS lightweight aircraft recording system nm nautical miles NPRM notice of proposed rulemaking NTSB National Transportation Safety Board

NTSB Aircraft Accident Report v

NVG night vision goggles OCC operational control center PED portable electronic device PIC pilot-in-command RFM rotorcraft flight manual STJ Rosecrans Memorial Airport TSO technical standard order VFR visual flight rules

NTSB Aircraft Accident Report vi

Executive Summary On August 26, 2011, about 1841 central daylight time, a Eurocopter AS350 B2 helicopter, N352LN, crashed following a loss of engine power as a result of fuel exhaustion near the Midwest National Air Center (GPH), Mosby, Missouri. The pilot, flight nurse, flight paramedic, and patient were killed, and the helicopter was substantially damaged by impact forces. The emergency medical services (EMS) helicopter was registered to Key Equipment Finance, Inc., and operated by Air Methods Corporation, doing business as LifeNet in the Heartland, as a 14 Code of Federal Regulations Part 135 medical flight. Day visual meteorological conditions prevailed at the time of the accident, and a company visual flight rules flight plan was filed. The helicopter was not equipped, and was not required to be equipped, with any onboard recording devices. The flight originated from Harrison County Community Hospital, Bethany, Missouri, about 1811 and was en route to GPH to refuel. After refueling, the pilot planned to proceed to Liberty Hospital, Liberty, Missouri, which was located about 7 nautical miles (nm) from GPH. The helicopter impacted the ground in about a 40° nose-down attitude at a high rate of descent with a low rotor rpm. Wreckage examination determined that the engine lost power due to fuel exhaustion and that the fuel system was operating properly. The investigation revealed that the pilot did not comply with several company standard operating procedures that, if followed, would have led him to detect the helicopter’s low fuel state before beginning the first leg of the mission (from the helicopter’s base in St. Joseph, Missouri, to Harrison County Community Hospital). After reaching the hospital, the pilot reported to the company’s EMS communication center that he did not have enough fuel to fly to Liberty Hospital and requested help locating a nearby fuel option. During their conversation, the pilot did not report and the communication specialist did not ask how much fuel was on board the helicopter, and neither of them considered canceling the mission and having fuel brought to the helicopter. After determining that GPH was the only airport with Jet-A fuel along the route of flight to Liberty Hospital, the pilot decided to proceed to GPH, although the estimated flight time to GPH was only 2 minutes shorter than that to Liberty Hospital. The engine lost power about 1 nm short of the airport, and the pilot did not make the flight control inputs necessary to enter an autorotation, which resulted in a rapid decay in rotor rpm. The safety issues identified in this accident include the following:  Distraction due to nonoperational use of portable electronic devices during flight and ground operations. Review of cell phone records indicated that the pilot sent and received multiple personal text messages throughout the day, including during time periods when the helicopter was in flight and while it was on the ground at Harrison County Community Hospital. The pilot’s texting, which occurred (1) while flying, (2) while the helicopter was being prepared for return to service, and (3) during his telephone call to the communication specialist when making his decision to continue the mission, was a self-induced distraction that took his attention away from his primary responsibility to ensure safe flight operations. Further, although there is no evidence that the pilot was texting at the time of the

NTSB Aircraft Accident Report vii

engine failure, his texting while airborne violated the company’s cell phone use policy.  Lack of Air Methods Operational Control Center (OCC) involvement in decision-making. Although the pilot reported his low fuel situation to the communication specialist, he did not request and was not referred to the company’s OCC or to someone such as the chief pilot who would likely have asked how much fuel was on board the helicopter and proposed canceling the mission. If the communication specialist or the pilot had notified operationally qualified personnel about the low fuel situation, the accident might have been averted. Both the Federal Aviation Administration (FAA) and the National Transportation Safety Board (NTSB) have emphasized the importance of having someone outside the immediate situation with operational experience provide an independent judgment on the safety of a launch in air medical operations.  Inadequate guidance on autorotation entry procedures. The simulator flight tests conducted after this accident showed that when a loss of engine power occurs in the Eurocopter AS350 B2 at cruise airspeeds, the pilot must simultaneously apply aft cyclic and down collective in order to maintain rotor rpm and execute a successful autorotation. However, the pilot’s autorotation training was done at airspeeds below cruise where less aft cyclic is needed to enter an autorotation. Further, FAA guidance on performing autorotations stresses lowering the collective as the initial step in entering an autorotation, does not emphasize the importance of other flight control inputs, and provides minimal information on the critical entry phase of autorotations.  Need for simulator training of helicopter emergency medical services (HEMS) pilots. The pilot had not received any flight training in a simulator. Simulators enable pilots to train in skills that are too risky to perform in a helicopter, such as the low altitude engine failure in this accident, and a simulator can accurately replicate the symptoms of an actual engine flameout. If the pilot had received autorotation training in a simulator rather than a helicopter, he would have been better prepared and might have effectively responded to the engine failure during the accident flight. This accident highlights the value of using simulators and flight training devices for HEMS pilot training.  Lack of a flight recorder. The helicopter was not required to have any type of crash-resistant recorder installed. If a recorder system that captured cockpit audio, images, and parametric data had been installed, it would have enabled NTSB investigators to reconstruct the final moments of the accident flight and determine why the pilot did not successfully enter an autorotation. The NTSB determines that the probable causes of this accident were the pilot’s failure to confirm that the helicopter had adequate fuel on board to complete the mission before making the first departure, his improper decision to continue the mission and make a second departure after he became aware of a critically low fuel level, and his failure to successfully enter an autorotation when the engine lost power due to fuel exhaustion. Contributing to the accident

NTSB Aircraft Accident Report viii

were (1) the pilot’s distracted attention due to personal texting during safety-critical ground and flight operations, (2) his degraded performance due to fatigue, (3) the operator’s lack of a policy requiring that an operational control center specialist be notified of abnormal fuel situations, and (4) the lack of practice representative of an actual engine failure at cruise airspeed in the pilot’s autorotation training in the accident make and model helicopter. As a result of this investigation, the NTSB makes safety recommendations to the FAA and Air Methods Corporation, reiterates previous recommendations to the FAA, and reiterates and reclassifies a previous recommendation to the FAA.

NTSB Aircraft Accident Report 1

1. The Accident
2. 1 The History of Flight

On August 26, 2011, about 1841 central daylight time,1 a Eurocopter AS350 B2 helicopter, N352LN, crashed following a loss of engine power as a result of fuel exhaustion near the Midwest National Air Center (GPH), Mosby, Missouri. The pilot, flight nurse, flight paramedic, and patient were killed, and the helicopter was substantially damaged by impact forces. The emergency medical services (EMS) helicopter was registered to Key Equipment Finance, Inc., and operated by Air Methods Corporation, doing business as LifeNet in the Heartland, as a 14 Code of Federal Regulations (CFR) Part 135 medical flight. Day visual meteorological conditions prevailed at the time of the accident, and a company visual flight rules (VFR) flight plan2 was filed.3 The helicopter was not equipped, and was not required to be equipped, with any onboard recording devices.4 The flight originated from Harrison County Community Hospital, Bethany, Missouri, about 1811 and was en route to GPH to refuel. After refueling, the pilot planned to proceed to Liberty Hospital, Liberty, Missouri, which was located about 7 nautical miles (nm) from GPH. 1.1.1 Events Before the Accident Flight The helicopter was based at the Rosecrans Memorial Airport (STJ), St. Joseph, Missouri (St. Joseph base). Figure 1 shows the locations of STJ, GPH, Harrison County Community Hospital, Liberty Hospital, and the accident site.

1 Unless otherwise indicated, all times in this report are central daylight time based on a 24-hour clock. 2 Air Methods has approval from the Federal Aviation Administration (FAA) for its pilots to file VFR flight plans that remain within the company, rather than being filed with the FAA. 3 More information about this accident, National Transportation Safety Board case number CEN11FA599, is available online at http://www.ntsb.gov/aviationquery/index.aspx. 4 See section 2.7 of this report for information on the need for flight recorders in all turbine-powered, nonexperimental, nonrestricted-category aircraft.

NTSB Aircraft Accident Report 2

Figure 1. Map showing locations of STJ, GPH, Harrison County Community Hospital, Liberty Hospital, and the accident site. During the week before the accident flight, Air Methods conducted night vision goggle (NVG) pilot training at the St. Joseph base. Maintenance records indicate that on August 22, 2011, the accident helicopter was configured for use in the NVG training; the medical interior was removed, and the copilot’s seat, cyclic, collective, and pedals were installed. Figure 2 is a photograph of the cockpit of an exemplar helicopter in the training configuration. While the accident helicopter was being used for the NVG training, another Air Methods Eurocopter AS350 B2, N101LN, was used by the St. Joseph base for EMS flights.

NTSB Aircraft Accident Report 3

Figure 2. Photograph of the cockpit of an exemplar helicopter. The last NVG training flight in the helicopter was completed about 0300 on August 26,

1. The Air Methods instructor who was providing the training reported that he did not have

the helicopter refueled after the last flight because the EMS pilot on duty needed to determine the amount of fuel required when the helicopter was returned to EMS service. According to the St. Joseph base lead pilot, the duty helicopter was typically loaded with a 70 percent fuel load, which provided about 2 hours of fuel. Fuel records obtained from the STJ airport manager showed that the helicopter was not refueled on August 26. The accident pilot reported for duty on the day of the accident about 0630. He received a briefing from the departing night shift pilot that covered the status of the active helicopter (N101LN) and the status of the accident helicopter. Regarding the accident helicopter, the night shift pilot reported that the NVG training had been completed, the helicopter needed to be reconfigured for medical work by the mechanic, and the helicopter was low on fuel and needed to be refueled before it was used. Because the accident helicopter was still awaiting

NTSB Aircraft Accident Report 4 reconfiguration for EMS flights, the pilot conducted a preflight inspection of N101LN and signed its daily flight log as required by the Air Methods General Operations Manual (GOM).5 The helicopter mechanic arrived about 0700 and began to reconfigure the accident helicopter for EMS work by removing the copilot’s seat, cyclic, collective, and pedals and reinstalling the medical interior. About 1400, the mechanic told the pilot that the work was complete, and they performed a “walk-around” inspection of the helicopter so that the mechanic could show the pilot what had been done. The mechanic then went inside to perform other duties. As he did so, the flight nurse and flight paramedic began to prepare the cabin for duty, and the pilot began to transfer his gear and paperwork from the active helicopter to the accident helicopter. The crew’s readying of the helicopter normally took about an hour, according to the helicopter mechanic, and he recalled that the accident helicopter had been moved out of the hangar to a nearby ramp area and was ready for service by 1530 because the crew came into the trailer where he was working about that time. Company procedures required that the pilot perform a preflight inspection of the helicopter, which included checking the fuel quantity, before it was returned to service. The mechanic did not know whether the pilot performed a preflight inspection of the helicopter before departing on the accident trip. Examination of the helicopter’s daily flight log revealed that the pilot did not sign it as required by the GOM to indicate that he had completed the preflight inspection. The pilot also did not take fuel samples from the helicopter on the day of the accident as required by the GOM.6 Further, three “conform your aircraft” (CYA) entries dated August 26, 2011, were made by the mechanic in the helicopter’s maintenance logbook, but the pilot did not initial the CYA entries as required by the GOM.7 1.1.2 The Accident Flight The purpose of the flight was to transport a patient from Harrison County Community Hospital to Liberty Hospital. The Air Methods Communication Center (AirCom)8 received the request about 1719, and the pilot was notified about 1720. During the initial notification, the pilot accepted the flight, and he and the flight paramedic and flight nurse prepared to depart. The helicopter became airborne about 1728. About 1730, the pilot reported by radio to the AirCom communication specialist that the helicopter had departed STJ with

5 The Air Methods GOM, page C-2/R-5/01-15-11, states, “The pilot shall record the preflight/airworthiness check by signing the appropriate section of the Daily Flight Log.” 6 The Air Methods GOM, page B-19/R-4/11-09-09, states, “At the beginning of each shift the pilot conducting the preflight will perform the following: • Aircraft fuel system: SUMP to collect a fuel sample and check for proper type and contaminates. • If fuel sample is contaminated, contact maintenance for further guidance. NOTE: For all Aircraft the two most recent fuel samples will be kept: After required periods, fuel samples shall be discarded appropriately.” 7 The Air Methods GOM, page B-28/R-5/01-15-11, states, “For all routine maintenance performed in the field by a company mechanic, a CYA check will be performed. If a second mechanic is unavailable to perform the check, a pilot may perform the check, and will initial the CYA entry in the Record of Maintenance.” According to the GOM, a CYA check is a postmaintenance visual inspection of a mechanic’s work. In this case, the three items that required a CYA check were the reconfiguration of the helicopter’s interior for medical service, a daily/5-hour engine chip detector inspection, and the mechanic’s daily airworthiness inspection of the helicopter. 8 AirCom is an EMS communications center staffed with communication specialists, who are not certified aircraft dispatchers. See section 1.6 of this report for further information on AirCom.

NTSB Aircraft Accident Report 5 2 hours of fuel and 3 persons on board with a risk code “Blue” (B-Caution).9 About 1758, the helicopter landed at the Harrison County Community Hospital helipad to pick up the patient. After the helicopter was shut down on the Harrison County Community Hospital helipad, the flight nurse and flight paramedic took their stretcher to the hospital’s emergency room to prepare the patient for flight. The pilot stayed in the helicopter and, about 1759, contacted the AirCom communication specialist using his company-provided cell phone and notified him that they had landed at the hospital. He also reported that about halfway through the flight from STJ, he had realized that the helicopter did not have as much fuel on board as he originally thought. He stated that he had reported the fuel from N101LN, not from the accident helicopter, and that he would have to stop somewhere and obtain fuel. The communication specialist asked the pilot if he could make it to Liberty Hospital and informed him that the distance to Liberty Hospital was 62 nm, with an estimated time en route of about 34 minutes. The pilot then stated, “That’s going to be cutting it pretty close. I’m probably going to need to get fuel before that.” The communication specialist and the pilot checked for availability of Jet-A fuel at nearby airports and found that the only airport with Jet-A fuel along the route of flight to Liberty Hospital was GPH, which was 58 nm away. After the communication specialist informed the pilot that the distance to GPH was 58 nm, the pilot stated, “Fifty-eight nautical miles. So it would save me, save me 4 nautical miles and 2 minutes. I think that’s probably where I’m going to end up going.”10 The communication specialist asked the pilot if he was going to depart for GPH for fuel and then return for the patient pick-up or if the pilot intended to refuel with the patient on board. The pilot informed the dispatcher that he would refuel at GPH with the patient on board. The pilot stated, “I don’t want to run short and I don’t want to run into that 20-minute reserve[11] if I don’t have to…,” and “we’ll take off. I’ll see how much gas I have when I got and I’ll call you when we’re in the air.” Review of AirCom transcripts revealed that while the communication specialist and the pilot were checking for possible fuel alternatives, the communication specialist also responded to three calls from two other Air Methods EMS helicopters concerning medical coordination information.12 Neither the pilot nor the communication specialist discussed contacting the

9 See section 1.6 of this report for information about Air Methods’ risk assessment program. 10 Using a ground speed of 110 knots, which was the speed used by Air Methods for flight planning for the helicopter, a 58 nm flight would take 32 minutes. Therefore, in comparison to a flight to Liberty Hospital, a flight to GPH would be 4 nm and 2 minutes shorter. 11 Title 14 CFR 135.209(b) states, “No person may begin a flight operation in a helicopter under VFR unless, considering wind and forecast weather conditions, it has enough fuel to fly to the first point of intended landing and, assuming normal cruising fuel consumption, to fly after that for at least 20 minutes.” 12 The AirCom communication specialist was responsible for providing EMS flight following for five Air Methods EMS bases.

NTSB Aircraft Accident Report 6 Air Methods Operational Control Center (OCC)13 to inform the OCC of the low fuel situation or the changed flight route. The conversation between the pilot and the communication specialist began just before the communication specialist completed his scheduled 12-hour work day, with the shift change time normally occurring about 1800. About 1806, the off-going day communication specialist briefed the on-coming night communication specialist regarding the status of all of the EMS helicopters that were currently dispatched, including the accident helicopter and its fuel situation, and the status of all of the EMS bases that were handled by their sector. Neither of the communication specialists mentioned notifying the OCC concerning the status of the accident helicopter. Following the shift change briefing, the day communication specialist remained on duty until about 1820 to complete the communications related to the accident helicopter’s low fuel situation. About this time, the flight nurse and flight paramedic arrived back at the helicopter and loaded the patient into the helicopter. Two hospital emergency room nurses who assisted the medical flight crew reported that neither medical crewmember mentioned anything unusual about the helicopter or its fuel status. About 1811, the helicopter departed from the Harrison County Community Hospital helipad, and the pilot reported via radio to the AirCom day communication specialist that he had 45 minutes of fuel and four persons on board with a risk code “Blue” and was en route to GPH. About 1813, the pilot requested that the AirCom communication specialist contact the fixed-base operator at GPH to indicate that the helicopter was inbound for fuel. The day communication specialist acknowledged the pilot’s radio transmission and stated that he would notify GPH that the helicopter would be landing for fuel. About 1815, the day communication specialist notified the AirCom supervisor that the helicopter was low on fuel and would be refueling with the patient on board at GPH. The supervisor directed him to contact the medical base supervisor at St. Joseph, but the day communication specialist informed him that the medical base supervisor was the flight nurse on board the helicopter. About 1821, the night communication specialist contacted the fixed-base operator at GPH and informed him that the helicopter was inbound for fuel and would be arriving in about 19 minutes. About 1827, the night communication specialist notified the pilot via radio that the fuel arrangement had been made at GPH. The pilot acknowledged the radio transmission, which was the last recorded transmission from the pilot. Combined radar data and Air Methods satellite tracking system data indicated that after departing from the hospital helipad, the helicopter headed directly toward GPH. En route to GPH, the helicopter’s altitude averaged between 400 and 600 feet above ground level (agl) with

13 The Air Methods GOM, page I-3/R-5/01-15-11, states that the communication specialist shall notify the OCC of all overdue aircraft, accidents, incidents, damage to aircraft, unscheduled landings, in-flight weather, and maintenance aborts. At the time of the accident, Air Methods did not require the communication specialist to notify the OCC of fuel-related issues or unplanned deviations. See section 1.6 of this report for further discussion of the OCC.

NTSB Aircraft Accident Report 7 an average ground speed of 111 to 116 knots. The last few minutes of data showed the helicopter in a shallow descent. About 1841, the last satellite tracking system position recorded was about 0.9 nm from the accident site and showed the helicopter was about 373 feet agl with a 116-knot ground speed. Figure 3 shows the last few miles of flight track data.

Figure 3. Flight track of the last few miles of the accident flight showing radar data (red dots) and Air Methods satellite tracking system data (blue dots). There were no witnesses to the accident. When the pilot did not report arriving at GPH, the AirCom communication specialist called the fixed-base operator, and the wreckage was located shortly thereafter in a farm field about 1 nm from the approach end of runway 18 at GPH. 1.2 Wreckage Information As shown in figure 4, the aircraft structure was heavily fragmented and scattered along a 100-foot-long debris path, which was oriented on a heading of about 242°.

NTSB Aircraft Accident Report 8

Figure 4. Photograph of the accident site. The wreckage displayed vertical crush damage consistent with impact at a high rate of descent. The main rotor blades remained attached to the rotor hub, were bent but not twisted, and had minimal leading-edge damage. Similarly, the tail rotor blades exhibited little impact damage and were relatively straight, although one blade was partially separated at the blade root. The damage to the main and tail rotor blades was consistent with a low rotor rpm at impact. The impact signatures to the components of the airframe structure were consistent with the initial impact occurring in a 40° nose-low and slight left-bank attitude, on a heading of about 030° (nearly opposite to the direction of travel). Figure 5 is a diagram illustrating the estimated impact attitude of the helicopter.

NTSB Aircraft Accident Report 9

Figure 5. Diagram showing the estimated impact attitude of the helicopter. There was no postimpact fire. The fuel tank assembly was found intact and located in the midst of the main wreckage. No fuel was observed at the accident site. Less than 1 liter of fuel was found in the fuel tank and lines, which were generally intact. The airframe fuel filter system was examined. No fuel was observed in the lines on the engine side of the filter, and only a residual amount of fuel was observed in the lines on the tank side of the filter. The evidence was consistent with a loss of engine power due to fuel exhaustion occurring shortly before impact. Examination of the engine revealed damage consistent with the engine rotating but not producing power at impact. The axial compressor displayed substantial blade curling and significant foreign object damage, which indicated that the gas generator was rotating at a high rpm at the time of impact. Unmelted aluminum shavings resulting from contact at impact between the rotating axial compressor and the intake plenum were found in the engine’s turbine section, which indicated that the engine was flamed out when impact occurred.14 According to the engine manufacturer, after shutdown, the gas generator speed drops from 97 percent to 30 percent within 5 seconds and to 15 percent after 11 seconds. Because the damage signatures indicated that the gas generator was still rotating at a high rpm at impact, the engine manufacturer estimated that impact must have occurred within the first 10 seconds after flameout.

14 A flameout is a condition in the operation of a gas turbine engine in which the fire in the engine unintentionally goes out. If the engine had been operating normally at impact, the aluminum shavings would have been melted.

NTSB Aircraft Accident Report 10 1.3 Pilot Information The pilot, age 34, held a commercial pilot certificate with rotorcraft-helicopter and instrument-helicopter ratings issued on September 22, 2005. He held a Federal Aviation Administration (FAA) second-class medical certificate with no limitations issued on September 1, 2010. Before he was hired by Air Methods in September 2010, the pilot flew for the US Army, where he was a pilot-in-command (PIC) in the Boeing AH-64 Apache helicopter.15 He had no previous civil commercial flight experience. On the resume that he provided to Air Methods, the pilot indicated that he had 2,071.1 total rotorcraft flight hours, of which 895.1 hours were as PIC and 1,675.4 hours were in twin-engine rotorcraft. Information provided by Air Methods indicated that the pilot accumulated a total of 104 flight hours in the Eurocopter AS350 B2 and 32 flight hours in the Eurocopter AS350 B3 between October 10, 2010, and August 26, 2011. His estimated total rotorcraft flight time at the time of the accident was about 2,207 hours. He flew 18 hours within the 30 days before the accident and 74 hours within the 90 days before the accident. Pilot training records showed that the pilot started his basic indoctrination training with Air Methods on September 13, 2010. After receiving 4.2 hours of flight training, on October 6, 2010, he satisfactorily completed an initial flight evaluation, which encompassed demonstration of current knowledge and competency (14 CFR 135.293), as well as demonstration of operational procedures (14 CFR 135.299). Power failures, autorotations16 to a power recovery (but without a reduction in power), and hovering autorotations (oral only) were performed. He was assigned to the St. Joseph base and completed his base orientation, which included three orientation flights, on October 11, 2010. From March 14 to 16, 2011, the pilot received his initial NVG flight training and recurrent flight training. On March 16, 2011, he satisfactorily completed his most recent annual flight evaluation (14 CFR 135.293 and 135.299) and his NVG proficiency check. In total, the pilot received 12.3 hours of Eurocopter AS350 B2 flight training from Air Methods, and none of this training was conducted in a flight simulator. On April 12, 2011, the pilot received differences training in a Eurocopter AS350 B3. The training was limited to ground training and covered preflight inspections and start procedures. On May 2, 2011, he transferred to Rapid City, South Dakota, where the base helicopter was a Eurocopter AS350 B3. At the time of the accident, the pilot was working at his original base in St. Joseph to help cover a temporary pilot shortage at that location. Since his transfer to Rapid City, he had worked most of his shifts at St. Joseph and had about 10 months of experience in the St. Joseph area.

15 The Boeing AH-64 Apache is a four-blade, twin-engine attack helicopter with a tailwheel-type landing gear arrangement and a tandem cockpit for a two-man crew. 16 An autorotation is the state of helicopter flight where the main rotor system is being turned by the action of air moving up through the rotor rather than engine power driving the rotor. See section 1.7 of this report for more information about autorotation.

NTSB Aircraft Accident Report 11 1.3.1 Work/Rest/Sleep History The pilot’s activities in the days before the accident were reconstructed from electronic records17 and interviews of witnesses. The pilot was off duty for 5 days before the day of the accident. The accident flight was his first flight after returning to duty. On Wednesday, August 24, 2 days before the accident, the pilot began the day at his parents’ home in Lincoln, Nebraska. According to his wife, the pilot departed from his parents’ home on Wednesday evening and spent the night with a friend in Manhattan, Kansas, on the way back to St. Joseph. Cell phone records indicate that the first activity recorded was an outbound text message about 1303, and the last activity recorded was an outbound text message about 2133. On Thursday, August 25, the day before the accident, records indicated that the pilot checked into the layover hotel in St. Joseph about 1423. The pilot was scheduled to attend company training beginning about 1630 (which consisted of annual recurrent aircraft ground training). The pilot’s wife spoke with him twice on Thursday by telephone, soon after he arrived at the hotel and later that evening, and indicated in a postaccident interview that he sounded good. A coworker (an Air Methods communication specialist) also spoke with the pilot by telephone that evening and reported in a postaccident interview that the pilot stated that his training went well. Cell phone records indicate that the first activity recorded was an inbound telephone call (44 seconds in duration) beginning about 1123, and the last activity recorded was an inbound telephone call (115 seconds in duration) ending about 0019 on Friday morning. On Friday, August 26, the day of the accident, the pilot was scheduled to work the day shift from 0630 to 1830. According to his coworker, the pilot would typically awaken about 1 hour before reporting for duty. The departing night shift pilot whom he relieved indicated in a postaccident interview that the accident pilot arrived for work on time, if not early. They spent at least 20 minutes briefing the shift change, and the accident pilot seemed alert. When the mechanic arrived, he encountered the accident pilot, whom he described in a postaccident interview as being in a normal mood, chipper, and ready to go. About 0730, the departing flight nurse encountered the accident pilot and described him as his normal, boisterous self. The pilot’s coworker indicated that during a telephone call about 0830, the pilot stated that he did not sleep well in the hotel and felt tired. About 1200, the accident pilot visited the mechanic in the hangar to ask about progress on the accident helicopter, and the mechanic and pilot walked together to the airport restaurant for lunch. They spoke about football and other general topics during the meal and returned to work about 1245. According to cell phone records, the pilot made and received multiple personal calls and text messages throughout the day. Figures 6a and 6b show the timing of the cell phone calls and text messages with the timing of radio communications and flight activities from 1400 (the time identified by the mechanic as when he and the pilot began the walk-around inspection) until the accident about 1841. Figure 6a, which covers the time period from 1400 to 1700, shows that

17 The pilot’s personal cell phone records were obtained from the cellular service provider. These records included the type of communication (call made, call received, text message sent, text message received), the time the communication began, and the time the communication ended. The records did not include the content of the text messages.

NTSB Aircraft Accident Report 12 during about 20 minutes (1430 to 1450) of the 90-minute time period (1400 to 1530) identified by the mechanic as when the helicopter was being prepared by the pilot and medical crew for its return to service, the pilot sent multiple text messages.

Figure 6a. Timeline of the pilot’s communications from 1400 to 1700. 14:00 14:15 14:30 14:45 15:00 15:15 15:30 15:45 16:00 16:15 16:30 16:45 17:00 R RR R RR R RR RR R R RRR R S SS S S R RR SS R R SS R R S R S R R S R R R R S R R R Phone: 15:52 - 15:53 - Pilot exchanges brief telephone calls with work friend Phone: 16:38 - 16:43 Pilot receives telephone call from work friend Helicopter Inspected and Returned to Service S - Personal text message sent R - Personal text message received Personal telephone call Legend Local Time

NTSB Aircraft Accident Report 13 Figure 6b, which covers the time period from 1700 to the accident, shows that text messages were sent from the pilot’s cell phone during time periods when the helicopter was in flight on the accident leg and the preceding leg and while the helicopter was on the Harrison County Community Hospital helipad.

Figure 6b. Timeline of the pilot’s communications from 1700 to the accident about 1841. 1.4 Helicopter Information The AS350 B2 helicopter was manufactured in France by Eurocopter in 2003 and acquired by Air Methods in 2005. It was equipped for VFR and NVG flights. It was powered by a single free turbine engine and equipped with a three-bladed main rotor system, a two-bladed tail rotor, and a skid-type landing gear. The helicopter’s interior was configured for transport and care of a single patient on a litter-type system installed on the left side of the aircraft. The instrument panel was configured with NVG lighting and filters. At the time of the accident, the helicopter had accumulated about 3,655 flight hours. A review of the helicopter’s maintenance records revealed no evidence of any uncorrected maintenance discrepancies.

Local Time 17:00 17:15 17:30 17:45 18:00 18:15 18:30 18:45 19:00 18:41 Time of Accident St. Joseph to HCMC Flight (17:28-17:58) Accident Flight (18:11-18:41) Radio : 17:20-17:21 - Flight follower calls to confirm weather, then LifeNet accepts the accident trip Radio: 17:29-17:30 - Pilot reports airborne, "two hours of fuel" Phone: 17:59-18:06 - Pilot reports on ground, landed at 17:58, short of fuel Radio: 18:12-18:13 - Pilot reports airborne on accident leg Radio: 18:27 - Flight follower calls to confirm that airport is standing by with fuel R R S S R R S R R S S R R S R S R S R R S - Personal text message sent R - Personal text message received Operationally-relevant telephone call Radio communication S R R R Legend

NTSB Aircraft Accident Report 14 1.4.1 Eurocopter AS350 B2 Fuel System The fuel tank on the Eurocopter AS350 B2 is mounted in the fuselage body structure behind the passenger compartment and below the main transmission deck. It has a capacity of 143 gallons, of which 142 gallons are usable. Fuel is supplied from the fuel tank to the engine through the following components in turn: two booster pumps, a fuel filter, a bypass valve, and an emergency fuel cut-off. The fuel system controls and indicators available to the pilot are a fuel flow control lever, a fuel shutoff lever, a fuel quantity gauge, a fuel pressure gauge, a low fuel level light, a low fuel pressure light, and a fuel filter clogging light. The fuel quantity gauge is mounted at the top of the center instrument panel and indicates the percentage of fuel that is on board. Figure 7 is a diagram of the instrument panel showing the location of the fuel quantity gauge and the low fuel level light.

NTSB Aircraft Accident Report 15

Figure 7. Diagram of the instrument panel, the fuel quantity gauge, and the caution/warning annunciator panel. The low fuel level light is an amber-colored light labeled “FUEL” in the caution/warning annunciator panel located on the upper right portion of the pilot’s instrument panel. The light illuminates when the fuel quantity is below 11 percent (15.8 gallons). According to the Eurocopter AS350 B2 Rotorcraft Flight Manual (RFM), when the light illuminates, the pilot is to “Avoid large attitude changes.” The RFM also states, “Note: Remaining usable fuel allows approximately 18 minutes level flight at maximum continuous power.” According to flight test data provided by Eurocopter, the airspeed in level flight at maximum continuous power would be about 119 knots.

NTSB Aircraft Accident Report 16 1.4.2 Fuel Quantity Calculations The investigation revealed that the helicopter’s fuel was exhausted shortly before impact. Working backwards from this point, the amounts of fuel in the helicopter on departure from the hospital helipad and from STJ were computed. A fuel chart at the St. Joseph base indicated that the fuel burn rate for the helicopter was about 35 percent per hour, which equated to about 50 gallons per hour. Using the 35 percent fuel burn rate, the 30-minute flight from Harrison County Community Hospital to the accident site would consume about 25 gallons of fuel. The 30-minute flight from STJ to Harrison County Community Hospital would also consume about 25 gallons of fuel. Not accounting for fuel consumed during aircraft start sequences, the helicopter had about 50 gallons (35 percent or about 60 minutes) of fuel when it departed STJ. 1.4.3 Engine Failure Emergency Procedure Section 3 of the Eurocopter AS350 B2 RFM provides information regarding helicopter emergencies, the warnings or alerts associated with a particular emergency, and the procedures to follow once the emergency has been identified. The main rotor rpm normal operating range is from 375 to 394 rpm and is represented by a green arc on the dual tachometer on the pilot’s instrument panel.18 Continuous tone audio warnings are provided when rotor rpm is below 360 rpm. Paragraph 3.1 in Section 3.1 of the RFM lists the following symptoms for an engine failure (flameout) in flight:  Jerk in the yaw axis (only in high power flight).  Drop in rotor speed (aural warning sounds below 360 rpm).  Torque at zero.  Ng [gas generator speed] falling off to zero.  Generator warning light illuminates.  Engine oil pressure drop warning light illuminates. Paragraph 2.1 in Section 3.1 of the RFM provides the autorotation procedure to follow in the event of an in-flight engine failure. The first three steps of the procedure are the following:  Set low collective pitch.  Monitor and control rotor rpm.  Establish approximately 65 k[no]t (120 km/hr – 75 mph) airspeed.

18 The dual tachometer is a single gauge that displays both free turbine speed and main rotor rpm.

NTSB Aircraft Accident Report 17 1.5 Tests and Research 1.5.1 Fuel System Component Examination Examination and testing of the helicopter’s fuel tank assembly, the fuel quantity gauge, and the caution/warning annunciator panel were conducted under the supervision of National Transportation Safety Board (NTSB) investigators at American Eurocopter in Grand Prairie, Texas. No preimpact anomalies were identified. The fuel system performed as designed, and the level at which the low fuel level light illuminated was 15 percent or 17.7 gallons, which should have provided the pilot slightly more time before flameout than was indicated in the RFM. The quantity indication provided by the fuel quantity gauge was accurate at all levels. Figure 8 shows a photograph of the fuel system component examination setup.

Figure 8. Photograph of the fuel system component examination setup. An operational check of the caution/warning annunciator panel was performed and revealed that all lights were working properly. Examination of the individual light bulb filaments revealed that the filaments for both bulbs from the low fuel level light exhibited slightly stretched coils consistent with the light being illuminated at the time of impact.

NTSB Aircraft Accident Report 18 The brightness switch on the caution/warning annunciator panel was found on the dim setting at the accident site. During the examination, the panel was illuminated in daylight conditions and observed in both bright and dim settings. With the panel in the dim position, only the low fuel pressure light (the only light that does not convert to the dim setting by design) was conspicuously illuminated. It was not possible to determine whether the panel was switched to the dim setting during the previous NVG training flight and never returned to bright for the accident flight, whether the panel was switched to the dim setting during the accident flight, or whether this setting occurred during impact. 1.5.2 Certification Flight Tests for Controllability Following Engine Failure The controllability requirements following engine failure for normal-category rotorcraft, such as the Eurocopter AS350 B2, are specified in 14 CFR 27.143(d), which states, in part, the following: The rotorcraft, after…complete engine failure…, must be controllable over the range of speeds and altitudes for which certification is requested when such power failure occurs with maximum continuous power and critical weight. No corrective action time delay for any condition following power failure may be less than – (i) For the cruise condition, one second, or normal pilot reaction time (whichever is greater); and (ii) For any other condition, normal pilot reaction time. FAA Advisory Circular (AC) 27-1B, “Certification of Normal Category Rotorcraft” (FAA 2008a), provides an acceptable method for demonstrating compliance with the regulatory requirements in 14 CFR Part 27. Regarding 14 CFR 27.143(d), the AC states, in part, the following: The corrective action time delay for the cruise failure should be 1-second or normal pilot reaction time (whichever is greater). Cyclic and directional control motions which are a part of the pilot task of flight path control are normally not subject to the 1-second restriction; however, the delay is always applied to the collective control for the cruise failure. If the aircraft flying qualities and cyclic trim configuration would encourage routine release of the cyclic control to complete other cockpit tasks during cruise flight, consideration should be given to also holding cyclic fixed for the 1-second delay. Although the same philosophy could be extended to the directional controls, the likelihood of the pilot having his feet away from the pedals is much lower, unless the aircraft has a heading hold feature. Review of reports documenting the flight tests performed by Eurocopter to demonstrate compliance with 14 CFR 27.143(d) revealed that for the Eurocopter AS350 B1,19 the test at

19 According to Eurocopter, the AS350 B1 data from this test are applicable to the AS350 B2 because the B1, the B2, and subsequent variants are all equipped with the same main rotor blades.

NTSB Aircraft Accident Report 19 maximum continuous power in level flight was at an airspeed of 119 knots, close to the 115-knot airspeed estimated for the accident scenario. In this test, following the simulated engine failure, the test pilot immediately applied left pedal, waited about 1 second, applied down collective, and about .5 second later applied aft cyclic. The rotor rpm dropped about 50 rpm, from 394 rpm to a minimum of about 345 rpm about 3 seconds after the simulated engine failure, and then began to increase. 1.5.3 Simulator Flight Evaluations Simulator demonstrations of autorotations in various profiles were conducted using Eurocopter’s full-motion AS350 simulator, certified to FAA level B standards.20 When an unannounced loss of power was initiated about 275 feet agl and 115 knots,21 the simultaneous application of down collective and aft cyclic within about 1 to 2 seconds resulted in a successful autorotation entry with an average time of about 25 seconds between the unannounced loss of power and touchdown. In contrast, if these flight control inputs were not made within about 1 to 2 seconds, the helicopter’s nose dropped, the rotor rpm decayed rapidly, and the helicopter impacted terrain about 4 to 5 seconds after the unannounced loss of power. It was observed that the simultaneous application of down collective and aft cyclic was required to maintain rotor rpm and execute a successful autorotation. 1.6 Company Information Air Methods is a commercial on-demand air taxi operator specializing in helicopter emergency medical services (HEMS). The company was established in 1980 in Colorado and currently serves 48 states with nearly 4,000 employees. It is the largest provider of air medical emergency transport services throughout the United States. In 2012, Air Methods flew 158,263 air medical flight hours and conducted 118,068 patient transports. Over the last 15 years, Air Methods acquired the following HEMS operations: Mercy Air Service (1997), ARCH (2000), Rocky Mountain Holdings (2002), CJ Systems (2007), and Omniflight (2011). Air Methods acquired LifeNet in the Heartland as part of its acquisition of Rocky Mountain Holdings. Air Methods provides air medical emergency transport services under three separate operating models: the community-based model, the hospital-based model, and the

20 Flight simulators are certified by the FAA at levels A through D, with level D being the highest or most realistic. The FAA allows a level B simulator to be used for training and evaluating the in-flight maneuver “power plant failure – single engine helicopter.” 21 NTSB investigators estimated that the accident helicopter was at an altitude of about 275 feet agl and an airspeed of about 115 knots when the engine flamed out.

NTSB Aircraft Accident Report 20 alternative delivery model.22 The St. Joseph base operates as a community-based model in which EMS helicopters and their crews receive flight requests through AirCom in Omaha, Nebraska. AirCom is an EMS communications center staffed with communications specialists, who are not certified aircraft dispatchers. The AirCom communication specialist receives the request for services from the local/state-operated dispatch system, notifies the pilot of the services request, enters the flight plan into the computer system, coordinates the patient transfer with the requesting agency and receiving hospital, and provides flight following services. Once a mission is in progress, the communication specialist communicates with the pilot through the aircraft radios when the helicopter is in flight and through the pilot’s company-issued cell phone when the helicopter is on the ground. When AirCom enters a flight plan into the system, the Air Methods OCC in Englewood, Colorado, is automatically notified via computer. The OCC performs flight monitoring and ongoing risk assessment for all Air Methods’ aircraft (regardless of operating model), and a computer system monitors the positions of the aircraft. The OCC can issue advisories/alerts that may include, but are not limited to, flying in the vicinity of marginal or deteriorating weather conditions, temporary flight restrictions, ground proximity, or any other significant occurrences that could become a flight hazard. All alerts are communicated to the pilot or the appropriate communication specialist responsible for flight following. The OCC communicates to Air Methods aircraft through the AirCom communication specialist or through a hands-free satellite communication system (Skyconnect) that is built into the aircraft’s instrument panel. The OCC is also responsible for initiating and managing the Air Methods postaccident/incident response plan. An experienced EMS helicopter pilot is always on duty in one of the two OCC workstations as a central contact point for pilots to discuss operational concerns (such as launch decisions due to developing weather). At the time of the accident, Air Methods had an operational risk assessment program that required the pilot to use a risk assessment matrix when deciding to accept or decline a flight assignment. According to the GOM, the matrix-determined risk category was to be recorded in the daily flight log and reported to AirCom. As shown in figure 9, there were two matrixes: one for day operations and one for night operations.

22 In the community-based model, Air Methods provides the community with the aircraft, pilots, mechanics, medical crew, medical direction, communications, marketing, EMS licensure, and patient billing and collection. In the hospital-based model, the hospital owns the program and provides the medical personnel, medical direction, communications functions, and patient billing and collection, while Air Methods provides aircraft operation and maintenance. In the alternative delivery model, Air Methods receives support from its partner in medical staffing, medical direction, and marketing, and Air Methods provides the aircraft, pilots, mechanics, communications, billing and collections, and EMS licensure.

NTSB Aircraft Accident Report 21

Figure 9. Air Methods flight risk assessment risk matrixes at the time of the accident. Each matrix identified the categories of risk as green (A-normal operation), blue (B-caution), yellow (C-extreme caution), and orange (D-critical decision to be made). The pilot used weather criteria and cross referenced with aircraft status, environment specifics, and fatigue to determine the risk category. The risk factors listed in the risk assessment matrixes did not include any reference to fuel. The GOM stated that the matrixes “are not intended to make the [launch] decision for the pilot and do not list every possible risk factor that may be encountered for a particular flight assignment, but are to be used as a tool to assist the pilot in identifying,

NTSB Aircraft Accident Report 22 assessing, and managing risks.” (Emphasis in the original) The matrixes did not include a risk threshold that triggered mandatory consultation with the OCC or managers, such as the chief pilot. During both the accident flight and the preceding flight, the pilot reported to AirCom a risk assessment value of blue. Review of the matrix for day operations indicated that the likely reason for the blue value was the applicability of the fatigue risk factor “late in shift.” According to Air Methods operational personnel, a risk assessment value of blue was common. 1.7 Autorotation Guidance The FAA’s Helicopter Flying Handbook, Chapter 2, “Aerodynamics” (FAA 2012a), explains that in normal, powered flight, air is drawn into the main rotor system from above and exhausted downward but, during autorotation, air moves up into the rotor system from below as the helicopter descends. Figure 10, which is included in the handbook, illustrates the difference in airflow.

Figure 10. Airflow through the main rotor system during normal, powered flight and during autorotation. Chapter 2 does not provide any information about how the transition from normal, powered flight to autorotation should be made. Chapter 11, “Helicopter Emergencies,” states that the most common reason for an autorotation is engine failure and provides the following information about how the pilot should react to an engine failure: At the instant of engine failure, the main rotor blades are producing lift and thrust from their angle of attack…and velocity. By lowering the collective pitch, which must be done immediately in case of an engine failure, lift and drag are reduced, and the helicopter begins an immediate descent, thus producing an upward flow of air through the rotor system. This upward flow of air through the rotor provides sufficient thrust to maintain rotor rpm throughout the descent. Since the tail rotor is driven by the main rotor transmission during autorotation, heading control is maintained with the antitorque pedals as in normal flight.

NTSB Aircraft Accident Report 23 The handbook does not contain any further information regarding the procedure for entering an autorotative descent.

The FAA’s Helicopter Instructor’s Handbook (FAA 2012b) recommends that to help students better understand autorotation, the instructor should divide it into four distinct phases: entry, steady-state descent, deceleration, and touchdown. Regarding the entry phase, the handbook states, in part, the following: Guide the student through the entry or first stage of autorotation and explain that this phase is entered after loss of engine power. The loss of engine power and rotor rpm are more pronounced when the helicopter is at high gross weight, high forward speed, or in high density altitude conditions. Any of these conditions demand increased power (high collective position) and a more abrupt reaction to loss of that power. In most helicopters, it takes only seconds for rpm decay to bring rpm to a minimum safe range, requiring a quick collective response from the pilot. The entry into autorotation must be immediate and smooth by lowering the collective, adjusting the pedals for the loss of torque, and adjusting the airspeed for the proper glide angle. A reprint of the US Army Field Manual 1-51, Rotary Wing Flight (Ean 1987), states that autorotations may be divided into three distinct phases: the entry, the steady-state descent, and the deceleration and touchdown. Regarding the entry phase, in addition to information similar to that contained in the FAA’s Helicopter Instructor’s Handbook, the manual states, in part, that “A cyclic flare[23] will help prevent excessive rpm decay if the [engine] failure occurs at high speed. This technique varies with the model helicopter. Pilots should consult and follow the appropriate aircraft Operator’s Manual.” Because a cyclic flare tilts the main rotor system aft so that the oncoming air is flowing upward through the rotor blades, it rapidly produces the upward flow of air necessary for an autorotation.

23 A cyclic flare is the use of aft cyclic to increase the helicopter’s pitch attitude.

NTSB Aircraft Accident Report 24

1. Investigation and Analysis
2. 1 General

The pilot and the helicopter were properly certified for the 14 CFR Part 135 HEMS flight. Wreckage examination determined that the helicopter’s engine lost power due to fuel exhaustion. Testing also determined that the helicopter’s fuel system, including the fuel quantity gauge and the low fuel level light, were operating properly. 2.2 Pilot’s Actions During Preflight and Departure for the Hospital The pilot missed three discrete opportunities to identify that the helicopter had inadequate fuel to complete the assigned mission. First, a preflight inspection was required before departing on the mission. This inspection was normally performed when the pilot first started his shift. However, in the event of a helicopter change-out, the inspection would be performed before the new helicopter was returned to active status. Because no witness observed the pilot performing a preflight inspection of the accident helicopter, it is uncertain whether he performed one. Company procedures for performing a preflight inspection required the pilot to confirm that there was an adequate quantity of fuel on board by turning on the helicopter’s master electrical switch and observing the fuel quantity gauge. Postaccident testing showed that the gauge was operating correctly and should have accurately displayed the helicopter’s fuel state, about half of the normal 2-hour fuel load, which the pilot should have recognized and corrected. Because the pilot did not recognize the helicopter’s low fuel state, he likely performed an incomplete preflight inspection. Additional items indicating that the pilot’s preflight inspection was not properly completed were his noncompliance with standard operating procedures that required him to initial the mechanic’s CYA entries, sign the daily flight log to confirm completion of the preflight inspection, and take a fuel sample from the helicopter. The pilot’s second missed opportunity was immediately before the flight to Harrison County Community Hospital began when he should have completed the before-takeoff confirmation checklist, which included checking the fuel quantity.24 The pilot’s third missed opportunity occurred when his posttakeoff status report made about 1730 required him to report the fuel level to the communication specialist using the gauge in the cockpit25 and he incorrectly reported that he had 2 hours of fuel. It is unlikely that the pilot deliberately misreported the

24 The Air Methods GOM, page B-7/R-5/01-15-11, states, “A before start/before takeoff confirmation checklist will be provided and affixed to each instrument panel in plain view of the pilot. The confirmation checklist will include essential items that will be confirmed by the pilot before each start and takeoff. Prior to start and liftoff each pilot will verbally challenge him or herself and respond verbally to each item on the confirmation checklist to ensure that each item is complete.” 25 The Air Methods GOM, page B-14/R-4/11-09-09, states, “When an aircraft lifts off for an assigned flight, the pilot or their designee will provide the communications specialist the number of people on board, fuel load remaining in flight time (hours and minutes), destination, ETA [estimated time of arrival], and risk assessment value.”

NTSB Aircraft Accident Report 25 fuel level because Jet-A fuel was available at the takeoff airport, and the pilot could have had fuel added without difficulty or penalty. It also seems unlikely that the pilot repeatedly misread the gauge indication, especially given the obvious difference in visual indication between the actual level (35 percent) and the reported level (70 percent). Rather, the pilot’s erroneous report can be related to a deviation from the informal refueling practices used at the St. Joseph base. Helicopters at the St. Joseph base were normally refueled to about 70 percent following each mission. However, the accident helicopter was returned after an NVG training flight the previous night with only about 35 percent fuel. Although the pilot had been advised during the shift change briefing about 0630 that the helicopter was low on fuel, it is possible that he forgot about this communication during the intervening 11 hours before the first leg of the mission, in which case he might reasonably have expected the normal 70 percent level for an active helicopter; such an expectation would be consistent with the incorrect fuel status report he provided after takeoff. Also, consistent with what the pilot subsequently stated, he had performed a preflight inspection on the earlier active helicopter (N101LN), and it was fueled to 70 percent. Past NTSB investigations (NTSB 2013) have identified instances in which pilots made callouts without first verifying the cockpit indication that corresponded with the callout. Therefore, it is likely that the pilot reported the fuel he expected to be in the helicopter without effectively referencing the fuel gauge.26 The NTSB concludes that although the helicopter’s low fuel state was clearly indicated, the pilot missed three opportunities to detect the condition: (1) before departing on the first leg of the mission as a result of his inadequate preflight inspection, (2) before takeoff by failing to properly complete the before-takeoff confirmation checklist, and (3) after takeoff when he erroneously reported the fuel level. 2.3 Pilot’s Decision to Continue the Mission After reaching Harrison County Community Hospital, the pilot contacted the communication specialist via his company-provided cell phone while waiting for the patient to be loaded into the helicopter, admitted that he had made a mistake and was short of fuel, and requested help locating a nearby fuel option. The pilot did not report and the communication specialist did not ask how much fuel was on board the helicopter. When asked by the communication specialist if he could complete the estimated 34-minute flight to Liberty Hospital before obtaining fuel, the pilot replied that he would probably need to stop en route for fuel. After they determined that the only airport with Jet-A fuel available along the flight route to Liberty Hospital was GPH and estimated that the flight to GPH would be about 2 minutes shorter than the direct flight to Liberty Hospital, the pilot announced his intention to proceed with the mission and to obtain fuel at GPH while en route with the patient on board. However, the pilot’s plan was highly risky because of the limited fuel on board. Further, the plan did not meet minimum fuel requirements for Part 135 operations, which required a minimum of 20 minutes of reserve fuel to launch on a flight. The difference between the actual fuel situation (30 minutes or about 18 percent) and the fuel the pilot reported in his

26 Regarding the posttakeoff report, there is laboratory and operational evidence that pilots can misperceive important information that is plainly visible especially when they have strong conflicting expectations and are engaged in tasks involving selective attention (NTSB 2007).

NTSB Aircraft Accident Report 26 posttakeoff report (45 minutes or about 26 percent) corresponded to a difference of about one marked increment on the fuel quantity gauge and should have been apparent to the pilot as he waited on the ground and considered his abnormal fuel situation.27 Further, the difference between the actual fuel situation and the minimum fuel required for the trip (52 minutes based on the estimated time en route to GPH of 32 minutes) was even greater. Therefore, the pilot almost certainly knew that he did not have the required fuel reserve and misrepresented his fuel situation in his posttakeoff report because he wanted to give the appearance of compliance with the 20-minute fuel reserve requirement. The pilot undoubtedly knew that his decision to proceed with the mission was risky, and company personnel uniformly reported that the pilot could have aborted the mission at Harrison County Community Hospital without fear of serious negative consequences from the company. This raises questions about the reasons for the pilot’s decision to proceed. The pilot was new to the company and might have been concerned that aborting the mission as a result of an error during preflight preparation would negatively affect others’ perceptions of his reliability as an employee. In addition, aborting the mission would likely have involved inconveniences (such as waiting at the hospital for fuel to be delivered) that the pilot probably preferred to avoid. Finally, he might have been influenced by time pressure associated with the urgency of the patient’s medical condition and the implications of a delay in treatment. Although the pilot did not express such concerns during any recorded communication, such concerns have played a role in past safety-related incidents involving EMS flights (Connell and Reynard 1995). At the very least, the pilot would have expected that aborting the mission would result in some degree of discomfort for him and the patient. The NTSB concludes that the pilot departed on the second leg of the mission despite knowing that the helicopter had insufficient fuel reserves likely in order to avoid delays and other possible negative outcomes that could have resulted from aborting the mission. During the accident flight, the pilot was likely monitoring the fuel gauge closely and watching the fuel level decrease. As he approached GPH, the indicated fuel level would have approached zero. This might have prompted the pilot to consider landing the helicopter somewhere off-airport as a precautionary measure. However, by the time the fuel gauge was near zero, the airport was in sight and the pilot was very close to successfully concluding the flight, and he may have been reluctant to land because it would have revealed his noncompliance with the 20-minute fuel reserve requirement. The pilot’s decision to continue the flight rather than make a precautionary landing, despite mounting evidence that fuel exhaustion was imminent, was a decision error. The FAA’s Risk Management Handbook (FAA 2009) calls this type of decision error “get-there-itis” and describes it as an error in which “personal or external pressure clouds the vision and impairs judgment by causing a fixation on the original goal or destination combined with a total disregard for alternative course of action.” Human factors researchers (Orasanu, Martin, and Davison 2001), who call this type of error “plan continuation error,” have postulated various causes for it and determined that it is more likely to occur near the end of a flight. The NTSB concludes that self-induced pressure likely caused the pilot to fixate on his

27 The fuel quantity gauge, which was readable by turning on the master switch, was marked in increments of 10 percent. A reading of 18 percent would be slightly below the increment representing 20 percent, and a reading of 26 percent would be between the increments representing 20 percent and 30 percent.

NTSB Aircraft Accident Report 27 intended refueling point and continue the flight rather than make a precautionary landing as the fuel gauge indication approached zero. 2.4 Pilot Human Factors There was no evidence that the pilot performance deficiencies observed in the accident were common in company operations or consistent with company policy. Rather, the company had formal operational procedures, including the completion of a preflight inspection and use of the before-takeoff checklist that, if complied with, would have led the pilot to detect the helicopter’s low fuel level before departing on the first leg of the mission. The pilot had previously served as a military helicopter pilot, was highly regarded by operational and training personnel at the company as very professional and competent, and had no history of previous violations or training/operational difficulties. 2.4.1 Distraction Due to Text Messaging During Flight and Ground Operations Personal issues in the pilot’s life might have been a source of distraction. His wife was pregnant with their first child, his father had recently undergone cardiac surgery, and he had recently moved to a new city but was still commuting to his old base in St. Joseph. In addition, on the day of the accident, he was making social plans to meet his coworker for dinner after his work shift. During his shift, the pilot needed to focus his attention away from personal issues when performing safety-related tasks, but at such times, both before departure and during the mission, he engaged in personal texting activities. The mechanic who reconfigured the accident helicopter finished his work and performed a walk-around inspection with the pilot about 1400. The pilot was required to perform a preflight inspection of the helicopter after the mechanic finished reconfiguring the helicopter and before it was returned to service. The helicopter was returned to service about 1530; therefore, the pilot should have performed the preflight inspection sometime between 1400 and 1530. However, as previously discussed, the pilot completed no preflight inspection or performed an incomplete preflight inspection as indicated by his lack of awareness of the helicopter’s low fuel state before beginning the mission and the fact that he did not sign off the CYA entries and daily flight log. According to Air Methods, a preflight inspection of the accident helicopter would have taken 15 or 20 minutes, so the pilot had ample time to perform a complete preflight inspection before the helicopter was returned to service; the pilot’s oversight in this area represented noncompliance with company standard operating procedures. Colleagues spoke positively about the pilot’s job performance and provided no indication that he was habitually noncompliant; therefore, this oversight seemed out of character for him. It is possible, therefore, that the pilot unintentionally overlooked part or all of the preflight inspection that was required for the helicopter’s return to service. The NTSB examined the pilot’s personal cell phone records to see whether distraction caused by the pilot’s personal electronic communications could have played a role in his

NTSB Aircraft Accident Report 28 incomplete preflight inspection. The pilot received frequent text messages between 1406 and 1455, a substantial portion of the time period when the helicopter was being prepared for its return to service. However, the pilot only responded to these texts between 1430 and 1450. Therefore, personal electronic communications did not necessarily preclude the performance of a complete preflight inspection, but they could have distracted the pilot. The change in helicopters caused a break in routine that could also have played a role in the pilot’s incomplete preflight inspection. The disruption caused by the change-out would have required the pilot to think purposefully about the actions that he needed to accomplish, and periodic interruptions of his attention caused by text messaging activity could have resulted in his forgetting about tasks that he had not yet completed. Moreover, the effect of such interruptions on the pilot’s memory could have been exacerbated by fatigue, as discussed in section 2.4.2 of this report. According to a 2000 study of voluntary aviation safety reports, errors of omission make up 44 percent of the errors reported by crewmembers (Sarter and Alexander 2000). Such errors typically result from lapses of attention stemming from the interruption of a task by someone else in the cockpit and the subsequent forgetting of the overlooked action. Such findings have been used to justify the need for sterile cockpit requirements when an aircraft is being operated.28 Further, they suggest that interruptions could also play a role in lapses of attention that occur when safety-critical activities are performed at other times, such as during preflight preparation or predeparture checks. In this accident, the pilot engaged in nonoperational use of his personal cell phone when the helicopter was being prepared for return to service. Although this activity did not prevent the performance of a thorough preflight inspection, it was a source of distraction that increased the risk of lapses of attention and errors of omission, which did, in fact, occur. Therefore, it is possible that the pilot’s nonoperational use of a portable electronic device (PED) contributed to his lack of awareness of the helicopter’s abnormally low fuel state. Company procedures prohibited pilots from using or turning on cell phones during active flight operations.29 The overlay of the pilot’s personal cell phone records, however, indicates that he sent one text message during the first leg of the mission and three during the accident flight. Moreover, based on the pilot’s report to the communication specialist that he recognized the helicopter’s low fuel state about halfway to Harrison County Community Hospital, all of these in-flight messages were sent after the pilot became aware of the helicopter’s low fuel state. The last outgoing text was sent about 20 minutes before the accident, and the pilot did not respond to two incoming text messages sent 15 and 11 minutes before the accident. Therefore, there is no evidence that the pilot’s airborne texting activities directly affected his response to the engine failure. However, the personal texting activities would have periodically diverted the pilot’s attention from flight operations and aeronautical decision-making. At a minimum, the

28 Sterile cockpit requirements are described in 14 CFR 121.542 and 135.100. 29 The Air Methods GOM, page B-7/R-5/01-15-11, states, in part, “In compliance with FCC [Federal Communications Commission] regulations, the PIC shall not allow cellular phones to be used or turned on during ground operations (including taxi and hover operations), takeoff, enroute, approach, and landing. Use of cellular phones while the aircraft is on the ground, not in motion, is acceptable provided it does not interfere with onboard navigation and/or communication equipment.”

NTSB Aircraft Accident Report 29 pilot’s attention would be diverted for the amount of time it took to read and compose messages. Further, from a control usage standpoint, to send a text, the pilot would require at least one hand to be temporarily removed from active control of the helicopter.30 Perhaps of equivalent concern, cell phone records indicate that the pilot exchanged an additional three text messages while he was on the ground between flights waiting for the patient to be loaded into the helicopter. As previously stated, the pilot was working with the communication specialist during this period to address the abnormal low fuel situation and needed to make a critical launch decision. Careful attention and conscientious problem solving were needed and should have led him to seek additional operational guidance from the company and to reject the launch due to insufficient fuel. Instead, he devoted a portion of the available time to personal texting. The pilot’s personal texting activities were a source of distractions and interruptions. Distractions and interruptions decrease cognitive capacity, reduce the processing of potentially relevant information, and can cause information in working memory to be confused or forgotten. These effects degrade performance of complex tasks and increase the likelihood of decision errors. Time pressure, which the pilot faced when deciding to continue the mission, can exacerbate this effect by restricting opportunities to weigh potentially relevant cues and consider alternative courses of action (Speier, Vessey, and Valacich 2003). Thus, the pilot’s personal texting activities likely degraded his decision-making performance when he decided to continue the mission. The NTSB concludes that the pilot’s texting, which occurred (1) while flying, (2) while the helicopter was being prepared for return to service, and (3) during his telephone call to the communication specialist when making his decision to continue the mission, was a self-induced distraction that took his attention away from his primary responsibility to ensure safe flight operations. Further, although there is no evidence that the pilot was texting at the time of the engine failure, his texting while airborne violated the company’s cell phone use policy. Following the accident, Air Methods modified its policy on the use of cell phones.31 The new policy states, in part, the following: In compliance with FAA regulations and to prevent distractions, the PIC shall not allow cellular phones/portable electronic devices to be used or turned on during ground operations including taxi and hover operations, takeoff, enroute, approach, and landing… In the interest of safety, this is a zero tolerance policy. This includes use of cellular phones and/or electronic tablets for verbal communications, sending or receiving electronic communications such as email, instant messages, or text messages while in flight and aboard an aircraft owned or operated by Air Methods.

30 The helicopter was equipped with a collective friction lock that could be engaged in flight to hold the collective lever in a fixed position and allow temporary removal of the pilot’s left hand from the collective in order to perform tasks such as changing radio frequencies and adjusting instruments. 31 On December 3, 2012, Air Methods provided a party submission to the NTSB that included a list of its postaccident actions.

NTSB Aircraft Accident Report 30 Additionally, Air Methods published an article in the August 2012 issue of the company’s monthly safety publication, Safety Connect, reiterating the company’s zero tolerance policy on in-flight cell phone use. Air Methods postaccident policy explicitly prohibits the use of cell phones and other PEDs in flight. However, this accident shows that the use of PEDs can also create distraction during safety-critical ground activities. Therefore, the NTSB recommends that Air Methods expand its policy on PEDs to prohibit their nonoperational use during safety-critical ground activities, such as flight planning and preflight inspection, as well as in flight. The NTSB has previously addressed the importance of providing explicit guidance to pilots prohibiting the use of personal PEDs. As a result of the NTSB’s investigations of both the October 21, 2009, incident of Northwest Airlines flight 18832 that overflew its destination of Minneapolis, Minnesota, because the flight crewmembers were distracted, in part, by their use of personal laptop computers and the February 12, 2009, crash of Colgan Air Continental Connection flight 3407 while on approach to Buffalo-Niagara International Airport, Buffalo, New York (NTSB 2010b), on February 23, 2010, the NTSB issued Safety Recommendation A-10-30. This recommendation asked the FAA to “require 14 Code of Federal Regulations Part 121, 135, and 91K operators to incorporate explicit guidance to pilots, including checklist reminders as appropriate, prohibiting the use of personal portable electronic devices on the flight deck.” On April 26, 2010, the FAA issued Information for Operators (InFO) 10003, “Cockpit Distractions” (FAA 2010), which emphasized that using PEDs was a safety risk. On March 7, 2012, the FAA stated to the NTSB that it did not plan to take any further action because current regulations prohibited the use of PEDs. The FAA believed that issuance of the InFO provided the appropriate information to Part 121, 135, and 91 subpart K operators about these regulations and that checklist reminders were not necessary. On June 14, 2012, the NTSB replied that regulations, as well as company policy, in effect at the time of the Colgan Air Continental Connection flight 3407 accident prohibited the use of PEDs. However, the NTSB noted that InFO 10003 contained no mention of checklist reminders, as specified in the recommendation, and that an InFO is a guidance document, not a regulation. Because the FAA indicated that its actions were complete and that it did not plan to take any additional action, the NTSB classified Safety Recommendation A-10-30 “Closed—Unacceptable Action.” On January 15, 2013, the FAA issued a notice of proposed rulemaking (NPRM), “Prohibition on Personal Use of Electronic Devices on the Flight Deck” (Federal Register 2013, 2912), that proposed a requirement to prohibit flight crewmembers in Part 121 operations from using a personal wireless communications device or laptop computer for personal use while at their duty station on the flight deck while the aircraft is being operated. The NPRM stated that the prohibition would commence at “taxi (movement of the aircraft under its own power)” and end when “the aircraft is parked at the gate at the end of the flight segment.” In its comments on the NPRM submitted to the FAA on March 12, 2013, the NTSB stated that it was pleased with the FAA’s proposed rulemaking. However, the NTSB indicated that contrary to the broad scope of Safety Recommendation A-10-30, the proposed rule would

32 More information about this incident, NTSB case number DCA10IA001, is available online at http://www.ntsb.gov/aviationquery/index.aspx.

NTSB Aircraft Accident Report 31 only affect pilots operating under 14 CFR Part 121. The NTSB noted that pilots using PEDs while operating under Parts 135 and 91 subpart K are equally susceptible to the potentially catastrophic consequences of distraction, and their passengers are all placed at risk. The NTSB indicated that it believes that the FAA should expand the proposed rule to Part 135 and 91 subpart K operations to more broadly and effectively address this issue within the industry. This accident clearly demonstrates that expansion of the FAA’s proposed rule on PED use to 14 CFR Part 135 and 91 subpart K operations is warranted. Therefore, the NTSB recommends that the FAA prohibit flight crewmembers in 14 CFR Part 135 and 91 subpart K operations from using a PED for nonoperational use while at their duty station on the flight deck while the aircraft is being operated. Further, because this accident shows that nonoperational use of PEDs can be a distraction during safety-critical, not-in-motion ground operations, the NTSB recommends that the FAA require all 14 CFR Part 121, 135, and 91 subpart K operators to incorporate into their initial and recurrent pilot training programs information on the detrimental effects that distraction due to the nonoperational use of PEDs can have on performance of safety-critical ground and flight operations. Also, the NTSB recommends that the FAA require all 14 CFR Part 121, 135, and 91 subpart K operators to review their respective GOMs to ensure that procedures are in place that prohibit the nonoperational use of PEDs by operational personnel while in flight and during safety-critical preparatory and planning activities on the ground in advance of flight. 2.4.2 Fatigue Fatigue was evaluated as a potential factor in degrading the pilot’s performance. On the night before the accident, records indicated that the pilot participated in a telephone call that ended about 0019. Therefore, the pilot was active past his preferred bedtime of 2200 to 2300, and, assuming he woke up about 0530 (1 hour before his shift started), his uninterrupted sleep potential was likely limited to no more than about 5 hours. According to a 2003 study of performance degradation due to sleep restriction, 3 hours of sleep loss (5 hours obtained) in one night is sufficient to degrade vigilance performance and increase reaction time (Belenky and others 2003). On the morning of the accident, the pilot stated in a telephone conversation that he did not sleep well and felt tired. Evidence indicates that the pilot was active all day with limited opportunity for rest.33 He had been on duty about 12 hours at the time of the accident, a duration associated with increased cockpit errors (Goode 2003), and awake more than 13 hours, a threshold also associated with increased errors (Dawson and Reid 1997). Further, the pilot needed to complete the preflight inspection of the helicopter between 1400 and 1530, and research indicates that due to circadian and other factors, the midafternoon period can be associated with reduced levels of alertness. Fatigue degrades decisions involving unexpected situations or plan revision and decreases the ability to deal with distractions and communicate effectively (Harrison and Horne 2000). Effects of fatigue on performance include increased lapses (errors of omission), increased perseveration on ineffective solutions, and increased reaction times (Dinges 1996). The pilot

33 According to the cell phone records, calls were made from the pilot’s cell phone about 0811, 0822, 0841, 0901, 1112, 1204, 1330, and 1552. Text messages were sent from the pilot’s cell phone about 0853-0857, 0922-1057, 1130, 1147-1158, 1356, 1430-1450, 1621-1635, 1655, 1719-1722, 1746, and 1802-1822.

NTSB Aircraft Accident Report 32 clearly demonstrated performance deficits in two areas: errors of omission (neglecting to refuel the helicopter and check the fuel gauge before departure) and perseveration on ineffective solutions (continuing the mission after discovering he had insufficient fuel). Additionally, he may have displayed increased reaction time when responding to the loss of engine power; however, this could not be confirmed because the lack of a recording device precluded determination of the timing of the pilot’s control inputs. The pilot’s demonstrated performance deficiencies were consistent with known effects of fatigue. Further, interviews with coworkers indicated that such deficiencies were uncharacteristic of his performance. The NTSB concludes that because of restricted sleep the night before the accident, the timing of his operational activities, and the nature of the pilot’s errors, which were uncharacteristic of his performance, the pilot was experiencing fatigue, which likely degraded his performance. The fact that the pilot reported for duty and completed his shift despite not sleeping well and feeling fatigued raises concern about the policies and training Air Methods used to combat the effects of fatigue on pilot performance and safety in the company’s flight operations. The company’s GOM (page B-15/R-5/01-15-11) states that pilots were expected to “report for duty with the appropriate rest and be capable of performing the functions of a flight crewmember,” but it did not contain a policy describing what pilots should do if they had been unable to obtain adequate rest or felt fatigued. However, the company provided training on causes of fatigue, performance-related effects of fatigue, and fatigue countermeasures during initial and recurrent pilot ground training. The company also provided rest facilities at its pilot bases and encouraged pilots to nap during their work shift if they felt tired. In addition, the lead pilot at the company’s St. Joseph base said that he had turned down a flight due to fatigue on one occasion and company managers had been accepting of his decision. Further, the company included fatigue risk factors in the risk assessment matrixes used by its pilots when deciding to accept or decline a flight assignment. As of March 22, 2013, federal regulations require flight crewmembers operating under 14 CFR Part 135 to complete initial crew resource management (CRM) training, and operators are required to have a CRM training program with both initial and recurrent training modules. These modules must contain material addressing the effects of fatigue on performance, fatigue avoidance strategies, and fatigue countermeasures. Although Air Methods did not address fatigue-related issues in detail in its CRM training provided to pilots at the time of the accident, it did cover this information in other training modules. Thus, because Air Methods was already covering much, if not all, of the required material, the company will likely be able to comply with the new training requirement through slight reorganizations of its training program. The pilot had completed the Air Methods initial pilot training program and had therefore been exposed to the company’s fatigue-related training material. Presumably, he was familiar with the effects of fatigue on performance, fatigue avoidance strategies, and fatigue countermeasures. He did not have the benefit of a clear company policy encouraging him to go off-duty if he felt fatigued. However, company pilots and other personnel indicated that the company was supportive of safety-oriented decisions and that pilots were unlikely to be questioned if they occasionally turned down a flight due to fatigue. Therefore, although the company’s policies could be improved, it appears that the pilot had received appropriate training on fatigue-related issues and that he did not accept the accident flight while fatigued because of pressure from company managers.

NTSB Aircraft Accident Report 33 The NTSB has previously addressed the need for operator policies allowing crewmembers to decline flying assignments due to fatigue by issuing Safety Recommendations A-08-19 and -20, which asked the FAA to do the following: In cooperation with pilot unions, the Regional Airline Association, and the Air Transport Association, develop a specific, standardized policy for 14 Code of Federal Regulations Part 121, 135, and Part 91 subpart K operators that would allow flight crewmembers to decline assignments or remove themselves from duty if they were impaired by a lack of sleep. (A-08-19) Once the fatigue policy described in Safety Recommendation A-08-19 has been developed, require 14 Code of Federal Regulations Part 121, 135, and Part 91 subpart K operators to adopt this policy and provide, in writing, details of the policy to their flight crewmembers, including the administrative implications of fatigue calls. (A-08-20) On March 14, 2011, the NTSB classified Safety Recommendations A-08-19 and -20 “Open—Acceptable Response” based on the FAA’s September 14, 2010, publication of an NPRM, “Flightcrew Member Duty and Rest Requirements,” addressing flight crew fatigue in Part 121 operations. On November 15, 2010, in comments submitted about this NPRM, the NTSB stated that the NPRM proposed requirements that would enable a flight crewmember to self-report as too fatigued to continue working an assigned flight duty period and prohibit a certificate holder from allowing the flight crewmember to continue. The NTSB stated that, if adopted, this would likely satisfy the intent of Safety Recommendations A-08-19 and -20 for Part 121 operations, but the FAA needed to adopt similar requirements for Part 135 and Part 91 subpart K operators. In the NPRM, the FAA indicated that the Part 135 community should expect an NPRM and final rule that are very similar, if not identical, to those proposed for Part 121 operators. On January 4, 2012, the FAA issued a final rule based on this NPRM. This accident provides an example of a fatal accident demonstrating the need for a similar requirement for Part 135 operations. 2.5 Lack of Operational Control Center Involvement in Decision-Making Company communication specialists provided dispatch services to pilots but were not qualified to provide operational guidance. Company individuals qualified to provide operational guidance, such as representatives of the OCC or managers such as the chief pilot, were available but were not contacted by the communication specialist or the pilot. If an operationally qualified individual had been involved in the decision-making process that led to the departure from Harrison County Community Hospital with insufficient fuel reserves, such an individual likely would have asked the accident pilot how much fuel was on board the helicopter, understood that there was not sufficient fuel on board to meet minimum fuel requirements, and proposed delaying or canceling the mission and having fuel brought to the helicopter. At the time of the accident, the company communication specialists had guidance to contact the OCC for certain operational issues, but these issues did not include fuel-related issues

NTSB Aircraft Accident Report 34 and unplanned deviations. Following the accident, Air Methods added these items to the list of issues requiring immediate notification of the OCC. Additionally, Air Methods developed a procedure and provided training to its communication specialists on how to recognize potential elevated risk situations and when to contact the OCC. The OCC was staffed at all times with at least one specialist with HEMS operational experience who was available as a central contact point for pilots to discuss operational concerns, such as launch decisions due to developing weather. However, the OCC did not share responsibility for “go/no go” decisions, which were solely the responsibility of the PIC,34 and the risk assessment matrixes used by pilots at the time of the accident did not include a risk threshold that triggered mandatory consultation with the OCC. Pilots interviewed after the accident stated that they rarely contacted the OCC to discuss operational issues. This practice was evident in the accident when the pilot told the communication specialist about his low fuel situation but did not contact the OCC. Following the accident, Air Methods revised its risk assessment program by replacing its risk assessment matrix with a risk assessment tool used by the pilot to calculate a numerical risk assessment value at the beginning of each shift and then update it before beginning each flight leg. Depending on the numerical value, the risk is categorized as “Low/Med,” “High,” or “Ex High.” The instructions for the risk assessment tool indicate that High and Ex High risk values must be mitigated by the pilot to a Low/Med value. The tool includes a specific risk factor for fuel. However, there is still no risk threshold that triggers mandatory OCC consultation. Rather, the instructions state, “If the PIC cannot mitigate a High or Ex High risk to an acceptable level for flight acceptance, then the PIC might consider conferring with either the OCC or with their Regional Management structure in an attempt to gain assistance in finding mitigators to a lower risk threshold.” The NTSB is encouraged that Air Methods has revised the list of specific items that trigger the communication specialist to involve the OCC and has provided training on identifying elevated risk situations to its communication specialists. However, the NTSB is concerned that it is not standard practice for pilots to contact the OCC for help with operational decision-making and that Air Methods’ new risk assessment matrix does not include a risk threshold that triggers mandatory OCC consultation. By contrast, both the FAA and the NTSB have emphasized the importance in air medical operations of having someone who is operationally qualified and outside the immediate situation provide an independent judgment on the safety of a launch. For example, in its 2006 Special Investigation Report on Emergency Medical Services Operations (NTSB 2006c), the NTSB noted that its investigations of EMS accidents revealed that “many EMS operators lack a consistent, comprehensive flight dispatch procedure, which—as part of a flight risk evaluation program—would help EMS pilots determine whether it is safe to accept or continue a mission.” Further, the NTSB stated that a flight dispatcher (not the 911 or hospital dispatcher) “would be less susceptible to making flight decisions based on the urgency of the situation and would be able to obtain an overall perspective of the mission’s safety.” As a

34 The Air Methods GOM, page A-20/R-5/01-15-11, states that the PIC has “final authority for the safety of passengers, cargo, and medical personnel, and has operational control for all flights which they initiate.”

NTSB Aircraft Accident Report 35 result, on February 7, 2006, the NTSB issued Safety Recommendation A-06-14, which asked the FAA to “require emergency medical services operators to use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance in flight risk assessment decisions.” In May 2008, the FAA published AC 120-96, “Integration of Operations Control Centers into Helicopter Emergency Medical Services Operations” (FAA 2008b), which provided detailed guidance about the creation and operation of OCCs for HEMS operations. In the AC, the FAA noted that “the main concept of OCCs and flight dispatch procedures is joint mission responsibility…[which] requires that at least one qualified ground staff member, in addition to the PIC, be responsible for monitoring factors affecting mission and flight status.” Further, the FAA specified that the OCC specialist should maintain awareness of all operational considerations including “weather, communication, fuel, [and] landing zone.” On October 12, 2010, the FAA issued an NPRM on air ambulance and commercial helicopter operations (Federal Register 2010, 62639) that included a proposed requirement to mandate the creation of an OCC and the use of operations control specialists for HEMS operations. On January 10, 2011, the NTSB submitted comments to the FAA on the NPRM, noting that the NPRM partially addressed Safety Recommendation A-06-14 by proposing that commercial HEMS operators with 10 or more helicopters that are engaged in HEMS activities establish OCCs. However, the NTSB indicated that it believes the requirement for an OCC should be applied to all HEMS operators. The NTSB stated that “The vast majority of HEMS accidents have historically involved poor decision-making by various personnel involved in launching or conducting a HEMS flight. Having [operational control specialists] who are trained and available to help manage the HEMS launch and in-flight decision-making will help pilots recognize and avoid high-risk situations.” Further, the NTSB noted that while it supports the FAA’s proposal to require HEMS operators to implement preflight risk assessment programs, a preflight risk assessment is only one part of the overall risk reduction process and that it “cannot substitute for the services and support provided by an OCC.” On August 22, 2012, the NTSB classified Safety Recommendation A-06-14 “Open—Acceptable Response,” pending the issuance of a final rule mandating OCCs for HEMS operators. This accident exemplifies the need for OCC involvement in operational decision-making. An operationally qualified individual outside the immediate situation would likely have recognized that the pilot’s decision to continue the mission was inappropriate. Although Air Methods was proactive in establishing its OCC, the OCC did not share responsibility for launch and in-flight decisions, and there were no procedures specifying that the OCC should be notified of abnormal fuel situations. The NTSB concludes that because there was no policy requiring that the Air Methods OCC be notified of abnormal fuel situations, available operationally qualified personnel outside the situation who would likely have recognized the pilot’s decision to continue the mission as inappropriate were not consulted. Therefore, the NTSB recommends that Air Methods revise company procedures so that pilots are no longer solely responsible for nonroutine operational decisions but are required to consult with the Air Methods OCC for approval to accept or continue a mission when confronted with elevated risk situations, such as fuel-related issues and unplanned deviations. Further, because the NTSB

NTSB Aircraft Accident Report 36 believes that a joint mission responsibility shared between the pilot and an OCC specialist would enhance the safety of HEMS flight operations, the NTSB reiterates Safety Recommendation A-06-14. 2.6 Autorotation Guidance and Training 2.6.1 Loss of Engine Power and Autorotation Entry The pilot’s awareness of the helicopter’s low fuel status and the near zero indication on the fuel gauge as the flight continued should have given the pilot ample warning of the impending engine failure and provided him with the opportunity to prepare to execute an autorotation.35 However, it was evident from the helicopter’s impact in a 40° nose-down attitude, on a heading nearly opposite to the direction of travel, at a high rate of descent, and with a low rotor rpm that the pilot did not successfully execute an autorotation following the loss of engine power. The simulator flight evaluations conducted during the investigation demonstrated that from low level cruise flight (the accident flight condition at the time of the engine flameout), it was possible to maintain rotor rpm and execute a successful autorotation with touchdown occurring about 25 seconds after engine failure. However, a successful autorotation was only possible if simultaneous flight control inputs of down collective and aft cyclic were made within about 1 to 2 seconds after the engine failure. If these flight control inputs were not promptly made, the result was a rapid decay in rotor rpm and impact with terrain in a nose-down attitude in an average time of 4 to 5 seconds after the simulated engine failure. Because the helicopter was not equipped with any type of recording device, it was not possible to determine the pilot’s control inputs following the loss of engine power. However, the consistency between the impact geometry and signatures and the simulator profile produced when simultaneous aft cyclic and down collective were not input indicates that the pilot either delayed too long in making control inputs or responded with flight control inputs other than simultaneous aft cyclic and down collective. The NTSB concludes that although a successful autorotation was possible, the pilot failed to make the flight control inputs necessary to enter an autorotation when the engine lost power, which resulted in a rapid decay in rotor rpm and impact with terrain. The pilot was required to demonstrate competency in performing autorotations during his Part 135 required initial and recurrent training, which took place 10 and 5 months before the accident, respectively. According to other Air Methods pilots, the practice autorotations that they performed in flight training were done at airspeeds of about 80 knots. This was consistent with traditional flight training for autorotations, which has typically been done at airspeeds below cruise and has emphasized immediate lowering of the collective as the first pilot action in response to a loss of engine power. However, Eurocopter AS350 B1 certification flight test data suggest that following a simulated engine failure at cruise speeds comparable to the accident scenario, the pilot may need to make a substantial aft cyclic input within 1.5 seconds of engine failure to achieve a successful autorotation entry.

35 Additionally, the low fuel level light likely came on at least 18 minutes before the engine flamed out; however, because the brightness switch for the caution/warning panel was found in the dim position and it is unknown when the switch was placed in that position, it is possible that the pilot may not have seen the light.

NTSB Aircraft Accident Report 37 Further, the simulator flight evaluations showed that following a simulated engine failure at 115 knots, the helicopter tended to pitch down rapidly, requiring immediate use of aft cyclic to enter the autorotation and avoid an unrecoverable decay in rotor rpm. Pilots might not be able to initiate the appropriate flight control inputs (aggressive aft cyclic, down collective, and left antitorque pedal) within such a short period of time unless they have received extensive practice in similar flight conditions. The pilot’s autorotation training had involved lower speeds in the vicinity of 80 knots where less aft cyclic is needed to enter an autorotation, so the practice autorotations he performed had been less dependent on immediate, coordinated application of aft cyclic and down collective. Thus, the pilot’s autorotation training was not representative of an actual engine failure at cruise speed and did not optimally prepare him to respond appropriately to such a scenario. An additional difference between the pilot’s autorotation training and the actual engine failure was that the pilot received all of his Air Methods training in Eurocopter AS350 B2 helicopters, and because the Eurocopter AS350 B2’s floor-mounted fuel control lever (throttle) does not have an idle detent, Air Methods elected to conduct practice autorotations with no reduction in throttle.36 A practice autorotation with no throttle reduction differs significantly from an actual engine failure because in an actual engine failure, there are distinct symptoms or cues, including a jerk in the yaw axis and a drop in rotor rpm, that will not occur during a practice autorotation with no throttle reduction. These cues should alert the pilot to immediately enter an autorotation. It is unlikely that the pilot had previous exposure to these cues because his only autorotation training in Eurocopter AS350-series helicopters was that provided by Air Methods. It is possible that if the pilot had previous exposure to these cues, it might have facilitated a more rapid recognition of the loss of engine power during the accident flight. Because it did not provide practice in entering autorotations from cruise airspeeds or the opportunity to experience the symptoms of an engine failure, the NTSB concludes that the autorotation training that the pilot received in the Eurocopter AS350 B2 was not representative of an actual engine failure at cruise airspeed and likely contributed to the pilot’s failure to execute a successful autorotation. 2.6.2 Inadequate Guidance on Autorotation Entry Procedures When the pilot received his training in the Eurocopter AS350 B2, the Air Methods Pilot Training Program, Annex 1, AS350 Flight Training Maneuvers Manual listed “smooth, positive reduction” of the collective to the full down position as the first step in performing a practice autorotation. This was consistent with the emergency procedure in the AS350 B2 RFM, which states that the pilot’s first action in response to an engine failure should be to lower the collective. Also, the training program was consistent with the general guidance provided by the FAA in the Helicopter Flying Handbook and the Helicopter Instructor’s Handbook, which emphasizes lowering the collective to initiate an autorotation. Following the accident, Air Methods changed the guidance on autorotations in its Eurocopter AS350 pilot training program to emphasize the importance of applying simultaneous

36 Not all Eurocopter AS350-series helicopters are equipped with a fuel flow control lever. The Eurocopter AS350 B3 model helicopter is equipped with a twist-grip style throttle on the collective flight control.

NTSB Aircraft Accident Report 38 control inputs when entering an autorotation. The changes included adding a discussion of autorotations to the AS350 Flight Training Maneuvers Handbook that states, in part, “It is imperative that the pilot take immediate action to change to an autorotative attitude; i.e., simultaneously applying aft cyclic, lowering the collective to maintain rotor rpm, and trimming the aircraft. Failure to apply aft cyclic while lowering the collective will result in a nose low attitude; this condition may be unrecoverable at low altitudes.” Also, a note was added to the procedure in the Air Methods AS350 Flight Training Maneuvers Handbook for performing practice autorotations stating that initial cyclic, collective, and antitorque pedal adjustments “must occur simultaneously to preclude an excessively nose low attitude from developing that may be unrecoverable at low altitude.” Additionally, the first step in performing a practice autorotation was changed to “Cyclic: Adjust to maintain 65 knots,” followed by lowering the collective as the second step. The NTSB recognizes that the motions of a helicopter following an engine power loss vary greatly from one make and model helicopter to another and from one flight condition to the next. Therefore, the technique required for safely entering an autorotation will vary, and there is no technique of universal applicability. However, in discussions with experienced helicopter flight instructors and test pilots, NTSB investigators found agreement that simultaneous control inputs, as opposed to only lowering the collective, should be used when entering an autorotation and that the critical task when entering an autorotation is to establish airflow upward through the main rotor system. Further, the instructors and test pilots interviewed reported that the Eurocopter AS350 B2 is not unique in requiring simultaneous application of aft cyclic and down collective to safely enter an autorotation at cruise airspeeds; rather this technique is applicable to many, if not all, helicopters with low inertia rotor systems.37 As illustrated in figure 10, a helicopter is not in an autorotation until the airflow is passing upward through the rotor blades. Pilots are taught to lower the collective following an engine failure because it results in a descent that produces an upward flow of air. However, when a helicopter is in cruise flight at the time the engine fails, using aft cyclic to increase the pitch attitude (a cyclic flare) will more rapidly produce an upward flow of air because it tilts the main rotor system aft so that the oncoming air is flowing upward through the rotor blades. As noted in Rotary Wing Flight (Ean 1987), this cyclic flare will help prevent excessive rotor rpm decay, which is critical in helicopters with low inertia rotor systems because they lose rotor rpm very quickly. The NTSB believes that the additional information about autorotation entries provided by Air Methods to its AS350 pilots would be equally valuable to all pilots flying helicopters with low inertia rotor systems. The NTSB concludes that without specific guidance regarding the appropriate control inputs for entering an autorotation at cruise airspeeds, the pilots of helicopters with low inertia rotor systems may not be aware that aft cyclic must be applied when collective is lowered to maintain control of the helicopter and perform a successful autorotation. Therefore, the NTSB recommends that the FAA inform pilots of helicopters with low inertia

37 Rotor inertia is a measure of the amount of energy stored in a helicopter’s main rotor system. Following an engine failure, a low rotor inertia system will lose rpm faster than one with high inertia because it has relatively less stored energy. High inertia rotor systems typically have heavy, long blades, whereas low inertia rotor systems have light, short blades.

NTSB Aircraft Accident Report 39 rotor systems about the circumstances of this accident, particularly emphasizing the findings of the simulator flight evaluations, and advise them of the importance of simultaneously applying aft cyclic and down collective to achieve a successful autorotation entry at cruise airspeeds. The NTSB’s review of the guidance on performing autorotations in the FAA’s Helicopter Flying Handbook, which is the primary source of information on helicopter aerodynamics and flight maneuvers published by the FAA, found that it emphasizes lowering the collective as the initial step in entering an autorotation, does not address the use of simultaneous control inputs in response to an engine failure, and contains minimal information on the entry phase of autorotations. The NTSB is concerned by this lack of information because, as this accident demonstrates, if the entry is not performed correctly, an unrecoverable loss of rotor rpm can occur. The handbook does not inform pilots that the rate of rotor rpm decay following an engine failure is most rapid when the helicopter is at high gross weight, high forward speed, or in high density altitude conditions and that in the most severe cases, it takes only seconds for the decay to become unrecoverable. The handbook also does not inform pilots that the procedure for safely entering an autorotation varies with the flight condition and the make and model helicopter or note that when entering an autorotation at cruise airspeed, aft cyclic can help prevent excessive rotor rpm decay. The NTSB notes that some information about the entry phase of an autorotation is included in the FAA’s Helicopter Instructor’s Handbook. However, this publication is targeted at flight instructors and may not be read by helicopter pilots who are not instructors or training to become an instructor. Also, the FAA’s Helicopter Instructor’s Handbook does not point out that the procedure for safely entering an autorotation varies with the make and model helicopter or note that when entering an autorotation at cruise airspeed, aft cyclic can help prevent excessive rotor rpm decay. The NTSB believes that because the Helicopter Flying Handbook, which is the primary source of information on helicopter aerodynamics and flight maneuvers published by the FAA, lacks a thorough discussion on the entry phase of autorotations, helicopter pilots may believe that lowering the collective (with no other control inputs) will always result in a successful autorotation entry. The NTSB concludes that because of the lack of information about the entry phase of autorotations in the FAA’s Helicopter Flying Handbook, helicopter pilots may not be aware that there are flight conditions in which immediate and simultaneous control inputs, not only lowering collective, are required to enter an autorotation. Therefore, the NTSB recommends that the FAA revise the Helicopter Flying Handbook to include a discussion of the entry phase of autorotations that explains the factors affecting rotor rpm decay and informs pilots that immediate and simultaneous control inputs may be required to enter an autorotation. 2.6.3 Need for Simulator Training of Helicopter Emergency Medical Services Pilots Air Methods is now providing all of its Eurocopter AS350 pilots with autorotation training and line-oriented flight training in a full-motion Eurocopter AS350 flight simulator. The NTSB notes that use of a flight simulator addresses the lack of practice representative of an actual engine failure at cruise airspeed in the accident pilot’s autorotation training because

NTSB Aircraft Accident Report 40 engine failures in a simulator are representative of an actual engine flameout and can be induced unexpectedly in any flight condition. This accident highlights the value of using simulators and flight training devices (FTD) for helicopter pilot training. The availability of new helicopter FTDs and simulators has increased greatly over the past few years.38 In addition to enabling pilots to train in skills that are too risky to perform in a real helicopter, such as the low altitude engine failure in this accident, simulators and FTDs can be used day or night and in any kind of weather, unlike real helicopters. Simulators and FTDs can also allow training for a complete flight, including an emergency, increasing the likelihood that a pilot will respond correctly and quickly in an emergency. Further, simulated flights can be tailored to a specific type of flight operation, such as interfacility HEMS flights (hospital to hospital) and remote helispot landings and takeoffs. The NTSB has previously addressed the need for HEMS pilots to receive scenario-based simulator training. On September 24, 2009, the NTSB issued Safety Recommendations A-09-87 and -88, which asked the FAA to do the following: Develop criteria for scenario-based helicopter emergency medical services (HEMS) pilot training that includes inadvertent flight into instrument meteorological conditions and hazards unique to HEMS operations, and determine how frequently this training is required to ensure proficiency. (A-09-87) Once the actions recommended in Safety Recommendation A-09-87 are completed, require helicopter emergency medical services pilots to undergo periodic FAA-approved scenario-based simulator training, including training that makes use of simulators or flight training devices. (A-09-88) On October 7, 2010, the NTSB classified Safety Recommendations A-09-87 and -88 “Open―Acceptable Response” based on the FAA’s response that it would conduct a study of the feasibility and safety impacts of requiring HEMS operators to conduct training in simulators. The FAA’s October 2010 NPRM on air ambulance and commercial helicopter operations did not address Safety Recommendations A-09-87 and -88. In its comments on the NPRM, the NTSB stated that it “strongly believes that the increased use of helicopter simulators for HEMS pilot training is essential to improving pilot knowledge and skills for inadvertent IMC [instrument meteorological condition] encounters and other piloting issues, such as emergency procedures. The NTSB encourages the FAA to consider including guidance for the use of simulators for helicopter pilot training in the final rule.” On August 22, 2012, the NTSB classified Safety Recommendation A-09-87 “Open—Unacceptable Response” pending completion of the recommended action.

38 According to a June 2010 article in Rotor & Wing magazine, FTDs are now available for the Eurocopter AS350 B2/B3, Eurocopter EC135, Bell 206, Bell 407, and Bell 427 helicopters. The highest level FTDs, level 7, allow flight crewmembers to receive the maximum amount of training credit from an FTD and qualify for nearly all parts of a Part 135 check ride (Adams 2010).

NTSB Aircraft Accident Report 41 This accident again demonstrates the importance of using helicopter simulators for HEMS pilot training. Because engine failures can be induced unexpectedly in any flight condition in a simulator and a simulator can accurately replicate the symptoms of an actual engine flameout, the NTSB concludes that if the pilot had received autorotation training in a simulator rather than in a helicopter, he would have been better prepared and might have effectively responded to the engine failure during the accident flight. Air Methods has already implemented scenario-based simulator training for its pilots, and the NTSB continues to believe that all HEMS pilots should receive this type of training. Therefore, the NTSB reiterates Safety Recommendations A-09-87 and -88 and reclassifies A-09-88 “Open—Unacceptable Response.” 2.7 Lack of Flight Recorder As previously noted, because the helicopter was not equipped with any type of recording device, the pilot’s control inputs in response to the loss of engine power are unknown. Also, the helicopter’s motions (pitch, bank, and yaw attitudes) and the time history of the rotor rpm decay following the loss of engine power are unknown. Further, although radar data and satellite tracking system data were available to NTSB investigators to determine the altitude and flightpath of the helicopter, the radar data and the tracking system data ended about 50 and 30 seconds, respectively, before the accident occurred. Thus, the NTSB could only estimate the helicopter’s altitude and airspeed at the time the engine flameout occurred. In addition, recorded images would possibly have shown where the pilot’s attention was directed immediately before the engine flameout and the setting of the brightness switch on the caution/warning annunciator panel during the accident flight. The NTSB concludes that if a recorder system that captured cockpit audio, images, and parametric data had been installed, it would have enabled NTSB investigators to reconstruct the final moments of the accident flight and determine why the pilot did not successfully enter an autorotation. The NTSB notes that the helicopter was not required to have any type of crash-resistant recorder installed. Previous NTSB recommendations have addressed the need for recording information on aircraft such as the one involved in this accident. Specifically, as a result of the NTSB’s investigation of the July 27, 2007, fatal accident involving two Eurocopter AS350 B2 electronic news gathering helicopters that collided in flight in Phoenix, Arizona (NTSB 2009b), on February 9, 2009, the NTSB issued Safety Recommendations A-09-9 through -11 to the FAA. These recommendations proposed the required installation of crash-resistant recorders capable of audio, video, and data recording, as specified in European Organization for Civil Aviation Equipment (EUROCAE) document ED-155,39 in both newly manufactured and existing turbine-powered, nonexperimental, nonrestricted-category aircraft. On June 11, 2012, the NTSB classified Safety Recommendations A-09-9 through -11 “Closed—Unacceptable Action” because the FAA stated that it did not intend to mandate the equipage of additional recording systems on all turbine-powered, nonexperimental, nonrestricted-category aircraft because of significant costs and limited ability to assess benefits.

39 EUROCAE ED-155 is a manufacturing standard, issued in July 2009, for a lightweight, low-cost, robust aircraft recording device. The ED-155 standard covers flight data recorder-like data recording, cockpit voice recorder-like audio recording, cockpit video, and data-like message recording. It also specifies parameters that should be recorded for both airplanes and helicopters and the details of range, resolution, and accuracy that should be required.

NTSB Aircraft Accident Report 42 Specific to HEMS operations, the NTSB also issued Safety Recommendation A-09-90, which asked the FAA to “require helicopter emergency medical services operators to install flight data recording devices and establish a structured flight data monitoring program that reviews all available data sources to identify deviations from established norms and procedures and other potential safety issues.” In its October 2010 NPRM on air ambulance and commercial helicopter operations, the FAA stated that it was considering requiring certificate holders conducting helicopter air ambulance operations to install lightweight aircraft recording systems (LARS) in their helicopters. However, the requirement for such a device was not incorporated into the proposed rule. On July 18, 2012, the NTSB classified Safety Recommendation A-09-90 “Open—Unacceptable Response,” pending the FAA’s issuance of a requirement to install LARS in helicopters used for EMS operations. On November 15, 2010, the FAA published Technical Standard Order (TSO) C197, “Information Collection and Monitoring Systems,” which provides standards for the design and production certification of lightweight recording systems. The TSO invokes certain requirements of the EUROCAE ED-155 standard. In addition to being a valuable aid to accident investigation, a TSO C197-compliant recorder would also be fully capable of supporting a structured flight data monitoring program, whether it is implemented as a formal FAA-approved flight operations quality assurance program or a monitoring program that is part of a company safety management system. The benefits of data monitoring programs have been evaluated and documented for commercial airlines. The U.S. Government Accountability Office (GAO 1998) conducted an evaluation of airline-based data collection and monitoring programs in 1998, shortly after adoption of such programs. The evaluation highlighted that such programs provide enhanced safety as well as financial benefits due to increased efficiency of operations. It is likely that the HEMS community, as well as all commercial helicopters, will experience similar benefits. Since 2010, Eurocopter has been delivering new AS350 B3 helicopters with Appareo Vision 1000 devices installed. The Appareo Vision 1000 is a cockpit imaging and flight data monitoring device installed in over 350 aircraft being operated in the United States, with about 250 new Eurocopter AS350s registered and operating in the US fleet.40 About 10 percent of Air Method’s fleet now has Appareo devices installed. Air Methods is currently developing a flight data monitoring program that will use the information recorded in these devices. While the NTSB is encouraged by the voluntary installation and use of these devices, the NTSB is concerned that these devices are installed in only a small portion of the overall US fleet and that they currently do not meet the minimum performance and crash survivability standards specified in TSO C197. Although issuance of TSO C197 constitutes progress, the NTSB is concerned that the FAA has not mandated the equipage of TSO-approved lightweight recording systems for all turbine-powered aircraft. This accident is another of the numerous accidents that the NTSB has investigated where the lack of recorders made the full information necessary to analyze an accident difficult or impossible to obtain (NTSB 2011a, 2011b, 2010a, 2009a, 2006a, 2006b, and 2003).

40 Appareo indicated that it is manufacturing and selling about 350 new units each year worldwide.

NTSB Aircraft Accident Report 43 Further, recorders can help investigators identify safety issues that may not otherwise be detectable, which is critical to the prevention of future accidents. For example, the August 10, 2005, accident involving a Sikorsky S-76C+ helicopter that crashed into the Baltic Sea shortly after takeoff from Tallinn, Estonia, was the first time that the NTSB participated in a helicopter accident investigation in which a flight data recorder (FDR) was on board.41 Importantly, without the recorder data, investigators would not have been able to identify the airworthiness issue that resulted in NTSB’s issuance of three urgent safety recommendations (A-05-33 through -35) on November 17, 2005. In response to Safety Recommendations A-05-33 and -34, the FAA issued Special Airworthiness Information Bulletin SW-06-15, which was followed by Airworthiness Directive 2010-10-02, and these recommendations were classified “Closed—Acceptable Alternate Action” on May 25, 2011. In response to Safety Recommendation A-05-35, the FAA issued two Safety Alerts for Operators (06021 and 08015), and this recommendation was classified “Closed—Acceptable Action” on January 5, 2009. Similarly, a Cessna 208B that crashed on November 19, 2005, following a loss of control in icing conditions during descent for landing in Moscow, Russia, was one of the first Cessna 208B airplanes to be equipped with a cockpit voice recorder (CVR) and an FDR.42 The recorder data provided investigators with new insight into the effects of icing on the Cessna 208B’s performance and resulted in the NTSB’s issuance of three urgent safety recommendations (A-06-01 through -03) on January 17, 2006. In response, the FAA issued Airworthiness Directive 2006-06-06, which fully met the intent of the recommendations, and all three recommendations were classified “Closed—Acceptable Action” on November 15, 2006. The recorder data from these two accidents were critical to identifying urgent safety issues, which clearly demonstrates that recording devices on aircraft can have a significant impact on safety. Therefore, the NTSB recommends that the FAA require the installation of a crash-resistant flight recorder system on all newly manufactured turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with an FDR and a CVR and are operating under 14 CFR Parts 91, 121, or 135. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in TSO C197, “Information Collection and Monitoring Systems.” Further, the NTSB recommends that the FAA require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with an FDR or CVR and are operating under 14 CFR Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in TSO C197, “Information Collection and Monitoring Systems.”

41 This accident was investigated by the Aircraft Accident Investigation Commission of Estonia, and the NTSB participated in the investigation under the provisions of Annex 13 to the International Convention on Civil Aviation. 42 This accident was investigated by the Interstate Aviation Commission of Russia, and the NTSB participated in the investigation under the provisions of Annex 13 to the International Convention on Civil Aviation.

NTSB Aircraft Accident Report 44

1. Conclusions
2. 1 Findings
3. The pilot and the helicopter were properly certified for the 14 Code of

Federal Regulations Part 135 helicopter emergency medical services flight.

1. Wreckage examination determined that the helicopter’s engine lost power due to

fuel exhaustion. Testing also determined that the helicopter’s fuel system, including the fuel quantity gauge and the low fuel level light, were operating properly.

1. Although the helicopter’s low fuel state was clearly indicated, the pilot missed three

opportunities to detect the condition: (1) before departing on the first leg of the mission as a result of his inadequate preflight inspection, (2) before takeoff by failing to properly complete the before-takeoff confirmation checklist, and (3) after takeoff when he erroneously reported the fuel level.

1. The pilot departed on the second leg of the mission despite knowing that the helicopter

had insufficient fuel reserves likely in order to avoid delays and other possible negative outcomes that could have resulted from aborting the mission.

1. Self-induced pressure likely caused the pilot to fixate on his intended refueling point and

continue the flight rather than make a precautionary landing as the fuel gauge indication approached zero.

1. The pilot’s texting, which occurred (1) while flying, (2) while the helicopter was being

prepared for return to service, and (3) during his telephone call to the communication specialist when making his decision to continue the mission, was a self-induced distraction that took his attention away from his primary responsibility to ensure safe flight operations. Further, although there is no evidence that the pilot was texting at the time of the engine failure, his texting while airborne violated the company’s cell phone use policy.

1. Because of restricted sleep the night before the accident, the timing of his

operational activities, and the nature of the pilot’s errors, which were uncharacteristic of his performance, the pilot was experiencing fatigue, which likely degraded his performance.

1. Because there was no policy requiring that the Air Methods Operational Control Center

be notified of abnormal fuel situations, available operationally qualified personnel outside the situation who would likely have recognized the pilot’s decision to continue the mission as inappropriate were not consulted.

1. Although a successful autorotation was possible, the pilot failed to make the flight control

inputs necessary to enter an autorotation when the engine lost power, which resulted in a rapid decay in rotor rpm and impact with terrain.

NTSB Aircraft Accident Report 45

1. The autorotation training that the pilot received in the Eurocopter AS350 B2 was not

representative of an actual engine failure at cruise airspeed and likely contributed to the pilot’s failure to execute a successful autorotation.

1. Without specific guidance regarding the appropriate control inputs for entering an

autorotation at cruise airspeeds, the pilots of helicopters with low inertia rotor systems may not be aware that aft cyclic must be applied when collective is lowered to maintain control of the helicopter and perform a successful autorotation.

1. Because of the lack of information about the entry phase of autorotations in the

Federal Aviation Administration’s Helicopter Flying Handbook, helicopter pilots may not be aware that there are flight conditions in which immediate and simultaneous control inputs, not only lowering collective, are required to enter an autorotation.

1. If the pilot had received autorotation training in a simulator rather than in a helicopter, he

would have been better prepared and might have effectively responded to the engine failure during the accident flight.

1. If a recorder system that captured cockpit audio, images, and parametric data had been

installed, it would have enabled National Transportation Safety Board investigators to reconstruct the final moments of the accident flight and determine why the pilot did not successfully enter an autorotation. 3.2 Probable Cause The National Transportation Safety Board determines that the probable causes of this accident were the pilot’s failure to confirm that the helicopter had adequate fuel on board to complete the mission before making the first departure, his improper decision to continue the mission and make a second departure after he became aware of a critically low fuel level, and his failure to successfully enter an autorotation when the engine lost power due to fuel exhaustion. Contributing to the accident were (1) the pilot’s distracted attention due to personal texting during safety-critical ground and flight operations, (2) his degraded performance due to fatigue, (3) the operator’s lack of a policy requiring that an operational control center specialist be notified of abnormal fuel situations, and (4) the lack of practice representative of an actual engine failure at cruise airspeed in the pilot’s autorotation training in the accident make and model helicopter.

NTSB Aircraft Accident Report 46

1. Recommendations
2. 1 New Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following safety recommendations: To the Federal Aviation Administration: Prohibit flight crewmembers in 14 Code of Federal Regulations Part 135 and 91 subpart K operations from using a portable electronic device for nonoperational use while at their duty station on the flight deck while the aircraft is being operated. (A-13-7) Require all 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to incorporate into their initial and recurrent pilot training programs information on the detrimental effects that distraction due to the nonoperational use of portable electronic devices can have on performance of safety-critical ground and flight operations. (A-13-8) Require all 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to review their respective general operations manuals to ensure that procedures are in place that prohibit the nonoperational use of portable electronic devices by operational personnel while in flight and during safety-critical preparatory and planning activities on the ground in advance of flight. (A-13-9) Inform pilots of helicopters with low inertia rotor systems about the circumstances of this accident, particularly emphasizing the findings of the simulator flight evaluations, and advise them of the importance of simultaneously applying aft cyclic and down collective to achieve a successful autorotation entry at cruise airspeeds. (A-13-10) Revise the Helicopter Flying Handbook to include a discussion of the entry phase of autorotations that explains the factors affecting rotor rpm decay and informs pilots that immediate and simultaneous control inputs may be required to enter an autorotation. (A-13-11) Require the installation of a crash-resistant flight recorder system on all newly manufactured turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a flight data recorder and a cockpit voice recorder and are operating under 14 Code of Federal Regulations Parts 91, 121, or 135. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in Technical Standard Order C197, “Information Collection and Monitoring Systems.” (A-13-12)

NTSB Aircraft Accident Report 47 Require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a flight data recorder or cockpit voice recorder and are operating under 14 Code of Federal Regulations Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in Technical Standard Order C197, “Information Collection and Monitoring Systems.” (A-13-13) To Air Methods Corporation: Expand your policy on portable electronic devices to prohibit their nonoperational use during safety-critical ground activities, such as flight planning and preflight inspection, as well as in flight. (A-13-14) Revise company procedures so that pilots are no longer solely responsible for nonroutine operational decisions but are required to consult with the Air Methods Operational Control Center for approval to accept or continue a mission when confronted with elevated risk situations, such as fuel-related issues and unplanned deviations. (A-13-15) 4.2 Previously Issued Recommendations Reiterated in This Report The National Transportation Safety Board reiterates the following safety recommendations to the Federal Aviation Administration: Require emergency medical services operators to use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance in flight risk assessment decisions. (A-06-14 classified “Open―Acceptable Response”) Develop criteria for scenario-based helicopter emergency medical services (HEMS) pilot training that includes inadvertent flight into instrument meteorological conditions and hazards unique to HEMS operations, and determine how frequently this training is required to ensure proficiency. (A-09-87 classified “Open—Unacceptable Response”)

NTSB Aircraft Accident Report 48 4.3 Previously Issued Recommendation Reiterated and Reclassified in This Report The National Transportation Safety Board reiterates and reclassifies from “Open—Acceptable Response” to “Open—Unacceptable Response” the following safety recommendation to the Federal Aviation Administration: Once the actions recommended in Safety Recommendation A-09-87 are completed, require helicopter emergency medical services pilots to undergo periodic FAA-approved scenario-based simulator training, including training that makes use of simulators or flight training devices. (A-09-88)

Chairman Hersman filed the following concurring statement on April 17, 2013; Member Sumwalt filed the following concurring statement on April 10, 2013; and Member Weener filed the following concurring and dissenting statement on April 15, 2013.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: April 9, 2013

NTSB Aircraft Accident Report 49 Board Member Statements

Chairman Deborah A.P. Hersman, concurring: Decision making is about making the right choices. In Advisory Circular 60-22, the FAA defines Aeronautical Decision Making or ADM as a systemic approach to the mental process of evaluating a given set of circumstances and determining the best course of action. Whether using the 3 P model (Perceive, Process, and Perform), the DECIDE model, or reviewing AOPA’s Air Safety Foundation publication titled, “Do the Right Thing: Decision Making for Pilots” – a key part of ADM is eliminating or mitigating risks. Our role in accidents is to identify what our investigators found. Through our efforts we bring issues to the attention of the transportation community so changes can be made to improve safety. In this investigation we identified a pilot who did not put his safety, the safety of his crew and the safety of his patient first. He did not eliminate and mitigate the risks that were right in front of him. We have all made bad choices, but most of the time those decisions don’t result in the loss of life. The choices that pilots make preparing for flight and in-flight are critical. Some increase safety margins, some decrease safety margins. HEMS flights have been identified as higher risk operations – that is why it is hard to understand why a generally good pilot did not have the discipline to do the right thing. There is a time and a place for everything. Our recommendations and safety alert recognize that the flight deck is not the time or the place to use PEDs for non-operational uses. Members Sumwalt and Rosekind joined in this statement.

NTSB Aircraft Accident Report 50 Member Robert L. Sumwalt, concurring: I believe this investigation uncovered many important issues – issues that, if addressed, will improve aviation safety. One key issue emerging from this investigation concerns the criticality of proper pilot actions during autorotation entries. As discussed in Sections 1.5.3 and 2.6, when entering an autorotation at cruise speeds, the pilot must simultaneously apply aft cyclic and down collective. As stated in Section 2.6 of the report: The simulator flight evaluations conducted during the investigation demonstrated that from low level cruise flight (the accident flight condition at the time of the engine flameout), it was possible to maintain rotor rpm and execute a successful autorotation with touchdown occurring about 25 seconds after engine failure. However, a successful autorotation was only possible if simultaneous flight control inputs of down collective and aft cyclic were made within about 1 to 2 seconds after the engine failure. If these control inputs were not promptly made, the result was a rapid decay in rotor rpm and impact with terrain in a nose-down attitude in an average time of 4 to 5 seconds after the simulated engine failure. Findings 11 and 12 of this report, and Recommendations 4 and 5 further discuss and address this issue. The reason for this concurring statement is that while I support the above report language that emphasizes the criticality of applying aft cyclic while flying at higher airspeeds, there are some flight regimes where the pilot would need to apply forward cyclic. According to page 9 of Eurocopter’s submission to Bureau d’Enquêtes et d’Analyses and NTSB, dated December 3, 2012: The simulator demonstrations confirmed the well-known fact that airspeed and attitude are two significant factors that affect how the pilot should appropriately respond with cyclic inputs when faced with a loss of engine power. For example, a pilot who is flying at a very low airspeed, when faced with a loss of power, would need to initially lower collective pitch (to maintain NR) and push the cyclic forward to establish 65 kts in accordance with the autorotation procedure, whereas a pilot flying at a very high airspeed with a nose down attitude would be required to lower collective pitch and pull aft cyclic when faced with a loss of power to establish 65 kts in accordance with the autorotation procedure. In summary, I support and applaud the excellent work of the NTSB’s investigative staff. However, I was concerned that the report’s emphasis on the critical need to pull aft cyclic during an autorotation entry while at cruise airspeeds may have overshadowed that, in some circumstances such as slower airspeeds, it may be necessary to apply a forward cyclic input. Herein lies one major advantage of high fidelity simulator training, where pilots can learn and apply appropriate flight control inputs during autorotation entries in all flight regimes. Member Weener joined in this statement.

NTSB Aircraft Accident Report 51 Member Earl F. Weener, concurring and dissenting: Generally, I agree with the findings from the investigation and the final report on this accident, a crash following loss of engine power due to fuel exhaustion. However, I do not support the part of the Probable Cause statement, or the various statements in the report and conclusions, attributing causal aspects of the accident to the pilot’s use of a personal electronic device. I am unconvinced the investigation or final report provides sufficient evidence to draw these conclusions. Instead, the investigation uncovered a clear case of poor aeronautical decision-making, one of the primary causes of GA accidents. Further, by emphasizing the PED distraction theme, the report itself provides a distraction from other critical safety issues identified and supported by the investigation, namely: appropriate involvement of independent, operationally qualified personnel in decision-making; adequate guidance on autorotation entry procedures; helicopter simulator training; and the importance of flight recording devices. Consistent with this view, I also oppose the issuance of a safety alert concerning non-operational use of PEDs based on this accident and the others cited in the alert. To be clear, I am not endorsing the pilot’s actions with regard to use of his PED. However, as discussed at the Board meeting, the PED was only one of many distractions for this pilot that day. As ill advisable and disconcerting as his actions may be with regard to his PED use, the report fails to make the case for attributing the causes or contributing causes of this accident to distraction based explicitly on use of the device. The pilot’s flawed aeronautical decision-making is the fundamental issue – which goes well beyond his decisions regarding cell phone use. It is the root cause of this accident, and in order to effect change the root cause must be addressed. At multiple, distinct points, the pilot demonstrated poor judgment by proceeding with the mission: (1) he did not complete a proper preflight inspection; (2) prior to departing on the first leg of the mission, he failed to complete the before take-off confirmation checklist; (3) en route, upon re-discovering the low fuel level, he reported an erroneous fuel level; (4) rather than abort the mission on landing at the hospital, he chose to load the patient and attempt another landing to refuel with the patient on board, 2 minutes short of the destination hospital; and finally, (5) en route to the refueling port, he chose to exhaust the fuel supply rather than attempt an emergency landing. These decisions were unrelated to his use of a PED. This is not to say he was not coping with distractions, and likely multiple distractions based on the record, but we can clearly say the act of texting or using the PED did not interfere or affect these decisions. Once the pilot made his decision to proceed with this mission, nothing was going to deter him from his course – regardless of whether he used a cell phone or not. If distraction is to be an identified causal factor, as discussed at the Board meeting, there is no basis to single out the PED as the lone distraction. This approach of calling out PED use in this case establishes a new, and unwarranted, standard for PED distraction, rather than addressing the issue of distraction as a whole. Unfortunately, in the aftermath of the report’s adoption, the unintended consequence of the Board’s emphasis on PEDs is the de-emphasis now on the other safety critical aspects of this accident. This accident brought into sharp focus the importance of proper instruction and training for rotorcraft operations, and in particular, realistic training achieved through use of simulators as well as training for emergency events. I commend the staff’s effort to delve into and highlight the autorotation dynamics and the importance of simulator training. Such issues are of significant relevance to helicopter operations, especially HEMS operations. As well, the report sections

NTSB Aircraft Accident Report 52 pertaining to the involvement of operationally qualified personnel, who can assess situations with independent judgment, is well founded. The report discussion on this issue is particularly relevant because it provides an opportunity for the Board to reiterate its position on the subject, and to clarify for the community what is intended by previous Board recommendations. Although Air Methods took the step to employ dispatch services and staff an operational control center with qualified personnel, it did not sufficiently establish OCC involvement in operational decision-making – a direct step toward mitigating poor aeronautical decision-making. Finally, the accident provides yet another reminder of the need for data recording devices, albeit the need was well documented through previous Board actions. Recording devices on aircraft have a proven track record for improving safety, a fundamental goal of the Board, although not seen as interesting as PEDs. The Board’s ability to enhance transportation safety rests solely on its credibility, credibility based on independent and objective analyses. It has a responsibility to ensure the elements of a report are fully supported by the facts and circumstances from the underlying accident investigation. As I am constantly reminded within the agency, the Board does not engage in speculation. The value of Board reports and for that matter, safety alerts, is undermined or lost if the underlying facts and analyses do not support the conclusions. In this report, as well as the safety alert, I believe the Board has not fulfilled its responsibility in terms of attributing a contributing cause of this accident to the pilot’s PED use. This accident was certainly a tragedy that need not occur. As the lead advocate for GA safety, I have seen like circumstances far too often in the accident statistics: loss of life due to poor aeronautical decision-making. Addressing this causal factor, along with the other critical safety issues identified through this investigation as outlined above, provides the greatest potential to enhance the safety of helicopter operations. Sadly, this potential is now limited by the distraction caused from the pilot’s use of a PED.

NTSB Aircraft Accident Report 53 References Adams, Charlotte. 2010. “Simulation & Training.” Rotor & Wing (June). http://www.aviationtoday.com/rw/training/maintenance/Simulation-and- Training_68236.html. Belenky, Gregory, Nancy J. Wesensten, David R. Thorne, Maria L. Thomas, Helen C. Sing, Daniel P. Redmond, Michael B. Russo, and Thomas J. Balkin. 2003. “Patterns of Performance Degradation and Restoration During Sleep Restriction and Subsequent Recovery: A Sleep Dose-Response Study.” Journal of Sleep Research 12(1): 1-12. Connell, Linda J. and William D. Reynard. 1995. “Incident Reports Highlight Hazards in EMS Helicopter Operations.” Helicopter Safety. Arlington, VA: Flight Safety Foundation. Dawson, Drew and Kathryn Reid. 1997. “Fatigue, Alcohol and Performance Impairment.” Nature 388: 235. Dinges, David. 1996. “Performance Effects of Fatigue.” In Fatigue Symposium Proceedings, November 1–2, 1995. Washington, DC: NTSB. Ean, Nicholas. 1987. Rotary Wing Flight: An Edited Reprint of Selected Portions of the U.S. Army Field Manual 1-51. Renton, WA: Aviation Supplies & Academics, Inc. FAA (Federal Aviation Administration). 2012a. Helicopter Flying Handbook. FAA-H-8083-21A. Washington, DC: US Department of Transportation, FAA. http://www.faa.gov/regulations_policies/handbooks_manuals/aircraft/media/faa-h-8083- 21A.pdf. ----. 2012b. Helicopter Instructor’s Handbook. FAA-H-8083-4. Washington, DC: US Department of Transportation, FAA. http://www.faa.gov/regulations_policies/handbo oks_manuals/aviation/media/FAA-H-8083-4.pdf. ----. 2010. “Cockpit Distractions.” InFO 10003. Washington, DC: US Department of Transportation, FAA. http://www.faa.gov/other_visit/aviation_industry/airline_operators/ airline_safety/info/all_infos/media/2010/InFO10003.pdf. ----. 2009. Risk Management Handbook. FAA-H-8083-2. Washington, DC: US Department of Transportation, FAA. http://www.faa.gov/regulations_policies/handbooks_manuals/aviati on/media/faa-h-8083-2.pdf. ----. 2008a. “Certification of Normal Category Rotorcraft.” AC 27-1B. Washington, DC: US Department of Transportation, FAA. http://www.faa.gov/documentlibrary/media/advi sory_circular/AC%2027-1B%20CHG3.pdf.

NTSB Aircraft Accident Report 54 ----. 2008b. “Integration of Operations Control Centers into Helicopter Emergency Medical Services Operations.” AC 120-96. Washington, DC: US Department of Transportation, FAA. http://rgl.faa.gov/Regulatory_and_Guidance_Library/rgAdvisor yCircular.nsf/list/AC%20120-96/$FILE/AC%20120-96.pdf. Federal Register. 2013. Vol. 78, no. 10 (January 15). Federal Register. 2010. Vol. 75, no. 196 (October 12). GAO (U.S. Government Accountability Office). 1998. Aviation Safety, U.S. Efforts to Implement Flight Operations Quality Programs. GAO/RCED-98-10. Washington, DC: GAO. Goode, Jeffrey H. 2003. “Are Pilots at Risk of Accidents Due to Fatigue?” Journal of Safety Research 34: 309-313. Harrison, Yvonne and James A. Horne. 2000. “The Impact of Sleep Deprivation on Decision Making: A Review.” Journal of Experimental Psychology: Applied 6(3): 236-249. NTSB (National Transportation Safety Board). 2013. “Preventing Rote Callouts.” Safety Alert SA-018. Washington, DC: NTSB. http://www.ntsb.gov/doclib/safetyalerts/SA_018.pdf. ----. 2011a. Loss of Control While Maneuvering, Pilatus PC-12/45, N128CM, Butte, Montana, March 22, 2009. Aircraft Accident Report AAR-11/05. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2011/AAR1105.pdf. ----. 2011b. Collision into Mountainous Terrain, GCI Communications Corp., de Havilland DHC-3T, N455A, Aleknagik, Alaska, August 9, 2010. Aircraft Accident Report AAR-11/03. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2011/AAR110 3.pdf. ----. 2010a. Crash During Takeoff of Carson Helicopters, Inc., Firefighting Helicopter Under Contract to the U.S. Forest Service, Sikorsky S-61N, N612AZ, Near Weaverville, California, August 5, 2008. Aircraft Accident Report AAR-10/06. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2010/AAR1006.pdf. ----. 2010b. Loss of Control on Approach, Colgan Air, Inc., Operating as Continental Connection Flight 3407, Bombardier DHC-8-400, N200WQ, Clarence Center, New York, February 12, 2009. Aircraft Accident Report AAR-10/01. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2010/AAR1001.pdf. ----. 2009a. Crash During Approach to Landing of Maryland State Police Aerospatiale SA365N1, N92MD, District Heights, Maryland, September 27, 2008. Aircraft Accident Report AAR-09/07. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2009/AAR0907.pdf.

NTSB Aircraft Accident Report 55 ----. 2009b. Midair Collision of Electronic News Gathering Helicopters, KTVK-TV, Eurocopter AS350B2, N613TV, and U.S. Helicopters, Inc., Eurocopter AS350B2, N215TV, Phoenix, Arizona, July 27, 2007. Aircraft Accident Report AAR-09/02. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2009/AAR0902.pdf. ----. 2007. Attempted Takeoff from Wrong Runway, Comair Flight 5191, Bombardier CL-600-2B19, N431CA, Lexington, Kentucky, August 27,

1. Aircraft Accident Report

AAR-07/05. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2007/AAR0705.pdf. ----. 2006a. Controlled Flight Into Terrain, Era Aviation, Sikorsky S-76A++, N579EH, Gulf of Mexico, About 70 Nautical Miles South-Southeast of Scholes International Airport, Galveston, Texas, March 23, 2004. Aircraft Accident Report AAR-06/02. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2006/AAR0602.pdf. ----. 2006b. Controlled Flight Into Terrain, Beech King Air 200, N501RH, Stuart, Virginia, October 24, 2004. Aircraft Accident Brief AAB-06/01. Washington, DC: NTSB. http://www.ntsb.gov/doclib/reports/2006/AAB0601.pdf. ----. 2006c. Special Investigation Report on Emergency Medical Services Operations. NTSB/SIR-06/01. Washington, DC: NTSB. http://www.ntsb.gov/doclib/safetystudies/SIR0601.pdf. ----. 2003. Loss of Control and Impact With Terrain, Aviation Charter, Inc., Raytheon (Beechcraft) King Air A100, N41BE, Eveleth, Minnesota, October 25, 2002. Aircraft Accident Report AAR-03/03. Washington, DC:

NTSB. http://www.ntsb.gov/doclib/reports/2003/AAR0303.pdf Orasanu, Judith, L. Martin, and Jeannie Davison. 2001. “Cognitive and Contextual Factors in Aviation Accidents; Decision Errors.” In Linking Expertise and Naturalistic Decision Making, edited by Eduardo Salas and Gary Klein, 209-226. Mahwah: Erlbaum Associates. Sarter, Nadine B. and Heather M. Alexander. 2000. “Error Types and Related Error Detection Mechanisms in the Aviation Domain: An Analysis of Aviation Safety Reporting System Incident Reports.” The International Journal of Aviation Psychology 10(2): 189-206. Speier, Cheri, Iris Vessey, and Joseph S. Valacich. 2003. “The Effects of Interruptions, Task Complexity, and Information Presentation on Computer-Supported Decision-Making Performance.” Decision Sciences 34(4): 771-97.

FD07402 ｜ 2013_美国_HAR1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Highway–Railroad Grade Crossing Collision Midland, Texas November 15, 2012

Accident Report NTSB/HAR-13/02 PB2014-100830

National Transportation Safety Board

NTSB/HAR-13/02 PB2014-100830 Notation 8462A Adopted November 5, 2013

Highway Accident Report Highway–Railroad Grade Crossing Collision Midland, Texas November 15, 2012

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2013. Highway–Railroad Grade Crossing Collision, Midland, Texas. Highway Accident Report NTSB/HAR-13/02. Washington, DC.

Abstract: About 4:35 p.m. on November 15, 2012, in Midland, Texas, a freight train collided with a parade float at a highway–railroad grade crossing, resulting in 4 fatalities and 12 injuries. The float consisted of a 2006 Peterbilt truck-tractor in combination with a 2005 Transcraft D-Eagle drop-deck flatbed semitrailer and was traveling south on South Garfield Street as part of a parade procession honoring US military men and women. The float, occupied by 12 veterans and their spouses, continued along South Garfield Street until it reached the intersection of West Front Avenue, where the traffic signal displayed red. Law enforcement personnel stationed to block cross traffic permitted the float and its escorts to continue across the intersection unhindered. About 80 feet south of the West Front Avenue intersection was an active highway–railroad grade crossing, and the crossing’s warning system activated as the float approached. The float continued across the railroad tracks at an estimated speed of 5 mph. A Union Pacific Railroad freight train approached the South Garfield Street crossing from the west at a speed of 62 mph. The train reached the crossing and struck the right rear of the float, causing the flatbed to rotate clockwise 122 degrees. As the flatbed rotated, it struck several occupants who were evacuating the float. It also struck a stationary 2008 Ford Crown Victoria occupied by a sheriff’s deputy. The collision did not cause the train to derail. This investigation focused on the following safety issues: driver expectations due to a consistent law enforcement escort, lack of awareness of traffic signal preemption by law enforcement escorts, and lack of parade planning. As a result of this investigation, the NTSB makes recommendations to the Federal Highway Administration, Federal Railroad Administration, city of Midland, National League of Cities, National Association of Counties, National Association of Towns and Townships, United States Conference of Mayors, International City/County Management Association, and International Festivals and Events Association. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety at www.ntsb.gov. Other information may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order report number PB2014-100830 from:

National Technical Information Service 5301 Shawnee Road Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB

Highway Accident Report

i

Contents Figures ........................................................................................................................................... iii Tables ..............................................................................................................................................v Acronyms and Abbreviations ..................................................................................................... vi Executive Summary .................................................................................................................... vii 1 Crash Narrative .......................................................................................................................1 1.1 Overview ..................................................................................................................................1 1.2 Crash Reconstruction Details ...................................................................................................6 1.3 Injuries ......................................................................................................................................9 1.4 Wreckage ................................................................................................................................11 2 Collision Factors.....................................................................................................................16 2.1 Introduction ............................................................................................................................16 2.2 Driver Factors .........................................................................................................................17 2.2.1 Employment History and Safety Record .....................................................................17 2.2.2 Activities Prior to Collision .........................................................................................18 2.2.3 Driver Expectancies .....................................................................................................21 2.2.4 Visibility .......................................................................................................................22 2.2.5 Parade Noise ................................................................................................................23 2.2.6 In-Vehicle Distractors ..................................................................................................23 2.2.7 Toxicology ...................................................................................................................24 2.2.8 Health ...........................................................................................................................24 2.2.9 Sleep Habits .................................................................................................................24 2.3 Highway Factors .....................................................................................................................25 2.3.1 Background ..................................................................................................................25 2.3.2 South Garfield Street Configuration ............................................................................25 2.3.3 South Garfield Street Signs and Markings...................................................................26 2.3.4 South Garfield Street Grade Crossing ..........................................................................27 2.3.5 Advance Preemption ....................................................................................................31 2.4 Show of Support Parade Factors ............................................................................................38 2.4.1 Background ..................................................................................................................38 2.4.2 Parade Permit Process ..................................................................................................42 2.4.3 Railroad Notification ...................................................................................................43 2.4.4 Parade Planning ...........................................................................................................44 2.4.5 Parade Float Operation ................................................................................................45 2.4.6 Parade and Event Safety ..............................................................................................46 3 Conclusions .............................................................................................................................49 3.1 Findings ..................................................................................................................................49 3.2 Probable Cause .......................................................................................................................51

NTSB

Highway Accident Report

ii

4 Recommendations ..................................................................................................................52 Board Member Statement ...........................................................................................................55 References .....................................................................................................................................58 Appendix A: Investigation ..........................................................................................................60 Appendix B: Reconstruction Timeline Details ..........................................................................61 Appendix C: Float Driver Activities (Nov. 12-15, 2012)...........................................................70 Appendix D: Parade Operations Guidelines .............................................................................72

NTSB

Highway Accident Report

iii

Figures Figure 1. Location of Midland, Texas............................................................................................ 1 Figure 2. Parade route showing the location of the crash .............................................................. 2 Figure 3. Float vehicle ................................................................................................................... 3 Figure 4. Traffic lights on southbound South Garfield Street at the intersection with West Front Avenue and the incline leading to grade crossing ..................................................................3 Figure 5. Aerial view of the crash site ........................................................................................... 4 Figure 6. Reconstruction of the vehicle positions at the time of the collision with train .............. 5 Figure 7. Postcrash scene showing the extent to which the flatbed rotated clockwise after being struck by the train ...................................................................................................................6 Figure 8. Approximate position of float when the grade crossing warning system activated ....... 7 Figure 9. Depiction of the occupant injuries by seating location on the parade float .................. 10 Figure 10. Front view of the undamaged truck-tractor at the crash site ...................................... 11 Figure 11. Damage to the flatbed tire rim on the right side of the fifth axle ............................... 12 Figure 12. Damage on the right side of the flatbed at the fifth axle tire and rim, the area directly impacted by the train ........................................................................................................12 Figure 13. Computerized image showing the degree to which the flatbed was deformed by the collision with the train. ........................................................................................................13 Figure 14. Damage to the lead locomotive of the train ................................................................ 13 Figure 15. Close-up view of the damage to the front of the lead locomotive .............................. 14 Figure 16. Damage to the Ford .................................................................................................... 15 Figure 17. Depiction of the change in vertical slope between West Front Avenue and South Garfield Street......................................................................................................................20 Figure 18. Diagram showing the road markings around the grade crossing, including the railroad crossing markings for each of the two lanes, as well as a stop line .................................26 Figure 19. Aerial photo of South Garfield Street around the grade crossing ............................... 27

NTSB

Highway Accident Report

iv

Figure 20. Driver’s view of the traffic signals on West Front Avenue from southbound South Garfield Street......................................................................................................................28 Figure 21. Grade crossing warning system mounted on the masts located on both northbound and southbound South Garfield Street ........................................................................29 Figure 22. View of the 12-foot distance between the rails and grade crossing mast on the southbound side of South Garfield Street and the warning light configuration ............................30 Figure 23. Depiction of the typical track clearance green interval .............................................. 32 Figure 24. Depiction of the typical traffic signal pattern once the track clearance green interval has expired ........................................................................................................................33 Figure 25. Illustration of the point, 67 feet from the stop line, at which the red stop signal was noticeable on the Midland County Sheriff’s vehicle dash camera .........................................34 Figure 26. View of the confirmation light activating at a railroad grade crossing in Minneapolis, Minnesota .................................................................................................................35 Figure 27. Close-up view of the same confirmation light activating at the same railroad grade crossing in Minneapolis, Minnesota ....................................................................................36 Figure 28. No-right-turn, no-left-turn, and no-through movement-activated blank-out signs .... 36 Figure 29. Movement-activated blank-out sign near a grade crossing in Thomasville, North Carolina ...............................................................................................................................36 Figure 30. Movement-activated blank-out sign near crossing in Belle Chasse, Louisiana ......... 37 Figure 31. Parade route 2004–2005 ............................................................................................. 39 Figure 32. Parade route 2006–2010 ............................................................................................. 40 Figure 33. Parade route 2011–2012 ............................................................................................. 41

NTSB

Highway Accident Report

v

Tables Table 1. Crash timeline .................................................................................................................. 8 Table 2. Injuries and fatalities ........................................................................................................ 9 Table 3. Float driver activities, November 12–15, 2012 .............................................................. 18

NTSB

Highway Accident Report

vi

Acronyms and Abbreviations ABS antilock brake system BMI body mass index CB citizen’s band (radio) CDL commercial driver’s license CFD Cosumnes Fire Department CFR Code of Federal Regulations CSU Colorado State University DOT US Department of Transportation EVP emergency vehicle preemption FAU Florida Atlantic University FHWA Federal Highway Administration FRA Federal Railroad Administration MUTCD Manual on Uniform Traffic Control Devices NMSU New Mexico State University NTSB National Transportation Safety Board Show of Support Show of Support, Military Hunt, Inc. Union Pacific Union Pacific Railroad

NTSB

Highway Accident Report

vii

Executive Summary About 4:35 p.m. central standard time on Thursday, November 15, 2012, in Midland, Texas, a freight train collided with a parade float at a highway–railroad grade crossing, resulting in 4 fatalities and 12 injuries. The float, which consisted of a 2006 Peterbilt truck-tractor in combination with a 2005 Transcraft D-Eagle drop-deck flatbed semitrailer, was traveling south on South Garfield Street as part of a parade procession honoring US military men and women. The truck-tractor was driven by a 50-year-old male, and the flatbed was occupied by 12 veterans and their spouses. The float was flanked by two law enforcement escort vehicles. The float continued along South Garfield Street until it reached the intersection of West Front Avenue, where the traffic signal displayed red. Law enforcement personnel stationed to block cross traffic permitted the float and its escorts to continue across the intersection unhindered. About 80 feet south of the West Front Avenue intersection was a highway–railroad grade crossing equipped with warning bells, warning lights, and an automatic gate assembly. As the float approached, the grade crossing warning system activated. The float continued across the railroad tracks at an estimated speed of 5 mph, and the grade crossing gate descended on the flatbed, striking several of the flag poles lining its right side. At about the same time, a Union Pacific Railroad (Union Pacific) freight train, consisting of 4 locomotives and 84 loaded freight cars, approached the South Garfield Street crossing from the west at a speed of 62 mph. The engineer sounded the horn and placed the train into emergency braking as the front of the float crossed the tracks. The train reached the crossing and struck the right rear of the float, causing the flatbed to rotate clockwise 122 degrees. As the flatbed rotated, it struck several occupants who were evacuating the float. It also struck a stationary 2008 Ford Crown Victoria occupied by a sheriff’s deputy. The collision did not cause the train to derail. As a result of the collision, four float passengers were killed. Eleven float passengers were injured, and the sheriff’s deputy was also injured. The two train crewmembers, the float driver, and nine other float passengers were not injured. The National Transportation Safety Board (NTSB) determines that the probable cause of this collision was the failure of the city of Midland and the parade organizer, “Show of Support, Military Hunt, Inc.” (Show of Support), to identify and mitigate the risks associated with routing a parade through a highway–railroad grade crossing. Contributing to the collision was the lack of traffic signal cues to indicate to law enforcement that an approaching train had preempted the normal highway traffic signal sequence at the intersection of South Garfield Street and West Front Avenue. Further contributing to the collision was an expectancy of safety on the part of the float driver, created by the presence of law enforcement personnel as escorts and for traffic control, leading him to believe that he could turn his attention to his side-view mirrors to monitor the well-being of the parade float occupants as he negotiated a dip in the roadway on approach to the grade crossing.

NTSB

Highway Accident Report

viii

This investigation focused on the following safety issues:  Driver expectations: The float driver had been escorted by law enforcement vehicles throughout the parade. Law enforcement had blocked cross traffic at each major signalized highway intersection up to the grade crossing. With right of way seemingly established for the parade and with law enforcement escorts on both sides of his vehicle, the float driver diverted his attention from the roadway to attend to the well- being of his passengers as the float negotiated a dip in the road ahead of the grade crossing.  Awareness of traffic signal preemption: Law enforcement escorts were not aware that the highway traffic signal on approach to West Front Avenue had been preempted by an approaching train.  Parade planning: Show of Support had not obtained a parade permit since 2009. The Show of Support parade committee did not have a written safety plan detailing how the parade was to be organized and executed, nor was Union Pacific informed of the parade schedule and route. As a result of this investigation, the NTSB makes recommendations to the Federal Highway Administration, Federal Railroad Administration, city of Midland, National League of Cities, National Association of Counties, National Association of Towns and Townships, United States Conference of Mayors, International City/County Management Association, and International Festivals and Events Association.

NTSB

Highway Accident Report

1

1 Crash Narrative 1.1 Overview On Thursday, November 15, 2012, about 4:02 p.m. central standard time, a parade sponsored by “Show of Support, Military Hunt, Inc.” (Show of Support), commenced in Midland, Texas, to honor a select group of veterans (see figure 1). The parade was an annual event, and generally included a high school band, car and motorcycle clubs, fire and law enforcement vehicles, and emergency medical vehicles, among other participants. The temperature at the time was 71 degrees Fahrenheit. Visibility was 10 miles, and the roadway was dry. The parade began in downtown Midland and proceeded along West Wall Street until it reached South Garfield Street. The procession then turned left and continued south along South Garfield Street en route to the Midland County Horseshoe Arena. At the turn, the high school band departed and riders from a motorcycle club took its place, leaving only motorized vehicles in the procession. The pace of the parade increased from about 5 mph to 9 mph. The complete parade route was approximately 3.1 miles long (see figure 2).

Figure 1. Location of Midland, Texas.

NTSB

Highway Accident Report

2

Figure 2. Parade route showing the location of the crash, denoted with a red symbol.

Among the vehicles in the parade was a float consisting of a 2006 Peterbilt truck-tractor in combination with a 2005 Transcraft D-Eagle drop-deck flatbed semitrailer (see figure 3). The float was operated by a 50-year-old male driver, and was the second of two floats being used to transport veterans and their spouses. The flatbed portion of the float was equipped with 26 metal-framed chairs arranged into 13 rows and held down with nylon cargo straps. All but the first row of chairs were occupied, with veterans seated on the left side (driver side) and spouses seated on the right. Two law enforcement vehicles, positioned on opposite sides of the float, acted as escorts.

NTSB

Highway Accident Report

3

Figure 3. Float vehicle. The float continued along South Garfield Street and reached the intersection of West Front Avenue, where it slowed to about 5 mph (see figure 4). The highway traffic signal at the intersection was red; however, law enforcement personnel blocking traffic on West Front Avenue allowed the float to proceed unhindered (see figure 5). About 80 feet from the south curb of the West Front Avenue intersection was an active hump highway–railroad grade crossing (grade crossing).1 As the float negotiated the incline on approach to the grade crossing, the warning system activated. The float continued to move forward onto the railroad tracks. As it did so, the grade crossing gate, situated 12 feet north of the tracks, descended on the float. The escort vehicles slowed and came to a stop several feet north of the descending gate.

Figure 4. Traffic lights on southbound South Garfield Street at the intersection with West Front Avenue and the incline leading to grade crossing.

1 An active grade crossing is one equipped with traffic control devices, such as flashing warning lights, bells, and gates. A hump grade crossing is a crossing where the railroad bed is higher than the road, creating a vertical curve for the motorist to cross. 2006 Peterbilt truck-tractor 2005 Transcraft drop-deck trailer

NTSB

Highway Accident Report

4

Figure 5. Aerial view of the crash site with arrows marking route of parade and train. (Photo courtesy of Google Maps) Union Pacific Railroad (Union Pacific) freight train ZLCAI-14 (train) was traveling east from Los Angeles, California, to Atlanta, Georgia, at a speed of 62 mph. The train crew consisted of a 35-year-old engineer and a 27-year-old conductor. The engineer stated that when he realized the float was not going to stop at the grade crossing, he sounded the train horn and placed the train into emergency braking. At about 4:35 p.m., the right front corner of the locomotive unit struck the right rear portion of the float (see figure 6). The train did not derail and continued braking to a stop.

NTSB

Highway Accident Report

5

Figure 6. Reconstruction of the vehicle positions at the time of the collision with train.

The collision caused the flatbed to rotate 122 degrees clockwise and the truck-tractor to rotate 28 degrees clockwise (see figure 7). The flatbed struck a 2008 Ford Crown Victoria (Ford), which was parked on the northbound intersection of South Garfield Street and West Industrial Avenue and was occupied by a deputy for the Midland County Sheriff’s Office. The collision killed four float passengers. Eleven float passengers were injured, and the sheriff’s deputy was also injured. The two train crewmembers, the float driver, and nine float passengers were not injured.

NTSB

Highway Accident Report

6

Figure 7. Postcrash scene showing the extent to which the flatbed rotated clockwise after being struck by the train. (Photo courtesy of the Midland City Police Department) 1.2 Crash Reconstruction Details The National Transportation Safety Board (NTSB) launched a full team of investigators to the crash site (see appendix A) and relied on several sources to reconstruct the events that led to the collision. Video sources included the train’s track image recorder, a dash-mounted camera in the Midland County Sheriff’s vehicle (escorting the float on the right side), and a camera in the lead float. The NTSB also used data from the locomotive event recorder, physical evidence from vehicles and the roadways, and information from witness interviews. According to the data, about a minute prior to impact, the train passed a “clear” signal green aspect indicating that it was permitted to proceed past that signal.2 In the meantime, the float was traveling south at about 9 mph toward the West Front Avenue intersection, flanked by law enforcement escort vehicles. The highway traffic signal displayed red when the float was about 67 feet from the intersection. Additional law enforcement personnel were positioned at the

2 “Aspect” refers to the visual appearance of the signal. The “clear” indication meant that the track was clear of other train equipment. The signal system does not monitor the tracks for intrusion from highway vehicles nor is the grade crossing warning system tied to the railroad signal system.

NTSB

Highway Accident Report

7

intersection to block cross traffic on West Front Avenue. The approaching train preempted the traffic signals on West Front Avenue just as the float began passing over the white stop line at 5 mph.3 The escort vehicles also continued across the West Front Avenue intersection. Approximately 21 seconds before impact, as the front of the float approached the south curb of the West Front Avenue intersection, the grade crossing warning system lights and bells activated. The float was approximately 61–64 feet from the grade crossing stop line and 69–72 feet from the crossing gate (see figure 8), which had not yet begun to descend. The float and escort vehicles continued to move forward. Soon after activation of the grade crossing warning system, the driver of the escort vehicle to the left of the float noticed the flashing lights and bells, and repeatedly yelled “train” over the Midland County Sheriff’s radio channel.4 Approximately 13.5 seconds before impact, the crossing gate began to descend on top of the float.

Figure 8. Approximate position of the float when the grade crossing warning system activated.

3 See Section 2.3.5 for a discussion of highway traffic signal preemption. 4 Based on interviews with sheriff’s deputies taking part in the parade, a back channel was used for communication among deputies during the parade and was not monitored or recorded by the dispatch center; therefore, the exact time of this transmission could not be determined. This channel was not accessible to the float drivers.

NTSB

Highway Accident Report

8

The escort vehicles slowed to a stop, halting on the incline several feet north of the crossing gate. The gate continued to descend until it contacted one of the flag poles mounted on the float. Approximately 8.9 seconds before impact, the front of the float was on the tracks. Passengers on the flatbed portion of the float began evacuating. Most passengers evacuated on the south side of the railroad tracks; several passengers seated to the rear of the float evacuated safely to the north side of the tracks. Approximately 7.8 seconds before impact, the horn on the lead locomotive sounded. The front of the float was 16 feet past the north rail, and the train was approximately 709 feet west of the point of impact. Approximately 4.8 seconds before impact, or 3 seconds after the horn was sounded, the train was placed into emergency braking. Braking continued as the train struck the rear of the float at 4:35 p.m., causing the flatbed to rotate clockwise through an arc of 122 degrees. As the flatbed rotated, it surmounted the highway median and east curb, striking highway signage and at least two passengers who had evacuated the float. The train came to a full stop approximately 78 seconds and 3,547 feet after the emergency brakes were applied, or slightly more than 73 seconds and 3,110 feet after striking the float. Table 1 presents the time and location of the train and float in the moments leading up to the crash, and appendix B illustrates the sequence of events. Table 1. Crash timeline. Event Local Time (p.m.) Front of Float Relative to North Rail (ft) Train Relative to Point of Impact (ft) Time to Impact (sec) Train Speed (mph) Float Speed (avg mph) Float 67 ft before W Front Ave stop line 4:34:55 228 3321 36.5 62 8 Float at W Front Ave stop line 4:35:02 161 2767 30.4 62 6 Traffic signal preempted 4:35:02 157 2729 30.0 62 6 Crossing signal lights active 4:35:11 82 1910 21.0 62 5 Gate descends 4:35:18 25 1228 13.5 62 5 Front of float atop rails 4:35:23 9a 808 8.9 62 5 Train horn 4:35:24 16a 709 7.8 62 5 Train begins emergency braking 4:35:27 38a 437 4.8 62 5 Impact 4:35:32 73a 0 0 62 5 a References positions south of (past) north rail.

NTSB

Highway Accident Report

9

1. 3 Injuries

The four passengers who were killed had either evacuated the left side of the float or were in the process of doing so when the train struck. Autopsies showed that the deaths were caused by multiple blunt force traumatic injuries from contact with either the ground or the rotating flatbed. Of those who were seriously injured, one person was hit directly by the train and three were hit by the trailer portion of the float. The minor injuries occurred primarily from evacuating or falling.

Eleven injured flatbed passengers and the sheriff’s deputy were transported to a local hospital, with one passenger subsequently flown to a medical center in Lubbock, Texas. The float driver was not injured but also was transported to a local hospital. The train crew was not injured. Table 2 and figure 9 summarize the injuries and fatalities from this collision. Table 2. Injuries and fatalities. Injurya Float Driver Train Crew Float Passengers Car Occupant Total Fatal 0 0 4 0 4 Serious 0 0 4 0 4 Minor 0 0 7 1 8 None 1 2 9 0 12 Total 1 2 24 1 28 a Title 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as any injury that results in death within 30 days of the accident. It defines serious injury as an injury that requires hospitalization for more than 48 hours, commencing within 7 days of the date of injury; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, or nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.

NTSB

Highway Accident Report

10

Figure 9. Depiction of the occupant injuries by seating location on the parade float. Note that several occupants had vacated their seats and the float itself prior to the collision with the train.

NTSB

Highway Accident Report

11

1. 4 Wreckage

The truck-tractor portion of the float was not damaged in the collision (see figure 10); however, the flatbed suffered extensive direct and indirect damage throughout its structure (see figures 11, 12, and 13). The damage included bent and separated frame rails and deck rails; a torn and displaced end plate holding the rear lights, including the antilock brake system (ABS) malfunction indicator light; and a bent and torn outer wheel rim on the right side of the fifth axle. The rear end of the flatbed was deformed laterally toward the driver side, resulting in a skew of its deck, measuring approximately 2 feet at the aft end. In addition, the fourth and fifth axles on the left side of the flatbed had minor damage caused by the collision with the Ford.

Figure 10. Front view of the undamaged truck-tractor at the crash site.

NTSB

Highway Accident Report

12

Figure 11. Damage to the flatbed tire rim on the right side of the fifth axle.

Figure 12. Damage on the right side of the flatbed at the fifth axle tire and rim, the area directly impacted by the train.

NTSB

Highway Accident Report

13

Figure 13. Computerized image showing the degree to which the flatbed was deformed by the collision with the train, with front of flatbed to the left.

The train, which consisted of 4 locomotives and 84 loaded freight cars, was 7,247 feet long and weighed 5,556 gross tons. The locomotives, configured for multiple-unit operation, were controlled from the lead locomotive. Three locomotive units were on the front of the train, and the fourth was at the rear. Damage to the train was limited to the right front corner of the lead locomotive. The plow, end plate, side steps, and side step mounting plate on the right side all exhibited rearward displacement. The hand rail and uncoupling lever were bent, and the plow was cracked (see figures 14 and 15).

Figure 14. Damage to the lead locomotive of the train.

Strike point

NTSB

Highway Accident Report

14

Figure 15. Close-up view of the damage to the front of the lead locomotive, showing gouges and scrapes on lower right corner of the plow and deformation to the side steps.

NTSB

Highway Accident Report

15

The Ford was damaged on its right front quarter panel, right rear door, rear quarter panel, and trunk lid (see figure 16). The right rear-view mirror was broken off. Both the right front passenger window and the rear windshield were broken. The right rear wheel was damaged and the tire was deflated. The right rear portion of the back seat exhibited signs of deformation from the inward displacement of the right rear passenger door and C-pillar.5 Additionally, the right rear C-pillar interior molding was separated from the headliner.

Figure 16. Damage to the Ford.

5 The C-pillar is the roof support between a car’s rearmost side window and its rear window.

NTSB

Highway Accident Report

16

2 Collision Factors 2.1 Introduction The NTSB considered the following factors in its investigation of the Midland, Texas, grade crossing collision: (1) emergency response; (2) vehicle maintenance; (3) motor carrier and train operation; (4) railway infrastructure; (5) float driver actions; (6) highway design and signal operations; and (7) parade planning. An examination of the timeline and actions of those responding to the grade crossing collision found that emergency responders quickly reached the scene, secured the area, and treated and evacuated the victims. Inspections of the float, the train, and the Ford uncovered no defects, maintenance issues, or utilization issues that caused or contributed to the collision or to the severity of injuries.6 Examination of the operational practices of Smith Industries—the owner and operator of the 2006 Peterbilt combination unit being used as the float—and Union Pacific revealed no policy or procedural issues that contributed to the crash. In addition, the train engineer was found to be qualified to operate the train. The engineer and the conductor had ample sleep opportunity during the previous days, did not have physiological issues that might have affected their performance, and had only been on duty for 3 hours prior to the crash. The NTSB determined that the engineer’s actions in response to the developing situation at the grade crossing were appropriate, given the float’s slow approach speed and the inherent risks to crew and rail equipment when a train is placed into emergency braking.7 A postcrash inspection of the railroad track at and on approach to the South Garfield Street grade crossing noted no issues with the track or the track structure. Data gathered from the train traffic control signal system indicated that the proper signal sequence was displayed for all train movements. Dispatch center data logs showed that the train had been given permission to proceed. In addition, the signal data logs and radio communications from the dispatch center showed routine operations prior to the crash. The NTSB concludes, therefore, that emergency response, vehicle maintenance, motor carrier and train operation, and railway infrastructure were not factors in the grade crossing collision or resulting injuries. During its investigation, the NTSB identified three areas warranting further examination: (1) factors that might have caused the float driver to miss or disregard the grade crossing warning signals; (2) the interconnection of the highway traffic signal system and the grade crossing warning system; and (3) the parade planning and permitting process. Section 2.2 provides background information on the float driver before detailing the circumstances that likely led him to cross the railroad tracks, despite the activation of the grade crossing warning system.

6 Brakes on the flatbed portion of the float malfunctioned during testing due to dust buildup in the ABS modulator valve assembly. This condition was not a factor in the collision, however, because the float driver did not apply the brakes prior to being struck by the freight train. Since the collision, the motor carrier (Smith Industries) has improved its maintenance practices related to dust removal to prevent brake malfunction on its vehicles. 7 Emergency braking is often considered a last resort because it can damage train components, track structure, and cargo. It can also result in a train derailment.

NTSB

Highway Accident Report

17

Section 2.3 describes the interconnection of the highway traffic signal system and the grade crossing warning system, and explores whether sufficient information was provided to law enforcement officials and other road users regarding the preemption of the normal highway traffic signal sequence by an approaching train. Section 2.4 examines whether the steps taken by Show of Support and the city of Midland to organize, permit, and conduct the parade were adequate to ensure the safety of the parade participants. 2.2 Driver Factors 2.2.1 Employment History and Safety Record The float driver, a 50-year-old male, held a Texas class A commercial driver’s license (CDL) at the time of the collision.8 The CDL was issued in February 2012 and expires in January

1. It included an N (tank) endorsement and a requirement that the driver wear his prescription

eyeglasses while driving. When interviewed by investigators, the float driver stated that he wore his prescription glasses “all the time.” The float driver began working for Smith Industries in September 2011. His employment application indicated that he had about 27 months of experience driving commercial vehicles, such as vans, tank trucks, straight trucks, and truck-tractor semitrailers. Additionally, he had served as a driver examiner in the US Army and had earned the Driver and Mechanic Badge while serving.9 In total, the float driver had about 4 years of experience driving commercial vehicles. When interviewed, the float driver told investigators that he had “years” of experience with Peterbilt truck-tractors and that he normally drove a Peterbilt on his regular route. The parade was his first time driving the truck-tractor portion of the float. He stated that he experienced no problems with either the truck-tractor or the flatbed prior to the collision. Driving records indicated that the float driver had been involved in crashes in his personal vehicle in July 2007 and July 2011, but he was not cited in either incident. He was cited for speeding in April 2006 while in a commercial vehicle. The float driver completed two roadside inspections in the past 2 years, including a level I inspection that occurred immediately following the Midland collision.10 A review of the float driver’s logbook entries from September 1 to November 15, 2012, indicated no hours-of-service violations.

8 A Texas class A CDL allows the operation of any combination of vehicles with a gross combination weight rating of 26,001 pounds or more, provided that the gross vehicle weight rating of the vehicle or vehicles towed exceeds 10,000 pounds. 9 Per Army Regulation 600-8-22, revised 15 September 2011, the Driver and Mechanic Badge is awarded to drivers, mechanics, and special equipment operators to denote the attainment of a high degree of skill in the operation and maintenance of motor vehicles. 10 A level I inspection is a detailed inspection of the driver, the vehicle, and the cargo. Five vehicle-related violations were found during the postcrash inspection of the float, with none resulting in the vehicle being placed out of service. The previous roadside inspection conducted in December 2011 resulted in one out-of-service violation for insufficient tie-downs.

NTSB

Highway Accident Report

18

The float driver generally worked Monday through Friday, 10–11 hours per day. His duty shift typically started about 7:00 a.m. The float driver was paid by the hour. His duties included delivering and unloading the cargo and helping assemble the delivered units. 2.2.2 Activities Prior to Collision The NTSB used information gathered from an interview with the float driver, his cell phone records, his logbook entries, video evidence, and an interview with the lead float driver to reconstruct the float driver’s activities on the days leading up to the parade. A detailed listing of these activities is provided in appendix C. Table 3 also summarizes the float driver activities. Table 3. Float driver activities, November 12–15, 2012. Monday, November 12 Time Event Source 5:15 a.m. Logs on duty Logbook 6:30 p.m. Logs off duty Logbook 9:30 p.m. Goes to bed Interviewb Tuesday, November 13 Time Event Source 5:15 a.m. Awakes Interviewb 7:00 a.m. Logs on duty Logbook 7:30 p.m. Logs off duty Logbook 9:30 p.m. Goes to bed Interviewb Wednesday, November 14 Time Event Source 5:15 a.m. Awakes Interviewb 7:00 a.m. Logs on duty Logbook 4:00 p.m. Logs off duty Logbook 9:30 p.m. Goes to bed Interviewb 10:21 p.m. Sends last outgoing dataa of day Cell phone records Thursday, November 15 Time Event Source 5:15 a.m. Awakes Interviewb 5:40 a.m. Leaves home Interviewb 5:50 a.m. Arrives at work Interviewb 7:00 a.m. Logs on duty Logbook unknown Goes home, puts on uniform, returns to work Interview

2:15 p.m. Logs driving in Midland, TX Logbook 2:30 p.m. Arrives at DoubleTree hotel Interview with other driver unknown Assists veterans onto flatbed Interview 3:51 p.m. Last cell activity before collision Cell phone records 4:02 p.m. Parade begins Video 4:35 p.m. Collision occurs

a Text/SMS/pictures are tracked together by the float driver’s cellular provider, referred to as “data” in the table. b Denotes the float driver's description of a typical day and not a specific recollection by the driver.

NTSB

Highway Accident Report

19

On the day of the parade, the float driver arrived at the Smith Industries terminal at 5:50 a.m. He conducted a pretrip inspection of the float and washed the vehicle. He secured the chairs, supplied by the city of Midland, to the flatbed. He arrived at the parade staging area about 2:30 p.m., and the parade began at 4:02 p.m. When interviewed, the float driver said that this was his first parade and his first involvement with Show of Support. He stated that he had not participated in any meetings regarding the parade and that he had obtained the parade route information from the lead float driver. The float driver told investigators that, prior to turning onto South Garfield Street, the parade had maintained a slow pace. A block after turning left onto South Garfield Street, the marching band departed, and a motorcycle club took its place. The speed of the parade increased until it reached the intersection of West Front Avenue. He stated that he radioed the lead float driver to voice his concern about the speed and was told that it always increased at that point. The south end of the West Front Avenue intersection contained a dip, followed by a short incline to the railroad tracks (see figure 17). The float driver indicated that, although he had driven across the grade crossing in his personal vehicle, he had never done so in a commercial vehicle. In an effort to minimize the jolt of the dip on his passengers, the float driver used his left-side mirrors to monitor the tires of the flatbed as they cleared the dip. He then shifted his gaze to the right-side mirror. He stated that he saw flashing lights in that mirror but did not initially attach any meaning to them, because they were “just flashing lights, more flashing lights.”11 The float driver stated that he looked down the tracks and saw the train, but it appeared stationary. In his mirror, he saw the crossing gate descend and strike either the flatbed or one of the flags mounted to it. He stated that he saw people jumping off the flatbed just before the train arrived.

11 The float driver’s statement suggests that he might have seen the grade crossing warning lights facing northbound traffic on the west grade crossing warning mast. Further, his mention of “more flashing lights” likely references the light bars on the law enforcement and fire department vehicles, which were continuously on during the parade.

NTSB

Highway Accident Report

20

Figure 17. Depiction of the change in vertical slope between West Front Avenue and South Garfield Street, which resulted in a slight dip in the roadway (vertical scale in profile view is exaggerated to better illustrate the changes in slope).

When asked about the warning bells and the train horn, the float driver stated that a train horn mounted on the lead float was sounded throughout the parade. Therefore, he was not sure whether he had heard the horn on the lead float or the horn from the train. He stated that he did not remember hearing the warning bells at the crossing. When asked about the police presence during the parade, the float driver stated that he was escorted by two law enforcement vehicles, one on each side of the float. He noted that additional law enforcement personnel blocked the x R R x R R x R R x R R ONLY ONLY Plan View S. Garfield St. West Front Ave. West IndustrialAve. UP Railroad grade crossing Railroad signal bungalow Profile View

• 0.4 %
• 5.6 %
• 5.4 %

Railroad flashing lights and gate City traffic signal pole City traffic signal cabinet Roadway dip

NTSB

Highway Accident Report

21

intersections along the parade route. He stated that he thought law enforcement was there to keep his path clear. He could not recall how many intersections he had passed through during the parade. He did not specifically recall seeing the traffic light at West Front Avenue, and he said that he never bothered looking at the traffic lights during the parade because the intersections were blocked off. 2.2.3 Driver Expectancies Video evidence indicated that the float driver continued to approach the railroad tracks at a constant speed, despite the activation of the grade crossing warning system. In examining the reasons for the float driver’s action, the NTSB considered the following information:  Prior to the collision, the float had traveled along the parade route for approximately 34 minutes, covering approximately 2 miles. During this time, law enforcement vehicles continuously escorted the float.  Video from one of the escorts showed that, prior to reaching the West Front Avenue intersection, the float had passed through six signalized intersections. Of those intersections, law enforcement controlled five. The traffic signals at four of the five intersections were red when the float was allowed to proceed without stopping.  Law enforcement personnel blocked the cross traffic at the intersection of West Front Avenue to allow the float to proceed through a red traffic signal and continue its approach toward the grade crossing.  According to the Texas Transportation Code, Title 7, Subtitle C, section 544.004(a), “The operator of a vehicle or streetcar shall comply with an applicable official traffic-control device placed as provided by this subtitle unless the person is …otherwise directed by a traffic or police officer….”  The float driver and the escorts did not have an established means of quickly communicating with each other, such as a dedicated radio channel.  The float driver stated that he did not notice or attend to traffic signals along the parade route due to the presence of law enforcement escorts. Additionally, during his approach and negotiation of the grade crossing, he said that he did not notice or attend to the active visual and auditory warning signals. Participation in a parade that included law enforcement escorts and law enforcement control of intersections may have created an expectancy of safety and right of way on the part of the float driver, regardless of the highway situation he encountered. Expectancy can be defined as a predisposition to believe that things will happen or be arranged in a certain way (Olson, Dewar, and Farber 2010, 21). Expectancies are associated with all levels of the driving task and all phases of the driving situation. Examples include the arrangement of the brake and acceleration pedals, the sequence of traffic signals, and the behavior of drivers who activate their left-turn indicator light. Such expectancies are learned through exposure to other motorists and to general civil/traffic engineering practices. They directly relate to a driver’s readiness to respond

NTSB

Highway Accident Report

22

to conditions, situations, events, and information (Alexander and Lunenfeld 1986, 8–9). Expectancies can influence the speed and accuracy of driver information processing and are considered one of the most important considerations in the design of highways and presentation of information to drivers. Conditions in accordance with drivers’ expectancies help them respond quickly, efficiently, and without error. Conversely, when driver expectancies are violated, longer reaction times, confusion, inappropriate response, and driver error may occur (Alexander and Lunenfeld 1986, 8). The float driver’s statements strongly suggest that his expectation of danger was low due to the situation (a parade), the presence of law enforcement escorts, and the blockage of cross traffic at signalized intersections by additional law enforcement personnel. The continued presence of law enforcement personnel blocking the cross traffic on West Front Avenue and allowing the float driver to proceed through the red traffic signal on South Garfield Street on approach to the grade crossing further enforced this expectancy of safety at all intersections, including at the grade crossing. Because of these circumstances, the float driver likely believed that he could turn his attention from the roadway to his mirrors to confirm that the passengers seated on the flatbed were not being jostled as he negotiated the dip at the south end of West Front Avenue. As a result, the float driver said that he did not notice the lights of the grade crossing warning system until he saw them reflected in his right-side mirror. His interpretation of both the warning signals as “just more lights” and of the train’s seemingly stationary presence on the tracks can also be attributed to his expectation of safety. The NTSB concludes that participation in the parade and law enforcement control of the parade route created an expectation on the part of the float driver that it was safe to continue through the grade crossing. The NTSB further concludes that the float driver did not see the flashing lights of the grade crossing warning system or detect the presence of the train until the float was on the tracks because he had been looking at his side-view mirrors to monitor the well-being of the float passengers. 2.2.4 Visibility On November 20, 2012, NTSB investigators recorded video from the cab of an exemplar vehicle to capture an approximation of the float driver’s view out the passenger side window. The exemplar vehicle was driven through the crossing when the sun was at the same azimuth as during the collision and at a speed that approximated that of the float.12 Although the sun was in a position to potentially cause brightness and glare issues for drivers looking west down the tracks, during a postcrash interview, the float driver stated that he had seen the train in the distance. The left- and right-side windows and the top portion of the driver-side windshield were tinted on the truck-tractor, allowing 17 percent, 18 percent, and 5 percent of light through, respectively. However, according to the float driver, the right-side window had been fully rolled down, and the left-side window had been rolled down 6 inches. The float driver further stated that he had used the left-side mirrors to monitor his tires as he proceeded over the dip in the road at the south end of the West Front Avenue intersection. These statements suggest that the tinting did not affect his ability to see through the left-side window.

12 According to the US Naval Observatory, at 4:35 p.m. on November 15, 2012, in Midland, Texas, the sun was at an altitude of 13 degrees above the horizon at 238 degrees east of true north.

NTSB

Highway Accident Report

23

The NTSB concludes that the float driver’s ability to monitor the scene around him was not hampered by sun glare or by the tinted windows of his vehicle. 2.2.5 Parade Noise Video of the parade and the list of performers and participants suggest that the parade produced a considerable amount of noise. Sources of noise included onlookers, motorcycle and truck engines, police sirens, and a train horn mounted on the lead float. Although the exact noise level within the vicinity of the grade crossing could not be determined with the available evidence, it is possible that the level and type of noise generated by the parade either masked the sound from the grade crossing warning system or caused the float driver to misinterpret the auditory warning as additional parade noise. It is also possible that the float driver’s expectation of safety might have led him to discount the auditory warning. The city of Midland established a quiet zone around the grade crossing in 2007 restricting the routine sounding of locomotive horns 24 hours a day.13 Typically, when not in a quiet zone, a train traveling at 62 mph would initiate a horn sequence about 15 seconds (a quarter mile) prior to reaching a grade crossing. The train horn sequence would have been initiated 5 seconds after the activation of the grade crossing lights and bells. Given the ambient noise surrounding the parade, the use of the lead float’s train horn throughout the parade, indication by the float driver that he had not heard the grade crossing bells on approach to the grade crossing, and the float driver’s expectation of safety, it is unlikely that a typical train horn sequence would have been detected, or if so, properly interpreted. The NTSB concludes that the float driver’s expectation of safety, combined with the noise generated by the parade, likely reduced his ability to hear or properly interpret the grade crossing system warning bells and train horn. 2.2.6 In-Vehicle Distractors The float driver stated that the only portable electronic device in the truck-tractor was his personal cellular telephone and that he was not using it around the time of the collision. This statement was confirmed by records obtained from his service provider. The float driver stated that the truck-tractor was equipped with a citizen’s band (CB) radio, and he used it during the parade to communicate with the lead float driver. He stated that he could use the CB only to communicate with the lead float driver and could not communicate with any law enforcement officials. He told investigators that he was not using his CB as he traversed the grade crossing. The NTSB concludes that the float driver was not distracted by the use of in-vehicle electronic devices.

13 In accordance with 49 CFR 222.39, the city of Midland submitted to the Federal Railroad Administration (FRA) a Notice of Establishment of a quiet zone, dated May 1, 2007, for the grade crossing at South Garfield Street. The horn may be sounded in an emergency situation, when the engineer believes that such action is appropriate, to prevent injury, death, or property damage.

NTSB

Highway Accident Report

24

1. 2.7 Toxicology

In accordance with motor carrier safety regulations, the float driver was tested for alcohol and controlled substances after the collision.14 An alcohol breath test was administered at 8:11 p.m. on November 15, 2012, and the results were negative for alcohol. A urine sample was also collected at 8:27 p.m., and it tested negative for five classes of drugs of abuse.15 The NTSB concludes that there is no evidence that the float driver was driving under the influence of alcohol or drugs of abuse. 2.2.8 Health Records from the float driver’s most recent commercial driver fitness examination, which had been conducted on November 16, 2010, show that his hearing and corrected vision were within acceptable federal standards, as specified in 49 CFR 391.43. The float driver’s height was recorded as 69 inches, and his weight was recorded as 198 pounds, which corresponds to a body mass index (BMI) of 29.2.16 The physician who performed the examination qualified the float driver for 2 years, with the only stipulation that he wear his glasses when driving. The float driver’s medical certification expired on November 16, 2012, one day after the collision. The NTSB was unable to locate doctors who had treated or were treating the float driver. When interviewed, the float driver stated that he did not see any doctors on a regular basis. No record of prescription medications was found, and postcrash hospital records did not indicate any conditions that might have affected his ability to operate a motor vehicle. The float driver told investigators that he had not been experiencing any health issues on the day of the parade. He further stated that he had not experienced any significant life changes or stressors in the days and weeks prior to the parade. The NTSB concludes that there is no evidence that the float driver was experiencing stress or had a health, hearing, or visual condition that affected his ability to perceive the grade crossing warnings, perceive the train, or safely operate his vehicle. 2.2.9 Sleep Habits The float driver stated that he would typically go to bed by 9:30–10:00 p.m. on nights preceding workdays and wake up at 5:15 a.m. On nights preceding a day off, he typically went to

14 Per 49 CFR 382.303, commercial drivers are required to submit to postaccident alcohol and controlled substance testing as soon as practicable. If an alcohol test is not administered within 2 hours of an accident, and if a controlled substance test is not administered within 32 hours of an accident, it is the carrier’s responsibility to prepare and maintain on file a record stating the reasons the tests could not be promptly administered. The NTSB has verified that Smith Industries has complied with the regulations by maintaining on file a record stating the reasons the alcohol test could not be promptly administered. 15 Per 49 CFR Part 40, laboratories must test for the following five drugs or classes of drugs in a US Department of Transportation (DOT) drug test: marijuana metabolites, cocaine metabolites, amphetamines, opiate metabolites, and phencyclidine. 16 The US Centers for Disease Control and Prevention classify a BMI of 30 or greater as obese. Studies indicate that individuals with a BMI over 33 are likely to have obstructive sleep apnea. Also see Gurubhagavatula and others, 2004.

NTSB

Highway Accident Report

25

bed by 11:00 p.m. and awoke at 7:00 a.m. He stated that he typically felt rested when he awoke and described his sleep quality as good or average. He told investigators that he had no trouble falling asleep at night or awakening in the morning, and that he does not nap. He typically woke once during the night but had no trouble falling back asleep. He stated that he used an alarm clock on the days when he had to rise at a particular time. Based on his logbook and interview, the driver had approximately 7 hours of sleep opportunity the night before the parade and 7.75 hours of sleep opportunity each of the two prior nights. He had been awake for about 11 hours at the time of the collision. The NTSB concludes that, based on evidence and statements regarding the float driver’s medical history, sleep opportunity, sleep quality, sleep schedule, and time awake, it is unlikely that he was fatigued at the time of the collision. 2.3 Highway Factors 2.3.1 Background South Garfield Street in the vicinity of the grade crossing was constructed in 1956. The roadway was improved in 2006 to include a raised median and to restripe the roadway to a five- lane cross section. The annual average daily traffic on South Garfield Street in the vicinity of the grade crossing at the time of the collision was 8,784 vehicles in the southbound lanes and 7,448 vehicles in the northbound lanes. The posted speed limit for South Garfield Street is 35 mph. 2.3.2 South Garfield Street Configuration South Garfield Street in the vicinity of the grade crossing consists of five lanes—two northbound through lanes, two southbound through lanes, and a left-turn-only lane. The northbound and southbound lanes are separated by a 2.5-foot-wide raised concrete median that contains 3-foot-tall yellow delineator posts. The total width of the five-lane cross section is approximately 62.5 feet. The Union Pacific single main track through the city of Midland is paralleled by five-lane West Front Avenue to the north and three-lane West Industrial Avenue to the south. South of the West Front Avenue intersection, South Garfield Street slopes upward 5.6 percent on approach to the grade crossing. This slope plateaus at the grade crossing for a distance of 2 feet outside the rails. South Garfield Street then slopes downward 5.4 percent toward West Industrial Avenue. The slopes on either side of this grade crossing are not severe enough to obstruct low-clearance vehicles on the tracks. The distance from the south curb line of West Front Avenue to the nearest rail is approximately 80 feet. The distance from the north curb line of West Industrial Avenue to the nearest rail is approximately 67 feet (see figure 18).

NTSB

Highway Accident Report

26

Figure 18. Diagram showing the road markings around the grade crossing, including the railroad crossing markings for each of the two lanes, as well as a stop line.

1. 3.3 South Garfield Street Signs and Markings

Figure 19 illustrates the signage in the vicinity of the grade crossing at the time of the collision. The signage on South Garfield Street consisted of an advance railroad crossing sign with a “No Train Horn” sign on both approaches to the grade crossing. A “Do Not Stop on Tracks” sign was located just prior to the tracks in the northbound and southbound directions. The pavement markings in the vicinity of the grade crossing consisted of grade crossing

NTSB

Highway Accident Report

27

pavement marking symbols located in the two northbound and two southbound through lanes. White stop lines17 were located approximately 8 feet from the automatic gate on both approaches to the grade crossing. The left-turn lane was marked with left-turn-only markings.

Figure 19. Aerial photo of South Garfield Street around the grade crossing, with street signs highlighted.

1. 3.4 South Garfield Street Grade Crossing

According to the DOT crossing inventory, the grade crossing at South Garfield Street is a public grade crossing owned and managed by Union Pacific. Its identification number is 796331L, and it is situated on railroad milepost 554.65. The design speed for the track is 79 mph, and the maximum track speed is 70 mph. On average, 23 trains pass through this grade crossing daily. The freight train involved in the collision was the sixteenth train to cross South Garfield Street that day and the eighth train to cross after 8 a.m. According to the FRA’s Office of Safety Analysis website, prior to the Show of Support parade collision, this grade crossing has been the site of 10 accidents since 1979, resulting in 6 injuries. The most recent of these occurred in 1997, resulting in one injury.

17 A stop line is a solid white line extending across an approach lane to indicate the point at which vehicles are intended to stop, in compliance with a STOP sign, traffic control signal, or some other traffic control device. Also see Federal Highway Administration (FHWA), 2009.

NTSB

Highway Accident Report

28

The grade crossing was equipped with an active grade crossing warning system (see figures 20, 21, and 22). The grade crossing warning system on southbound South Garfield Street consisted of two pairs of alternately flashing 12-inch warning lights, a warning bell, and a fiberglass gate arm—all mounted on a mast positioned to the west side of the roadway and 12 feet north of the nearest rail. The pairs of warning lights were mounted on opposite sides of the mast to warn southbound and northbound traffic. The grade crossing warning system on northbound South Garfield Street consisted of identical equipment mounted on a mast on the east side of the roadway. The red- and white-striped gate arms consisted of a drive mechanism and were equipped with lights. The stripes were spaced alternately red and white at 16-inch intervals measured horizontally. Three 4-inch-diameter red lights were mounted on top of the gate arms. When activated, the gate arm light nearest the tip was continuously lit, and the other two lights flashed alternately in unison with the flashing light signals. When lowered into the horizontal position, the gates extended across all lanes from the curb to the center median in each direction of travel. The collision between the train and the float damaged the automatic gate arm located in the northbound lanes of South Garfield Street. The gate arm was torn from its drive mechanism and was found on the grass in the southeast quadrant of the grade crossing. Postaccident testing on the gate arm in the southbound lanes found that it began descending about 6.8 seconds after the flashing light units activated. The gate arms assumed a horizontal position less than 15 seconds after the flashing light units were activated.

Figure 20. Driver’s view of the traffic signals on West Front Avenue from southbound South Garfield Street, showing the crossing arm, flashing light signal, and crossbuck of the southbound South Garfield Street grade crossing in the background.

NTSB

Highway Accident Report

29

Figure 21. Grade crossing warning system mounted on the masts located on both northbound and southbound South Garfield Street.

NTSB

Highway Accident Report

30

Figure 22. View of the 12-foot distance between the rails and grade crossing mast on the southbound side of South Garfield Street and the warning light configuration, which provides visual warning for both northbound and southbound traffic. (The grade crossing mast on the northbound side of South Garfield Street is equipped in an identical fashion.)

A microprocessor unit housed in a railroad signal bungalow located in the northwest quadrant of the grade crossing controlled the grade crossing warning system.18 A separate traffic signal cabinet located in the northeast quadrant of the West Front Avenue intersection controlled the traffic control signals at the West Front Avenue and the West Industrial Avenue intersections. As required by 49 CFR 234.225,19 Union Pacific designed the grade crossing warning system to provide motorists with at least 20 seconds of warning time when a train approaches. Additionally, Union Pacific provided a buffer time of 5 seconds to account for fluctuations in warning activation time due to changing ballast and track conditions, as well as variances in the speed of approaching trains.

18 The train detection and warning system activation was configured through a Safetran grade crossing predictor, model 3000D2, microprocessor unit. 19 The FRA published a final rule on grade crossing warning times in 1995, and Texas has complied with the final rule since then.

NTSB

Highway Accident Report

31

Records indicated that on January 2012, a contractor informed Union Pacific that the manner in which audio frequencies were allocated among the grade crossings between milepost 553.66 and 555.85 could lead to additional fluctuations in train detection time.20 The South Garfield grade crossing was among those potentially affected. Union Pacific approved plans to eliminate potential frequency issues between these mileposts; however, due to an oversight by Union Pacific, these plans were not implemented. Postcrash tests on the South Garfield grade crossing warning system revealed that its assigned audio frequency was close enough to the audio frequency at an adjacent grade crossing to cause slight delays in the train detection time. This delay consumed most of the 5-second buffer time and resulted in warning activation times just above 20 seconds. At the time of the collision, the grade crossing warning signals were activated about 21 seconds before the arrival of the train.21 Data downloaded from the grade crossing warning system indicated that from October 12 to November 15, 2012, the South Garfield grade crossing met federal warning time requirements on all but one occasion, when on October 29, the system provided 19 seconds of warning time for an approaching train.22 Apart from this, grade crossing warning times ranged from 21 to 28 seconds. In December 2012, Union Pacific changed the audio frequencies used at the South Garfield grade crossing and at two other crossings to eliminate the frequency issue identified. The NTSB concludes that the grade crossing warning system provided 20 seconds of warning as required by federal regulations. 2.3.5 Advance Preemption The Manual on Uniform Traffic Control Devices (MUTCD)23 defines preemption as “the transfer of normal operation of a traffic control signal to a special control mode of operation” (FHWA 2009). Advance preemption describes the situation at the highway intersections near the South Garfield Street grade crossing, where an approaching train preempts highway traffic signals prior to activating the grade crossing warning system. The traffic signal controller24 for the signals along South Garfield Street, West Front Avenue, and West Industrial Avenue near the grade crossing is interconnected with the grade crossing warning system and programmed for advance preemption to eliminate traffic conflicts while minimizing congestion. When an approaching train is detected, the normal traffic signal sequence is preempted for a signal pattern that clears vehicles on either side of the tracks on South Garfield Street and prevents additional vehicles

20 Train detection is accomplished by the use of audio frequencies transmitted along the tracks. 21 The Safetran grade crossing predictor recorded 21 seconds of warning time. Video evidence indicated about 20.5 seconds of warning time. 22 During this 35-day period, about 798 trains passed through the South Garfield grade crossing. 23 The FHWA’s MUTCD sets the minimum standards for and provides guidance to ensure the uniformity of traffic-control devices across the nation. 24 The traffic signal controller unit was a Naztec Model 900 TS2 running firmware version 980–NTCIP Version 61.3q.

NTSB

Highway Accident Report

32

from approaching the grade crossing in advance of activation of the grade crossing warning system. This highway traffic signal pattern is referred to as a “track clearance green interval.” Figure 23 illustrates the typical traffic signal pattern under the track clearance green interval at the West Front Avenue intersection.25 Advance preemption of the traffic signals is programmed to begin approximately 10 seconds before activation of the grade crossing warning system. Depending on when a train is detected during a normal traffic signal pattern, it could take as long as 5.8 seconds for the traffic signals to cycle to the track clearance green interval. The highway traffic signals would typically continue to operate in this interval for 25 seconds, then transition to a sequence that allows for traffic flow that does not conflict with passage of the train (referred to as the “dwell operation”; see figure 24). Once the train clears the grade crossing and the warning system deactivates, the highway traffic signals return to normal operation.

Figure 23. Depiction of the typical track clearance green interval. Only the signal next to the grade crossing is green. All others on South Garfield Street, West Front Avenue, and West Industrial Avenue are red. Note location of signals is for illustration purposes only.

25 The traffic signal lights at South Garfield Street, West Front Avenue, and West Industrial Avenue consist of a 16-phase signal, and the timings vary depending on the traffic volume.

NTSB

Highway Accident Report

33

Figure 24. Depiction of the typical traffic signal pattern once the track clearance green interval has expired. This traffic signal pattern would occur while grade crossing gates are down, warning signals are active, and a train occupies the grade crossing—allowing for limited traffic flow that does not conflict with train operations.

Information obtained from the highway traffic signal controller and video footage from a Midland County Sheriff’s vehicle dash camera indicated that the highway traffic signal facing southbound South Garfield Street at the West Front Avenue intersection was already displaying red when the float was 67 feet from the stop line (see figure 25). A reconstruction of the collision sequence—based on video evidence, data gathered from the downloaded logs of the grade crossing warning system, and the highway traffic signal controller—established that the highway traffic signals transitioned to advance preemption when the float was approximately 10–17 feet from the north curb line of the West Front Avenue intersection. Because the southbound facing highway traffic signal was programmed to display red during advance preemption, it simply continued to display red, with no overt sign given to drivers on South Garfield Street that the highway traffic signal had transitioned in response to an approaching train.

NTSB

Highway Accident Report

34

Figure 25. Illustration of the point, 67 feet from the stop line, at which the red stop signal was noticeable on the Midland County Sheriff’s vehicle dash camera.

The law enforcement escort vehicles and the law enforcement personnel blocking the West Front Avenue intersection allowed the float to proceed toward the grade crossing, unaware of the advance preemption of the traffic signals and the approaching train. It was only after the grade crossing warning system activated that at least one of the escorts became aware of the danger—at this time, the float was less than 9 seconds from the grade crossing stop line. Had it been possible to quickly identify that the traffic lights had entered preemption because of an approaching train, law enforcement and parade participants would have had almost 10 additional seconds of warning time before the grade crossing lights and bells activated. x R R x R R x R R x R R ONLY ONLY ONLY S. Garfield St. West Front Ave. West Industrial Ave. Railroad signal bungalow UP Railroad grade crossing 67' 171' City traffic signal pole Railroad flashing lights and gate City traffic signal cabinet

NTSB

Highway Accident Report

35

Because there are a number of scenarios in which law enforcement officers might bypass a red highway traffic signal—such as parades, funerals, and emergency response situations—it is essential that they be informed when highway traffic signals are preempted by an approaching train. In this case, the preemption status of the highway traffic signal at the intersection of South Garfield Street and West Front Avenue could not be easily recognized without additional cues. The NTSB concludes that, had visual cues been available to signify that an approaching train had preempted the normal highway traffic signal sequence at the intersection of South Garfield Street and West Front Avenue, there would have been as much as 10 seconds of additional time to warn law enforcement officers and the float driver of the approaching train. The NTSB found that some communities have equipped signalized intersections near grade crossings with additional lights or signs to inform emergency responders and motorists when an approaching train has preempted traffic signals. For example, in localities where an emergency vehicle preemption (EVP) system has been installed, approaching emergency vehicles can preempt normal traffic signal operations. When an emergency vehicle successfully preempts a highway traffic signal, the traffic signal ahead of the emergency vehicle transitions to green, and a steady white confirmation light displays on the traffic signal post (see figures 26 and 27). Emergency vehicles arriving at the intersection from a different direction see a red signal light, accompanied by a flashing white confirmation light indicating that traffic signals have been preempted. If an intersection equipped with EVP is located near a rail line, an approaching train has precedence over all types of vehicles. Red signal lights are displayed, accompanied by flashing white confirmation lights, in all directions of traffic to inform approaching emergency vehicles that they do not have the right of way.

Figure 26. View of the confirmation light activating at a railroad grade crossing in Minneapolis, Minnesota. This light serves to warn traffic that the normal light sequence has been preempted. (Photo courtesy of the city of Minneapolis, MN)

NTSB

Highway Accident Report

36

Figure 27. Close-up view of the same confirmation light activating at the same railroad grade crossing in Minneapolis, Minnesota. (Photo courtesy of the city of Minneapolis, MN)

Movement-activated blank-out signs have also been used to inform motorists of the approach of a train. These signs display a fixed message when activated and are blank when inactive (see figures 28, 29, and 30). Figure 28. No-right-turn, no-left-turn, and no-through movement-activated blank-out signs. (Images courtesy of the FHWA’s MUTCD, 2009)

Figure 29. Movement-activated blank-out sign near a grade crossing in Thomasville, North Carolina, reading “no right turn,” with the word “train” located at bottom of sign to emphasize that a train is approaching the grade crossing. (Photo courtesy of the North Carolina Department of Transportation)

NTSB

Highway Accident Report

37

Figure 30. Movement-activated blank-out sign near grade crossing in Belle Chasse, Louisiana, with a no-right-turn icon and “train” at bottom warning that a train is approaching the crossing. (Photo courtesy of the Louisiana Department of Transportation)

In summary, a number of traffic control options, such as confirmation lights and movement-activated blank-out signs, can be used to warn emergency responders and motorists that an approaching train has preempted traffic signals. The MUTCD references only movement- activated blank-out signs and does not describe where confirmation lights should be used. Specifically, it is difficult to discern from the manual the circumstances in which movement- activated blank-out signs would be appropriate near highway–rail grade crossings. The NTSB concludes that confirmation lights and movement-activated blank-out signs can help law enforcement and emergency responders quickly determine whether an approaching train has preempted a highway traffic signal and might have alerted law enforcement escorts sooner of the need to stop the parade to avoid the approaching train. The NTSB recommends that the FHWA work with the FRA to (1) include guidance in the MUTCD for the installation of advance warning devices, such as movement-activated blank- out signs, that specifically use the word “train” to indicate the preemption of highway traffic signals by an approaching train, and (2) amend the MUTCD to indicate that preemption confirmation lights, while not intended to provide guidance to the general public, would be useful in providing advance information on train movements to law enforcement and emergency responders.

NTSB

Highway Accident Report

38

1. 4 Show of Support Parade Factors
2. 4.1 Background

The parade was part of a 4-day event sponsored by Show of Support, whose stated purpose is to “…demonstrate public support for the men and women of the military by providing outdoor opportunities to those injured in service to our country.” The parade traditionally takes place the week before Thanksgiving and involves several community organizations that have volunteered their time and equipment. Participants in the 2012 parade included 25 veterans, their spouses, the Midland Police Department, the Midland County Sheriff’s Office, the Midland Fire Department, the Midland Christian School Band, the Gold Star Mothers,26 the National Honor Society, the Patriot Guard Riders,27 and the local Corvette and antique car clubs. Smith Industries donated the use of the combination units to transport the veterans and their spouses, and the drivers donated their time. The founder of Show of Support and a former Midland City Police lieutenant in charge of traffic enforcement worked together to conceive and organize the parade. According to the former lieutenant, who retired in March 2012, when the Show of Support event began in 2004, it consisted only of a few vehicles, including two limousines that transported the veterans. In the intervening years, the parade grew as community participation increased. By 2011, approximately 100 vehicles and several groups were taking part in the parade. The parade route has changed twice since 2004. For the first 2 years, the parade was routed through an underpass to avoid the railroad tracks (see figure 31). The parade organizers changed the route in 2006 to accommodate the growing number of participants and to increase Show of Support’s exposure in the community (see figure 32). This revised parade route proceeded west from the DoubleTree Hotel on West Wall Street to South Garfield Street, turned south on South Garfield Street to the grade crossing, turned right on West Industrial Avenue for two blocks, and then turned left onto Cotton Flat Road to the Midland County Horseshoe Arena. Parade organizers adopted the current parade route in 2011 after South Garfield Street was extended to the Horseshoe Arena (see figure 33).

26 Gold Star Mothers was formed to provide support to those who have lost a loved one in a war. 27 Patriot Guard Riders is a diverse organization of motorcycle enthusiasts who participate primarily in funeral processions, services, and special events held in honor of deceased war veterans, police officers, and firefighters.

NTSB

Highway Accident Report

39

Figure 31. Parade route 2004–2005.

NTSB

Highway Accident Report

40

Figure 32. Parade route 2006–2010.

NTSB

Highway Accident Report

41

Figure 33. Parade route 2011–2012.

NTSB

Highway Accident Report

42

1. 4.2 Parade Permit Process

The NTSB investigation found that Show of Support failed to obtain a parade permit, and the city of Midland failed to enforce its ordinance by allowing the parade to take place despite the absence of a permit. According to the city ordinance in place at the time of the 2012 parade: No procession, excepting the forces of the United States Army or Navy, the military forces of this state, and the forces of the police and fire departments, shall occupy, march or proceed along any street except in accordance with a permit issued by the chief of police and such other regulations as are set forth in this Title which may apply. The above does not apply to funeral processions. A permit had to be submitted at least 30 days prior to an event date. The fine for violating the parade permit ordinance was $500. The permit form listed a number of requirements that needed to be met before a permit was issued, including:  Verifying if a Temporary Land Use Permit is required;  Submitting an event map indicating the location or route of the event;  Obtaining the required city officials’ signatures (city manager; city attorney; transportation supervisor; police department representative, i.e. traffic lieutenant; Health Department representative; Fire Department representative; and Solid Waste Services representative); and  Obtaining insurance indemnifying the city and obtaining a $1 million insurance policy covering the conduct of the event. The absence of a parade permit is indicative of the lax and informal manner by which the parade was organized, approved, and executed. According to the former lieutenant, when the parade was first established in 2004, he assumed responsibility for obtaining the parade permit. Show of Support itself did not initiate or retain any documents related to city approval of the parade or other activities. In 2009, when the former lieutenant again submitted an application for a parade permit, he was told by a number of city officials that the event no longer needed a permit because it qualified as a “city-sponsored” event.28,29 Thereafter, from 2010 until 2012, the former lieutenant and his successor did not initiate the process to obtain a parade permit. The NTSB obtained a copy of the incomplete 2009 permit application from the city transportation manager and also from the city’s insurance agent. The permit was signed by the former lieutenant but contained no city officials’ names. When NTSB investigators asked city officials why they allowed the parade to proceed for 4 years without issuing a permit, they were told that the ordinance required Show of Support to obtain a permit. NTSB investigators were not provided any documents indicating that a permit

28 The former lieutenant first obtained this information from an assistant to the director of the city’s Transportation Department. He then verified it with the director of the city’s Safety and Risk Department and with either the city manager or the city attorney (he could not remember which one). 29 The supposition that the Show of Support parade qualified as a “city-sponsored event” may have originated when the city began purchasing supplemental insurance annually for parades to cover persons along the parade route who might be injured from incidental activity, such as the throwing of candy by parade participants.

NTSB

Highway Accident Report

43

was obtained or approved for the 2012 parade, or that the permit requirements listed above were fulfilled. In a press release dated November 21, 2012, the city of Midland stated that it did not issue a permit nor had the city received a permit application from Show of Support. The city of Midland did not fine Show of Support for violating the parade permit ordinance. The NTSB concludes that the city of Midland failed to follow and enforce its own ordinances, and allowed the Show of Support parade to take place without a permit from 2009 to 2012. In February 2013, the Midland city council amended its parade ordinance to prohibit the city manager from issuing permits for special events that propose crossing over a railroad track. According to the city code of Midland, only the city council can issue such a permit, and it can do so only after an applicant submits proof of having received permission from the appropriate railroad officials to traverse the railroad crossing. 2.4.3 Railroad Notification When the railroad is notified in advance of an event that traverses or is held near a grade crossing, the railroad may take actions, such as arranging to halt train traffic, restrict train speeds, or provide a flagman.30 At the time of the collision, the city of Midland did not require the railroad to be notified when a parade was planned to be routed over a grade crossing. The former lieutenant stated that he had notified the railroad of the parade in 2006 and 2007, the first 2 years the parade crossed the grade crossing at South Garfield Street and West Front Avenue. He discontinued notifying the railroad in 2008, opting instead to post police officers at the grade crossing to monitor train activity. After the lieutenant retired and was replaced by a successor, the Show of Support parade took place in November 2012 without the railroad being notified or officers being posted at the crossing with the specific purpose of monitoring for oncoming trains. Although the absence of additional officers at the grade crossing to specifically monitor train traffic during the parade might have played a role in the collision, research suggests that individuals commonly underestimate the approach speed and distance of trains and other large objects. Therefore, a reliance on train monitors may not be an effective method of detecting trains and estimating their arrival (Cohn and Nguyen 2003; Cooper and Ragland 2008). Train monitors at this particular grade crossing might have supplemented the alerts provided by the grade crossing warning system, but a rapid and reliable method of communication would still be needed for monitors to convey any impending dangers because the float drivers may have been attending to other visually demanding tasks.31 Additionally, the fast approach speed of an oncoming train still presents a hazard unless the track speed is lowered or train traffic is halted during the time of the parade. Hence, though train monitors may be beneficial to the safety of parades that traverse a grade crossing, they are not an effective substitute for notifying the railroad.

30 This information was provided by the director of Public Safety for Union Pacific during a phone interview on October 25, 2013. 31 As described previously, the communication systems used by law enforcement and the two float drivers were incompatible; the float drivers were only able to communicate with each other and not with law enforcement.

NTSB

Highway Accident Report

44

NTSB investigators obtained and evaluated parade permit ordinances and procedures from several Texas cities.32 Most of these documents were more thorough in their requirements than those on record in Midland. When interviewed by investigators, the Stanton chief of police stated that he officially notified the railroad when a city event occurred close to its highway– railroad grade crossing.33 None of the ordinances obtained by the NTSB, however, specifically mentioned notifying the railroad in the event that a parade route was scheduled to traverse a grade crossing. The NTSB concludes that, with the exception of avoiding the grade crossing entirely, the most effective way for the city of Midland and Show of Support to have prevented a grade crossing collision would have been to notify the railroad in advance of the parade. Additionally, the NTSB concludes that the absence of ordinances or laws addressing risks related to parades and other events traversing a grade crossing poses a safety hazard for event participants and spectators. 2.4.4 Parade Planning The Show of Support parade was organized by a committee of about 28 volunteers, each with an area of responsibility.34 According to committee members interviewed by NTSB investigators, a written plan delineating the specific responsibilities of each committee member was never drafted because the committee was of the opinion that everyone knew his/her role in preparing for the parade. According to the former lieutenant, the Midland Police Department’s responsibilities were to coordinate law enforcement activities with the Sheriff’s Department and to coordinate parade participant activities; the Transportation Department’s responsibilities included blocking streets and establishing sufficient traffic control along the route. The NTSB requested, but did not receive, written documentation related to the planning or operation of the 2012 parade from the Midland Police Department or the Department of Transportation. By not developing and implementing a written plan that identified and addressed all possible risks to the event, Show of Support, the Midland Police Department, and the committee members overlooked several important aspects of parade safety. As previously noted, Show of Support and its committee failed to conduct a risk assessment that specifically addressed the hazards of the grade crossing. However, other aspects of parade safety that may suffer in the absence of a safety plan include traffic management throughout the city, safety-related coordination and communication among all event participants, and contingency planning.35 A safety plan could have further benefited the parade planners by providing a framework for

32 In addition to the neighboring cities of Odessa and Stanton, the NTSB evaluated the ordinances of Plano, Dallas, Killeen, and Fort Worth. 33 In response to the notification, the railroad would restrict the speed of trains passing through the area to 15 mph. 34 The exact number of volunteer organizations participating in the event is not known because no planning or related documents were available. 35 The NTSB uses the term “safety plan” to refer to any written plan that addresses all aspects of risk mitigation and contingency planning. A safety plan may be a standalone document or a part of a larger operational plan for an event.

NTSB

Highway Accident Report

45

conducting postevent evaluations to address any deficiencies and improve the safety of future events. The NTSB concludes that the failure of Show of Support, the Midland Police Department, and other parade committee members to develop and implement a written safety plan covering all aspects of the parade led to a failure to manage the safety hazards along the parade route. 2.4.5 Parade Float Operation The NTSB discovered that there are no nationally accepted guidelines for the design of vehicles involved in parades. However, the NTSB also found that parade float incidents involving serious injury or death occur infrequently. Additionally, there is no evidence that traditional vehicle impact crashworthiness features—such as seatbelts or crush zones—would be beneficial on floats, because they do not normally travel at speeds that would require crash mitigation. Although emergency exits are a provision in some parade float guidelines, they are intended for enclosed spaces. To assess the relative safety of float operation during the Show of Support parade, NTSB investigators consulted publicly available documents from several cities, municipalities, and universities to identify common practices.36 If a safety requirement was included in several of the documents, NTSB considered it a common practice. For example, several documents listed various means of hazard recognition and communication, with the general objective being the mitigation of driver error. Appendix D lists the entities and sources used to evaluate common practices and presents a matrix of operational guidance. In general, the source documents consulted addressed four areas of parade float operational risk:  Risk of fire,  Risk of injury from parade activities,  Risk of driver error and driver visibility, and  Risk of poor planning and poor instructions for float operators. Fire and injury from parade activities—such as people approaching the float or people throwing candy—were not factors in this collision. However, common practices related to driver error and visibility, along with poor planning and instructions for float operators, were relevant to the investigation.

36 “Common practice” is a term used to describe a qualitative assessment of actions that can be considered typical and expected given a reasonably well organized operation. In categorizing each practice, the NTSB focused on the objective (for example, float passenger safety) rather than the method used to arrive at the objective.

NTSB

Highway Accident Report

46

The sources consulted revealed six practices relevant to driver error and driver visibility: (1) having an unobstructed view, (2) providing drivers with a means of communicating with passengers or other parade participants, (3) having spotters accompany the float,37 (4) providing drivers with safety drills or checklists, (5) providing float passengers with an emergency sound device, and (6) limiting the speed of the float. Only one of these six practices (unobstructed view) was met during the Show of Support parade. Had the passengers been equipped with a means to communicate with the float driver, they might have been able to alert him to the grade crossing warning system signals or to the oncoming train. Had spotters been assigned to monitor the area in front of and around the float, they also could have warned the float driver. Video evidence suggests that the four law enforcement escorts assigned to the two floats were not consistent in the execution of their duties. Three of the escort vehicles generally remained alongside the floats, while the escort vehicle to the right of the lead float frequently sped ahead to temporarily block cross traffic at intersections. It is unlikely that the escort drivers were meant to act as spotters because: (1) spotters, generally on foot and dedicated to a float, typically avoid assuming secondary roles so they can remain focused and react quickly to potential dangers to spectators and parade participants; (2) the escort vehicles lacked a means of quickly communicating hazards to the float drivers; and (3) traffic control is an entirely separate function. The background noise and unique environment of a parade must also be considered. In the Midland collision, these factors rendered less effective the typical warnings from the train, reinforcing the importance of dedicated methods of hazard identification and alerts. A prearranged alerting method would have prepared the float driver to expect and better discriminate an emergency signal from background noise. Additionally, had the driver been provided with drills or a safety checklist that addressed the grade crossing, he might have been more aware of the intended roles of the police escorts and the limits of their duties. Cities, municipalities, and universities commonly require the presence of a parade director38 and the approval of a route plan. The Show of Support parade included a person who acted in a role similar to a parade director; however, the planning committee did not review the parade route. The NTSB concludes that a safety plan that followed common parade float operation practices could have prevented the circumstances that led to this collision. 2.4.6 Parade and Event Safety The NTSB examined four other parade and special event incidents to determine if a lack of safety planning contributed to their occurrence. Two of the incidents involved vehicles

37 Spotters generally walk along the side and rear of a float during the parade. They have the responsibility of staying with their assigned float and making sure the following occurs: (1) spectators maintain a safe distance from the floats; (2) the float driver knows when and where to start, stop, reverse, or increase speed; and (3) the float driver is aware of potential dangers to participants/spectators. 38 A parade director (sometimes referred to as a parade marshal) is the person with top level responsibility for all phases of a parade event, from planning and permitting to postevent activities.

NTSB

Highway Accident Report

47

striking pedestrians, one involved a collision between two vehicles, and one involved parade float passenger activity. On July 16, 2003, in Santa Monica, California,39 a 1992 Buick LeSabre driven by an 86-year-old man struck a sedan that had stopped for pedestrians in a crosswalk. The Buick continued through the intersection and drove into a farmers’ market that was held on a blocked off street. The vehicle struck pedestrians and vendor displays, resulting in 10 fatalities and 63 injuries. On May 18, 2013, in Damascus, Virginia, an 87-year-old man driving a 1996 Cadillac DeVille sedan as part of the 27th Annual Appalachian Trail Days festival parade lost control of his vehicle and struck parade participants, spectators, and other vehicles. Two people were seriously injured and approximately 60 others suffered minor injuries.40 Some planning and traffic control measures were in place in Santa Monica and Damascus, but neither event included a safety plan. In Santa Monica, event permitting and planning included a certification process for the market vendors, a temporary traffic plan, and a review by the fire and police departments for emergency vehicle access. The NTSB investigation concluded that the city failed to comply with its own internal guidance, as well as state and federal guidance, on temporary road closures that require a higher level of protection for the pedestrians located in temporary traffic control areas. In the Damascus parade, it is less clear what could have been done to prevent an incident involving a driver suddenly losing control of his vehicle. A safety plan, however, could be used to identify special circumstances in events that might require additional risk mitigation beyond the minimum requirements—for example, additional driver screening, driver escorts, and special vehicle provisions. A safety plan should not impose arbitrary rules but should help organizers consider potential risks and mitigation strategies. On July 4, 2013, during a parade in Bangor, Maine, a 1930 McCann Pump Engine fire truck operated by a 29-year-old firefighter struck a 1941 John Deere farm tractor operated by a 64-year-old man. As the vehicles approached an intersection, the farm tractor had slowed to make a turn and was struck from behind by the fire truck, causing the tractor to overturn. The tractor operator was run over by the fire truck and killed.41 The local law enforcement investigation found evidence of faulty brakes on the fire truck due to insufficient quantity and quality of brake fluid. The brakes operated sufficiently on level ground but were ineffective on a shallow downward slope. No maintenance documentation for the fire truck was identified, and the parade organizers had exempted emergency response vehicles from the parade float application process. The parade organizers did not have, nor were they required to have, a safety plan, a route plan, a vehicle inspection process, or any other parade safety requirement. Parade vehicle safety is an item commonly included in parade guidelines or requirements. On July 4, 2013, a 2013 Toyota Tundra pickup truck, driven by a 44-year-old man, was hauling an 18-foot flatbed trailer carrying several child passengers in the LibertyFest Independence Day Parade in Edmond, Oklahoma. The parade was nearing the end of the route, and the vehicles were returning to a staging area, when witnesses reported seeing children

39 See NTSB/HAR-04/04, a final report published by the NTSB in 2004. (See “References.”) 40 See the NTSB public docket, HWY13-IH-011. 41 See the NTSB public docket, HWY13-IH-017.

NTSB

Highway Accident Report

48

jumping on and off the trailer as the truck approached an intersection at a low speed. One child, who either jumped or fell from the trailer, was run over by the trailer and killed.42 The LibertyFest event, in general, and the parade, in particular, included various elements of safety planning, float inspections, and float safety requirements. The rules required passengers to remain on the floats at all times while on the parade route, included provisions for the supervision of child passengers, and required floats to have handholds or other provisions for the securement of passengers. Low-profile hay bales were installed for the passengers to sit on, but the float did not have handholds. In this incident, a safety plan existed; however, it was not fully implemented and executed. This incident, as well as the Bangor, Maine, incident previously described, illustrates the importance of developing a safety culture that emphasizes clear communication and adherence to safety requirements. These four incidents might have been prevented had the organizers developed, communicated, and implemented a written safety plan that addressed risk mitigation and contingency planning. The topics and scope of a safety plan may differ depending on the type and size of the event, but common elements in parade planning include route safety, safe zone protection, participant control, vehicle occupant control, and vehicle safety. Many organizations have safety plans in place for their events, with several making these plans publicly available on the Internet, but the NTSB’s investigation shows that many others still proceed without one. The NTSB concludes that many communities and organizations engaged in parade and special event planning fail to develop and implement a written safety plan. To minimize the risk of accidents during a parade or any other celebratory event, the NTSB makes the following recommendations: First, the NTSB recommends that the city of Midland include in its city ordinances a requirement that all organizations create a safety plan as part of the city’s event and parade approval process, to include, at a minimum, the following elements: route selection, mitigation of unavoidable hazards, lines of communication among event participants, notification of railroads or other entities with control over possible hazards, development of operating and emergency procedures, and a safety briefing for vehicle operators. Second, the NTSB recommends that the National League of Cities, National Association of Counties, National Association of Towns and Townships, United States Conference of Mayors, and International City/County Management Association encourage their members to require, as part of the parade and special event approval process, that organizations create a written safety plan, which, at a minimum, addresses the following elements: risk mitigation and contingency planning, with provisions for communication among event participants and other stakeholders; safety briefings for event participants and other stakeholders; driver and vehicle screening; safe float operation; and notification of railroads or other entities with control over possible hazards. Third, the NTSB recommends that the International City/County Management Association— with the assistance of the International Festivals and Events Association, National League of Cities, and National Association of Counties—develop and disseminate a list of key elements that state and local officials can use as a resource to create guidelines, standard operating procedures, or ordinances for the safe planning and operation of parades and other special events.

42 See the NTSB public docket, HWY13-IH-016.

NTSB

Highway Accident Report

49

3 Conclusions 3.1 Findings

1. Emergency response, vehicle maintenance, motor carrier and train operation, and

railway infrastructure were not factors in the grade crossing collision or resulting injuries.

1. Participation in the parade and law enforcement control of the parade route created an

expectation on the part of the float driver that it was safe to continue through the grade crossing.

The float driver did not see the flashing lights of the grade crossing warning system or detect the presence of the train until the float was on the tracks because he was looking at his side-view mirrors to monitor the well-being of the float passengers.

The float driver’s ability to monitor the scene around him was not hampered by sun glare or by the tinted windows of his vehicle.

The float driver’s expectation of safety, combined with the noise generated by the parade, likely reduced the driver’s ability to hear or properly interpret the grade crossing system warning bells and train horn.

The float driver was not distracted by the use of in-vehicle electronic devices.

There is no evidence that the float driver was driving under the influence of alcohol or drugs of abuse.

There is no evidence that the float driver was experiencing stress or had a health, hearing, or visual condition that affected his ability to perceive the grade crossing warnings, perceive the train, or safely operate his vehicle.

Based on evidence and statements regarding the float driver’s medical history, sleep opportunity, sleep quality, sleep schedule, and time awake, it is unlikely that he was fatigued at the time of the collision.

The grade crossing warning system provided 20 seconds of warning as required by federal regulations.

Had visual cues been available to signify that an approaching train had preempted the normal highway traffic signal sequence at the intersection of South Garfield Street and West Front Avenue, there would have been as much as 10 seconds of additional time to warn law enforcement officers and the float driver of the approaching train.

NTSB

Highway Accident Report

50

Confirmation lights and movement-activated blank-out signs can help law enforcement and emergency responders quickly determine whether an approaching train has preempted a highway traffic signal and might have alerted law enforcement escorts sooner of the need to stop the parade to avoid the approaching train.

The city of Midland failed to follow and enforce its own ordinances, and allowed the Show of Support parade to take place without a permit from 2009 to 2012.

With the exception of avoiding the grade crossing entirely, the most effective way for the city of Midland and Show of Support, Military Hunt, Inc. to have prevented a grade crossing collision would have been to notify the railroad in advance of the parade.

The absence of ordinances or laws addressing risks related to parades and other events traversing a grade crossing poses a safety hazard for event participants and spectators.

The failure of Show of Support, Military Hunt, Inc.; the Midland Police Department; and other parade committee members to develop and implement a written safety plan covering all aspects of the parade led to a failure to manage the safety hazards along the parade route.

A safety plan that followed common parade float operation practices could have prevented the circumstances that led to this collision.

Many communities and organizations engaged in parade and special event planning fail to develop and implement a written safety plan.

NTSB

Highway Accident Report

51

1. 2 Probable Cause

The National Transportation Safety Board determines that the probable cause of this collision was the failure of the city of Midland and the parade organizer, “Show of Support, Military Hunt, Inc.,” to identify and mitigate the risks associated with routing a parade through a highway–railroad grade crossing. Contributing to the collision was the lack of traffic signal cues to indicate to law enforcement that an approaching train had preempted the normal highway traffic signal sequence at the intersection of South Garfield Street and West Front Avenue. Further contributing to the collision was an expectancy of safety on the part of the float driver, created by the presence of law enforcement personnel as escorts and for traffic control, leading him to believe that he could turn his attention to his side-view mirrors to monitor the well-being of the parade float occupants as he negotiated a dip in the roadway on approach to the grade crossing.

NTSB

Highway Accident Report

52

4 Recommendations As a result of its investigation into this collision, the National Transportation Safety Board makes the following recommendations. To the Federal Highway Administration: Work with the Federal Railroad Administration to (1) include guidance in the Manual on Uniform Traffic Control Devices (MUTCD) for the installation of advance warning devices, such as movement-activated blank-out signs, that specifically use the word “train” to indicate the preemption of highway traffic signals by an approaching train, and (2) amend the MUTCD to indicate that preemption confirmation lights, while not intended to provide guidance to the general public, would be useful in providing advance information on train movements to law enforcement and emergency responders. (H-13-41) To the Federal Railroad Administration: Work with the Federal Highway Administration to (1) include guidance in the Manual on Uniform Traffic Control Devices (MUTCD) for the installation of advance warning devices, such as movement-activated blank-out signs, that specifically use the word “train” to indicate the preemption of highway traffic signals by an approaching train, and (2) amend the MUTCD to indicate that preemption confirmation lights, while not intended to provide guidance to the general public, would be useful in providing advance information on train movements to law enforcement and emergency responders. (R-13-38) To the city of Midland, Texas: Include in your city ordinances a requirement that all organizations create a safety plan as part of the city’s event and parade approval process, to include, at a minimum, the following elements: route selection, mitigation of unavoidable hazards, lines of communication among event participants, notification of railroads or other entities with control over possible hazards, development of operating and emergency procedures, and a safety briefing for vehicle operators. (H-13-42) To the National League of Cities, National Association of Counties, National Association of Towns and Townships, United States Conference of Mayors, and International City/County Management Association: Encourage your members to require, as part of the parade and special event approval process, that organizations create a written safety plan, which, at a minimum, addresses the following elements: risk mitigation and contingency

NTSB

Highway Accident Report

53

planning, with provisions for communication among event participants and other stakeholders; safety briefings for event participants and other stakeholders; driver and vehicle screening; safe float operation; and notification of railroads or other entities with control over possible hazards. (H-13-43) To the International City/County Management Association: With the assistance of the International Festivals and Events Association, National League of Cities, and National Association of Counties, develop and disseminate a list of key elements that state and local officials can use as a resource to create guidelines, standard operating procedures, or ordinances for the safe planning and operation of parades and other special events. (H-13-44) To the International Festivals and Events Association, National League of Cities, and National Association of Counties: Assist the International City/County Management Association in developing and disseminating a list of key elements that state and local officials can use as a resource to create guidelines, standard operating procedures, or ordinances for the safe planning and operation of parades and other special events. (H-13-45)

NTSB

Highway Accident Report

54

Member Weener filed the following concurring statement on November 14, 2013.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: November 5, 2013

NTSB

Highway Accident Report

55

Board Member Statement Notation 8462A Member Earl F. Weener, concurring:

All of the accidents we investigate have a tragic aspect. Yet this accident, involving men and women who voluntarily placed themselves in harm’s way through military service only now to return and face harm in the least expected of places, a memorial parade, particularly touches our hearts. Sadly, this is an accident where expectations were not met. Now the board, in pursuit of its mission to prevent recurrence of such accidents, is expected to objectively review and analyze the facts surrounding the event, and make recommendations as appropriate. With this goal in mind, I prepared this statement. The final report reflects a comprehensive investigative and analytic effort by the staff; however, I believe the final record of this tragic event would benefit from a more detailed discussion of the responsibilities attendant with operating a motor vehicle. The primary responsibility of a motor vehicle operator, as with other vehicular modes of transportation, is to operate the vehicle safely. This responsibility rests solely with the driver of the vehicle. Congress recognized this responsibility and the need to ensure drivers of large commercial motor vehicles particularly, were equipped with the necessary knowledge and skills to operate such vehicles by enacting the Commercial Motor Vehicle Safety Act of 1986 (the Act). Aimed at removing unqualified drivers from the road, the Act established uniform commercial driver licensing requirements across the country and eliminated the practice of issuing/holding multiple commercial drivers’ licenses (CDLs). The Act has since been implemented through promulgation of certain federal motor carrier safety regulations, which require CDL drivers to have knowledge of driving safety superior to non-commercial vehicle drivers.1 In this accident involving a truck-tractor in combination with a drop-deck flatbed, the driver of the accident vehicle held a CDL. However, as extensively addressed in the report, the driver faced a number of challenges to the normal driving task. Several of these challenges competed for and diverted the driver’s attention from the forward roadway - a critical task for maintaining situation awareness to ensure safe operation of the vehicle. The fatal diversion was the driver’s attention away from the forward roadway to his side view mirror for a length of time which in turn caused a loss of situation awareness. The board does not, however, consider the diversion of the driver’s attention a distraction, which bears further discussion. In completing the investigation of a multiple motor vehicle accident in Gray Summit, Missouri, the board adopted report language distinguishing between diversions of attention for

1 Lt. John Harmon Et. Al., National District Attorneys Association, Commercial Drivers’ Licenses: A Prosecutor’s Guide to the Basics of Commercial Motor Vehicle Licensing and Violations (2012), 4 n.23.

NTSB

Highway Accident Report

56

“driving-related safety concerns” and “nondriving-related distractions.”2 The distinction being diversions of attention for activities related to the primary task of driving, are not considered distractions. This is the standard the board applied to the actions of the bus driver in the Gray Summit accident whose attention was diverted from the forward roadway by activities occurring on the side of the road. The Midland accident report provides an opportunity to again review this rationale, and refine the board’s position on distraction. In this accident, similar to Gray Summit, the driver’s attention was diverted away from the forward roadway, and for a period of time, to the care of his passengers. As discussed at the Midland accident board meeting, staff believe the accident driver’s diversion of attention to his passengers was part of his driving task, and therefore not a distraction from the driving task. I agree with the application of the rationale, in this case; however, each case requires independent review. Further, I note the board is now in the process of refining its guidance on distraction to ensure consistency in application across the modes. The task of driving involves a number of competing demands on a driver’s attention. Yet, as explained in the Gray Summit report, a driver’s attention to the forward roadway is paramount in terms of safety.3 As well, the Gray Summit report mentions the hazard caused by drivers focusing too long on mirrors, rather than the forward roadway – recommending drivers limit their attention shifts to mirrors to glances. In short, a driver needs to be constantly shifting his attention within the parameters of the driving task, to monitor the roadway and vehicle operation, in order to maintain situation awareness and safely execute the driving task. However, the successful driver prioritizes these shifts or diversions of attention to minimize the risk of losing situation awareness. In this case, sadly, we have a case of poor prioritization by the driver, along with a delay in focusing his attention on the highest priority of monitoring the forward roadway. Unlike the bus driver in Gray Summit, though, this report is not critical of the length of time the driver’s attention was diverted to the side mirror. Instead, it rationalizes the driver’s actions based on a theory of expectancy. Referring back to my initial point, drivers holding CDLs are expected to be safer drivers; they are held to a higher standard regardless of the driving environment. Based on this expectation and in the interest of preventing a recurrence of this type of accident, I believe it important to note a driver’s responsibilities are not obviated by a parade context or police escort – a driver’s primary responsibility when operating a vehicle remains the safe operation of the vehicle. In this accident sequence, the driver knew this crossing to be active; there were no obstacles blocking the view of the tracks; the rail crossing signal system activated properly and well in advance of the approaching accident truck; the driver saw the train with its headlights on, although mistakenly thought it was stationary; there was sufficient space between floats for the accident vehicle to expedite traversing the tracks; and the point of impact indicates it was a mere fraction of a second between the accident vehicle clearing the track and being hit. Granted, hindsight is 20-20. There were significant lapses in risk assessment and mitigation identified throughout this report, and responsibility for these lapses duly assigned. But

2 Multivehicle Collision Interstate 44 Eastbound Gray Summit, Missouri, August 5, 2010. Highway Accident Report NTSB/HAR-11/03 (Washington, DC: National Transportation Safety Board, 2011). 3 Id. at 61-62.

NTSB

Highway Accident Report

57

from an objective standpoint, the driver’s decision-making played a central role in this accident and it bears emphasizing: the responsibility for safely operating a motor vehicle, first and foremost, rests with the driver. Earl F. Weener November 14, 2013

NTSB

Highway Accident Report

58

References Alexander, G. J., and H. Lunenfeld. 1986. Driver Expectancy in Highway Design and Traffic Operations, Report No. FHWA-TO-86-1. Washington, DC: DOT/FHWA. Baylor University website, Risk Management Manual, “11.2.24 Parade Float Safety Requirements for Homecoming,” accessed April 2013, www.baylor.edu/content/services/document.php?id=58028. City of Arlington, Texas, website, “Holiday Lights Parade,” participant letter, accessed April 2013, www.holidaylightsparade.com/pdf/Float_Building_101.pdf. City of Dallas, Texas, Office of Special Events website, “Parade Guidelines,” accessed April 2013, www.dallasspecialevents.com/event-guidelines/parade-guidelines/. City of Fremont, California, website, “Guidelines for Parade Floats,” accessed April 2013, www.fremont.gov/DocumentCenter/Home/View/925. City of San Diego, California, website, FP-Policy (F-08-9), “Float and Parade Vehicle Requirements,” accessed April 2013, http://ljparade.com/uploads/FloatRegs.city.pdf. Cohn, T., and T. Nguyen. 2003. “A Sensory Cause of Railroad Grade-Crossing Collisions: Test of the Leibowitz Hypothesis.” Transportation Research Board 2003 Annual Meeting. Washington, DC: TRB. Colorado State University website, “Homecoming Parade Float Builder’s Manual 2009,” accessed April 2013, http://www.homecoming.colostateledu/float-manual-1.aspx. Cooper, D. L., and D. R. Ragland. 2008. “Addressing Inappropriate Driver Behavior at Rail-Highway Crossings.” Transportation Research Board 2008 Annual Meeting. Washington, DC: TRB. DOT (US Department of Transportation). U.S. Department of Transportation Grade Crossing Inventory website, accessed April 2013, http://www.fra.dot.gov/Page/P0111. FHWA (Federal Highway Administration). 2009. Manual on Uniform Traffic Control Devices, Chapter 4A, Washington, DC: DOT/FHWA. FRA (Federal Railroad Administration). Office of Safety Analysis database, accessed July 2013, http://safetydata.fra.dot.gov/OfficeofSafety/default.aspx Florida Atlantic University website, Environmental Health and Safety, “Float Safety Requirements,” accessed April 2013, www.fau.edu/facilities/ehs/info/Float-Safety- Requirements.doc.

NTSB

Highway Accident Report

59

Gurubhagavatula I., G. Maislin, J.E. Nkwuo, and A.I. Pack. 2004. “Occupational Screening for Obstructive Sleep Apnea in Commercial Drivers.” American Journal of Respiratory and Critical Care Medicine. 170. Midland, Texas. City Code of Midland, Texas, Title X, Chapter 1, Section 2, “Permit required for parades and processions,” http://library.municode.com/index.aspx?clientId=13275. NTSB (National Transportation Safety Board). 2004. Rear-End Collision and Subsequent Vehicle Intrusion Into Pedestrian Space at Certified Farmers’ Market, Santa Monica, California, July 16, 2003, NTSB/HAR-04/04. Washington, DC: NTSB New Mexico State University website, “Float Safety Requirements,” accessed April 2013, http://safety.nmsu.edu/policies/NMSUFloatRequirements.pdf. Olson, P. L., R. Dewar, and E. Farber. 2010. Forensic Aspects of Driver Perception and Response, 3rd ed. Tucson. Tucson, Arizona: Lawyers & Judges Publishing Company, Inc. Sacramento, California, Cosumnes Community Service District, Parks & Recreation and Fire Department, website, “Requirements for Parade Floats,” accessed April 2013, http://www.yourcsd.com/safety/pdf/parades.pdf.

Title 7, Texas Transportation Code. 1995. Subtitle C, Chapter 544, Section 544.004. Austin, Texas: Texas State Legislature. Title 49, Code of Federal Regulations. 2011. Part 234, Subpart D, Section 234.225, “Grade Crossing Signal System Safety & State Action Plans.” Washington, DC: GPO. Title 49, Code of Federal Regulations. 2011. Part 391, Subpart E, Section 391.43, “Medical Examination; Certificate of Medical Examination.” Washington, DC: GPO. Title 49, Code of Federal Regulations. 2011. Part 392, Subpart B, Section 392.10(b)(2), “Railroad Grade Crossings; Stopping Required.” Washington, DC: GPO. .

NTSB

Highway Accident Report

60

Appendix A: Investigation The National Transportation Safety Board (NTSB) received notification of this collision on November 15, 2012, and launched highway investigators to address motor carrier, survival factors, human factors, vehicle, and highway issues. Additionally, the NTSB launched rail investigators to address train operations, and mechanical and signals issues. The NTSB team included staff from the Transportation Disaster Assistance Office and support staff from the Offices of Public Affairs, Government Affairs, and Research and Engineering. Member Mark R. Rosekind was the spokesman on scene. Parties to the investigation were the Federal Highway Administration, the Federal Motor Carrier Safety Administration, the Federal Railroad Administration, the Texas Department of Transportation, the city of Midland, the Midland Police Department, Meritor WABCO, Union Pacific Railroad, the United Transportation Union, the Brotherhood of Locomotive Engineers and Trainmen, the Brotherhood of Railroad Signalmen, and Smith Industries. No public hearing was held in connection with this collision, and no depositions were taken.

NTSB

Highway Accident Report

61

Appendix B: Reconstruction Timeline Details NTSB investigators constructed this timeline to detail the location of the float and the train at key points prior to the collision.

Figure B.1: Time to impact: 36.5 seconds Float 67 feet before stop line / Float distance to impact 301 feet / Train distance to impact 3,321 feet

NTSB

Highway Accident Report

62

Figure B.2: Time to Impact: 30.4 seconds Float at north stop line of West Front Avenue / Float distance to impact 243 feet / Train distance to impact 2,767 feet

NTSB

Highway Accident Report

63

Figure B.3: Time to Impact: 30 seconds Float at highway traffic signal preemption / Float distance to impact 231 feet / Train distance to impact 2,729 feet

NTSB

Highway Accident Report

64

Figure B.4: Time to Impact: 21 seconds Grade crossing warning system activation / Float distance to impact 155 feet / Train distance to impact 1,910 feet

NTSB

Highway Accident Report

65

Figure B.5: Time to Impact: 13.5 seconds Float at beginning gate descent / Float distance to impact 98 feet / Train distance to impact 1,228 feet

NTSB

Highway Accident Report

66

Figure B.6: Time to Impact: 8.9 seconds Float crossing rails / Float distance to impact 65 feet / Train distance to impact 808 feet

NTSB

Highway Accident Report

67

Figure B.7: Time to Impact: 7.8 seconds Train horn sounds / Float distance to impact 57 feet / Train distance to impact 709 feet

NTSB

Highway Accident Report

68

Figure B.8: Time to Impact: 4.8 seconds Train begins braking / Float distance to impact 36 feet / Train distance to impact 437 feet

NTSB

Highway Accident Report

69

Figure B.9: Impact Float distance past north rail 73 feet

NTSB

Highway Accident Report

70

Appendix C: Float Driver Activities (Nov. 12–15, 2012) Monday, November 12 Time Event Source 5:15 a.m. Logs on duty, not driving in Midland Logbook 5:30 a.m. Logs driving in Midland Logbook 6:47 a.m. Sends first outgoing dataa of day Cell phone records 10:45 a.m. Logs on duty, not driving in Florence Logbook 11:00 a.m. Logs sleeper berth in Florence Logbook 12:00 noon Logs on duty, not driving in Florence Logbook 1:15 p.m. Logs driving in Florence Logbook 4:27 p.m. Receives, answers first call of day Cell phone records 6:15 p.m. Logs on duty, not driving in Midland Logbook 6:30 p.m. Logs off duty in Midland Logbook 6:37 p.m. Receives, answers last call of day Cell phone records unknown Returns home Interviewb unknown Eats dinner Interviewb 8:11 p.m. Sends last outgoing data of day Cell phone records 9:30 p.m. Goes to bed Interviewb Tuesday, November 13 Time Event Source 5:15 a.m. Awakes Interviewb 5:40 a.m. Leaves his home Interviewb 5:50 a.m. Arrives at the yard Interviewb 6:40 a.m. Sends first outgoing data of day Cell phone records 7:00 a.m. Logs on duty, not driving in Midland Logbook 9:15 a.m. Logs driving in Midland Logbook 10:45 a.m. Logs on duty, not driving in Patricia Logbook 6:00 p.m. Logs driving in Patricia Logbook 6:50 p.m. Checks his voicemail; first phone activity Cell phone records 7:15 p.m. Logs on duty, not driving in Midland Logbook 7:30 p.m. Logs off duty in Midland Logbook unknown Returns home Interviewb unknown Eats dinner Interviewb 8:08 p.m. Makes last outgoing call of day Cell phone records 9:24 p.m. Sends last outgoing data of day Cell phone records 9:30 p.m. Goes to bed Interviewb

NTSB

Highway Accident Report

71

Wednesday, November 14 Time Event Source 5:15 a.m. Awakes Interviewb 5:20 a.m. Checks voicemail; first phone activity Cell phone records 5:40 a.m. Leaves his home Interviewb 5:50 a.m. Arrives at the yard Interviewb 6:43 a.m. Sends first outgoing data of day Cell phone records 7:00 a.m. Logs on duty, not driving in Midland Logbook 8:14 a.m. Makes outgoing call; first activity of day Cell phone records 8:30 a.m. Logs driving in Midland Logbook 11:30 a.m. Logs on duty, not driving in Mentone Logbook 12:00 noon Logs driving in Mentone Logbook 1:30 p.m. Logs on duty, not driving in Kermit Logbook 2:15 p.m. Logs driving in Kermit Logbook 3:30 p.m. Logs on duty, not driving in Midland Logbook 4:00 p.m. Logs off duty in Midland Logbook unknown Returns home Interviewb unknown Eats dinner Interviewb 6:00 p.m. Watches television Interviewb 6:00 p.m. Makes last outgoing call of day Cell phone records 9:30 p.m. Goes to bed Interviewb 10:21 p.m. Sends last outgoing data of day Cell phone records Thursday, November 15 Time Event Source 5:15 a.m. Awakes Interviewb 5:40 a.m. Leaves his home Interviewb 5:50 a.m. Arrives at the yard Interviewb 7:00 a.m. Logs on duty, not driving in Midland Logbook 7:08 a.m. Sends first outgoing data of day Cell phone records unknown Helps other drivers with their loads Interview unknown Washes float at yard Interview 11:26 a.m. Makes outgoing call; first activity of day Cell phone records unknown Goes home, puts on uniform, returns Interview unknown Polishes chrome on truck, puts on flags/chairs Interview 2:15 p.m. Logs driving in Midland Logbook 2:30 p.m. Arrives at DoubleTree hotel Interview (other float driver) unknown Assists veterans onto flatbed Interview 3:51 p.m. Receives incoming data; last activity before collision Cell phone records 4:02 p.m. Parade begins Video 4:35 p.m. Collision

a Text/SMS/pictures are tracked together by the driver’s cellular provider; referred to as “data” in the table. b Denotes the driver's description of a typical day and not a specific recollection by the driver.

NTSB

Highway Accident Report

72

Appendix D: Parade Operations Guidelines Table D-1 summarizes selected information found online in documents from the entities listed below (also see “References” for specific source/location). Using this matrix, the National Transportation Safety Board was able to establish commonalities among parade float operation practices. Cities/Municipalities  City of Dallas, Texas (Office of Special Events Guidelines)  City of San Diego, California (Parade Float Regulations)  City of Fremont, California (Parade Float Guidelines)  City of Arlington, Texas (Holiday Light Parade Float Building 101)  Sacramento, California, Cosumnes Fire Department (CFD) (Requirements for Parade Floats)

Universities  Baylor University (Parade Float Safety Requirements for Homecoming)  New Mexico State University (NMSU) (Float Safety Requirements)  Florida Atlantic University (FAU) (Float Safety Requirements)  Colorado State University (CSU) (Homecoming Parade Float Builder’s Manual 2009)

NTSB

Highway Accident Report

73

Table D-1. Selected parade float operational requirements or guidelines, accessed through the Internet in April 2013.

Baylor CFD flyer Dallas CSU FAU Arlington San Diego Fremont NMSU Risk of Fire Use of generators N C C C C C C C C Fuel storage or re-fueling P N N G P N P P P Smoking / alcohol N P N N P N P P P Open flame P N N P N N P P P Space heaters N P N N N N N N N Risk of Injury from Parade Activities Movement on or off of float during parade N N P P P N N P P Objects thrown from float N N P P N P N N P Animals P N C N N N N P N Squirt guns, silly string, etc N N P N N N N N N Risk of Driver Error, Driver Visibility Driver view Ca N N N Ra N N G Ca Driver communication R N N N Rd N N N R Spotters, walking support N N C Rb G N N N N Driver safety checklist/drill N N N N R N N R R Emergency sound device N N N N R N N N R Speed limited N N N Cc Ce N N N Ce Driver Direction and Planning Parade director N N R N N N N N N Route plan approval N N R N N N N N N Key: P: Prohibited

a: 180-degree unrestricted view. G: Follow good practice b: At least two spotters to walk near the float to monitor occupants. R: Required

c: Parade moves 4 to 5 mph for the entire route. C: Controlled or Restricted d: Communication between driver and float occupants. S: Suggested

e: Float must be capable of 10 mph and occupied must not exceed 20 mph. N: Not addressed

FD07403 ｜ 2013_美国_MAB1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-13/02 National Transportation Safety Board Marine Accident Brief Determination of Probable Cause Fire On Board Passenger Vessel Malaspina

Accident No. DCA-12-LM-009 Vessel Name Malaspina Accident Type Fire Location Alaska Ship and Drydock (ASD), Ketchikan, Alaska 55°21.3952′ N, 131°41.9782′ W Date February 7, 2012 Time 1155 Alaska standard time (universal coordinated time –9 hours) Injuries None Damage Est. $500,000–$750,000 Environmental damage None Weather Winds light and variable, clear skies, 10-mile visibility Air temperature 45° F Waterway characteristics Vessel was out of the water for repairs in ASD’s drydock

The passenger vessel Malaspina was in dry dock in Ketchikan, Alaska, for scheduled repairs when a fire broke out on February 7, 2012, resulting in estimated damage of $500,000 and $750,000. No one was injured. The Malaspina was undergoing duct repair which required “hot work”―cutting, grinding, and welding. The vessel is shown in figure 1.

Figure 1. The passenger vessel Malaspina under way.

Marine Accident Brief: Determination of Probable Cause DCA-12-LM-009 Fire On Board Passenger Vessel Malaspina

NTSB/MAB-13/02 2 The fire began in the sewage treatment room, also known as the marine sanitation device space, at about 1155 local time. A shoreside work crew employed by Alaska Ship and Drydock, Inc., (ASD) was on board the Malaspina to repair a ventilation duct located in a crewmember stateroom with fire watch personnel present. ASD’s permit to perform the work did not call for the fire watch to remain on scene for any length of time once the work was completed. The location is shown in figure 2.

Figure 2. Ketchikan, Alaska, site of the Malaspina fire, on the coast at the far southeastern tip of Alaska, near British Columbia, Canada. Background by Google. The sewage treatment room was located directly below the stateroom in which the repair work was taking place, and the open ventilation duct directly exposed the rooms to one another. The workers placed a welding curtain horizontally at the opening of the exposed duct to collect slag, the waste produced during high-temperature metal work, and other hot material to keep it from falling into the room below. About noon, after the workers had been cutting away steel tabs inside the duct, they and the fire watch departed for lunch. As they were leaving the vessel, shipyard and vessel personnel noticed smoke coming from the sewage treatment room. The local fire department was notified, and the fire was extinguished. In the sewage treatment room, the fire burned spare rubber fan belts and hoses; severely damaged the sodium bisulfate injection system, which protects carbon filters from premature exhaustion; and damaged overhead insulation, sewage piping, and electrical power cabling. The fire also caused smoke and soot damage to nearby spaces. The United States Coast Guard investigation revealed that the welding curtain the workers had placed over the ventilation duct was intended to be used only on a vertical plane to shield against sparks. It was not designed to withstand continuous contact with slag and other hot material as it did when placed horizontally. The hot material burned through the curtain and fell Ketchikan

Marine Accident Brief: Determination of Probable Cause DCA-12-LM-009 Fire On Board Passenger Vessel Malaspina

NTSB/MAB-13/02 3 down the duct into the sewage treatment room below, where it ignited combustible material. Although the curtain was improperly placed, however, if the workers had remained on site to ensure that the hot materials had cooled sufficiently, they could have detected and quickly extinguished any small flames before the fire spread. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board the passenger vessel Malaspina was the failure of the shoreside work crew and fire watch to ensure that proper cooling had occurred before leaving the area where the repair work was conducted. Contributing to the accident was the work crew’s improper use and application of a welding curtain, placed horizontally as opposed to vertically, which allowed molten material to burn through the curtain and fall into the space below. Vessel Particulars Vessel Passenger vessel Malaspina Owner/operator State of Alaska Port of registry Skagway, Alaska Flag United States Type Inspected ferry vessel Built August 3, 1962 Official number (US) 290288 Construction Steel Length 372.2 ft. (113 m) Draft 10.83 ft. (3.3 m) Beam 74 ft. (22.5 m) Gross tonnage 2,928 Engine power 8,000-hp / 5,965 kW diesel Persons on board n/a (vessel was drydocked and undergoing scheduled maintenance)

For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM009.

Adopted: February 1, 2013 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07404 ｜ 2013_美国_MAB1303.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-13/03 National Transportation Safety Board Marine Accident Brief Determination of Probable Cause Engine Room Fire and Eventual Flooding and Sinking of Fishing Vessel Lucky Diamond

Accident no. DCA-12-LM-018 Accident type Fire and subsequent sinking Vessel Uninspected fishing vessel Lucky Diamond Location Gulf of Mexico, southwest of Morgan City, Louisiana 29°22.08′ N, 092°08.95′ W Date May 10, 2012 Time 2200 central daylight time (coordinated universal time – 5) Injuries/ fatalities 1 crewmember with first-degree burns 3 crewmembers missing and presumed deceased Environmental damage Potential release of 20,000 gallons of diesel fuel and unknown quantity of lube oil Weather Isolated showers, 10- to 15-knot winds from the southeast, clear visibility, seas 2 to 4 ft., air temperature 75° F

The fishing vessel Lucky Diamond caught fire and burned for several hours before sinking in 40 feet of water about 2200 on May 10, 2012. The master of the vessel suffered first- degree burns to his face and eyes, and the remaining three crewmembers were lost and are presumed deceased. The accident location is shown in figure 1.

Figure 1. Red star indicates approximate location of the Lucky Diamond fire and sinking. (Background from National Oceanic and Atmospheric Administration [NOAA] chart 11340)

Morgan City, LA Louisiana

Marine Accident Brief: Determination of Probable Cause DCA-12-LM-018 Engine Room Fire and Eventual Flooding and Sinking of Fishing Vessel Lucky Diamond

NTSB/MAB-13/03 2 On April 28, 2012, the Lucky Diamond departed its homeport in Sabine Pass, Texas, for a month-long shrimping trip. On board the vessel were a master and three crewmembers. Around 1600 on May 10, 2012, the men stopped fishing for the day and moored the Lucky Diamond stern-to-stern with the anchored fishing vessel Miss Carol. The crew then had dinner and rested. Later that night at 2200, the master awoke to the smell of smoke in his stateroom and went to the galley area to investigate. He observed heavy smoke in the galley area and in the vicinity of the crew quarters. He also saw fire coming up through the deck area near the crew quarters where electrical supply cables from one of the vessel’s diesel generators passed underneath the deck. (See “Vessel Drawings” for sketches of the vessel’s main and lower decks.) The master shouted to alert the crew and then opened the door to the crew accommodation space, but heavy smoke prevented him from seeing inside. The master tried unsuccessfully to fight the fire with onboard firefighting equipment, sustaining first-degree burns to his face and eyes during this effort. He then abandoned the vessel via the stern where he boarded the Miss Carol. At that time, the entire accommodation space of the Lucky Diamond was engulfed in flames, and the crew of the Miss Carol cut the mooring lines to the Lucky Diamond, setting the vessel adrift. The Lucky Diamond burned for several hours and then sank in about 40 feet of water. On May 17, 2012, at 1155, divers with T & T Bisso, LLC, performed a penetration dive on the hull and remaining structure of the Lucky Diamond, which was resting on its keel and starboard side shell. The divers identified extensive fire and heat damage, including warped steel bulkheads, decks, and a water-tight door. They could not locate any human remains. The status of the navigational, mechanical, propulsion, steering, and other vital systems on board the Lucky Diamond at the time of the accident could not be determined, but the master stated they were operational before the accident. The investigation could not determine which electrical generation system was energized at the time of the fire’s ignition. The fire and subsequent sinking of the Lucky Diamond resulted in the total constructive loss of the vessel. In addition, oil sheening was observed in the area of the Gulf of Mexico where the vessel sank. Probable Cause The National Transportation Safety Board determines that the probable cause of the loss of the uninspected fishing vessel Lucky Diamond was a fire of unknown origin in the engine room followed by down-flooding of the interior compartments and eventual sinking of the vessel.

Marine Accident Brief: Determination of Probable Cause DCA-12-LM-018 Engine Room Fire and Eventual Flooding and Sinking of Fishing Vessel Lucky Diamond

NTSB/MAB-13/03 3 Vessel Particulars Vessel Lucky Diamond Owner/Operator TL&S Corporation, Stafford, Texas Port of registry Palacios, Texas Flag United States Type Uninspected fishing vessel Built Johnson Shipbuilding & Repair Bayou La Batre, Alabama, 1987 Official number 911160 Construction Steel Depth 13.5 ft. (4.1 m) Length 92.2 ft. (28 m)) Width 27 ft. (8.2 m)) Gross tonnage 232 Engine power and type 2 Caterpillar 3412 diesels at 600 hp (447 kW) each Cargo 70,000 pounds of shrimp Crew complement 4

For more information about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM018.

Adopted: February 1, 2013

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07405 ｜ 2013_美国_MAB1305.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB/13-05 Vehicle carrier Alliance Norfolk. Photo by Jeffrey J. Kunce, http://marinetraffic.com.

National Transportation Safety Board Marine Accident Brief Fire Aboard Vehicle Carrier M/V Alliance Norfolk

On the morning of March 10, 2012, while transiting between Malta and Sicily, Italy, in the Mediterranean Sea, the M/V Alliance Norfolk, a roll on/roll off vehicle carrier, encountered rough weather and heavy seas resulting in damage to its cargo and a subsequent fire on a cargo deck. The fire was extinguished at sea, but 2 days later while in port, the damaged cargo deck was ventilated, and the fire reflashed, causing further damage to the vessel and its cargo. The vessel was on a voyage from Jacksonville, Florida, bound for ports in the Arabian Gulf via the Suez Canal when it experi- enced rolls up to 30 to 35 degrees during its passage through the Mediterranean (see accident location next page). While experiencing rough seas, the main engine tripped and was subse- quently restarted. During this time the crewmembers checked the status of cargo, which included military containers, commercial vehicles, motorcycles, small boats, and Accident no. DCA-12-LM-012 Accident type Fire Vessel M/V Alliance Norfolk Location Mediterranean Sea, about 30 miles northeast of Malta 36° 17.0′ N, 014° 39.0′ E Date March 10, 2012 Time 1030 central European time (universal time coordinated + 1) Injuries 3 minor injuries Damage Est. $1.3 million Environmental damage 10–15 gallons diesel oil in the water Weather, sea conditions Gale force winds from 060° at 33 knots gusting to 51 knots and wave heights of 18 to 32 feet

Cargo Damaged During Rough Weather and Subsequent Fire Aboard Vehicle Carrier M/V Alliance Norfolk

2 NTSB/MAB/13-05 electrical and other equipment. During one of these checks, a crewmember observed large engines, generators, air conditioning chillers, and 20-foot containers adrift on cargo deck 5. The cargo was shifting with the rolling of the vessel, and being thrown against each other and the main deck supports of the cargo deck. The crew was unable to safely secure the cargo.

At 1030, the fire detection and alarm system activated in cargo deck 5. The chief mate and chief engineer investigated and saw flames and heavy smoke coming from the area. Ventilation and boundaries for the area were secured in preparation for release of the fixed carbon dioxide (CO2) fire extinguishing system, which was activated at 1050. Adjoining spaces were monitored for heat or fire, and the master reported the fire was extinguished at 1250. Coast Guard investigators could not determine the initial source of ignition. However, the dynamic environment of the vessel rolling in heavy seas and shifting cargo in the presence of various flammable liquids (held within the mixed cargo and containers) could have produced an ignition source.

The vessel deviated course to Piraeus, Greece, as a port of refuge, and anchored there 2 days later at 1200 on March 12, 2012. A marine chemist boarded the vessel and at 1700 declared cargo decks 4, 5, and 7 safe for mechanical ventilation. However, at 2000 that evening, heavy black smoke was seen escaping from the ventilation system, indicating the smoldering fire had reflashed when ventilation reintroduced sufficient oxygen to feed the fire. The space was again secured, and the local fire department boarded the vessel and brought the fire under control nearly 9 hours later, at 0445 on March 13, 2012. Following the accident, test results for illegal drugs and alcohol were negative for Alliance Norfolk crewmembers. Three crewmembers reported minor injuries. Position of the Alliance Norfolk when crew first reported the fire, in the Mediterranean Sea approximately 30 miles northeast of Malta between Sicily and Malta, as shown by the red pin. Chart from http://itouchmap.com/latlong.html. Sicily Accident site N

Cargo Damaged During Rough Weather and Subsequent Fire Aboard Vehicle Carrier M/V Alliance Norfolk

3 NTSB/MAB/13-05

Cargo remains of Harley Davidson motorcycle and pool of oil on deck. (Photo by US Coast Guard)

Container damage in cargo hold. (Photo by US Coast Guard)

An interim survey report by Scandinavian Underwriters Agency (SCUA) Middle East Ltd., Dubai, June 4, 2012, estimated total damage to the vessel and its cargo caused by the fire was about $1.3 million. Specific damage was reported to the following vessel areas and cargo: • Approximately 40 military containers and vehicles; • Approximately 24.3 tons of the vessel’s structure, including fixed car deck 5 and hoistable car deck 6, port-side shell plating, structural pillars, longitudinal frames, and deck-mounted lashing bars;

Cargo Damaged During Rough Weather and Subsequent Fire Aboard Vehicle Carrier M/V Alliance Norfolk

4 NTSB/MAB/13-05 • Drainage system pipes and valves, fire detection system, ventilation system, and lighting system of the cargo deck; • Heavy fuel oil, compressed air, and fire main seawater pipe lines; • Automation controls for car deck; and • Communication system between the navigation bridge and the engine room.

Probable Cause The National Transportation Safety Board determines the probable cause of the fire on board the M/V Alliance Norfolk was ignition of flammable material by an undetermined ignition source ondeck 5 due to shifting cargo while the vessel was rolling in heavy seas after losing power. Contributing to the severity of the damage was the reflash of the smoldering fire when the vessel was in port.

Cargo Damaged During Rough Weather and Subsequent Fire Aboard Vehicle Carrier M/V Alliance Norfolk

5 NTSB/MAB/13-05

Vessel Particulars

Vessel Alliance Norfolk Registered owner Wilmington Trust Co. Ship manager Maersk Line Ltd. Flag state United States International Maritime Organization number 9332547

Builder/date Daewoo Shipbuilding & Marine Engineering Co. Ltd., December 2007 Port of registry Norfolk, VA Classification society Det Norske Veritas Length overall 655.8 ft. (199.9 m) Breadth 105.8 ft. (32.26 m) Gross tonnage 57,280 (International Tonnage Convention) Engine type and power 1 MAN-B&W 7S60MC diesel direct Max. power, 14,280 kW Service speed 20.5 knots Cargo Cars, trucks, motorcycles, boats; industrial and manufacturing parts and equipment; boxes and containers Persons on board 23 crew Injuries 3 minor

For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM012.

Adopted: May 10, 2013

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07406 ｜ 2013_美国_MAB1306.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-13/06

National Transportation Safety Board Marine Accident Brief Fire on Board Uninspected Towing Vessel Ivory Coast

Accident no. DCA-12-LM-001 Vessel Ivory Coast Accident type Fire Location General Ship Repair, near Domino Sugar Pier, Baltimore Northwest Harbor, Maryland 39° 16.46 N, 076° 36.02 W Date October 10, 2011 Time 1645 eastern daylight time (universal coordinated time – 4) Damage Estimated more than $1 million Injuries None Weather North-northeast winds at 4 knots, visibility 10 mi., air temperature 82° F, dew point temperature 55° F

The US uninspected towing vessel Ivory Coast was moored at General Ship Repair (GSR) in Baltimore’s Northwest Harbor while undergoing cutting and welding―or “hot work”―on the starboard side hull plating in the engine room when a fire ignited and spread to the main deck galley on October 10,

1. Damage to the engine

room, associated machinery, and galley on the main deck was extensive, with repairs estimated to cost over $1 million. The Ivory Coast arrived at the GSR facility 4 days earlier, on October 6, 2011, to undergo repairs including the replacement of rub rails, which protect the vessel’s hull when made up to a barge or another vessel. Most of the crew left the ship, while the engineer and ordinary seaman remained on board in a caretaker status. Ivory Coast starboard side showing area of hot work for replacement of rub rails (red arrow). (Photo: US Coast Guard)

Fire On Board Uninspected Towing Vessel Ivory Coast during Hot Work

2 NTSB/MAB-13/06

At about 1630 that afternoon, Upper Chesapeake Chemist Co. Inc. issued a marine chemist certificate indicating the atmosphere near the port and starboard diesel fuel tanks and the engine room space was safe for workers and for limited hot work. When ship repair and construction may result in fire, explosion, or exposure to toxic vapors or chemicals, a marine chemist is required to ensure the work can be conducted safely. After initial certification by a marine chemist, a competent person conducts follow-up routine monitoring of the space and adjacent areas. A competent person is trained and experienced in atmospheric sampling and monitoring and qualified to apply workplace standards and identify potential hazards with authority to correct them. The marine chemist certificate stated that hot work to be performed on the Ivory Coast was limited to replacement of the rub rail on the starboard side while maintaining a fire watch and ventilation. A competent person was required to check the atmosphere daily before hot work could begin to confirm the atmosphere was safe. Repair work began on Friday, October 7, and continued Monday, October 10. The repairs planned for Monday morning included conducting hot work in the engine space, which involved cutting with an acetylene torch along the starboard hull to remove the vessel’s rub rails.

The shipfitter started work at 0740 and secured the cutting torches before taking a break at 1130. A supervisor/ competent person acting as fire watch was stationed nearby in the engine room throughout the hot work and was spraying water from a fire hose to cool the hull plating. When the shipfitter and fire watch resumed work, the vessel’s engineer was working in the engine room on the exhaust manifold of the starboard generator. Less than 2 hours later, the shipfitter felt intense heat on his safety jacket and pants, removed his face shield, and realized a Accident site (red arrow) in Baltimore’s Northwest Harbor. Inset shows location of Baltimore (red dot) in the state of Maryland on the US east coast. (Background by Google maps) Northwest Harbor Baltimore Harbor

Fire On Board Uninspected Towing Vessel Ivory Coast during Hot Work

3 NTSB/MAB-13/06 Underside of main deck Side shell near area of hot work where hull meets deck Diesel oil manifold disconnected to gain access for hot work View of the starboard side engine room looking up to the point at which the side shell insert hull meets the underside of the main deck. As hot work was performed at this location, sparks fell down into the engine room onto a wooden cabinet located below this area. (Photo by US Coast Guard) fire had broken out and the fire watch was spraying water toward the flames with the fire hose, but the water intensified the flames. The shipfitter told Coast Guard investigators he secured the torch, relieved the fire watch of the fire hose, and a short time later located a CO2 portable fire extinguisher and discharged it at the deck plates but with no effect. The shipfitter, fire watch, and vessel chief engineer realized the fire was out of control, and all personal evacuated the tug; the shipfitter then asked the supervisor/fire watch to call 911. The fire was extinguished by the Baltimore City Fire Department early that afternoon. The chief engineer stated that before starting hot work he drained and disconnected the diesel oil manifold so the shipfitter could gain access for the repairs. He also said that below the manifold was a wooden tool box, which over time had become saturated with diesel oil. This was confirmed by testing of a sample of residue from the wooden box by the Bureau of Alcohol, Tobacco, Firearms, and Explosives (ATF). Therefore, a possible ignition source of the fire could have been a shipfitter’s spark igniting the unprotected diesel oil– soaked wooden tool box below the area of the hot work. No injuries were sustained by those onboard or the responding fire department personnel. No alcohol or drug testing was performed on the vessel crew or the GSR workers. Although the marine chemist certificate was completed on October 6, 2011, the day the vessel arrived at GSR, the Ivory Coast was subsequently moved within the repair facility after the certificate was issued. National Fire Protection Association standards specify that “the prescribed work [be] carried out at the original location within the facility for which the Certificate was issued, unless movement is authorized within the facility” by the responsible marine chemist . . . .” The marine chemist certificate did not authorize vessel movement; therefore, the certificate was voided. However, a competent person performed required daily monitoring to ensure the atmosphere was safe for hot work.

Fire On Board Uninspected Towing Vessel Ivory Coast during Hot Work

4 NTSB/MAB-13/06 Probable Cause The National Transportation Safety Board determines the probable cause of the fire on board the uninspected towing vessel Ivory Coast was sparks from welding and cutting repair work conducted with an oxygen-acetylene torch igniting unprotected combustible material in the engine room. Vessel Particulars Vessel Ivory Coast Vessel type Uninspected towing vessel Registered owner Ivory Coast LLC Ship manager/ operator Dann Marine Towing LLC Flag state United States IMO number US official number 7042825 520332 Builder, date Breaux Bay Craft, Inc. October 1967 Gross tonnage 140 US (446 ITCa) Length overall 110.67 ft. (33.74 m) Width 26.1 ft. (7.96 m) Main engines 2 main engines, EMD (Electro-Motive) model 16-567-BC Max. power 1,350 hp (2,354 kw) each Service speed 13 knots Persons on board Docked: 2 crewmembers, 1 shipfitter, and 1 supervisor/competent person acting as a fire watch a Measured according to International Tonnage Convention

For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM001.

Adopted: May 16, 2013

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07407 ｜ 2013_美国_MAB1310.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-13/10

National Transportation Safety Board Marine Accident Brief Engine Room Fire On Board Towing Vessel Patrice McAllister

Accident no. DCA-12-LM-014 Vessel Patrice McAllister Accident type Fire Location Lake Ontario – 4 miles southeast of Point Petre, near Prince Edward Point, Ontario, Canada; 43°46.0′ N, 077°02.0′ W (Canadian territorial waters) Date March 27, 2012 Time 0229 eastern daylight time (coordinated universal time –4 hours) Injuries One fatality and five minor injuries Environmental damage

None Weather and sea conditions Clear skies; winds 12 knots from 010°; 3.5-foot seas and good visibility; air temperature 27° F; water temperature 36° F. Waterway characteristics The accident occurred in open waters of Lake Ontario. The lake is 193 miles long, 53 miles wide, with an average depth of 283 feet. On March 27, 2012, at 0229 eastern daylight time, the uninspected towing vessel (UTV) Patrice McAllister, with six crewmembers on board, experienced an engine room fire. At the time, the vessel was transiting east on Lake Ontario en route from Toledo, Ohio, to Staten Island, New York. The crew released CO2 from the vessel’s fire suppression system into the engine room and extinguished the fire; however, the fire later reflashed and burned out of control. The vessel’s chief engineer was fatally injured, and the five remaining crewmembers suffered minor injuries. No pollution resulted from the accident.

The Patrice McAllister under way. Photo by Paul Beesley, www.shipspotting.com.

Engine Room Fire On Board Towing Vessel Patrice McAllister

2 NTSB/MAB-13/10 The US Coast Guard was the lead investigative agency in the accident. The Transportation Safety Board of Canada (TSB) provided assistance. The National Transportation Safety Board (NTSB) conducted an independent investigation; assisted with metallurgical, materials, and chemical analyses; and downloaded the engine electronic control module.

Lake Ontario, including the location where the Patrice McAllister crew reported the fire. Background by Google. On March 23, 2012, about 4 days before the accident, the Patrice McAllister departed the Ironhead Shipyard in Toledo, where the vessel had undergone a complete overhaul. McAllister Towing of New York, LLC, had purchased the vessel in December 2011, and the accident voyage was to transfer the vessel to McAllister Towing’s fleet in Staten Island. Shortly after midnight on March 27, 2012, the Patrice McAllister was transiting at about 10–12 knots through Canadian territorial waters on Lake Ontario. It was being powered by the vessel’s portside main engine, which was running at about 1,630 rpm at the time; the crew had shut off the starboard-side main engine to repair a leak in the lubrication oil cooler line. About 0229, a small hairline fracture in the port engine’s pre-lubrication oil pump discharge line began spraying lubrication oil into the engine room. The oil spray made contact with the hot portside engine manifold and flashed into an oil spray fire. ~ 10 miles

Engine Room Fire On Board Towing Vessel Patrice McAllister

3 NTSB/MAB-13/10

The engine room fire resulted from a fracture in the port main engine’s pre-lube pump discharge line. Photo by TSB. The chief engineer was in the engine room when the fire broke out. The only exit was an accommodation ladder leading to a watertight door onto the fiddley deck, a partially raised deck located directly above the engine room near the smokestack. Because the accommodation ladder was in the path of the oil spray fire, the chief engineer had to exit through the fire, which ignited his clothing. He collapsed on deck after exiting. The other crewmembers, who had been alerted to the fire moments earlier by heat and smoke coming through a galley rangehood vent, discovered the chief engineer and extinguished the flames in his clothing. The chief engineer suffered burns on more than 90 percent of his body. The oil spray fire also ignited combustible material on the fiddley deck. The crewmembers prepared to release the CO2 into the engine room from the vessel’s fixed fire suppression system. They secured the vessel’s centerline passageway by closing its aft watertight door leading to the weather deck and its forward door leading to the galley (see “Vessel Layout” for configuration drawings). However, the crewmembers did not close the watertight door onto the fiddley deck, through which the chief engineer had escaped, before the master released the CO2. Had the crew done so, the door would have helped segregate the centerline passageway from the engine room and the fiddley deck. In addition, no means existed to mechanically isolate the engine room’s exhaust and supply ventilation. On receiving word that the engine room was secured, the master released the CO2, which, as expected, caused the portside main engine to shut down, followed by the generator and ventilation system. The vessel lost all power and began drifting in an easterly direction. At 0346, after observing a noticeable reduction in heat and smoke, the master reported to the Canadian Coast Guard that the fire was extinguished. During this time, crewmembers opened the doors to the vessel’s superstructure and began de-smoking it. However, this action compromised the fire

Engine Room Fire On Board Towing Vessel Patrice McAllister

4 NTSB/MAB-13/10 boundary by allowing CO2 to escape and fresh air to enter the interior of the vessel, which caused the fire to reflash. At 0419, the smoke alarms sounded. Because the vessel had lost power, crewmembers were unable to run the main fire pump, and they had already released all of the CO2. The fire also blocked access to the portable fire pump. As a result, the crewmembers were unable to fight the fire, which now raged out of control. It spread into the accommodation space and consumed all combustible material up through the upper wheelhouse. The vessel’s two liferafts, stowed on the bridge deck, were inaccessible to the crew because of the flames and intense heat. Unable to abandon ship into out-of-water flotation, the crew huddled in survival suits at the stern of the vessel, waiting to be rescued. At 0456, a Canadian Coast Guard rescue helicopter evacuated the chief engineer, who later died from his injuries. An hour later at 0556, the remaining five crewmembers, who sustained minor smoke inhalation injuries, were evacuated to the Canadian Coast Guard ship Cape Hearne. The Patrice McAllister was salvaged later that afternoon by the UTV Bowditch and towed to Clayton, New York.

The fire-damaged Patrice McAllister after being towed to port. Photo by TSB. The NTSB materials laboratory in Washington, DC, examined the pre-lubrication oil pump nipple/flange assembly (“assembly”) for the port engine. The assembly exhibited a circumferential fracture adjacent to the fillet weld, which is a weld of about triangular cross

Engine Room Fire On Board Towing Vessel Patrice McAllister

5 NTSB/MAB-13/10 section that joins two pieces, especially perpendicularly. The fracture had progressed to about 75 percent of the assembly circumference, and was located along a thread root adjacent to the fillet weld. A scanning electron microscope revealed that fatigue was the only failure mode on the fracture surface. No indications of other failure modes, such as overstress or corrosion, were found.

The assembly, as received. The crack was located along a thread valley and spanned across about 75 percent of the assembly’s circumference. About 35 gallons of lubrication oil had sprayed out. This particular oil, Mobil DELVAC 1300 Super 15W-40, had a flashpoint temperature of 419° F and an auto-ignition temperature of about 569° F. According to the engine manufacturer, the temperature of the exhaust manifold would have been about 930° F at the time, and so the oil easily auto-ignited when the spray came in contact with the manifold. Although the manifold’s cover prevented solid objects from directly touching the manifold, it did not keep out spraying liquids or gases. A burn pattern and residue of burnt lubrication oil extended athwartship (side to side) from port to starboard, and from the overhead to the bilges, including the accommodation ladder.

The fire caused extensive damage to the entire vessel, including the lower and upper engine room, galley, crew mess, crew quarters, upper and lower wheelhouses, and internal and external deckhouse structures. Both the port- and starboard-side engines required extensive repair; all auxiliary equipment required extensive repair or replacement; the entire superstructure needed to be replaced; and so did all electrical equipment, interior and exterior fittings, and navigational and communications systems and equipment. According to the surveyor’s report, total estimated cost for repair and towage to New York was about $3,569,000. Following the accident, the five surviving Patrice McAllister crewmembers and the body of the chief engineer were tested for illegal drugs and alcohol. All test results were negative.

Engine Room Fire On Board Towing Vessel Patrice McAllister

6 NTSB/MAB-13/10

The steel door of the centerline passageway to the galley (main deck frame 25) is lying on the deck. The wooden door frame was consumed in the fire. Photo by TSB. The chief engineer was 49 years old. He held a merchant mariner’s credential with endorsement as designated duty engineer, and had 22 years’ experience in the maritime industry. He had been the chief engineer of this vessel for 13 years, from the time it was built in 1999. The chief engineer and the assistant engineer stood watch in rotations of 12-hours-on/12-hours-off. The master was 29 years old. He held a merchant mariner’s credential with endorsements as unlimited third mate and master, 1600 gross tons, of near coastal towing vessels. He had worked for McAllister Towing since he graduated from a maritime academy in 2005, and had been sailing as master for the last 2 years. The master and the mate stood watch in rotations of 6-hours-on/6-hours-off. The remaining two crewmembers were deckhands, who both held merchant mariner’s credentials. In an August 11, 2011, notice of proposed rulemaking (NPRM), titled Inspection of Towing Vessels, the Coast Guard stated that it would establish safety regulations governing the inspection, standards, and safety management systems of towing vessels. The proposal included provisions covering specific electrical and machinery requirements for new and existing towing vessels, the use and approval of third-party auditors and surveyors, and procedures for obtaining certificates of inspection. In two letters dated December 8, 2011, the NTSB expressed support for

Engine Room Fire On Board Towing Vessel Patrice McAllister

7 NTSB/MAB-13/10 the NPRM and the intent of the proposed rules. Proposed regulations that are applicable to the Patrice McAllister accident and may have lessened the damage and injuries are:  Fire hazards to be minimized … storage areas are kept free from accumulation of combustible materials.  Training crews to … fight a fire in the engine room … stop any mechanical ventilations system for the engine room and effectively seal all natural opening to the space to prevent leakage of the extinguishing agent.  The (portable fire) pump must be stowed with its hose and nozzle outside of the machinery space.  Liferaft launching will be covered by Subchapter W.  Where practical, each space on an existing towing vessel where crew may be quartered or normally employed must have at least two means of escape. As a result of the Patrice McAllister accident, the government/industry Towing Safety Advisory Committee (TSAC) issued Task #12-06: Recommendations to Improve Operational, Structural or Other Standards to Enhance Fire Prevention and Containment aboard Towing Vessels. The background and discussion for the recommendations stated that, over a 5-year period beginning in 2007, a fifth of all reported fires on board UTVs were oil spray fires. The Patrice McAllister is cited as a recent example of a fire spreading into other areas of the vessel, resulting in significant additional fire damage. The lack of fire dampers in ventilation systems, along with compromised boundaries due to holes, openings, and casual modification, appear to be major problems in containing engine room fires. By September 20, 2013, TSAC is to recommend additional standards to ensure the safe operation of towing vessels. Probable Cause The National Transportation Safety Board determines that the probable cause of the engine room fire on board the Patrice McAllister was the ignition of lubricating oil that sprayed from a fatigue-fractured fitting on the portside main engine’s pre-lubrication oil pump onto the hot surface of the portside main engine’s exhaust manifold. Contributing to the extent of the fire damage was the crewmembers’ compromise of the fire boundaries when they prematurely began de-smoking the vessel’s superstructure; the inability to completely secure the engine room’s fire boundaries; and the abundance of flammable material throughout the vessel.

Engine Room Fire On Board Towing Vessel Patrice McAllister

8 NTSB/MAB-13/10 Vessel Particulars Vessel Patrice McAllister Owner/operator McAllister Towing & Transportation Co., Inc. Crew complement 6 Port of registry Wilmington, DE Flag United States Type Uninspected towing vessel Built C & G Boatworks Inc. – Mobile, Alabama, 1999 Official number 1082214 IMO number 9215799 Construction Steel Depth 15.2 ft (4.62 m) Length 105.2 ft (31.9 m) Breadth 34.0 ft (10.3 m) Gross tonnage 149 Engine power and type Twin 3516B Caterpillar diesels 16 cylinders each 4,400-hp/3,278 kW Service speed Unknown Cargo n/a Persons on board 6 crew

For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM014. Adopted: June 6, 2013

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131.

Engine Room Fire On Board Towing Vessel Patrice McAllister

9 NTSB/MAB-13/10 Vessel Layout

FD07408 ｜ 2013_美国_MAB1312.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-13/12 National Transportation Safety Board Marine Accident Brief Fire on Board Passenger Vessel Safari Spirit

Accident no. DCA-12-LM-016 Vessel name Safari Spirit Accident type Fire Location Pier 9, Fisherman’s Terminal, Seattle, Washington 47°39.385′ N, 122°22.896′ W Date April 27, 2012 Time 0100 Pacific daylight time (coordinated universal time – 7 hours) Damage Est. $1.5 million Injuries None Environmental damage None Weather Winds southerly at 10 knots, air temperature 45° F, sky overcast, visibility good Waterway characteristics Fisherman's Terminal, a marina near the Lake Washington Ship Canal about 1.5 miles east of Puget Sound

A fire broke out on the aft deck on board the passenger vessel Safari Spirit while the vessel was docked at Pier 9 of Fisherman’s Terminal in the Ballard area of Seattle, Washington, on April 27, 2012, about 0100 local time. The vessel was off charter but soon to start its seasonal cruising schedule in Alaska.

Safari Spirit ablaze at Fisherman’s Terminal in Seattle, Washington. (Photo by Joshua Lewis, KOMO News)

Fire on Board Passenger Vessel Safari Spirit

2 NTSB/MAB-13/12

Two company personnel, the chief executive officer (CEO) and the vessel’s chief engineer, were aboard and asleep at the time of the fire. The CEO stated that he awoke to a popping or crackling sound, got up to investigate, and discovered the fire. After escaping the vessel hand-over-hand across the bow lines to the dock, the CEO and chief engineer tried to fight the fire with small water hoses located on the pier. They also released the mooring lines of nearby vessels to allow them to float away from the fire engulfing the Safari Spirit. Local fire units arrived on scene within about 10 minutes and extinguished the blaze. The Seattle Fire Department maintained a fire watch with the vessel until daybreak to monitor hotspots and observe the vessel’s structural integrity.

The day before the fire, two contract workers were aboard to oil the teak deck located aft on the vessel’s main deck. The workers also painted newly fabricated kayak storage racks further aft and on the deck below. Rags used to apply and clean up the oil from the teak wood treatment were laid across rails to dry. The workers stated they removed all the oiled rags and painting equipment from the vessel at the end of the work day. To their recollection, all paint and oil cans were sealed and stowed on the back deck near the completed work. The CEO and the chief engineer returned to the vessel later that night about an hour apart to spend the night aboard. The CEO recalled turning on overhead lighting on the aft deck to illuminate a “Do Not Enter” sign that identified the freshly oiled decks. A security camera located in the port captured an unidentified person walking on Pier 9 near the Safari Spirit shortly before the estimated time of the fire’s ignition; however, no evidence was found to indicate this person had any connection with the fire. Seattle, Washington Canada United States The Safari Spirit caught fire while docked at Fisherman’s Terminal, shown by the red star, on the Lake Washington Ship Canal in the Ballard area of Seattle, Washington. Inset map shows the location of Seattle in the northwestern United States. (Background maps by Google Earth and www.maps-gps-info.com) Atlantic Ocean Fisherman’s Terminal

Fire on Board Passenger Vessel Safari Spirit

3 NTSB/MAB-13/12

CORRECTED COPY Self-heating and fire ignition Self-heating is a process in which heat is created within a material through a biological or chemical process and without the application of an external heat source. If self- heating increases the temperature of the material above its ignition point with sufficient oxygen present, self-ignition can occur. Sufficient air must be present to sustain the combustion reaction, but not so much air that the heat is dissipated. Common examples of materials that can self-heat/self-ignite are linseed oil rags, coal dust, hay, wood chips, manure, and latex. The fire was estimated to have started at about 0100, with the Seattle Fire Department arriving shortly thereafter and extinguishing the blaze. The bow of the vessel was pointed north and the ignition location was on the aft deck, so the southerly 10-knot wind helped to push the flames forward on the vessel. The forensic fire investigation concentrated on the self-heating of the flammable oil and paint cans left on the aft decks in the area of the freshly oiled decks. (See box at right on self-heating and fire ignition for more information.) However, no final determination was made regarding the source of ignition of the fire. In an open letter to company personnel, the CEO alerted staff to the circumstances of this accident, precautions in dealing with the materials that were in use aboard the Safari Spirit that day, and the location of the ignition point of the fire. At the time of the fire, the Safari Spirit was operated by InnerSea Discoveries, which managed a fleet of eight passenger vessels, each carrying from 22 to 88 passengers, with a total seasonal staff ashore and afloat ranging up to 250 personnel.

The Safari Spirit was one of a fleet of InnerSea Discoveries passenger vessels conducting recreational tours along the west coast of North American and Hawaii. (Photo by InnerSea Discoveries) A marine survey estimated the cost of rebuilding the vessel to be $4 million. A pre-fire fair market value survey in January 2011 estimated the value of the vessel at $1.5 million.

Fire on Board Passenger Vessel Safari Spirit

4 NTSB/MAB-13/12

CORRECTED COPY

Charred wreckage of the Safari Spirit. (Photo from Bowditch Marine, Inc.) Probable Cause The National Transportation Safety Board determines that the fire aboard the passenger vessel Safari Spirit ignited due to unknown causes and was accelerated by the flammable materials stored on the aft portion of the main deck. Vessel Particulars Vessel Safari Spirit Owner/operator Mukilteo Maritime Contractors LLC/ InnerSea Discoveries Type Inspected passenger vessel Port of registry Skagway, Alaska Flag United States Official number (US) 631818 Built 1981 Construction Aluminum Length overall 105 ft. (32 m) Breadth 25 ft. (7.6 m) Draft 9.7 ft. (2.96 m) Gross tonnage 231 Engines Twin GM 12V71 (approx. 10,000 operating hours each) Persons on board 2

Fire on Board Passenger Vessel Safari Spirit

5 NTSB/MAB-13/12

For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM016. Adopted: July 3, 2013, revised July 17, 2013

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07409 ｜ 2013_美国_MAB1314.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB/13/14

National Transportation Safety Board Marine Accident Brief Fire On Board and Sinking of Liftboat Mako

Accident no. DCA-12-LM-005 Accident type Fire and sinking Vessel Offshore supply vessel (liftboat) Mako Location Atlantic Ocean, Gulf of Guinea, 6 miles off the coast of Nigeria 04°21.164′ N, 005°47.053′ E Date January 16, 2012 Time 0503 local time (coordinated universal time –1 hour) Injuries None Property damage Vessel was a total loss; estimated value of $8,000,000 Environmental damage Unknown Weather Foggy, winds 1–2 knots north, air temperature 80° F, visibility ¾ mile Waterway characteristics The Gulf of Guinea is the northeastern-most part of the tropical Atlantic Ocean. There are a number of active oil fields in this area off the coast of Nigeria.

About 0503 on January 16, 2012, the US liftboat Mako caught fire while supporting oil drilling operations about 6 miles off the coast of Nigeria, Africa. No one on board was injured, but the Mako was a total loss in the accident.

Liftboat Mako jacked up during operations. (Photo by Hercules Liftboat Company)

Fire On Board and Sinking of Liftboat Mako

2 NTSB/MAB/13/14 The Mako was operating in the Funiwaw oil field, located off the coast of Bayelsa State, Nigeria. Beginning November 18, 2011, the Mako was positioned next to the Panama-flagged jack-up drilling rig KS Endeavor (“Endeavor”), and had been taking on drill cuttings from the Endeavor. Drill cuttings are small pieces of rock created when a well is drilled through rock to reach an oil or gas reservoir. The cuttings were pumped into containers on the liftboat. Once filled, the containers were lowered to offshore supply vessels and taken to shore for disposal.

Location of the accident in the Gulf of Guinea, off the coast of Nigeria. (Background by Google Earth) The crew on board the Mako included a licensed master and a licensed mate, both US citizens. The vessel carried 26 additional personnel including crew and offshore workers, all Nigerian citizens. Similar to other liftboats, the Mako had jacking legs designed to rest on the seafloor and raise the hull above the sea surface to create a stable work platform. The level of elevation above the surface of the water would depend on the sea state and the type of work being done. The Mako’s three 175-foot-long legs were arranged in a triangular pattern with two legs positioned at the forward outboard sides of the hull and a single leg positioned at the stern on the centerline of the hull. The length of the legs was fixed; that is, the legs did not have sections that slid or passed within one another to extend or contract the legs. In the Funiwaw oil field, the Mako was jacked up in about 25 feet of water and had a clearance of about 50 feet from the surface of the water. The liftboat was located about 150 feet from the Endeavor’s blow-out preventer (BOP, an inline mechanical safety device with a valve Accident Site Nigeria Gulf of Guinea

Fire On Board and Sinking of Liftboat Mako

3 NTSB/MAB/13/14 or series of valves designed to secure the flow of oil and gas in the event of an unintended high-pressure pipeline release from the well being drilled). About 0500 on January 16, 2012, as the master was getting ready to take over the watch from the mate, he heard a loud noise. He went to the bridge where he observed a spray of mud, oil, and gas coming from the Endeavor’s BOP. The mixture coated the Mako’s decks and superstructure. The master sounded the general alarm and ordered the mate to muster the crew and offshore workers at the liferaft muster station on the lower deck. The master said to abandon ship if the rig caught fire. All personnel mustered with their lifejackets. The master stayed on the bridge and began to jack down the Mako toward the surface of the water. The Mako was limited in how quickly it could get under way from a jacked-up position. The vessel was capable of jacking down at a maximum speed of 7 feet per minute. Then the legs would have to be raised from the seafloor, requiring additional time. As the Mako began to jack down, gas from the Endeavor’s BOP ignited. When the liftboat was about 10 feet above the water’s surface, flames melted a hydraulic hose for one of the forward jacking legs. The system lost hydraulic pressure and as a result the master was unable to lower the vessel further. He then gathered survival equipment, including the global maritime distress and safety system (GMDSS) survival craft radio, search and rescue transponder (SART), and the emergency position indicating radio beacon (EPIRB), and headed toward the muster station. The mate and crewmembers launched two liferafts on the Mako’s port side and one on the starboard side. When the fire started on board the Endeavor and quickly spread to the Mako, the mate gave the order to enter the water and all personnel did so successfully by lowering themselves using the escape rope. They did not attempt to fight the fire. Once in the water, the personnel tried to pull the rafts away from the burning rig and vessel, but were unsuccessful. The liferafts melted from the heat and became unusable. While in the water, the crew used the survival craft radio to call for help. About 0700, the security vessel Janis 1 recovered the master and 27 other personnel from the water (26 from the Mako and one from the Endeavor). One offshore worker from the Mako was recovered by another vessel.

Fire On Board and Sinking of Liftboat Mako

4 NTSB/MAB/13/14

Photo of the fire, taken on January 17, 2012. The charred remains of the Mako are visible in the foreground, to the right of the flames. Photo provided by the US Coast Guard. The Mako was consumed by the fire and eventually sank. The fire at the well continued to burn for about another month and a half, until March 2, 2012, when a portion of the well sealed itself. There were no fatalities or major injuries to personnel from the Mako; however, two workers from the Endeavor died. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board and sinking of the liftboat Mako was a blow-out of the well-head under the adjacent jack-up drilling rig KS Endeavor, which resulted in an uncontrollable gas fire that rapidly spread to the liftboat.

2012 Bing Maps

Fire On Board and Sinking of Liftboat Mako

5 NTSB/MAB/13/14 Vessel Particulars Vessel Mako

Owner/operator Hercules Liftboat Company, LLC Flag state United States IMO number 8765723 Type Offshore supply vessel (liftboat) Year built 2003 Home port New Orleans, LA Construction Steel Length overall 34.44 ft. (113 m) Breadth 21.34 ft. (70 m) Depth 2.74 ft. (9 m) Jacking legs 3 (two forward, one aft) Leg length 175 ft. (53.34 m) Gross tonnage; ITC 440 Propulsion type Diesel reduction Crew complement 28 For more details about this accident, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12LM005.

Adopted: July 16, 2013 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07410 ｜ 2013_美国_MAB2013.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-20/13 National Transportation Safety Board Marine Accident Brief Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel On August 26, 2019, about 1830 local time, the fishing vessel Ariel was transiting Sheep Bay, Prince William Sound, Alaska, when a fire broke out in the vessel’s engine room. The four crewmembers aboard the Ariel attempted to fight the fire, but they were unsuccessful and abandoned ship into the vessel’s skiff. The Ariel continued to burn and subsequently sank. The crew was rescued by Good Samaritan vessels and returned to port uninjured. About 500 gallons of diesel fuel was aboard the vessel when it sank. The Ariel, valued at an estimated $600,000, was a total loss.

Ariel moored before the accident. (Source: Compass Rose Marine Surveyor)

Accident type Fire/Explosion No. DCA19FM046 Vessel name Ariel Location Sheep Bay, Prince William Sound, 10 miles northwest of Cordova, Alaska 60°38.07’ N, 146°4.45’ W Date August 26, 2019 Time 1830 Alaska daylight time (coordinated universal time – 8 hours) Injuries None Property damage $600,000 est. Environmental damage About 500 gallons diesel oil on board at the time of the fire Weather Visibility 10 miles, clear, winds southwest at 5 knots, seas 1–2 feet, air temperature 60°F, water temperature 57°F Waterway information Sheep Bay is a small protected inlet in Prince William Sound with steep banks providing navigable water near the shoreline.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

2 NTSB/MAB-20/13

Location of the Ariel fire and sinking, as indicated by the red triangle. (Background source: Google Maps) Background The 50-foot-long Ariel was built of fiber-reinforced plastic in 1988 and rigged as a purse seiner.1 The vessel’s engine room had a single 550-horsepower Caterpillar main propulsion diesel engine mounted centerline and a single Isuzu diesel generator on the port side. A Halon 1301 fixed fire-extinguishing system was installed on the forward bulkhead. The Halon system was a self- contained unit with an automatic high-heat actuator—it had no manual activation—and a single discharge nozzle, both co-located with the Halon storage cylinder. The Ariel worked the Prince William Sound pink salmon fishery with a crew of four, including a captain, an engineer, and two deckhands. The purse seining season in the fishery began on June 3, 2019, with the bulk of the fish caught after July 1. The fishery was managed daily, opening and closing during daylight hours depending on assessments of fish stocks gathered from aerial observations by Alaska Department of Fish and Game officials. According to the captain, the Ariel anchored each night after the daily closing of the fishery and, as needed, the offloading of fish to a tender.

1 Purse seiners use a large wall of netting with floats on the top of the net and a lead line strung through rings at the bottom of the net. The net is deployed using a skiff and then circled around fish as they school or run. Once the fish are encircled, the lead line is drawn tight to close, or “purse,” the bottom of the net, preventing the catch from escaping downward. The net is then pulled alongside the fishing vessel, where the fish are loaded into holds.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

3 NTSB/MAB-20/13 Accident Events In the early evening on August 26, the Ariel had completed fishing and was transiting Sheep Bay at 5.5 knots (about 75% power) en route to a tender in the adjacent inlet. The captain was at the helm in the wheelhouse located above the vessel’s cabin. According to the captain, the main fish hold, located just aft of the engine room, was full of fish, and the aft hold, located behind the main hold, was empty. About 1830, the engineer was in the cabin when he smelled smoke. He opened the main hatch to the engine room to investigate and saw flames in the vicinity of the generator. He alerted the captain and the crew and grabbed a fire extinguisher to fight the fire.

General arrangement of the Ariel, with the area where the fire was first reported indicated by the red flame icon.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

4 NTSB/MAB-20/13 Just after the engineer informed him of the emergency, the captain noted that the generator was operating erratically, with the engine rpm fluctuating significantly. Consequently, he shut down the generator from the wheelhouse. He next attempted to slow the main propulsion engine by moving the throttle lever to the idle position. He stated that the engine did not slow, however, and the throttle lever returned to its previous ahead position. The captain subsequently shutdown the main engine from the wheelhouse and instructed one of the deckhands to start the motor on the Ariel’s skiff. His intention was to use the skiff to push the stricken fishing vessel toward shallower water. The captain then went below to assist with firefighting efforts. When he arrived in the cabin, the captain shut the main hatch to the engine room, and the crew attempted to fight the fire with portable chemical fire extinguishers through an engine room hatch in the galley area on the port side of the cabin, which was closest to the apparent source of the fire. Their efforts were unsuccessful, and the smoke drove them out of the cabin. The crew stated that before leaving the cabin, they closed the port hatch to the engine room. The captain returned to the wheelhouse and made a Mayday call over VHF radio before he was forced out of the wheelhouse by smoke. According to the engineer, the crew also discharged extinguishers into the stacks aft on the deckhouse and the ventilation inlets on either side of the exterior cabin. The crew determined that it would be unsafe to remain on board the Ariel, so the engineer went to the bow to drop the anchor, while the rest of the crew gathered their immersion suits and boarded the skiff. Once the engineer had set the anchor, he boarded the skiff, and the crew stood off the Ariel at a safe distance—about 100 feet by the estimation of one crewmember. A few minutes later, the crew heard a sound, which they believed was the automatic Halon system discharging. Shortly thereafter, the smoke seemed to lessen. The engineer then re-boarded the Ariel to close the exterior doors to the cabin. The louvers that covered the engine room ventilation inlets on either side of the deckhouse were fixed open, so, according to the engineer, he also stuffed rain gear and other materials into the louvers in an attempt to prevent Halon from escaping the engine room. Not long afterward, the smoke increased, and the crew saw visible flames, so the engineer reboarded the skiff, and the crew once again stood off at a distance of about 300 feet.

Ariel on fire at 1912, prior to sinking in Sheep Bay. (Source: US Coast Guard)

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

5 NTSB/MAB-20/13 Nearby fishing vessels that had heard the captain’s distress call began arriving at the location of the accident and picked up the crew in the skiff. The Ariel continued to burn for several hours and sank at 2335 in 275 feet of water. Additional Information Steering and propulsion could be controlled from three locations on the Ariel: the wheelhouse, a crow’s nest on the mast, and a station on the starboard side work deck. The steering system was hydraulic, using oil as an operating fluid, and included a pump driven off the forward end of the main propulsion engine, a reservoir tank on the forward engine room bulkhead mounted under the Halon system, and a head tank mounted in the crow’s nest. The propulsion engine speed control system was also hydraulic, with an operating fluid mixture of water and anti-freeze. The throttle levers at all stations were linked to the engine and transmission via the control system. The hydraulic lines were high-pressure, temperature-treated nylon. According to the manufacturer, when a throttle was moved at one control station, the levers at the other stations also moved in the same way. The system was pressurized by compressed air and included a small hydraulic fluid reservoir tank located in the engine room on the port side of the forward bulkhead. Another hydraulic system, which used oil as an operating fluid, powered the machinery used to handle fishing gear, such as the power blocks on the mast and a capstan on the main deck. The hydraulic pump was mechanically driven off the forward end of the main propulsion engine, and the oil reservoir tank was located on the port side forward of the generator. The last condition and valuation survey of the Ariel was conducted on March 28, 2018. They surveyor found that the “vessel appeared well maintained and fit for intended use.” According to the survey, the fuel lines on the Ariel were copper. The owner stated that the copper piping ran from the fuel tanks in the lazarette (the aftermost space on the vessel) to the engine room, and were connected to a valve manifold by reinforced rubber fuel hoses rated USCG Type A1.2 From the manifold, the fuel was routed via USCG-Type-A1-rated hoses to fuel filters and then to the main engine and generator. The fuel system was fitted with manually operated fuel oil shut-off valves at the tanks in the lazarette and at the fuel filters in the engine room. The owner and captain told investigators that the exhaust piping and the turbocharger on the main engine were fully lagged (insulated), and photos from the 2018 survey showed the lagging in place. A former owner of the Ariel stated that the lagging covers had been custom made for the vessel by a company based in Alaska. The owner of the Ariel was a member of Alaska Marine Safety Education Association (AMSEA) and provided investigators with the Commercial Fishing Vessel Emergency Instruction and Drill Manual produced by the association. The owner stated that emergency drills, including fire drills, were conducted monthly on the vessel using the AMSEA program. According to the captain, the last drill on the Ariel was conducted on August 6. Three of the four crewmembers on

2 USCG Type A1 is the highest standard of fuel hose used in boatbuilding (other standards are Types A2, B1, and B2). Per Title 33 Code of Federal Regulation Part 183.540, “USCG Type A1” hose must meet the following performance standards: 1) SAE Standard J1527DEC85, Class 1 and a fire test, or 2) Underwriters' Laboratories, Inc. (UL) Standard 1114.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

6 NTSB/MAB-20/13 board during the accident were present during the drill, and the fourth—a deckhand who joined the vessel late in the season—had previously worked on the Ariel and had conducted drills with the crew. Both the owner and the engineer held US Coast Guard Drill Instructor qualification cards. Analysis The Ariel was not salvaged, and thus investigators could not inspect the machinery or hull to determine an exact cause of the fire. However, observations by the crew during the accident provided some indication of the location and potential source of the fire. The engineer stated that when he first opened the engine room hatch to investigate smoke, he saw flames in the vicinity of the generator located on the port side aft in the engine room. The long delay in the heat-sensor activation of the Halon fixed fire-extinguishing system, located on the forward bulkhead of the space, further indicates that the fire started aft in the space. Thus, it is unlikely that the hydraulic systems for steering, throttle control, and deck machinery—whose main components were located forward in the space near the Halon system—were the source of the fire. (Investigators could not determine why the captain could not reduce the main propulsion engine speed prior to shutting the engine down, but based on the information above, it is unlikely that this was causal to the fire.) The fluctuating rpm of the diesel engine generator observed by the captain just after the fire was discovered was likely the result of fuel starvation, which suggests that the fuel line to the generator’s engine was breached. The fuel hoses that ran between the manifold, fuel filter, and generator met Coast Guard material specifications; however, over time a hose could have become worn from contact, its connections could have loosened through vibration, or it could have otherwise failed, allowing fuel to leak into the engine room. Leaking fuel or fuel vapor may have then come into contact with a hot surface, igniting the fire. The vessel was fitted with manually operated fuel oil shut-offs in the lazarette and engine room; there were no remote emergency shut-offs. The crew was not able to close the manual shut- off valves before abandoning the vessel. Although not causal to the initial fire, the remaining fuel in the tanks would have continued to feed the fire once the hoses melted. Based on crewmember accounts, the Halon fixed fire-extinguishing system on the Ariel activated and appeared to reduce the fire, but the fire rekindled and eventually consumed the vessel. To work effectively, fixed fire-extinguishing systems require a minimum concentration of firefighting agent to either halt the chemical reaction producing the fire, displace oxygen feeding the fire, or effect a combination of both. The fixed-open louvers on the inlets to the Ariel’s engine room ventilation ducts prevented the space from being sealed off, and thus the discharged Halon was allowed to escape, and new air was introduced to the fire. The engineer’s attempt to seal off the ventilation inlet louvers using available materials was commendable but likely too late to prevent the spread of the fire. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire aboard the fishing vessel Ariel was the ignition of fuel leaking from the generator fuel supply line in the engine room. Contributing to the severity of the fire and the eventual loss of the vessel were the fixed-open inlets for the engine room ventilation, which allowed fire-extinguishing agent to escape and air to enter the space.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

7 NTSB/MAB-20/13

Closing Ventilation During Fixed Fire-Extinguishing System Activation Fixed fire-extinguishing systems in engineering and other hazardous spaces require a minimum concentration of extinguishing agent to either halt the chemical reaction producing the fire, displace the oxygen feeding the fire, or effect a combination of both. To ensure the effectiveness of the system and prevent the reintroduction of oxygen to the space, ventilation inlets should be designed or modified to be closed remotely or covered.

Fire Aboard and Subsequent Sinking of Fishing Vessel Ariel

8 NTSB/MAB-20/13 Vessel Particulars Vessel Ariel Owner/operator Private citizen Port of registry Cordova, Alaska Flag United States Type Fishing vessel Year built 1988 Official number (US) 931891 IMO number N/A Classification society N/A Construction Fiber reinforced plastic Length 50 ft (15.2 m) Draft 5.5 ft (1.7 m) Beam/width 15.5 ft (4.7 m) Tonnage 31 GRT Engine power; manufacturer 1 x 550 hp (410.1 kW); Caterpillar 3406B diesel engine Persons on board 4 NTSB investigators worked closely with our counterparts from Coast Guard Marine Safety Unit Valdez, Alaska, throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA19FM046. Issued: March 25, 2020

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 United States Code, Section 1131(b)(1). This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, Section 1154(b).

FD07411 ｜ 2013_美国_PAB1301.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

CORRECTED COPY NTSB/PAB-13/01

National Transportation Safety Board Washington, D.C. 20594

Pipeline Accident Brief

Accident No.:

DCA09FP007 Accident Type: Rupture of Florida Gas Transmission Pipeline and Release of Natural Gas Location: Near Palm City, Florida Date: May 4, 2009 Time: 5:10 a.m. eastern daylight time Owner/Operator: Florida Gas Transmission Company Fatalities: 0 Injuries: 3 Damage/Clean-up Cost: $606,360 Material Released: Natural gas Quantity Released: 36 million standard cubic feet (estimated) Pipeline Failure Pressure: 854 psig

The Accident On Monday, May 4, 2009, about 5:10 a.m. eastern daylight time,1 Florida Gas Transmission Company’s (FGT)2 line 100, an 18-inch-diameter natural gas transmission pipeline, ruptured about 6 miles south of Palm City, Florida. The rupture occurred in a sparsely populated rural area of Martin County and displaced about 106 feet of buried pipe onto the right-of-way between Interstate 95 (I-95) and the Florida Turnpike (SR-91). An estimated 36 million cubic feet of natural gas was released during the accident without ignition. Two parallel FGT natural gas transmission pipelines in the same right-of-way were undamaged.3 Three minor injuries were attributed to the rupture: two people were injured escaping from a vehicle that lost control and ran off the turnpike, and one member of the Palm Beach County Sheriff’s department walked through a dense cloud and inhaled natural gas. The rupture occurred between two automatic shutoff valves (ASV),4 but only one valve shut in response to the pressure drop on the pipeline.

1 All times in this report are eastern daylight time unless otherwise noted. 2 From 2004 through 2006, FGT was owned by Citrus Corp. Cross Country Energy and El Paso Corporation indirectly owned 50 percent of Citrus Corp. In 2006, Southern Union Company purchased 50 percent interest in FGT from Cross Country Energy. 3 FGT operates a 24-inch (line 200) and a 30-inch pipeline (line 300) in the same right-of-way as line 100. 4 An automatic shutoff valve uses electric- or gas-powered actuators to operate the valve automatically based on pipeline sensor readings. The sensor sends a signal to close the valve based on a preset rate of pressure decay in the pipeline. An ASV does not require human interpretation of the pipeline operations, and it closes automatically based on the established criteria. E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

CORRECTED COPY 2 NTSB/PAB-13/01 Emergency responders rerouted traffic on both SR-91 and I-95 and evacuated a high school and a residential subdivision that were nearby. The FGT control center did not receive any Supervisory Control and Data Acquisition (SCADA)5 alarms or recognize the rupture from SCADA data. However, emergency response personnel began notifying the FGT control center at 5:49 a.m., after which the control center dispatched three field operators to the scene. By 7:30 a.m., the field operators had stopped the flow of natural gas. Local authorities reopened I-95 by 8:00 a.m. and SR-91 by 11:15 a.m. About 2 hours 20 minutes had elapsed from the time of the rupture to the complete isolation of the flow of gas. FGT operates more than 4,800 miles of Gulf Coast transmission lines from a control center in Houston, Texas. Lines start near Galveston Bay, Texas, and extend through Louisiana, Mississippi, and Alabama before turning south along the Florida peninsula. At the time of the accident, the FGT system consisted of 25 compressor stations with a mainline capacity of 2.25 billion cubic feet per day. The line 100 rupture occurred between compressor station 20 (upstream) and station 21 (downstream). (See figure 1.)

Figure 1. Route of Florida Gas Transmission’s three natural gas pipelines along Florida peninsula.

5 FGT used a computer-based SCADA system to remotely monitor and control the movement of gas through its pipelines. SCADA controllers at the SCADA center in Houston, Texas, monitored operating parameters such as flow rate, pressure, equipment status, and abnormal condition alarms.

CORRECTED COPY 3 NTSB/PAB-13/01 Accident Narrative A section of the ruptured 18-inch pipeline, about 106 feet long and weighing more than 5,000 pounds, was ejected out of the ground and landed near the crater in two pieces,6 leaving two open ends of the pipe exposed and discharging natural gas. Within minutes, one of two 18-inch ASVs closed, shutting off the gas flow to the upstream (north) end of the rupture and limiting the discharging gas to the south end. (See figure 2.) FGT operated two parallel, interconnected 24-inch and 30-inch natural gas transmission pipelines in the same right-of-way, but the rupture of the 18-inch line did not damage the other two lines. After the rupture, the increased flow of gas through the open pipe began to vent the stored gas volume in the interconnected pipelines and reduce the pressure.

Figure 2. Aerial photograph of ruptured 18-inch pipeline showing venting gas and dislodged pipe near crater. At the time of the accident, the 18-inch natural gas transmission line was operating at a pressure of 854 pounds per square inch, gauge (psig), or 98.6 percent of the maximum allowable operating pressure (MAOP).7 The rupture occurred in the final hour of the Sunday evening shift at the FGT Houston control center, before the Monday morning shift change. The releasing gas from the rupture resulted in pressure drops on all three of the interconnected pipelines; however, no SCADA alarms were generated. The pipeline controller did not recognize the line pressure and gas volume reductions as being unusual for that time of day.

6 The larger of the two pieces was about 104 feet long; the smaller piece was about 1.6 feet long. 7 Title 49 Code of Federal Regulations (CFR) 192.3 defines maximum allowable operating pressure as the maximum pressure at which a pipeline or segment of a pipeline may be operated. MAOP is established under 49 CFR 192.619.

CORRECTED COPY 4 NTSB/PAB-13/01 Emergency Response The initial call to the Florida Highway Patrol reporting the accident was made at 5:16 a.m., about 6 minutes after the rupture. The first responders to the accident included the Florida Highway Patrol and the Martin County Hazardous Materials Team, Fire Rescue Department, Police, and Sheriff’s Office. By 5:21 a.m., the Martin County Sheriff’s Office had received more than 31 calls reporting the incident. . At 5:33 a.m., Martin County Fire Rescue workers were on scene near the rupture, and by 5:49 a.m. Martin County Fire Rescue made the first notification to the FGT control center, erroneously reporting that a vehicle had struck an FGT pipeline. Within minutes of being notified, an on-call field operator assigned to the Fort Pierce compressor station (station 20) and another assigned to the West Palm Beach compressor station (station 21) were dispatched to the scene by the control center. Believing that the accident involved only an aboveground pipeline marker rather than the buried pipeline, the control center staff remained unaware that a pipeline had actually ruptured. By 5:59 a.m., the on-scene emergency responders had confirmed that a natural gas pipeline had ruptured. Emergency response personnel established a 1-mile perimeter around the site because of the risk of ignition from a vehicle idling near the rupture. About this time, the Martin County Hazardous Materials Team notified the FGT control center that the accident involved a ruptured pipeline near the I-95 Stuart/Jupiter exit. After receiving the second call, the FGT gas controllers reviewed SCADA data and identified drops in the pipeline pressures from station 20, drops in pressure at the Martin North Florida Power and Light gas meter, and a noticeable drop in the stored gas volume in the pipeline. At 6:05 a.m., another field operator was dispatched to the accident site. By 6:39 a.m., about 34 minutes after being dispatched, the first FGT field operator reported to the incident command near mile marker 129 and was able to see a white cloud and smell the gas. This field operator became the FGT incident commander. The control center did not know which of the three lines had ruptured until a field operator on scene saw that the upstream 18-inch ASV was closed. At 7:09 a.m., an FGT field operator closed the remaining downstream ASV, and by 7:30 a.m. no discernible gas was flowing from the ruptured pipe. Emergency responders gradually cleared the roads of debris and restored traffic to I-95 by 8:00 a.m. and to SR-91 by 11:15 a.m. Injuries and Evacuations About 6:40 a.m., the fire chief ordered the evacuation of South Fork High School and the Foxwood residential community, both less than a mile southwest of the rupture. The school remained closed for the day, and the fire chief staged additional units in Foxwood to respond to any fires that might break out if gas were to ignite. Emergency responders also closed I-95 and SR-91 in both directions to maintain about a 1-mile perimeter around the ruptured pipeline. Three injuries were directly attributed to the rupture and gas release. Two people sustained minor injuries while leaving their vehicle after the driver lost control and ran off the turnpike into the right-of-way. The third injury occurred when a member of the Palm Beach

CORRECTED COPY 5 NTSB/PAB-13/01 County Sheriff’s department walked through the dense natural gas cloud and inhaled natural gas while assisting with the response. Pipeline Information History The ruptured pipeline section8 consisted of four pipe segments buried to a depth of about 3 feet 9 inches.9 Two of the 18-inch-diameter ruptured pipe segments were part of the original 1959 installation with a spiral-wrapped, field-applied Polyken 900 general utility polyethylene tape as the primary means of corrosion protection. These two polyethylene-tape–coated pipe segments were manufactured to the American Petroleum Institute (API) Standard 5LX10 grade X5211 with a 0.25-inch nominal wall thickness and a direct current electric resistance welded (ERW) longitudinal weld seam. Samples from the pipe material were tested, and the results showed that the mechanical and chemical properties of these pipe segments met the requirements of the API standard. After the original installation of the pipe, a hydrostatic pressure test was performed to a pressure of 1,085 psig, and an MAOP of 975 psig was assigned to the pipeline. In the latter half of 1971, line 100 was hydrostatically pressure tested again, to 1,320 psig, to qualify portions of the pipeline for Class 3 operation. This resulted in an MAOP of 866 psig, which was in place at the time of the accident.12 The NTSB Materials Laboratory examination revealed that the two remaining segments of the ruptured section, downstream of girth weld 3, had been replaced with pipe that was newer than the original pipe segments. (See figure 3.) Each of the newer segments had an ERW longitudinal weld seam and was coated with fusion bonded epoxy. The newer segment farthest downstream had a thicker wall than the other three pipe segments of the ruptured section. The FGT integrity management group stated that the two newer segments13 were installed in late 2004 because of corrosion features identified during a magnetic flux leakage (MFL) in-line inspection that same year. FGT could not provide records of the replacement project that identified why the work was performed or whether an analysis of the defects was conducted on

8 Herein, section applies to multiple segments of pipeline; segment refers to a single joint of pipe between an upstream and a downstream girth (circumferential) weld. 9 Pipeline burial depth is measured from the ground surface to the top of the pipe. 10 The API develops industry-based consensus standards that support oil and gas production and distribution. API 5LX is a specification for line pipe. 11 Grade X52 signifies that the pipe has a specified minimum yield strength (SMYS) of 52,000 psi. Yield strength is a measure of the pipe’s material strength and indicates the stress level at which the material will exhibit permanent deformation. Although yield strength is expressed in psi, this value is not equivalent to a pipe’s internal pressure. 12 Title 49 CFR 192.611 defines the requirements for a change in class location. Class 3 MAOP was 60 percent of the pressure at the SMYS. The SMYS pressure was 1,444 psig for the ruptured pipe. 13 According to FGT, three 18-inch-diameter segments were installed on line 100 in December 2004: 18.3 feet of 0.25-inch wall thickness API 5L grade X60 ERW, 41.7 feet of 0.375-inch wall thickness API 5L grade X52 seamless, and 39.6 feet of 0.375-inch wall thickness API 5L grade X65 ERW.

CORRECTED COPY 6 NTSB/PAB-13/01 the replaced pipe segments. No other maintenance or excavation activities were identified near the ruptured segment. In addition to the tape coating, line 100 had a cathodic protection system.14

Figure 3. Side view of crater and four pipe segments of ruptured section. Investigators examined SCADA pressure data from the upstream compressor station for the preceding year to identify the maximum operating pressure and operating ranges. The highest recorded pressure during this period was 865.4 psig, and the average operating pressure was about 850 psig. The largest daily low to high pressure range was 214 psig, with an average range of 36.7 psig. Natural gas operators are required by 49 CFR Part 191 to report incidents involving leaks on transmission pipelines to the Pipeline and Hazardous Materials Safety Administration (PHMSA). Two FGT incident reports15 identified failures caused by stress corrosion cracking (SCC)16 on polyethylene-tape–coated pipelines in Florida and Alabama that were installed about 1959.

14 Cathodic protection is a corrosion mitigation method used by the pipeline industry to protect underground steel structures. The system uses direct current power supplies at selected locations along the pipeline to supply protective electrical current. The protective current is supplied to the pipeline through a ground bed that typically contains a string of suitable anodes, with soil as an electrolyte. A wire connected to the pipeline provides the return path for the current to complete the circuit. 15 PHMSA report numbers 19850184 (November 19, 1984) and 19850185 (February 25, 1985). 16 Stress corrosion cracking is a form of environmentally assisted cracking produced under the combined action of corrosion and tensile stress typically manifesting as clusters of small cracks in the external body of the pipe.

CORRECTED COPY 7 NTSB/PAB-13/01 Pipeline Configuration Line 100 was one of three parallel, interconnected, or looped, pipelines operating along a 56.8-mile right-of-way. It transported natural gas north to south between compressor stations 20 and 21. (See figure 4.) The ruptured section was about 27.7 miles downstream of station 20. Branch connections from all three transmission lines delivered gas to many commercial and municipal customers between stations, including a Florida Power and Light power plant (Martin North). According to statements made by the pipeline controllers, it was normal to see a drop in pipeline pressure in the mornings and evenings when energy demand peaked. The 30-inch pipeline primarily operated as a loop, supplementing gas to the 18-inch and 24-inch transmission lines at the Jupiter regulating station through 12-inch-diameter cross-connections. Dual pressure-reducing regulators protected the lower MAOP on the 18-inch line from the higher MAOP on the 30-inch line.17

Figure 4. Simplified schematic of 18-inch, 24-inch, and 30-inch interconnected transmission lines between compressor stations 20 and 21. ASV Line Break Actuators The rupture occurred between ASV 20-1 and ASV 20-2 on the 18-inch main line. ASV 20-1 was about 8 miles upstream of the rupture site, and ASV 20-2 was about 12 miles downstream. ASV 20-2 was less than 3 miles from the 12-inch cross-connect joining the 30-inch and 18-inch pipelines. Both the 18-inch main line ASV and the 12-inch cross-connect ASV included line break actuators that automatically close the valves if a rupture or large leak occurs.

17 The 18-inch pipeline was rated for a MAOP of 866 psig, and the 24- and 30-inch pipelines were both rated at a MAOP of 975 psig.

CORRECTED COPY 8 NTSB/PAB-13/01 The line break actuators are designed to close the valve when the rate of pressure drop in the pipeline exceeds a predefined set point.18 FGT stated that all of the line break actuators were identical in operation, including set points. The line break actuator on ASV 20-2 was set to trip at a pressure drop of 15.5 psig against an operating line pressure of 800 psig. After the rupture, the upstream flow was stopped when the line break actuator at ASV 20-1 tripped and closed the valve about 2 minutes after the rupture, whereas the line break actuator downstream of the rupture at ASV 20-2 did not trip. ASV 20-2 was closed by hand by an FGT crew about 2 hours after the rupture. After the accident, FGT tested the line break actuator at ASV 20-2, and it tripped as intended at its design set point. The FGT operations group performed yearly inspections and testing of the line break actuators to verify they operated properly. The manufacturer’s service manual defines the relationship between rate of pressure drop and line pressure. If the rate of pressure drop is not steep enough, then the line break actuator may not trip. The line break actuator on ASV 20-1 did not trip when the line ruptured, most likely because the rate of pressure drop at the line break actuator was below the set point of the device. The limitations and design considerations for the use of line break actuators, including when they are installed in looped systems, are documented in a 1995 Southwest Research Institute report, Remote and Automatic Main Line Valve Technology Assessment:19 Both field experience and simulation results show that rate of pressure drop measurements in looped lines are not as reliable for line break detection as in single line systems. Because flow from adjacent loops feed the ruptured line through open crossovers, pressure in the ruptured line does not fall as fast as it would if it were in a single line or if crossovers were closed. SCADA System When the pipeline ruptured, the SCADA pressure readings at the upstream compressor station showed a 24.3 psig drop20 on the l8-inch line followed by steadily decreasing pressures in both the 30-inch and the 24-inch transmission lines.21 The SCADA system reported the pressures at each compressor station and the stored volume of gas in the pipeline, but the system did not report intermediate pressure or flow readings22 for the main line. None of the main line valves or cross-connect regulators included position feedback to SCADA. After the rupture, the controllers

18 The line break actuator used pneumatic logic to compare the pressure in the pipeline to the pressure in a reserve cylinder. When the difference in pressure between the reserve cylinder and the pipeline meets a preset value, the actuator (gas over hydraulics) closes the mainline valve. Once tripped, the line break actuator has to be reset manually. 19 C. R. Sparks et al., Remote and Automatic Main Line Valve Technology Assessment, Gas Research Institute Report No. GRI-95/0101 (Project No. 04-6609 for Gas Research Institute), (San Antonio: Southwest Research Institute, 1995). 20 SCADA pressure readings from compressor station 20 showed a pressure drop between 5:10 a.m. and 5:12 a.m. from 853.8 psig to 829.5 psig. 21 SCADA pressure readings at compressor station 20 showed a nearly identical pressure drop on the 24-inch and 30-inch pipelines from 899.7 psig to 813.8 psig between 5:17 a.m. and 7:07 a.m. 22 Some branch connections to customer sites included pressure and flow readings that were viewable over SCADA and could be used by the control center to examine intermediate conditions.

CORRECTED COPY 9 NTSB/PAB-13/01 did not know that ASV 20-1 had closed or that the cross-connect pressure regulators had fully opened. Line 100 normally operated with frequent flow and pressure changes based on the demand for gas, and SCADA alarms were set to warn controllers about abnormal conditions. However, no SCADA alarms were triggered throughout this accident. The Monday morning shift controller stated that because SCADA showed no alarms, he did not examine the pressure drop or historical pressure trends until after the second call from emergency responders. The controller further stated that at the time of the accident, the drop in pressures on the three lines appeared to be consistent with peak demand and that, without an alarm, the pressure drop alone was not sufficient to suggest a leak or line rupture. FGT had incorporated both low- and high- pressure alarm settings and rate-of-change alarms set to detect abnormal operations that resulted from 20-psig pressure swings. Although none of the three pipeline pressures reached the low alarm threshold, the pressure change on the 18-inch line after the rupture was above the 20-psig threshold of the rate-of-change alarm. A review of the SCADA rate-of-change alarm revealed that it did not trigger because of the upstream ASV closure and the SCADA scan rate. The rate-of-change alarm was programmed to alert the controller when a 20-psig difference from the previous recorded pressure was present over two scans of the pressure sensor (about 8 minutes at this location).23 Pressure trend data from the accident indicate that the initial 24-psig drop at the upstream compressor station did not continue for two full scans of the SCADA system. When ASV 20-1 closed, the upstream pressure in the pipeline stabilized, resulting in a pressure difference less than 20 psig within the two scans, so the rate-of-change alarm did not activate. Examination of the Accident Pipe About 106 feet of pipe weighing about 5,000 pounds was ejected from the ground in two pieces. The larger of the two pieces measured about 104 feet long and was found opened up and folded over onto itself. (See figure 5.) The smaller piece measured 1.6 feet long and came to rest near the larger piece.

23 FGT stated that the scan rate or time for SCADA to receive updated data from the instrumentation was about 4 minutes on this portion of the system.

CORRECTED COPY 10 NTSB/PAB-13/01

Figure 5. One hundred four-foot-long section of 18-inch buried pipe that was dislodged from the ground. Sample lengths of pipe were taken from each of the four segments of the ruptured section, including portions of the intact ends (upstream and downstream), and sent to the NTSB Materials Laboratory for testing and analysis. An examination of the fracture face showed that the rupture originated between girth welds 1 and 2 and simultaneously traveled upstream and downstream along the longitudinal seam welds through four girth welds. The fracture origin was about 30.5 feet downstream of girth weld 1 and was oriented in the 4 o’clock position24 coinciding with the longitudinal seam weld. (See figure 3.) Tape Coating, Corrosion, and Cracking Examination of the Polyken 900 (polyethylene) tape revealed deterioration of the adhesive bond with the pipe surface, with preexisting wrinkles and air pockets or bubbles along the length of the ruptured section. Beneath the tape wrap, general corrosion and corrosion pitting were observed on the exterior surface of the pipe. Corrosion pitting damage was observed near the fracture and at regular 12-inch intervals where the overlapped spiral coating had disbonded from the pipe. The general and localized pitting corrosion indicated that the cathodic protection was ineffective in mitigating corrosion damage. Pitting corrosion, as deep as 0.075 inches (30 percent of the nominal wall thickness), was observed on or near longitudinal seam weld. The depth of the corrosion, measured at several locations near the origin, resulted in a remaining wall thickness that was less than the specified minimum. No internal corrosion was observed on the ruptured pipe section. Magnetic particle inspections25 conducted on the outer surface of the pipe along and adjacent to the fracture revealed several colonies of longitudinal cracks. (See figure 6.) These colonies of cracks were identified on both sides and close to the longitudinal seam weld.

24 Orientation is given as the clockwise position when looking down the pipe in the direction of flow (north to south). The 12 o’clock position represents the top of the pipe. 25 Magnetic particle inspection is a nondestructive test method for detecting the existence and extent of linear indications (such as cracks) open to the surface of ferromagnetic materials.

CORRECTED COPY 11 NTSB/PAB-13/01 Additional colonies of cracks were found on the segment of pipe upstream from the rupture origin.

Figure 6. Longitudinal cracks and corrosion pits observed below longitudinal weld seam and upstream of rupture origin. Further examination of the cracks revealed that they initiated from the bottom of corrosion pits on the external pipe surface. (See figure 7.) The initial stages of crack advancement into the pipe wall showed characteristics consistent with environmentally assisted mechanisms such as near-neutral pH stress corrosion cracking (NNpHSCC)26 or corrosion fatigue.27 Final stages of crack propagation in the pipe wall exhibited little secondary branching and was most consistent with NNpHSCC. NNpHSCC and corrosion fatigue are both forms of environmentally assisted cracking that share many similar metallurgical characteristics. According to the Canadian Energy Pipeline Association’s Stress Corrosion Cracking, Recommended Practices, SCC occurs in pipelines with mechanically failed coatings in the absence of adequate cathodic protection.28 The same publication indicated that pipe wrapped with polyethylene tape has the greatest susceptibility to SCC compared to all other coatings. The problem created by disbonded polyethylene coating and cathodic protection shielding is well known in the pipeline industry.29

26 Near-neutral pH SCC is a specific form of environmentally assisted cracking that propagates through the metal grain boundaries with little secondary branching. It was first noted on the polyethylene-tape–coated pipeline in the TransCanada Pipelines system in the 1980s. 27 Corrosion fatigue is a form of environmentally assisted cracking in materials under the combined actions of cyclic loading and a corrosive environment. 28 Stress Corrosion Cracking, Recommended Practices, 2nd ed., (Calgary, Alberta: Canadian Energy Pipeline Association, 2007). 29 Disbondment of the tape coating from the outer pipe wall can result in moisture ingress between the tape and the steel, promoting corrosion. In this instance, the polyethylene tape no longer separates the pipe wall from a corrosive environment and the high electrical resistance of the tape shields the surface from receiving the adequate protective current of the cathodic protection system.

CORRECTED COPY 12 NTSB/PAB-13/01

Figure 7. (Left) Cross section of colony of six longitudinal cracks (shown in figure 6) identified by arrows. (Right) magnified view of single crack (about 0.03 inches deep) advancing from corrosion pit. The Fracture Origin Fracture features on the face of the rupture identified the origin area, which measured about 6 inches long and was on the longitudinal weld seam. The longitudinal weld seam measured 0.255 inches thick in this region. The fracture face along the origin coincided with a dark colored region of corroded steel that extended from the outer surface of the pipe to a maximum depth of about 75 percent of the longitudinal seam weld thickness. (See figure 8.) No crack arrest features were observed on the fracture face. Two corrosion pits, about 1 inch apart, were on the outer surface in the corroded region of the fracture origin. Both corrosion pits measured about 0.2 inches in diameter and extended 0.04 inches into the pipe wall. Closer examination of the fracture surface near the two corrosion pits revealed radial marks emanating from the surface of the corroded region toward the inner wall. The corrosion pit at the deepest portion of the fracture origin included a subsurface crack that extended from the base of the pit. The fracture emanated from corrosion pits on the outer pipe wall and propagated toward the inner wall to a depth of 75 percent of the weld seam thickness before the remaining pipe wall failed from overstress. The NTSB Materials Laboratory determined that the fracture most likely resulted from external environmentally assisted cracks along the longitudinal seam weld. The radial markings on the fracture face show that these cracks emanated from corrosion pits. The darker corroded region suggests that the crack propagation occurred over a long period before reaching a size that resulted in the rupture.

CORRECTED COPY 13 NTSB/PAB-13/01

Figure 8. Scanning electron microscope photograph of a portion of the fracture origin showing corrosion pit at outer wall and subsurface crack. Integrity Management In January 2004, PHMSA issued the gas integrity management rule that established how pipeline operators should identify, prioritize, assess, evaluate, repair, and validate the integrity of gas transmission pipelines using multiple assessment methods. This integrity management approach was directed at protecting high consequence areas (HCA) from catastrophic effects of ruptured natural gas lines. The integrity management rule required that a pipeline operator complete a baseline assessment of 50 percent of HCA pipeline mileage by December 17, 2007, and of 100 percent by December 17, 2012. As part of the integrity management program, an operator must identify and evaluate all potential threats to HCA segments, collect and integrate relevant data from the entire pipeline, and conduct a risk assessment in accordance with ASME B31.8S.30 Class Location To determine which pipeline segments were covered under the integrity management rule, FGT used method 2, defined by 49 CFR 192.903,31 to calculate a potential impact radius

30 ASME B31.8S-2004, “Managing System Integrity of Gas Pipelines;” ASME Code for Pressure Piping, B31 supplement to ASME B31.8. 31 “The area within a potential impact circle containing (i) 20 or more buildings intended for human occupancy, unless the exception in paragraph (4) applies; or (ii) an identified site.”

CORRECTED COPY 14 NTSB/PAB-13/01 and identify HCA sites within that radius. FGT reported more than 600 miles of HCA pipeline segments and 1,138 HCA locations covered under the integrity management program. The ruptured section was defined by the integrity management group as being in a Class 1 location with no HCA identified sites.32 Therefore, FGT did not include the pipeline section under the integrity management program. However, because HCA segments were located upstream and downstream of the rupture location, the entire 56.8 miles between compressor stations was inspected with in-line tools, including the pipe segments that ruptured, as part of the integrity management baseline assessment. After the accident, a review of the area was conducted through PHMSA to examine whether a neighboring high school qualified as an HCA “identified site.” The findings from the review concluded that the rupture location should have been designated as Class 3 and should have included an HCA identified site because the potential impact radius (366 feet) intersected three semi-open structures at the nearby high school.33 (See figure 9.)

Figure 9. Rupture location shown relative to nearby high school that was determined to fall within 366-foot potential impact radius.

32 The hydrostatic testing conducted in 1971 qualified line 100 for Class 3 operation; however, at the time of the accident, the ruptured section was operated as Class 1 by FGT. 33 FGT did not reduce the mainline valve spacing from Class 1 to Class 3 to meet the requirements under 49 CFR 192.179, citing a PHMSA final ruling in the matter of Viking Gas Transmission (1998; CPF 32102). Because the class change did not require pipe replacement, no mainline valves were required.

CORRECTED COPY 15 NTSB/PAB-13/01 Integrity Assessments The FGT risk assessment program in place in 200434 used a total risk methodology addressing the nine threat categories described in ASME B31.8S and classified threats as either time dependent, stable, or time independent. Time-dependent threats include external corrosion and SCC. The total risk was defined as the product of the likelihood of an event multiplied by the consequence of that event. The likelihood of failure was derived using appendix A of ASME B31.8S and an internally developed consequence algorithm. The program used a prescriptive method combined with subject matter expert input to arrive at the total risk value. The FGT risk assessment procedure stated that the threat of SCC is managed by external surface coating systems, balanced cathodic protection, minimizing cyclic loading, and operating below 60 percent specified minimum yield strength (SMYS) (if possible). The procedure noted that in-line inspection tool effectiveness35 for detecting SCC had not been adequately demonstrated for gas lines, but the procedure outlined other methods that could be used to assess susceptibility to SCC, including soil characterization, magnetic particle inspection, pressure testing, and leak and rupture history. The FGT 2004 risk assessment spreadsheet showed that the pipeline segments upstream and downstream of the rupture location had very low risk scores for both the external corrosion and the SCC categories.36 According to the FGT corrosion engineer, polyethylene-tape–coated pipe has the highest risk weighting for SCC, but pipeline segments along the Florida peninsula had no prior history of SCC-related failures. When SCC was identified as a risk in the relative risk matrix, the FGT 2004 integrity assessment procedures discussed the use of both direct assessment and hydrostatic spike pressure testing.37 FGT stated that hydrostatic spike testing was the approach used for SCC and that direct assessment was not part of the integrity program. Appendix A of the 2004 FGT integrity assessment procedure states that the use of spike testing is the method of choice when confirmed “significant” SCC38 is present and a proven EMAT tool39 is not commercially available. Without a direct assessment program, the FGT

34 FGT risk and integrity procedures were Cross Country Energy procedures from 2004 until 2006 when the company was sold to Southern Union Gas (Panhandle Eastern). 35 The FGT integrity assessment procedure lists the electromagnetic acoustic transducer (EMAT) and the circumferential magnetic flux leakage (MFL) in-line inspection tools as being capable of SCC detection, but each has limitations on detection capabilities. FGT had not run an EMAT or circumferential MFL tool through line 100 before the rupture. 36 External corrosion relative risk assessment scores were 0.03 for upstream HCA segments and 0.05 for downstream HCA segments. SCC relative risk assessment scores were 0.001 for upstream HCA segments and 0.003 for downstream HCA segments. 37 The FGT procedures define the spike test as a 30- to 60-minute pressure test to 100 to 110 percent of SMYS followed by a reduction to 90 percent of SMYS pressure for the remainder of the test. 38 Defined by FGT as deeper than 10 percent of the wall thickness and as long or longer than the critical crack length of a crack 50 percent through the pipe wall at a stress level of 110 percent of SMYS as defined by the Canadian Energy Pipeline Association. 39 The EMAT tool is designed to detect crack defects using electromagnetic acoustical transducers. These dry coupled sensors do not require a liquid couplant like traditional ultrasonic crack detection tools, making the EMAT tool suitable for gas pipeline inspections.

CORRECTED COPY 16 NTSB/PAB-13/01 identification of SCC as a threat relied primarily on historical failures or findings from opportunistic digs. According to the FGT director of integrity management, the ruptured section had not been identified as susceptible to SCC and therefore was never spike tested. Line 100 In-line Inspections In-line inspections were performed on line 100 in 2004 using both a caliper tool to locate dents and a high-resolution second-generation axial MFL tool to locate metal loss caused by corrosion. Although axial MFL in-line inspection tools are well suited for detecting metal loss features in pipelines, they are incapable of accurately detecting longitudinally oriented defects, including colonies of SCC. The findings from the 2004 axial MFL in-line inspection of line 100 revealed that most of the surface indications were adjacent to the longitudinal seam weld. The inspection identified no corrosion anomalies at the location of the rupture origin. The 2004 MFL final report recorded maximum corrosion depths of between 0.04 and 0.1 inches at various locations along the ruptured section; the average peak depth was about 0.051 inches (20 percent of the nominal wall thickness). None of the reported corrosion anomalies met the immediate criteria for repair. Based on the findings of the 2004 in-line inspection, FGT performed 12 excavations, all of which were on pipeline segments between compressor stations 20 and 21. None of these excavations exposed the ruptured segment. FGT also replaced two segments of pipe downstream from the failure origin and girth weld 3 (see figure 3). FGT could not provide supporting documentation from the 2004 in-line inspection that led to the replacement of the two pipe segments. Postaccident Actions PHMSA After the accident in Palm City, PHMSA issued a corrective action order (CAO) to FGT on May 7, 2009; PHMSA later amended the CAO on May 22, 2009. As part of the CAO, FGT was not allowed to operate line 100 until a written plan to verify the integrity of the pipeline segments was approved by the PHMSA regional director. Pipe segments from compressor station 20 through Cutler, Florida, were subject to the verification, which required hydrostatic spike testing of all low-frequency ERW pipe, the use of the appropriate in-line tools suitable for finding defects such as the one responsible for the rupture, an evaluation of the pipeline for areas of damaged or disbonded coating, and a survey of the effectiveness of the cathodic protection system. When permission to restart the line was granted by the PHMSA director of the Southern Region on June 2, 2009, the portion of line 100 from compressor station 20 to Cutler, Florida, was subject to a 20 percent reduction in operating pressure, not to exceed 682 psig. FGT submitted a return–to-service plan to PHMSA on May 27, 2009 and FGT had restarted line 100 by June 3, 2009. Florida Gas Transmission After the accident, FGT reviewed all locations on the pipeline system that had a cross- connect arrangement similar to that of the accident location. Six looped configurations similar to the accident site were identified for instrumentation upgrades. FGT installed a pressure

CORRECTED COPY 17 NTSB/PAB-13/01 transmitter downstream of the regulators at the Jupiter regulator station and pressure transmitters on each of the parallel lines. Position sensors were also installed on both regulators, allowing the control center to monitor the regulating valve states, and a proximity sensor was installed on the cross-connect valve. Each of these sensors was tied into the SCADA system. Additional functionality was added to the SCADA system so that the cross-connect valve between the 30-inch and the 18-inch pipelines would close automatically if a rapid change in the position of the regulator valve occurred. This added functionality also permits the control center to close the cross-connect valve remotely. A proximity switch on the cross-connect valve now activates to alert the control center when the line break actuator trips and the valve closes. FGT has changed the SCADA rate-of-change alarm methodology. SCADA now alarms for a rate-of-change equivalent to a pressure drop of more than 32 psig over a 120-second interval. FGT also conducted an instrument gas leak survey between compressor stations 20 and 21 and increased leak inspection land patrols of the transmission line downstream of the accident site to the end of the line. These patrols are in addition to aerial patrols. In response to the PHMSA corrective action order, FGT has conducted cathodic protection surveys on line 100 from compressor station 20 to the end of the line, inspected the line for corrosion using a magnetic flux leakage tool and for SCC using circumferential MFL, and conducted hydrostatic pressure testing of the 56.8-mile stretch between compressor stations 20 and 21. According to FGT, the hydrostatic pressure testing resulted in four failures on the 18-inch line: (1) a failure caused by corrosion in an ERW longitudinal weld seam, (2) a seam failure related to SCC, (3) a failure caused by corrosion, and (4) a failure caused by mechanical damage. FGT has performed a subsequent hydrostatic spike test on the segments from compressor station 20 to ASV 20-2. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was environmentally assisted cracking under a disbonded polyethylene coating that remained undetected by the integrity management program. Contributing to the accident was Florida Gas Transmission Company’s failure to include the pipe section that ruptured in the integrity management program. Contributing to the prolonged gas release was the pipeline controller’s inability to detect the rupture because of SCADA system limitations and the configuration of the pipeline.

Adopted: August 13, 2013

FD07412 ｜ 2013_美国_PAB1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-13/02

National Transportation Safety Board Washington, DC 20594

Pipeline Accident Brief

Accident No.: DCA-10-FP-004 Type of System: Natural gas transmission pipeline Accident Type: Rupture and fire Location: Cleburne, Texas Date: June 7, 2010 Time: 2:40 p.m. central daylight time1 Owner/Operator: Enterprise Products Operating, LLC Fatalities/Injuries: 1 fatality, 6 injuries Damage/Clean-up Cost: $1,029,000 Material Released: Natural gas Quantity Released: 172 million cubic feet Pipeline Pressure: 950 pounds per square inch, gauge Maximum Allowable Operating Pressure:

1,051 pounds per square inch, gauge Component Affected: 36-inch steel transmission pipeline

The Accident On June 7, 2010, at 2:40 p.m., a truck-mounted power auger (auger truck) operated by C&H Power Line Construction (C&H) struck and punctured a 36-inch-diameter natural gas transmission pipeline operated by Enterprise Products Operating, LLC2 (Enterprise). C&H, a contractor working for Brazos Electric (Brazos), was using the auger truck to dig holes for the installation of new electric service utility poles. The accident occurred about 45 miles southwest of Fort Worth, Texas, near the town of Cleburne. The natural gas ignited and killed the auger operator and burned six workers, who were transported to a nearby hospital for treatment. The pipeline had a maximum allowable operating pressure (MAOP)3 of 1,051 pounds per square inch, gauge (psig) and was operating at 950 psig at the time of the accident. Total property damage and clean-up costs were estimated to be $1,029,000. Accident Narrative The C&H auger operator was preparing to bore a hole for an electric utility pole to be installed near a pipeline right-of-way. Temporary pipeline markers identified the location of what

1 All times in this brief are central daylight time. 2 Enterprise Products Operating, LLC is a subsidiary of Enterprise Products Partners, LP. 3 The MAOP is the highest pressure at which a pipeline may be operated under federal regulations. E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

NTSB/PAB-13/02 2 the C&H and Brazos crews believed to be the only underground pipeline, a 36-inch-diameter, high-pressure, natural gas transmission pipeline operated by Energy Transfer (ET). Before digging the hole, a Brazos worker moved the dig location marker to increase the distance between the pole location and the marked underground pipeline to ensure that the power auger would not come close to the pipeline. Unknown to the workers, the new dig marker location was placed directly above a second, unmarked underground natural gas transmission pipeline owned by Enterprise. After the C&H auger operator bored to a depth of about 4 feet, the auger punctured the Enterprise pipeline. The eruption of high-pressure gas threw the 60-ton auger truck more than 100 feet and violently ignited. (See figure 1.) The C&H auger truck operator was killed. Six other workers sustained non-life threatening burns from the intense fire. The ET natural gas transmission pipeline was not damaged. A pipeline controller at Devon Energy Corporation (Devon), a natural gas supplier to Enterprise, made the first call to the Enterprise gas control center after the pipeline ruptured. The Devon controller noticed a rapid decrease in the pipeline system operating pressure and called the Enterprise gas control center to inquire if a pressure drop had occurred on its North Texas Johnson County 36-inch-diameter pipeline, which was connected to the Devon system.

Figure 1. Natural gas burning from 36-inch-diameter Enterprise pipeline At 2:49 p.m., Enterprise gas control center personnel determined that the supervisory control and data acquisition (SCADA) system had automatically closed a main line block valve (MLBV 15) about 2 miles upstream of the rupture. The Enterprise head of gas control was notified that field personnel working near the pipeline saw a large fire in the pipeline right-of-way. He then directed field technicians to close MLBV 14, 7.8 miles downstream from

NTSB/PAB-13/02 3 the rupture, to stop the gas flow. The Enterprise SCADA records showed the valve was closed at 2:55 p.m. Manual isolation block valves on several branch lines were closed to isolate the rupture and allow the fire to self-extinguish. Emergency Response The Cleburne Fire Department (CFD) was dispatched to the scene at 2:57 p.m. While en route, the CFD confirmed that six workers with burn injuries had been transported to a nearby hospital in private vehicles. The CFD chief arrived at the scene at 3:09 p.m. and established the incident command. Volunteer fire departments from Johnson, Somervell, and Hood counties assisted the CFD with extinguishing the brush fires, search and rescue operations, and medical support. The incident commander declared the area safe to enter at 5:45 p.m. After arriving at the scene, the incident commander accounted for all of the workers except for the auger operator. Emergency responders recovered his body 2 hours later, after the gas flow was stopped and the fire was extinguished. Texas 811 Underground Utility Marking Texas Excavation Safety System, Inc. (Texas 811) is a private nonprofit corporation that operates a notification center in accordance with Texas Utilities Code Title 5, Chapter 251. Excavators, that is, requestors,4 are required to call Texas 811 at least 48 hours in advance of any planned excavation to provide information about the work, the location, and “all necessary instructions to make sure the right area gets marked” before proceeding with any mechanized digging. Texas 811 issues a locate ticket to all documented utility companies having underground equipment in the surrounding area. Each utility is required to (1) survey and mark the underground utilities within 2 working days after receiving the locate ticket and (2) notify Texas 811 when the marking work is complete. Texas 811 notifies the requestor that the underground utilities have been located and marked. Mechanized digging tools are prohibited within the marked areas until the underground utilities have been exposed using hand digging techniques. A new locate request must be submitted if the excavation work is not completed within 14 days from the date the utilities were temporarily marked. The Texas 811 system uses the same procedure to locate and mark underground utilities as part of construction planning. The power line upgrade work involved two locate ticket requests: one in November 2009 for the power line route planning work and another in June 2010 for the power line installation. November 2009 Power Line Route Planning Brazos contracted with Power Engineers to install a 138-kilovolt transmission power line that crossed the right-of-way for the Enterprise and the ET transmission pipelines. (See figure 2.) The right-of-way contained two 36-inch-diameter high-pressure transmission pipelines running

4 A requestor is the person or company that contacts Texas 811 before excavation work to request that locations of underground utilities be marked.

NTSB/PAB-13/02 4 parallel about 30 feet apart. Power Engineers issued a subcontract to Surveying and Mapping, Inc. (SAM) to develop the detailed route map for the new power line. On November 3, 2009, the SAM foreman submitted a locate request to Texas 811 to identify all underground utilities along the power line route. Texas 811 issued locate tickets to the Enterprise and the ET underground utility locators to survey the area and mark the locations of the underground pipelines. Following the driving directions on the tickets, the locator would have passed the electric substation access road, where the crews were installing the power lines, and continued about one-half mile to a location near the right-of-way. The work location was a few hundred feet from the electric substation, which was at the end of the one-quarter mile long access road.

Figure 2. Map showing electric power line route, accident location, pipeline right-of-way, and endpoint of the driving directions on the locate ticket The ET line locater went to the substation, located and marked the underground ET pipeline, and notified Texas 811 that the locate work was complete. The SAM foreman was notified that the ET pipeline had been marked. Unknown to the foreman, the Enterprise line locater had not yet processed his locate ticket. The Enterprise pipeline remained unmarked. On November 5, 2009, the SAM senior technician and survey party chief conducted a work area walkdown to identify the paint marks and utility flags used to mark the location of the underground ET pipeline. The SAM crew also examined the right-of-way but did not see surface

NTSB/PAB-13/02 5 conditions that would suggest other underground utilities, including permanent or temporary pipeline markers for the Enterprise pipeline. The survey chief recorded the location of the ET underground pipeline markers using a global positioning system (GPS) device and a portable data logger. The information was used to finalize the new power line pole placement map. On November 9, 2009, 4 days after the SAM crew had completed the walkdown, and 2 days after the Texas 811 processing deadline, the Enterprise line locator finally opened his locate ticket and called the SAM foreman to schedule a site visit to mark the location of the Enterprise pipeline.5 However, the SAM foreman told the line locator that they had completed their route map survey work for the area listed on the locate ticket. Unaware that their brief discussion incorrectly identified the work location, they agreed that the Enterprise line locator did not need to travel to the site and mark the underground pipeline. The final routing map developed by SAM showed the ET pipeline but did not show the Enterprise pipeline in the right-of-way. Had the Enterprise line locator marked the pipeline, it would have been shown on the route map. An accurate route map would have alerted the Brazos and C&H work crews that two underground pipelines crossed the power line route and that both pipelines would have to be marked before they could install the electric power line pole in the pipeline right-of-way. June 2010 Power Line Construction Brazos hired C&H to install the power line using the detailed route map produced by SAM. On June 1, 2010, in preparation for power pole installation, the C&H foreman responsible for the installation work submitted a locate request to Texas 811. The request included the foreman’s name and telephone number. The foreman provided driving directions, as well as latitude and longitude coordinates, to destinations near the work location. Texas 811 sent locate tickets to ET and Enterprise. On June 2, 2010, the same Enterprise line locator who processed the November 2009 locate ticket, and who was familiar with the pipeline right-of-way and the area where the work was being performed, used his laptop computer to retrieve the locate ticket for the work near the substation. He drove to the indicated work location using the driving directions provided on the locate ticket, but he did not use the latitude and longitude coordinates. He told National Transportation Safety Board (NTSB) investigators: I was there approximately an hour to an hour and a half, driving and on foot, trying to find a work crew or equipment or just some sign that that was where they were working, following the [driving] directions they gave me on the E-Call ticket. I didn’t find anything.

5 The Enterprise line locator attended training on November 5 and 6. November 7 and 8 (Saturday and Sunday) were his scheduled days off. Enterprise procedures at the time allowed a delay for a ticket that was classified “routine” rather than “emergency.” The ticket was not reassigned to a different line locator.

NTSB/PAB-13/02 6 He did not see any evidence of the power line installation work, nor did he call the C&H foreman to clarify where the work was being performed. He left the area without marking the Enterprise pipeline. The next day, June 3, the Enterprise line locator returned to the location he had visited the day before to, again, look for the work crew or evidence of any construction activity near the pipeline right-of-way. As on the day before, he found no activity, and he did not call the C&H foreman or mark the pipeline. The Enterprise line locator returned to the location a third time on June 4, again following the driving directions on the C&H locate ticket. The Enterprise line locator told NTSB investigators that because he did not find any evidence of power pole installation activities at the location described on the locate ticket, he decided to close the ticket without placing any temporary pipeline markers. He annotated the ticket with a code K, meaning the “line locator has knowledge that there is no conflict with an Enterprise pipeline,” then returned the ticket to the Texas 811 office. Later that day, the C&H main office in Dewey, Oklahoma, received an electronic notification from Texas 811 reporting, “all clear/no conflict.” The C&H office forwarded the notification to the C&H foreman at the job site. On the morning of June 7, the Enterprise line locator retrieved a new ticket from Texas 811 containing directions to the same work location.6 Knowing that he had made three visits to what he believed was the correct work location based on the driving directions on the ticket without finding evidence of construction activity, he called the C&H foreman listed on the locate ticket. The line locator told investigators that the C&H foreman told him the work in the area had been completed. However, the C&H foreman told NTSB investigators that he was referring to a different power line installation job at another substation that had been completed a few days earlier.7 The C&H foreman8 told NTSB investigators that he had assumed the Enterprise line locator was at the construction site where the new power poles were being installed. The foreman also told the Enterprise line locator that C&H expected to complete all pole installation work the next day. The C&H foreman did not know that the Enterprise line locator was not at the work location where the underground utility identification was needed before the work could proceed. The foreman told the line locator that the second ticket was “an update ticket” for the ongoing job, which the line locator presumed was for the same work that he had examined 2 days earlier.

6 A separate locate ticket is generated for each county near the work location. In this case, tickets were generated for Johnson and Somervell counties. The other information on the tickets was the same. 7 The foreman told NTSB that the other substation was about 8 miles away. 8 The C&H foreman was at another C&H site when he was talking to the Enterprise line locator, so neither person was at the actual construction site during their conversation.

NTSB/PAB-13/02 7 Based on the conversation, and for the second time, the line locator cleared the locate ticket status on his computer without conducting the required underground survey and pipeline marking. This time he assigned the ticket a code C, “Clear—no possible interference.” Again, the C&H foreman was incorrectly notified that the construction area had no other underground utilities. The closure of the locate tickets meant that C&H was authorized to proceed with using mechanized digging equipment to install the power line poles as long as they remained outside the limits of the markers for the underground utilities. Bore Hole Relocation and Pipeline Strike A Brazos employee assigned to assist the C&H crew noticed that one bore hole location was close to the ET pipeline temporary location markers. To ensure the auger would not come close to the ET pipeline, the Brazos employee moved the marker stake 10 feet farther away from the ET pipeline markers,9 to a location outside the mowed area10 that typically indicates the limits of a pipeline right-of-way. Furthermore, he did not see any permanent pipeline markers that would have alerted him to the presence of the Enterprise pipeline. Unknown to the worker, he placed the new pole location directly above the unmarked Enterprise pipeline. When the C&H boring machine operator proceeded to bore the hole, the auger punctured the Enterprise high-pressure natural gas pipeline. The top of the pipe ruptured and split along a length of about 110 feet. (See figure 3.) The eruption threw the 60-ton auger truck more than 100 feet. (See figure 4.)

9 The Brazos procedures allow moving a pole location up to 10 feet without prior approval from the engineering department. 10 Federal regulations require the pipeline right-of-way to be periodically cleared of tall vegetation by mowing or other methods to maintain clear access.

NTSB/PAB-13/02 8

Figure 3. Ruptured section, about 110 feet long, of 36-inch-diameter Enterprise natural gas pipeline

NTSB/PAB-13/02 9

Figure 4. Upside-down, 60-ton C&H auger truck; exemplar truck shown in lower right Postaccident Actions The Texas Railroad Commission cited Enterprise for management deficiencies in its one call program. Enterprise has taken the following corrective actions to resolve the deficiencies:  Completed remarking its entire onshore pipeline system in Texas with line-of-sight markers by December 31, 2011.  Revised its written procedures for permanent line markers to reflect the transition to line-of-sight markers. Instituted line-of-sight markers for active regulated pipelines.  Revised its written procedures for permanent line markers to reflect the requirement to use line of sight markers.  Purchased new GPS devices for its employees who perform line-locating tasks.  Developed in-house training for using the GPS devices for line locating and began training employees during the fourth quarter of 2011.  Provided classroom instruction and hands-on performance training on the equipment used to locate underground pipelines.  Developed and implemented standardized in-house training on the use of the utility mapping software.

NTSB/PAB-13/02 10  Implemented a new software application, Internet Retrieval Ticketing Handling (IRTH), for processing locate tickets. Conducted additional IRTH software training. The IRTH system tracks the status of late or incomplete locate tickets. Texas 811 staff works with field personnel, supervisors, managers, and directors to resolve ticket processing delays. Probable Cause The National Transportation Safety Board determines that the probable cause of the rupture and fire was a contractor’s puncturing the unmarked, underground natural gas pipeline with a power auger. Contributing factors were the lack of permanent markers along the Enterprise Products Operating, LLC, pipeline and the failure of the Enterprise pipeline locator to locate and mark the pipeline before C&H Power Line Construction attempted to install the utility pole in the pipeline right-of-way. Adopted: September 9, 2013

FD07413 ｜ 2013_美国_PAB1303.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-13/03 National Transportation Safety Board Washington, DC 20594

Pipeline Accident Brief Accident No.: DCA-10-FP-009 Type of System: Crude oil transmission pipeline Accident Type: Pipeline damage with release Location: Romeoville, Illinois Date: September 9, 2010 Time: 11:30 a.m., central daylight time1 Owner/Operator: Enbridge Energy, Limited Partnership Fatalities/Injuries: None Damage/Clean-up Cost: $46.6 million Material Released: Heavy crude oil Quantity Released: 6,430 barrels (270,000 gallons) Pipeline Pressure: 101 pounds per square inch, gauge Maximum Operating Pressure:

619 pounds per square inch, gauge Component Affected: 34-inch diameter steel crude oil transmission pipeline

The Accident On September 9, 2010, at 11:30 a.m., a 34-inch-diameter pipeline (Line 6A)2 owned and operated by Enbridge Energy, Limited Partnership (Enbridge) leaked beneath the street pavement adjacent to 717 Parkwood Avenue in the Village of Romeoville (Romeoville), Will County, Illinois, releasing about 6,430 barrels of Saskatchewan heavy crude oil.3 Damages, including the cost of the environmental remediation, totaled about $46.6 million. The crude oil leak occurred at an industrial park about 0.6 mile west of the Des Plaines River, and 0.9 mile west of the Chicago Sanitary and Ship Canal. The closest residential areas were about 200 yards from the spill site, which was also within populated and ecologically sensitive areas designated as high consequence areas in Title 49 Code of Federal Regulations (CFR) 195.450.

1 All times are central daylight time. 2 Line 6A is part of the Enbridge liquid pipeline system that originates in Edmonton, Alberta, Canada. The 1,900-mile US portion, known as the Lakehead System, consists of pipelines of various diameters and ages operated from a control center in Edmonton. The pipeline delivers 670,000 barrels per day of synthetic, light, medium, and heavy crude oils. 3 The Enbridge Line 6A leak volume calculation indicated a total release of 7,752 barrels, including a supervised drain down of 1,325 barrels that did not leak from the pipeline. E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

NTSB/PAB-13/03 2 Enbridge reported that the monitoring system showed no indication of a leak during the several hours before discovering the crude oil release. At 9:36 a.m. on September 9, 2010, a passerby reported a water leak near 717 Parkwood Avenue to the Romeoville Public Works Department (PWD). The PWD immediately dispatched an equipment operator to investigate the water leak. At 9:46 a.m., the equipment operator notified the PWD water superintendent that water was discharging from expansion joints and cracks in the pavement from what he believed was a leaking service line. The equipment operator closed a valve on the water service line to Northfield Block Company, a privately owned business near the leak site, stopping the water discharge. Concluding that the leak was not creating a safety hazard, he turned the valve back on to restore water service to the facility—the water flow resumed from cracks in the pavement. He recommended a water leak detection company to a Northfield Block Company representative. About 11:30 a.m., a technician from Water Services, Inc., the water leak detection company hired by Northfield Block Company, arrived at the scene to locate the source of the leak. In addition to the leaking water, the technician observed oil discharging from beneath the pavement in the vicinity of the reported water leak. At 12:04 p.m., the Romeoville Fire Department received a report about a gas-like odor at 719 Parkwood Avenue, the location where oil was flowing out of the ground. Firefighters were dispatched to conduct an outdoor gas odor investigation. Upon their arrival at 12:11 p.m., they observed black oil discharging from expansion joints and cracks in a 30 square foot area of an asphalt-and-concrete driveway at the entrance to the Northfield Block Company. They described a heavy flow of oil running south along the street gutter in a 4-foot wide stream that was about 6 inches deep (see figure 1). The fire department immediately notified Enbridge, and a control center operator initiated the oil pipeline shutdown at 12:29 p.m. The released oil flowed into a storm water drainage ditch and then to a storm water management pond. Both required subsequent excavation and restoration activities to remove the oil. Three days later, Enbridge crews excavated the area around the damaged water and crude oil pipelines. Investigators observed a 1.5-inch diameter hole on the underside of the oil pipeline directly above the leaking 6-inch diameter water pipe that crossed 5 inches beneath the Enbridge pipeline. The earthen material around the pipes contained large rocks and coarse gravel. The water pipe was severely corroded and had three large holes on top of the pipe facing the oil pipeline.

NTSB/PAB-13/03 3

Figure 1. Aerial view of Parkwood Avenue looking southeast, September 9, 2010 Emergency Response About 12:11 p.m., the Romeoville Fire Department reported the oil leak to the PWD. The assistant fire chief obtained the Enbridge emergency contact information from a nearby pipeline marker and notified the company of the release at 12:28 p.m. At 12:29 p.m., the Enbridge control center initiated a shutdown of Line 6A and isolated the leak. The control center staff notified the assistant fire chief that they had initiated a shutdown and that they were contacting oil spill cleanup contractors to respond. Firefighters observed the oil flow diminish within 35 to 40 minutes. Enbridge notified the National Response Center at 1:06 p.m., then notified the Illinois Environmental Protection Agency, the US Coast Guard, and the Illinois Emergency Management Agency. Responding fire department units, including a hazardous materials response team, established a command post and evacuated nearby businesses. The fire and public works departments established a control point for the oil spill at the storm water management pond. Firefighters attempted to contain the oil in the gutter along Parkwood Avenue, but the release volume was too great to control with the equipment they had. Crude oil entered two storm drain

NTSB/PAB-13/03 4 inlets then flowed into a 1.5-acre storm water management pond that drains into the Des Plaines River. Subsurface oil at the spill site accumulated under the Parkwood Avenue pavement and migrated along underground utility pipes. Some of the oil entered the sanitary sewer system via compromised piping and manhole covers, where the oil flowed into the Romeoville Waste Water Treatment Plant–South Plant. Operators diverted the contaminated influent to holding tanks and a retention basin. No oil was released from the waste water treatment plant. Responders also placed oil booms at the storm water retention pond spillway to prevent the release from entering the Des Plaines River. Enbridge spill response contractors contained the oil in the pond using boom and skimming equipment. Enbridge, the US Environmental Protection Agency, and the Romeoville emergency responders established a unified command. Cooperating agencies included the Pipeline and Hazardous Materials Safety Administration, the Romeoville mayor, the village manager, and the police and the fire departments. Enbridge financed the clean-up operations and remedial actions. Pipeline Information The pipeline was constructed in 1968 of flash-welded4 American Petroleum Institute (API) X52 steel pipe manufactured by A.O. Smith. The 34-inch-diameter pipe had a nominal wall thickness of 0.281 inches. The pipe was coated with a single wrap of 18-inch wide Polyken polyethylene tape. The tape was field applied by machine after the bare metal pipe was coated with a primer to ensure adhesion and bonding. The tape coating was damaged and disbonded (that is, the adhesive bond between the pipe and its protective polyethylene tape coating had deteriorated) in the area where the leak occurred. The maximum operating pressure (MOP) of the pipeline segment was 619 psig. Enbridge estimated that the pipeline pressure at the time and location of the accident was 101 psig. Several other underground pipes ran parallel to the oil pipeline, including a storm sewer, a sanitary sewer, a natural gas pipeline, and water pipes. A 6-inch-diameter ductile iron cement lined water service pipe ran perpendicular to and below the Enbridge pipeline with a separation of only 5 inches. The oil pipeline leak occurred directly above the water pipe.

4 The longitudinal weld seam is formed by electric flash welding, a resistance welding process in which the ends are joined by heating and forging without the addition of filler metal.

NTSB/PAB-13/03 5 Corrosion Protection In addition to the polyethylene tape wrap on the pipeline, Enbridge operated a cathodic protection system using impressed dc electrical current rectifiers5 to protect the line from corrosion. The nearest anode bed for the cathodic protection was located about 1.4 miles upstream of the accident location. Section 4.3.10 of the National Association of Corrosion Engineers (NACE)6 standard states that underground piping systems should be installed so that they are physically separated from foreign metallic structures at crossings and parallel installations and in such a way that electrical isolation can be maintained. Furthermore, since April 1970, 49 CFR 195.250 has prescribed that a minimum clearance of 12 inches must be maintained between a pipeline and any other underground structure. A reduction in this clearance is allowed only if adequate provision is made for corrosion control, which was not done at this location. Survey Data and Leakage History Enbridge reported that between 2000 and 2008, it did not identify any defects of concern from eight in-line inspections for corrosion, metal loss, dents, or cracks in the area where the pipeline damage was located. However, an August 2008 inspection using a magnetic flux leakage (MFL) tool7 identified a metal object near the area of the damaged pipeline. Records indicated no history of excavation to repair or work on the pipeline at the location of the leak. Enbridge reported that its supervisory control and data acquisition (SCADA) system, its commodity movement and tracking (CMT) system,8 and its material balance system (MBS)9 did not indicate any anomalies during the several hours preceding the discovery of the crude oil leak by the Water Services, Inc. technician.

5 Impressed current cathodic protection is considered more effective than galvanic cathodic protection in long pipelines. An external dc electrical power source imparts current into the soil through sacrificial metal (the anode), which corrodes instead of the protected metal. 6 NACE is an industry organization dedicated to the study of corrosion by promoting research of new technology and trade standards and publications. 7 Sensors on MFL inspection tools detect the leakage fields as they move through the pipeline. Pipe wall changes such as metal loss will cause some of the magnetism to leak outside of the pipe wall. MFL tool specifications describe that a tool has a 90 percent probability of identifying general metal loss that is greater than 10 percent of the wall thickness. 8 At Enbridge, CMT is a system that performs real-time monitoring of the oil in the pipeline. Control center operators manually perform an accounting of the volumes in the pipeline every 2 hours to check for delivery volumes and potential leaks. 9 The Enbridge MBS uses a real-time pressure transient pipeline model, which operates in parallel with the SCADA and CMT systems to compare actual and expected flows and pressures between pipeline sections.

NTSB/PAB-13/03 6 Water Supply Pipe Crossing The Illinois Underground Utility Facilities Damage Prevention Act mandates the use of the Joint Utility Locating Information for Excavators, Inc. (JULIE) one-call system for all excavations on pipeline right-of-ways. Will County, Illinois, began using the JULIE system in August 1974.10 The JULIE system requires that prior to any nonemergency excavation an excavator must do the following: (1) Take reasonable action to become aware of the location of underground utility facilities. (2) Plan the excavation or demolition to avoid or minimize interference with the underground utility facilities. (3) Provide notice through the statewide one-call system not more than 14 days nor less than 48 hours in advance of the start of the operation. (4) Provide support for existing underground utility facilities during and following the operation. (5) Properly backfill all excavations. Utility owners or operators are required by the legislation to maintain written records of the notice. Romeoville records indicate that the 6-inch water pipe that passed beneath Line 6A was installed in 1977. At that time, service connections were subject to the requirements of the Village of Romeoville, Illinois, Code of Ordinances.11 The ordinance required that the application to begin proposed plumbing work shall be made to the building inspector by the plumber as agent of the property owner. Romeoville records did not identify the plumber who installed the water pipe, nor did they indicate whether JULIE or Enbridge had been notified of the project. Enbridge had no record documenting the existence of the water pipe and no record from JULIE for any excavation work at that location.

10 In 1976, JULIE was accepted by the Illinois Commerce Commission as being compliant with the one-call notification section of Illinois General Order 185. 11 Village of Romeoville, Illinois, Code of Ordinances, Title V, Chapter 50: Waterworks System.

NTSB/PAB-13/03 7 Postaccident Investigation The oil pipeline sustained a 1.5-inch-diameter hole (see figure 2) about the 6:00 o’clock (bottom) position directly above the water pipe that crossed beneath it. The pipeline wall was thinned and deformed inward around the edges of the hole.

Figure 2. External view of the hole in the bottom of the 34-inch-diameter oil pipeline The outer surface deformed inward within a diameter of about 3 inches and was visible on the interior surface of the pipe. Piles of small rocks about 0.125 inch in diameter were covered in oil and stuck to the interior surface of the pipeline.

NTSB/PAB-13/03 8 The oil pipeline tape coating was heavily damaged in the area above the water pipe, likely from the water jetting against it. Strips of ripped and disbonded coating and tape hung down from the sides of the pipeline in the vicinity of the leak location (see figure 3).

Figure 3. View of the damaged tape coating on the oil pipeline in the excavated trench

NTSB/PAB-13/03 9 Sliding contact damage (gouging) on the outer surface of the oil pipeline was observed within 24 inches downstream from where the water pipe passed under the pipeline (see figure 4). Deformed pipe wall material protruded from the surface of many of the marks, most likely caused by digging tool strikes that occurred during the excavation work when the water pipe was installed.

Figure 4. Sliding contact gouges (individual arrows) and deformed material on the outer surface of the oil pipeline near the water pipe intersection

NTSB/PAB-13/03 10 The water pipe was corroded and had three large holes through the pipe wall and concrete liner on the upper half of the pipe in the immediate area directly below the oil pipeline (see figure 5). The largest hole measured 5.1 inches around the circumference and had an irregular shape. The metal edges of the holes were rounded and oxidized. A corrosion pitted area extended about 16 inches upstream and downstream along the top and sides of the pipe from the center of the largest hole. The bottom of the pipe as well as the entire circumference upstream and downstream beyond the corroded area did not exhibit significant corrosion.

Figure 5. Large holes and corrosion damage on the top of the 6-inch-diameter water pipe

NTSB/PAB-13/03 11 Trench Conditions Upon excavating the damaged pipes, investigators observed large rocks and coarse gravel between the bottom of and in contact with the oil pipeline and the top of the water pipe. The NTSB Materials Laboratory examined six large rocks that had been firmly wedged between the oil pipeline and the water pipe. Some were stained black, consistent with deposited oil. The rock shapes were compared to the shape of the hole and inward deformation in the oil pipe; however, no conclusive match was found. The trench backfill along the oil pipeline north and south of the leak location was sand, in contrast to the large rocks that were used as the backfill in the vicinity of the water pipe crossing. Sequence and Mechanism of the Pipeline Hole Formation Holes were observed in the water pipe and the oil pipeline. Most likely, the large holes in the water pipe developed first due to stray current corrosion, and the hole in the oil pipeline developed due to erosion from water jet impingement on the oil pipeline. The oil pipeline is cathodically protected with an impressed current system. A metallic object in close proximity to the oil pipeline, such as the water pipe, can disrupt the electric current flow and cause the metallic object to corrode, which is likely what caused the heavy local corrosion on the water pipe. Being only 5 inches away, the water pipe was close enough to disrupt the cathodic protection currents on the oil pipeline. The gravel fill to the west of the oil pipeline was added after a sanitary sewer repair the previous winter and remained exposed at the surface until an asphalt patch was applied in the spring. According to an article published by the Ductile Iron Pipe Research Association,12 when a ductile iron pipe crosses a cathodically protected pipe, the ductile iron pipe should be encased with polyethylene for a 20-foot distance in each direction from the nearby cathodically protected pipe. Alternatively, a sacrificial anode could be attached to the water pipe to discharge the current from the anode instead of from the water pipe back to the oil pipeline. Contrary to these recommended practices, the water pipe was not provided either protection method. Although the oil pipeline was installed with a protective coating, NTSB investigators determined the coating was most likely damaged during the water pipe installation, as evidenced by the gouges observed on the oil pipeline. The damaged oil pipeline coating provided a pathway for stray current to lead to extensive, deep corrosion on the upper side of the water pipe. Eventually, the ductile iron water pipe was so degraded that the concrete liner was unable to contain the water pressure.

12 Richard. W. Bonds, “Stray Current Effects on Ductile Iron Pipe,” Ductile Iron Pipe Research Association, Birmingham, Alabama, (1997).

NTSB/PAB-13/03 12 The holes in the water pipe became larger from the jetting water flow. The high-velocity, spraying water with suspended sand and small gravel began striking the oil pipeline until a through-wall hole developed. Impact of the Crude Oil Release Community On the day of the accident, the fire department evacuated 50 persons from 11 nearby businesses. Twenty-three area businesses were closed for 1 to 9 days. The PWD temporarily plugged one sanitary sewer line, which disrupted several nearby businesses for a day. Environment The EPA responded to the scene on September 9, 2010, to oversee removal of oil-contaminated soil and pavement, and the cleanup and restoration of the sanitary and storm drain systems, storm water management pond, and waste water treatment plant. The EPA also supervised surface water sampling, area air monitoring, and the installation and sampling of a network of 31 groundwater monitoring wells. On October 28, 2010, the EPA transferred oversight of long-term monitoring and cleanup of contaminated ground water to the Illinois EPA. Enbridge recovered 694,000 gallons of oil and water mixture. An additional 55,650 gallons of oil were pumped from the isolated pipeline segment. The EPA also removed about 1.5 million gallons of hazardous waste, 1 million gallons of treated water from the retention pond, 4.4 million gallons of treated sewage lagoon water, and 15,000 cubic yards of contaminated soils. A wildlife response center treated and released 141 turtles and frogs, while another 32 animals were found deceased in the field. Costs Enbridge’s expenses related to the release of crude oil from Line 6A, including environmental remediation, totaled $46,617,000. Federal response and oversight costs were $550,000. Postaccident Actions Involving Hazardous Liquid Pipelines On January 3, 2012, pipeline leak detection capability was addressed in the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011,13 Section 8. This Act requires the US Secretary of Transportation to submit to Congress a report on leak detection systems used by operators of hazardous liquid pipelines. The report must include an analysis of the technical limitations of current leak detection systems, including the ability of the systems to detect ruptures and small leaks that are ongoing or intermittent, and of what can be done to foster development of better technologies. The report must also address the practicability of establishing technically, operationally, and economically feasible standards for the capability of such systems to detect leaks. The Act requires the US Department of Transportation (DOT) to

13 Public Law 112-90, January 3, 2012.

NTSB/PAB-13/03 13 promulgate regulations mandating implementation of the technology if the DOT finds that it is practicable to establish such standards for the capability of leak detection systems to detect leaks. On July 10, 2012, the NTSB adopted its report addressing the July 25, 2010, rupture of a 30-inch-diameter Enbridge pipeline that released more than 843,000 gallons crude oil into a wetland and the Kalamazoo River in Marshall, Michigan.14 The NTSB issued safety recommendations to the US Secretary of Transportation, the Pipeline and Hazardous Materials Safety Administration, Enbridge Incorporated, the American Petroleum Institute, the Pipeline Research Council International, the International Association of Fire Chiefs, and the National Emergency Number Association. The NTSB expressed concern about the failure of the Enbridge control center staff to recognize abnormal conditions that might indicate a pipeline leak or rupture and issued recommendations to Enbridge to improve leak detection. Probable Cause The National Transportation Safety Board determines that the probable cause of the Enbridge Energy, Limited Partnership oil pipeline leak and crude oil release near the Des Plaines River in Romeoville, Illinois, on September 9, 2010, was erosion caused by water jet impingement from a leaking 6-inch diameter water pipe 5 inches below the oil pipeline. Contributing to the accident was the interruption of the cathodic protection currents by the close proximity of the improperly installed water pipe. Adopted: September 30, 2013

14 National Transportation Safety Board, Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release, Marshall, Michigan, July 25, 2010, PAR-12/01 (Washington, DC: National Transportation Safety Board, 2012).

FD07414 ｜ 2013_美国_RAB1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/RAB-13/02

National Transportation Safety Board Washington, D.C. 20594

Railroad Accident Brief

Accident No.: DCA-11-FR-001 Location: Tiskilwa, Illinois Date: October 7, 2011 Time: 2:14 a.m. central daylight time Railroad Iowa Interstate Railroad Property Damage: $1.6 million Injuries: 0 Fatalities: 0 Type of Accident: Derailment and hazardous materials release and fire

The Accident On October 7, 2011, at 2:14 a.m. central daylight time,1 26 cars in eastbound Iowa Interstate Railroad (IAIS) train RI-BI-06 derailed in Tiskilwa, Illinois. Ten of the derailed cars contained ethanol, a hazardous material; ethanol released from the damaged tank cars ignited and burned. Property damage was estimated to be $1.6 million. The engineer and the conductor were not injured. No emergency responders were injured during the fire suppression and cleanup efforts. Accident Sequence At 11:30 p.m. on Thursday, October 6, 2011, an IAIS train crew consisting of a locomotive engineer and a conductor reported for duty at Rock Island, Illinois. The crew boarded train RI-BI-06 at the Silvis siding about 7 miles east of Rock Island at milepost (MP) 166. The train was destined for Blue Island, Illinois. The train consisted of 2 locomotives, 128 loaded cars, and 3 empty cars, accounting for 16,351 trailing tons. The train was 8,156 feet long. The crew obtained a track warrant to proceed eastward from the siding. At 12:30 a.m., the train proceeded onto the main track. The engineer stated that the trip had been uneventful up to the point of derailment (POD) at MP 121.8. At MP 121.8, the lead locomotive experienced a severe impact under the wheels. As the conductor was expressing his concern about this occurrence, the train went into emergency braking. The conductor looked back and saw that the cars near the locomotive were on fire, and he informed the engineer. (See figure 1.) The train (rail cars) had uncoupled from the

1 All times in this brief are central daylight time. E

P L U R IB US UN U M

N A T I O N A L

T R A S P O R T A T I O N

B O A R D S A FE T Y N

2 NTSB/RAB-13/02 locomotives. The engineer stopped the locomotives about 20 car lengths beyond where the first car of the train derailed.

Figure 1. Aerial photograph of derailment looking east. The first 26 cars behind the locomotives had derailed. The first 15 derailed cars were covered hopper cars carrying corn mash followed by a hopper car carrying sand and 10 tank cars carrying ethanol. Nine of the derailed ethanol cars were damaged and lost product, which burned. (See figure 2.) The intense fire caused three of the tank cars to fail and erupt in massive fireballs.

3 NTSB/RAB-13/02

Figure 2. Intense ethanol-fueled fires from several derailed tank cars. Emergency Response The Tiskilwa Fire Department response efforts began at 2:15 a.m. after the department had received several 911 calls from citizens reporting the train derailment and fire. About 2:16 a.m., the locomotive engineer notified the IAIS train dispatcher who notified the Bureau County Sheriff’s Department. At 2:20 a.m., the IAIS dispatcher called the sheriff’s department again and reported that the hazardous materials placards on the tank cars were commodity code UN 1987, which identified the material as Alcohols, NOS (Not Otherwise Specified), the proper shipping name for denatured fuel ethanol, a flammable liquid, Hazard Class 3. The Tiskilwa fire chief arrived at the scene at 2:21 a.m. and ordered a 1/2-mile radius evacuation as recommended in the Emergency Response Guidebook.2 At 2:25 a.m., the fire chief requested assistance from a hazardous materials response team from the LaSalle Fire Department. The immediate objectives of the fire department response team were evacuating and sheltering the residents in the vicinity of the derailment, securing the perimeter, and using portable water reservoirs and fire hoses to cool railroad cars. Five additional fire departments

2 PHMSA (Pipeline and Hazardous Materials Safety Administration). 2012. Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident. Washington, DC: US Department of Transportation, PHMSA.

4 NTSB/RAB-13/02 were contacted between 2:21 a.m. and 2:43 a.m. to respond to the incident: Bureau County Fire Protection District and Princeton, Buda, Malden, and Wyanet Fire Departments. About 2:56 a.m., responding state and local police departments began a precautionary evacuation of the town’s 745 residents. The evacuees were sheltered at Princeton High School. About 4:00 a.m., responders at the scene reported that one of the tanks had ruptured. About 5:00 a.m., the IAIS chief transportation officer reported three tank cars were venting and flames could be seen above the pressure-relief devices. Shortly before 7:00 a.m., the incident command ordered the back end of the train (nonderailed cars) separated and removed from the scene to prevent it from becoming involved in the fire. About 8:00 a.m., using thermal imaging cameras, the hazardous materials team measured the fire temperatures at more than 1000°F. The incident command ordered continued cooling of the derailed cars. By 10:00 a.m., only one tank car was venting and on fire. The Bureau County Fire Protection District continued the cooling operations until about 11:00 a.m., at which time its employees were relieved by firefighters contracted by the railroad. The incident command coordinated with the contract firefighters to cool the tank cars to reduce the risk of tank rupture. After the fires were extinguished and the equipment cooled, transloading of the tank car contents began. (See figure 3.) This process took several days and mitigated the release of ethanol into the surrounding environment.

Figure 3. Crews pumping remaining ethanol from derailed tank car.

5 NTSB/RAB-13/02 The Investigation National Transportation Safety Board (NTSB) investigators reviewed the event recorder data and determined that the crew was operating the train within the authorized speed for the territory. The crew had correct track warrants and track authority. Investigators also reviewed the crew’s work history and determined the crew had sufficient off-duty time before reporting for work. Equipment Nonderailed Cars From the original consist, 105 cars were uncoupled and moved to the Atkinson siding. On October 8, 2011, NTSB investigators observed an airbrake test and performed a mechanical inspection of the cars. No exceptions were identified. Locomotives On October 8, 2011, investigators inspected the two locomotives: IAIS 513 (leading) and IAIS 504. Investigators found fresh transverse batter3 marks on the wheel treads of the wheels on the right side of both locomotives at wheel positions 1 through 6. The batter appeared more pronounced on the first three wheels. The forward main spring located on the right side of locomotive IAIS 504 at wheel position 1 had new impact marks on the inner portions of the coil, indicating that it recently had bottomed out. The Federal Railroad Administration (FRA) Class 1 brake test and the air leakage test were completed with no exceptions. A review of the maintenance and inspection records for both locomotives indicated all of the required FRA and IAIS mechanical inspections were current with no defects recorded. Video recordings from outward-facing cameras on both locomotives were reviewed. The trailing unit recording system captured video from its rear-facing camera. The lead unit recording system (facing forward) was inoperable, and no video was recorded. Both recordings contained audio from microphones mounted outside the locomotive cabs and some parametric data similar to that recorded by the locomotive’s event recorder. The trailing locomotive video was illuminated by the rear-facing headlight. The audio captured a loud bang as the video showed the first trailing car dropping and rotating to the south side of the track. The video also shows a fire in the distant background. Previous Train Traffic The last train to operate through Tiskilwa before the accident went through about 6 hours before. The engineer and the conductor of that train told NTSB investigators that they did not see or feel anything unusual. In response to a request from investigators, IAIS maintenance personnel inspected the rear car of the 2-locomotive, 26-car train for lateral markings on the

3 Batter is deformation of the wheel that is perpendicular to the wheel tread.

6 NTSB/RAB-13/02 wheel tread, which would indicate that the train had encountered a broken rail. No lateral markings were visible. Track and Engineering The IAIS inspects and maintains the single main track on the portion of Subdivision 1 where the accident occurred to the FRA Track Safety Standards for Class 3 track, which allows for a maximum operating speed of 40 mph. The subdivision carries an average of four trains in a 24-hour period—about 9 million gross tons annually. The day before the accident, October 6, 2011, an IAIS maintenance crew repaired fouled ballast4 at locations west and east of Tiskilwa. The work began west of Tiskilwa at MP 123.8, and the crew worked eastward. After working west of Tiskilwa, the crew worked three short spots of fouled ballast east of Tiskilwa: one west of the derailment area, one within the limits of the derailment area, and one east of the derailment area. NTSB investigators took no exceptions to the ballast conditions, anchoring pattern, and rail restraint effectiveness. Two locations were noted where new ballast had been applied to the track structure: one west of and outside the derailment area and one near the 3/4-mile marker post east of the derailment area. These findings were consistent with the information from interviews of the regulatory inspector and the maintenance personnel. Additionally, the IAIS geometry test data, ultrasonic records, and test frequency were reviewed; no exceptions were noted from those examinations. Rail Recovery and Rebuild On October 8, 2011, NTSB investigators assembled pieces of rail recovered from the derailment. Investigators measured, documented, and inventoried each piece of recovered rail. The entire north side rail was recovered; all except 2 feet 7 inches of the south rail was recovered. The markings and conditions of the recovered rails indicated that the POD was a section of the south rail at MP 121.76. About 100 feet into the derailment area5 in the direction of train travel, the rail exhibited severe receiving rail end batter.6 Fifty-seven inches east of the severely battered rail end, investigators found wheel flange markings on top of the rail that trailed into the gage side, or the inside, of the rail head. The area of the north rail opposite the POD had markings consistent with corresponding derailment marks on the opposite rail. The south rail was bent outward to the southeast of the

4 Fouled ballast is the accumulation of material (generally dirt and cemented mud) within the limits of the rails or at the outside edges of the crossties where the track structure is supported by the ballast section. Typically, areas with fouled ballast do not drain properly, which adversely affects the track geometry. 5 As measured from the west end of the derailment footprint 6 Rail end batter is deformation of the rail face and running surface that results from contact with a wheel at a gap or misalignment in the rail that allows the wheel to drop below the running surface of the rail. Severe batter is indicative of a heavy load hitting already broken rail. Two types of rail end batter can occur: receiving and trailing.

7 NTSB/RAB-13/02 severe rail end batter about 100 feet into the derailment area. The north rail bowed outward to the north across from the south rail’s outward bend, creating an area of wide gage that caused subsequent cars to derail at that point. Both rails had multiple rail fractures east of the severe rail end batter noted about 100 feet into the derailment area. No rail defects were found in the rail fractures east of the severe rail end batter. All fractures east of the POD were overstressed or new breaks in the rail. This is consistent with a scenario in which an axle set of wheels derailed from its normal wheel-rail relationship and caused damage as the train continued eastward. Rail pieces adjacent to the severely battered rail end about 100 feet into the derailment area were sent to the NTSB Materials Laboratory in Washington, DC, for detailed documentation, examination, and analysis. The running surface adjacent to the severely battered fracture face was flattened and deformed downward, and the upper portion of the fracture in the rail head had been obliterated by receiving rail end batter. (See figure 4.) The field side7 of the head had an overall downward deformation near the fracture face. No evidence of preexisting cracks was observed.

Figure 4. Rail head at east end of west rail fracture showing severe rail end batter and detail fracture.

7 The field side refers to the outside of the rail head towards the “field” as opposed to the running side or gauge side of the rail where the wheels or the equipment make contact with the inside if vertical face of the rail head.

8 NTSB/RAB-13/02 Investigators found a detail fracture8 that measured about 3 percent of the original head area. Because a small section of the rail in the POD area was missing, investigators could not determine whether this rail defect caused the derailment; however, the other physical evidence points to a broken rail as the initiating factor. Also, it is unlikely that a detail fracture of only 3 percent of the original head area would cause a derailment. The rail pieces from the POD were inspected using an ultrasonic flaw detector. The inspection revealed no indications of features that would suggest the presence of an internal rail flaw within either of the rails. The train crew’s experience of a severe impact under the lead locomotive wheels, the locomotive recordings, the physical evidence of lateral markings on the lead locomotive wheels, and the presence of severely battered rail all indicate that the rail broke prior to the derailment. Tank Cars The 10 tank cars that derailed were general service specification DOT-111A-100W1 (DOT-111) noninsulated stub sill design cars manufactured by American Rail Car, Trinity Tank Car, or Union Tank Car. Each car was fitted with a bottom outlet valve, top fittings within a protective housing, a hinged and bolted manway, and safety valves (pressure relief devices). None of the tank cars had head shields, jackets, or thermal protection. Current design requirements for specification DOT-111 tank cars are found in Title 49 Code of Federal Regulations (CFR) Part 179 Subparts B and D. The minimum head and shell thickness authorized for DOT-111 tank cars by 49 CFR 179.201-1 is 7/16 inch (0.4375 inch), and these metals must be of specification AAR TC 128, grade B, or ASTM A 516 grade steels.9 The 10 tank cars derailed in this accident were in compliance with this specification requirement in effect at the time of their construction. Damage to seven of the nine tank cars that were damaged included four head punctures, three shell punctures, and three shell tears. The head punctures were caused by car-to-car coupler strikes or contact with a rail or another object. The shell punctures resulted from car-to-car impact, and the shell tears resulted from the high temperatures of the pool fire. The damage to these DOT-111 tank cars is similar to the tank car damage that has occurred in several derailments over the years. (See “Previous NTSB Investigations,” below.) Tank car ADMX 31172 exhibited significant head damage, front sill pad weld fractures, and a circumferential shell fracture. The breach to tank car ADMX 31172 appears to have had a

8 Title 49 Code of Federal Regulations Part 213 defines detail fracture as a progressive fracture originating at or near the surface of the rail head. These fractures should not be confused with transverse fissures, compound fissures, or other defects that have internal origins. Detail fractures may arise from shelly spots (where small shell-like pieces have become detached from the top surface or side of the railhead), head checks, or flaking.

9 Title 49 CFR 179.200-7, Materials, The maximum allowable carbon content must be 0.31 percent when the individual specification allows carbon content greater than this amount. The plats may be clad with other approved materials: . . . .

9 NTSB/RAB-13/02 failure mode consistent with other accidents examined by the NTSB and the FRA in Cherry Valley, Illinois,10 and in Arcadia, Ohio. The B-end11 draft sill and attachments and the breached area of tank car ADMX 31172 were examined in detail. In each instance, the end of the tank with the sill pad separation also had significant tank head damage. The stub sill exhibited a downward deformation, and in the process the front sill pad fractured from the shell. As the draft sill was pulled further down relative to the tank, the tank appears to have breached with a transverse fracture that followed the fillet weld along the edge of the body bolster pad. The fracture surfaces in the B-right side and the B-end draft sill to head assembly were subjected to metallurgical testing and comparison to ADMX 30847, which did not sustain impact damage to the B-end head as a result of the accident. This draft sill exhibited downward deformation, and the draft sill broke free from the car without separating the head pad or fracturing the tank. The welds in this area were compared to those in ADMX 31172. Previous NTSB Investigations The NTSB has investigated a number of accidents in which DOT-111 tank cars have been damaged and subsequently released hazardous materials. Previous NTSB investigations identified the poor performance of DOT-111 tank cars include a May 1991 safety study12 as well as the following NTSB investigations: June 30, 1992, derailment in Superior Wisconsin;13 February 9, 2003, derailment in Tamaroa, Illinois;14 October 20, 2006, derailment of an ethanol unit train in New Brighton, Pennsylvania;15 and June 19, 2009, derailment of 19 tank cars carrying ethanol in Cherry Valley, Illinois.16 In addition, on February 6, 2011, the FRA investigated the derailment of a unit train of DOT-111 tank cars loaded with ethanol in Arcadia, Ohio, which released about 786,000 gallons of product. The poor performance of DOT-111 general specification tank cars in derailments suggests that DOT-111 tank cars are inadequately designed to prevent punctures and breaches and that catastrophic release of hazardous materials can be expected when derailments involve DOT-111.

10 National Transportation Safety Board. 2012. Derailment of CN Freight Train U70691-18 With Subsequent Hazardous Materials Release and Fire, Cherry Valley, Illinois, June 19, 2009. RAR-12/01. Washington, DC: NTSB. 11 Because rail cars have no front or rear, for descriptive purposes, the ends of the cars are designated “A” and “B.” The “B” end of a car is the end equipped with the wheel used to manually set the car‘s brakes. The end without the brake wheel is the “A” end. As trains are assembled, either end of a tank car may be placed in the front or rear position. 12 NTSB (National Transportation Safety Board). 1991. Transport of Hazardous Materials by Rail, SS-91-01, Washington, DC: NTSB, http://:www.ntsb.gov 13 NTSB (National Transportation Safety Board). 1994. Derailment of Burlington Northern Freight Train No. 01-142-30 and Release of Hazardous Materials in the Town of Superior, Wisconsin, June 30, 1992, HZM-94/01. Washington, DC: NTSB. 14 NTSB (National Transportation Safety Board). 2005. Derailment of Canadian National Freight Train M33371 and Subsequent Release of Hazardous Materials in Tamaroa, Illinois, February 9, 2003, RAR-05/01. Washington, DC: NTSB, 15 NTSB (National Transportation Safety Board). 2008. Derailment of Norfolk Southern Railway Company Train 68QB119 With Release of Hazardous Materials and Fire, New Brighton, Pennsylvania October 20, 2006. RAR-08/02. Washington, DC: NTSB. 16 RAR-12/01.

10 NTSB/RAB-13/02 About 40,000 tank cars are dedicated to transporting ethanol, and recently industry has dramatically increased the number of DOT-111 tank cars used to transport crude oil to US refineries. About 10,000 new DOT-111 tank cars are expected to be manufactured in 2013 to meet the increase in demand. In the Cherry Valley accident, 13 of 15 tank cars that were involved in the derailment, lost about 324,000 gallons of product from head and shell breaches or through damaged valves and fittings, or a combination of the two, The NTSB concluded that tank car design standards for the attachments of draft sills to sill pads and of sill pads to the tanks are insufficient to protect the integrity of the tanks in accidents in which the draft sills are subjected to significant downward deformation. The NTSB recommended to the Association of American Railroads: Review the design requirements in the Association of American Railroads Manual of Standards and Recommended Practices C-III, “Specifications for Tank Cars for Attaching Center Sills or Draft Sills,” and revise those requirements as needed to ensure that appropriate distances between the welds attaching the draft sill to the reinforcement pads and the welds attaching the reinforcement pads to the tank are maintained in all directions in accidents, including the longitudinal direction. (R-12-9) Environmental Cleanup Activities The Environmental Protection Agency (EPA) was responsible for environmental monitoring, wreckage clearing, and contaminated soil remediation. Site Cleanup and Waste Disposal The IAIS and its contractor, SWS Environmental Services (SWS), delayed clearing the wreckage until the transloading of the hazardous liquid was complete. Between October 8 and October 10, SWS recovered about 97,000 gallons of ethanol, which was about 37 percent of the original 259,000 gallons of lading from the nine damaged tank cars. The 162,000 gallons of unrecovered ethanol was consumed by the fire, absorbed into the soil, or evaporated Environmental Monitoring and Remediation The EPA conducted air monitoring in the surrounding community and surface water monitoring in the vicinity of the accident scene to either prevent or minimize releases to navigable waterways. The EPA assisted in drafting a plan for sampling residential wells, surface water, groundwater, surface and subsurface soils, and waste materials. The Center for Toxicology and Environmental Health, LLC (CTEH) was contracted by the IAIS to monitor releases of hazardous materials to air and water. The EPA oversaw the excavation of about 100 cubic yards of contaminated soil underlying the incident footprint following the CTEH October 9, 2011, work plan. Monitoring wells installed close to the accident scene were sampled three times between November 7 and 14, 2011. The samples revealed the presence of ethanol and denaturant constituents. In accordance with the interim remedial action plan, on November 10, 2011, the

11 NTSB/RAB-13/02 IAIS contractors installed two groundwater recovery wells at the center of the accident scene to remove ethanol-affected groundwater and reduce the pollutant concentrations. On November 11, about 60,000 gallons of groundwater was pumped from the wells into containers for transport. According to the plan, additional groundwater recovery or treatment will continue if sampling of monitoring wells detects additional pollutants. Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was a broken rail. Contributing to the large quantity of hazardous materials released was inadequate puncture resistance of the tank heads and shells of the DOT-111A-100W1 general service tank cars and the failure of draft sill attachments.

Adopted: August 14, 2013

FD07415 ｜ 2013_美国_RAR1302.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2013 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Head-On Collision of Two Union Pacific Railroad Freight Trains Near Goodwell, Oklahoma June 24, 2012

Accident Report NTSB/RAR-13/02 PB2013-107679

National Transportation Safety Board

NTSB/RAR-13/02 PB2013-107679 Notation 8431B Adopted June 18, 2013

Railroad Accident Report Head-On Collision of Two Union Pacific Railroad Freight Trains Near Goodwell, Oklahoma June 24, 2012

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2013. Head-On Collision of Two Union Pacific Railroad Freight Trains Near Goodwell, Oklahoma, June 24, 2012. Railroad Accident Report NTSB/RAR-13/02. Washington, DC.

Abstract: On Sunday, June 24, 2012, at 10:02 a.m. central daylight time, eastbound Union Pacific Railroad (UP) freight train ZLAAH 22 and westbound UP freight train AAMMLX 22 collided head-on while operating on straight track on the UP Pratt subdivision near Goodwell, Oklahoma. The collision derailed 3 locomotives and 24 cars of the eastbound train and 2 locomotives and 8 cars of the westbound train. The engineer and the conductor of the eastbound train and the engineer of the westbound train were killed. The conductor of the westbound train jumped to safety. During the collision and derailment, several fuel tanks from the derailed locomotives ruptured, releasing diesel fuel that ignited and burned. Damage was estimated at $14.8 million.

Safety issues identified in this investigation were the actions and responsibilities of the train crews, the medical examination process for railroad engineer certification, the survivability of event recorder data, and the need for implementation of positive train control. The National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Brotherhood of Locomotive Engineers and Trainmen, the United Transportation Union, all Class I Railroads, the Union Pacific Railroad, and all railroads subject to the positive train control provisions of the Rail Safety Improvement Act of 2008. The National Transportation Safety Board also reiterates recommendations to the Federal Railroad Administration and the Association of American Railroads and reclassifies three recommendations to the Federal Railroad Administration.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2013-107679 from:

National Technical Information Service 5301 Shawnee Rd Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Railroad Accident Report

i Contents

Figures ............................................................................................................................................ ii Tables ............................................................................................................................................. ii Abbreviations and Acronyms ..................................................................................................... iii Executive Summary ..................................................................................................................... iv 1 Investigation and Analysis .........................................................................................................1 1.1 Accident Narrative .....................................................................................................................1 1.2 Factors Not Contributing to the Accident ..................................................................................6 1.3 Limitations of the Investigation .................................................................................................7 1.4 Personnel Information ................................................................................................................7 1.4.1 Job Responsibilities of Engineer and Conductor .............................................................8 1.4.2 Eastbound Train Crew Performance ................................................................................9 1.4.3 Fatigue ...........................................................................................................................14 1.4.4 Train Crew Medical Requirements ................................................................................16 1.4.5 Train Crew Medical Information ...................................................................................16 1.5 Adequacy of UP Medical Records ...........................................................................................21 1.6 Alternate Color Vision Field Test ............................................................................................21 1.7 Adequacy of Medical Evaluation of Train Crewmembers ......................................................24 1.8 Locomotive Recorders .............................................................................................................30 1.8.1 Event Recorders .............................................................................................................30 1.8.2 Video Recorders ............................................................................................................32 1.8.3 In-Cab Audio and Video Recordings ............................................................................34 1.9 Positive Train Control ..............................................................................................................37 1.9.1 Positive Train Control Forum ........................................................................................39 2 Conclusions ................................................................................................................................43 2.1 Findings....................................................................................................................................43 2.2 Probable Cause.........................................................................................................................44 3 Recommendations .....................................................................................................................46 3.1 New Recommendations ...........................................................................................................46 3.2 Previously Issued Recommendations Reiterated in this Report ..............................................48 3.3 Previously Issued Recommendations Reclassified in This Report ..........................................49 Board Member Statements .........................................................................................................51 Appendix: Investigation and Hearing ........................................................................................55 References .....................................................................................................................................56

NTSB Railroad Accident Report

ii Figures Figure 1. Map showing route of both trains on June 24, 2012, with collision location at Goodwell, Oklahoma. ..................................................................................................................... 1 Figure 2. Aerial view of accident and fire. .................................................................................... 2 Figure 3. Typical signal light on UP Pratt subdivision. ................................................................. 3 Figure 4. Track map of accident area. ............................................................................................ 5 Figure 5. Suppression of the fire. ................................................................................................... 6 Figure 6. Eastbound train timeline using event recorder data from trailing locomotive. ............ 10 Figure 7. Interior of video recorder hard drive enclosure from lead locomotive of westbound train. .............................................................................................................................................. 33

Tables Table 1. Work schedule for engineer of eastbound train for 4 days before accident. .................. 15 Table 2. Work schedule for conductor of eastbound train for 4 days before accident. ................ 15

NTSB Railroad Accident Report

iii Abbreviations and Acronyms AAR Association of American Railroads AME aviation medical examiner Amtrak National Railroad Passenger Corporation BLET Brotherhood of Locomotive Engineers and Trainmen BMI body mass index BNSF BNSF Railway CFR Code of Federal Regulations CN Canadian National Railroad CRM crew resource management CSX CSX Transportation FAA Federal Aviation Administration FCC Federal Communications Commission FIRE functionally integrated railroad equipment FMCSA Federal Motor Carrier Safety Administration FRA Federal Railroad Administration KCSR Kansas City Southern Railway Company LOSA Line Operations Safety Audit MP milepost nm nanometers Norfolk Southern Norfolk Southern Corporation NTSB National Transportation Safety Board PTC positive train control RSAC Railroad Safety Advisory Committee RSIA Rail Safety Improvement Act of 2008 UP Union Pacific Railroad SMS safety management system UTU United Transportation Union

NTSB Railroad Accident Report

iv Executive Summary On Sunday, June 24, 2012, at 10:02 a.m. central daylight time, eastbound Union Pacific Railroad (UP) freight train ZLAAH-22 and westbound UP freight train AAMMLX-22 collided head-on while operating on straight track on the UP Pratt subdivision near Goodwell, Oklahoma. Skies were clear, the temperature was 89°F, and visibility was 10 miles. The collision derailed 3 locomotives and 24 cars of the eastbound train and 2 locomotives and 8 cars of the westbound train. The engineer and the conductor of the eastbound train and the engineer of the westbound train were killed. The conductor of the westbound train jumped to safety. During the collision and derailment, several fuel tanks from the derailed locomotives ruptured, releasing diesel fuel that ignited and burned. Damage was estimated at $14.8 million. The National Transportation Safety Board determines that the probable cause of this accident was the eastbound Union Pacific Railroad train crew’s lack of response to wayside signals because of the engineer’s inability to see and correctly interpret the signals; the conductor’s disengagement from his duties; and the lack of positive train control, which would have stopped the train and prevented the collision regardless of the crew’s inaction. Contributing to the accident was a medical examination process that failed to decertify the engineer before his deteriorating vision adversely affected his ability to operate a train safely. The accident investigation focused on the following safety issues:  The actions and responsibilities of the train crews: Crew conversations in the locomotive cab concerning signal aspects, radio transmissions, or any condition that can affect the safe operation of the train are important crew activities. In this accident, as the train passed signals for advance approach, approach, and stop, the engineer actively adjusted the throttle and dynamic brake as if all three signals were clear. The fact that the conductor was disengaged from his duties and did not appropriately intervene as the train proceeded through the signals demonstrates a serious failure of the UP’s safety management system that allowed lagging implementation of crew resource management.

 The medical examination process for railroad engineer certification: The UP’s medical records for the engineer of the eastbound train indicated that the engineer had passed his required vision test in 2009. However, the medical records from the engineer’s personal physician, his ophthalmologist, and his optometrist documented that his vision could not be corrected with glasses and contact lenses to meet the Federal Railroad Administration’s (FRA) visual acuity requirements. In 2009, for the first time, the engineer also failed the color vision test accepted by the FRA. Although he passed the UP’s color vision field test for secondary testing, the validity and reliability of that test are unknown. Although the FRA regulations allow such secondary tests, they do not define the characteristics of such tests to assure they are valid and reliable. Finally, no attempt was made to increase the frequency of medical

NTSB Railroad Accident Report

v evaluation when the railroad was aware that the engineer’s vision was deteriorating from a chronic, progressive condition.

 The survivability of event recorder data: The lead and trailing locomotives of both trains in this accident had event recorders to capture and preserve operational data that is important to accident investigation. However, most of the data could not be retrieved after the severe damage to the lead locomotives from the postaccident fire. What data were retrieved were downloaded from a trailing locomotive, but the amount of data relayed to the trailing locomotive was much less than the data captured by the recorders on the front of the train. And even though the event recorders on the lead locomotives had certified crashworthy memory modules, they did not survive the fire. If more of the locomotive operating data had been relayed to the recorder on the trailing locomotive or to another location, information critical to the investigation of the accident would likely have survived the accident.

 The need for implementation of positive train control: Before reaching the Goodwell siding, the eastbound train crew had passed three signals without appropriately responding by slowing and then stopping their train. Regardless of the reason for the crew’s nonresponse, had a positive train control system been in place in the area of the accident, it would have slowed and stopped the train, avoiding the collision. As a result of this investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, the Brotherhood of Locomotive Engineers and Trainmen, the United Transportation Union, all Class I Railroads, the Union Pacific Railroad, and all railroads subject to the positive train control provisions of the Rail Safety Improvement Act of 2008. The National Transportation Safety Board also reiterates recommendations to the Federal Railroad Administration and the Association of American Railroads and reclassifies three recommendations to the Federal Railroad Administration.

NTSB Railroad Accident Report

1 1 Investigation and Analysis 1.1 Accident Narrative On Sunday, June 24, 2012, at 10:02 a.m. central daylight time,1 eastbound Union Pacific Railroad (UP) freight train ZLAAH-22 (eastbound train) and westbound UP freight train AAMMLX-22 (westbound train) collided head-on while operating on straight track on the UP Pratt subdivision near Goodwell, Oklahoma. (See figure 1.) Skies were clear, the temperature was 89°F, and visibility was 10 miles.

Figure 1. Map showing route of both trains on June 24, 2012, with collision location at Goodwell, Oklahoma. The collision derailed 3 locomotives and 24 cars of the eastbound train and 2 locomotives and 8 cars of the westbound train. The engineer and the conductor of the eastbound train and the engineer of the westbound train were killed. The westbound train conductor jumped to safety. During the collision and derailment, several locomotive fuel tanks ruptured, releasing diesel fuel that ignited and burned. (See figure 2.) Damage was estimated at $14.8 million.

1 All times in this report are central daylight time.

NTSB Railroad Accident Report

2

Figure 2. Aerial view of accident and fire. The UP train dispatcher was controlling 10 to 12 trains in the area on the morning of the accident, including several trains operating both east and west over the division. This required the dispatcher to route some trains into sidings to meet other trains operating in the opposing direction. The dispatcher arranged for the eastbound and westbound trains to meet at the Goodwell siding by setting the combination of switches and signal lights to coordinate the movements of both trains. He planned for the eastbound train to stop on the main track, west of the east end of the Goodwell siding, and wait until the westbound train pulled into the siding and cleared the main track. The eastbound train would then continue east.2 In the territory of the accident, the UP signal system consisted of a clearly defined arrangement of colored lights (green, yellow, red) on the top of track-side masts to control the movement of trains in the east and west directions. Some signals had an additional lower light, to allow for additional signal indications (See figure 3.)

2 According to dispatcher log data and the dispatcher’s interview, the dispatcher had lined the switch for the westbound train to enter the siding, while the eastbound train was to stop at the stop signal at milepost 483.7.

NTSB Railroad Accident Report

3

Figure 3. Typical signal light on UP Pratt subdivision. The westbound train originated in Kansas City, Kansas, with a final destination of Los Angeles, California. The train crew boarded in Pratt, Kansas, about 188 miles from Goodwell, and departed Pratt at 5:32 a.m. According to the conductor, the crew had an uneventful trip before they encountered an advance approach signal (flashing yellow light) at milepost (MP) 478.6, which required the train crew to reduce the train speed to 40 mph and be prepared to stop at the second signal. According to event recorder data and calculation of the motion at the front of the train, the train crew reduced speed to comply with the signal indication. The lead locomotive was moving at 51 mph when it passed MP 478.6, and it decelerated to 41 mph about 2 minutes later. At MP 481.2, the crew encountered an approach diverging signal indication (yellow-over-yellow light). Near MP 482.0, the crew saw the headlight of the eastbound train. After several seconds, the crew determined that the eastbound train had not stopped before it reached the east end of the Goodwell siding, as expected. The conductor and the engineer both placed the train air brakes into an emergency application. The conductor exited the locomotive cab and jumped to safety.

NTSB Railroad Accident Report

4 The eastbound train originated in Los Angeles, California, with a final destination of Chicago, Illinois. The train crew boarded at Dalhart, Texas, about 59 miles west of Goodwell, and departed at 8:45 a.m. The crew did not report anything unusual after leaving Dalhart. The track speed limit in the area where the accident occurred was 70 mph. Event recorder data showed that the train was operating at about 65 mph as it approached the accident location. At MP 487.9, the train encountered an advance approach signal (flashing yellow light), which required the train crew to reduce the train speed to 40 mph. Event recorder data showed that the engineer did not decrease train speed after the train passed the advance approach signal. About 2 miles beyond the advance approach signal, the eastbound train crew encountered an approach signal (solid yellow light over solid red light) at MP 485.5 (at the west end of the Goodwell siding). This signal required the train crew to reduce the train speed to 30 mph and be prepared to stop before passing the next signal. Event recorder data showed that the train crew did not reduce speed after the train passed the approach signal. About 2 miles beyond the approach signal, at MP 483.7 (the east end of the Goodwell siding), the eastbound train crew encountered a stop signal (solid red light) at which they were supposed to come to a stop. Event recorder data showed that the engineer did not stop for this signal; instead, the train passed the stop signal at about 65 mph. Immediately after passing the stop signal, the train went through a switch that had been aligned so that the westbound train would enter the Goodwell siding.3 Event recorder data showed that the eastbound train’s air brakes were placed into an emergency application about 8 seconds before impact with the westbound train. The two trains collided at MP 482.18. While observing the train movements on the computer screen, the train dispatcher noticed the track circuit indication for the switch at the east end of the Goodwell siding start to flash, indicating that a switch was out of correspondence.4 The train dispatcher immediately made several attempts to contact both train crews by radio but was unable to do so. He then checked with another train crew in the area to confirm that his radio was working properly. A short time later, the conductor of the westbound train used his cell phone to report the accident to the dispatcher. At the time of impact, the eastbound train was traveling at 58 mph, and the westbound train was traveling at 21 mph. The lead locomotives of both trains were found on their sides, with extensive damage, in the field adjacent to the point of collision. Based on the locomotive event recorders on the trailing locomotives of each train and signal and dispatcher recorder data, the time of the collision was 10:02 a.m. Figure 4 shows a track map of the accident area.

3 NTSB investigators examined the switch points at MP 483.7 and saw fresh contact marks on the field side, a gap between each switch and its stock rail, and a severely bent rod that controlled the position of the switch. These marks and conditions are consistent with the appearance of a switch that has been run through in the wrong direction. 4 Out of correspondence refers to a condition in which a track switch is not lined and not locked.

NTSB Railroad Accident Report

5

Figure 4. Track map of accident area. The conductor of the westbound train told National Transportation Safety Board (NTSB) investigators that the trip had been normal until after the train passed Guymon, Oklahoma. He recalled passing an advance approach signal and said he knew the train would be entering a siding. When the conductor looked out of the window, he saw the headlight of the eastbound train. The conductor recalled the engineer’s slowing the train and asking if the oncoming train looked close, to which the conductor replied that it was still coming. He said he then realized that the train was approaching much faster than he had initially thought. The conductor said he then told the engineer they had to jump; he last saw the engineer standing at the control stand. The conductor said he moved to the exit at the front of the train and saw smoke coming from the wheels of the oncoming train, which did not appear to be slowing down. At that point, he jumped from the train and saw a large explosion as he jumped. The derailed locomotives and railcars of both trains came to rest as a pile of wreckage and debris near the point of collision. Witnesses told investigators that the wreckage was immediately engulfed in a large fire. The diesel-fueled fire burned for more than 24 hours despite fire suppression efforts that continued throughout the day and into the evening. (See figure 5.)

NTSB Railroad Accident Report

6

Figure 5. Suppression of the fire. 1.2 Factors Not Contributing to the Accident On the morning of the accident, the weather was dry and no ground level visibility problems were reported. After the accident, the track, the signal system, the trailing locomotives, and the railcars were examined and tested by NTSB investigators. No defects were identified. Further, both trains had received initial terminal airbrake inspections before the accident, and no discrepancies were noted. Signal system data indicated that the signals were functioning properly up to and at the time of the collision. Investigators performed sight distance tests that simulated the movement of the eastbound train at same time and with the same weather conditions as on the day of the accident. All three signals that the eastbound train passed before reaching the east end of the Goodwell siding were clearly visible to a person with normal vision. The surviving crewmember—the conductor of the westbound train—was tested in accordance with regulations; he did not have alcohol or drugs in his system. Investigators obtained usage records from known cell phone numbers for all four crewmembers; there was no cell phone activity for any of the crewmembers just before or at the time of the collision. The NTSB concludes that the following were not factors in the accident: the weather; the condition of

NTSB Railroad Accident Report

7 the track, the locomotives, or the railcars; the signal system; cell phone use by any of the crewmembers; or drug or alcohol use by the conductor of the westbound train. 1.3 Limitations of the Investigation This investigation was limited by the destruction by fire of the lead locomotives and their contents. The intensity of the postaccident fire precluded conducting autopsies or toxicology analyses of any of the deceased crewmembers. No personal effects of the crewmembers were recovered. The lead locomotives of both trains had functionally integrated railroad equipment (FIRE) computers that sent operating data to certified crashworthy event recorder memory modules. However, the long and intense postaccident fire destroyed both computers, and although the memory modules were recovered, they were so severely damaged that no data could be recovered. 1.4 Personnel Information The engineer of the eastbound train was 56 years old. He was hired by the UP on July 28, 1995. UP records indicated that he passed his most recent physical examination, which included vision and hearing tests, to operate as an engineer on August 12, 2009. He was recertified to operate as a locomotive engineer on September 23, 2009; the recertification was valid until September 14, 2012. UP records also indicated that the engineer had taken and passed 96 railroad training courses between August 29, 1995, and May 31, 2012. The courses covered various aspects of railroad operations, and some courses included management oversight to ensure employees’ knowledge and application of, and compliance with, railroad rules, regulations, and instructions. UP records from the year before the accident contained no disciplinary actions pertaining to the engineer. The conductor of the eastbound train was 49 years old. He began work at the UP on May 19, 2003. According to UP records, the conductor had passed his most recent physical examination on January 18, 2008. UP records also indicated that the conductor had taken and passed 72 training courses between May 20, 2003 and January 17, 2012. UP records from the year before the accident contained no disciplinary actions pertaining to the conductor. The engineer of the westbound train was 49 years old. He was hired by the UP on July 10, 1995. UP records indicated that the engineer had passed his most recent physical examination, which included vision and hearing tests, on December 9, 2009. He was recertified to operate as a locomotive engineer on February 10, 2010; the recertification was valid until March 7, 2013. UP records further indicated that the engineer had taken and passed 94 training courses between October 22, 1996, and May 3, 2012. The training courses covered various aspects of railroad operations, and some courses included management oversight to ensure employees’ knowledge and application of, and compliance with, railroad rules, regulations, and instructions. UP records from the year before the accident contained no disciplinary actions pertaining to the engineer.

NTSB Railroad Accident Report

8 The conductor of the westbound train was 34 years old. He began work at the UP on May 19, 2003. UP records indicated that the conductor had passed his most recent physical examination on February 20, 2009. UP records also indicated that the conductor had taken and passed 70 training courses between May 19, 2003, and December 24, 2011. UP records from the year before the accident contained no disciplinary actions pertaining to the conductor. The crewmembers of both UP trains were trained and tested, and they were qualified by the UP to perform their duties. 1.4.1 Job Responsibilities of Engineer and Conductor Crewmembers who operate trains on the UP have clear responsibilities. These responsibilities are documented in the UP operating rulebook, which is based on the sixth edition of the General Code of Operating Rules (GCOR),5 effective April 7, 2010. Specifically, the conductor is in charge of the train and must remind the locomotive engineer of any upcoming restrictions. The engineer is responsible for safely and efficiently operating the engine. Crewmembers must obey instructions from the locomotive engineer that concern operating the engine. Crew conversations in the locomotive cab concerning signal aspects and radio transmissions are an important crew activity. UP management makes in-cab signal aspect conversations among crewmembers an important part of its crew-monitoring program. The UP operating rulebook (UP 2010) states the following crewmember responsibilities: C. All Crewmembers’ Responsibilities

1. To ensure the train is operated safely and rules are observed, all

crewmembers must act responsibly to prevent accidents or rule violations. Crewmembers in the engine control compartment must communicate to each other any restrictions or other known conditions that affect the safe operation of their train sufficiently in advance of such condition to allow the engineer to take proper action. If proper action is not being taken, crewmembers must remind engineer of such condition and required action.

1. Crewmembers in the engine control compartment must be alert for signals.

As soon as signals become visible or audible, crewmembers must communicate clearly to each other the name of signals affecting their train. They must continue to observe signals and announce any change of aspect until the train passes the signal. If the signal is not complied with promptly, crewmembers must remind the engineer and/or conductor of the rule requirement. If crewmembers do not agree on the signal indication, regard the signal as the most restrictive indication observed.

5 The GCOR is a standard book of operating rules adopted by many railroads in the United States. It was developed by a committee composed of adopting railroads and is updated periodically by the committee. Each railroad that adopts the GCOR remains free to modify the specific rules to better suit its individual operating characteristics.

NTSB Railroad Accident Report

9

1. When the engineer and/or conductor fail to comply with a signal

indication or take proper action to comply with a restriction or rule, crewmembers must immediately take action to ensure safety, using the emergency brake valve to stop the train, if necessary. (UP 2010, 1-29) Both the conductor and the locomotive engineer must announce to each other in the locomotive cab the aspect of all signals encountered. If any signal is displaying an aspect that is less than clear,6 the crew must also announce the train identification and the aspect in a radio transmission to the dispatcher and trains in the area. There are no radio recordings, nor were they required, from the accident at Goodwell, Oklahoma, therefore it cannot be determined whether any signals were announced on the radio. 1.4.2 Eastbound Train Crew Performance Evidence of the actions of the eastbound train was obtained from the event recorder on the trailing locomotive and the wayside signal logs. The advance approach signal (flashing yellow light) was about 2 miles from the approach signal and about 4 miles from the stop signal at the east end of the Goodwell siding. The advance approach signal required the crew to slow their train to 40 mph. The approach signal (solid yellow light over solid red light) required the crew to proceed at not more than 30 mph and be prepared to stop at the next signal (red light), which was a stop signal. The stop signal required the crew to stop the train. The crew did not comply with any of the three wayside signals; instead, the train was operated past each of the signals at speeds greater than 60 mph, ultimately colliding head-on with the westbound train. (See figure 6.) The investigation revealed that the advance approach, approach, and stop signals were functioning properly and accurately displayed their aspects before the accident.

6 A clear (green) signal indication allows a train to operate at the maximum speed authorized for the track segment. A less-than-clear signal is one that is more restrictive than a clear (green) signal indication.

NTSB Railroad Accident Report

10 09:55 09:56 09:57 09:58 09:59 10:00 10:01 10:02 0 1 2 3 4 50 55 60 65 70 75 80 0 10 20 30 40 50 60 70 80 90 100 Red Signal Approach Signal Throttle Time (hr:min) Throttle Eastbound Train Throttle, Speed & dynamic brake Advance Approach Signal Collision Speed (MPH) Speed Dynamic Brake Dynamic Brake (%)

Figure 6. Eastbound train timeline using event recorder data from trailing locomotive. The eastbound train engineer did not reduce the train speed in accordance with the two approach signals or stop the train at the third (last) signal—a stop signal—before the collision. Instead, based on the event recorder data, the engineer appeared to make throttle and dynamic brake adjustments that maintained train speed close to the 70 mph limit, as would be expected for a train operating on a clear signal. The conductor did not intervene to slow or stop the train as the wayside signals were not obeyed, as required by UP rules. At the time of the accident, the conductor of the eastbound train had worked for the UP for 9 years. Given his years of experience, it seems unlikely that he saw the advance approach, approach, and stop signals and chose to do nothing to stop the train in time to prevent the collision. It seems much more likely that the conductor failed to observe the three signals during the almost 5 minutes between the advance approach signal and the collision. It appears that he was not engaged in the developing situation as the train neared and proceeded past the advance approach signal. However, detailed evidence that would have been useful to reconstruct and explain the circumstances leading to the accident was limited due to the extensive collision damage and fire: there were no data on crew behavior captured in the event recorder on the lead locomotive, no autopsy results, no toxicology

NTSB Railroad Accident Report

11 information, and no data from the conductor’s personal electronic devices, and his personal possessions on board the train did not survive. The NTSB therefore concludes that for undetermined reasons the conductor of the eastbound train was disengaged from performing his duties as the train passed the advance approach, approach, and stop signals. Despite the lack of available evidence, the investigation considered plausible scenarios based on available evidence and experience with past railroad accidents to explain the erroneous operation of the eastbound train. The investigation looked for indications that the crewmembers may have been unable or otherwise prevented from operating the train. The trailing unit event recorder data indicated that throttle and dynamic brake adjustments were made in the minutes prior to the collision. Moreover, there was no indication of distress from the train, either by radio calls or by emergency braking until seconds before the collision. Therefore, it is unlikely that a situation existed in the locomotive cab that prevented both crewmembers from making train control actions. The investigation also considered scenarios in which the crew became disoriented or confused about their track location. Notwithstanding the crew’s noncompliance with three wayside signals, a witness to the accident, who was driving a truck parallel to the eastbound train for several miles, reported to investigators that the train horn was blown at a highway crossing a few miles before the accident. Thus, it seems unlikely that the crewmembers were disoriented or confused about their location. The available evidence for the actions of the eastbound train crew does suggest that the crewmembers performed in a disengaged, if not dysfunctional, manner. Specifically, an operating practice across the railroad industry is that both crewmembers are responsible for the overall safe and efficient movement of the train. Moreover, it is known that effective crew coordination is imperative for safe operations involving two or more crewmembers. Since both crewmembers were present in the locomotive cab (based on recovery evidence), and since both crewmembers failed to comply with the wayside signals, the NTSB concludes that both crewmembers of the eastbound train failed to maintain proper crew coordination and jointly failed to make proper decisions and actions to control the train safely. Many accidents in transportation systems occur because of poor decisions and actions by people, as opposed to machinery failures. Consequently, approaches to minimize and avoid these human factors failures have received considerable attention over the past 2 decades across several transportation industries: aviation, maritime, pipeline, and railroad transportation. One of the more successful approaches is crew resource management (CRM), which makes use of equipment, procedures, and people to achieve greater levels of safety and efficiency in system operations. The main principle of CRM is that crewmembers will work together safely when their work climate fosters effective communications, improved situation awareness, and good leadership. Safety studies have indicated that CRM increases crew work relationships, improves control of workload levels, enhances exchange of mission information, increases cross-monitoring performance, improves management of mission-threatening errors, and increases the number of successful mission segments. In the aviation industry, the organizational impact of CRM has been a decrease in the number of aircraft accidents.

NTSB Railroad Accident Report

12 The purpose of CRM is to assure that all crewmembers understand their roles and responsibilities in relation to the tasks being performed. Teamwork and active engagement are important elements of CRM. Moreover, CRM becomes even more important when one or more members of a crew potentially become disengaged, distracted, or performs in a dysfunctional manner, and, therefore, the whole system is at higher risk of failure. Using CRM principles of effective communications, situation awareness, and teamwork can mitigate the adverse risks of poor individual and team performance. The NTSB has identified the lack of CRM as a safety failure in previous railroad accidents. In its investigation of a March 25, 1998, collision between two Norfolk Southern Corporation (Norfolk Southern) trains in Butler, Indiana, the NTSB concluded that railroad safety would be improved if crewmembers received CRM training (NTSB 1999). As a result of the Butler, Indiana, accident, the NTSB issued safety recommendations to the Federal Railroad Administration (FRA), Norfolk Southern, Class I railroads and Amtrak (National Railroad Passenger Corporation), the American Short Line and Regional Railroad Association, the Brotherhood of Locomotive Engineers, and the United Transportation Union (UTU) to work together to develop and implement CRM training for train crewmembers. Likewise, NTSB investigated the September 30, 2010, collision of two Canadian National Railway freight trains near Two Harbors, Minnesota (NTSB 2013b). The trains were operating in unsignaled territory, and one train entered the main track from a siding after failing to properly execute an after-arrival track authority.7 All five crewmembers on the two trains were injured, and estimated damages were $8.1 million. The NTSB determined that inadequate CRM, as evidenced by disengaged and dysfunctional crew performance that allowed a lack of communications, unchallenged decisions, and rule violations, contributed to the probable cause of the accident. In August 2012, NTSB investigators met with the FRA, which provided information on current efforts to facilitate the development and implementation of CRM in the rail industry. FRA representatives told the NTSB that the FRA was monitoring progress regarding CRM with select railroads. They also reported that FRA-sponsored research published since 2007 had led to CRM training curricula for transportation, mechanical, and engineering employees and had provided business-case justifications for CRM in the rail industry. Moreover, FRA had awarded grants to some railroads, including the UP, for CRM pilot programs. Therefore, the NTSB concludes that there is an adequate foundation of guidance and opportunity for railroads to develop and deploy CRM programs. At the February 26, 2013, investigative hearing on the Goodwell accident held at NTSB headquarters (NTSB 2013c), the UP testified that it uses CRM and other crew safety programs, such as peer-to-peer oversight and confidential close-call reporting, within its railroad system, but it had not implemented these programs yet on the Pratt subdivision where the Goodwell collision occurred. The NTSB concludes that had crewmembers of the eastbound train received training in and practiced the principles of CRM and other crew safety programs, they likely

7 With an after-arrival track authority, the permission to occupy a designated portion of single main track does not become effective until after the arrival of one or more opposing trains.

NTSB Railroad Accident Report

13 would have demonstrated improved coordination, communication, and discipline while operating the train. One crew safety program discussed by the UP during the hearing involved peer-to-peer oversight. Experience in other transportation modes indicates that the use of peer observers in a nonpunitive program to assess operational safety, perform peer-to-peer counseling, and generate data on trends of risky behaviors that can be used to develop mitigation strategies is an approach with merit. For example, the aviation industry has found success in the Line Operations Safety Audit (LOSA), a voluntary safety program in which trained observers (usually line pilots from the airline) ride on a jump seat during regularly scheduled flights to collect safety-related data on environmental conditions, operational complexity, training efficacy, and flight crew performance. The data collected remain confidential, and pilots are assured of nonpunitive use of those data. The LOSA program is a proactive means to understand the flight management process―both successful and unsuccessful—by noting the problems crews encounter on the line and how they manage these problems. Such a program would be equally valuable to the rail industry, as suggested by the circumstances of the Two Harbors, Minnesota, accident. The NTSB is aware that a few railroads have begun the implementation of LOSA-like programs. The NTSB concludes that a nonpunitive peer audit program is an important element of an effective safety management system (SMS) and would provide railroads with opportunities to better understand and address operational safety issues. Therefore, the NTSB recommends that the UP work with the Brotherhood of Locomotive Engineers and Trainmen (BLET) and the UTU to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety. Also, the NTSB recommends that the BLET work with the UP and the UTU to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety for the UP. Further, the NTSB recommends that the UTU work with the UP and the BLET to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety for the UP. It is important to note that CRM and LOSA are components of an overall SMS; that is, they are facets of a systematic approach to manage safety risks throughout all levels of an organization. SMS provides for goal setting, planning, and measuring safety performance, including the following:  How an organization is set up to manage risk  Identification of workplace risks and suitable controls  Implementation of effective communications across all levels of an organization  Implementation of processes to identify and correct nonconformities  Implementation of continual improvement processes In other words, an effective SMS requires organizational structures, accountabilities, policies, and procedures that ensure diligent and aggressive implementation of management’s safety objectives throughout the workforce. All federally regulated transportation industries have recognized the importance of SMS as a foundation for a robust safety culture. It is known that an

NTSB Railroad Accident Report

14 effective SMS helps companies reduce and prevent accidents and reduce accident-related loss of life, time, and resources, including money. The Goodwell investigation revealed a failure in the UP SMS. Despite the UP’s acknowledgment of the importance of SMS and its intent to implement crew safety programs throughout its railroad system, the UP admits that it has not achieved this safety goal yet, and, in particular, it has not implemented CRM and related crew safety programs on the Pratt subdivision. The UP testified that more time is needed to implement the program, despite its recognition that a SMS allows it to identify, mitigate, and manage safety risks to its workforce and the public. The NTSB is concerned that the UP continues to operate its trains, especially in the Pratt subdivision, without a fully implemented and mature SMS. Therefore, the NTSB concludes that had the UP established, maintained, and enforced a SMS, it is likely that this accident may have been avoided. The NTSB recommends that the UP develop and implement a plan to establish a SMS, which incorporates CRM. 1.4.3 Fatigue The NTSB routinely examines the potential role of human fatigue in accident scenarios. Human fatigue is known to arise from lifestyle routines that limit or create variations in sleep patterns, medical conditions and medications that create drowsiness, as well as an array of physiological and psychological stress factors that create weary reactions to operational requirements. Consequentially, the NTSB works to determine the likelihood of human fatigue and its significance in accident causation by carefully considering numerous human factors. In the Goodwell accident investigation, many of the information sources used to assess human fatigue factors were destroyed by the casualties and the fire resulting from the train collision, as well as by the associated emergency response recovery work. Nevertheless, the information obtained on the likelihood of fatigue for the eastbound crewmembers—primarily from UP work records and interviews with surviving family members—is discussed below. Table 1 shows the work schedule for the eastbound engineer for 4 days leading up to the accident. On the day of the accident, the engineer reported for duty at 6:40 a.m., and the accident occurred 3 hours 21 minutes later. The day before the accident, the engineer was off duty. He lived with his mother, who was unable to discuss her son’s non-work activities and sleep patterns with investigators. However, it was determined from UP work records that during the second and third days before the accident, the engineer had worked nights, starting about 10:00 p.m. and finishing at irregular morning hours. His work schedule indicates that he had an irregular schedule, and, consequentially, irregular opportunities to sleep, which is a known factor causing human fatigue. However, event recorder data for the eastbound train indicated that before the collision, the engineer was making throttle and dynamic brake adjustments, indicating that he was not asleep. But, because a complete history of his non-work activities and his actual sleep patterns were not available to the investigation, the NTSB could not determine whether fatigue affected the engineer’s operation of the train.

NTSB Railroad Accident Report

15 Table 1. Work schedule for engineer of eastbound train for 4 days before accident.

DATE

ON-DUTY

OFF-DUTY

WORK HOURS

NON-WORK HOURS SLEEP OPPORTUNITY HOURS Wednesday, June 20, 2012 10:15 p.m.

Thursday, June 21, 2012

9:45 a.m. 12.50

1. 25

up to 12.25 10:00 p.m.

Friday, June 22, 2012

2:45 a.m. 5.75

Saturday, June 23, 2012

1. 00

up to 24.00 Sunday, June 24, 2012 6:40 a.m.

10:01 a.m.

1. 35

Table 2 shows the work schedule for the conductor of the eastbound train for 4 days leading up to the accident. On the day of the accident, he reported for work at 6:40 a.m.; the eastbound engineer reported for work at the same time. The conductor’s spouse reported that he went to bed about 10:00 p.m. on June 23, suggesting that he had no more than about 8 hours of sleep opportunity before work on the day of the accident. For the 2 days before the accident, the conductor was off duty, but his non-work activities and his sleep patterns were not available to the investigation. And for 2 days before this 2-day off-duty period, the conductor reported for work at varying night and day times, although no further information about his non-work periods and sleep patterns was available to the investigation. The conductor’s work schedule indicates that he also had an irregular work schedule, and, therefore, irregular opportunities to sleep. But because the non-work activities and actual sleep patterns of the conductor were unavailable to the investigation, the NTSB could not determine whether fatigue affected the conductor’s operation of the train. Table 2. Work schedule for conductor of eastbound train for 4 days before accident.

DATE

ON-DUTY

OFF-DUTY

WORK HOURS

NON-WORK HOURS SLEEP OPPORTUNITY HOURS Wednesday, June 20, 2012

1:05 a.m.

1:00 p.m.

1. 08

Thursday, June 21, 2012

1. 25

up to 12.25 9:30 a.m.

1:05 p.m. 3.58

Friday, June 22, 2012

1. 00

up to 24.00 Saturday, June 23, 2012

1. 00

up to 8.00 Sunday, June 24, 2012 6:40 a.m.

10:01 a.m.

1. 35

NTSB Railroad Accident Report

16 The UP work records indicated that in the week before the accident, both crewmembers of the eastbound train had been called to work at various times of the day and night. However, the circumstances of the accident resulted in a substantial loss of evidence and traceability of the actions and reactions of the engineer and the conductor before the collision. Therefore, the NTSB concludes that insufficient information was available to determine whether fatigue of the eastbound train crew was a factor in the accident. 1.4.4 Train Crew Medical Requirements Federal regulations require railroad personnel in safety-sensitive positions8 to undergo a medical evaluation that is limited to measuring vision and hearing. The regulations have no requirements for evaluating any other health concerns or medication use. Engineers have been subject to this requirement for almost 22 years. Conductors were added with nearly identical requirements, in Title 49 Code of Federal Regulations (CFR) 242.117, effective September 1, 2012. Title 49 CFR 240.121 requires railroad engineers to meet the following vision criteria, and 49 CFR 240.201 requires railroad engineers to meet these criteria every 3 years: (1) For distant viewing either: (i) Distant visual acuity of at least 20/40 (Snellen)9 in each eye without corrective lenses or (ii) Distant visual acuity separately corrected to at least 20/40 (Snellen) with corrective lenses and distant binocular acuity of at least 20/40 (Snellen) in both eyes with or without corrective lenses; (2) A field of vision of at least 70 degrees in the horizontal meridian in each eye; and (3) The ability to recognize and distinguish between the colors of railroad signals as demonstrated by successfully completing one of the tests in appendix F to [49 CFR 240.121]. 1.4.5 Train Crew Medical Information The UP provided the NTSB with its medical records for all crewmembers of both trains. According to those records, all four crewmembers had passed their most recent medical examinations and were certified at the time of the accident.

8 A safety-sensitive position is one covered under the hours of service laws, including train and engine service employees involved in the movement of trains or engines (that is, engineers, conductors, brakemen, switchmen, locomotive hostlers/helpers); dispatching employees who issue mandatory directives (that is, train dispatchers, control operators); and signal employees who inspect, repair, or maintain signal systems. 9 The Snellen chart measures visual acuity by comparing a person’s ability to see relative to a person with normal vision. A person with 20/40 vision can accurately read information at a distance of 20 feet that a person with normal vision can accurately read at a distance of 40 feet.

NTSB Railroad Accident Report

17 The UP medical records for the westbound crewmembers documented no medical issues related to vision or hearing. The westbound engineer had a single measurement of height and weight on his preemployment exam in 1995. At that time, he was 72 inches tall, weighed 248.5 pounds, and reported treatment for hypertension on his new-hire physical in 1995. His body mass index (BMI)10 was 33.6 (NHBLI 2013). The westbound conductor had a single measurement of his height and weight on his preemployment physical in 2003. At that time he was 67 inches tall and weighed 217 pounds (BMI = 34.0). The eastbound train conductor’s UP medical records did not identify any medical issues. He had passed all of his medical certification exams and did not report any medical problems to the railroad. On his preemployment physical in 2003, he was 71 inches tall and weighed 187 pounds (BMI = 26.1). However, during an interview with the NTSB, his wife reported a history of gout and treatment for mild hypertension. The eastbound train engineer’s UP medical records identified a number of medical conditions. On his preemployment exam in 1995 he was 73 inches tall and weighed 246 pounds (BMI = 32.5). He had entries related to a retinal detachment requiring months off the job in 2001–2002 and for injuries related to a motorcycle crash requiring weeks off the job in 2003. He had passed previous vision testing but initially failed both visual acuity and color vision testing in 2009. The follow-up evaluation of his vision in 2009 and his ongoing vision problems are discussed more extensively in the remainder of this section. The NTSB obtained and reviewed additional personal medical records for the engineer of the eastbound train from three physicians and an optometrist.11 The records from his primary care doctor show intermittent treatment for gout and occasional visits for upper respiratory infections, and the records demonstrate that his weight varied from about 245 to 259 pounds during the period from 2001 to 2012. In addition, for many years he had regular appointments with both an optometrist and an ophthalmologist.12 In the year before the accident, the engineer regularly saw a second ophthalmologist who specialized in retinal care. The engineer had multiple eye conditions that caused persistent vision problems and progressive vision loss. In childhood he had cataract surgery, which required removing the lenses from both of his eyes. This meant that he routinely required both contact lenses and glasses with progressive lenses to focus on distant, intermediate, and near objects. Of note, all of the visual acuity measurements included in this report were obtained with his contact lenses in and his glasses on. In addition to having cataracts, the engineer had longstanding open-angle glaucoma13 in both eyes. Glaucoma is a disorder in which the pressure inside the eye becomes and remains too

10 BMI is a measure of body fat that applies to adults. Normal BMI is between 18.5 and 24.9, overweight is considered 25.0 to 29.9, and a BMI of more than 30.0 is considered obese. 11 An optometrist is a vision specialist who may prescribe glasses and contact lenses. 12 An ophthalmologist is a medical doctor who specializes in eye care and may prescribe medications and perform ocular surgical procedures. 13 Open-angle glaucoma is a chronic eye disease associated with increased pressure in the eye that causes damage to the optic nerve. Glaucoma can degrade vision, leading to blindness.

NTSB Railroad Accident Report

18 high, putting pressure on the optic nerve and the retina. Untreated, it leads to blindness. To keep the pressures in his eyes in or close to the normal range, the engineer required daily medications. Over the years, when medications failed to sufficiently control the intraocular pressure, he required various procedures to decrease the pressure. The last of these procedures was the placement of a drain in his left eye in November 2009, which allowed fluid to come out to the edge of the sclera (the white outer layer of the eye) when the intraocular pressure became high. When needed, the fluid pocket is then drained by an ophthalmologist. The ophthalmologist performed this procedure on the engineer multiple times. In his left eye, the engineer had recurrent episodes of iritis14 and vitreitis15 and had required a surgical procedure to remove and replace the vitreous in his left eye.16 In his right eye, in addition to having previous cataract surgery and glaucoma, he had a retinal detachment requiring surgery in 2001. By 2011, as a result of all the inflammation from his eye diseases, he developed cystoid macular edema.17 In addition, epiretinal membranes18 caused wrinkling of the retina in both eyes. This required surgery to remove the membranes on his right eye in September 2011 and on his left eye in November 2011. These last two conditions cause wavy distorted areas in the central vision that appear something like looking through water droplets. The locations and extent of the visual distortion from these conditions may change significantly from day to day. The engineer’s medical records indicate that his vision was evaluated many times; some evaluations were required for his 3-year locomotive engineer recertification, as mandated in 49 CFR 240.121, while others were part of his ongoing medical care. His medical evaluations included tests of his near and distant visual acuity, peripheral field of view, and color discrimination. However, every 3 years from 1998 through 2006, the engineer passed the vision and hearing tests required by the FRA. In 2006, his corrected vision was measured by his primary care physician for his railroad medical examination as 20/30 in both eyes for both near and distant visual acuity, he had a horizontal visual field of view of 90 degrees in each eye, and he passed the Ishihara color plate test without error (17 plates).19 Between 2006 and 2009, the engineer underwent a series of medical and surgical interventions for uncontrolled glaucoma, mostly in the left eye. According to his optometrist’s and ophthalmologists’ records, he had variable results on visual acuity testing; it was different on every visit. However, at no time after May 14, 2008, was the engineer’s corrected vision in his left eye documented by any of his medical providers as better than 20/70. By 2009, he reported

14 Iritis is a condition in which there is inflammation in the anterior chamber of the eye. 15 Vitreitis is a condition in which there is inflammation in the posterior chamber of the eye. 16 The vitreous is a gel-like substance that helps the eye maintain a round shape. 17 Cystoid macular edema is swelling in the central area of the retina (the macula) caused by capillaries leaking fluid. It distorts central vision. 18 An epiretinal membrane is created by local inflammation causing a thin film to develop over an area of the retina, usually in the macula. It can be a complication of cystoid macular edema, and it distorts vision. 19 The Ishihara test is the standard protocol mentioned in 49 CFR Part 240, Appendix F, to test for color vision deficiencies.

NTSB Railroad Accident Report

19 to his medical providers that his visual acuity was sometimes “marginal” and quite variable and that he was having trouble with color vision. On August 12, 2009, the engineer underwent testing at his primary care physician’s office as part of his FRA-required triennial railroad medical examination. On that date, his corrected visual acuity did not meet the standard; it was measured as 20/80 in the right eye and 20/80 in the left eye. Also, he failed the Ishihara color plate testing, getting only 7 out of 17 plates correct. Only his peripheral vision met the standard. The visual acuity and color vision test failures should have disqualified him from recertification as a locomotive engineer, pending a retest or review by a railroad medical examiner. The engineer sought assistance from his optometrist, likely hoping a new set of glasses would improve his visual acuity. During a visit on August 17, 2009, the optometrist attempted to correct the engineer’s vision with glasses but was able to correct it to only 20/40-2 (meaning two errors at the 20/40 level) in the right eye and 20/70-2 in the left eye. There was no record of color vision testing by the optometrist. However, in the record from that visit, the optometrist quoted the engineer as saying he was “losing color recognition.” The engineer provided the results from both his primary care doctor’s testing and the optometrist’s testing to the UP. The synopsis of medical records provided by the UP to the NTSB included the following information: September 16, 2009―The [UP] chief medical officer reported speaking with [the optometrist], who said [the engineer] had a history of cataracts (and had lenses removed) and glaucoma. He said [the optometrist] reported that [the engineer’s] current visual acuity was 20/40 in both eyes and full to confrontation.20 He still needed color vision testing. Based on the fact that no further visual acuity testing was required or performed, it appears that the UP used this conversation to determine that the engineer met the FRA requirements for visual acuity. The optometrist’s records contained no record of this conversation or any record of visits by the engineer to the optometrist in 2009 after August 17. Nevertheless, the conversation recorded in the UP’s records should have made it clear to the railroad that the deterioration in the engineer’s vision was the result of glaucoma, a chronic and progressive disease. The NTSB concludes that the results from required medical examinations and UP conversations with the engineer’s health care providers demonstrated to the UP that the eastbound train engineer’s vision had significantly deteriorated because of a chronic medical condition. After the UP medically certified the eastbound train engineer in 2009, the engineer’s vision continued to deteriorate. He continued to require the procedure to relieve the intraocular pressure in his left eye, and his vision continued to fluctuate. In July 2010, he told his ophthalmologist that he had “noticed some trouble telling color on train traffic signals.” In August 2010, he complained to his optometrist of “variable color vision.” Also in August, the

20 Full to confrontation is a normal result of confrontation testing for peripheral vision, but the test is designed to identify only significant defects. Confrontation testing is part of a physical examination aimed at determining the patient’s peripheral vision by comparing it to the examiner’s peripheral vision.

NTSB Railroad Accident Report

20 engineer’s ophthalmologist administered the Farnsworth D-15 test, a color vision test that can determine the type and severity of color vision loss (Colblinder 2013). The engineer’s results placed him in a category of severe protanopia, also known as red-blindness.21 In people who have acquired severe protanopia, the red-detecting cones in the retina no longer function. This means that colors of light with wavelengths longer than about 490 nanometers (nm) appear as shades of yellow, and those with shorter wavelengths appear as shades of blue. Although the exact colors of railroad signal lights are not regulated, the Association of American Railroads (AAR) chromaticity standards for railroad signals place the red signals about 622 nm, yellow between 589 and 598 nm, and green between 498 and 512 nm. To the engineer, signals at these wavelengths would have appeared as various shades of yellow. Some people with color vision defects use differences in brightness to compensate for difficulty with color differences. However, in addition to having difficulty detecting color differences above 490 nm, people with protanopia perceive colors of longer wavelengths (green, yellow, orange, and red) as less bright than people with normal vision do. Also in August 2010, the Texas Department of Motor Vehicles restricted the engineer’s automobile driver’s license to daytime driving only. A representative of the Texas Department of Motor Vehicles told the NTSB that there are only three reasons for such a restriction: at the request of the driver, when the driver verbally reported limited night vision, or when the result of visual acuity testing using both eyes was worse than 20/70. The representative was unable to tell the NTSB which of these was the reason for the engineer’s license restriction, but because his visual acuity measured at the time by his eye-care providers ranged from 20/60 to 20/100 in both eyes, it seems likely that the restriction was placed as a result of deteriorating visual acuity. Overall, between his last medical certification by the UP in September 2009 and the Goodwell accident in June 2012, the engineer visited his eye-care providers on more than 50 occasions and underwent 12 separate procedures. Some of these procedures were for elevated ocular pressure as a result of his glaucoma, but he also underwent two surgeries in 2011 to strip the epiretinal membranes from in front of his retinas. He continued to have cystoid macular edema, which causes variable areas of distortion within the central vision and can also impair color vision. He is quoted in 2011 as saying that his vision was “sometimes good and sometimes not” and noted “to have a hard time distinguishing colors.” On his last visit, on June 4, 2012, his visual acuity was measured as 20/70 in the right eye and 20/200 in the left eye. The engineer’s vision continued to deteriorate following his last medical certification in

1. Based on the engineer’s years of professional experience and his corresponding knowledge

of the signals in the subdivision in which he was operating, it is reasonable to expect he would have slowed and stopped the train had he seen and interpreted the wayside signals correctly. Instead, he operated the train as if the signal aspects were green. Based on the evidence of the operation of the train once it arrived at and proceeded beyond the advance approach, approach, and stop signals, the NTSB concludes that the engineer of the eastbound train was unable to visually detect and correctly interpret the wayside signals.

21 Protanopia is a type of color vision defect in which only two hues are seen; colors appear bluish or yellowish because of a lack of perception of red and green. Colors with wavelengths below 493 nanometers appear bluish; colors with wavelengths above 493 nanometers (red and green) appear yellowish.

NTSB Railroad Accident Report

21 1.5 Adequacy of UP Medical Records On September 16, 2009, the same day as the conversation between the optometrist and the UP chief medical officer, the engineer of the eastbound train saw his ophthalmologist. The ophthalmologist’s records from that visit quote the engineer as stating that the optometrist “could only get to 20/70” in the left eye. On that day, the ophthalmologist measured the engineer’s corrected vision as 20/70-2 in the right eye and 20/100-1 in the left eye. Based on the medical records made available to the NTSB, the engineer’s visual acuity in his left eye was not measured as 20/40 or better by any clinician on or after September 16, 2009. The NTSB investigation did not find any written documentation of the engineer’s visual acuity consistent with the reported conversation from the UP between the medical officer and the optometrist. The UP’s policy for verifying visual acuity was to obtain written documentation from an outside source stating the visual acuity test used and the crewmember’s test results. The UP did not comply with this policy when it recertified the eastbound train engineer in 2009. In addition, according to notes in the UP’s Health and Medical Services Encounters record for the eastbound engineer, the UP’s chief medical officer determined after his conversation with the optometrist that the engineer would need retesting after 1 year. There is no evidence that the UP ever retested the engineer’s visual acuity or obtained any further information regarding the engineer’s vision. The UP’s chief medical officer at the time is no longer employed by the UP and was not available for an interview with the NTSB. The NTSB concludes that the UP failed to adhere to its policy requiring written documentation from an outside source to verify visual acuity and failed to perform follow-up testing recommended by its own chief medical officer, either of which would have helped ensure that vision standards were continuously being met. Therefore, the NTSB recommends that the UP audit its medical records to ensure that all personnel in safety-sensitive positions have adequate documentation of appropriate medical testing. 1.6 Alternate Color Vision Field Test In addition to failing initial visual acuity testing, the engineer of the eastbound train failed the Ishihara color vision test for the first time in 2009. Federal regulations in 49 CFR 240.121(e) permit locomotive engineers to retake vision tests when they fail to meet the standards for certification, with a limit on the number of retests permitted. The regulations allow the use of alternate color vision tests, such as one of several standardized color vision tests or an unspecified field or, practical, test. The choice of test is at the discretion of the railroad’s chief medical examiner in consultation with the railroad’s designated supervisor of locomotive engineers. According to the regulations, the railroad’s medical examiner is expected to review all pertinent information and, under some circumstances, may restrict an examinee who does not meet the criteria from operating the train at night, during adverse weather conditions, or under other circumstances. The engineer of the eastbound train was retested for color vision using the UP field test protocol on September 17, 2009. The UP field test instructions state that 10 wayside signal configurations will be presented to the examinee in a preselected order. The examinee is asked to stand at ground level, about 440 yards away from the signal mast. No measurement of the distance is required. One of the 10 possible signal configurations is dark/unlit. Scoring is

NTSB Railroad Accident Report

22 performed by a supervisor, who follows a written protocol to record the approximate length of time the examinee takes to identify the lighted colors and interpret the meaning of each displayed signal (scored as 1–2 seconds, 2–3 seconds, and more than 3 seconds). However, no actual measurement of the time taken to perform this task is required. If any of the 10 signals is not displayed, the examiner must note the reason. No minimum number of signals is required by the UP’s protocol. Present at the time of the engineer’s test were a supervisor administering the test and the engineer’s labor representative. For the engineer’s test, six signal configurations were presented (one configuration was dark) and the remaining four configurations were noted as being “unavailable.” Thus, only 6 of 10 (60 percent) expected signal conditions were assessed in the engineer’s color vision field test, and one of those was dark. According to UP medical records, the engineer passed the color vision field test on September 17, 2009, by identifying each of six wayside signal configurations within 1–2 seconds. According to the current UP chief medical officer, the UP’s test has been in use since 1999 and complies with 49 CFR Part 240, Appendix F, which regulates secondary color vision testing. However, he was unable to provide information on when, why, or by whom the color vision field test was developed. Moreover, he stated that the reliability and validity of the UP’s color vision field test have not been evaluated, either by UP internal vision experts or by external vision experts. Therefore, the NTSB concludes that the UP routinely relies on a color vision field test of unknown validity, reliability, and comparability for medical certification of employees in safety-sensitive positions. Initially, the UP medical officer reported to the NTSB that enough crewmembers fail the primary color vision testing that the railroad performs secondary testing once or twice each month. However, the UP recently reported that it has administered this secondary color vision test 365 times since the beginning of 2008, and eight people were considered to have failed the exam. This equates to a 2.19 percent failure rate per test taken. However, the time period covers more than 3 years (the interval for medical certification exams); some of these engineers would have been tested twice. If the 365 tests were performed evenly over the time period, this would cover about 200 people (365 tests in 66 months with a requirement for retesting every 36 months). The actual failure rate of secondary testing is therefore likely to be closer to 4 percent per engineer tested. These 200 people who failed primary testing represent 1.4 percent of the 14,642 medically certified engineers at the UP. Further, the test scoring sheet provides space for recording the test conditions: yard versus mainline track, approximate viewing distance (expected to be 440 yards), and ambient weather (dark, daylight, clear, cloudy, fog, rain, snow). The scoring sheet for the engineer’s field test indicated that the test was conducted in a yard, at a viewing distance of 440 yards, and in daylight and clear weather. Although these conditions were reasonable, the field test does not evaluate a person’s ability to accurately perceive signals under common but less than ideal situations, such as during adverse weather, after dark, or under glaring sun. Therefore, the NTSB concludes that the field test used by the UP fails to ensure that UP employees have adequate color perception to perform in safety-sensitive positions. The NTSB recommends that the UP replace its color vision field test with a test that has established and acceptable levels of validity, reliability, and comparability to ensure that certified employees in safety-sensitive positions have sufficient color discrimination to perform safely. The NTSB further recommends that until the UP has implemented a validated, reliable, and comparable color vision field test, the UP perform

NTSB Railroad Accident Report

23 a safety analysis and undertake measures to manage the risk created by the use of an inadequate test. Such measures might include, but are not limited to, restricting crewmembers who have failed primary color vision testing to yard assignments or unsignaled territory. The NTSB also recommends that once the UP’s replacement color vision field test is implemented, the UP retest all certified UP employees in safety-sensitive positions who failed the primary color vision testing on their last medical certification exam using the new procedure. The color vision field tests used by the railroads vary widely. Amtrak requires that the supervisor conducting the field test has passed initial color testing (that is, has passed the Ishihara color plate test and did not require a field test) and is certified to perform the same job as the examinee. The Amtrak test is conducted under three lighting conditions including daylight, night, and dusk or dawn and at three distances, typically 1/16 mile (330 feet), 1/8 mile (660 feet), and 1/4 mile (1320 feet). For the Amtrak test, a minimum of 10 signals are presented in each of the three lighting and distance conditions, and the signal aspects are designed to emphasize those combinations with which the employee may be expected to have difficulty, based on results of their prior color vision testing. Examinees must describe and interpret each of the signals in less than 3 seconds. A single response delayed longer than 3 seconds or an incorrect response constitutes a failure of the color vision field test. If the employee is moved to a route where the signals are significantly different, a repeat color vision field test may be required. Similarly, the test used by CSX Transportation (CSX) requires evaluation both in daylight and at night; the CSX notes that “the ability to identify colors may be affected by lighting conditions.” Additionally, the CSX test is performed on a moving train. The supervisor performing the evaluation notes the distance at which he can see and interpret the signals and the distance at which the examinee can see and interpret the signals. The CSX test instructions require that the evaluation is “of sufficient duration to enable observance of numerous signal aspects,” but no minimum number is stated in the instructions. The supervisor then writes a recommendation indicating “whether the employee can or cannot properly identify signal aspects in time to safely comply with the signal indication.” No scoring instructions are defined. Although the federal regulations for secondary color vision tests (49 CFR Part 240, Appendix F) provide some flexibility in accommodating employees’ circumstances or for adopting new test technologies, the lack of specificity in the regulations creates safety risks and opportunities for shortcomings in the visual test protocols. For example, the allowance for field tests creates opportunities for the use of nonstandard procedures with unknown diagnostic sensitivity, reliability, and validity. Also, because color vision is a critical safety capability needed by locomotive crewmembers, color vision tests must establish unequivocally that crewmembers can identify the colored aspects of wayside signals regardless of lighting and weather conditions. The federal regulations provide general guidance for administering color vision field tests but do not provide specific procedures, pass-fail criteria, or interpretation guidelines for these tests. In fact, the regulations allow enough discretion by an individual railroad that an engineer with limited color vision could fail one railroad’s secondary testing (and be denied medical certification) but pass the secondary testing of another railroad. The NTSB therefore concludes that color vision field tests used after standardized color vision tests have been failed are not defined in FRA regulations to ensure valid, reliable, and comparable assessments. The NTSB recommends that the FRA determine what constitutes a valid, reliable, and comparable field test procedure for assessing the color discrimination capabilities of employees in safety-sensitive positions. When the FRA has made the determination in the

NTSB Railroad Accident Report

24 previous safety recommendation, the NTSB recommends that the FRA require railroads to use a valid, reliable, and comparable field test procedure for assessing the color discrimination capabilities of employees in safety-sensitive positions. 1.7 Adequacy of Medical Evaluation of Train Crewmembers According to 49 CFR 240.121(f), the engineer of the eastbound train had an obligation to report any further decline in his visual function to the railroad: As a condition of maintaining certification, each certified locomotive engineer shall notify his or her employing railroad’s medical department or, if no such department exists, an appropriate railroad official if the person’s best correctable vision or hearing has deteriorated to the extent that the person no longer meets one or more of the prescribed vision or hearing standards or requirements of this section. This notification is required prior to any subsequent operation of a locomotive or train which would require a certified locomotive engineer. Further, according to UP Safety Rule 90.4, an employee is required to report any health changes by [n]otifying the supervisor when the employee becomes aware of or is concerned that a medical condition or symptom(s) exists which may affect his/her ability to safely perform his/her job. (UP 2010) Once informed of a medical condition, the supervisor and the medical officer make a determination about safety and ability and either place the employee on leave, begin the temporary or permanent disability process, or terminate employment. By August 2010, nearly a year after the eastbound train engineer first failed visual acuity and color vision testing, the engineer was complaining of difficulty seeing train signals, and formal color vision testing revealed severe protanopia. In addition, the engineer had his visual acuity measured by various eye-care providers six times in August and September 2010. Although the vision in the right eye was measured as acceptable (20/40) on one of these examinations, it was never measured as better than 20/80 in the left eye. The other measurements in the left eye ranged from 20/100 to 20/200. If the engineer had been reevaluated in 2010 as planned by the UP or after he self-reported his vision treatments and test results, it is unlikely that he would have continued to be medically certified and the collision may have been avoided. The NTSB previously has encountered the problem of employees in safety-sensitive positions not reporting changes in their health status to railroads and has made a series of safety recommendations to address this issue. On February 9, 1996, about 8:40 a.m., two New Jersey Transit commuter trains collided nearly head-on in Secaucus, New Jersey (NTSB 1997b). About 400 passengers were on the trains; 3 people were killed and 158 were injured in the collision. The NTSB determined that the collision occurred because one train engineer failed to perceive a red signal aspect. The engineer had longstanding diabetes, which caused him to develop a color vision deficiency. He had not reported his diabetes to New Jersey Transit, but he was not

NTSB Railroad Accident Report

25 required to do so under FRA regulations. As a result of that accident, the NTSB issued the following safety recommendations: To the FRA: Require as a condition of certification that no person may act as an engineer with a known medical deficiency, or increase of a known medical deficiency, that would make that person unable to meet medical certification requirements. (R-97-2) To New Jersey Transit: Inform your employees, especially those in safety-critical positions, of the facts and circumstances of this accident stressing that they must accurately report their use of medications or any changes in their medical condition. (R-97-4) To AAR (R-97-5), Brotherhood of Locomotive Engineers (R-97-6), UTU (R-97-7), and American Public Transit Association (R-97-8): Provide your members with information about this accident, specifically explaining acquired vision deficiency and emphasizing the importance of ensuring the color vision requirement. Stress that railroad employees in safety sensitive positions, especially engineers, report their use of medications or any changes in their medical condition to their employer. Safety Recommendations R-97-2 and -4 through -8 have been classified “Closed—Acceptable Action.” These NTSB safety recommendations led to changes in federal regulations and a number of improvements across the railroad industry that increased the awareness, monitoring, and regulation of medical conditions that affect human vision. New Jersey Transit improved its medical examinations for all locomotive engineers and increased the frequency of examinations for engineers with known medical conditions, such as diabetes, from annually to twice a year. The AAR, the Brotherhood of Locomotive Engineers, the UTU, and the American Public Transit Association undertook employee awareness campaigns to inform their members about the accident and the importance of self-reporting medical conditions that could affect their performance in safety-sensitive jobs. The FRA issued a final rule to revise 49 CFR Part 240 with enhanced qualifications and certification procedures for locomotive engineers. In particular, the FRA updated 49 CFR 240.121 by specifying a list of approved vision tests for the initial evaluation of the color vision. However, although some railroad companies perform more comprehensive medical evaluations and more frequent evaluations, the current regulations do not require anything other than vision and hearing testing every 3 years. On November 15, 2001, two Canadian National/Illinois Central Railway trains collided near Clarkston, Michigan (NTSB 2002), killing two crewmembers and seriously injuring two other crewmembers. The NTSB investigation revealed that the two crewmembers who passed a stop signal had both been informed by their private physicians that they had potentially incapacitating medical conditions. Neither crewmember had informed the railroad, and neither

NTSB Railroad Accident Report

26 had received sufficient treatment to mitigate the problem. The NTSB determined that the probable cause of the accident was the “crewmembers’ fatigue, which was primarily due to the engineer’s untreated and the conductor’s insufficiently treated obstructive sleep apnea” (NTSB 2002). As a result of that accident, the NTSB issued the following safety recommendations to the FRA: Develop a standard medical examination form that includes questions regarding sleep problems and require that the form be used, pursuant to Title 49 Code of Federal Regulations Part 240, to determine the medical fitness of locomotive engineers; the form should also be available for use to determine the medical fitness of other employees in safety-sensitive positions. (R-02-24) Require that any medical condition that could incapacitate, or seriously impair the performance of, an employee in a safety-sensitive position be reported to the railroad in a timely manner. (R-02-25) Require that, when a railroad becomes aware that an employee in a safety-sensitive position has a potentially incapacitating or performance-impairing medical condition, the railroad prohibit that employee from performing any safety-sensitive duties until the railroad’s designated physician determines that the employee can continue to work safely in a safety-sensitive position. (R-02-26) In response to Safety Recommendation R-02-24, the FRA initiated a Railroad Safety Advisory Committee (RSAC) working group on medical standards to address the issues uncovered in the Clarkston accident. Because the FRA initially responded positively to the emerging public concerns about health issues in the railroad industry with research and regulatory work (FRA 2005), R-02-24 was classified “Open—Acceptable Response.” However, the NTSB has monitored the RSAC medical standards group since its initiation and is aware that the RSAC has not proposed any new medical standards or educational materials, and the FRA has made no changes to improve the medical certification of railroad employees in safety-sensitive positions in the 11 years since the Clarkston accident. Moreover, the FRA has indicated that future products from the RSAC medical standards working group will be guidelines for the railroad industry, rather than information to support improved regulations. The Goodwell accident is not the first since Clarkston where medical conditions that were not being monitored or evaluated by the railroad led to a train crew’s failure to respond appropriately to wayside signals. On April 17, 2011, a BNSF Railway (BNSF) coal train collided with the rear end of a standing BNSF maintenance-of-way equipment train near Red Oak, Iowa (NTSB 2012). Both crewmembers in the striking locomotive were killed; both had met the FRA-required vision and hearing standards and were medically certified at the time. The engineer had been diagnosed with obesity, diabetes, hypertension, and high cholesterol. The conductor was obese and had been treated for restless leg syndrome, hypertension, and depression. Although both crewmembers had significant risk factors for sleep apnea, and the conductor had been treated for restless leg syndrome, neither had undergone a sleep study. Combined with irregular work hours, these medical conditions led to the crewmembers’ falling asleep while operating the train, resulting in their failure to appropriately slow and stop their train following a restricted signal, with the readily visible equipment train on the track.

NTSB Railroad Accident Report

27 The FRA also has not adequately addressed Safety Recommendations R-02-25 and -26 resulting from the Clarkston accident. Although 49 CFR 240.121(f) requires employees to self-report deterioration in vision or hearing, there is no requirement that railroad employees in safety-sensitive positions report any other medical issue that might impair or affect their ability to operate a train safely. The RSAC working group on medical standards also has not made progress in the area addressed by Safety Recommendation R-02-26, which requires railroads to prohibit an employee known to have a potentially incapacitating or performance-impairing medical condition from performing any safety-sensitive duties until the railroad’s designated physician determines that the employee can continue to work safely in a safety-sensitive position. The areas addressed by all three of these safety recommendations (R-02-24, -25, and -26) are discussed further later in this report. Current FRA regulations place the onus of reporting new or deteriorating health concerns that could impair performance on the employee. This first presumes employees can successfully determine what constitutes a health concern that could impair their performance. As demonstrated in the Goodwell accident, the regulations place the onus on the employee even when the railroad knows that an employee has a chronic disease with the potential to dangerously deteriorate. In addition, both the Goodwell and the Clarkston accidents demonstrate that relying on employees to self-report to the railroad potentially dangerous medical conditions may not be optimal when there are potential financial and personal disincentives to reporting. This requirement may also be unrealistic because employees may not know whether they meet the standards. While it continues to be the case that the only FRA requirements for crewmember medical certification are vision and hearing testing, other medical problems have contributed to serious train accidents. In Secaucus in 1996, the contributing medical problem was diabetes, which caused a color vision problem. In Clarkston in 2001, it was sleep apnea. In Red Oak in 2011, it was fatigue stemming from a combination of obesity, hypertension, diabetes, high cholesterol, a sleep disorder, and irregular work hours. Among the four crewmembers involved in the Goodwell accident, three were obese at the time of their preemployment exams. Obesity is associated with developing sleep apnea, diabetes, hypertension, and high cholesterol. However, the UP never reevaluated the BMI of any of these employees. In addition to the eastbound engineer, who had vision problems, the conductor had mild hypertension according to his wife, and the westbound engineer had poorly controlled hypertension identified on a preemployment physical. The UP had no knowledge of the eastbound conductor’s hypertension or any details relating to its treatment because it developed after his preemployment exam in 2003, and the UP never required another blood pressure measurement or list of medications. When the westbound engineer reported having hypertension at his new-hire physical in 1995, he was taking three medications for it. However, during the examination, his blood pressure was measured at 170/80. Normal blood pressure and well-controlled hypertension are below 140/90. The examining (outside) physician recommended that the engineer follow up with his primary care doctor about his hypertension. Over the next 17 years, no mention of blood pressure, its measurement, or its treatment was made anywhere in the westbound engineer’s UP medical record. Hypertension, particularly when poorly controlled, is a common precursor of heart attacks, heart failure, kidney failure, strokes, and dementia. Any of these conditions could impair the safe operation of a train. Under current

NTSB Railroad Accident Report

28 FRA regulations, the UP was not required to perform any evaluation of height, weight, BMI, blood pressure, or medication use by any of these crewmembers. Other federally regulated transportation modes have more comprehensive medical certification regulations. The Federal Aviation Administration (FAA) regulations, which cover about 600,000 commercial and private pilots, are at Title 14 CFR Part 67. The Federal Motor Carrier Safety Administration’s (FMCSA) regulations governing the medical certification of more than 2.6 million drivers22 are at Title 49 CFR Part 391 Subpart E. The US Coast Guard’s regulations regarding medical certification of about 83,000 merchant mariners are at Title 46 CFR Part 10 Subpart B. With rare exceptions such as entry level ratings and shipboard food service workers, all these modes require a complete medical history, a list of medications, and a thorough physical exam for operators under their jurisdictions. Both the FAA and the FMCSA require the evaluation to be carried out by a trained and certified medical examiner (for the regulations requiring this, see Title 14 CFR Part 183 Subpart C for the FAA and Title 49 CFR Part 390 Subpart D for the FMCSA). All three transportation modes increase the frequency of medical evaluations for operators with identified chronic medical conditions that have the potential to worsen over time. For comparison, there are about 68,000 train engineer jobs in the United States. The FAA issues three levels of medical certification, with a first-class certificate having the most stringent criteria. First-class medical certificates are mandatory for airline transport pilots exercising the privileges of their credentials by working for airlines, and they expire more quickly than second- or third-class certificates. For all classes, the interval between required examinations decreases after age 40. For more than 30 years the FAA has used a system of special issuance medical certification that awards time-limited certification with specified retesting for pilots with medical conditions that have the potential to worsen over time. The FAA has listed specific medical conditions as disqualifying; finding these conditions during an initial medical certification examination requires the aviation medical examiner (AME) to defer certification to the FAA. At that time, further medical information and testing are required before the pilot can be certified. For many conditions that are otherwise disqualifying, when a special issuance is granted, the certificate is issued with a time limitation, usually restricting the validity of the medical certification to only 1 year. Specific follow-up evaluations must occur at specified intervals for each recertification. For the FAA, glaucoma and hypertension are both specifically identified conditions requiring special attention. For glaucoma, after an initial special issuance, annual reissuance by an AME requires a pilot to provide the results of a series of specified tests performed by the pilot’s ophthalmologist. Recertification by the AME may occur only if the pilot’s ophthalmologist finds visual acuity at least at specified standards: 20/20 in each eye separately for a first- or second-class certificate and 20/40 in each eye separately for a third-class medical certificate. If at any time the pilot’s visual acuity falls below these standards, the certification

22 The covered motor vehicle operators are drivers of commercial vehicles operating interstate and above 10,001 pounds of gross vehicle weight or carrying more than eight passengers, and drivers of all vehicles requiring a commercial driver license (26,001 pounds or higher gross vehicle weight).

NTSB Railroad Accident Report

29 must be deferred and the pilot referred to the FAA for further evaluation of the pilot’s fitness to fly (FAA 2013, 131). For hypertension, if the pilot is taking only specified classes of medication and the blood pressure measured by the AME is below 155/95, the pilot may be certified. Measured hypertension above this limit, as in the case of the westbound engineer in this collision, requires deferral of certification by the AME and further FAA evaluation. Medical monitoring and reporting programs used in other transportation modes do not rely solely on the employee to self-report deterioration in chronic conditions. Instead, other modes have identified specific chronic conditions with the potential for deterioration and require more frequent, specified medical evaluation and certification for employees in safety-sensitive positions who have those conditions. The NTSB concludes that medical certification requirements identifying chronic conditions with the potential to deteriorate dangerously, such as glaucoma, and increased frequency of medical evaluation for those conditions would very likely have identified the further decline in the eastbound engineer’s vision and would have decertified him prior to this accident. Therefore, the NTSB recommends that the FRA require more frequent medical certification exams for employees in safety-sensitive positions who have chronic conditions with the potential to deteriorate sufficiently to impair safe job performance. The NTSB acknowledges that specific job requirements differ across various modes of transportation, leading to different occupational health standards. However, many of the safety risks created by health problems or their treatments are similar. The medical certification process used by the FAA requires a complete medical examination (rather than one limited to vision and hearing) (FAA 2013). Effective in 2014, the FMCSA is upgrading its process to authorize only specially trained and certified medical examiners to perform medical certification exams (Federal Register 2008, 73096). The Coast Guard is also exploring a similar program (Federal Register 2013, 19725). In addition, each of these transportation modes incorporates central oversight of workers who have medical conditions that are initially disqualifying and require retesting, specialist evaluation, or medical determination that the condition does not impair the ability to perform safely. Each of these medical certification processes includes the ability to shorten the duration of certification when the condition has the potential to deteriorate. The exact requirements for evaluation depend on the condition but are clearly defined and consistent within each mode. Leaving such assessments to individual employers predictably results in different tests and test standards across the industry. Both the FMCSA’s current program change and the Coast Guard’s potential change, if enacted, will bring medical certification for those modes into closer alignment with the FAA system. The NTSB concludes that upgrading FRA medical certification requirements for employees in safety-sensitive positions to include comprehensive health examinations, standardized testing across the industry, and centralized oversight of certification decisions when initial testing is failed, as well as more frequent medical certification when an employee has a condition with the potential to deteriorate, would improve transportation safety. Therefore, the NTSB recommends that the FRA develop medical certification regulations for employees in safety-sensitive positions that include, at a minimum, (1) a complete medical history that includes specific screening for sleep disorders, a review of current medications, and a thorough physical examination; (2) standardization of testing protocols across the industry; and

NTSB Railroad Accident Report

30 (3) centralized oversight of certification decisions for employees who fail initial testing; and consider requiring that medical examinations be performed by those with specific training and certification in evaluating medication use and health issues related to occupational safety on railroads. This recommendation supersedes three safety recommendations to the FRA: R-02-24, which requires the development of a medical examination form with questions about sleep problems for use in determining the medical fitness of locomotive engineers; R-02-25, which requires employees to report performance-impairing medical conditions to the railroad; and R-02-26, which requires a railroad to prohibit an employee from performing safety-sensitive duties if the railroad is aware that the employee has a performance-impairing medical condition. Therefore, Safety Recommendations R-02-24, -25, and -26, previously classified “Open―Acceptable Response,” are now classified “Closed―Unacceptable Action/Superseded.” 1.8 Locomotive Recorders The eastbound train had four locomotives (three at the front of the train and one at the end of the train), and the westbound train had three locomotives (two at the front and one at the end). The lead locomotives of both trains had functionally integrated railroad equipment (FIRE) computers that recorded operating parameters, including those required by FRA regulations. These two locomotives also had certified crashworthy event recorder memory modules that received and recorded the data from the FIRE computer, even though such modules were not required.23 In addition, the other five locomotives, which includes the trailing locomotives on both trains, had event recorders, but they were designed to capture only a limited set of parameters related to speed, throttle, and brakes, and they did not have certified crashworthy memory modules.24 Both trains had outward-facing locomotive-mounted video cameras on the lead and the trailing locomotives. After the collision, investigators recovered the video recorder from the westbound train’s lead locomotive and the video recorders from the trailing locomotives of both trains. The video recorders were sent to the NTSB’s Vehicle Recorder division for evaluation. The video recorder from the lead locomotive on the eastbound train was not recovered. 1.8.1 Event Recorders After the collision, investigators were able to recover and download data from the event recorders from the trailing locomotives of both trains. Because of the extensive fire and collision damage to both lead locomotives, the FIRE computers on the lead locomotives were destroyed. Although the certified crashworthy event recorder memory modules from both lead locomotives were taken to the NTSB’s Vehicle Recorder division for readout and evaluation, no data could be recovered from the severely damaged modules.

23 According to a waiver approved by the FRA (Federal Register 2011b) AAR members (the UP is a member) are not required to have certified crashworthy event recorder memory modules until after the mandate of positive train control is effective, on December 31, 2015. 24 The trailing locomotives did not have crew aboard and were controlled remotely by the engineer on the lead locomotive of each train.

NTSB Railroad Accident Report

31 Event Recorder Regulations. Since the 1970s, the NTSB has advocated the capture and preservation of onboard locomotive operational data to assist in accident investigations. After the NTSB’s first recommendation on event recorders in 1978,25 recorder and data storage technology improved, and railroads began to install locomotive event recorders in significantly greater numbers. By the 1990s, most railroads were installing event recorders on their locomotives. However, recorder data remained susceptible to damage during accidents, and the value of event recorders in accident investigations has been compromised in many cases. In its investigation of a head-on collision between two UP freight trains in Devine, Texas, on June 22, 1997 (NTSB 1998), the NTSB found that the event recorders on both lead locomotives were destroyed and that critical operational data were lost. The NTSB made the following safety recommendation to the FRA: Working with the industry, develop and implement event recorder crashworthiness standards for all new or rebuilt locomotives by January 1, 2000. (R-98-30) An FRA regulation requiring crashworthy event recorder memory modules was promulgated and became effective on October 1, 2005. The crashworthiness standards were to be phased in from 2006 to October 1, 2009, but with grandfathering and the AAR exemption, many locomotives may not have certified crashworthy event recorder memory modules for 20 or more years. In correspondence dated October 26, 2005, the NTSB stated its preference for stricter recorder survivability standards that would meet the European Organization for Civil Aviation Equipment standard. The NTSB noted that the regulatory standards issued by the FRA are less stringent. Nonetheless, the NTSB classified Safety Recommendation R-98-30 “Closed―Acceptable Action.” The NTSB further noted that it would continue to monitor this situation and offer recommendations as a result of its (future) accident investigations to improve the effectiveness of crashworthiness standards and survivability of event recorders. Unavailable Event Data. Although the NTSB successfully recovered data from the trailing locomotives’ event recorders, the data those recorders captured were limited. The motion at the front of the trains, including the collision time and collision speeds, had to be calculated. The recorders on the lead locomotives were designed to capture many more parameters than the trailing locomotives’ recorders. But because the lead locomotives’ data modules were destroyed, despite their being certified crashworthy, important data were not available for analysis. For example, parameters recorded by the lead locomotives’ recorders include those for alarms, the horn, and emergency brake applications, among others. Because these were not available to investigators, the investigation lacked critical information. These critical data would be available for use by accident investigators if a redundant data set were recorded remote from the lead locomotives. For the Goodwell accident, locomotive speed data were available because they were stored in two locations: the lead and the trailing locomotives. The FRA should consider redundancy requirements to increase the likelihood of survivability of lead locomotive data in catastrophic accidents. This may include strategic

25 Safety Recommendation R-78-44 to the FRA: Promulgate regulations to require locomotives used in trains on main tracks outside of yard limits to be equipped with operating event recorders. Classified “Closed―Unacceptable Action.”

NTSB Railroad Accident Report

32 mounting locations for certified crashworthy event recorder memory modules (as far aft as practical), installation of more than one certified crashworthy memory module, data telemetry options to transmit data continuously from the lead locomotive to an alternate location on the train (such as the end-of-train device), or other redundant solutions that can increase the likelihood of data availability after an accident. Some railroads have made significant improvements in the capture of critical event recorder data. For example, Amtrak’s Wi-Tronics system notifies railroad managers immediately anytime an Amtrak locomotive experiences an undesired emergency air brake application. When this occurs, the system also immediately transmits vital train data to a remote location, ensuring data redundancy. Even though both lead locomotives had certified crashworthy memory modules, key event data were unrecoverable and, therefore, unavailable to investigators. With some key data stored on the trailing locomotives, which avoided the damage and fire from the collision, valuable data were retrieved, enabling NTSB investigators to reconstruct some of the events leading up to the accident to aid in the investigation. However, because only a portion of the important data were stored in more than one location, data critical to the investigation were destroyed in the collision and fire. The NTSB concludes that redundant storage of event data provided critical data to the accident investigation that would have been otherwise unavailable. The NTSB recommends that the FRA require all information captured by any required recorder to also be recorded in another location remote from the lead locomotive(s) to minimize the likelihood of the information’s being unrecoverable as a result of an accident. 1.8.2 Video Recorders The video recorders on the locomotives in the Goodwell accident were not required by regulation and were not protected from impact or fire. The video recorders from the trailing locomotives of both trains were undamaged and downloaded normally but provided limited information. The video recorder from the lead locomotive on the eastbound train was not recovered. The video recorder from the lead locomotive of the westbound train was severely damaged by fire. The enclosure was opened and inside were unrecognizable burned and broken small pieces of debris, dust, and ash. (See figure 7.)

NTSB Railroad Accident Report

33

Figure 7. Interior of video recorder hard drive enclosure from lead locomotive of westbound train. Outward-facing video cameras are not required by regulation. However, some railroads are installing them to record conditions related to accidents involving pedestrians and highway-rail grade crossings. Both locomotives in the Goodwell, Oklahoma, accident and the lead locomotive in the April 17, 2011, Red Oak, Iowa, accident (NTSB 2012) had outward-facing video cameras. However, in both accidents, the video data were not available because the recorded data were not stored in crashworthy memory modules and were lost to collision and fire damage. The NTSB believes that it would be a good safety practice for railroads to ensure that data from these cameras are safeguarded. The NTSB concludes that because data from locomotive video cameras are typically not stored in crashworthy memory modules, important operational and safety data are at risk of being lost after an accident. Addressing this risk provides an opportunity for the industry to revisit the best methods to preserve electronic data. In the Red Oak, Iowa, report, the NTSB made the following recommendation to the AAR: Develop a standard that specifies the use of suitable crash-protected memory modules for all new and existing installations of onboard video and audio recorders. The memory modules should meet or exceed the survivability criteria

NTSB Railroad Accident Report

34 specified in Title 49 Code of Federal Regulations Section 229.135, Appendix D, Table 2. (R-12-24) (NTSB 2012) Because valuable information contained in the recorders was destroyed by the collision and subsequent fire in the Goodwell, Oklahoma, accident, the NTSB reiterates Safety Recommendation R-12-24 to the AAR and appreciates the work being done to develop the standard. 1.8.3 In-Cab Audio and Video Recordings Since the late 1990s, the NTSB has recommended that the FRA require audio recorders inside locomotive cabs so that accident investigators can understand the actions of crewmembers just before an accident. As a result of the investigation of the collision between a Maryland Rail Commuter train and an Amtrak train near Silver Spring, Maryland, on February 16, 1996 (NTSB 1997a), in which no operating crewmembers survived, the NTSB was unable to determine whether crewmember activities leading up to the accident contributed to the accident. Consequently, the NTSB made the following safety recommendation to the FRA: Amend 49 Code of Federal Regulations Part 229 to require the recording of train crewmembers’ voice communications for exclusive use in accident investigations and with appropriate limitations on the public release of such recordings. (R-97-9) After the NTSB’s investigation of a Bryan, Ohio, railroad accident that occurred in 1999 (NTSB 2001), with no surviving crewmembers, the NTSB reiterated this safety recommendation. The FRA responded that it … has reluctantly come to the conclusion that this recommendation should not be implemented at the present time. … [The] FRA appreciates that, as time passes and other uses are found for recording media that may create synergies with other public and private purposes, the [NTSB’s] recommendation may warrant re-examination. Based on this response and further meetings, the NTSB classified Safety Recommendation R-97-9 “Closed—Unacceptable Action.” Since the refusal by the FRA to act on the recommendation of in-cab recorders, the NTSB has continued to investigate accidents in which audio recorders, along with video recorders, would have provided valuable information to help determine probable cause and develop safety recommendations. These include the July 10, 2005, collision of two Canadian National Railroad (CN) freight trains in Anding, Mississippi (NTSB 2007), after which the NTSB made the following safety recommendation to the FRA: Require the installation of a crash- and fire-protected locomotive cab voice recorder, or a combined voice and video recorder, (for the exclusive use in accident investigations and with appropriate limitations on the public release of such recordings) in all controlling locomotive cabs and cab car operating compartments. The recorder should have a minimum 2-hour continuous recording

NTSB Railroad Accident Report

35 capability, microphones capable of capturing crewmembers’ voices and sounds generated within the cab, and a channel to record all radio conversations to and from crewmembers. (R-07-3) The NTSB has found that in many accidents, the individuals involved either have limited recollection of events or, as at Goodwell, were killed in the accident. In the September 12, 2008, railroad accident in Chatsworth, California (NTSB 2010), a westbound Southern California Regional Rail Authority Metrolink train collided head-on with an eastbound UP freight train, resulting in 25 fatalities, including the engineer of the Metrolink train, and 101 injuries. For many accidents the NTSB has investigated, a better knowledge of crewmembers’ actions before the accident would have helped reveal key causal factors and facilitated the development of more effective safety recommendations. In the Goodwell accident, video could have shed light on the activities of the crew of the eastbound train leading up to the collision and why the crew did not respond to wayside signals. The NTSB believes that the only reasonable and reliable mechanism for making such observations is an in-cab audio and image recorder that would capture crewmembers’ activities while in the train operating compartment. As a result of the investigation of the Chatsworth accident, the NTSB made two safety recommendations to the FRA: Require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings to verify that train crew actions are in accordance with rules and procedures that are essential to safety as well as train operating conditions. The devices should have a minimum 12-hour continuous recording capability with recordings that are easily accessible for review, with appropriate limitations on public release, for the investigation of accidents or for use by management in carrying out efficiency testing and systemwide performance monitoring programs. (R-10-1) The NTSB reclassified Safety Recommendation R-07-3 “Closed—Unacceptable Action/Superseded” when it issued Safety Recommendation R-10-1 to the FRA. The NTSB also issued the following safety recommendation to the FRA: Require that railroads regularly review and use in-cab audio and image recordings (with appropriate limitations on public release), in conjunction with other performance data, to verify that train crew actions are in accordance with rules and procedures that are essential to safety. (R-10-2) The FRA has acknowledged the value of using audio and imaging technology in locomotives and cab cars; however, it has not taken action to implement the safety recommendations. Until the FRA requires that locomotives and cab cars operated under 49 CFR Part 229 be equipped with crash- and fire-protected inward-facing audio and image recorders, Safety Recommendations R-10-1 and -2 are classified “Open—Unacceptable Response.” The NTSB is concerned that the lack of action by the FRA leaves many safety lessons unlearned and thereby unnecessarily delays improvements in the safe operation of railroads.

NTSB Railroad Accident Report

36 Until the actions of crewmembers during train operations can be meaningfully monitored, the NTSB recognizes that opportunities will be missed to understand and improve safety after some accidents, and the missed opportunities are not infrequent, as discussed below. The rear-end collision of two BNSF trains near Red Oak, Iowa, on April 17, 2011, again demonstrated the need for in-cab recording devices to better understand (and thereby help to prevent) serious railroad accidents that claim the lives of crewmembers, passengers, and the public. In the report on this accident, the NTSB stated that “while video recorders will assist in the investigation of accidents, their value in preventing accidents cannot be overstated” (NTSB 2012) and added that the installation of inward-facing cameras could also assist railroads in monitoring rules compliance and identifying fatigued engineers, which could lead to interventions that could prevent accidents. During the Red Oak accident investigation, NTSB investigators determined, based on medical records, work-rest histories, and event recorder data from the lead locomotive, that the crewmembers of the striking coal train had fallen asleep just before the collision. However, without visual evidence of the crewmembers’ actions during the trip, additional information about the crewmembers’ performance was not available for investigators. In that accident, the NTSB concluded that “had an inward-facing video and audio recorder been installed in the cab of the locomotive of the striking train, additional valuable information about the train crew’s actions before the collision would have been available” (NTSB 2012). Also, in its report on the May 24, 2011, collision of two CSX trains in Mineral Springs, North Carolina (NTSB 2013a), the NTSB stated it was unable to determine why the crew of the striking train failed to comply with a wayside signal, because the crewmembers had been killed and the cab was not equipped with either an inward-facing camera or an audio recorder. The NTSB cannot develop effective recommendations to improve safety when critical elements of information are unavailable to the investigation. In its recent report on the September 30, 2010, collision of two CN trains in Two Harbors, Minnesota, the NTSB noted that appropriate action had not been taken in response to Safety Recommendations R-10-1 and -2 (NTSB 2013b). In the investigation, investigators found that crewmembers of both trains had used cell phones in moving locomotives—a violation of railroad rules and FRA regulations. Moreover, the NTSB urged the FRA to “promptly initiate rulemaking activity for the audio and imaging requirements outlined in Safety Recommendations R-10-1 and -2” (NTSB 2013b) and reiterated these two safety recommendations, noting that FRA action on the recommendations would require locomotive manufacturers to implement important safety improvements. In the Two Harbors, Minnesota, accident report, the NTSB reiterated Safety Recommendations R-10-1 and -2, stating the following: The NTSB is disappointed that more than four years after the deadliest passenger train accident in decades, the FRA has not acted on two recommendations that would protect railroad employees, as well as the public. (NTSB 2013b) The NTSB railroad accident investigations conducted since the issuance of Safety Recommendations R-10-1 and -2 consistently indicate that in-cab audio and video recorders could provide critical information for accident investigations about crew performance

NTSB Railroad Accident Report

37 and the locomotive cab environment. The Goodwell accident demonstrates clearly that in-cab audio and video data, if sufficiently protected from fire and crash damage, could have provided information for understanding the actions of the crew of the eastbound train. Therefore, the NTSB reiterates Safety Recommendations R-10-1 and -2 to the FRA. In its most recent response to the NTSB about Safety Recommendations R-10-1 and -2, on July 31, 2012, the FRA stated that it recognizes the inherent safety value of in-cab cameras and voice recordings for use in accident investigations. However, the FRA also stated that it is aware of “significant privacy concerns” among railroad employees; more specifically, the FRA stated that it fears that implementing Safety Recommendations R-10-1 and -2 might erode railroad employee morale, because some employees suspect that inward-facing cameras and voice recordings might be used for selective enforcement and retaliation by railroad management. Although the importance of management-labor relations is understood, the NTSB has based the two safety recommendations on objective and recurring evidence of significant risks to the safety of railroad employees and the public. Moreover, these safety risks are recognized within the railroad industry itself. The NTSB is aware that the Kansas City Southern Railway Company (KCSR), a Class I freight railroad, expressed intent on April 24, 2013, to install inward-facing cameras into its U.S. locomotives to improve its operational safety by reducing and mitigating the risks of human performance errors in locomotive cabs during train movements. The KCSR has encountered resistance to implementing its plan from two railroad labor unions, the BLET and the UTU, in the U.S. District Court for the Western District of Louisiana, Shreveport Division (Civil Action No. 5:13-cv-838); the case has not yet been resolved. The NTSB is pleased by the proactive initiative of the KCSR to implement inward-facing cameras and recognizes that the inherent safety value of inward-facing cameras and audio recorders applies equally to other Class I freight railroads. Therefore, the NTSB recommends that all Class I railroads install in all controlling locomotive cabs and cab car operating compartments crash- and fire-protected inward- and outward-facing audio and image recorders. The devices should have a minimum 12-hour continuous recording capability. 1.9 Positive Train Control In the NTSB’s nearly 50 years of investigating railroad accidents, including hundreds of train collisions and overspeed derailments, accidents have been caused by mechanical defects, maintenance issues, and track failures. However, the biggest safety challenge is human error, which is an area where technology can be very helpful. Since 2005, the NTSB has completed 16 investigations of railroad accidents that could have been prevented or mitigated with positive train control (PTC). These 16 accidents claimed 52 lives and injured 942 more; the damages totaled hundreds of millions of dollars. In each of these accidents, the NTSB concluded that PTC would have provided critical redundancy that would have prevented the accident. Had such a system been in place where the Goodwell accident occurred, it would have intervened when the eastbound train engineer failed to slow and ultimately stop his train at the red stop signal at the east end of the Goodwell siding. Although human error cannot be completely eradicated, PTC technology is capable of supplementing the human operation of trains. Such systems provide a safety redundancy by slowing or stopping a train that is not being operated in accordance with signal systems and

NTSB Railroad Accident Report

38 operating rules, as was the case in each of the 16 accidents referenced above. For years, PTC has been in place on Amtrak trains in the Northeast and Michigan, but for PTC to reach its greatest safety potential, it must be widely implemented across the United States. Because of the NTSB’s repeated findings that technology-based collision avoidance systems could provide the needed safety redundancy to prevent rail accidents, PTC was placed on the NTSB’s Most Wanted List at the inception of that list in 1990. Following the tragic head-on collision between a passenger train and a freight train in Chatsworth, California, on September 12, 2008, which resulted in 25 fatalities and more than 100 injuries, Congress enacted the Rail Safety Improvement Act of 2008 (RSIA). This law requires each Class I railroad over which poisonous-by-inhalation or toxic-by-inhalation hazardous materials are transported and regularly scheduled intercity or commuter rail passenger transportation travels to implement a PTC system by December 31, 2015. Encouraged by this legislative action, the NTSB’s safety recommendation calling for PTC to be installed on railroads was classified as closed and was removed from the Most Wanted List in October 2008. As a result of the May 2011 rear-end collision between two CSX freight trains in Mineral Springs, North Carolina, and the collision of the two UP trains in Goodwell, Oklahoma, the NTSB added PTC to the 2013 Most Wanted List. The NTSB has long advocated the implementation of PTC systems to prevent train-to-train collisions. NTSB railroad accident investigations over the past 40 years have shown conclusively that the most effective way to avoid train-to-train collisions is through the use of PTC systems that will automatically assume some control of a train when the train crew does not comply with the requirements of a signal indication. Had such a system been in place where this accident occurred, it would have intervened when the eastbound train engineer failed to slow and ultimately stop his train at the red stop signal at the east end of the Goodwell siding. No PTC speed enforcement or stop-signal enforcement is installed in the area where this accident occurred. The UP is in the process of developing a PTC system, which would have prevented this accident if it had been in operation. In a test lab, NTSB investigators simulated the UP’s proposed PTC system based on preliminary versions and using the current configuration of PTC software, simulators, and track profile data. In this testing, a train with characteristics similar to those of the eastbound train approached the stop signal at the east end of the siding at Goodwell, Oklahoma, using the downloaded event recorder data. The screen in the engine of the eastbound train would have displayed the following as the train progressed down the track:  When the lead locomotive was near MP 487.8, the PTC system would have displayed a required stop for the signal at the east end of the siding (MP 483.7).  When the lead locomotive was at MP 487.4, the PTC system would have provided to the train crew visual and audible warnings of a pending enforcement of the required stop.  The PTC system would have continued to provide visual warning to the train crew for about 75 seconds.

NTSB Railroad Accident Report

39  When the lead locomotive was near MP 485.7, the PTC system would have invoked a full-service enforcement brake application.  When the lead locomotive was near MP 484.6, the brake application would have stopped the train. The NTSB concludes that had a PTC system been installed and used on the UP’s Pratt subdivision, this accident would have been prevented. The RSIA mandated that not later than 18 months from the date of enactment, Class I railroads shall develop and submit to the Secretary of Transportation a plan for implementing a positive train control system by December 15, 2015. The plans were due on April 1, 2010, 18 months after the October 1, 2008, enactment date. This mandate applies to the UP track in the accident area. However, progress in the implementation of PTC systems has been slow. 1.9.1 Positive Train Control Forum On February 27, 2013, the NTSB held a forum: “Positive Train Control: Is it on Track?”26 This forum included three panels that addressed three broad issues:  PTC Systems as Envisioned vs. Implemented: The panelists were Grady Cothen, Independent Transportation Consultant; Steven Ditmeyer, Independent Transportation Consultant; Mark Hartong, Ph.D., Senior Scientist and Technical Advisor for Railroad Electronics, FRA; and Gerhard Thelen, Vice President for Operation and Planning, Norfolk Southern, AAR.  Current Status of PTC Regulatory Implementation: The panelists were David Blackmore, Program Manager for Applied Technologies, PTC Specialist, FRA; Frank Lanegro, Vice President of Mechanical, CSX, AAR; Lou Sanders, Director of Technical Services, American Public Transportation Association; Tom Schnautz, President, PTC-220;27 Mark Hartong, Ph.D., Senior Scientist and Technical Advisor for Railroad Electronics, FRA; and Richard Arsenault, Chief Counsel, Mobility Division, Federal Communications Commission (FCC).  Current Status of PTC Technical Implementation: The panelists were Jeffrey Young, PTC Program Manager, UP, AAR; Keith Holt, Deputy Chief Engineer, C&S Amtrak; Mike Baldwin, Director of Research, Brotherhood of Railroad Signalmen; Steven Bruno, Vice President, BLET; Frank Wilson, Wabtec; and Darell Maxey, Metrolink. During the PTC forum, representatives from Norfolk Southern, the UP, and the AAR talked about the issues they had regarding the availability of radio frequency spectrum for use in

26 Information about this forum is available at http://www.ntsb.gov/news/events/2013/ptc/index.html. 27 PTC-220 is a spectrum holding company formed in 2007 that has the seven Class I freight railroads as members.

NTSB Railroad Accident Report

40 PTC systems. Responding to those issues was Richard Arsenault from the FCC. He stated that the FCC issued a public notice to ascertain spectrum needs for PTC, and he discussed the status of spectrum acquisition of some of the transit agencies. He stated that the Metropolitan Transportation Authority has more spectrum than it needs for PTC, with the exception of an area in Connecticut where the agency is still trying to resolve some remaining issues. Mr. Arsenault said that Long Island Railroad has more than adequate spectrum. Southeast Pennsylvania Transit Authority has already acquired the spectrum it needs and will provide some spectrum to New Jersey Transit. Southern California Regional Rail Authority has entered into a leasing arrangement with PTC-220 that was approved by the FCC. Mr. Arsenault said he had met in Chicago with Amtrak, commuter railroads, and PTC-220 to work together to solve any problems they may encounter, noting that Chicago is a good example of how to get the spectrum issue resolved. PTC-220 and Meteorcomm28 have told the FCC that they have software that will enable PTC deployment efficiently and effectively. Mr. Arsenault concluded by telling the rail systems in attendance that if they find an entity that is not responsive to their spectrum needs, the FCC is ready to assist in any way necessary to help solve PTC spectrum problems (NTSB 2013d, 95–98). Throughout the forum, panelists were asked whether their railroads were going to meet the date for PTC implementation stated in the RSIA. Jeff Young, PTC Program Manager for the UP, said that UP management did not expect implementation to be complete by the mandated 2015 date (NTSB 2013d, 141). He stated further that the railroad expects PTC system certification sometime in late 2014 and the system to be approved by the FRA by 2015 (NTSB 2013d, 142). Panelists were reminded that the RSIA was passed into law by Congress in October 2008, and the 2015 implementation date gave the railroads 7 years of lead time to complete PTC implementation (NTSB 2013d, 187). Gerhard Thelen from Norfolk Southern said the railroad likely would not have its PTC system fully implemented until between 2018 and 2020 (NTSB 2013d, 61). Instead of 7 years of lead time for PTC implementation, this would almost double the time to 12 years. Congress has not waived or extended the December 31, 2015, date for PTC implementation. If a railroad fails to meet the statutory requirements of the RSIA, Appendix A to 49 CFR Part 236 lists the penalties for various violations. For failure to complete a PTC system installation on a track segment where PTC is required prior to December 31, 2015, (Section 236.1005) the penalty is $16,000. The penalty for operating a controlling locomotive in PTC territory without a required and operative PTC onboard apparatus (Section 236.1006) is $15,000. The penalty for failure to report the progress toward achieving the railroad’s goal to deploy PTC and equip locomotives on PTC lines is $5,000. The penalty for operation of unequipped trains in PTC territory is $15,000. Every day beyond December 31, 2015, that a railroad fails to comply with the PTC requirements of the RSIA is a failure to meet the requirement. If Congress were to delay the statutory deadline, railroads that had delayed planning PTC implementation would be rewarded and railroads that had moved ahead with planning for PTC implementation by the deadline would essentially be punished. Therefore if Congress were to delay the deadline, the NTSB would encourage the FRA to adjust Appendix A to Part 236 accordingly. However if

28 Meteorcomm is a provider of equipment and services to track, monitor, and control mobile and fixed assets for the railroad industry.

NTSB Railroad Accident Report

41 Congress does not delay the statutory deadline, the NTSB would encourage the FRA to use its regulatory authority to levy the appropriate penalties for all instances of noncompliance. The PTC forum revealed that some railroads are working aggressively toward meeting the 2015 PTC implementation date. When asked specifically, Dr. Hartong of the FRA responded that Amtrak, Alaska Railroad, BNSF, and Metrolink had given every indication that they expect to complete PTC implementation by the 2015 date or earlier (NTSB 2013d, 99). The Amtrak representative spoke about the challenges that his railroad faces with PTC implementation. In a related issue, on December 20, 2012, the FRA issued a report, Railroad Safety: Amtrak Has Made Progress in Implementing Positive Train Control, but Significant Challenges Remain (FRA 2012). This report discussed many PTC-related issues and made recommendations to Amtrak, including the following three:  develop a master project schedule that includes detailed tasks and dependencies and periodically revise it;

 remain engaged with [the] FRA to increase the likelihood that the FRA review process stays on schedule; and

 engage sufficiently at the appropriate level with host railroads and others in the industry to influence developments with I-ETMS [Interoperable Electronic Train Management System] that affect Amtrak. During the PTC forum, NTSB Board Members asked who is overseeing the timelines and milestones for overall PTC implementation and progress, where is that information kept, and is it accessible to the public? In response, Dr. Hartong from the FRA said that the FRA continues to monitor progress for each railroad in the PTC implementation plan, as required. However, he added that there is no general oversight of implementation, and each railroad is responsible for its own plan (NTSB 2013d, 62–64). Although railroads appear to be making slow progress toward PTC implementation, the PTC forum made clear that an overall timeline and milestones do not exist, and that data on the railroads’ progress toward PTC implementation are neither transparent nor available to the public. During the PTC forum many railroad representatives stated that their railroads could not achieve PTC implementation by the 2015 date contained in the RSIA, but they provided no details of their progress to date or their overall implementation plans. The NTSB therefore concludes that if all railroads required to implement PTC provided frequent updates to the FRA on the progress of PTC implementation, the FRA and the public would be better able to follow the progress and estimate when railroads will come into compliance with the mandates in the RSIA. Therefore, the NTSB recommends that all railroads subject to the PTC provisions of the RSIA provide PTC implementation update reports to the FRA every 6 months until PTC implementation is complete. The update reports should consist of two sections: components and training. The components section should include a description of the PTC component to be implemented, the number of components, the number of components completed on the report

NTSB Railroad Accident Report

42 date, the number of components that remain to be completed, the overall completion percentage, and the estimated completion date. Components are defined as locomotives, wayside units, switches, base station radios, wayside radios, locomotive radios, and any new and novel technologies that are part of a PTC system. The training section should include the number of safety-related employees and equivalent railroad carrier contractors and subcontractors that need to be trained, by class and craft; minimum training standards for those employees and contractors, meaning the knowledge of and ability to comply with federal railroad safety laws and regulations and carrier rules and procedures to implement PTC; the percentage of employees who have completed training; the percentage of employees who remain to be trained; and the estimated date that training will be completed. The NTSB further recommends that the FRA publish the PTC implementation update reports submitted by all railroads subject to the PTC provisions of the RSIA and make the reports available on the FRA website within 30 days of report receipt.

NTSB Railroad Accident Report

43 2 Conclusions 2.1 Findings

1. The following were not factors in the accident: the weather; the condition of the track, the

locomotives, or the railcars; the signal system; cell phone use by any of the crewmembers; or drug or alcohol use by the conductor of the westbound train.

1. For undetermined reasons the conductor of the eastbound train was disengaged from

performing his duties as the train passed the advance approach, approach, and stop signals.

1. Both crewmembers of the eastbound train failed to maintain proper crew coordination and

jointly failed to make proper decisions and actions to control the train safely.

1. There is an adequate foundation of guidance and opportunity for railroads to develop and

deploy crew resource management programs.

1. Had crewmembers of the eastbound train received training in and practiced the principles of

crew resource management, they likely would have demonstrated improved coordination, communication, and discipline while operating the train.

1. A nonpunitive peer audit program is an important element of an effective safety

management system and would provide railroads with opportunities to better understand and address operational safety issues.

1. Had the Union Pacific Railroad established, maintained, and enforced a safety management

system, it is likely that this accident may have been avoided.

1. Insufficient information was available to determine whether fatigue of the eastbound crew

was a factor in the accident.

1. The results from required medical examinations and Union Pacific Railroad conversations

with the engineer’s health care providers demonstrated to the Union Pacific Railroad that the eastbound train engineer’s vision had significantly deteriorated because of a chronic medical condition.

1. The engineer of the eastbound train was unable to visually detect and correctly interpret the

wayside signals.

1. The Union Pacific Railroad failed to adhere to its policy requiring written documentation

from an outside source to verify visual acuity and failed to perform follow-up testing recommended by its own chief medical officer, either of which would have helped ensure that vision standards were continuously being met.

NTSB Railroad Accident Report

44

1. The Union Pacific Railroad routinely relies on a color vision field test of unknown validity,

reliability, and comparability for medical certification of employees in safety-sensitive positions.

1. The field test used by the Union Pacific Railroad fails to ensure that Union Pacific Railroad

employees have adequate color perception to perform in safety-sensitive positions.

1. Color vision field tests used after standardized color vision tests have been failed are not

defined in Federal Railroad Administration regulations to ensure valid, reliable, and comparable assessments.

1. Medical certification requirements identifying chronic conditions with the potential to

deteriorate dangerously, such as glaucoma, and increased frequency of medical evaluation for those conditions would very likely have identified the further decline in the eastbound engineer’s vision and would have decertified him prior to this accident.

1. Upgrading Federal Railroad Administration medical certification requirements for

employees in safety-sensitive positions to include comprehensive health examinations, standardized testing across the industry, and centralized oversight of certification decisions when initial testing is failed, as well as more frequent medical certification when an employee has a condition with the potential to deteriorate, would improve transportation safety.

1. Redundant storage of event data provided critical data to the accident investigation that

would have been otherwise unavailable.

1. Because data from locomotive video cameras are typically not stored in crashworthy

memory modules, important operational and safety data are at risk of being lost after an accident.

1. Had a positive train control system been installed and used on the Union Pacific Railroad’s

Pratt subdivision, this accident would have been prevented.

1. If all railroads required to implement positive train control provided frequent updates to the

Federal Railroad Administration on the progress of positive train control implementation, the Federal Railroad Administration and the public would be better able to follow the progress and estimate when railroads will come into compliance with the mandates in the Rail Safety Improvement Act of 2008. 2.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the eastbound Union Pacific Railroad train crew’s lack of response to wayside signals because of the engineer’s inability to see and correctly interpret the signals; the conductor’s disengagement from his duties; and the lack of positive train control, which would have stopped the train and prevented the collision regardless of the crew’s inaction. Contributing

NTSB Railroad Accident Report

45 to the accident was a medical examination process that failed to decertify the engineer before his deteriorating vision adversely affected his ability to operate a train safely.

NTSB Railroad Accident Report

46 3 Recommendations 3.1 New Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Railroad Administration: Determine what constitutes a valid, reliable, and comparable field test procedure for assessing the color discrimination capabilities of employees in safety-sensitive positions. (R-13-18) When you have made the determination in Safety Recommendation R-13-18, require railroads to use a valid, reliable, and comparable field test procedure for assessing the color discrimination capabilities of employees in safety-sensitive positions. (R-13-19) Require more frequent medical certification exams for employees in safety-sensitive positions who have chronic conditions with the potential to deteriorate sufficiently to impair safe job performance. (R-13-20) Develop medical certification regulations for employees in safety-sensitive positions that include, at a minimum, (1) a complete medical history that includes specific screening for sleep disorders, a review of current medications, and a thorough physical examination; (2) standardization of testing protocols across the industry; and (3) centralized oversight of certification decisions for employees who fail initial testing; and consider requiring that medical examinations be performed by those with specific training and certification in evaluating medication use and health issues related to occupational safety on railroads. (R-13-21) Require all information captured by any required recorder to also be recorded in another location remote from the lead locomotive(s) to minimize the likelihood of the information’s being unrecoverable as a result of an accident. (R-13-22) Publish the positive train control implementation update reports submitted by all railroads subject to the positive train control provisions of the Rail Safety Improvement Act of 2008 and make the reports available on your website within 30 days of report receipt. (R-13-23) To the Brotherhood of Locomotive Engineers and Trainmen: Work with the Union Pacific Railroad and the United Transportation Union to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety for the Union Pacific Railroad. (R-13-24)

NTSB Railroad Accident Report

47 To the United Transportation Union: Work with the Union Pacific Railroad and the Brotherhood of Locomotive Engineers and Trainmen to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety for the Union Pacific Railroad. (R-13-25) To All Class I Railroads: Install in all controlling locomotive cabs and cab car operating compartments crash- and fire-protected inward- and outward-facing audio and image recorders. The devices should have a minimum 12-hour continuous recording capability. (R-13-26) To All Railroads Subject to the Positive Train Control Provisions of the Rail Safety Improvement Act of 2008: Provide positive train control implementation update reports to the Federal Railroad Administration every 6 months until positive train control implementation is complete. The update reports should consist of two sections: components and training. The components section should include a description of the positive train control component to be implemented, the number of components, the number of components completed on the report date, the number of components that remain to be completed, the overall completion percentage, and the estimated completion date. Components are defined as locomotives, wayside units, switches, base station radios, wayside radios, locomotive radios, and any new and novel technologies that are part of a positive train control system. The training section should include the number of safety-related employees and equivalent railroad carrier contractors and subcontractors that need to be trained, by class and craft; minimum training standards for those employees and contractors, meaning the knowledge of and ability to comply with federal railroad safety laws and regulations and carrier rules and procedures to implement positive train control; the percentage of employees who have completed training; the percentage of employees who remain to be trained; and the estimated date that training will be completed. (R-13-27) To Union Pacific Railroad: Work with the Brotherhood of Locomotive Engineers and Trainmen and the United Transportation Union to develop and implement a nonpunitive peer audit program focused on rule compliance and operational safety. (R-13-28) Develop and implement a plan to establish a safety management system, which incorporates crew resource management. (R-13-29) Audit your medical records to ensure that all personnel in safety-sensitive positions have adequate documentation of appropriate medical testing. (R-13-30)

NTSB Railroad Accident Report

48 Replace your color vision field test with a test that has established and acceptable levels of validity, reliability, and comparability to ensure that certified employees in safety-sensitive positions have sufficient color discrimination to perform safely. (R-13-31) Until you have implemented a validated, reliable, and comparable color vision field test, perform a safety analysis and undertake measures to manage the risk created by the use of an inadequate test. Such measures might include, but are not limited to, restricting crewmembers who have failed primary color vision testing to yard assignments or unsignaled territory. (R-13-32) Once your replacement color vision field test is implemented, retest all certified Union Pacific Railroad employees in safety-sensitive positions who failed the primary color vision testing on their last medical certification exam using the new procedure. (R-13-33) 3.2 Previously Issued Recommendations Reiterated in this Report As a result of this accident investigation, the National Transportation Safety Board reiterates the following previously issued safety recommendations: To the Federal Railroad Administration: Require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings to verify that train crew actions are in accordance with rules and procedures that are essential to safety as well as train operating conditions. The devices should have a minimum 12-hour continuous recording capability with recordings that are easily accessible for review, with appropriate limitations on public release, for the investigation of accidents or for use by management in carrying out efficiency testing and systemwide performance monitoring programs. (R-10-1 classified “Open―Unacceptable Response”) Require that railroads regularly review and use in-cab audio and image recordings (with appropriate limitations on public release), in conjunction with other performance data, to verify that train crew actions are in accordance with rules and procedures that are essential to safety. (R-10-2 classified “Open―Unacceptable Response”)

NTSB Railroad Accident Report

49 To the Association of American Railroads: Develop a standard that specifies the use of suitable crash-protected memory modules for all new and existing installations of onboard video and audio recorders. The memory modules should meet or exceed the survivability criteria specified in Title 49 Code of Federal Regulations Section 229.135, Appendix D, Table 2. (R-12-24 classified “Open—Initial Response Received”) 3.3 Previously Issued Recommendations Reclassified in This Report As a result of this accident investigation, the National Transportation Safety Board reclassifies from “Open—Acceptable Response” to “Closed―Unacceptable Action/Superseded,” by Safety Recommendation R-13-21, the following safety recommendations to the Federal Railroad Administration: Develop a standard medical examination form that includes questions regarding sleep problems and require that the form be used, pursuant to Title 49 Code of Federal Regulations Part 240, to determine the medical fitness of locomotive engineers; the form should also be available for use to determine the medical fitness of other employees in safety-sensitive positions. (R-02-24) Require that any medical condition that could incapacitate, or seriously impair the performance of, an employee in a safety-sensitive position be reported to the railroad in a timely manner. (R-02-25) Require that, when a railroad becomes aware that an employee in a safety-sensitive position has a potentially incapacitating or performance-impairing medical condition, the railroad prohibit that employee from performing any safety-sensitive duties until the railroad’s designated physician determines that the employee can continue to work safely in a safety-sensitive position. (R-02-26)

NTSB Railroad Accident Report

50

Vice Chairman Hart filed the following concurring statement on June 24, 2013; Member Weener filed the following concurring statement on June 20, 2013.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: June 18, 2013

NTSB Railroad Accident Report

51 Board Member Statements Vice Chairman Christopher A. Hart, concurring

I concur with the findings, probable cause, and recommendations in this accident report, but I would like to address an ancillary issue that came to my attention as a result of the investigation of this accident – namely, that reports about running red signals are excluded from the protections of the FRA’s Confidential Close Call Reporting System (C3RS). The railroad industry, to its credit, has created a near-miss reporting program, the C3RS. Near-miss reporting programs have been very successful in other industries, most notably in aviation. Among the objectives of near-miss reporting programs are (a) providing a source of information about things that almost went wrong or almost resulted in a mishap, and (b) providing information about why something almost went wrong or almost resulted in a mishap. The first objective can be very important, especially if the near-miss reporting program is the only source of information about something that went wrong; but the second objective is always very important because knowing why something went wrong is crucial to developing an effective intervention to stop the problem from recurring in the future. Near-miss reporting programs are as successful as they are because, with some important exceptions, they generally protect the provider of information from being punished based upon the information provided. The theory of the protection is that the best way, and sometimes the only way, to find out about defects in a complex system is from the people who operate the system; but the people who operate the system are obviously reluctant to provide any information that might be used against them. Contrary to popular belief, however, near-miss reporting programs do not provide “get out of jail free” cards to those who submit reports because most programs expressly deny protection for information about intentional or criminal wrongdoing, and many also exclude information about accidents. Significantly, other than with respect to accidents, these denials of protection are generally based upon the intent of the operator (or upon something within the operator’s control that affects intent, such as substance abuse), rather than upon the type of event. Running a red signal significantly increases the likelihood of injury or worse, and train crews are obviously well aware of that. Hence, it is safe to assume that train crews do not run red signals intentionally. Moreover, it was revealed in the public hearing for this accident that, despite various efforts to stop the problem, the rate of running red signals is not generally improving. As a result, two significant questions arise – namely, why are competent, highly trained professionals doing something that they know may cause them harm or worse, and why is this problem so resistant to an effective solution? In order for the industry to make meaningful progress on the rate of red-signal running, safety and operations experts must know why the problem keeps occurring; and the best source of information about why the problem keeps occurring, and very often the only source of information about why the problem keeps occurring, is the crews who have run signals. Until

NTSB Railroad Accident Report

52 the information about why red signals are being run is protected by C3RS, the industry will not have the information it needs to develop and implement effective remedies. Accordingly, I would urge the FRA and the railroad industry to use the intent of the operator, rather than the nature of the event, to determine eligibility for C3RS protection, and hence to provide protection to those who report about red-signal running unless there is criminal or intentional wrongdoing. Once the industry begins to find out why red signals are being run, it can begin, finally, to understand this nagging problem enough to develop effective solutions that will help eliminate it.

Chairman Hersman and Members Sumwalt, Rosekind, and Weener joined in this statement.

NTSB Railroad Accident Report

53 Member Earl F. Weener, concurring: I support the accident report concerning the head-on collision of the two Union Pacific Railroad Company freight trains occurring near Goodwell, Oklahoma. Sadly, as we have seen before in other rail accidents, this accident did not need to happen. There were numerous opportunities for intervention prior to the accident; and yet, with likely the best of intentions of helping out a colleague, instead three people lost their lives. From my tenure as an advocate for safety in the corporate environment, non-profit environment and the government environment, I am troubled by this outcome. It begs the question: why is there such disparity in approaches to safety between the railroad industry and other transportation modes?

From a general standpoint, a basic survey of the safety regulatory schemes and industry practices applicable to the various modes clearly indicates the railroad industry, with some exceptions, lags behind the more developed, sophisticated frameworks applied in other transportation modes. For example, as the report documents, with limited exceptions, the medical requirements for the aviation, commercial trucking and marine industries far exceed those of the rail industry both in scope and specificity. As well, in terms of safety concepts such as safety management systems (SMS), crew resource management, and fatigue risk management, other modes appear to be engaged in more aggressive action to mitigate risk, whether through government intervention or by industry initiative. Additionally, from a technology perspective, aviation has made significant strides toward mitigating safety risks through the advancement of technologies such as traffic collision avoidance systems (T-CAS) and terrain awareness and warning systems (TAWS), and commercial vehicles are benefitting from advancements in stability control and collision avoidance technology, yet we see efforts in the rail industry to delay and confound implementation of technology such as positive train control.

In attempting to understand this disparity between the rail industry’s approach to safety and other modal approaches I considered both the history and evolution of the various transportation modes, as well as the operational differences between them. However, I have yet to find justification for the diverging views. On the one hand, there is the marine industry, with its time honored history and tradition, which has nonetheless managed to embrace risk management principles and innovation. Alternatively, the relatively young aviation industry often appears to be leading the curve as far as developing and advancing safety concepts and spurring technological advancements. Similarly, all modes of transportation share common operational challenges, although there may be unique characteristics to each mode which require the development of appropriate mitigations to address these challenges. Nonetheless, as demonstrated by implementation of SMS concepts and fatigue risk management programs across modal operations, there is more commonality than distinction among the transportation modes when it comes to advancing safety.

Also, from a business standpoint, safety just makes good sense. As industry leaders from the marine and aviation modes have learned, companies that cannot manage safety are unlikely to manage a profitable company. This maxim takes into account more than costs related to a specific accident; it also involves the costs associated with day-to-day operations such as work force loss or injury, insurance premiums, company reputation, lost productivity, and environmental stewardship. In other words, safety must be managed, just as other functions of a

NTSB Railroad Accident Report

54 company’s operation are managed. In all, development of a sound safety culture, a dedicated approach to safety, leads to cost savings rather than costs on the company’s bottom line.

As is often quoted, “safety culture is enlightened self-interest.” Candidly, after reviewing accident investigations for the derailment and subsequent hazardous materials fire at Cherry Valley, Illinois; the collision of coal train with a maintenance-of-way equipment train in Red Oak, Iowa; the collision of two freight trains at Two Harbors, Minnesota; and this accident, along with participating in the Board’s forum on positive train control, it appears the rail industry could stand some enlightenment.

Vice Chairman Hart and Member Sumwalt joined in this statement.

NTSB Railroad Accident Report

55 Appendix: Investigation and Hearing The NTSB was notified on June 24, 2012, of the collision of two UP trains near Goodwell, Oklahoma. The NTSB launched an investigator-in-charge and eight other investigative team members from its headquarters and from its Los Angeles and Chicago regional offices. Mark R. Rosekind was the NTSB Board Member on scene. The FRA; the UP; the BLET; the UTU; Electro-Motive Diesel, Inc.; and the Guymon, Oklahoma, Fire Department were parties to the investigation. An en banc investigative hearing for this accident investigation was held at NTSB headquarters on February 26, 2013. This hearing addressed three broad issues: (1) an overview of the accident, investigation, and the UP’s railroad system; (2) the UP’s management of human error; and (3) the current status of the UP’s PTC implementation. The parties to the hearing were the FRA, the UP, the BLET, and the UTU. The transcript of the hearing proceeding is available in the public docket.

NTSB Railroad Accident Report

56 References Colblinder. 2013. “Online Farnsworth D-15 Colorblindness Test.” http://www.colblindor.com/2009/03/10/online-farnsworth-d-15-dichotomous-color- blindness-test/. Accessed April 9, 2013. Colorblindness. 2013. "Colorblindness: Information: Identification: Solutions. http://www.colour-blindness.com/colour-blindness-tests/ishihara-colour-test-plates/. Accessed April 10, 2013. FAA (Federal Aviation Administration). 2013. Guide for Aviation Medical Examiners. http://www.faa.gov/about/office_org/headquarters_offices/avs/offices/aam/ame/guide/me dia/guide.pdf. Accessed April 9, 2013. Federal Register. 2013. Vol. 78, no. 63 (April 2). ----. 2011. Vol. 76, no. 168 (August 30). ----. 2008. Vol. 73, no. 231 (December 1). FRA (Federal Railroad Administration). 2012. Railroad Safety: Amtrak Has Made Progress in Implementing Positive Train Control, but Significant Challenges Remain. Washington, DC: OIG–E–2013–03. ----. 2005. Medical Standards for Railroad Workers (Final Report). Washington, DC: DOT/FRA/RRS–05/01. NHBLI (National Heart, Blood and Lung Institute). “Calculate Your Body Mass Index,” accessed June 5, 2013, http://www.nhlbi.nih.gov/guidelines/obesity/BMI/bmicalc.htm. NIAAA (National Institute on Alcohol Abuse and Alcoholism). 2013. Alcohol’s Effects on the Body. Accessed February 4, 2013. http://www.niaaa.nih.gov/alcohol-health/alcohols-effects-body. NTSB (National Transportation Safety Board). 2013a. CSX Transportation (CSX) Freight Train Strikes Stopped CSX Freight Train Near Mineral Springs, North Carolina, May 24, 2011. Railroad Accident Brief RAB-13/01. Washington, DC: NTSB. ----. 2013b. Collision of Two Canadian National Railway Freight Trains near Two Harbors, Minnesota, September 30, 2010. Railroad Accident Report RAR-13/01. Washington, DC: NTSB. ----. 2013c. Transcript of Investigative Hearing on Head-on Collision of Two Union Pacific Railroad Company Freight Trains Near Goodwell, Oklahoma, June 24, 2012. February 26, 2013. Washington, DC: NTSB. ----. 2013d. Transcript of “Positive Train Control: Is it on Track?” Forum. February 27, 2013. Washington, DC: NTSB.

NTSB Railroad Accident Report

57 ----. 2012. Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train, Red Oak, Iowa, April 17, 2011. Railroad Accident Report RAR-12/02. Washington, DC: NTSB. ----. 2010. Collision of Metrolink Train 111 and Union Pacific Train LOF65-12, Chatsworth, California, September 12, 2008. Railroad Accident Report RAR-10/01. Washington, DC: NTSB. ----. 2007. Collision of Two CN Freight Trains, Anding, Mississippi, July 10, 2005. Railroad Accident Report RAR-07/01. Washington, DC: NTSB. ----. 2002. Collision of Two Canadian National/Illinois Central Railway Trains Near Clarkston, Michigan, November 15, 2001. Railroad Accident Report RAR-02/04. Washington, DC: NTSB. ----. 2001. Collision Involving Three Consolidated Rail Corporation Freight Trains Operating in Fog on a Double Main Track, Near Bryan, Ohio, January 17, 1999. Railroad Accident Report RAR-01/01. Washington, DC: NTSB. ----. 1999. Collision of Norfolk Southern Corporation train 255L5 with Consolidated Rail Corporation Train TV 220, Butler, Indiana, March 25, 1998, Railroad Accident Report RAR-99/02. Washington, DC: NTSB. ----. 1998. Collision and Derailment of Union Pacific Railroad Freight Trains 5981 North and 9186 South, In Devine, Texas, June 22, 1997. Railroad Accident Report RAR-98/02. Washington, DC: NTSB. ----. 1997a. Collision and Derailment of Maryland Rail Commuter MARC Train 286 and National Railroad Passenger Corporation AMTRAK Train 29, Near Silver Spring, Maryland, February 16, 1996. Railroad Accident Report RAR-97/02. Washington, DC: NTSB. ----. 1997b. Near Head-On Collision and Derailment of Two New Jersey Transit Commuter Trains Near Secaucus, New Jersey, February 9, 1996. Railroad Accident Report RAR-97/01. Washington, DC: NTSB. UP (Union Pacific Railroad). 2010. General Code of Operating Rules. Sixth Edition. Omaha, NE: Union Pacific Railroad.

FD07416 ｜ 2014_美国_AAR1401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Descent Below Visual Glidepath and Impact With Seawall Asiana Airlines Flight 214 Boeing 777-200ER, HL7742 San Francisco, California July 6, 2013

Accident Report NTSB/AAR-14/01 PB2014-105984

National Transportation Safety Board

NTSB/AAR-14/01 PB2014-105984 Notation 8518 Adopted June 24, 2014

Aircraft Accident Report Descent Below Visual Glidepath and Impact With Seawall Asiana Airlines Flight 214 Boeing 777-200ER, HL7742 San Francisco, California July 6, 2013

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, D.C. 20594

National Transportation Safety Board. 2014. Descent Below Visual Glidepath and Impact With Seawall, Asiana Airlines Flight 214, Boeing 777-200ER, HL7742, San Francisco, California, July 6,

1. Aircraft Accident Report NTSB/AAR-14/01. Washington, DC.

Abstract: This report discusses the July 6, 2013, accident involving a Boeing 777-200ER, Korean registration HL7742, operating as Asiana Airlines flight 214, which was on approach to runway 28L when it struck a seawall at San Francisco International Airport (SFO), San Francisco, California. Three of the 291 passengers were fatally injured; 40 passengers, 8 of the 12 flight attendants, and 1 of the 4 flight crewmembers received serious injuries. The other 248 passengers, 4 flight attendants, and 3 flight crewmembers received minor injuries or were not injured. The airplane was destroyed. Safety issues relate to the need for Asiana pilots to adhere to standard operating procedures regarding callouts; reduced design complexity and enhanced training on the airplane’s autoflight system; opportunity at Asiana for new instructors to supervise trainee pilots in operational service during instructor training; guidance for Asiana pilots on use of flight directors during a visual approach; more manual flight for Asiana pilots; a context-dependent low energy alert; research that examines the injury potential from significant lateral forces in airplane crashes and the mechanism that produces high thoracic spinal injuries; evaluation of the adequacy of slide/raft inertia load certification testing; aircraft rescue and firefighting (ARFF) training for officers in command of an aircraft accident response; guidance on when to use a skin-piercing nozzle on a burning airplane fuselage; integration of the medical supply buses at SFO into the airport’s preparation drills; guidance or protocols for ensuring the safety of passengers and crew at risk of a vehicle strike during ARFF operations; requirements for ARFF staffing; improvements in SFO emergency communications; and increased Federal Aviation Administration (FAA) oversight of SFO’s emergency procedures manual. Safety recommendations are addressed to the FAA, Asiana Airlines, Boeing, the ARFF Working Group, and the City of San Francisco.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2014-105984 from:

National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of any part of an NTSB report related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB

Aircraft Accident Report

i Contents Figures .............................................................................................................................................v Tables ............................................................................................................................................ vi Abbreviations .............................................................................................................................. vii Executive Summary ..................................................................................................................... xi

1. Factual Information ...................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Injuries to Persons ....................................................................................................................13
4. 3 Damage to Airplane .................................................................................................................13
5. 4 Other Damage ..........................................................................................................................14
6. 5 Personnel Information ..............................................................................................................14
7. 5.1 The Pilot Flying .............................................................................................................14
8. 5.1.1 The Pilot Flying’s Preaccident Activities ........................................................15
9. 5.2 The Pilot Monitoring .....................................................................................................16
10. 5.2.1 The Pilot Monitoring’s Preaccident Activities ................................................18
11. 5.3 The Observer .................................................................................................................18
12. 5.3.1 The Observer’s Preaccident Activities.............................................................19
13. 5.4 The Flight Attendants ....................................................................................................19
14. 6 Airplane Information ...............................................................................................................19
15. 6.1 General ...........................................................................................................................19
16. 6.2 Instrument Panel Displays .............................................................................................20
17. 6.3 Automatic Flight Control System ..................................................................................22
18. 6.3.1 Autopilot Flight Director System.....................................................................23
19. 6.3.2 Autothrottle ......................................................................................................25
20. 6.3.3 Flight Mode Annunciator .................................................................................25
21. 6.3.4 Autopilot and Autothrottle Pairing ..................................................................26
22. 6.3.5 Autothrottle Automatic Engagement ...............................................................27
23. 6.4 Airspeed Awareness and Low Airspeed Alerting Features ...........................................28
24. 6.4.1 Airspeed Awareness.........................................................................................28
25. 6.4.2 Low Airspeed Alerting Systems ......................................................................29
26. 7 Meteorological Information .....................................................................................................30
27. 8 Aids to Navigation ...................................................................................................................30
28. 9 Communications ......................................................................................................................30
29. 10 Airport Information ................................................................................................................30
30. 10.1 Emergency Plan and Drills ..........................................................................................32
31. 10.2 Minimum Safe Altitude Warning System ...................................................................32
32. 11 Flight Recorders .....................................................................................................................33
33. 11.1 Cockpit Voice Recorder ..............................................................................................33
34. 11.2 Flight Data Recorder....................................................................................................33
35. 11.3 Quick Access Recorder ................................................................................................34

NTSB

Aircraft Accident Report

ii 1.12 Wreckage and Impact Information ........................................................................................34 1.13 Medical and Pathological Information...................................................................................35 1.13.1 Fatalities .......................................................................................................................35 1.13.2 Survivors ......................................................................................................................35 1.13.3 Flight Crew Toxicological Testing ..............................................................................36 1.14 Fire .........................................................................................................................................36 1.15 Survival Aspects ....................................................................................................................37 1.15.1 General .........................................................................................................................37 1.15.2 Seatbelt Compliance ....................................................................................................39 1.15.3 Evacuation of Passengers and Crewmembers .............................................................40 1.15.4 Emergency Response ...................................................................................................42 1.15.4.1 Incident Command .........................................................................................44 1.15.4.2 Firefighting Tactics ........................................................................................45 1.15.4.3 Communication Problems ..............................................................................47 1.15.4.4 Aircraft Rescue and Firefighting Training .....................................................49 1.15.4.5 Triage .............................................................................................................49 1.15.5 Injury Severity .............................................................................................................51 1.15.6 Doors and Slide/Rafts ..................................................................................................52 1.15.6.1 Slide/Raft Information ...................................................................................52 1.15.6.2 Door and Slide/Raft Performance ..................................................................53 1.15.6.3 Slide/Raft Maintenance Information ..............................................................54 1.15.7 Cabin Damage .............................................................................................................55 1.16 Tests and Research .................................................................................................................56 1.16.1 Airplane Performance Study and Simulator Evaluations ............................................56 1.16.1.1 Workstation Simulation .................................................................................57 1.16.1.2 Pilot-in-the-Loop Simulation .........................................................................58 1.16.2 Mode Control Panel Examination ...............................................................................58 1.16.3 Autothrottle Component Examination .........................................................................59 1.16.4 Enhanced Ground Proximity Warning System ............................................................59 1.16.5 Slide/Raft Examination and Testing ............................................................................60 1.16.5.1 Slide/Raft Release Mechanism Examination .................................................60 1.16.5.2 Slide/Raft Certification Information ..............................................................60 1.16.5.3 Slide/Raft Tests ..............................................................................................60 1.17 Organizational and Management Information .......................................................................61 1.17.1 Pilot Standard Operating Procedures ...........................................................................61 1.17.1.1 Use of Automation .........................................................................................62 1.17.1.2 Descent Procedures ........................................................................................63 1.17.1.3 Visual Approach ............................................................................................63 1.17.1.4 Stabilized Approach and Go-Around .............................................................64 1.17.1.5 Flight Crew Duties During Approach ............................................................65 1.17.1.6 Expected Pitch and Power on Final Approach ..............................................66 1.17.1.7 Evacuation......................................................................................................66 1.17.2 Flight Crew Training ...................................................................................................67 1.17.2.1 Autothrottle Function Training ......................................................................67 1.17.2.2 Asiana Pilots’ Statements about A/T Function ..............................................68 1.17.2.3 Stall Protection Demonstration ......................................................................69

NTSB

Aircraft Accident Report

iii 1.17.2.4 Flight Director Use During Visual and Circling Approaches ........................69 1.17.2.5 Instructor Pilot Training .................................................................................70 1.17.3 Regulatory Oversight ...................................................................................................70 1.18 Additional Information ..........................................................................................................71 1.18.1 Postaccident Safety Action ..........................................................................................71 1.18.1.1 Asiana Airlines...............................................................................................71 1.18.1.2 City and County of San Francisco .................................................................72 1.18.2 Boeing Certification Issue Involving A/T Automatic Engagement Logic ..................73 1.18.3 Federal Aviation Administration Actions About Manual Flight Operations ..............74 1.18.4 Federal Aviation Administration Guidance on Use of HRET .....................................75 1.18.5 Postaccident Flight Crew Toxicological Testing Requirements .................................75

1. Analysis .....................................................................................................................................77
2. 1 General .....................................................................................................................................77
3. 2 Accident Sequence ...................................................................................................................78
4. 2.1 Approach from 14 to 5 nm from the Runway................................................................78
5. 2.2 Approach from 5 nm to the Runway .............................................................................79
6. 3 Flight Crew Performance .........................................................................................................85
7. 3.1 Fatigue ...........................................................................................................................85
8. 3.2 Flight Crew Communication .........................................................................................87
9. 3.3 Flight Crew Monitoring .................................................................................................88
10. 3.4 Go-Around Decision-Making ........................................................................................90
11. 4 Autoflight System Training and Design ..................................................................................93
12. 4.1 Autoflight System Training ...........................................................................................93
13. 4.2 Autoflight System Design ..............................................................................................96
14. 5 Pilot Training ...........................................................................................................................98
15. 5.1 Visual Approach Training .............................................................................................98
16. 5.2 Instructor Pilot Training ..............................................................................................100
17. 6 Operations Issues ...................................................................................................................101
18. 6.1 Cycling of Flight Director Switches ............................................................................101
19. 6.2 Manual Flight ...............................................................................................................102
20. 7 Low Energy Alert ..................................................................................................................104
21. 8 Survival Aspects ....................................................................................................................107
22. 8.1 Accident Survivability .................................................................................................107
23. 8.1.1 Evacuation......................................................................................................107
24. 8.1.2 Fatalities .........................................................................................................108
25. 8.1.3 Injuries ...........................................................................................................111
26. 8.1.4 Accident Survivability Summary ...................................................................113
27. 8.2 Slide/Raft Performance ................................................................................................114
28. 8.2.1 Slide/Rafts 1R and 2R ....................................................................................114
29. 8.2.2 Slide/Rafts 3L and 3R ....................................................................................115
30. 8.2.3 Slide/Rafts 4L and 4R ....................................................................................115
31. 8.3 Emergency Response ...................................................................................................116
32. 8.3.1 Firefighting Tactics and Use of High-Reach Extendable Turrets ..................116
33. 8.3.2 Medical Response Issues ...............................................................................117
34. 8.3.3 Staffing ...........................................................................................................120
35. 8.3.4 Incident Command .........................................................................................121

NTSB

Aircraft Accident Report iv

1. 8.3.5 Communication…………………………………………………………………123

1. 8.3.6 Airport Emergency Procedures Manual………………………………………...125

Conclusions……………………………………………………………………….…………126 3.1. Findings……………………………………………………………………………………126 3.2 Probable Cause……………………………………………………………………………...129

Recommendations………………………………………………………………………..…130

Board Member Statements…………………………………………………………………...134

References…………………………………………………………………………...…………146

• Appendixes……………………………………………………………………………...…..148

Appendix A: Investigation and Hearing………………………………………………………..148 Appendix B: Cockpit Voice Recorder Transcript………………………………………..……..149 Appendix C: The Republic of Korea Aviation and Railway Accident Investigation Board Comments…………………………………………………………………………………...….182 NTSB

Aircraft Accident Report

v Figures Figure 1. Map of the accident location........................................................................................... 1 Figure 2. Diagram of cockpit showing flight crew roles. .............................................................. 2 Figure 3. Instrument approach chart for the SFO runway 28L ILS or LOC Z procedure. ............ 4 Figure 4. Profile view of the last 40 seconds of flight 214. ..........................................................11 Figure 5. Aerial view of the flight 214 wreckage. ....................................................................... 13 Figure 6. 777 instrument panel. ................................................................................................... 21 Figure 7. 777 navigation display depicting information for the approach to SFO. ..................... 22 Figure 8. 777 mode control panel. ............................................................................................... 23 Figure 9. 777 flight mode annunciator. ........................................................................................ 26 Figure 10. 777 indicated airspeed display. ................................................................................... 29 Figure 11. Fire damage to the fuselage of flight 214. .................................................................. 37 Figure 12. Diagram of flight 214’s cabin configuration. ............................................................. 38 Figure 13. Slide/raft components. ................................................................................................ 52 Figure 14. Automation sequence from 1,850 to 1,330 ft msl. ..................................................... 80 Figure 15. Location where ejected occupants were found. ........................................................ 109

NTSB

Aircraft Accident Report

vi Tables

Table 1. Timeline of selected events during last 1,000 ft of approach. .......................................... 9 Table 2. Injury chart. .................................................................................................................... 13 Table 3. Selected AFDS pitch modes. .......................................................................................... 24 Table 4. Selected AFDS roll modes. ............................................................................................. 24 Table 5. A/T mode summary. ....................................................................................................... 25

NTSB

Aircraft Accident Report

vii Abbreviations AC advisory circular ACARS aircraft communications addressing and reporting system ACRP Airport Cooperative Research Program AD airworthiness directive AFCS automatic flight control system AFDS autopilot flight director system AFE above field elevation AFFF aqueous film forming foam AFM airplane flight manual agl above ground level A/P autopilot ARAC Aviation Rulemaking Advisory Committee ARFF aircraft rescue and firefighting ASHWG ASO Avionics Systems Harmonization Working Group airfield security officer A/T autothrottle ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service BS body station CFR Code of Federal Regulations CG center of gravity CRM crew resource management

NTSB

Aircraft Accident Report

viii CVR cockpit voice recorder DFW FTRC Dallas/Fort Worth International Airport Fire Training Research Center EASA European Aviation Safety Agency EFS engineering flight simulator EGPWS enhanced ground proximity warning system EICAS engine indication and crew alerting system EMS emergency medical service FAA Federal Aviation Administration FAF final approach fix FCOM flight crew operating manual FCTM flight crew training manual F/D flight director FDR flight data recorder FLCH SPD FMA FMC FO flight level change speed flight mode annunciator flight management computer first officer FOM flight operations manual fpm FRMS ft per minute fatigue risk management system g ratio of a particular acceleration to the acceleration due to gravity at sea level HDG SEL heading select HRET high-reach extendable turret ICAO International Civil Aviation Organization

NTSB

Aircraft Accident Report

ix ICN Incheon International Airport IFR instrument flight rules ILS instrument landing system IMC instrument meteorological conditions IP instructor pilot KARAIB The Republic of Korea Aviation and Railway Accident Investigation Board KOCA The Republic of Korea Office of Civil Aviation L left LOC localizer MCP mode control panel MSAW minimum safe altitude warning msl mean sea level ND navigation display nm nautical mile NorCal Northern California Terminal Radar Approach Control NOTAM notice to airmen NTSB National Transportation Safety Board OE operating experience PAPI precision approach path indicator PF pilot flying PFD primary flight display PIC pilot-in-command PM pilot monitoring POI principal operations inspector

NTSB

Aircraft Accident Report

x POM QAR QRH pilot operations manual quick access recorder quick reference handbook R right RA radio altitude RI response item RSA runway safety area SAFO safety alert for operators SFFD San Francisco Fire Department SFFD-AB San Francisco Fire Department-Airport Bureau SFO San Francisco International Airport SFPD San Francisco Police Department SOP standard operating procedure SPD speed START simple triage and rapid treatment THR thrust TO/GA takeoff/go-around Vref reference landing speed VMC visual meteorological conditions VNAV vertical navigation VPI vertical path indicator V/S vertical speed

NTSB

Aircraft Accident Report

xi Executive Summary On July 6, 2013, about 1128 Pacific daylight time, a Boeing 777-200ER, Korean registration HL7742, operating as Asiana Airlines flight 214, was on approach to runway 28L when it struck a seawall at San Francisco International Airport (SFO), San Francisco, California. Three of the 291 passengers were fatally injured; 40 passengers, 8 of the 12 flight attendants, and 1 of the 4 flight crewmembers received serious injuries. The other 248 passengers, 4 flight attendants, and 3 flight crewmembers received minor injuries or were not injured. The airplane was destroyed by impact forces and a postcrash fire. Flight 214 was a regularly scheduled international passenger flight from Incheon International Airport, Seoul, Korea, operating under the provisions of 14 Code of Federal Regulations Part 129. Visual meteorological conditions prevailed, and an instrument flight rules flight plan was filed. The flight was vectored for a visual approach to runway 28L and intercepted the final approach course about 14 nautical miles (nm) from the threshold at an altitude slightly above the desired 3° glidepath. This set the flight crew up for a straight-in visual approach; however, after the flight crew accepted an air traffic control instruction to maintain 180 knots to 5 nm from the runway, the flight crew mismanaged the airplane’s descent, which resulted in the airplane being well above the desired 3° glidepath when it reached the 5 nm point. The flight crew’s difficulty in managing the airplane’s descent continued as the approach continued. In an attempt to increase the airplane’s descent rate and capture the desired glidepath, the pilot flying (PF) selected an autopilot (A/P) mode (flight level change speed [FLCH SPD]) that instead resulted in the autoflight system initiating a climb because the airplane was below the selected altitude. The PF disconnected the A/P and moved the thrust levers to idle, which caused the autothrottle (A/T) to change to the HOLD mode, a mode in which the A/T does not control airspeed. The PF then pitched the airplane down and increased the descent rate. Neither the PF, the pilot monitoring (PM), nor the observer noted the change in A/T mode to HOLD. As the airplane reached 500 ft above airport elevation, the point at which Asiana’s procedures dictated that the approach must be stabilized, the precision approach path indicator (PAPI) would have shown the flight crew that the airplane was slightly above the desired glidepath. Also, the airspeed, which had been decreasing rapidly, had just reached the proper approach speed of 137 knots. However, the thrust levers were still at idle, and the descent rate was about 1,200 ft per minute, well above the descent rate of about 700 fpm needed to maintain the desired glidepath; these were two indications that the approach was not stabilized. Based on these two indications, the flight crew should have determined that the approach was unstabilized and initiated a go-around, but they did not do so. As the approach continued, it became increasingly unstabilized as the airplane descended below the desired glidepath; the PAPI displayed three and then four red lights, indicating the continuing descent below the glidepath. The decreasing trend in airspeed continued, and about 200 ft, the flight crew became aware of the low airspeed and low path conditions but did not initiate a go-around until the airplane was below 100 ft, at which point the airplane did not have the performance capability to accomplish a go-around. The flight crew’s insufficient monitoring of airspeed indications during the approach resulted from expectancy, increased workload, fatigue, and automation reliance.

NTSB

Aircraft Accident Report

xii When the main landing gear and the aft fuselage struck the seawall, the tail of the airplane broke off at the aft pressure bulkhead. The airplane slid along the runway, lifted partially into the air, spun about 330°, and impacted the ground a final time. The impact forces, which exceeded certification limits, resulted in the inflation of two slide/rafts within the cabin, injuring and temporarily trapping two flight attendants. Six occupants were ejected from the airplane during the impact sequence: two of the three fatally injured passengers and four of the seriously injured flight attendants. The four flight attendants were wearing their restraints but were ejected due to the destruction of the aft galley where they were seated. The two ejected passengers (one of whom was later rolled over by two firefighting vehicles) were not wearing their seatbelts and would likely have remained in the cabin and survived if they had been wearing their seatbelts. After the airplane came to a stop, a fire initiated within the separated right engine, which came to rest adjacent to the right side of the fuselage. When one of the flight attendants became aware of the fire, he initiated an evacuation, and 98% of the passengers successfully self-evacuated. As the fire spread into the fuselage, firefighters entered the airplane and extricated five passengers (one of whom later died) who were injured and unable to evacuate. Overall, 99% of the airplane’s occupants survived. The safety issues discussed in the report relate to the need for the following:  Adherence of Asiana pilots to standard operating procedures (SOP) regarding callouts. The flight crew did not consistently adhere to Asiana’s SOPs involving selections and callouts pertaining to the autoflight system’s mode control panel. This lack of adherence is likely the reason that the PF did not call out “flight level change” when he selected FLCH SPD. As a result, and because the PM’s attention was likely on changing the flap setting at that time, the PM did not notice that FLCH SPD was engaged.  Reduced design complexity and enhanced training on the airplane’s autoflight system. The PF had an inaccurate understanding of how the Boeing 777 A/P and A/T systems interact to control airspeed in FLCH SPD mode, what happens when the A/T is overridden and the throttles transition to HOLD in a FLCH SPD descent, and how the A/T automatic engagement feature operates. The PF’s faulty mental model of the airplane’s automation logic led to his inadvertent deactivation of automatic airspeed control. Both reduced design complexity and improved systems training can help reduce the type of error that the PF made.  Opportunity at Asiana for new instructors to supervise trainee pilots in operational service during instructor training. The PM was an experienced 777 captain who was on his first flight as an instructor pilot supervising a trainee captain gaining operating experience. The PM did not have the opportunity during his instructor training to supervise and instruct a trainee during line operations while being observed by an experienced instructor. Such an opportunity would have improved the PM’s awareness of the dynamic and often unpredictable challenges that an instructor must deal with when supervising a trainee during line operations.

NTSB

Aircraft Accident Report

xiii  Guidance for Asiana pilots on use of flight directors during a visual approach. During the accident flight, after the A/P was disconnected, the PM loosely followed Asiana’s informal practice, which was to turn both flight directors (F/Ds) off and then turn the PM’s F/D back on when conducting a visual approach. However, the two F/D switches were not both in the off position at the same time. If they had been, the A/T mode would have changed to speed mode and maintained the approach speed of 137 knots. In addition, during a visual approach, F/D pitch and roll guidance is not needed and can be a distraction.  More manual flight for Asiana pilots. Asiana’s automation policy emphasized the full use of all automation and did not encourage manual flight during line operations. If the PF had been provided with more opportunity to manually fly the 777 during training, he would most likely have better used pitch trim, recognized that the airspeed was decaying, and taken the appropriate corrective action of adding power. Federal Aviation Administration (FAA) guidance and a recent US regulatory change support the need for pilots to regularly perform manual flight so that their airplane handling skills do not degrade.  A context-dependent low energy alert. The airplane was equipped with a low airspeed alerting system that was designed to alert flight crews to low airspeed in the cruise phase of flight for the purpose of stall avoidance. However, this accident demonstrates that existing low airspeed alert systems that are designed to provide pilots with redundant aural and visual warning of impending hazardous low airspeed conditions may be ineffective when they are developed for one phase of flight (e.g., cruise) and are not adequately tailored to reflect conditions that may be important in another phase of flight (e.g., approach). During the approach phase of flight, a low airspeed alert may need to be designed so that its activation threshold takes airspeed (kinetic energy), altitude (potential energy), and engine response time into account.  Research that examines the injury potential from significant lateral forces in airplane crashes and the mechanism that produces high thoracic spinal injuries. In this accident, the dynamics were such that occupants were thrown forward and experienced a significant lateral force to the left during the impact sequence. One passenger sustained serious head injuries as a result of striking the arm rest of the seat that was in front of and to his left. While current FAA dynamic seat certification requirements do include testing row/row seat interactions with seats positioned slightly off the longitudinal axis, they would not likely approximate the forces encountered in this accident. Further, there was a high number of serious injuries to the high thoracic spine in this accident, and the mechanism that produces these injuries is poorly understood.  Evaluation of the adequacy of slide/raft inertia load certification testing. The forces experienced by the slide/rafts during the impact sequence far exceeded their certification limits, leading to overload failures of the slide/raft release mechanisms on the 1R and 2R slide/rafts. Given the critical nature of these evacuation devices and their proximity to essential crewmembers, slides and slide/rafts must be certified to sufficient loads so that they will likely function in a survivable accident. Although this exact accident scenario is unlikely to occur again, the data obtained during this accident investigation could prove useful for future slide/raft design.

NTSB

Aircraft Accident Report

xiv  Aircraft rescue and firefighting (ARFF) training for officers placed in command of an aircraft accident. The arriving incident commander placed an officer in charge of the fire attack who had not received ARFF training, and this individual made decisions that reflected his lack of ARFF training. Although no additional injuries or loss of life could be attributed to the fire attack supervisor’s lack of ARFF training, it demonstrates the potential strategic and tactical challenges associated with having nonARFF trained personnel in positions of command at an airplane accident.  Guidance on when to pierce the fuselage of a burning airplane with a skin-piercing nozzle. The airport’s fire department had two vehicles equipped with high-reach extendable turrets (HRETs) that were not used to the best of their capabilities in the initial attack. This was partially the result of departmental guidance that discouraged penetration of the fuselage using the skin-piercing nozzles on the HRETs until all of the occupants were known to have evacuated the airplane. Current FAA guidance provides information on how to pierce but does not include any guidance on when to pierce.  Integration of the medical supply buses at SFO into the airport’s preparation drills. Although the airport’s emergency procedures manual called for airport operations personnel to deliver the airport’s two emergency medical buses to the accident site, neither of the medical buses arrived. Further, the monthly emergency drills conducted by the airport did not include deployment of the buses either as a matter of routine or as part of the unique scenario being evaluated. This lack of integration of the medical buses into the airport’s preparation drills likely played a part in their lack of use in the initial response to the accident.  Guidance or protocols for ensuring the safety of passengers and crew at risk of being struck or rolled over by a vehicle during ARFF operations. In this case, only one passenger was at significant risk for a vehicle strike due to her close proximity to the burning airplane; however, there are other accident scenarios in which many injured or deceased persons could be located near an accident airplane. There is currently no guidance or any recommended protocols for ensuring the safety of passengers and crew at risk of being struck or rolled over by a vehicle during ARFF operations.  Requirements for ARFF staffing. Seven ARFF vehicles and 23 ARFF personnel from SFO’s fire department were involved in the initial response to the accident. This equipment level exceeded the FAA-required minimum of three vehicles, and there is currently no FAA-required minimum staffing level. Because of the amount of available ARFF vehicles and personnel, the airport firefighters were able to perform exterior firefighting and send firefighters into the airplane who rescued five passengers who were unable to self-evacuate amid rapidly deteriorating cabin conditions. Due to the lack of an FAA-required minimum staffing level, passengers involved in an aviation accident at a smaller airport may not be afforded the same level of protection that the passengers of flight 214 had.  Improvements in emergency communications at SFO. Numerous problems with communications occurred during the emergency response, the most critical being the inability for responding mutual aid units to speak directly with units from the airport on a common radio frequency. Although some of the communications difficulties encountered during the emergency response, including the lack of radio

NTSB

Aircraft Accident Report

xv interoperability, have been remedied, others, such as the breakdown in communications between the airport and city dispatch centers, should be addressed.  Increased FAA oversight of SFO’s emergency procedures manual. Although the airport had submitted, and the FAA had approved in December 2012, an updated emergency procedures manual, the airport had not yet distributed or trained personnel on the updated manual when the accident occurred and was still actively operating with the manual approved by the FAA in December 2008. The National Transportation Safety Board (NTSB) determined that the probable cause of this accident was the flight crew’s mismanagement of the airplane’s descent during the visual approach, the PF’s unintended deactivation of automatic airspeed control, the flight crew’s inadequate monitoring of airspeed, and the flight crew’s delayed execution of a go-around after they became aware that the airplane was below acceptable glidepath and airspeed tolerances. Contributing to the accident were (1) the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing’s documentation and Asiana’s pilot training, which increased the likelihood of mode error; (2) the flight crew’s nonstandard communication and coordination regarding the use of the autothrottle and autopilot flight director systems; (3) the PF’s inadequate training on the planning and execution of visual approaches; (4) the PM/instructor pilot’s inadequate supervision of the PF; and (5) flight crew fatigue, which likely degraded their performance. As a result of this investigation, the NTSB makes safety recommendations to the FAA, Asiana Airlines, Boeing, the Aircraft Rescue and Firefighting Working Group, and the City and County of San Francisco.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1 History of Flight

On July 6, 2013, about 1128 Pacific daylight time,1 a Boeing 777-200ER, Korean registration HL7742, operating as Asiana Airlines flight 214, was on approach to runway 28L when it struck a seawall at San Francisco International Airport (SFO), San Francisco, California. Three of the 291 passengers were fatally injured; 40 passengers, 8 of the 12 flight attendants, and 1 of the 4 flight crewmembers received serious injuries. The other 248 passengers, 4 flight attendants, and 3 flight crewmembers received minor injuries or were not injured. The airplane was destroyed by impact forces and a postcrash fire. Flight 214 was a regularly scheduled international passenger flight from Incheon International Airport (ICN), Seoul, Korea, operating under the provisions of 14 Code of Federal Regulations (CFR) Part 129. Visual meteorological conditions (VMC) prevailed, and an instrument flight rules (IFR) flight plan was filed. Figure 1 is a map showing the location of the accident.

Figure 1. Map of the accident location.

1 All times in this report are Pacific daylight time (unless otherwise noted) and based on a 24-hour clock.

NTSB Aircraft Accident Report 2 The flight and cabin crews were based at ICN. Two of the flight crewmembers, a trainee captain and an instructor pilot (IP), were the primary flight crew, and the other two flight crewmembers, a second captain and a first officer (FO), were relief pilots. The flight, which was the first of a scheduled 2-day trip with a scheduled layover in San Francisco, was an operating experience (OE) training flight for the trainee captain. The flight plan showed an estimated time en route of 10 hours 24 minutes. As shown in figure 2, the trainee captain occupied the left seat and was the pilot flying (PF) for the takeoff and landing. The IP, who was the pilot-in-command (PIC), occupied the right seat and was the pilot monitoring (PM) for the takeoff and landing. The relief captain and FO occupied seats in the cabin for takeoff and during the initial part of the flight. About 4 hours 15 minutes after takeoff, they came forward to the cockpit and assumed flight crew duties for about the next 5 hours 15 minutes of the flight, allowing the primary flight crew to rest in the cabin.

Figure 2. Diagram of cockpit showing flight crew roles.

NTSB Aircraft Accident Report 3 The PF stated in an interview that he returned to the cockpit about 0938. According to the relief captain, he told the PF that he had programmed the flight management computer (FMC) with the instrument landing system (ILS)/localizer (LOC) 28L approach and advised him of the likelihood that the flight would be held at high altitude and/or high speed by air traffic control (ATC) for longer than normal during the approach to SFO. The relief captain stated that the PM returned to the cockpit about 10 minutes after the PF’s return. According to the cockpit voice recorder (CVR), at 0955:45, there was a transfer of aircraft control to the PF and the PM, and the relief captain and FO returned to the cabin. About 6 minutes later, the PF and the PM discussed expectations for receiving radar vectors for a visual approach.2 At 1042:28, the PF began an approach briefing. During his briefing, the PF referred to automatic terminal information service (ATIS) Juliet,3 which included the information that visual approaches to runways 28L and 28R were in progress, and the ILS glideslopes4 for these runways were out of service. The PF stated that he expected vectors for a visual approach to runway 28L, would use the LOC to maintain lateral path, and, after capturing the LOC, would use the automatic flight control system (AFCS)5 to manage the vertical profile. He said that the minimum descent altitude for the LOC approach was 460 ft mean sea level (msl) and that he would set a go-around altitude of 3,000 ft msl in case of a missed approach. Figure 3 is the instrument approach chart for the SFO runway 28L ILS or LOC Z procedure.

2 The Federal Aviation Administration defines a visual approach as an ATC authorization for an aircraft on an IFR flight plan to proceed visually to the airport of intended landing. It is not an instrument approach procedure, and there is no missed approach segment. 3 Juliet was the assigned code for the ATIS broadcast given at 0956. The ATIS changed to information Kilo at 1056, but the content of the broadcast was not significantly different. 4 The terms glideslope and glidepath are commonly used interchangeably. For the purposes of this report, glideslope refers to the electronic radio aid portion of the ILS that provides vertical guidance, and glidepath refers to a descent profile determined for vertical guidance during a final approach. When specific glidepaths are referenced, the method of determining the glidepath will be stated (for example, “PAPI [precision approach path indicator] glidepath”). 5 Specifically, the PF stated that he would use the vertical speed pitch mode of the autopilot flight director system (AFDS). Along with the autothrottle, the AFDS is a subsystem of the 777 AFCS. See section 1.6.3 for additional information about the functionality of these systems.

NTSB Aircraft Accident Report 4 (Used by permission of Jeppesen Sanderson Inc. NOT TO BE USED FOR NAVIGATION.) Figure 3. Instrument approach chart for the SFO runway 28L ILS or LOC Z procedure. At 1047:28, the PF called for the descent checklist. The PM acknowledged the callout and began to run the checklist, which included verification that the reference landing speed (Vref)6 was 132 knots. At 1047:54, the PM stated, “checklist completed.” At 1112:33, the relief

6 Vref is 1.23 times the airplane’s stalling speed in the landing configuration. It is the speed required on crossing the landing runway threshold at a 50-ft height to achieve calculated aircraft performance.

NTSB Aircraft Accident Report 5 FO returned to the cockpit, occupied the center jumpseat, and acted as an observer during the approach and landing.7 As the flight proceeded towards SFO, it was cleared to descend to lower altitudes and vectored to intercept a straight-in approach to runway 28L. At 1121:49, a controller at Northern California Terminal Radar Approach Control (NorCal) asked if the flight crew had the airport in sight. The PM replied, “okay runway in sight,” and the controller cleared the flight for a visual approach to runway 28L. According to flight data recorder (FDR) data, when the approach clearance was given, the airplane was descending through about 6,300 ft msl. The airplane’s airspeed was about 211 knots; it was configured with the flaps and landing gear up; the autothrottle (A/T) was in hold (HOLD) mode; and the autopilot flight director system (AFDS) was in flight level change speed (FLCH SPD) pitch mode and heading select (HDG SEL) roll mode.8 At 1122:07, the PF stated, “I am intercepting localizer,” and the PM responded, “yes.” At 1122:11, the LOC9 push-button switch on the AFCS’s mode control panel (MCP) was pushed, arming the LOC mode, and the PM stated, “localizer armed,” to which the PF replied, “check, cleared visual approach.” At 1122:46, the PF stated, “next, three thousand one hundred” and then “cleared visual approach,” and the PM replied “check.” At 1122:48, the MCP-selected altitude changed to 3,100 ft. At 1122:52, LOC capture occurred, and the AFDS roll mode changed from HDG SEL to LOC, where it remained for the duration of the flight. At this time, the airplane was about 15.4 nautical miles (nm) from the runway threshold, descending through about 5,300 ft msl at an airspeed of about 210 knots. At 1122:54, the PM stated, “let’s descend slowly to one thousand eight hundred feet, and it’s visual.” The PF replied, “yes yes sir I will set to one thousand eight hundred.” At 1123:02, the MCP-selected altitude was changed to 1,800 ft, which was the minimum altitude for the DUYET waypoint, located 5.4 nm from the runway and the final approach fix (FAF) for the ILS/LOC 28L approach.10 At 1123:05, the PM stated, “localizer capture.” The PF replied, “check, flaps one sir,” and the PM stated, “speed check flaps one set.” At 1123:11, the flap lever was moved to the flaps 1 position as the airplane was descending through about 4,900 ft msl at an airspeed of about 214 knots. At 1123:16, the PF stated, “speed one nine two set,” and the MCP-selected airspeed changed from 212 to 192 knots. At 1123:17, when the airplane was about 14.1 nm from the runway, descending through about 4,800 ft msl at an airspeed of about 215 knots and a descent rate of about 900 ft per minute (fpm), the NorCal controller instructed the flight to reduce airspeed to 180 knots and to maintain that speed until 5 miles from the airport; the PM acknowledged the instruction. At 1123:31, the PF stated, “speed one eight zero,” and the PM replied, “check.” At 1123:33, the PF stated, “flaps

7 The relief captain remained in the cabin for the descent, approach, and landing. 8 In HOLD mode, the A/T will not move the thrust levers; FLCH SPD pitch mode moves the elevator to maintain the selected airspeed; and HDG SEL roll mode maintains the selected heading. See section 1.6.3 for further description of the airplane’s AFCS. 9 The LOC roll mode captures and tracks the localizer centerline. 10 Because flight 214 was conducting a visual approach, there was no requirement for the flight to cross DUYET at 1,800 ft. The flight crew chose to use this altitude as a reference.

NTSB Aircraft Accident Report 6 five.” About 3 seconds later, the PM made an unintelligible comment, and the MCP-selected airspeed changed to 180 knots. At 1123:42, the PF stated, “flaps five sir,” and the PM replied, “speed check” and then “flaps five.” At 1123:45, the flap lever was moved to the flaps 5 position. By 1123:50, the airplane’s descent rate had decreased to about 300 fpm, and the PM made an unintelligible comment. About 2 seconds later, the MCP-selected airspeed changed to 172 knots. At 1123:53, the PF stated, “yeah, I am descending now,” and the PM replied, “yeah.” At 1123:57, the AFDS pitch mode changed to vertical speed (V/S);11 the A/T mode changed to speed (SPD) mode;12 and the MCP-selected vertical speed was set to -900 fpm. At 1123:58, the PM called out the pitch mode change by stating, “V/S,” and the PF replied, “one thousand.” About 1 second later, the MCP-selected vertical speed changed to -1,000 fpm, and the PM stated, “check.” There was no communication between the flight crew for about the next 31 seconds. At 1124:32, when the airplane was about 9.5 nm from the runway, descending through about 3,900 ft msl at an airspeed of about 185 knots and a descent rate of about 1,000 fpm, the relief FO who was observing (hereafter referred to as the observer) commented that the flight was to maintain 180 knots until 5 miles from the airport by stating, “to one eight zero five miles.” The PM responded, “ah ah ah one eight zero,” and the observer repeated, “one eight zero five miles.” At 1124:36, the PF stated, “huh?” The observer again repeated the speed to be maintained as instructed by the NorCal controller, and the PF stated, “okay one eight zero five miles.” There was no communication between the flight crew for about the next 12 seconds. At 1124:51, when the airplane was about 8.5 nm from the runway, descending through about 3,500 ft msl at an airspeed of about 188 knots and a descent rate of about 1,000 fpm, the PF called for the landing gear to be extended. At 1124:53, the gear handle was moved to the down position, and the PM stated, “this seems a little high.” About 2 seconds later, the PF stated, “yeah,” and the PM repeated, “this should be a bit high.” About 3 seconds later, the PF stated, “do you mean it’s too high?” The PM made an unintelligible reply. At 1125:02, the PF stated, “I will descend more,” and at 1125:04, the MCP-selected vertical speed changed to -1,500 fpm. There was no communication between the flight crew for about the next 21 seconds. At 1125:23, the PM made an unintelligible comment, followed about 6 seconds later by his comment, “ok.” At 1125:31, the PM stated, “one thousand,” and the MCP-selected vertical speed changed to -1,000 fpm. At this time, the airplane was about 6.3 nm from the runway, descending through about 2,600 ft msl at an airspeed of about 178 knots and a descent rate of about 1,500 fpm. At 1125:36, the NorCal controller instructed the flight to contact the SFO air traffic control tower (ATCT), and the PM acknowledged the instruction. At 1125:43, the PF stated that the missed approach altitude was 3,000 ft, and about 2 seconds later, the MCP-selected altitude changed to 3,000 ft.

11 V/S pitch mode maintains the selected vertical speed until the selected altitude is captured. 12 SPD A/T mode commands thrust to maintain the selected airspeed.

NTSB Aircraft Accident Report 7 The airplane crossed DUYET at 1125:46, while descending through about 2,250 ft msl at an airspeed of about 176 knots and a descent rate of about 1,100 fpm. When it reached DUYET, the airplane was about 450 ft above the 1,800-ft minimum altitude depicted on the approach chart. The airplane reached a point about 5 nm from the runway at 1125:55, while descending through about 2,085 ft msl at an airspeed of about 174 knots and a descent rate of about 1,000 fpm. When it reached the 5.0 nm point, the airplane was about 400 ft above the altitude for the desired glidepath13 of 3°. At 1125:56, the PM radioed the tower controller stating the flight’s position but did not receive an immediate response. About 5 seconds later, the PF called out “flaps twenty,” and the PM replied, “flaps five ahh” and then “flaps twenty.” At 1126:06, the flap lever was moved to the flaps 20 position as the airplane was descending through about 1,900 ft msl at an airspeed of about 175 knots and a descent rate of about 1,000 fpm, and the PF stated, “yeah.” At 1126:10, the MCP-selected speed changed to 152 knots. About 2 seconds later, the PF called out “flaps thirty,” and the PM replied, “speed check flaps thirty sir.” At this time, the airplane’s airspeed was about 174 knots, which was above the flaps 30 limit speed of 170 knots. At 1126:25.7, the AFDS pitch mode changed to FLCH SPD, and the A/T mode changed to thrust (THR) mode.14 The AFCS responded to the mode change by starting to slow the airplane to the MCP-selected speed of 152 knots and initiating a climb toward the MCP-selected target altitude of 3,000 ft, as seen in FDR-recorded AFDS pitch commands, a slight increase in thrust lever angles, and a slight pitch up. At 1126:28.3, the PM stated “flaps thirty,” and at 1126:29.5, the PF made an unintelligible statement that included the word “sir.” Between these two remarks, at 1126:28.8, the flap lever was moved to the flaps 30 position, and simultaneously, the autopilot (A/P) was disconnected. At this time, the airplane was about 3.5 nm from the runway, descending through about 1,500 ft msl at an airspeed of about 169 knots and a descent rate of about 1,000 fpm. According to FDR data, the AFCS-initiated forward movement of the thrust levers that began when the A/T mode changed to THR was manually overridden, and the thrust levers were moved aft. At 1126:33, the thrust levers reached the idle position, and the A/T mode changed to HOLD. Immediately before the A/T mode change occurred, at 1126:32.5, the PM stated, “flight director,” and immediately after the change, at 1126:34.0, the PF replied, “check.”15 During a postaccident interview, the PF stated that he considered pressing the FLCH push-button to obtain a higher descent rate but could not recall whether he did so or not. When interviewed, none of the three flight crewmembers recalled seeing the changes to the A/T mode displayed on each primary flight display’s (PFD) flight mode annunciator (FMA) that resulted from the selection of FLCH.

13 For purposes of this report, the term “desired glidepath” refers to a descent profile extending out from the 28L touchdown zone at an angle of 3° and approximately conforming to the PAPI glidepath, the ILS glideslope, and an imaginary line drawn through the ILS/LOC 28L approach step-down waypoints. 14 THR A/T mode commands thrust to maintain the climb/descent rate required by the pitch mode. 15 As a result of disconnecting the A/P, the status indication for the AFDS displayed near the top of both pilots’ primary flight displays would have changed from “A/P” to “FLT DIR.”

NTSB Aircraft Accident Report 8 At 1126:36, the PM stated, “speed,” and the PF replied, “target speed one three seven.”16 At 1126:38, the MCP-selected airspeed changed to 137 knots. At this time, the airplane was about 2.9 miles from the runway, descending through 1,300 ft msl at an airspeed of about 165 knots and a descent rate of about 1,000 fpm. By this point, the flight crew should have been able to clearly see the precision approach path indicator (PAPI)17 lights; the PAPI indication would have been four white lights, showing that the airplane was significantly above the PAPI glidepath angle of 2.98°. At 1126:40, the PF called out “flight director off,” and the PM replied, “okay.” According to quick access recorder (QAR) data,18 at 1126:43, the left (PF’s) flight director (F/D) switch was turned off, and the right (PM’s) F/D switch remained on.19 There were no further changes in the F/D switch positions for the duration of the recording. At 1126:44, the PM stated, “it’s high,” and over the next 8 seconds, the airplane’s descent rate increased from about 1,000 to 1,500 fpm. At 1126:52, the PM stated, “one thousand,” and the PF replied, “check.” At 1126:54.9, the airplane was about 2.1 nm from the runway when it descended through 1,000 ft radio altitude20 (RA) at an airspeed of about 151 knots with a descent rate of about 1,500 fpm. When it descended through 1,000 ft RA, the airplane was 243 ft above the altitude for a 3° glidepath, and the PAPI indication was four white lights. Table 1 lists selected events during the last 1,000 ft of the approach.

16 Target speed for the approach was 132 knots (Vref ) plus 5 knots, or 137 knots. 17 A PAPI system consists of a row of four light units installed on the side of the runway that provide visual glidepath indications. The on-glidepath angle (typically about 3°) indication is two red and two white lights. Other light combinations indicate when an airplane’s position is above the glidepath (four white), slightly above (three white and one red), slightly below (three red and one white), and below (four red). According to the Federal Aviation Administration’s (FAA) Aeronautical Information Manual, PAPI lights are visible from about 5 miles during the day and up to 20 miles at night. 18 The QAR data were used to determine the flight director switch positions because it recorded the switch positions once per second while the FDR recorded them once every 4 seconds. 19 It is also possible that the PM rapidly (in less than 1 second) cycled his F/D switch off and then back on before he turned off the PF’s F/D switch. 20 Radio altitude is the height of an airplane above terrain immediately below the airplane as measured by a radio altimeter.

NTSB Aircraft Accident Report 9 Table 1. Timeline of selected events during last 1,000 ft of approach. With respect to the PAPI lights, W=white and R=red. Local Time Time to impact (seconds) Radio altitude (feet) Airspeed (knots) Event 1126:54.9 -55.3 1000 150.5 PAPI displaying WWWW 1126:58.6 -51.7 917 146.7 Observer: "sink rate sir" 1126:59.1 -51.2 904 147.2 PF: "yes sir" 1126:59.5 -50.8 891 147.6 PM (radio): "tower asiana two one four short final" 1127:05.1 -45.2 723 146.0 Observer: "sink rate sir" 1127:07.5 -42.8 658 144.4 Controller issues landing clearance 1127:10.8 -39.5 581 141.3 PM (radio): "cleared to land two eight left" 1127:14.8 -35.4 500 136.7 PAPI displaying WWWR 1127:15.1 -35.2 495 135.9 Airspeed drops below MCP-speed (137 knots) 1127:16.6 -33.7 465 133.8 PF: "landing checklist" 1127:17.5 -32.8 447 134.4 PM: "landing checklist complete cleared to land" 1127:19.8 -30.5 404 134.0 PM: "on glide path sir" / PAPI WWRR 1127:21.2 -29.1 378 132.8 PF: "check" 1127:23.3 -27.0 344 130.5 Airspeed drops below VREF (132 knots) 1127:24.1 -26.2 331 129.7 PAPI changes to WRRR 1127:31.0 -19.3 219 121.9 PAPI changes to RRRR 1127:32.3 -18.0 198 120.4 Electronic voice: "two hundred" 1127:33.6 -16.7 180 117.6 PM: "it's low" 1127:34.8 -15.5 165 119.2 PF: "yeah" 1127:39.3 -11.0 124 113.9 Sound of quadruple chime 1127:41.6 -8.7 102 111.8 Electronic voice: "one hundred" 1127:42.8 -7.5 90 109.8 PM: "speed" 1127:43.2 -7.1 86 109.1 Right engine thrust lever advanced 1127:43.7 -6.6 81 108.4 Left engine thrust lever advanced 1127:44.7 -5.6 68 106.9 A/T mode transition from HOLD to THR 1127:46.4 -3.9 46 103.6 Stick shaker engaged 1127:47.8 -2.5 29 103.8 PM: “go around”

1127:48.6 -1.7 21 104.7 Stick shaker disengaged 1127:50.3 0 5 105.5 Impact

At 1126:59, the observer stated, “sink rate sir,” and the PF replied, “yes sir.” At 1127:00, the PM radioed the tower controller that the flight was on short final. At 1127:05, the observer

NTSB Aircraft Accident Report 10 stated, “sink rate sir” for the second time. About this time, the airplane’s descent rate momentarily reached about 1,800 fpm. Then the descent rate began to decrease, and the pitch attitude began to increase. At 1127:06, the PM stated, “cleared to land?” About 1 second later, one of the flight crewmembers stated, “sink rate.” Simultaneously, the tower controller cleared the flight to land on runway 28L. At 1127:11, the PM radioed acknowledgment of the landing clearance, and simultaneously, one of the other flight crewmembers said something unintelligible. At 1127:14.3, the PM stated, “okay.” At 1127:14.8, the airplane was about 1.3 nm from the runway when it descended through 500 ft RA at an airspeed of about 137 knots with a descent rate of about 1,200 fpm. As shown in figure 4, which depicts a profile view of the last 40 seconds of the flight, the PAPI indication was three white lights and one red light—a slightly above glidepath indication—when the airplane descended through 500 ft RA. The thrust levers were at the idle position, and the engines’ N1 speeds21 were about 24%. At 1127:15.5, an electronic voice22 announced “five hundred,” and about 1 second later, the PF called out “landing checklist.” At 1127:16.8, an electronic voice announced “minimums, minimums.” At 1127:17.5, the PM stated, “landing checklist complete cleared to land.” At 1127:19.8, the PM stated, “on glidepath sir,” as the PAPI indication changed to two white and two red lights, showing the airplane’s on-glidepath position. At this time, the airplane was descending through about 400 ft RA at an airspeed of about 134 knots (where it remained for about 4 seconds) and a descent rate of about 1,100 fpm, which was above the descent rate of about 700 fpm needed to remain on glidepath. At 1127:21.2, the PF responded, “check.” There was no communication between the flight crew for about the next 11 seconds. At 1127:23.3, the airplane’s airspeed dropped below 132 knots (Vref). At 1127:24.1, the airplane was about 1 nm from the runway at 331 ft RA, the airspeed was about 130 knots, the descent rate was about 1,000 fpm, and the PAPI indication changed to one white light and three red lights, showing the airplane’s slightly below-glidepath position. Over the next 5 seconds, the airplane’s pitch attitude increased from about 2° to 4° nose up, where it remained for about 3 seconds. At 1127:31.0, the airplane was about 0.7 nm from the runway at 219 ft RA, the airspeed was about 122 knots, the descent rate was about 900 fpm, and the PAPI indication changed to four red lights, showing the airplane’s significantly below-glidepath position. Over the next 5 seconds, the airplane’s pitch attitude increased to about 7° nose up, where it remained for about 3 seconds before continuing to increase.

21 N1 speed is the rotational speed of the engine’s low pressure spool, which includes the fan, low pressure compressor, and low pressure turbine. 22 The airplane was equipped with an enhanced ground proximity warning system (EGPWS) that included an advisory callout feature that generated radio-altitude-based callouts at 500, 200, 100, 50, 40, 30, 20, and 10 ft. In addition, a callout was generated when the airplane reached the minimum descent altitude for the approach, in this case 460 ft. For more information about the EGPWS, see section 1.16.4.

NTSB Aircraft Accident Report 11

Figure 4. Profile view of the last 40 seconds of flight 214. During a postaccident interview, the observer stated that he saw two white lights and two red lights on the PAPI as the flight descended through 500 ft RA. He recalled that beginning sometime after the airplane descended below 500 ft, he could no longer see the runway or the PAPI lights through the windscreen. The PM stated that at 500 ft RA, the airplane was slightly low, and he saw one white light and three red lights on the PAPI. The PF stated that he began to see one white light and three red lights on the PAPI at 500 ft RA and recalled thinking that if he allowed the PAPI indication to go to four red lights, he would fail his flight and would be embarrassed.23 The PF pitched the airplane up to avoid going low. He stated that about that time, he “saw some light and was in blindness for a second.” The light prompted him to stop looking outside and instead look down at the instrument panel. He stated that the blindness was only momentary, and he could see the airspeed tape and noticed that the airspeed was low. The PM stated that he did not see any bright light. The PM further stated that about 200 ft RA, the airspeed was about 120 knots; he saw four red lights on the PAPI and thought perhaps the A/T was not working.

23 Although the OE training flight was not a check flight, one of the PF’s previous Asiana OE instructors told investigators that a four-red PAPI indication that occurred during an OE training approach would probably be reported to Asiana training managers.

NTSB Aircraft Accident Report 12 At 1127:32.3, an electronic voice announced “two hundred.” At 1127:33.6, the PM stated, “it’s low,” and the PF replied, “yeah.” At 1127:36.0, one of the flight crewmembers made an unintelligible comment. At 1127:39.3, the quadruple chime master caution alert sounded. When the alert sounded, the airplane was about 0.45 nm from the runway at 124 ft RA, the airspeed was about 114 knots, and the descent rate was about 600 fpm. At 1127:41.6, an electronic voice announced “one hundred.” At 1127:42.8, the PM stated, “speed.” Less than a second later, both thrust levers were advanced by the PM.24 At 1127:44.7, the A/T mode changed from HOLD to THR. At 1127:46.4, the CVR recorded the stick shaker activating, and the lowest airspeed during the approach of about 103 knots was recorded by the FDR at 1127:46.9. At this time, the airplane was about 0.35 nm from the runway at 39 ft RA, the descent rate was about 700 fpm, the N1 speeds for both engines were increasing through about 50%, and the pitch attitude reached about 12° nose up. The airspeed then began to increase. At 1127:47.8, the PM called out, “go around,” and at 1127:48.6, the airspeed was about 105 knots, and the stick shaker stopped. The initial impact with the seawall occurred at 1127:50. At that time, the N1 speeds for both engines were increasing through about 92%, and the airspeed was about 106 knots.25 Video from airport surveillance cameras showed that following the initial impact, the tail of the airplane separated, the airplane slid along the runway, and the rear of the fuselage lifted up, tilting the airplane into about a 30° nose-down angle. The airplane pivoted counterclockwise about 330° before impacting a second time and coming to rest off the left side of the runway, about 2,400 ft from the initial seawall impact point. The airplane came to a stop about 1128:06.26 Figure 5 is an aerial view of the approach end of runway 28L and the location of the wreckage. (See sections 1.15.3 and 1.15.4 for information about the evacuation and emergency response, respectively.)

24 All three flight crewmembers recalled that it was the PM who performed this action. 25 When the thrust levers were fully advanced, 90% N1 compressor speeds were reached in about 6 seconds by the left engine and about 7 seconds by the right engine. The acceleration time for both engines met the 8-second performance requirement stated in the design specification. 26 Because the airplane was enveloped in a cloud of dust between 1128:02 and 1128:28, it was not possible to determine from the video footage exactly when the airplane came to a stop.

NTSB Aircraft Accident Report 13

Figure 5. Aerial view of the flight 214 wreckage. 1.2 Injuries to Persons Table 2. Injury chart. Injuries Flight Crew Cabin Crew Passengers Total Fatal 0 0 3 3 Serious 1 8 40 49 Minor 2 2 134 138 None 1 2 114 117 Total 4 12 291 307 1.3 Damage to Airplane The airplane was destroyed by the impact forces and postcrash fire.

NTSB Aircraft Accident Report 14 1.4 Other Damage The PAPI and the runway were damaged during the accident sequence. 1.5 Personnel Information 1.5.1 The Pilot Flying The PF, age 45, held an airline transport pilot certificate issued by the Republic of Korea Office of Civil Aviation (KOCA)27 with a multiengine land airplane rating and type ratings in the Airbus A320 and the Boeing 737, 747-400, and 777. His most recent KOCA medical certificate was issued on July 4, 2013, with no limitations and an expiration date of September 30, 2014. Asiana records did not indicate any previous accidents, incidents, violations, or company disciplinary actions. The records indicated that the PF had accumulated 9,684 total flight hours, including 3,729 hours as PIC. He had 33 hours of 777 flight time and 24 hours of 777 simulator time. In the 90 days, 30 days, and 7 days before the accident, the PF accumulated about 33, 33, and 5 flight hours, respectively. The PF was hired by Asiana Airlines on March 2, 1994, as a cadet pilot with no previous flight experience, and he received ab initio (from the beginning) flight training at a flight school in Florida from 1994 to 1996. He began FO training on the 737 in 1996 and served as a 737 FO and a 747-400 FO before upgrading to 737 captain on December 15, 2005. He transitioned to A320 captain on October 22, 2007. The PF began transition training to 777 captain on March 25, 2013. He completed ground training, full flight simulator training, a simulator check, and OE ground school. He completed his 777 simulator proficiency check on May 18, 2013, and his line-oriented flight training check on May 30, 2013. Training records indicated that during the simulator stage of his 777 transition training, the PF performed six visual approaches, two without an ILS glideslope, receiving a grade of “good” each time. In addition, the PF performed one circling approach and one sidestep maneuver28 in the simulator. The record for the PF’s sixth simulator period noted that the instructor “reviewed high-energy[29] landing technique to achieve planned performance runway required” but did not indicate whether the instruction was a discussion only or an approach was flown. According to the Asiana 777 captain transition training syllabus in use at the time, a high-energy approach was not required. The PF began 777 observation flights on June 14, 2013, and logged 9 hours 35 minutes of observer time. He began flying the 777 with an IP as part of his required initial OE on June 16,

27 The KOCA is similar in function to the US FAA. For more information on the KOCA, see section 1.17.3. 28 A sidestep maneuver is a visual maneuver performed to execute a landing on a runway parallel to the one an instrument approach has been made to. 29 The level of energy of an airplane is a function of primary flight parameters (airspeed, thrust, configuration, and flightpath) and their rate of change. The pilot controls energy level by controlling these parameters and trading one parameter for another. A low-energy airplane is too slow and/or too low; a high-energy airplane is too fast and/or too high.

NTSB Aircraft Accident Report 15

1. Of the 20 flight legs and 60 hours flight time required by Korean regulations, the PF had

completed 8 flight legs and 33 hours 31 minutes before the accident flight.30 All of the approaches the PF had previously flown during OE were ILS approaches, and there was no requirement to perform visual approaches during OE. On one approach, the PF made an automated landing, and on several approaches, he disengaged the A/P about 1,000 ft before landing. Three IPs who had flown with the PF during his OE training were interviewed. The first IP, who conducted two flights with the PF, told investigators the PF made errors that were normal for his stage of training, like not flaring soon enough when landing, and that the PF’s overall performance was above average. The second IP, who conducted four flights with the PF, told investigators that nothing stood out about the PF’s performance. A third IP, who conducted two flights with the PF 2 days before the accident, told investigators he was not sure if the PF was making normal progress because the PF did not perform well during their trip together. He said the PF was not well organized or prepared, conducted inadequate briefings, poorly monitored the operation, and deviated from multiple standard operating procedures (SOP). He said that the PF allowed the descent rate to get a little high on short final and allowed the nose to drop at an altitude of 200 to 100 ft. This had caused the airplane to go below the desired glidepath and forced the PF to initiate the flare early. The IP counseled the PF extensively on these and other issues but worried that the PF was not taking his feedback seriously enough. The IP was not overly concerned, however, because he knew that the PF had to complete more OE flights. The PM said that during the takeoff, climb, and cruise portions of the flight, he did not find any problems with the PF’s proficiency. He also said that the PF communicated well, notifying him before doing something, after which, the PM would confirm it. The PM said that the callouts and responses seemed to be working well. Asiana records showed that the PF flew 29 trips that transited SFO as a 747 FO from July 24, 1997, to April 29, 2004. On those 29 trips, he made 4 landings at SFO. His most recent prior landing at SFO was on July 30, 2002, and his most recent prior flight into SFO was on April 29, 2004. 1.5.1.1 The Pilot Flying’s Preaccident Activities The PF reported no recent stressors in his personal life. He stated, however, that life was generally stressful and that performing 777 OE flights was stressful. He reported that he normally went to sleep about 2300 and needed 6 to 8 hours of sleep per night to feel rested.31

30 The PF’s previous OE flights originated from and returned to ICN, and the destination airports were Narita (NRT), Los Angeles (LAX), and London (LHR). 31 The times in this section are expressed in Korea local time, based on a 24-hour clock.

NTSB Aircraft Accident Report 16 On Thursday, July 4, the PF woke at an unknown time. He served as PF on a roundtrip from ICN to Narita and back, departing ICN about 1500, returning to ICN about 2200, and arriving at his residence about midnight. He could not recall when he fell asleep. On Friday, July 5, the PF woke at an unknown time. He was off duty and engaged in routine activities at home. He went to sleep about 2200 or 2300 and slept 8 or more hours. On Saturday, July 6, the PF woke about 0700 feeling rested. He went jogging, returned about 0800, and ate breakfast. He took a bus to ICN about 0930, arrived about 1030, and began preparing for the flight. The official show time was 1510, but he met his instructor (the PM) about 1440, and they began briefing for the flight. The PF had a cup of coffee when he arrived at the airplane. The PF was in the cockpit for the first 4 hours 15 minutes of flight. After reaching the initial cruising altitude, he ate a crew meal and drank a second cup of coffee. About 2108, he left the cockpit, went to a business class seat that reclined flat, and began a 5-hour rest break. He recalled being asleep for the first 2 hours of the break and “half-asleep” for the rest of it. He recalled feeling tired but finding it difficult to sleep. Near the end of the break, he ate a small meal and drank a third cup of coffee. The PF was scheduled to reenter the cockpit about 0208 but returned about 0138 instead.32 He decided to do this because it was a training flight. The PM joined him at the scheduled time, and they resumed control of the flight. The PF recalled feeling excited because he had not flown into SFO in 10 years but feeling stressed that the runway 28L glideslope was out of service. He was concerned about his ability to conduct a stable visual approach without the electronic glideslope. There was no CVR evidence that the PF discussed his concern with the PM. 1.5.2 The Pilot Monitoring The PM, age 49, held an airline transport pilot certificate issued by the KOCA with a multiengine land airplane rating and type ratings in the Boeing 757/767 and 777. His most recent KOCA medical certificate was issued on September 5, 2012, with no limitations and an expiration date of September 30, 2013. Asiana records did not indicate any previous accidents, incidents, violations, or company disciplinary actions. The records indicated that the PM had accumulated 12,307 total flight hours, including 9,045 hours as PIC. He had a total time of 3,208 hours in the 777. In the 90 days, 30 days, and 7 days before the accident, the PM accumulated about 211, 71, and 0 hours, respectively. After serving as a pilot in the Republic of Korea Air Force, the PM was hired by Asiana Airlines on February 1, 1996. He was initially qualified as a 767 FO and upgraded to 767 captain on March 21, 2001. He transitioned to 777 captain on January 16, 2008. He underwent 777 IP

32 During the flight from ICN to SFO, the airplane crossed the International Date Line and 8 time zones. The PF’s reported return to the cockpit occurred about 0138 on July 7 Korean standard time, which was equivalent to about 0938 on July 6 Pacific daylight time.

NTSB Aircraft Accident Report 17 training in May and June 2013 and became qualified as an IP on June 12, 2013. The accident flight was his first time acting as an IP. The PM had attended Asiana’s 777 recurrent training every year since 2008. A review of Asiana’s 777 recurrent simulator training guides from 2010 to 2013 showed that visual approach training had been conducted each year. Specifically, the 2010 recurrent training included a visual approach at night with no ILS or PAPI, and the 2011 recurrent training included a visual approach to runway 28L at SFO with no PAPI. The PM’s IP training included ground school, simulator training, and OE. A review of the PM’s instructor training records showed that typical comments were “good performance” or “very good performance.” Records indicate that he performed a visual approach three times during the simulator stage of his IP training in 2013, receiving a grade of “good” on each occasion. One of the instructors who provided training to the PM during the simulator stage of his IP training stated that he performed “well enough” in the simulator. The instructor said that he told new IPs that when they were in the right seat, they were chosen because of a higher level of proficiency. They had to do the FO’s job and do it well, and, at the same time, they had to supervise the new captain in training. He advised the PM to let the trainee do his job as much as possible but never go beyond their own comfort level. One of the instructors who had flown with the PM during the OE stage of his IP training stated that the PM had a good character and personality and that he could be a very good instructor. He discussed common errors instructors see in transitioning pilots. The captain who conducted the PM’s OE final check flight stated that he was very calm, followed the procedures correctly, had professional knowledge of the flight, and had good capability and skill as an instructor. The PF said some Asiana IPs were very energetic and active, pointing at and touching the instruments, and he sometimes found their behavior stressful. The PM was more relaxed by comparison. The PF thought the PM had been adequately supporting him. Asiana records showed that the PM flew 33 trips that transited SFO as a 777 captain from December 12, 2007, to May 10, 2013. On those 33 trips, he made 17 landings at SFO. His most recent prior landing at SFO was on May 8, 2013.

NTSB Aircraft Accident Report 18 1.5.2.1 The Pilot Monitoring’s Preaccident Activities The PM reported that he normally went to sleep about 2400, needed 6 to 7 hours of sleep per night to feel rested, and typically slept 7 hours per night when off duty for an extended period.33 He reported no recent personal stressors. On Thursday, July 4, the PM woke about 0600 and went to the Asiana Airlines training facility in Seoul. He participated in joint crew resource management (CRM) training from 0800 to 1600, returned home about 1700, and went to sleep about midnight. On Friday, July 5, the PM woke about 0700 or 0800. He spent the day engaging in routine activities at home and went to sleep about midnight. He recalled that his quality of sleep was “okay.” On Saturday, July 6, the PM woke about 0800. He ate breakfast, visited with family, and watched television. He recalled taking a 15-minute nap while watching television. He reported leaving home about 1310 or 1315 and taking a 1330 bus to the airport. He reported napping for 20 minutes on the bus. He arrived at the airport about 1420 and changed into his uniform. He recalled feeling rested as he went on duty. He began briefing flight 214 with the PF about 1440. He was in the cockpit for the first 4 hours 15 minutes of the flight. During this time, he ate a crew meal and drank a cup of coffee. He was relieved about 2108 and took a rest break. He went to a business class seat that reclined flat and slept from about 2128 to 0028. When he woke, he ate some soup, drank a second cup of coffee, and watched movies. He returned to the cockpit about 0208 feeling “normal” as he and the PF resumed control of the flight. 1.5.3 The Observer The observer (relief FO), age 40, held an airline transport pilot certificate issued by the KOCA with a multiengine land airplane rating and type ratings in the Airbus A320 and the Boeing 777. His most recent KOCA medical certificate was issued on July 4, 2013, with no limitations and an expiration date of July 31, 2014. Asiana records indicated that the observer had accumulated 4,557 total flight hours, including 1,445 hours as PIC. He had a total time in the 777 of 715 hours. In the 90 days, 30 days, and 7 days before the accident, the observer accumulated about 232, 57, and 0 hours, respectively. After serving as a pilot in the Republic of Korea Air Force, the observer was hired by Asiana Airlines on December 12, 2007. He was initially qualified as an A320 FO and transitioned to the 777 on March 3, 2012. Asiana records showed that the observer flew seven trips that transited SFO as a 777 FO from May 29, 2012, to April 10, 2013, and made no landings at SFO during those trips. The observer’s most recent flight into SFO before the accident was on May 10, 2013.

33 The times in this section are expressed in Korea local time, based on a 24-hour clock.

NTSB Aircraft Accident Report 19 1.5.3.1 The Observer’s Preaccident Activities The observer said he normally went to sleep between 0200 and 0300 and woke between about 0930 and 1000, sleeping 6.5 to 8 hours.34 He reported no recent personal stressors. On Thursday, July 4, the observer was off duty. He went to sleep and woke in keeping with this normal schedule. He reported spending the day at home reading books. On Friday, July 5, the observer was off duty. He went to sleep between about 0200 and 0300 and woke between about 0930 and 1000. He was home until about 1600, then ate dinner at a restaurant. He returned home about 2000 and read books. On Saturday, July 6, the observer went to sleep about 0200 and woke about 1130. He recalled that his quality of sleep was “good.” He ate lunch and left home about 1250 to catch a 1310 bus to the airport. He reported that he arrived at the airport about 1420 feeling “okay.” During the initial portion of the flight, the observer rested in a business class seat that reclined flat. He ate dinner and drank a cup of coffee about 2 hours into the flight and then took what he described as a good-quality 2-hour nap. About 2108, he went to the cockpit and began operating the flight with the reserve captain. While he was in the cockpit, he consumed four more cups of coffee and had a snack. About 0208, he was relieved by the PM and returned to his seat in business class. He took a nap, sleeping from about 0223 until 0243. When he woke, he felt tired. He tried to make himself feel more alert by going to the restroom and performing stretches. When he returned to the cockpit for the arrival at SFO, the airplane was descending through about 11,000 ft msl. He sat down in the center jumpseat and prepared to monitor the approach. 1.5.4 The Flight Attendants Twelve flight attendants, ranging in age from 22 to 42, were working on the accident flight. The lead flight attendant (or cabin manager) completed initial training on March 13, 1995, and her most recent annual recurrent training was completed on January 24, 2013. Eight flight attendants completed initial training between November 1995 and October 2011, and their most recent annual recurrent training was completed between December 2012 and June 2013. The other three flight attendants completed initial training in June or July 2012 and had not received their first annual recurrent training as of the date of the accident. 1.6 Airplane Information 1.6.1 General The Boeing Airplane Company completed the manufacture of the accident airplane (model 777-200ER, serial number 29171) on February 6, 2006. The airplane was delivered new to Asiana Airlines on March 7, 2006, and it had since been continuously operated and

34 The times in this section are expressed in Korea local time, based on a 24-hour clock.

NTSB Aircraft Accident Report 20 maintained by the company. The airplane was powered by two Pratt & Whitney PW4090 turbofan engines. At the time of the accident, the airplane had accumulated about 37,120 total hours and 5,388 total cycles.35 Asiana Airlines maintained the airplane in accordance with the manufacturer’s recommended continuing maintenance program, and the most recent scheduled maintenance was performed on June 28, 2013, when the airplane had accumulated 36,992 total hours. According to the Asiana 777 Flight Crew Operating Manual (FCOM), the Vref speed for a flaps 30 landing at the airplane’s landing weight was 132 knots. The flap limit speeds given in the FCOM were 255 knots for flaps 1, 235 knots for flaps 5, 195 knots for flaps 20, and 170 knots for flaps 30. 1.6.2 Instrument Panel Displays The 777 instrument panel is equipped with five flat panel liquid crystal display units that supply information to the flight crew. As shown in figure 6, the engine indication and crew alerting system (EICAS) is located in the center of the panel, two navigation displays (ND) are located on either side of the EICAS, and two PFDs are located on the far left and far right sides of the panel. The EICAS displays engine parameters and provides a single, central location for alert messages. Each PFD presents a color display of the parameters necessary for flightpath36 control, including flight mode annunciations (see section 1.6.3.3), airspeed (see section 1.6.4.1), altitude, radio altitude, vertical speed, and attitude. Each ND provides a mode-selectable37 color flight progress display. Recommended for most phases of flight, the MAP mode was in use during the accident approach (figure 7 shows an exemplar ND with the indications and parameters that the flight crew would have seen during the approach to SFO). The MAP mode is presented track up and shows airplane position relative to the route of flight (represented by a magenta line) against a moving map background. A green altitude range arc shows the map position where the airplane will reach the MCP target altitude38 based on current vertical speed and groundspeed.

35 An airplane cycle is one complete takeoff and landing sequence. 36 Flightpath refers to the precise route taken or due to be taken by the airplane; it is the combination of the airplane’s vertical and lateral paths. 37 The modes are MAP (map), VOR (very high frequency omnidirectional range), APP (approach), and PLN (plan). 38 See section 1.6.3 for more information about the MCP.

NTSB Aircraft Accident Report 21 Figure 6. 777 instrument panel. The FMC computes a performance-optimized descent path, assuming idle thrust from the top of descent, that meets all airspeed and altitude constraints and the end of descent point in the flight plan. During descent, once the top of descent has been passed, a vertical path indicator (VPI), consisting of a path pointer and deviation scale, is displayed on the lower right side of the ND (see figure 7). The VPI shows the airplane’s vertical distance above or below the computed descent path. If the FMC has been programmed for a LOC procedure, the airplane’s vertical navigation (VNAV) system computes a vertical path from the FAF to the runway threshold. From the FAF to the runway, the VPI shows the airplane's vertical distance above or below the computed glidepath for the approach regardless of whether or not the ILS glideslope is functional.

NTSB Aircraft Accident Report 22 Figure 7. 777 navigation display depicting information for the approach to SFO. 1.6.3 Automatic Flight Control System The 777 AFCS consists of the AFDS and the A/T. The flight crew configures the AFDS and A/T to perform climb, cruise, descent, and approach through the FMC and the MCP. The MCP, located above the center of the instrument panel and accessible to either pilot (see figure 6), is the primary interface between the flight crew and the AFDS and A/T. Through the MCP, which is shown in figure 8, the flight crew arms or engages the AFDS and the A/T, makes mode selections, and sets target values. Four liquid crystal displays on the MCP show the target values for indicated airspeed, heading or track, vertical speed or flightpath angle, and altitude.

NTSB Aircraft Accident Report 23 Figure 8. 777 mode control panel. 1.6.3.1 Autopilot Flight Director System The AFDS can provide A/P pitch, roll, and yaw commands to the airplane’s flight control surfaces through the fly-by-wire control system,39 and it can provide F/D guidance to the flight crew on the PFDs. Left and right F/D switches on the MCP (shown in figure 8) activate the F/D steering indications on the respective PFDs. The A/P is engaged by pushing either of the two MCP A/P engage buttons. The A/P can be disengaged by pressing the control wheel A/P disengage switch, pulling the MCP A/P disengage bar down, or by overriding the control column, control wheel, or rudder pedals.

39 In a fly-by-wire control system, pilot control inputs are processed by flight control computers that then send electrical signals to actuators that move the flight control surfaces.

NTSB Aircraft Accident Report 24 Disconnecting the A/P generates a warning level alert.40 The master warning lights on the glareshield illuminate, the message “AUTOPILOT DISC” displays on the EICAS, and the siren, which is the aural cue for all warning level alerts, sounds. The first push of a control wheel disengage switch triggers the alert, and the second push cancels the alert. Numerous AFDS pitch and roll modes are available and can be activated or armed by pushing the appropriate buttons on the MCP or programming the FMC. When an MCP mode button is pushed, a light in the lower half of the button illuminates. The AFDS pitch and roll modes that are relevant to this report are summarized in tables 3 and 4, respectively. Table 3. Selected AFDS pitch modes. AFDS Pitch Mode AFDS Annunciation AFDS Mode Description Flight level change speed FLCH SPD Acquires and maintains an MCP airspeed target. Vertical speed V/S Acquires and maintains an MCP vertical speed target. Takeoff/Go- around—Pitch TO/GA Acquires and maintains takeoff speed reference after liftoff, or go-around speed reference after initial go- around rotation. Vertical navigation speed VNAV SPD

Follows vertical steering commands from the FMC. VNAV SPD acquires and maintains an FMC or MCP speed target.

Table 4. Selected AFDS roll modes. AFDS Roll Mode AFDS Annunciation AFDS Mode Description Heading select HDG SEL Acquires and maintains an MCP heading target. Takeoff/Go- around—Roll TO/GA Maintains ground track after liftoff or at go-around. Lateral navigation LNAV Follows lateral steering commands from the FMC. Localizer LOC Captures and tracks the localizer centerline.

40 The 777 has three levels of alerts: advisory, caution, and warning. Advisory alerts require routine pilot awareness, caution level alerts require immediate crew awareness and action may be required, and warning level alerts require immediate crew action.

NTSB Aircraft Accident Report 25 1.6.3.2 Autothrottle The A/T is armed by moving the left and right engine A/T arm switches on the MCP to the ARM position. Once armed, the A/T will engage when certain AFDS pitch modes (including FLCH SPD) are selected or the MCP A/T engage button is pushed. The A/T may be overridden manually at any time by taking control of the thrust levers and placing them at a desired position. The A/T can be disconnected by turning off the A/T arm switches on the MCP or by pushing the A/T disconnect switches located on the thrust levers. Disconnecting the A/T generates a caution level alert. The master caution lights illuminate, the message “AUTOTHROTTLE DISC” displays on the EICAS, and the quadruple chime, which is the aural cue for all caution level alerts, sounds. The first push of an A/T disconnect switch triggers the alert, and the second push cancels the alert. Table 5 summarizes the A/T modes that may be active under normal operating conditions. Table 5. A/T mode summary. A/T Mode A/T Annunciation A/T Mode Description Thrust reference THR REF Thrust set to the reference thrust limit displayed on EICAS. Speed SPD Thrust applied to maintain target airspeed set using the MCP or FMC. Thrust THR Thrust applied to maintain the climb/descent rate required by AFDS pitch mode. Idle IDLE Occurs when A/T controls the thrust levers to the aft stop. Hold HOLD Occurs when A/T removes power from the servo motors. In this mode, A/T will not move the thrust levers. No mode

A/T is armed but not engaged. This is the only state where the A/T automatic engagement function is potentially active.41 1.6.3.3 Flight Mode Annunciator An FMA is located at the top of each PFD and displays flight mode annunciations and the AFDS status. As shown in figure 9, flight mode annunciations are above the AFDS status indication and show (from left to right) A/T mode, AFDS roll mode, and AFDS pitch mode. Active or captured modes are displayed in green letters, and armed modes are displayed in smaller white letters. A green box surrounds the mode annunciation for 10 seconds when a mode first becomes active.

41See section 1.6.3.5 for a description of the A/T automatic engagement function.

NTSB Aircraft Accident Report 26 The AFDS status is displayed on each PFD just above the attitude display. When the A/P is engaged, the message “A/P” displays on both PFDs. When the A/P is disengaged and the left or right F/D switch is turned on, the message “FLT DIR” displays on the respective PFD. When the A/P is disengaged and both F/D switches are turned off, no message is displayed on either PFD. Figure 9. 777 flight mode annunciator. 1.6.3.4 Autopilot and Autothrottle Pairing Airplane speed can be controlled by the AFDS or the A/T. When the AFDS is controlling speed, this is informally called “speed-on-elevator,” as the speed is controlled by modifying the pitch of the airplane through elevator movement. When the A/T is controlling speed, this is informally called “speed-on-throttle,” as the speed is controlled by movement of the thrust levers. The A/T controls speed only when it is in SPD mode. An example of “speed-on-throttle” is the pairing of V/S pitch mode with the SPD A/T mode. In the V/S pitch mode, the AFDS issues elevator commands to achieve the MCP vertical speed target, while the airspeed is controlled by an increase or decrease in thrust through A/T control or manual pilot control. The pilot may use this mode to climb or descend to the altitude

NTSB Aircraft Accident Report 27 set in the MCP. The V/S mode is selected by setting the target vertical speed on the MCP and pushing the V/S button. To maintain the target airspeed, the pilot must set the engine thrust manually or engage the A/T by pushing the MCP A/T engage button, which will activate the A/T in the SPD mode. With the V/S mode active and the A/T engaged, the lights on the V/S and A/T buttons on the MCP will illuminate, and the FMA will display “V/S” for pitch mode and “SPD” for A/T mode. The annunciations “V/S” and “SPD” will be surrounded by green boxes for 10 seconds after being activated. An example of “speed-on-elevator” is the pairing of FLCH SPD pitch mode with the THR or HOLD A/T modes. The FLCH SPD pitch mode is used to change flight level, and, just as with the V/S mode, the pilot may use this mode to climb or descend to the altitude set in the MCP. However, in this mode, the elevator commands from the AFDS maintain the MCP target speed, while the climb or descent rate (vertical speed) is controlled by an increase or decrease in thrust through A/T control or manual pilot control. To use the FLCH SPD mode, the pilot sets an MCP target altitude and pushes the FLCH button on the MCP. If armed, the A/T will activate in the THR mode and advance the thrust levers if the target altitude is above the airplane’s current position or retard the thrust levers if the target altitude is below the airplane’s current position. With the FLCH SPD pitch mode active and the A/T engaged, the lights on the FLCH and A/T buttons on the MCP will illuminate, and the FMA will display “FLCH SPD” for pitch mode and “THR” for A/T mode. The annunciations “FLCH SPD” and “THR” will be surrounded by green boxes for 10 seconds after being activated. In FLCH SPD mode, the rate at which the thrust levers move depends on the difference between the current altitude and the target altitude. The A/T is limited by the thrust limit at the forward range of thrust lever travel and by idle at the back range of travel. During a FLCH descent, HOLD mode will engage when the thrust levers reach the aft stop or if the pilot manually overrides the A/T. During a FLCH climb, HOLD mode will engage only if the pilot manually overrides the A/T. When the HOLD mode engages, the annunciation for the A/T mode will change from “THR” to “HOLD,” and the annunciation will be surrounded by a green box for 10 seconds. The A/T will remain in HOLD mode until one of the following conditions is met: (1) The airplane reaches the MCP target altitude. (2) The pilot engages a new AFDS pitch mode or new A/T mode. (3) The A/T arm switches are turned off. (4) The thrust is manually commanded to increase past the thrust limit. (5) The A/P is disconnected, and both F/D switches are turned off. 1.6.3.5 Autothrottle Automatic Engagement The A/T system has an automatic engagement feature (commonly referred to as “A/T wakeup”). Automatic engagement functions when the AFDS is in a compatible pitch mode or no mode, as long as the A/T is armed but not activated in any of its modes, the engine thrust is not already at its maximum limit, and the aircraft is above 100 ft on approach or 400 ft on takeoff. Compatible AFDS pitch modes are all modes except FLCH SPD and Takeoff/Go-Around. The feature will engage the A/T automatically if the airspeed is detected to

NTSB Aircraft Accident Report 28 be below a minimum threshold for 1 second. According to Boeing, at flaps 30, the minimum threshold is 8 knots below Vref.42 When the system automatically engages, the A/T will respond with the same functionality as it would if the A/T engage button was manually selected. The A/T automatic engagement feature was described in the Asiana 777 FCOM, chapter 4, “Automatic Flight,” page 4.20.9, as follows: The autothrottle can support stall protection when armed and not activated. If speed decreases to near stick shaker activation, the autothrottle automatically activates in the appropriate mode (SPD or THR REF) and advances thrust to maintain minimum maneuvering speed (approximately the top of the amber band) or the speed set in the mode control speed window, whichever is greater. The EICAS message AIRSPEED LOW displays.

Note: When the pitch mode is FLCH or TOGA, or the airplane is below 400 feet above the airport on takeoff, or below 100 feet radio altitude on approach, the autothrottle will not automatically activate.

Note: During a descent in VNAV SPD, the autothrottle may activate in HOLD mode and will not support stall protection. 1.6.4 Airspeed Awareness and Low Airspeed Alerting Features The primary means of airspeed awareness for flight crews is through indications on the left and right PFDs. If airspeed decreases below the minimum maneuver speed, additional visual, aural, and tactile cues are provided by low airspeed alerting features. 1.6.4.1 Airspeed Awareness Each PFD includes a speed tape that displays the current airspeed (normally in a white box), an airspeed trend vector, and the MCP-selected airspeed on a continuous basis (see figure 10). The airspeed trend vector (an upward- or downward-pointing green arrow) indicates whether the airspeed is increasing or decreasing. According to Boeing, the airspeed trend vector indicates the predicted airspeed at which the airplane will be flying in 10 seconds based on current acceleration or deceleration. The MCP-selected airspeed is represented on the tape by a magenta pointer and is also displayed in a box above the speed tape. Vref is represented on the speed tape by a green line with the letters “REF” beside it. For low speed operations, an amber band is displayed on the speed tape, which indicates the speed range between the minimum maneuvering speed43 (the top of the amber band) and the speed at which the stick shaker will activate (the bottom of the amber band). A red and black barber pole is displayed below the amber band, and the top of this barber pole indicates the speed at which the stick shaker will

42 For flight 214, the minimum threshold was 132 knots (Vref) minus 8 knots, or 124 knots. 43 When flaps are extended, minimum maneuvering speed is the airspeed that provides 1.3g maneuver capability to stick shaker activation.

NTSB Aircraft Accident Report 29 activate. The pitch angle at which the stick shaker will activate is indicated on the PFD by an amber pitch limit indicator. If airspeed decreases below the minimum maneuvering speed, further nose-up pitch trim is inhibited. As speed decreases within the amber band’s range, the force required to pull back on the control column increases. The pilot may still override the force with increased effort. These features are designed to provide a tactile cue that the airspeed is dropping below the minimum maneuvering speed.

Figure 10. 777 indicated airspeed display. 1.6.4.2 Low Airspeed Alerting Systems The 777 low airspeed alerting systems include a low airspeed alert and a stick shaker. The low airspeed alert is a caution-level alert and occurs when airspeed decreases about 30% below the top of the amber band. The visual cues that accompany a low airspeed alert include changing the color of the airspeed box on the PFD to amber, displaying an “AIRSPEED LOW” caution message on the EICAS, and illuminating the master caution lights. The caution-level aural alert (quadruple chime) will also sound. The stick shaker is a warning-level alert designed to warn the flight crew that the aircraft is approaching an aerodynamic stall. The noise of the stick shaker motor shaking the columns provides an aural cue, and the physical shaking of the column provides a tactile cue. The stick shaker activation point is the top of the barber pole. When the flaps are not retracted, or at slow

NTSB Aircraft Accident Report 30 speeds with the flaps retracted, the stick shaker activation point is also shown by the pitch limit indicator, an amber visual indication on the PFD’s attitude indicator. 1.7 Meteorological Information The SFO weather observation about 1056 reported wind from 210° at 6 knots, 10 miles visibility, few clouds at 1,600 ft above ground level (agl), temperature of 18°C, dew point temperature of 10°C, and an altimeter setting of 29.82 inches of mercury. The SFO weather observation about 1156 reported wind from 210° at 7 knots, wind variable between 170° and 240°, 10 miles visibility, few clouds at 1,600 ft agl, temperature of 18°C, dew point temperature of 10°C, and an altimeter setting of 29.82 inches of mercury. 1.8 Aids to Navigation No problems with any navigational aids were reported. At the time of the accident, the runway 28L ILS glideslope was out of service due to a construction project. 1.9 Communications No problems with any communications equipment during the flight were reported. See section 1.15.4.3 for information about communications problems during the emergency response. 1.10 Airport Information SFO, located about 13 miles south of downtown San Francisco, is owned and operated by the City and County of San Francisco. The field elevation is 13 ft msl. For the 12-month period ending December 12, 2012, SFO had about 430,812 total aircraft operations. SFO is served by four paved runways. Two parallel runways are oriented east/west (runway 10L/28R and runway 10R/28L), and two parallel runways are oriented north/south (runway 01L/19R and runway 01R/19L). At the time of the accident, runway 28L had a grooved asphalt surface that was 11,381 ft long and 200 ft wide. It was marked as a precision instrument approach runway and equipped with high-intensity runway edge and centerline lights. In July 2012, SFO began a construction project to comply with a congressional mandate (Public Law 109-115) to bring the runway safety areas (RSA) of all its runways into compliance with Federal Aviation Administration (FAA) design standards.44 Part of the project involved moving the runway 28L threshold west to expand the RSA. Runway 28L was closed for repaving/remarking on June 24, 2013, and reopened on June 29, 2013. The threshold was

44 An RSA is a clear area around a runway, centered on the runway centerline, that is free of objects and structures. According to FAA Advisory Circular 150/5300-13, “Airport Design,” the RSA standards applicable to SFO are a width of 500 ft, a length prior to landing of 600 ft, and a length beyond the runway of 1,000 ft.

NTSB Aircraft Accident Report 31 displaced west 300 ft, providing a 600-ft RSA between the seawall and the threshold. Also, the runway 28L ILS glideslope antenna, portions of the approach lighting system, and the PAPI lights had to be relocated as a result of the threshold movement. At the time of the accident, the ILS glideslope and the approach lighting system were out of service. A notice to airmen (NOTAM) published by the FAA on June 1, 2013, indicated that the ILS glideslope would remain out of service until August 22, 2013. An FAA flight check conducted on July 2, 2013, certified the relocated PAPI lights serving runway 28L with a 2.98° glidepath.45 The 28L LOC was operational at the time of the accident. On July 7, 2013, an FAA after-accident flight check of the LOC found that it was functioning properly. The FAA certified SFO as a 14 CFR Part 139 airport with Index E aircraft rescue and firefighting (ARFF) capabilities.46 At the time of the accident, the San Francisco Fire Department-Airport Bureau (SFFD-AB) had three fire stations on airport property dedicated to ARFF. ARFF services were continuously available, and the stations were staffed by a minimum of 23 firefighters and paramedic personnel.47 According to 14 CFR 139.317, an Index E airport is required to have three ARFF vehicles.48 The SFFD-AB fire stations had a total of seven firefighting vehicles: three structural firefighting vehicles (Rescue 44 and Engine 33 and 56) and four ARFF vehicles. Three of the ARFF vehicles were Oshkosh Striker 4500s (Rescue 9, 10, and 11), two of which (Rescue 9 and 10) were equipped with 65-ft high-reach extendable turrets (HRET) with piercing nozzles. Each of the three Strikers had a capacity of 4,500 gallons of water, 630 gallons of foam, 460 lbs of dry chemical, and 500 lbs of Halotron. Each Striker was staffed with two firefighters. The fourth ARFF vehicle (Rescue 88) was an Oshkosh T3000 that had a capacity of 3,000 gallons of water, 420 gallons of foam, and 460 lbs of dry chemical. This unit was staffed with two firefighters and a lieutenant. SFFD maintained three additional ARFF vehicles (Rescue 34, 37, and 49) as reserve vehicles. In addition to the firefighting vehicles, two SFFD

45 On the flight inspection report for the PAPI check, the box labeled “G[lide].S[lope]. Angle” contained the entry “2.85/2.98 Sat[isfactory].” According to the FAA, the entry indicated that the intended PAPI glidepath angle was 2.85°, the as-inspected glidepath angle was 2.98°, and this result was satisfactory as it was within the required tolerance of +/-0.2°. 46 SFO was certified as an Index E airport based on five or more average daily departures of aircraft at least 200 ft in length, as defined in 14 CFR 139.315. 47 Title 14 CFR Part 139 does not address minimum ARFF staffing requirements. 48 Of the three vehicles required by 14 CFR 139.317 for an Index E airport, one must carry either (1) 500 lbs of sodium-based dry chemical, halon 1211, or clean agent or (2) 450 lbs of potassium-based dry chemical and water with a commensurate quantity of aqueous film forming foam (AFFF) to total 100 gallons for simultaneous dry chemical and AFFF application. The other two vehicles must carry an amount of water and the commensurate quantity of AFFF such that the total quantity of water for foam production carried by all three vehicles is at least 6,000 gallons.

NTSB Aircraft Accident Report 32 medical vehicles (Rescue 91 and 93) were based at SFO. Each medical vehicle was staffed with a driver/emergency medical technician and a paramedic.49 1.10.1 Emergency Plan and Drills Title 14 CFR 139.325 requires that each certificated airport develop and maintain an airport emergency plan designed to minimize the possibility and extent of personal injury and property damage on the airport in an emergency. At the time of the accident, the airport was using an emergency procedures manual that had been approved by the FAA in December 2008. SFO had submitted, and the FAA had approved, an updated emergency procedures manual in December 2012; however, the airport had not yet distributed or trained personnel on the updated manual. There were no significant changes to the Alert 3 (which indicates an accident on or near the airport) section of the manual in the 2012 revision. According to 14 CFR 139.325, SFO is required to hold a full-scale airport emergency plan exercise at least once every 36 consecutive calendar months. The airport conducted full-scale drills on an annual basis. In the 3 years before the accident, SFO conducted exercises responding to the following simulated scenarios: a water crash/water rescue incident (2012), an air crash involving San Mateo County mutual aid (2011), and a fire disaster involving an aircraft parked at an international terminal gate (2010). In addition to these annual events, the Airport Operations and Security Division and SFFD-AB performed monthly “Redcap” drills, which were designed as “time trial” drills for ARFF personnel; they included exercises for basic strategy and tactics and for the positioning of ARFF units, initiating the incident command system, and establishing a unified command post with airport operations personnel. 1.10.2 Minimum Safe Altitude Warning System NorCal and SFO ATCT used a minimum safe altitude warning (MSAW) system to alert controllers when an airplane was below, or was predicted by the radar system computer to go below, a predetermined minimum safe altitude. The SFO MSAW configuration consisted of two areas, a “Type 1” area and a “Type 2” area. The Type 1 area began at the approach end of the runway and extended out the approach path for 2 miles. MSAW alerts occurring within the Type 1 area were suppressed because an aircraft in this area was expected to be in close proximity to terrain. The Type 2 area extended from the end of the Type 1 area to a point 5 miles from the approach end of the runway. MSAW functions were enabled within the Type 2 area. The Type 2 area contained a current warning slope and a predicted warning slope. The current warning slope started at the beginning of the Type 2 area and extended out the approach path at an angle of 0.68°. The predicted warning slope started at the beginning of the Type 2 area, 100 ft below the current warning slope, also at an angle of 0.68°. MSAW alerts are

49 Title 14 CFR 139.319(j)(4) requires that certificated airports have at least one individual, who has been trained and is current in basic emergency medical services, available during air carrier operations.

NTSB Aircraft Accident Report 33 generated under two conditions: when an aircraft is radar-observed operating below the current warning slope, or when an aircraft is predicted to be operating below the predicted warning slope within the next 22 seconds. Review of recorded radar data indicated that flight 214 remained well above the current and predicted warning slopes while operating in the SFO Type 2 area, and no MSAW alerts were generated. An MSAW simulation conducted at the FAA Technical Center indicated that with the SFO MSAW configuration changed so that the Type 2 area began at a point 1 mile from the approach end of the runway, no MSAW alerts would have been generated for flight 214. 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The airplane was equipped with a Honeywell 6022 solid-state CVR capable of recording 2 hours of 2-channel digital cockpit audio and 30 minutes of 3-channel digital cockpit audio.50 An examination of the CVR at the National Transportation Safety Board’s (NTSB) vehicle recorders laboratory found no evidence of structural or heat damage, and audio information was extracted without difficulty. The extracted 2-hour, 5-minute, 33-second recording consisted of 5 channels of useable audio information. Excellent quality audio51 was obtained from the channels for the cockpit area microphone and the three individual flight crew positions (right seat, left seat, and jump seat), and good quality audio was obtained from the channel that combined the audio information from all the individual flight crew positions. The recording began at 0922:29 with the airplane in cruise flight and ended at 1128:02, about 12 seconds after the initial impact. A transcript was prepared starting at 1042:28 and is provided in Appendix B of this report. 1.11.2 Flight Data Recorder The airplane was equipped with a Honeywell 4700 solid-state FDR that records airplane information in a digital format using solid-state flash memory as the recording medium. The FDR was sent to the NTSB’s laboratory for readout and evaluation; it was received in good condition, and the data were extracted normally from the recorder. The FDR recorded about

50 One 2-hour-long channel contained audio information from the cockpit area microphone, one 2-hour-long channel contained audio information summed from all of the individual flight crew positions, and three 30-minute-long channels contained audio information from each of the individual flight crew positions. 51 In an excellent quality recording, virtually all of the crew conversations can be accurately and easily understood, and only one or two words are not intelligible; any loss is usually attributed to simultaneous cockpit conversations and/or radio transmissions that obscure each other. In a good quality recording, most of the crew conversations can be accurately and easily understood, but several words or phrases are not intelligible; any loss can be attributed to minor technical deficiencies, momentary dropouts in the recording system, or a large number of simultaneous cockpit conversations and/or radio transmissions that obscure each other.

NTSB Aircraft Accident Report 34 27 hours of data, and the accident flight was reflected in the final 10 hours 50 minutes of the recording. For this investigation, 260 parameters were verified. At 1127:54, about 4 seconds after the initial impact, the values recorded for some parameters (including the acceleration parameters) became constant indicating they were no longer valid. The recording ended at 1128:01, about 11 seconds after the initial impact. 1.11.3 Quick Access Recorder The airplane was equipped with a Teledyne Optical QAR that records airplane information in a digital format using an optical disc as the recording medium.52 The QAR was sent to the NTSB’s laboratory for readout and evaluation; it was received in good condition, and the data were extracted normally from the recorder. The QAR recording of the accident flight ended about 52 seconds earlier than the FDR data due to buffering of the QAR data stream. For this investigation, 16 parameters were verified to provide supplemental data to the FDR data. 1.12 Wreckage and Impact Information Examination of the accident site showed that the airplane’s main landing gear and the underside of the aft fuselage struck the seawall. The main landing gear, the first part of the airplane to hit the seawall, separated cleanly from the airplane as per design specifications.53 The tail of the airplane separated at the aft pressure bulkhead. Ground scars and debris from the aft fuselage extended from the seawall to the main wreckage. The vertical stabilizer, the left and right horizontal stabilizers, and left and right main landing gear components were located between the seawall and the runway numbers. The left and right engines separated cleanly from their respective wings during the impact sequence as per design specifications.54 The left engine came to rest about 600 ft north of the main wreckage in the grass on the opposite side (right) of the runway. The engine exhibited fan blade airfoil fractures opposite the direction of rotation consistent with high speed fan rotation at the time of impact. The right engine came to rest against the right side of the fuselage near door 2R, lying on its right side. The exterior surfaces of the left side of the engine, which was facing up, and the bottom of the engine, which was facing the fuselage, exhibited thermal damage and sooting. The oil tank located on the left side of the engine was partially melted, and the areas around the tank were heavily sooted and thermally damaged. The engine exhibited fan blade tip bending opposite

52 The primary function of a QAR is to provide the airplane’s operator with a user-configurable set of flight data similar to that of the FDR. QARs are not crash hardened. 53 The 777 main landing gear attachments to the wing rear spar are controlled by a series of fuse pins, which connect the landing gear to the wing fittings. These fuse pins are designed to fail under a prescribed load in the case of a landing gear breakaway event, thus protecting the wing fuel tank structure. 54 The attachment of the 777 engines to the wing structure is controlled by a series of fuse pins, which connect the strut to the wing fittings. These fuse pins are designed to fail under a prescribed load in the case of an event that overloads the strut-to-wing attachment beyond design ultimate load, thus protecting the wing fuel tank structure.

NTSB Aircraft Accident Report 35 the direction of rotation and hard object impact damage on the fan blade airfoil leading edges, consistent with foreign objects entering the fan when the engine was rotating at high speed. 1.13 Medical and Pathological Information 1.13.1 Fatalities Passenger 41B,55 a 16-year-old female, was found on the right side of the runway about midway between the seawall and the main wreckage. An autopsy was performed by the San Mateo County Coroner’s office, and the cause of death was determined to be “multiple blunt injuries” and the manner of death to be “accident.” The autopsy report described skull fractures, as well as extensive contusions and abrasions to the torso and extremities. Passenger 41E, a 16-year-old female, was found about 30 ft in front of the airplane’s left wing and about 50 ft from the left side of the fuselage. An autopsy was performed by the San Mateo County Coroner’s office, and the cause of death was determined to be “multiple blunt injuries” and the manner of death to be “accident.” The autopsy report noted that there was a moderate amount of dirt and plant material on the outside and inside of passenger 41E’s clothing. The autopsy report described skull fractures, a lacerated aorta, a fractured pelvis, and extensive contusions and abrasions of the extremities and anterior torso as well as open fractures of the right humerus and left wrist and closed fractures of the left humerus and left femur. Passenger 42A, a 15-year-old female, was taken to the hospital from the scene and died 6 days after the accident. The San Mateo County Coroner’s Office performed an external examination and reviewed the patient’s medical records. The cause of death was determined to be “multiple organ dysfunctions due to multiple traumatic injuries” and the manner of death to be “accident.” Her injuries included a skull fracture, multiple traumatic brain injuries, a cervical spine fracture, and fractured ribs. 1.13.2 Survivors Overall, 192 occupants (181 passengers, 10 flight attendants, and the observer) were treated at local area hospitals after the accident.56 Additionally, the PF and the PM were treated at a hospital in Korea beginning on July 14, 2013. Based on review of medical records and the definitions in 49 CFR 830.2, the severity of injuries to each of the 304 survivors was classified as serious, minor, or none. Forty-nine persons (40 passengers, 8 flight attendants, and the PF) sustained serious injuries; 138 persons

55 For purposes of this report, all passengers will be identified by the number of their assigned seat. Some passengers were known to have moved and were not seated in their assigned seats for landing. Specifically, passenger 41B was reported to be seated in 41D for landing. 56 This total includes passenger 42A who died 6 days after the accident.

NTSB Aircraft Accident Report 36 (134 passengers, 2 flight attendants, the PM, and the observer) sustained minor injuries; and 117 persons (114 passengers, 2 flight attendants, and the relief captain) were not injured.57 For additional information about the injuries sustained by the occupants, see section 1.15.5. 1.13.3 Flight Crew Toxicological Testing58 The NTSB’s counterpart agency in Korea, the Republic of Korea Aviation and Railway Accident Investigation Board (KARAIB), collected scalp hair samples from the PF and the PM on August 4, 2013, and submitted them to the Korea National Forensic Service for toxicological tests, which found no evidence of drug use.59 The observer was transported to a local hospital where blood and urine samples were collected. Toxicological testing of the samples at the FAA’s Civil Aerospace Medical Institute detected no evidence of alcohol or performance-impairing drugs.60 1.14 Fire A fire erupted during the accident sequence and destroyed sections of the airplane before being suppressed by firefighting personnel. Portions of the fuselage crown structure above the window belt were burned through from about body station61 (BS) 358 aft to about BS 1434. The cabin interior above the passenger floor from about the cockpit door aft to about BS 1434 was partially consumed by fire. Figure 11 shows fire damage to the airplane.

57 Passengers and crew who were not transported to a hospital after the accident and did not report an injury to the NTSB were considered to have no injury. Also considered to have no injury were 6 passengers who were examined at a local hospital and were found to have no injuries. 58 See section 1.18.5 for information about postaccident flight crew toxicological testing requirements. 59 Gas chromatography/mass spectrometry, gas chromatography/tandem mass spectrometry, and liquid chromatography/tandem mass spectrometry methods were used to look for evidence of 47 different substances, including amphetamine-type stimulants, cannabinoids, opioids, cocaine, and benzodiazepines. 60 Specimens were screened using immunoassay and chromatography to detect alcohol and a variety of legal and illegal drugs, including amphetamines, opiates, marijuana, cocaine, phencyclidine, benzodiazepines, barbiturates, antidepressants, and antihistamines. 61 On the 777, body station refers to the distance measured in inches from a point located 92.5 inches forward of the tip of the airplane’s nose to a point on the airplane’s longitudinal axis.

NTSB Aircraft Accident Report 37

Figure 11. Fire damage to the fuselage of flight 214. Examination of the accident site and the airplane’s fuel tanks showed no evidence of postcrash fire involving fuel. As previously noted, the right engine’s oil tank was breached and partially melted; thermal damage signatures around the oil tank were consistent with an oil-fed fire. The fuselage in the area where the right engine came to rest (BS 825 to 867) showed severe heat damage but no penetrations other than rivet holes and minor cracks. The door 2R external skins were burned away, but the fire did not penetrate internal insulation and mechanisms into the cabin. However, below the cabin floor in the cargo bay, severely burned ducts, thermal acoustic insulation, and composite floor beams were found between BS 755.5 and 888 behind the cargo compartment liner. The path of the fire was traced from this area, up the environmental control system riser duct bay between BS 825 and 846 and into the overhead area. 1.15 Survival Aspects 1.15.1 General The airplane was configured with 295 passenger seats, 2 flight deck crew seats, 2 flight deck observer seats, and 13 retractable flight attendant jumpseats. As shown in figure 12, the cabin was divided into three zones, which were separated by service areas (galleys and lavatories). A-zone was the forward section and contained 24 business-class seats in rows 1 to 6. B-zone was the middle section and contained 157 travel-class seats in rows 10 to 28. C-zone was the aft section and contained 114 travel-class seats in rows 29 to 42. The A-zone seats were equipped with lap belts and single-diagonal shoulder harnesses, and the B-zone and C-zone seats were equipped with lap belts only.

NTSB Aircraft Accident Report 38

Figure 12. Diagram of flight 214’s cabin configuration including injury classification based on assigned seat.

NTSB Aircraft Accident Report 39 The airplane was equipped with eight doors that also served as emergency exits. There were no other cabin exits. The eight doors were paired along the airplane fuselage and numbered beginning at the front of the cabin and proceeding aft as 1 through 4 left (L) and 1 through 4 right (R). A window in each door allowed observation outside the airplane. Each door was equipped with an automatically inflating evacuation slide/raft, which was mounted on the lower face of the door and covered with a molded plastic cover. As shown in figure 12, 11 of the 13 flight attendant jumpseats were located at cabin doors: 1 at door 1R; 2 each at doors 1L, 2R, and 2L; and 1 each at doors 3R, 3L, 4R, and 4L. If there were two jumpseats at the same door, the jumpseat on the forward side of the door was designated A, and the jumpseat on the aft side of the door was designated B. For example, the two jumpseats at door 1L were designated as L1A and L1B. Additionally, there were two aft-facing jumpseats in the aft galley between doors 4R and 4L that were designated as M4A and M4B. During the approach, all of the flight attendant jumpseats were occupied except the R2B jumpseat.62 1.15.2 Seatbelt Compliance Following the accident, NTSB investigators interviewed and/or obtained written statements from 8 of the 12 flight attendants.63 These flight attendants described a normal flight until the final approach for landing. They reported that they performed their seatbelt compliance checks and that at least two flight attendants (the cabin manager and flight attendant L2A) checked C-zone.64 The three passengers who sustained fatal injuries were part of a school group traveling from China to the United States to attend summer camp. Following the accident, an NTSB investigator interviewed three students from the school group. The students, passengers 41G, 41J, and 41D (who was seated in 41B for landing), were interviewed together and stated that their school group was seated throughout the cabin. All three students reported that they were wearing their seatbelts for landing. They reported that their fatally injured friend, passenger 41B, was seated in 41D and covered by a blanket at the time of landing. They did not know if she was wearing her seatbelt. They also reported that their fatally injured friend, passenger 41E, was seated in her assigned seat and was not wearing her seatbelt at the time of landing. The students made no seat location or seatbelt status observations regarding the other fatally injured student, passenger 42A. When asked if the flight attendants performed a seatbelt compliance check before landing, Passenger 41J stated that a male flight attendant65 came through the cabin and that he specifically reminded her to fasten her seatbelt. Immediately after the impact,

62 For purposes of this report, with the exception of the cabin manager, who was seated in jumpseat L1A, the flight attendants will be identified by the number of their assigned jumpseat. 63 Due to the extent of their injuries, the four aft flight attendants (seated in jumpseats L4, R4, M4A, and M4B) were not interviewed and were unable to provide written statements. 64 Because they were not interviewed, it was not possible to determine whether the four aft flight attendants performed seatbelt compliance checks of C-zone; however, it would have been normal procedure for at least some of them to do so. 65 L2A was the only male flight attendant.

NTSB Aircraft Accident Report 40 passenger 41D (seated in 41B) noticed that the seats where her fatally injured friends had been sitting (41D and 41E) were empty. All three students believed that their friends, passengers 41B and 41E, were ejected from the airplane during the impact. Other passengers from C-zone who were not members of the school group were interviewed. Passenger 37H stated that he believed many of students were inexperienced flyers. He stated that “they seemed pretty unfamiliar and the flight attendants did a pretty good job enforcing the safety measures.” He reported that the first thing the students did after boarding was to put their tray tables down and get out iPads and other electronic devices. It was the same thing before landing. He stated that the flight attendants were “very diligent” in making sure seats and tray tables were up for takeoff and landing. He recalled flight attendants coming through the cabin before landing and checking seatbelt compliance and said “they had a lot of work to do,” indicating there was significant noncompliance among passengers. Passenger 37B flew Asiana Airlines regularly and stated that they had always been good about safety and compliance checks. He felt they were very strict. He reported that the flight attendants even came through and checked seatbelts “a couple times” when there was turbulence during the accident flight. 1.15.3 Evacuation of Passengers and Crewmembers Several flight attendants reported that as the airplane approached the runway, they felt a sensation that the airplane was traveling or descending too quickly. Flight attendant L2A was able to see out a window and felt they were going to impact the water and yelled for his colleague (flight attendant L2B) to brace herself. Some flight attendants reported that the airplane pitched up unusually. The flight attendants generally described the first impact as similar to a hard landing. One flight attendant reported a crushing sensation after the first impact. Some flight attendants stated that the first impact was followed by a sensation of lifting off again. Others reported being thrown against their restraints or that the airplane was shaking or rolling. The flight attendants reported a second impact that was much more severe than the first. Flight attendants R1 and R2A reported that the second impact caused the slide/rafts attached to their doors to come free and inflate inside the cabin, pinning them in their seats. Most of the flight attendants reported items flying throughout the cabin and oxygen masks and ceiling panels falling down. According to the ATC transcript prepared by the SFO ATCT, at 1128:26, about 36 seconds after the initial impact and about 20 seconds after the airplane came to a stop, one of the pilots radioed the tower controller stating, “uh tower tower asiana two one four.” The tower controller responded, “asiana two fourteen heavy emergency vehicles are responding.” At 1128:33, the pilot again radioed the tower controller stating, “asiana two one four,” and the tower controller responded, “emergency vehicles are responding.” For about the next minute, radio calls from the pilot to the tower controller continued, but with the exception of a few words, the transmissions were unintelligible. The last transmission from the pilot was at 1129:37. According to the PM, the airplane was enveloped in dust when it came to a stop, and he attempted to contact the tower controller to determine the airplane condition as seen by the

NTSB Aircraft Accident Report 41 tower. When the cabin manager came to the cockpit and asked if they should initiate an evacuation, the PM said “standby.” When the PM understood emergency vehicles were responding, he read and accomplished the evacuation checklist. He was delayed in completing the 777 Quick Reference Handbook (QRH) evacuation procedure because he could not immediately find the QRH. Once the initial steps of the checklist were completed, he issued an evacuation order. According to the cabin manager, after the airplane came to a stop, she ordered flight attendant L1B to check on the status of the pilots. Flight attendant L1B went to the cockpit and knocked on the door, which was immediately opened by one of the flight crew. She ascertained that they were okay and went back to door 1L. Upon hearing them say they were okay, the cabin manager immediately went to the cockpit and asked if the flight attendants should evacuate the airplane. She was told, “No, please wait.” She went back to her jumpseat and made an announcement to passengers to remain seated. Immediately after her announcement, she heard “evacuate!” Although she was unsure of who the command came from, she went to door 1L, opened it, and began to command passengers to evacuate. Flight attendant L2A reported that after the airplane came to a stop, he immediately realized the situation was an emergency. He made an announcement for passengers to wait while he assessed conditions and then heard flight attendant R2A screaming for help. Her legs had been pinned against the galley next to her jumpseat by the inflated slide/raft, and she could not free them. He went over to her to try to assist but was unsuccessful in freeing her. He saw fire and smoke outside the door 2R window and determined that they needed to evacuate. Before he could get back to his exit, he heard the cabin manager making her announcement for passengers to remain seated. He told flight attendant L2B to go to door 1L and stop her from making the announcement while simultaneously commanding the evacuation to begin in both Korean and English. He did not hear a command from a flight crewmember to evacuate; he initiated the evacuation entirely on his own. Review of video from airport surveillance cameras indicated that doors 1L and 2L were opened nearly simultaneously at 1129:39, about 1 minute 33 seconds after the airplane came to a stop. Occupants began to evacuate down the 1L and 2L slide/rafts about 10 seconds later. The video footage showed the flow of passengers evacuating out of door 1L temporarily stopped after about 10 passengers evacuated in the first 30 seconds while the flow of passengers out of door 2L remained constant. At 1131:10, several occupants were seen evacuating door 1L, and by 1132:10, occupants were no longer evacuating from doors 1L and 2L. Flight attendant L3 reported losing consciousness for a few seconds after impact. When she regained consciousness, she was still restrained in her jumpseat but recognized they were in a “very bad situation.” She was confused because she heard the cabin manager make an announcement. She tried to use the interphone to independently command an evacuation but reported it did not work. She released her seatbelt and tried to open her door, but it would not open. She recognized flight attendant L2A’s voice when he commanded an evacuation and shortly thereafter saw light coming from across the airplane at door 3R. Passenger 30K (who reported that he opened door 3R) was there directing passengers out the door. She stayed in the

NTSB Aircraft Accident Report 42 area of her jumpseat and began directing passengers to evacuate from both doors 2L and 3R. Flight attendant L3 was the only crewmember in the back half of the airplane who was capable of assisting with the evacuation. Flight attendant R3’s statement indicated that despite fastening her seatbelt before landing, she was thrown to the floor and seriously injured during impact. She recalled being helped from the airplane through door 3R by passengers. After most of the passengers had evacuated from the front of the airplane, the cabin manager and flight attendant L1B both realized that flight attendant R1 was trapped in her jumpseat by an inflated slide/raft and assisted her husband (who was traveling on the flight as a passenger) in extricating her. She was described as initially being unconscious, and she was helped down the 1L slide/raft by her husband and two flight attendants. At the same time, flight attendant R2A’s legs were still pinned against the galley across from her jumpseat. She remained conscious and had managed to unfasten her restraint and fall to the floor. Several flight attendants and at least one member of the flight crew helped her. When nothing could be immediately found to puncture the slide/raft, flight attendants who had evacuated asked for and retrieved knives from emergency responders who had arrived on scene. According to the cabin manager, she retrieved a knife from the galley between the doors 2R and 2L, and the observer (relief FO) punctured the slide/raft with it. She then retrieved a fire extinguisher, and the observer attempted to extinguish an interior fire. The remaining flight attendants and flight crew in the front of the airplane evacuated from either door 1L or door 2L. When all of the ambulatory passengers in her area had evacuated, flight attendant L3 noticed that several passengers were not evacuating. She commanded them to evacuate but realized that some passengers were trapped. She went to the back of the airplane and tried to help extricate them until firefighters arrived, but she was forced to evacuate because of the smoke and difficulty breathing. Once outside, the uninjured flight attendants performed various duties, such as gathering passengers together, attending to injured passengers and crewmembers, and notifying responders that the four flight attendants who had been seated in the aft galley area were missing. 1.15.4 Emergency Response Most of the airport emergency responders learned of the accident via an Alert 3 notification from the ATCT about 10 seconds after the initial impact at 1128:00. Review of video footage indicated that the first vehicle to arrive on scene was an airport operations pickup truck driven by an airfield security officer (ASO) at 1130:16. At that time, the evacuation at doors 1L and 2L had been underway for about 25 seconds. The first SFFD ARFF vehicle to arrive was Rescue 88 at 1131:11. It was positioned about the airplane’s 1 o’clock position66 and began to apply agent to the visible fire involving the right engine that was against

66 The positions of the ARFF vehicles are described by reference to a clock face overlaid on the airplane with the airplane’s nose at 12 o’clock, the right wing at 3 o’clock, the tail at 6 o’clock, and the left wing at 9 o’clock.

NTSB Aircraft Accident Report 43 the right side of the fuselage, near door 2R. Rescue 9 arrived and also began applying agent to the fire about 37 seconds later. Within about 20 seconds of Rescue 9’s arrival, most passengers had finished evacuating from doors 1L and 2L. By 1133:02, SFFD had seven firefighting vehicles on scene in various positions around the airplane. Additionally, two SFFD rescue vehicles had taken position on taxiway F in the location that would become the triage area. At 1136:53, Rescue 10 was repositioning to lay a foam blanket in front of the left wing near the missing left engine where fuel was leaking. On-vehicle camera footage showed several firefighters on the ground, one of whom directed Rescue 10 around a victim (later identified as passenger 41E) lying in the grass near a cart path forward of the left wing. At 1138:37, three firefighters climbed the 2L slide/raft with a handline and entered the cabin. In their statements, these firefighters reported that one firefighter moved forward and searched the cockpit and forward cabin while the other two moved aft down the airplane’s left aisle. Visibility was hazy, but one of these firefighters recalled seeing that the cockpit door was open when they entered the airplane. As he moved aft, he saw fire on the right side of the airplane spreading upward toward the overhead bins. He sprayed water on the fire to knock it down and continued aft past door 3L. He estimated four to six passengers remained in C-zone, and a flight attendant was attempting to assist them. Some passengers were pinned beneath seats, and others had stayed with them to try to help. Other firefighters and San Francisco Police Department (SFPD) officers entered C-zone through the hole in the back of the airplane and helped with extricating and removing these passengers from the airplane. Based on information from multiple sources, it is likely that the last passenger was extricated from the back of the airplane about 1147. At 1149:41, video footage showed an individual walking across the runway from the debris field toward the airplane. Although the individual’s path was partially hidden on the video by the smoke plume, the individual appeared to be walking from the general vicinity of where the R4 jumpseat was found. When the individual neared the edge of the runway in the vicinity of a runway distance-remaining marker behind the airplane, passengers ran to and began assisting the person. The discovery of this individual prompted a search of the debris field between the seawall and the airplane, which had not yet been performed because all of the SFFD personnel on-scene were initially dealing with the airplane fire and interior search and rescue. Once the search of the debris field began, numerous SFPD officers and ASOs responded to assist. An SFPD officer provided a complete accounting for the occupants found on the runway stating that there were five total: one fatality (passenger 41B) and four who were seriously injured. About the time the individual was seen walking across the runway, the Rescue 9 HRET began to rise, which was the first indication of an attempt to elevate that piece of equipment by the personnel of either Rescue 9 or Rescue 10 (the only two trucks equipped with an HRET). At the same time, Rescue 10 was positioned at 9 o’clock, and its personnel were dispensing foam from its roof turret onto the door 2L area from beyond the left wing tip. At 1148:34, Rescue 10

NTSB Aircraft Accident Report 44 personnel began to slowly advance the truck perpendicular to the airplane while using its bumper turret intermittently. Rescue 10’s in-vehicle video footage showed passenger 41E lying in a right lateral recumbent (fetal) position and covered by a layer of foam as Rescue 10 approached. Rescue 10 rolled over passenger 41E at 1150:46. The Rescue 10 HRET pierced the airplane in the area above and aft of door 2L at 1152:42, and the piercing tip was withdrawn about 50 seconds later. The tip was broken at that time and hung from the end of the HRET. At 1158:37, Rescue 37 arrived in the area of the 1L slide/raft after Rescue 10 had departed. The fire attack supervisor directed the driver of Rescue 37 to dispense agent into door 2L, and she complied but ran out of water and departed the area by making a sweeping right turn in front of the left wing. During this turn, Rescue 37 rolled over passenger 41E at 1201:11. Shortly thereafter, passenger 41E (no longer covered due to the displacement of foam by the vehicle tires) was pointed out to the fire attack supervisor. He reported the victim over the radio and had the body covered with a blanket at 1206:29. The heavy black smoke abated, and the fire was brought under control at 1218:30 after simultaneous, elevated attacks by both Rescue 9 and Rescue 10 using the burnthrough holes in the crown of the airplane as entry points for the application of water and foam. 1.15.4.1 Incident Command The initial incident commander for the accident was the on-duty shift captain from the SFFD-AB. Mutual aid resources arrived from San Francisco within about 24 minutes of the accident. Upon arrival, an SFFD city assistant division chief assumed incident command. He assigned an SFFD city battalion chief as the fire attack supervisor, and the SFFD-AB shift captain remained at the incident command post as the liaison between SFFD city units and SFFD-AB units. Eventually, representatives from SFPD, airport operations, San Mateo County Fire, and AMR (an ambulance company) arrived at the command post. Neither the SFFD city assistant division chief who served as incident commander nor the SFFD city battalion chief who served as fire attack supervisor had any previous experience working at an airport. When asked in interviews, both replied that they had never been involved in a disaster exercise at the airport. When asked why he had chosen to place the SFFD city battalion chief as fire attack supervisor, the incident commander stated that it was because he was the most knowledgeable about this type of fire. He knew that the fire attack supervisor was a pilot67 and an instructor for tank fires in the Texas oil fields and that he knew about foam and ARFF operations. Both audio and video of the fire attack supervisor’s actions were recorded on a digital video camera installed on his helmet. Review of the video footage indicated that about 1200, the driver of Rescue 37 was applying agent through the airplane’s windows near door 2L. The fire attack supervisor opened the vehicle’s door and told the driver to discharge agent into the 2L

67 The fire attack supervisor stated that he was a commercial pilot with about 3,500 hours of flight time, the majority of which was in helicopters.

NTSB Aircraft Accident Report 45 door rather than the windows. The driver briefly explained that there was a bulkhead inside the door that would limit the effectiveness of the agent but complied with his instructions for a short time before needing to depart and refill. The fire attack supervisor then directed city unit Engine 15 to position in that location and put agent into the 2L door. Several minutes later, the fire attack supervisor was approached by members of a rescue squad who suggested a limited search in the back of the airplane. He advised them that he had been notified that everyone had already evacuated and not to proceed with a search saying, “anybody’s in there right now is dead.” The rescue squad persisted and the fire attack supervisor eventually relented, stating “okay. Don’t go too deep.” About 1215, the fire attack supervisor was notified that four “cabin crew” were missing. He then instructed a rescue squad to place a ladder at the cockpit window and “try and break the window open.” When the rescue squad stated they preferred to use the open door 1L, he replied that the fire was “right there” and that they would have to deal with a secure cockpit door. Again the rescue squad persisted, and the fire attack supervisor eventually allowed them to use door 1L as their entry point. 1.15.4.2 Firefighting Tactics Upon arrival, the driver of Rescue 88 observed the evacuation taking place on the left side of the airplane and took the 1 o’clock position. He immediately began to engage the visible fire in the right engine, which appeared to be spreading under the fuselage. Initially, he used the roof turret and then the bumper turret to knock down the fire, and both the driver and rider stated that they used additional foam to try to cool the fuselage for the passengers who were evacuating. The driver stated that he hit the fire intermittently to make the agent last and also to assess the effectiveness of each blast. He reported that the fire did not completely extinguish but changed in character: the smoke went white, and the flames abated. He also tried to create a blanket of foam under the right wing due to the risk of leaking fuel. Rescue 9 arrived immediately behind Rescue 88 and also took up a position near 1 o’clock. The driver stated that he shot foam from the bumper turret onto the top of the fuselage, aiming it just aft of the cockpit. Video footage indicated that Rescue 9 shot three blasts of agent (16, 2, and 11 seconds in length) in a 34-second period. The driver then decided to reposition around the left side of the airplane to take the 5 o’clock position.68 Video footage showed that Rescue 9 began to reposition at 1132:44, about 1 minute after arriving on scene. While Rescue 9 was repositioning, numerous passengers were still in the area of the slide/rafts, including one occupant who was coming down the L1 slide/raft. When asked why they repositioned, Rescue 9’s rider stated that Rescue 88 had knocked down the fire; people were evacuating, and she was worried about hitting them with high pressure water. She stated that they thought they would be more effective at the rear of the airplane, so they repositioned. They went around the nose and down the left side of the airplane to the rear, assessing the situation.

68 The driver of Rescue 9 stated that after repositioning, he applied foam to the fuselage to keep it cool; however, video footage did not show evidence of this activity.

NTSB Aircraft Accident Report 46 Rescue 10 arrived on scene about 1 minute after Rescue 9. It arrived directly behind Rescue 11 (a similarly sized vehicle but without a HRET). Rescue 11 turned left on taxiway N, took the 3 o’clock position, and began applying agent to the engine and fuselage. When he arrived on scene, the Rescue 10 driver noted that other ARFF vehicles had already arrived, and he saw passengers outside the airplane. Because of this, he chose to take the 10 o’clock position on the left side of the airplane. He said he selected his initial attack position based on his personal assessment and not as a result of command direction. Video footage showed that Rescue 10 continued straight on taxiway F and took a position facing the airplane beyond the left wing at 1133:42. By this time, the majority of passengers had evacuated, and a group of flight attendants in search of something sharp to puncture the 2R slide/raft approached the vehicle. While this was occurring, Engine 56 arrived on scene and eventually positioned next to Rescue 11 near the 3 o’clock position. Rescue 10 moved closer to the airplane and eventually took a position closer to the area of the missing left engine about 1137. Over the next 3 minutes, numerous short bursts of foam were applied to the left wing in the area of the missing left engine where fuel was leaking. Rescue 10 then abandoned that position and performed a wide 360-degree circle, coming to a stop further from the fuselage, again near the left wing tip. About 1141, Rescue 10 personnel again discharged agent from the bumper turret onto the left engine area and fuselage. By this time, three firefighters had entered the airplane and begun the interior fire attack and rescue. Video footage showed that there was no longer activity with firefighters or crew around the slide/rafts, and gray smoke was visible coming from door 1L. The driver of Rescue 10 indicated in his interview that he was waiting for an “all clear” from the firefighters inside the airplane before using the HRET to pierce the airplane. When an SFFD-AB lieutenant radioed that everyone was out of the airplane, both drivers commenced with piercing operations: Rescue 10 on the left side of the airplane above door 2L and Rescue 9 on the right side of the airplane near door 2R. Video footage of Rescue 10’s piercing operation showed that the HRET was first raised at 1150:34. The airplane was pierced at 1152:51, and agent was discharged for about 41 seconds. The driver stated that during removal of the piercing tip, the angle of the tip changed, which he believed caused the tip to break and separate.69 Video footage showed Rescue 9’s HRET was raised about 1148. Rescue 9 then quickly lowered the HRET, repositioned at 3 o’clock, and raised the HRET again about 1149. Due to the smoke plume and lack of onboard video, it could not be determined exactly when Rescue 9 pierced the fuselage. The driver stated that he pierced the airplane twice: once over the cockpit and once over the wing. He stated that he had no problems piercing the fuselage or dispensing the agent. Investigators found three circular-shaped holes on the airplane’s right side: a hole near the 2R lavatory (BS 835), above row 14 (BS 972, even with the top of door frame), and above row 17 (BS 1108, on a stringer above the door frame).

69 At the NTSB’s December 2013 investigative hearing for this accident, a witness explained that the piercing tip was designed to shear in the event forces are placed upon it that could potentially damage the boom.

NTSB Aircraft Accident Report 47 In an interview, when asked about the HRET and SFFD’s policy on when to pierce an airplane, the assistant deputy chief in charge of the SFFD-AB stated that there was no specific policy on the best time to use the piercing nozzle on the HRET.70 At the NTSB’s December 2013 investigative hearing for this accident, the assistant deputy chief provided the following testimony: Our personnel are trained from the beginning of their career to never conduct exterior fire attacks simultaneously with an interior fire attack. In this case, through the early part of the incident we had both trapped passengers and personnel inside the aircraft extricating those trapped passengers…I would say that it was a decision, a tactical decision made based upon their training and their experience, and good risk management to wait until…they had extricated the passengers from the aircraft and the personnel had evacuated the aircraft to go ahead and start piercing and employ an exterior attack. 1.15.4.3 Communication Problems In postaccident interviews and statements, first responders reported numerous problems with communications during the emergency response. One of the reported problems was the inability for responding mutual aid units from the City of San Francisco to speak directly with units from the airport. According to the assistant deputy chief in charge of the SFFD-AB, the communication frequencies used at the airport were different than those used at the city, and the procedure was for the arriving SFFD city vehicles to switch to a designated frequency for the airport. According to the incident commander, the initial mutual aid response from the city was a first alarm that involved three engines, two fire trucks, a medical vehicle, two battalion chiefs, the rescue squad, and himself. He considered it a normal response to the airport except that slide/rafts had been deployed in this event. While en route to the airport, he communicated with the city communications center and reminded them to have all companies switch to frequency C9. He attempted to tune his SFFD radio to C9 but could not because the radio shop had just reprogrammed all the radios, and “there was no C9.” Initially, the incident commander did not call for additional units from the city or call a yellow or red alert because he did not know the extent of the situation at the airport. He was still en route to the airport when he got a report from the city communications center that there was no fire on the airplane and that there were injuries. He considered whether more medics should be dispatched to the site. At the time, he thought that the slide/rafts were deployed and that people were evacuating the airplane, so he asked the city communications center to “give me two ambulances.” When he got closer to the airport, he saw a light smoke column about 1.5 miles

70A policy for HRET/piercing nozzle use was being developed at the time of the interview in November 2013. The assistant deputy chief was part of an affiliation of all the Index E ARFF chiefs, and he canvassed all of them about this topic. He was also using the FAA’s advisory circulars and other guidance in developing the policy. Because he had only been on the job for 5 days at the time of the accident, he did not know what the training on the HRET had been before the accident.

NTSB Aircraft Accident Report 48 away but was not sure of its origin because several industrial buildings were in that location. He asked the city communications center if there was fire with this incident and was told there was no information about fire at the time. The city communications center then asked a unit on the scene if smoke was visible, and the unit replied, “yes, there is a column of smoke.” The fire attack supervisor stated that upon arriving at the scene with the incident commander, they received a briefing from the SFFD-AB shift captain (who was the initial incident commander) followed by a short discussion about what communication channel they should be on. Because frequency C9 was not available, he and the incident commander both switched to frequency C14. He stayed on C14 for the duration of the event and provided face-to-face instructions to ARFF drivers throughout the event because he could not talk to them on C14. He stated that he experienced no difficulty in communicating, and although he would have preferred to be able to talk to them on the radio, they “adapted and moved on.” In addition to the radio frequency problem, multiple firefighters reported significant problems reaching command staff and receiving additional assistance when requested. One SFFD-AB firefighter stated that he radioed for assistance with victims several times but never received a response and believed that once mutual aid responded to the site, communications completely stopped. Another SFFD-AB firefighter stated that at one point, neither she nor two other SFFD-AB firefighters could reach the SFFD-AB shift captain (who served as initial incident commander). In addition to the firefighters, ASOs and SFPD officers also reported communication difficulties. One ASO stated that he was unable to communicate with the firefighters because he was communicating on operations channel 1, and they were on a different channel. This ASO also reported that when he tried to use his truck’s public address system to rally people toward him, he discovered the system was not functional. Another ASO reported that the operations radios could be tuned to the fire frequency but that the emergency response buses only had the operations channel radio. An SFPD lieutenant reported that SFPD officers stationed at the airport could not speak directly to firefighters via radio. There were also reports of breakdowns in communications involving the medical response. Several ASOs were among the first to recognize and respond to the presence of injured occupants in the debris field on the runway. One of these ASOs attempted to get a paramedic company to respond to the area but was told they would have to radio the incident commander to be released to help. Once the incident commander was informed about the seriously injured people on the runway and that no emergency medical services (EMS) personnel were on the east end of the airfield, he released the paramedic company to help. The ASO believed that the incident commander was not aware that help was needed at the rear of the airplane. An SFFD-AB firefighter/paramedic, who initially served as lead triage officer, stated that at no time during the event was he informed about victims on the runway or further back in the debris field toward the water. He believed that all of the ambulances stayed at the triage/treatment area and loaded patients there. He stated that communicating with the ambulances and the other agencies that arrived was very difficult.

NTSB Aircraft Accident Report 49 The SFFD-AB firefighter who served as the staging officer described communication difficulties at the staging area. He stated that some vehicles were escorted to staging and others arrived with no escort. He stated that communication was a big challenge. He stated that having everyone on the same channel would have been good and being able to distribute more radios and/or use fewer channels would have been beneficial. 1.15.4.4 Aircraft Rescue and Firefighting Training Title 14 CFR 139.319(i)(2) states that each certificate holder must ensure that “all rescue and firefighting personnel are properly trained to perform their duties in a manner authorized by the Administrator. Such personnel must be trained before initial performance of rescue and firefighting duties and receive recurrent instruction every 12 consecutive calendar months.” The curriculum for initial and recurrent training must include at least 11 specific areas, including live fire training. The SFFD-AB shift captain, who served as the initial incident commander, had not yet received his FAA-required live fire training. The captain started work at the airport in April 2013, and according to the assistant deputy chief in charge of the SFFD-AB, he was scheduled to attend a live fire burn in July 2013, but it had not yet occurred at the time of the accident. 1.15.4.5 Triage SFFD personnel stated, and industry guidance indicated, that in a mass casualty incident where the number of patients eclipses the number of first responders, the primary goal of triage is to attempt to do the most good for the most people as quickly as possible. As a result, rapid assessments (30 to 60 seconds) of patients’ conditions are made. An inherent aspect of this goal is to prevent the inappropriate application of limited resources to victims who are dead or dying because other victims with a greater chance of survival would be neglected. In addition to the firefighting personnel, who were all trained as either basic emergency medical technicians or paramedics, SFFD had two paramedics, one assigned to each of its medical vehicles (Rescue 91 and 93). Between 1132 and 1133, those vehicles arrived on scene and positioned on the north edge of taxiway F, just past the intersection with taxiway N. One of the paramedics assumed the role of medical group supervisor, and the other assumed the role of lead triage officer. The medical group supervisor responded to the incident command post and was in charge of coordinating the entire medical response while the lead triage officer and the

NTSB Aircraft Accident Report 50 driver of Rescue 91 began the Simple Triage And Rapid Treatment (START) process of placing red, yellow, green, or black triage tags on passengers’ wrists.71 While the personnel on the fire apparatuses initially focused their efforts on controlling the exterior fire, the paramedics from Rescue 91 and 93 began triaging the walking wounded who had gathered in an area near the intersection of taxiway N and F. Passengers were instructed to move toward the medical vehicles to assist with the triage process. At 1136:30, an ambulance already at the airport on an unrelated call positioned near Rescue 91 and 93 and became the hub of triage activity for passengers who evacuated from the left side of the airplane. A second group of passengers who evacuated from the right side and tail of the airplane gathered behind the airplane. About 1153, the first mutual aid ambulance was seen in the accident area. As stated earlier, it is likely that the last passenger was extricated from the back of the airplane about 1147. Although some of the extricated passengers were immediately placed on backboards, numerous SFPD officers and SFFD firefighters complained of a lack of backboards for seriously injured passengers, the quality of the available backboards, and the absence of a mass casualty supply bus. The initial shortage of backboards was remedied by the arrival of mutual aid medical vehicles with additional backboards. Airport operations had two medical buses equipped with mass casualty supplies (including backboards) that were stored at the Airfield Safety Building. The SFO emergency procedures manual listed delivering these buses to the staging area or crash site as among the duties of ASOs in the event of an Alert 3 at the airport. The emergency plan stated that “aviation safety officers deliver…the two Emergency Medical Response buses…early in the response sequence and provide medical supplies and the Emergency Casualty Evacuation carts used by the litter bearers.” In postaccident interviews, several ASOs remarked about a lack of mechanical reliability with the 29-year-old buses, and the captain who supervised the SFFD-AB medical personnel stated that during the airport’s monthly Redcap drills, ASOs did not respond with the medical buses. In postaccident interviews, numerous personnel reported requesting the medical buses at different points after the accident, beginning as early as 5 minutes after the event. According to the airport’s chief operating officer, neither medical bus was driven to the accident site triage area by an ASO because all of the ASOs were busy with other duties, such as escorting mutual aid vehicles to the accident site. The chief operating officer further stated that in the event of an Alert 3 (an accident on or near the airport), the specifics of the event determined what specific equipment needed to be deployed and the medical buses would be delivered when requested by the incident commander. The chief operating officer reported that the airport operations supervisor received a request about 1238, from the airport duty manager, for the two medical

71 Developed in 1983, START is a triage method used by first responders to quickly classify victims during a mass casualty incident based on the severity of their injury. Three main criteria—respiration, perfusion, and mental status—are used to classify the injured. Those requiring immediate treatment are categorized as red, those for whom treatment and transport can be delayed are categorized as yellow, and the “walking wounded” with minor injuries are considered green. A black triage tag would be given to those who are either deceased or expected to die imminently.

NTSB Aircraft Accident Report 51 buses to be brought to the ramp level of Gate 91. However, one of the two buses would not start, so only one was driven by an ASO to the gate. The supplies from this bus were used in providing secondary triage to passengers in the terminal. According to SFFD records, the last patient was transported from the scene by ambulance about 1301. All ambulatory passengers who were relocated to the terminal underwent secondary triage. Numerous additional passengers reported injuries, and by about 1758, the last of those passengers were transported from the terminals to area hospitals. Passenger 41E

In postaccident interviews, at least four emergency responders reported seeing passenger 41E before the first rollover event. The ASO who was the first responder to arrive on the scene reported seeing something that looked like a “big doll” on the ground. He stated that when he saw her, she had no obvious injuries, and there was no blood around her body. He did not find out she was a passenger until more than a day later. The firefighter who initially directed Rescue 10 around the body stated in his interview that he noticed a young female on the ground in the fetal position. She looked to be dead “by appearance,” but he did not check her vital signs. While he was moving his driver into position, he saw a lieutenant and told her about the body. She replied, “yes, yes, okay, okay. We’ve gotta get a line inside.” In her interview, the lieutenant stated that she saw the body and “immediately categorized it as a casualty.” A third firefighter saw passenger 41E while she was repositioning her vehicle in front of the left wing (before the arrival of Rescue 10). She avoided what looked like a small woman curled up (with her knees bent) on the ground. By her position, she thought the person was dead and reminded herself to take care because there might be other deceased persons around the airplane. 1.15.5 Injury Severity The 40 passengers with serious injuries were primarily located in the aft cabin. They included 25 of the 114 passengers with assigned seats in C-zone (22%), 14 of the 158 passengers with assigned seats in B-zone (9%), and 1 of the 21 passengers with assigned seats in A-zone (5%). Figure 12 shows the injury classifications of all occupants by assigned seat and crewmember position. Twenty-four passengers and five flight attendants sustained spinal injuries. The passengers with spinal injuries were also primarily located in the aft cabin, with 20 of the 24 passengers (83%) with spinal injuries located in C-zone. One seriously injured surviving passenger was diagnosed with multiple left-side skull and orbital wall fractures. Additionally, 11 passengers sustained one or more rib fractures. It was noted that only 1 of those 11 passengers (passenger 39G) had a right-side rib fracture.

NTSB Aircraft Accident Report 52 1.15.6 Doors and Slide/Rafts 1.15.6.1 Slide/Raft Information The slide/rafts were manufactured by Air Cruisers Company. The major components of each slide/raft included a slide/raft pack and a packboard with a lacing cover, which contained the slide/raft pack. The slide/raft pack consisted of the girt,72 girt bar, the inflatable tube structure, and the inflation system, which included an inflation cylinder, a regulator valve, hoses, and aspirators.73 The slide/raft was mounted on the door using hardware installed on the back of the packboard that included a release mechanism (see figure 13).

Figure 13. Slide/raft components.

72 The girt is a reinforced, high strength fabric panel that attaches the slide/raft to the airplane. One end of the girt is cemented to the inflatable tube structure, and the other end is attached to the girt bar (a rigid bar) that is attached to floor fittings on the airplane. 73 An aspirator is a tubular structure containing internal nozzles that are connected to the inflation cylinder. When high pressure gas from the cylinder flows through the nozzles, flappers at the inlet end of the aspirator open due to the venturi effect, thereby drawing in surrounding ambient air to supplement the pressurized gas entering the inflatable tube structure.

NTSB Aircraft Accident Report 53 Each slide/raft pack had two safety pins, one for the release mechanism and one for the inflation cylinder, that were to be used when a slide/raft was removed from a door for maintenance. When the slide/raft was reinstalled on the door, both of these pins were to be removed and stowed in a plastic pouch on the lacing cover. A red “remove before flight” warning flag about 4 ft long and 1 inch wide was provided for attachment to the inflation cylinder safety pin. According to Air Cruisers, the slide/rafts were designed to function as follows: (1) The door is closed and then armed, which attaches the girt bar to the floor fittings. (2) Opening the armed door activates the release mechanism, separating the slide/raft pack from the packboard. (3) The slide/raft pack begins to drop downward, and when it has dropped about 65 inches, the increase in tension on the inflation cable opens the valve on the inflation cylinder to initiate inflation. (4) Gas released from the inflation cylinder rushes to the aspirators opening their flappers, which entrain ambient air. The unfolding of the slide/raft occurs in stages controlled by frangible attachments. The aspirator flappers close when the slide/raft pressure builds. (5) The slide/raft extends and inflates fully within 6 seconds. 1.15.6.2 Door and Slide/Raft Performance Postaccident examination of the cabin found doors 1L, 1R, 2L, 2R, 3R, and 4R had no visible structural damage. Door 3L exhibited slight bulging in the forward and aft doorway edge frame, and door 4L had separated from the airplane. The door sill heights to the ground were measured as follows:

 Door 1L: 110 inches  Door 1R: 117 inches  Door 2L: 98 inches  Door 2R: 99 inches  Door 3L: 53 inches  Door 3R: 17 inches (to fuselage wreckage under door sill)  Door 4L: 14 inches  Door 4R: 27 inches Doors 1L and 2L were found in the open position. Both video evidence and flight attendant statements indicated that the 1L and 2L slide/rafts fully deployed and were used during evacuation. Video evidence indicated that the 1L slide/raft was later punctured when firefighters placed a ladder on it to access the airplane’s interior. Door 1R was found in the open position. The 1R slide/raft was found deployed and deflated inside the airplane on the exit passageway floor, extending forward into the forward galley and aft into the right main aisle about 1 to 2 ft. Door 2R was found in the closed position

NTSB Aircraft Accident Report 54 and was fire damaged. The 2R slide/raft was found deployed and deflated inside the airplane on the exit passageway floor, extending across the right main aisle, through the midcabin galley, and ending about 1 ft short of the left main aisle. Door 3L was found in the open position. Video footage showed the door closed throughout the evacuation and opened from the inside by an emergency responder at 1207:43. The 3L slide/raft fell onto the ground and did not inflate. When NTSB investigators arrived, the uninflated 3L slide/raft was hanging from the girt bar on the door sill and resting on the ground. The slide/raft’s inflation cylinder was fully charged, and the cylinder safety pin with the warning flag attached was stowed in the pouch on the lacing cover. Door 3R was found in the open position. Passenger 30K reported opening door 3R during the evacuation and stated that it was “really easy.” The 3R slide/raft was partially deployed when investigators arrived but had not inflated. The slide/raft was hanging from the girt bar and resting on top of the fuselage wreckage that was under the door sill. The slide/raft’s inflation cylinder was fully charged, and the cylinder safety pin with the warning flag attached was stowed in the pouch on the lacing cover. Door 4L was found on the ground outside the airplane about 13 ft laterally from the door sill. The door 4L slide/raft was found inside the airplane fuselage extending aft. The floor structure under the door sill and aft was missing, and the slide/raft was resting on the ground. The slide/raft was attached to the girt bar, which remained attached to the floor fittings. The inflation cylinder was empty. The slide/raft’s aft aspirator had ingested either a blanket or a curtain cabin divider, and the forward aspirator had ingested a stack of folded paper towels. The ingested material in the aspirators was consistent with the slide/raft attempting to inflate during the impact sequence. Door 4R was found in the open position. The girt bar was attached to the floor fittings, but the slide/raft’s girt was torn at the girt bar. The slide/raft was found slightly to the right of airplane centerline at the break in the aft pressure bulkhead and extended aft away from the airplane. The inflation cylinder was fully charged with a safety pin installed in the valve; however, no warning flag was present on the safety pin. The cylinder safety pin warning flag (with no pin attached) was found in the pouch on the lacing cover. The 1L and 2L slide/raft release mechanisms were both examined and were found to have no damage. A detailed examination of the slide/raft release mechanisms on the other six packboards was conducted at the manufacturer’s facility in July 2013 (see section 1.16.5.1). 1.15.6.3 Slide/Raft Maintenance Information Asiana Airlines provided maintenance records that indicated the 4R slide/raft was last overhauled by Asiana on December 17, 2010, and installed on the airplane on January 17, 2011. The installation procedure included a step to remove and stow the inflation cylinder safety pin in the pouch on the lacing cover. This procedure was stamped off as complete by the mechanic and was not stamped off by an inspector. According to Asiana maintenance personnel, an inspector signoff was not required. The maintenance records indicated that during a scheduled

NTSB Aircraft Accident Report 55 maintenance check, the cylinder safety pin was installed on December 2, 2012, and removed on December 8, 2012. This was the last recorded maintenance on door 4R before the accident. Following the postaccident discovery of the safety pin installed in the inflation cylinder of the 4R slide/raft, the FAA performed seven ramp inspections of airplanes operated by Part 129 air carriers with a special emphasis on evacuation slide/rafts and found no discrepancies. Additionally, Asiana performed a voluntary inspection of all of its 777 slide/rafts (including spare slide/rafts) to identify the presence of a safety pin in any other slide/raft’s inflation cylinder. None were found. Also, in response to the finding of the safety pin installed in the inflation cylinder of the 4R slide/raft, Asiana made a change to its slide/raft maintenance procedure. Previously, a single work order was issued per airplane for the installation and removal of the safety pins during maintenance. Under the new procedure now in use, two separate work orders are issued for each slide/raft location (16 work orders per airplane), one for the installation of the safety pin and one for the removal of the safety pin. On March 29, 2013, the FAA published Airworthiness Directive (AD) 2013-05-10, effective May 3, 2013, and applicable to Boeing 777-200, -200LR, -300, -300ER, and 777F airplanes. The AD was issued to detect and correct possible corrosion to the slide/raft release mechanism, which could impair deployment of the slide/raft. Maintenance records provided by Asiana Airlines reflected that the AD was applicable to all eight door positions on the accident airplane and had been accomplished on six of the eight door positions. The compliance “accomplish by” date had not yet been reached for the slide/rafts installed on the 1L and 4R doors. 1.15.7 Cabin Damage The A-zone business class cabin was heavily damaged by the postcrash fire. The fire damage in A-zone was slightly less on the right side of the airplane. All of the seats were damaged and consumed by fire. With the exception of four seats (1A, 1E, 1F, and 5A) for which fire damage precluded determination, all of the seats appeared to be attached to the floor. The B-zone economy class cabin was heavily damaged by the postcrash fire. The fire appeared to be most severe on the left side of B-zone with the forward right side of the area receiving the least severe fire damage. There was localized floor buckling at seat row 15. The following observations were made regarding the B-zone seats:  All of the seats were damaged or consumed by fire.  Most of the seats appeared to be attached to the seat tracks except the center and right-hand side seats at row 15.  Only two seat legs were found cracked or broken. Some of the seat legs were bent to the left. The general condition of the B-zone seat legs appeared to exhibit similar or slightly less bending than what was observed in C-zone. The C-zone economy class cabin was heavily damaged in the crash sequence but did not sustain postcrash fire damage. The damage to C-zone appeared to be most severe aft of seat row 36, where the subfloor structure was destroyed to the extent that most floor panels appeared

NTSB Aircraft Accident Report 56 to be lying directly on the ground. The following observations were made regarding the C-zone seats:  All of the seats remained inside the airplane, were still intact as a unit, and undamaged by fire.  The seat tracks were intact and attached to the floor panels.  Many of the seat units were rotated aft, including seats 42AB.  All of the seatbelts were intact, undamaged, and unbuckled except for seat 42B, where the seatbelt was still buckled.  The seat tubes were all intact at their junctions to the seat legs. The forward seat cross tubes at seats 41ABC and 42AB were fractured at the right end of the tube.  The observed seat legs retained at least one seat track attachment point except seats 30HJK, 39ABC, and 41AB. The general condition of the C-zone seat legs exhibited similar or worse bending compared to the seat legs in B-zone. Several aft seat legs were broken. Many of the seat legs were bent to the left. The aft galley was destroyed in the airplane’s initial impact and slide down the runway. A small section of aft galley floor found just beyond the seawall was the earliest identifiable item from the airplane cabin in the debris field. The L4 and R4 jumpseats, each attached to a section of galley structure, were found to the right of the runway centerline about 500 and 550 ft, respectively, from the runway threshold. Witness (drag) marks leading to the L4 jumpseat and associated galley structure started just past the runway threshold, and witness marks leading to the R4 jumpseat and associated galley structure began about midway through the threshold markings. The four-point restraints for the 4L and 4R jumpseats were unlatched, undamaged, and functioned normally. The M4A jumpseat was found inside the airplane still affixed to the aft lavatory wall in the aft galley; the four-point restraint was unlatched, and the outboard lap belt attachment shackle was fractured. The M4B jumpseat was found, attached to a section of the aft lavatory wall, about 50 ft aft of the airplane; the four-point restraint was latched, and both inertia reels and the buckle functioned normally. 1.16 Tests and Research 1.16.1 Airplane Performance Study and Simulator Evaluations The NTSB conducted an airplane performance study to determine the time alignment among CVR events, FDR data, and ATC data; calculate the airplane’s weight and balance; examine the actions of the low airspeed alerting system; compare the airplane’s airspeed to maximum landing gear and flaps extended speeds; compare the airplane’s flightpath to stabilized approach criteria; and correlate calculated pilot eye height with calculated PAPI beam guidance. In addition, the NTSB conducted engineering workstation simulation and pilot-in-the-loop simulator work using a Boeing 777-200ER engineering flight simulator (EFS) that Boeing provided. Pilots from Boeing, Asiana Airlines, the FAA, and the NTSB participated in the EFS pilot-in-the-loop simulator work.

NTSB Aircraft Accident Report 57 Based on Asiana’s stabilized approach criteria74 and available factual evidence, at 500 ft above airport elevation, Asiana flight 214 had a sink rate greater than 1,000 fpm and did not meet the appropriate power setting guidance for flaps 30° with the gear down.75 Below 500 ft above airport elevation, the approach was evaluated to be unstabilized due to a sink rate greater than 1,000 fpm, airspeed less than target speed by more than 5 knots, progressively large changes in pitch required to maintain the flightpath, and a significantly low glidepath as evidenced by the calculated PAPI guidance cues of four red lights. 1.16.1.1 Workstation Simulation The nominal 777-200ER simulation model provided a good match for the airplane’s previous normal landing and an adequate match for the segment of the accident final approach flightpath in free air (above about 200 ft agl). However, the simulation model did not match the segment of the accident flightpath in ground effect (below about 200 ft agl); rather, it yielded conservative results, producing progressively less lift and higher sink rates than the accident airplane with increasing angle of attack and decreasing airspeed. As a result, the simulated airplane flightpath descended below the accident airplane path, and the simulated airplane contacted the ground short of the accident airplane impact location. The mismatch was likely due to the fact that the accident airplane exceeded 10° angle of attack in ground effect and was operating outside the flight-test-validated envelope for the 777-200ER simulation model.76 Four alternate go-around scenarios were evaluated using the 777-200ER simulation model in a workstation environment. Each go-around scenario represented a specific flight crew technique (control input sequence) accomplished in an attempt to correct the low airplane path and low airspeed condition by initiating a go-around.77 Because the simulation model was conservative in ground effect, each of the four hypothetical go-around scenarios was evaluated with the knowledge that the calculated go-around performance capability would be conservative in the ground effect region. The simulation results indicated that the airplane had adequate performance capability to accomplish a go-around initiated 11 to 12 seconds before ground impact (depending on technique), assuming a minimum aft fuselage clearance during the maneuver of 17 ft above field

74 For information about Asiana’s stabilized approach criteria, see section 1.17.1.4. 75 For information about power setting guidance, see section 1.17.1.6. 76 The 777-200ER aerodynamic ground effect simulation model was validated with flight test data for angle of attack values between -2° and +10°. Boeing reported that it does not conduct flight test maneuvers in ground effect beyond angle of attack values of +10° because of safety concerns. 77 The rationale for choosing go-around scenarios to simulate began with the intent to model the go-around initiation technique attempted by the accident flight crew. The normal all-engine go-around initiation technique documented in existing Boeing guidance was added next. The subsequent comparison of available FDR data to the normal go-around guidance identified differences in engine thrust lever advancement rate and target pitch attitude rate. The effect of these variables was evaluated by constructing two additional hybrid go-around scenarios.

NTSB Aircraft Accident Report 58 elevation.78 The accident flight crew initiated a go-around by advancing the thrust levers about 7 seconds before ground impact. 1.16.1.2 Pilot-in-the-Loop Simulation Test pilots from Boeing and the FAA, who were type rated and current in the 777, flew multiple runs simulating visual approaches to runway 28L at SFO with the A/P off, beginning 5 nm from the runway threshold with two sets of initial conditions. One set of conditions, referred to as the accident profile, modeled the accident flight with the starting altitude at 2,100 ft msl, about 400 ft above a 3° glidepath, and the other set, referred to as the standard profile, modeled a flight that was on a 3° glidepath by starting at 1,650 ft msl. Data from each run were evaluated to determine whether the approach was stable at and below 500 ft agl based on Asiana’s stabilized approach criteria. The pilots had no difficulty in achieving stable approaches on any of the nine runs started at the standard profile conditions (on glidepath), and they were always able to comply with Asiana’s guidance to avoid descent rates in excess of 1,000 fpm below 1,000 ft agl and in excess of 1,500 fpm between 2,000 and 1,000 ft agl. When starting at the accident profile conditions (above glidepath), the pilots experienced difficulty in achieving stabilized approaches, and on 4 of the 10 accident profile runs, they were unable to achieve a stabilized approach. On all 6 runs that resulted in a stabilized approach, the pilots used descent rates in excess of 1,000 fpm below 1,000 ft agl, and on 5 of the 6 runs, the pilots used descent rates in excess of 1,500 fpm between 2,000 and 1,000 ft. 1.16.2 Mode Control Panel Examination The MCP was removed from the instrument panel before the airplane was recovered from the accident site. Other than heavy soot contamination, the MCP appeared to be in good physical condition. Review of the information stored in the MCP’s nonvolatile memory showed that no faults were recorded during the accident flight.79 A functional test of the MCP was performed in accordance with the manufacturer’s specifications. The tests included activation of all toggle switches, push buttons, and knobs on the MCP. The unit passed all performed tests except four. These tests failed because the bottom horizontal segment of the 100s digit in the vertical speed/flightpath angle liquid crystal display screen was missing. Industrial computed tomography was used to internally check the FLCH push-button switch and the left and right F/D switches; no anomalies were identified in any of these switches. Vibration testing of the MCP was conducted, and the push-button switches were monitored during the testing for illumination indicating an unexpected mode engagement. No unexpected mode engagements occurred during the vibration testing.

78 The 17-ft clearance value was based on an estimated 7-ft allowance for lead-in light mounting height above the pier catwalk and a 10-ft allowance to account for the simulation-calculated altitude tolerance. 79 The contacts for all toggle and push-button switches on the front panel of the MCP (including the left and right F/D switches and the FLCH push-button switch) are monitored by the MCP. If a fault is identified for any contact, it will be recorded in the unit’s nonvolatile memory.

NTSB Aircraft Accident Report 59 1.16.3 Autothrottle Component Examination The thrust lever assembly, left A/T assembly, and right A/T assembly were removed from the airplane after it was recovered from the accident site. Other than soot and dust contamination, the components appeared to be in good physical condition. All components were lightly cleaned and installed into a control stand to perform a functional test. The sections of the control stand functional test relevant to the A/T function, thrust lever function, takeoff/go-around (TO/GA) switch operation, and A/T disconnect switch operation were performed in accordance with the manufacturer’s specifications. The control stand passed all sections of the test that were performed except for the right thrust lever angle resolver section. This test section was failed because the A and B channel readings for the right resolver transmitter assembly differed by about 2.6°. According to Boeing, the airplane was designed so that if both channels from the same resolver transmitter assembly are valid, the A/T system receives and uses the higher of the two values. Review of FDR data indicated that during the flight, the recorded values for the left and right engine thrust lever angles were both within the expected tolerance of 34.0° +/- 0.25° when the levers were at the idle stop. Further, if the difference between the two channels is greater than 2° for more than 2 seconds, a noncorrelated maintenance message80 will be generated and reported via the aircraft communications addressing and reporting system (ACARS).81 Asiana reported that no maintenance messages related to a resolver transmitter channel disagree were reported through ACARS from the airplane in their available history dating back to June 20, 2013. 1.16.4 Enhanced Ground Proximity Warning System The airplane was equipped with a Honeywell Mark V enhanced ground proximity warning system (EGPWS) designed to provide aural and visual alerts and warnings to prevent controlled flight into terrain and for low altitude windshear conditions. Review of the information stored in the EGPWS’s nonvolatile memory revealed that no faults, warnings, or events were recorded for the time between the takeoff record and the landing record for the accident flight.82 A functional test was performed on the EGPWS per the manufacturer’s specifications, and it passed all portions of the test. An event analysis provided by Honeywell indicated that the accident flight did not meet the criteria to trigger any EGPWS alerts.

80 A noncorrelated maintenance message is one that does not have an associated flight deck effect. 81 ACARS is a data link system to a ground station that allows for text-based communications. 82 There were faults and warnings recorded more than 10 seconds after the time of the landing record. According to Honeywell, landing records are created when an airplane descends through 50 ft RA. According to the CVR transcript, the 50-ft RA callout occurred at 1127:45.8, and the initial impact occurred less than 5 seconds later at 1127:50.3, indicating that the recorded faults and warnings were postimpact.

NTSB Aircraft Accident Report 60 1.16.5 Slide/Raft Examination and Testing 1.16.5.1 Slide/Raft Release Mechanism Examination The slide/raft release mechanisms for the 1R, 2R, 3L, 3R, 4L, and 4R slide/rafts were examined at the manufacturer’s facility in July 2013. No evidence of corrosion was found on any of the slide/raft release mechanisms. The release shafts of all of the mechanisms sustained damage with the most severe damage being to the 2R, 3R, and 4R release shafts. At the NTSB’s investigative hearing in December 2013, a representative of Air Cruisers described the damage to the release mechanisms as “catastrophic” and stated it was unlike anything the company had seen before in certification tests or in-service airplanes. A Boeing engineer, who was also involved with the investigation of a British Airways 777 accident at Heathrow Airport in 2008, confirmed that no similar damage was seen to the slide/rafts in that accident83 and also stated Boeing had no previous reports of similar damage from in-service airplanes. 1.16.5.2 Slide/Raft Certification Information According to Air Cruisers, during the 777 slide/raft certification process, inertia load testing for slide/raft certification was conducted by attaching a slide/raft assembly to a test fixture that simulated installation on a door. The test fixture was mounted at the end of a long centrifuge arm and rotated to an rpm calculated to achieve the required acceleration loads84 (g85 loads) at the slide/raft’s center of gravity (CG). Starting from a stationary position, the rpms were increased to the desired rpm and maintained for a minimum of 3 seconds and then decreased to a stationary position. The slide/raft was required to remain intact on the fixture, stay within its allowable pack envelope, and then deploy from an aircraft door or equivalent test module. The tests met FAA and Boeing requirements, and testing to higher loads was not performed. 1.16.5.3 Slide/Raft Tests In an effort to replicate the type of damage observed to the slide/raft release mechanisms from the airplane, two series of destructive tests were performed on exemplar 777 packboard release mechanisms. The first series of tests subjected the release mechanisms to an increasing

83 According to the Boeing representative, all of the slide/rafts deployed and inflated normally in that event. 84 The required slide/raft acceleration test loads are specified in 14 CFR 25.810(a)(1)(v) by reference to 14 CFR Part 25.561(b), which states that although an airplane may be damaged in emergency landing conditions on land or water, it must be designed as prescribed in this section to protect each occupant under those conditions. The structure must be designed to give each occupant every reasonable chance of escaping serious injury in a minor crash landing when (1) proper use is made of seats, belts, and all other safety design provisions; (2) the wheels are retracted (where applicable); and (3) the occupant experiences the following ultimate inertia forces acting separately relative to the surrounding structure: (i) upward, 3.0g; (ii) forward, 9.0g; (iii) sideward, 3.0g on the airframe and 4.0g on the seats and their attachments; (iv) downward, 6.0g; and (v) rearward, 1.5g. 85 The letter “g” denotes the ratio of a particular acceleration to the acceleration due to gravity at sea level. In accordance with common practice, this report refers to accelerations or forces in terms of g. For example, it is customarily understood that “5g” represents an acceleration of five times the acceleration of gravity at sea level.

NTSB Aircraft Accident Report 61 (static) tensile load until ultimate failure. Three tests were performed in the inboard direction, and three were performed in the downward direction. The ultimate loads at failure during these tests varied between 1465 and 1781 lbs, which were three to four times higher than certification loads. In all six tests, the release mechanism experienced a failure (tearing) of the release shaft in the area of tang engagement similar to the damage on the release mechanisms for the 2R, 3R, and 4R slide/rafts on the airplane. The NTSB also contracted with a research company to perform sled acceleration tests of six exemplar 777 slide/raft packs. Complete slide/raft packs were affixed to a test rig in a vertical orientation to apply inboard lateral loads, a horizontal orientation to apply downward loads, or a 45° orientation to apply a combined downward and inboard load. The packs were then subjected to test runs with increasing g loads until ultimate failure. The two slide/rafts subjected to inboard loads released at loads of 14.2g and 14.4g; however, there was no damage to the release shafts of the release mechanisms. The two slide/rafts that were subjected to downward loads released at loads of 12.7g and 13.5g, and the damage to the release shafts was similar to those from the 2R, 3R, and 4R slide/rafts on the airplane. The two slide/rafts that were subjected to combined inboard and downward (45°) loads released at loads of 12.4g and 12.9g, and again, the damage to the release shafts was similar to those from the 2R, 3R, and 4R slide/rafts on the airplane. 1.17 Organizational and Management Information Asiana Airlines is a major Korean domestic and international airline based in Seoul, Korea. The company was established in 1988 and, at the time of the accident, provided passenger service to 23 countries and cargo service to 14 countries. Asiana had a fleet of 81 airplanes,86 including 12 Boeing 777 aircraft, and employed 1,349 pilots, including 136 Boeing 777 captains and 129 Boeing 777 FOs. 1.17.1 Pilot Standard Operating Procedures Asiana provided procedural guidance to its flight crews in several documents. The Asiana Flight Operations Manual (FOM) established general procedures and provided instructions and guidance for use by flight operations personnel in the performance of their duties. Flight crew procedures specific to the 777 were found in the Asiana 777 Pilot Operations Manual (POM). Additional guidance was found in the Asiana 777 FCOM, which was prepared by Boeing for Asiana and included operating limitations, procedures, performance, and systems information. With the FCOM, Boeing also provided a 777 QRH that listed normal and nonnormal procedures in a checklist format. Further information and recommendations on maneuvers and techniques were found in Boeing’s 777 Flight Crew Training Manual (FCTM). Flight crews were expected to follow POM guidance where it was more restrictive than other guidance, such as that in the FOM, FCOM, or FCTM.

86 At the time of the accident, Asiana’s fleet was composed of 10 Airbus A320, 24 Airbus A321, 13 Airbus A330, 14 Boeing 747, 8 Boeing 767, and 12 Boeing 777 airplanes.

NTSB Aircraft Accident Report 62 1.17.1.1 Use of Automation The 777 POM, chapter 2, “Supplementary [Normal Procedures] NP,” paragraph 2.1.6, “AFCS Procedures,” provided general guidance to pilots on the proper use of the AFDS and A/T. Subparagraph 2.1.6.1, “General,” stated that the flight crew must always monitor airplane course, vertical path, and speed; verify manually selected or automatic AFDS changes; and when selecting a value on the MCP, verify that the respective value changes on the flight instruments. Further, the subparagraph stated that the flight crew should use the FMA to verify mode changes for the A/P, F/D, and A/T and that to “call out loudly and clearly to the changes on the FMA and thrust mode display when they occur are a good CRM practice.” Subparagraph 2.1.6.2, “AFCS guideline,” stated that “operations by A/P and A/T have preference to improve safety, to reduce workload and to enhance operational capability.” It stated that when “operating within terminal areas where air traffic congestion could be expected, the PF and the PM [should] make full use of A/P and A/T.” It further stated that the flight crew should use the A/P and A/T together and recommended use of A/T during all phases of flight, including manual flight. Subparagraph 2.1.6.4, “A/P and A/T Disengage (Disconnect) Procedure,” stated that the PF should notify the PM when disengaging or disconnecting the A/P and/or A/T. The subparagraph included a note stating that the PF should call out “manual flight” upon disconnecting the A/P and “A/T disconnect” upon disconnecting A/T; the PM should verify that the change is indicated by a change in AFDS status or mode annunciation on the FMA and then call out the change. Further guidance regarding AFDS and A/T mode selections and related callouts was found in paragraph 2.1.4, “Crew duties,” which stated that manipulating the controls and switches on the MCP is the PF’s responsibility, but when flying manually, the PF should direct the PM to make changes on the MCP. Also, paragraph 2.1.7, “Standard Callouts & Response Procedures,” stated that the pilot who is in charge of “flight mode change” must call out accomplishment of a mode change, and the other pilot must respond with a confirmation. This paragraph also stated that the PM should call out every FMA change. Regarding the use of FLCH SPD mode, the 777 FCTM, page 5.26, stated, “Non-ILS approaches are normally flown using VNAV, V/S, or [flightpath angle] FPA pitch modes. The use of FLCH is not recommended after the FAF.” The Asiana 777 chief pilot stated in an interview that the airline recommended using as much automation as possible. He agreed with the statement that Asiana pilots obtained most of their manual flying practice during approaches below 1,000 ft agl. He stated it was permissible for Asiana pilots to disengage the A/P above 1,000 ft, but turning the A/P off at 8 nm from the airport and at 2,800 ft, for example, would not be recommended. When asked if Asiana had a policy regarding when FLCH SPD could be used during an approach, he stated that there was no requirement but that it was not recommended on final approach. He stated that when executing a manually flown visual approach, it was mandatory to have the A/T on for final approach.

NTSB Aircraft Accident Report 63 Other Asiana pilots interviewed agreed that it was standard practice to disengage the A/P about 1,000 ft agl on a manually flown approach. Two Asiana captains with prior flight experience at other airlines stated that most Asiana FOs preferred to make automated landings or to leave the A/P engaged to 1,000 ft agl or lower before taking over and landing manually. An Asiana contract simulator instructor stated that manual flying was a “big scare for everybody,” and he believed that pilots avoided flying manually because of concern that they might do something wrong and the company would blame them if they performed a go-around or had a hard landing that was captured by onboard flight data monitoring devices. He further stated that manual flying training that included the approximate power settings and pitch attitudes required to achieve a 3° glidepath was not in the training syllabus. Asiana provided landing statistics for the year 2012 indicating that on the 777, 77.7% of the landings were made manually and 17.1% were automated landings.87 The statistics also showed that 36% of all 777 landings in 2012 were made by the FO. 1.17.1.2 Descent Procedures The FOM, paragraph 7.8.9, “Maximum Descent Rate,” stated that to avoid controlled flight into terrain, the maximum descent rate is 3,300 fpm for altitudes between 5,000 and 2,000 ft agl and 1,500 fpm for altitudes between 2,000 and 1,000 ft agl. Below 1,000 ft agl, the pilot should follow the stabilized approach criteria (see section 1.17.1.4). The 777 POM, subparagraph 2.12.9.7, “Use of Speedbrakes,” stated that to avoid buffeting, the use of speedbrakes should be avoided at flap settings higher than 5°. It also stated that speedbrakes should be retracted before reaching 1,000 ft agl. According to the 777 FCTM, page 4.21, “Descent Rates,” when operating at idle thrust and an airspeed of about 210 knots, the descent rate can be increased from 1,000 fpm to about 2,300 fpm with the use of speedbrakes. 1.17.1.3 Visual Approach The 777 POM, section 2.18, “Visual Approach,” provided guidance to pilots for visual approaches. The section described how to set up downwind, base, and final legs using the FMC arrival page and how to use distance from the runway end and timing techniques to fly the visual traffic pattern. Subparagraph 2.18.1.4, “Final Approach,” stated that the recommended approach path angle was 2.5° to 3°; an altitude of about 300 ft above the airport elevation for each mile from the runway would provide a normal approach profile; and the airplane should be stabilized on the selected approach speed with a rate of descent of 700 to 900 fpm. It further stated that descent rates greater than 1,000 fpm should be avoided; however, rates a “little over 1,000 fpm” were acceptable and should be included in the approach briefing.

87 For the other 5.2% of 777 landings in 2012, the type of landing was not reported.

NTSB Aircraft Accident Report 64 In the same simulator that was used for the pilot-in-the-loop simulations described in section 1.16.1.2, an Asiana training captain demonstrated the technique pilots were taught for performing a visual approach involving a standard traffic pattern. His demonstration, including the use of the FMC, timing to determine when to make turns, use of the VPI, and use of the A/P until about 1,000 ft agl on final approach, were consistent with the guidance in the Asiana 777 POM. 1.17.1.4 Stabilized Approach and Go-Around The 777 POM, paragraph 2.13.6, “Stabilized Approach,” addressed stabilized approach procedures and criteria. It stated, “every flight crewmember must confirm and monitor a stabilized approach, and “if a stabilized approach is not established, go-around.” The paragraph also included a note that stated “deciding to make Go-Around does not mean that the procedure has been done wrong, but it means that crews follow[ed] the company safety policy and executed safety procedure normally.” Subparagraph 2.13.6.5, “Stabilized Approach Criteria,” stated, in part, the following:

a. All approaches should be stabilized by 1,000 ft above airport elevation in [instrument meteorological conditions] IMC and 500 ft above airport elevation in VMC. An approach is considered stabilized when all of the following criteria are met: 1) the airplane is on the correct flightpath 2) only small changes in heading and pitch are required to maintain the correct flightpath 3) Speed: Max Target speed +10 knots, Min Target speed - 5 knots (Target speed = Vref + Wind Correction) 4) the airplane is in the correct landing configuration 5) sink rate is no greater than 1,000 fpm; if an approach requires a sink rate greater than 1,000 fpm, a special briefing should be conducted 6) thrust setting is appropriate for the airplane configuration 7) all briefings and checklists have been conducted.

The subparagraph included a note that stated, in part, “an approach that becomes unstabilized below 1,000 feet [above field elevation] AFE in IMC or below 500 feet AFE in VMC requires an immediate go around.” The 777 POM, subparagraph 2.13.6.8, “Standard Callout & Response,” stated that the PM should call out “five hundred” at 500 ft AFE; the PF should respond “stabilized” or “go-around;” and a go-around should be made if the approach was not stabilized. In a postaccident interview, the PF stated that at 500 ft AFE, the airplane should be stabilized, and for a visual approach, the airplane should be stabilized by 300 ft AFE. For an unstable condition, he said a go-around should be performed. The PF stated that only the PIC, in

NTSB Aircraft Accident Report 65 this case the PM, had the authority to decide to go around. He said this was company policy resulting from a tailstrike event that had occurred when an FO had initiated a go around. In a postaccident interview, the PM stated that “the PF was supposed to be the one calling out the go-around.” However, he also stated that when he discussed executing a go-around with the PF during the flight, he said that if performance requirements were not met, he (the PM) would say “I have control.” The FOM, paragraph 7.10.2, “Decision to Land,” subparagraph 7.10.2.1, “Responsibility,” stated that the “captain has authority and responsibility to make a landing or missed approach (go-around) considering actual weather condition and stabilized approach condition.” The 777 POM, section 2.19, “Missed Approach (Go-around) Procedure,” subparagraph 2.19.1.1, “Decision and Control,” stated that “the decision to make a missed approach rests with the Captain. However, when the Co-pilot (F/O) flies the aircraft as PF, Co-pilot (F/O) can make a missed approach.” Subparagraph 2.19.1.3, “Missed approach during Manual Instrument Approach or Visual Approach,” stated that if a missed approach is required following a visual approach, the PF should “push either TO/GA switch, call for flaps 20, check go-around thrust set, and rotate smoothly toward 15 [degree] pitch attitude.” The Asiana 777 chief pilot stated in an interview that the first responsibility for conducting a go-around rested with the PIC but the PF could decide to perform a go-around at any time, and anyone in the cockpit could call for a go-around. He said he thought all Asiana captains would agree that an FO could initiate a go-around. Interviews with several Asiana pilots and instructors yielded similar interpretations of Asiana policy in this area. For example, an IP who conducted OE with the PF for flight 214 was asked specifically if it was acceptable for a captain in the left seat who was being instructed to make the decision to go around, and he responded that it was acceptable. 1.17.1.5 Flight Crew Duties During Approach The 777 POM, section 2.13, “Approach Procedure,” paragraph 2.13.1, “PF/PM’s Duties,” stated that for all approaches, the PF’s duties were the following:

• Maintain aircraft control and conduct the approach briefing
• Follow published approach procedures
• Cross check all flight instruments
• When using the AFDS, the PIC should be ready for manual flight before

passing the final approach fix. The PM’s duties for all approaches were the following:

• Make active standard callouts
• Cross check all primary instruments and raw data

NTSB Aircraft Accident Report 66

1. Monitor any display of warning/caution flags or deviation from the intended

flightpath and callout to the PF

1. Monitor speed and descent rate until touchdown
2. After landing, advise runway and taxiway to PF
3. When aircraft is unstabilized or safe landing is not assured, advise the PF to

make a missed approach.

Subparagraph 2.13.2.2, “Deviation Callout,” stated that when airspeed, glideslope, localizer, sink rate, thrust, or visual guidance is out of approach limitation, the PM should call it out clearly. Paragraph 2.13.5, “Scan Policy,” addressed the division of flight deck workload for instrument scan and acquisition of visual cues during landing. It stated that for a visual approach below 1,000 ft agl, after visual contact was made with the airport, both the PF and the PM should be scanning both inside and outside the airplane. It stated that the PM should monitor airspeed and sink rate through the touchdown, and when there was an additional pilot in the cockpit, he or she should perform backup duty for the PM during the approach. 1.17.1.6 Expected Pitch and Power on Final Approach The 777 FCOM, chapter PI, “Performance Inflight,” pages PI.10.30-31, provided a chart listing approximate values for pitch attitude and power setting for various phases of flight. For flight on final approach (1,500 ft agl), gear down, thrust set to maintain a 3° glidepath, flaps 30, and speed Vref plus 10 knots (142 knots for flight 214), at a landing weight of 450,000 lbs, the chart showed an expected pitch attitude of 0° and 57.9% N1 speed. For a landing weight of 350,000 lbs, the chart showed an expected pitch attitude of -0.5° and 51.2% N1 speed. 1.17.1.7 Evacuation The 777 POM, chapter 4, “Non-Normal Procedures,” paragraph 4.1.4, “Authority and Responsibility in Emergency,” stated, “in an emergency situation that requires immediate action for the safety of passengers, crew and aircraft, the captain may deviate from prescribed operation procedures and aviation regulations. At that time the captain shall notify appropriate ATC facilities immediately [of] the deviated situation.” Subparagraph 4.10.2.5, “After Landing or Rejected Takeoff,” addressed evacuation policy. It indicated that the captain should determine if an evacuation is necessary, and if so, to perform the QRH evacuation procedure; the evacuation procedure was located on the back page of the 777 QRH. The procedure required the parking brake to be set, the outflow valves to be opened, and the engine to be shut down before advising the cabin to evacuate. A contract simulator instructor stated that if pilots missed a step on the evacuation checklist in training it would be a failure, and he did not think Asiana pilots would deviate from the evacuation checklist. He was asked if there was a step in the evacuation training that involved calling the tower before evacuating. He replied yes. He stated that it was not in the checklist, but in a situation where the crew was not sure about the condition of the airplane, the

NTSB Aircraft Accident Report 67 pilots would want to confirm with the tower whether a fire was visible. If the flight crewmembers were sure about the airplane’s condition, they would have to immediately evacuate. 1.17.2 Flight Crew Training Asiana Airlines provided its pilots with all training at its headquarters, including initial, recurrent, upgrade and transition ground training, simulator training, testing, and checks. Asiana employed contract instructors to conduct the full flight simulator portion of 777 training. All training curriculum, procedures, and standards were developed by the Asiana flight crew training team under the direction of the general manager of flight crew training. The Asiana Airlines Flight Crew Training Regulation established operational standards and procedures for flight crew training and evaluation. For 777 pilot training, Asiana Airlines also used Boeing’s 777 FCTM. The introductory section of the FCTM stated that procedures and restrictions published in the FCOM, QRH, and other documents took precedence over the FCTM. 1.17.2.1 Autothrottle Function Training The PF’s Asiana 777 transition training included detailed overviews of the 777 autoflight system presented during two instructor-led training modules, a 4-hour slideshow on the “Automatic Flight System,” and a 2-hour slideshow titled “B777 Flight Controls – Recurrent Training.” According to Asiana, the slides were based on screen captures of computer-based training lessons purchased from Boeing to which Asiana instructors added descriptions and references from the Asiana POM, Asiana FCOM, and the Boeing FCTM. The “Automatic Flight System” training module described A/T function during FLCH descent and stated that the A/T activates in THR mode and transitions to HOLD mode if the thrust levers reach idle. This module also included information about the forms of flight envelope protection provided by the A/P, which included stall protection. One of the module’s slides included the statement:

DOES THE AUTOPILOT NEED TO BE ENGAGED TO HAVE FLIGHT ENVELOPE PROTECTION? NO (Demo in SIM[ULATOR]) The “B777 Flight Controls – Recurrent Training” training module contained the following additional information about stall protection:

Stall Protection Feature • Reduces the possibility of reaching stick shaker • No trim below minimum maneuvering speed • Slow speed requires continuous back pressure • Autothrottle engaged automatically (if armed)

NTSB Aircraft Accident Report 68 The “Automatic Flight System” transition training module and the “B777 Flight Controls – Recurrent Training” module did not indicate that the low speed protection function provided by the A/T would not activate if the A/T was in HOLD mode. In a written statement, an Asiana 777 ground school instructor indicated that although the information was not included on any slides, he explained during a 777 ground school class attended by the PF that the A/T would sometimes remain in HOLD mode after the A/P was disconnected and airspeed could drop. He described this as an “anomaly in the Boeing 777’s autothrottle functioning” that he had personally experienced on three separate occasions. He said he advised students that this could occur during a high energy descent in FLCH mode and that if they encountered this situation, they should change the AFDS pitch mode to V/S or VNAV. An Asiana pilot who was in this instructor’s class with the PF reviewed his class notes and confirmed that the instructor had provided this information. The same student stated that another instructor had provided similar information during another 777 ground school class attended by the PF and advised students that they should not use FLCH to descend after crossing the FAF. 1.17.2.2 Asiana Pilots’ Statements about A/T Function The PF stated that the 777 A/T system would always maintain the selected airspeed as long as the A/T was on. He said that if a pilot overrode the thrust levers manually, the A/T would resume controlling airspeed when the pilot released the thrust levers. He stated that it was irrelevant whether he had pushed the FLCH button immediately before disconnecting the A/P during the accident approach because he was in manual flight and the A/T was always working. He thought the A/T should have automatically advanced the thrust levers upon reaching the MCP-selected airspeed during the accident approach, and he did not understand why that did not occur. Furthermore, he thought the A/T system should have automatically transitioned to TO/GA when the airplane reached minimum airspeed. In that respect, he believed that the 777 A/T functionality was similar to alpha floor protection on the Airbus A320/321.88 Asked how confident he was in his understanding of the 777 AFCS, he said he had followed the Asiana training program but was not confident in his understanding, and he thought he needed to study more. An Asiana 777 OE instructor captain who had conducted an OE instructor check flight with the PM was asked to predict how the 777 A/T system would behave if the FLCH pushbutton was selected while descending through 2,000 ft msl in V/S mode with the A/P on and the MCP altitude set to 3,000 ft msl. He said that the thrust levers would advance, and the airplane would try to climb. When asked what mode the A/T would be in if the pilot manually pulled the thrust levers back, he said that the A/T would remain in SPD mode, and the thrust levers would advance after the pilot released them. Three additional Asiana pilots were asked what would happen in this same scenario if a pilot pulled the thrust levers back manually and then disconnected the A/P. Another 777 OE instructor captain who had conducted an OE training

88 Alpha floor protection is a low speed protection feature of the Airbus autothrust system. When activated, it provides TO/GA thrust. As an Airbus airplane decelerates into the alpha (angle of attack) protection range, alpha floor protection is activated, even if the autothrust is disengaged. Alpha floor protection is inhibited below 100 ft RA, if autothrust is unserviceable, following a double engine failure on the four-engine A340 or a single engine failure on twin-engine models, and above Mach 0.53.

NTSB Aircraft Accident Report 69 flight with the PM said he did not know what thrust mode the A/T would be in after this sequence of actions. Two 777 OE instructor captains who had conducted OE training flights with the PF said that the A/T would transition to HOLD mode and remain there until a different A/P pitch mode was selected by the pilot. The Asiana 777 chief pilot was asked if there were any conditions in which the 777 A/T system would not provide low speed protection, and he said it would not provide low speed protection in HOLD mode. He said this information was not included in Asiana’s 777 pilot training curriculum but was contained in the 777 FCOM, and he thought Asiana 777 pilots were aware of it. When the same question was posed to three OE training captains (two of whom had conducted OE training flights with the PM and one of whom had conducted an OE flight with the PF), they said that the A/T system did not provide low speed protection in HOLD mode; however, one said he had only learned that after the accident. A fourth OE instructor was asked the same question and said that the A/T system would not provide low speed protection if the A/P and A/T both failed. A contract simulator instructor (who had been providing 777 simulator training to Asiana pilots since 2006) was asked if he thought most pilots understood that the 777 A/T system did not provide low speed protection in HOLD mode, and he said he was not aware of that himself until Boeing provided an update to the 777 FCOM in 2012.89 1.17.2.3 Stall Protection Demonstration The 777 FCTM, page 7.11, “Stall Protection Demonstration,” described a demonstration to be used in 777 training to familiarize pilots with stall warning and the correct recovery technique for conditions approaching a stall, with and without the A/P engaged. In a series of three approaches to stall from level flight, the first maneuver demonstrated the A/T “wake up” feature, the second demonstrated nose-up trim inhibit and increased column force below minimum maneuver speed, and the third demonstrated A/P commanded descent at slightly above minimum maneuver speed when the A/T is disarmed. Asiana adopted the FCTM stall protection demonstration in its 777 simulator training, and the pilots had observed the demonstration. During the demonstration, A/P and A/T were disengaged, thrust levers were retarded to idle, command speed was reduced below minimum speed on the speed tape, and the airplane was allowed to decelerate into the amber band on the airspeed tape (below minimum maneuvering speed). With no pilot intervention, the A/T system’s “wake up” feature activated, and the system engaged in SPD mode and returned the airplane to minimum maneuver speed. The PF stated that when he saw the demonstration, he was “astonished” that the airplane would recover by itself from an approach to stall. 1.17.2.4 Flight Director Use During Visual and Circling Approaches The FCTM, page 5.60-61, “Visual Approach –General,” addressed procedures for flying a visual approach. No reference was made in this section to the use of F/Ds. The FCTM,

89 According to Boeing, this 2012 update relocated a discussion of the A/T’s automatic activation feature from section 9.20, where it had been part of a larger discussion of stall protection features, to section 4.20, where it was included in a description of the A/T.

NTSB Aircraft Accident Report 70 page 5.54, “Circling Approach – General,” did address the use of F/Ds during a circling approach, stating the following: When intercepting the visual profile, disengage the autopilot and continue the approach manually. At this point in the approach, the pilot’s attention should be focused on flying the visual profile rather than attempting to set the MCP or FMC to allow continued use of the autopilot. After intercepting the visual profile, cycle both F/D to OFF, and select the PM F/D to ON. This eliminates unwanted commands for the PF and allows continued F/D guidance for the PM in the event of a go-around when pitch or roll mode is changed. Complete the landing.

Note: If a go-around is selected with either flight director switch in the OFF position, the flight director pitch or roll command bar on the corresponding side will disappear when the first pitch or roll mode is selected or engaged. 1.17.2.5 Instructor Pilot Training A review of Asiana’s 777 flight instructor training guide showed that instruction techniques were taught, as well as execution of normal and nonnormal procedures. The simulator training included several scenarios in which the instructor trainee had to identify poor or dangerous performance by the pilot in the left seat and take action to recover the airplane safely. For example, in one scenario, the instructor trainee had to take control of the flight from the left seat pilot because of a takeoff overrotation, and in another scenario, the instructor trainee had to take over because of no flare during landing at 30 ft above the runway. The final stage of instructor training consisted of two flight legs of OE instruction and two flight legs of a check in the airplane. On the training flights and check flights, the instructor trainee flew the airplane from the right seat but gave no instruction. 1.17.3 Regulatory Oversight Regulatory oversight of Asiana in the Republic of Korea is the responsibility of the KOCA. Regulatory oversight of Asiana in the United States is the responsibility of the FAA. Within the KOCA, oversight of Asiana is conducted by the Air Operations Safety Division. According to the principal operations inspector (POI), he was responsible for approving the entire Asiana training manual, including all changes, and FOM special limitations. The POI stated that the KOCA only conducted pilot checkrides of upgrading captains, and he did about 10 flight examinations per year but did not conduct type rating checkrides. To operate into the United States, foreign carriers must obtain a permit issued by the US Department of Transportation and obtain operations specifications issued by the FAA. Operations of foreign air carriers are regulated by the FAA under 14 CFR Part 129,90 which

90 According to the FAA, as of July 2013, there were 482 foreign air carriers certified under Part 129.

NTSB Aircraft Accident Report 71 specifies that each carrier must meet the safety standards contained in International Civil Aviation Organization (ICAO) Annex 6.91 In 1992, the FAA established the International Aviation Safety Assessments Program under which the FAA assesses whether another country’s oversight of its air carriers operating into the United States complies with ICAO safety standards; as of July 2013, the Republic of Korea was determined to be in compliance. The POI assigned to provide FAA oversight of Asiana Airlines in the United States explained that as a Part 129 POI, his activities focused on maintaining the operations specifications of each carrier he was responsible for, reviewing each carrier’s performance, and generating recommendations for the work program. He stated that the only type of inspection the FAA was authorized to perform on Asiana was a ramp inspection. The POI stated that the FAA was not authorized to ride a foreign carrier jumpseat or to conduct cockpit or cabin en route inspections. He stated that the FAA did not approve operations manuals or crew training programs and had no oversight of these items. A review of 140 entries in the FAA’s program tracking and reporting subsystem regarding Asiana since October 2011 showed that most entries were related to ramp inspections or operations specifications revisions. A total of 118 ramp inspections were conducted at 11 US airports served by Asiana. One possible flight violation was noted, which was referred to and resolved by Asiana Airlines.92 1.18 Additional Information 1.18.1 Postaccident Safety Action 1.18.1.1 Asiana Airlines In December 2013, Asiana Airlines provided NTSB investigators with a list of the company’s postaccident actions, which included the following:

(1) Enhanced flight crew training and evaluation for all flight crewmembers: • Increased hours for basic, initial, and transition training • Increased training focus on automation logic and the capabilities of the A/T stall protection system

91 Annex 6 addresses the standards and recommended practices for the operation of aircraft. 92 According to the FAA, during an approach to Seattle-Tacoma International Airport, an Asiana flight was cleared by ATC to track inbound on the localizer and maintain 5,000 ft. However, the flight started descending on the ILS glideslope before receiving clearance for the descent. According to the FAA, Asiana took immediate corrective actions including briefing and training the incident flight crew and informing other Asiana pilots of the circumstances of the event.

NTSB Aircraft Accident Report 72 • Increased training focus on visual approaches and enhanced evaluation of visual approach performance • Additional evaluation for captain upgrade

(2) Strengthened flight instructor training • Enhanced flight instructor screening and selection process • Increase in required training hours for ground school, simulator, and OE flight instructor training • Increased focus on special airports, visual and nonprecision approach, unstabilized approach, monitoring, and standard callouts

(3) Enhanced CRM training • Implementation of new advanced communications and CRM courses • Special training focusing on monitoring, workload management, and threat and error management

(4) Revamped safety management structure • New senior executive-level position to oversee safety operations • Additional staff devoted to internal safety audits, flight crew training support and development, and CRM instruction

(5) Other measures • Revision of safety management system program and company procedures and manuals to provide more detailed guidance on key issues 1.18.1.2 City and County of San Francisco On January 17, 2014, the City and County of San Francisco provided a party submission that included a list of postaccident actions. These actions included the following:

(1) Training enhancements • 40-hours ARFF training for all personnel provided by Dallas/Fort Worth International Airport (DFW) Fire Training Research Center (FTRC) • Advanced-level ARFF training at the DFW FTRC budgeted for a 2014 start • Adoption of DFW curriculum for driver training and HRET training • Adoption of incident management training and certification of all officers

(2) System and equipment enhancements • Adoption of improved triage system to enhance mass casualty incident management and patient tracking • Adoption of an accountability system for tracking all fire and emergency personnel on scene • Budgeted for the purchase of two dedicated SFFD-AB mass casualty unit vehicles, each holding 250 backboards, one to be purchased in 2014/15 and one in 2015/16

NTSB Aircraft Accident Report 73 • Integration of the new 700-MHz radio system at SFFD-AB with established interoperability with SFFD and San Mateo County • Budgeted for the installation of an airfield fire hydrant to be located approximately 2,500 ft in from the 28R threshold, near Taxiways Charlie and November • Purchase of a 767-200 aircraft to be used for emergency training • In 2014, plan to require each airline regularly operating at SFO to review with airport officials its individual safety plans as required by federal law

(3) Personnel development • Upgrade of the EMS supervisor position from a 40-hour/week position to a 24/7 position • Agreement by the Fire Fighters’ union that assignment to the SFFD-AB will be a 5-year commitment, rather than no previously imposed commitment • Development of a new managerial level position, effective January 6, 2014, for a Director of Safety and Strategic Programs 1.18.2 Boeing Certification Issue Involving A/T Automatic Engagement Logic Boeing reported that during the 777 flight test certification program in 1995, a specific test was conducted to demonstrate that the A/T did not automatically engage when the A/P pitch mode was FLCH SPD. The flight test certification report documenting this flight, approved by the FAA on May 27, 1996, stated, “Per design, when the autopilot is controlling airspeed, the autothrottle automatic engage feature is disabled.” During the 787 flight test certification program in 2010, the FAA’s primary project pilot for the program noted an issue involving the A/T automatic engagement feature. (According to Boeing, the 777 and 787 have the same automatic A/T engagement feature.) The FAA pilot reported that during a 787 test flight on August 30, 2010, he was flying the airplane from the left seat and descending from 10,000 to 3,000 ft msl in FLCH pitch mode when the traffic collision avoidance system issued a resolution advisory. He responded by disconnecting the A/P and manually leveling off. He subsequently noticed that the airspeed had decreased 10 or 15 knots. The airspeed continued to decrease until it was below the minimum maneuvering speed. At that point, he pushed the thrust levers forward and recovered the airspeed. The primary project pilot stated that he had about 1,000 hours of flight experience in Boeing airplanes, including about 500 hours in the 777, and that the A/T system in the 787 had not functioned the way he expected during this incident. He thought the system behavior was “less than desirable” and could be improved. As a result, he drafted an FAA Flight Test Response Item (RI) report titled “Autothrottle does not wake up when in Thrust Hold mode.” Identified as “RI-12,” the report described the issue as follows:

NTSB Aircraft Accident Report 74 When in a descent such as FLCH with autothrottle in THR HOLD mode, and the descent has to be manually interrupted for something such as [a] traffic alert, the autothrottle will stay in THR HOLD mode and will not wake up as it does when you capture the original altitude. The speed will decrease well past maneuvering speed. The primary project pilot said RI-12 prompted discussions between the FAA and Boeing. As a result, the FAA required Boeing to add the following passage to the 787 Airplane Flight Manual (AFM), which was added in August 2011: During a descent in FLCH mode or VNAV SPD mode, the A/T may activate in HOLD mode. When in HOLD mode, the A/T will not wake up even during large deviations from target speed and does not support stall protection. The primary project pilot stated that a similar note was not added to the 777 AFM, which had been previously approved by the FAA. The European Aviation Safety Agency (EASA) also voiced a concern about A/T automatic engagement on the 787 in a document titled “EASA Debrief Note on Boeing 787-8 RR EASA Validation Familiarization Flight Test Visit,” dated May 22, 2011. In an item titled “Major Recommendation for Improvement #3,” the debrief note pointed out that A/T automatic engagement (wake up) was not available in a FLCH or VNAV SPD descent with the A/T in HOLD mode and stated that “although the certification team accepts that this ‘Autothrottle wake up’ feature is not required per certification requirements, these two exceptions look from a pilot’s perspective as an inconsistency in the automation behavior of the airplane.” According to the note, a major recommendation for improvement is “an item which meets the required standard but where considerable improvement is recommended.” The debrief note further stated that “the manufacturer would enhance the safety of the product by avoiding exceptions in the ‘Autothrottle wake up’ mode condition.” 1.18.3 Federal Aviation Administration Actions About Manual Flight Operations The FAA issued Safety Alert for Operators (SAFO) 13002, “Manual Flight Operations,” on January 4, 2013, encouraging operators to promote manual flight operations when appropriate. It stated that a recent analysis of flight operations data (including normal flight operations, incidents, and accidents) identified an increase in manual handling errors. The SAFO acknowledged that autoflight systems are useful tools for pilots and have improved safety and workload management but cautioned that continuous use of autoflight systems could lead to degradation of the pilot’s ability to quickly recover the aircraft from an undesired state. It encouraged operators to take an integrated approach by incorporating emphasis of manual flight operations into both line operations and training (initial/upgrade and recurrent). The FAA issued a revision to 14 CFR Part 121, titled “Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers,” on November 12, 2013, intended to enhance US air carrier pilot training programs by emphasizing the development of pilots’ manual handling skills. Among the changes was a new section, 14 CFR 121.423, “Pilot: Extended Envelope Training,”

NTSB Aircraft Accident Report 75 which states, in part, that pilots must receive training that includes the following maneuvers and procedures: manually controlled slow flight, manually controlled loss of reliable airspeed, manually controlled instrument departure and arrival, upset recovery maneuvers, and recovery from bounced landing. Operators’ compliance with this section is required no later than March 12, 2019. 1.18.4 Federal Aviation Administration Guidance on Use of HRET At the NTSB’s investigative hearing, an FAA representative stated that Advisory Circular (AC) 150/5210-23, “ARFF Vehicle and High Reach Extendable Turret (HRET) Operation, Training and Qualifications,” dated September 30, 2010, provided guidance on HRET use. He added that “we don’t directly tell them when to pierce, but we do provide information about piercing…we do provide guidance on how to pierce, but we don’t provide any guidance really on when to pierce.” The AC included the results of FAA testing that compared the performance of a roof turret with an HRET, stating that the HRET and skin-penetrating nozzle evaluated at the fire test facility outperformed the standard roof-mounted turret and hand line. The AC further stated that during a full-scale fire field test using a training aircraft, the HRET with skin-penetrating nozzle showed the ability to control and contain the fire from spreading beyond the tail section, reduce high cabin temperatures from over 1,500°F to about 250°F, and provide rapid smoke ventilation. Additionally, the cabin conditions after discharging the fine mist water spray allowed firefighters to enter the aircraft. FAA Report DOT/FAA/AR-11/15, dated November 2011, titled “Test and Evaluation of Next Generation 65-Foot, High-Reach Extendable Turret,” stated that the benefits of the HRET include “the ability to penetrate inside an aircraft to cool the interior cabin and extinguish the fire,” which “can increase passenger survivability, protect property, and extinguish fire faster during an aircraft postcrash incident.” 1.18.5 Postaccident Flight Crew Toxicological Testing Requirements Title 14 CFR Part 129 does not address drug and alcohol testing for foreign air carriers and operators following an accident in the United States. Title 14 CFR Part 120, which specifies the required drug and alcohol testing programs for US air carriers and operators, does not apply to Part 129 air carriers. According to 14 CFR 120.217(b), postaccident alcohol testing of flight crewmembers is required as soon as practicable following an accident (preferably within 2 hours and not later than 8 hours after an accident). According to 14 CFR 120.109(c), postaccident drug testing of flight crewmembers for the presence of marijuana, cocaine, opiates, phencyclidine, and amphetamines is required as soon as possible but not later than 32 hours after an accident. In the Omnibus Transportation Employee Testing Act of 1991, the FAA was authorized to prescribe regulations requiring foreign air carriers to implement drug and alcohol testing programs, but only if such regulations were consistent with the international obligations of the United States and took into consideration foreign laws and regulations. Pursuant to this statute, in

NTSB Aircraft Accident Report 76 February 1994, the FAA published a notice of proposed rulemaking to require foreign air carriers operating to the United States to implement testing programs like those required of US carriers. In January 2000, the FAA withdrew the proposed rule, stating that through ICAO, multilateral action had been taken to support an aviation environment free of substance abuse. The FAA further stated that it was leaving within the purview of each government the method chosen to respond to the ICAO initiatives and that it viewed a multilateral response as the best approach to evolving issues in the substance abuse arena. Additionally, the FAA stated that should the threat to aviation safety posed by substance abuse increase or require additional efforts and the international community did not adequately respond, the FAA would take appropriate action, including the possible reinitiation of rulemaking. During the 38th session of the ICAO Assembly held from September 24 to October 4, 2013, the United States presented a paper, authored by the FAA, that proposed developing an ICAO standard on postaccident drug and alcohol testing of flight crewmembers. The paper stated that although postaccident testing is referenced in the ICAO Standards and Recommended Practices, the lack of a common approach to accident investigations, particularly postaccident testing, may result in an inability of some nations to properly determine the existence of, or impairment from, drugs and alcohol. The paper further stated that the establishment of an ICAO standard for postaccident drug and alcohol testing would promote international acceptance and implementation of such programs. ICAO agreed to review existing standards, recommended practices, and guidance material to determine the need for a specific standard to address postaccident drug and alcohol testing of flight crewmembers.

NTSB Aircraft Accident Report 77

1. Analysis
2. 1 General

The flight crewmembers were properly certificated and qualified in accordance with Korean regulations and 14 CFR Part 129. The investigation found no evidence that the flight crews’ performance was affected by any behavioral or medical condition or by the use of alcohol or drugs. The airplane was loaded within weight and CG limits and was equipped, certified, and maintained in accordance with KOCA regulations and 14 CFR Part 129. The investigation found no evidence of any preimpact structural, engine, or system failures, including no indications of problems with the airplane’s AFCS. Weather conditions at the time of the accident were suitable for a visual approach. Air traffic controllers vectored flight 214 toward the extended centerline of runway 28L and, after the pilots reported the airport in sight, issued a clearance for the visual approach at a position and altitude that allowed for a normal descent and approach to the runway. The speed restriction issued on approach was in accordance with FAA procedures, and the flight crew accepted the speed assignment. The MSAW system was configured within FAA standards and performed as expected; it would not have activated based on the airplane’s proximity to the runway. The NTSB concludes that the following were not factors in the accident: flight crew certification and qualification; flight crew behavioral or medical conditions or the use of alcohol or drugs; airplane certification and maintenance; preimpact structural, engine, or system failures; or the air traffic controllers’ handling of the flight. A NOTAM had been published indicating that the ILS glideslope for runway 28L was out of service due to a construction project, and the flight crew was aware of the outage. While the electronic vertical guidance provided by a glideslope is required for approaches in certain low visibility conditions and can be a useful aid in all weather conditions, a glideslope is not required for a visual approach. The flight crew had numerous other cues to assist in planning and flying an appropriate vertical flightpath to the runway. Flight crews routinely plan descents based on speed and distance from airports or navigational fixes and published crossing altitudes on approach charts. Aids such as the ND’s green altitude range arc and VNAV features were available to guide the pilots in the initial portion of the descent. As the airplane neared the runway, the PAPI lights and the visual aspect of the runway surface provided additional cues. The NTSB concludes that although the ILS glideslope was out of service, the lack of a glideslope should not have precluded the pilots’ successful completion of a visual approach. The following analysis describes the accident sequence and examines the safety issues associated with the flight crew’s performance and the operation of the airplane’s systems during the approach.

NTSB Aircraft Accident Report 78 2.2 Accident Sequence 2.2.1 Approach from 14 to 5 nm from the Runway The airplane intercepted the final approach course for runway 28L about 14.1 nm from the runway threshold and 4,800 ft msl, which was close to the desired glidepath and set up the flight crew for a straight-in visual approach. However, after the flight crew accepted the ATC instruction to maintain 180 knots to 5 nm from the runway, the crew made inputs to the AFCS that reduced the airplane’s descent rate and caused it to diverge well above the desired 3° glidepath. The PF decreased the MCP-selected speed from 210 knots to 180 knots and commanded flaps 5. While these selections at this time were appropriate, leaving the AFDS in FLCH SPD pitch mode without using the speedbrake to ensure an adequate rate of descent was not effective because the A/P was controlling airspeed with elevator inputs and the reduction in selected speed caused the airplane to pitch up and the descent rate to decrease. As a result, the airplane started to drift above the desired glidepath. In addition, the PF did not appear to promptly recognize that the airplane was drifting above the desired glidepath after he had selected a lower airspeed in FLCH SPD. A cue available to the flight crew indicating the airplane’s position relative to the desired glidepath was the green altitude range arc on the ND’s map display. After they were cleared for the approach, the flight crewmembers had selected an MCP altitude of 1,800 ft because it is the crossing altitude for the DUYET waypoint, located 5.4 nm from the runway. The FMC used the airplane’s vertical speed and groundspeed to calculate and display an arc showing where the airplane was expected to reach the MCP-selected altitude. Throughout the initial part of the approach, the green arc would have shown that the airplane would not arrive at 1,800 ft until well past the DUYET waypoint. When the airplane was about 11.5 nm from the runway, descending through 4,300 ft msl, the PF changed the A/P pitch mode from FLCH SPD to V/S and adjusted the vertical speed to -1,000 fpm; there was a corresponding automatic change in the A/T mode from HOLD to SPD. The airplane’s vertical speed began to increase toward the target value; however, a descent rate of 1,000 fpm was not high enough to maintain, let alone recapture, the desired glidepath, so the airplane continued to drift above it. When the airplane was about 8.5 miles from the runway threshold, descending through 3,400 ft msl at an airspeed of 188 knots, the PF commanded landing gear down. Gear extension added drag and made it easier to decelerate. Although he did not do so, the PF could also have commanded flaps 20 at this time, adding additional drag, because the airspeed was 7 knots below the flaps 20 limit speed of 195 knots. The airplane was about 900 ft above the desired glidepath, and a higher flap setting would have allowed the flight crew to descend the airplane at a steeper angle while maintaining the assigned airspeed and would have saved time later when the flight crew needed to establish a landing configuration and decelerate to final approach speed.

NTSB Aircraft Accident Report 79 After moving the gear handle to the down position, the PM commented on the airplane’s position above the desired glidepath, stating, “this seems a little high.” The PF agreed. The PM continued, “this should be a bit high.” After a few seconds, the PF queried, “do you mean it’s too high?” The PM made an unintelligible response, and the PF stated, “I will descend more,” then decreased the selected vertical speed to -1,500 fpm. This exchange was followed by 21 seconds of no communication between the pilots as the airplane’s descent rate increased and the airplane drew closer to the desired glidepath. When the airplane was about 6.3 nm from the runway at about 2,600 ft msl and an airspeed of 178 knots, the selected vertical speed was changed back to -1,000 fpm. By examining the altitude and distance to the runway, both of which were displayed on the instrument panel, and applying the well known rule of thumb that a 3° glidepath requires about 300 ft of altitude loss per nm, the pilots could have quickly estimated that they were still several hundred feet high. Changing the vertical speed back to -1,000 fpm at that time was, therefore, inappropriate because the airplane was still well above the desired glidepath, and the flight crew needed to continue descending the airplane at more than 1,000 fpm to return to the desired glidepath. The crew’s action indicated a lack of awareness of the airplane’s position relative to the desired glidepath and of cues in the cockpit that could have alerted them to this. As a result of this lack of awareness and their early reversion to a descent rate of 1,000 fpm, the airplane remained high. When the airplane reached the 5 nm point, it was about 400 ft above the desired glidepath, descending through 2,085 ft msl, at an airspeed of about 174 knots. As a result, the PF needed to slow the airplane below the flaps 30 limit speed of 170 knots, while also losing the excess altitude. When test pilots from Boeing and the FAA attempted to fly a stabilized approach in a flight simulator beginning from this starting point, they found it difficult to achieve a stabilized approach by 500 ft agl. In fact, they found it impossible to do so without exceeding maximum descent rates published in Asiana’s FOM. However, when the starting point was changed to an on-desired-glidepath altitude (1,650 ft msl) with the same airspeed, the test pilots were consistently able to achieve a stabilized approach by 500 ft agl, and they did so without exceeding Asiana’s maximum descent rates. Clearly, the airplane’s excess altitude increased the difficulty of achieving a stabilized approach. The NTSB concludes that the flight crew mismanaged the airplane’s vertical profile during the initial approach, which resulted in the airplane being well above the desired glidepath when it reached the 5 nm point, and this increased the difficulty of achieving a stabilized approach. 2.2.2 Approach from 5 nm to the Runway The flight crew’s difficulty in managing the airplane’s vertical path continued as the approach progressed. The PF was aware of the need to lose excess altitude and attempted to do so using FLCH SPD pitch mode, which initiated a sequence of events that had the unintended consequence of deactivating automatic airspeed control. The changes on the FMA that occurred during the airplane’s descent from 1,850 to 1,330 ft msl, when it was between about 4.5 and 3.0 nm from the runway threshold, are shown in figure 14 and discussed below.

NTSB Aircraft Accident Report 80 Figure 14. Automation sequence from 1,850 to 1,330 ft msl.

After passing the DUYET waypoint, the PF called out and set the MCP altitude to 3,000 ft, the planned altitude in the event of a go-around. After passing the 5 nm point, the PF commanded flaps 20; the PM moved the flap lever to the flaps 20 position; and the PF set the MCP speed to 152 knots (panel A of figure 14), the target speed for flaps 20.93 The PF then commanded flaps 30, but the PM delayed setting them to the flaps 30 position because the airspeed had not yet slowed to below the flaps 30 limit speed.

93 The PF correctly determined the target speed for flaps 20 by following the procedure as described in the 777 FCOM of adding 20 knots to Vref (132 + 20 = 152 knots).

NTSB Aircraft Accident Report 81 About 13 seconds after the PF commanded flaps 30 and 3 seconds before the PM set flaps 30, the AFDS pitch mode changed from V/S to FLCH SPD. By design, the A/T mode simultaneously changed from SPD to THR. Because the MCP-selected speed of 152 knots was less than the airplane’s current airspeed of 172 knots (and in FLCH SPD, the AFDS controls speed via elevator pitch commands), the AFDS responded to this mode change by increasing pitch to slow the airplane. Also, the F/D command bars displayed an increase in target pitch. Because the MCP-selected altitude of 3,000 ft was above the airplane’s current altitude of about 1,550 ft msl (and in THR mode, the A/T applies thrust appropriate to attain the selected altitude), the thrust levers began to advance to initiate a climb. About three seconds later, the PF disconnected the A/P and manually countered the forward motion of the thrust levers, moving them to the idle position. He then decreased the pitch by pushing the control column forward. As a result of the PF’s manual override of the A/T, the A/T mode switched to HOLD, a mode in which the A/T would not move the thrust levers and was not controlling thrust or airspeed. During a postaccident interview, the PF volunteered that he considered selecting FLCH SPD while descending in V/S mode because the airplane was high and he thought FLCH SPD would cause the thrust levers to move to the idle position and stay there, facilitating a more rapid descent than he could achieve in V/S mode. He added that he was not sure whether he selected FLCH SPD. During a follow-up interview, when informed that FLCH SPD had been selected, he initially reiterated his uncertainty but stated that it did not matter because selecting FLCH SPD would not have affected the functioning of the A/T and its automatic control of the selected airspeed.94 When questioned further, he stated that he did not believe he had selected FLCH SPD. Postaccident testing of the MCP and A/T components revealed no system faults that could have caused the transition to FLCH SPD without deliberate pilot action via the MCP. Based on the fact that the PF was flying the airplane and responsible for manipulating the MCP at the time of the mode transition, his recollection that he considered selecting FLCH SPD, and the fact that immediately after FLCH SPD was engaged, the PF disconnected the A/P and counteracted the climb inputs that had just been initiated by the autoflight system, it is likely that the PF selected FLCH SPD. Further, it is likely that he reconsidered his decision when he realized the AFCS was initiating a climb, disconnected the A/P, and then unintentionally put the A/T in HOLD mode by manually resisting the advance of the thrust levers. When the PF selected FLCH SPD mode on the MCP, he did not announce doing so, as required by the Asiana 777 POM. By design, when the FLCH SPD mode was selected, the following visual changes occurred: the green light on the FLCH push-button switch illuminated, the MCP V/S window dropped the -1,000 fpm value that previously had been selected (because the AFDS mode was no longer V/S), and, as shown in panel B of figure 14, the FMA displayed boxed indications of THR in the A/T position and FLCH SPD in the pitch position. These MCP and FMA indications were important cues to the PM and the observer about the AFDS and A/T mode changes, but neither reported noticing these indications. Another visible cue indicating that

94 It was apparent from the PF’s interview statements that he did not understand the implications of the A/T mode transitions that occurred as a result of his selecting FLCH SPD. See section 2.4.1 for discussion of the training the pilots received on the A/T system.

NTSB Aircraft Accident Report 82 the AFDS mode had changed was the increase in target pitch of the F/D command bars, but according to the PM and the observer, they also did not notice this indication. Because the PM moved the flap lever to the flaps 30 position about 3 seconds after the PF selected FLCH SPD on the MCP, it is likely that at that time, the PM was monitoring the airspeed in preparation for changing the flap setting, which may have been why he missed the cues indicating the AFDS and A/T mode changes. At the same time as the PM selected flaps 30, the PF disconnected the A/P by double-clicking the wheel switch, which prevented the A/P disconnect aural alarm from sounding. The PF did not make the required “manual flight” callout when he disconnected the A/P. However, the disconnection of the A/P was apparently noticed by the PM because he called out “flight director,” indicating the change to the AFDS status displayed on the PFDs (panel C of figure 14). About 1.5 seconds later, the PF responded, “check.” Between these two callouts, the A/T mode changed from THR to HOLD. Neither pilot called out the change in the A/T mode, which would have been visible as a boxed HOLD annunciation (see panel D of figure 14). In postaccident interviews, no flight crewmember recalled noticing the A/T transition to the HOLD mode. This is not surprising in light of human factors research demonstrating that pilots frequently do not notice mode changes on the FMA, especially those that are unexpected (Sarter et al. 2007, 347-357). The process of decelerating and configuring for landing would have been much easier, the pace of activities slower, and the workload less if it was not necessary for the PF and PM to both lose excess altitude and slow down after reaching the 5 nm point. Because they had to do both, they encountered a period of increased workload when they were engaged in parallel tasks for an extended period of time during a critical portion of the approach. This, in addition to the PF’s failure to make a callout when he selected FLCH SPD pitch mode on the MCP, reduced their ability to effectively crosscheck each other’s actions and monitor changes in the status of the autoflight system. The NTSB concludes that the flight crew’s mismanagement of the airplane’s vertical profile during the initial approach led to a period of increased workload that reduced the PM’s awareness of the PF’s actions around the time of the unintended deactivation of automatic airspeed control. After setting the target approach speed of 137 knots in the MCP, the PF commanded, “flight director off.” It was Asiana’s informal practice to fly visual approaches with the PF’s F/D turned off and the PM’s F/D turned on, but only after turning both F/D switches off first.95 In postaccident interviews, the PF and PM stated that the PM followed this practice. However, QAR data indicated that the PM turned off the PF’s F/D switch but did not turn off his F/D switch. If both F/Ds had been in the off position at the same time, this would have cleared the AFDS modes and caused the A/T to transition to the SPD mode and resume automatic control of airspeed. However, the AFDS remained active and continued to display the FLCH SPD guidance that the PF had commanded. The PF’s and PM’s FMAs continued to display A/T HOLD mode, LOC roll mode, and FLCH SPD pitch mode (see panel E of figure 14). The PM’s F/D command

95 As further discussed in section 2.6.1, the purpose of having the PM’s F/D on during a circling approach was to ensure that it would be active in the event of a missed approach. Asiana had an informal practice of also following this procedure on visual approaches.

NTSB Aircraft Accident Report 83 bars were providing guidance to stay on the localizer and pitch to maintain the commanded 137-knot speed. The PF’s F/D command bars were removed. When the PF’s F/D switch was turned off, the airplane’s descent rate was about 1,000 fpm. About 2 seconds later, the PM stated “it’s high,” and the PF responded by pitching the airplane down and increasing the descent rate to capture the desired glidepath. Over the next 8 seconds, the descent rate increased to about 1,500 fpm. When the flight passed 1,000 ft, the PAPI would have been showing a too-high indication of four white lights, and over the next few seconds, the PF increased the descent rate to as much as about 1,800 fpm. The observer called out “sink rate, sir” three times in the next 9 seconds; he later stated this was because the Asiana FOM states that the descent rate must be 1,000 fpm or less below 1,000 ft agl. He further stated that the PF and PM were slow to respond to his sink rate callouts but they did respond, and the sink rate decreased, so he stopped making sink rate callouts. As the airplane reached 500 ft, the descent rate diminished to about 1,200 fpm. At that time, the PAPI indication was three white lights and one red light showing the airplane was slightly high but approaching the desired glidepath. The thrust levers were still at idle, with N1 speed about 23%. The airspeed, which had been decreasing rapidly, reached the proper approach speed of 137 knots. The decreasing trend in airspeed then slowed, and the airspeed remained about 135 knots for about the next 4 seconds. Review of recorded flight data showed that about 5 seconds after it descended through 500 ft, the airplane finally attained, but passed through, a 3 glidepath. Although, at 500 ft, the airplane met some of Asiana’s stabilized approach criteria as listed in the 777 POM (including being on target airspeed, in the landing configuration, and on the correct flightpath), it failed to satisfy other criteria. It was descending at greater than 1,000 fpm, and the thrust setting was not appropriate (it should have been about 56% N1 speed). Because the approach was not stabilized at 500 ft agl, the flight crew should have conducted a go-around. Either the pilots did not notice that these parameters exceeded stabilized approach criteria96 or they believed that the deviations were minor and could easily be corrected. In either case, the crew’s decision to press ahead was not unusual, as industry statistics indicate about 97% of unstable approaches are continued to landing (Burin 2011). Asiana’s POM guidance for visual approaches stated that the PM should call out “five hundred” at 500 ft above the touchdown height, and the PF should respond “stabilized,” or “go around.” The PM did not make a 500-ft callout, and the PF did not say “stabilized” or “go around.” However, about 5 seconds after passing through 500 ft, when the airplane finally attained the desired glidepath and the PAPI was giving an on-path indication of two white and two red lights, the PM made a callout, stating “on glidepath,” and the PF replied “check.” Thus, the flight crew did not make standard callouts for the mandatory stabilized approach check. About 5 seconds after the PAPI on-path indication, the airplane descended through about 330 ft, and the PAPI indication changed to three red lights and one white light, meaning the

96 See section 2.3.3 for a discussion of the flight crew’s monitoring performance.

NTSB Aircraft Accident Report 84 airplane was now slightly below the PAPI glidepath. All three flight crewmembers later stated in interviews that they were aware of the PAPI indication changing to three red lights but for the 12 seconds between the PM stating “on glidepath” and his next remark, “it’s low,” none of the pilots remarked about the changing glidepath. The PM’s remark of “it’s low” (made as the airplane passed 180 ft, about 17 seconds from impact) could have applied to either the airspeed (which was about 118 knots) or the glidepath since, about 2 or 3 seconds earlier, the PAPI indication had changed to four red lights, showing that the airplane was significantly below glidepath. Both the airspeed indication, which was more than 5 knots below target approach speed, and a PAPI indication of four red lights required a go-around, but the flight crew continued the increasingly unstabilized approach. In a postaccident interview, the PF stated that he never saw four red PAPI lights. However, FDR data indicate that immediately after the change to four red PAPI lights and the PM’s comment “it’s low,” the PF increased the pitch from 5° to 7.5° by pulling back on the control column. This suggests that the PF interpreted the PM’s comment as referring to low glidepath, that the PF was aware of the low glidepath, and that he attempted to correct the low glidepath by pulling back on the control column.97 In a postaccident interview, the PM recalled that he first noticed the airspeed was low (120 knots) about 200 ft and thought at that time that the A/T was not working. FDR data are consistent with his recollection that the airspeed was 120 knots at 200 ft. The observer also recalled noticing that airspeed was low and seeing that the red hatch marks at the bottom of the airspeed tape (the barber pole) were moving up around 200 ft. He estimated that this was 5 or 10 seconds before impact (the airplane reached 200 ft about 18 seconds before impact). The observer did not recall a specific airspeed value at 200 ft. In a postaccident interview, the PF said he was briefly “blinded” by a bright light similar to a glare or reflection outside the airplane between 500 and 200 ft, and when he looked down, he noticed the low airspeed and the EICAS “airspeed low” caution alert. However, the PF also stated that the bright light was visible only momentarily, that it did not subsequently affect his vision, and that its only effect was to cause him to look at the instrument panel shortly after the quadruple chime sounded. In addition, neither of the other pilots reported seeing a bright light or having it interfere with the performance of their duties. Thus, the visual phenomenon described by the PF seems to have had little effect on the performance of the flight crew, aside from possibly causing the PF to look at the instrument panel. As further discussed below, it is also possible that the PF’s attention was drawn to the instrument panel by the low airspeed alert’s quadruple chime or master caution light. About 8 seconds after the PAPI indication changed to four red and 7 seconds after the PM recalled seeing the airspeed at 120 knots, the quadruple chime caution aural alert sounded, and the master caution light illuminated. The airplane was about 11 seconds from impact at an

97 The PF’s reaction at this point would be consistent with his reaction to the PM’s earlier comment “it’s high” at 11:26:44, after which the PF pitched the airplane down to increase descent rate because they were well above the glidepath (as indicated by four white lights on the PAPI).

NTSB Aircraft Accident Report 85 altitude of 124 ft and a speed of 114 knots. According to the performance study, after this point, the airplane likely no longer had performance capability to accomplish a go-around. The PF and PM recalled seeing the accompanying “airspeed low” message on the EICAS. Their attention was likely drawn to the EICAS as a result of the quadruple chime caution aural alert and/or master caution light. The PF and PM also recalled seeing low airspeed indications on the PFD at that time. About 4 seconds after the quadruple chime sounded and 7 seconds before impact, when the airplane was at an altitude of 90 ft and a speed of 110 knots, the PM said, “speed,” and added go-around thrust. Shortly thereafter, the control column reached the full aft position, and the stall warning stick shaker activated. Pitch attitude increased to 12, and, passing 30 feet, the PM called out “go-around.” Seconds later, the airplane struck the seawall. The observer recalled that he first noticed airspeed was low when the airplane was about 200 ft but could not recall what speed was displayed at that time. He said he did not advise the other pilots about the low airspeed because the PF was already reacting. He thought this happened about 5 or 10 seconds before impact. However, it was the PM who pushed the throttle levers forward, and he did so about 11 seconds after the airplane passed through 200 ft. In addition, the airplane passed through 200 ft about 18 seconds before impact. Therefore, it is uncertain when the observer first became aware of the low airspeed, but it was probably sometime between 200 ft and the point where the PM moved the throttle levers forward (86 ft). The NTSB concludes that about 200 ft, one or more flight crewmembers became aware of the low airspeed and low path conditions but the flight crew did not initiate a go-around until the airplane was below 100 ft, at which point the airplane did not have the performance capability to accomplish a go-around. 2.3 Flight Crew Performance 2.3.1 Fatigue The NTSB evaluated a number of criteria, including recent sleep, sleep quality, circadian factors, and time awake to determine whether the flight crewmembers were experiencing fatigue at the time of the accident. There is no evidence that any of the pilots began their duty period with a preexisting sleep debt or fatigue. In the 24 hours before the accident, the PF, the PM, and the observer obtained about 5.5 hours, 8 hours, and 10.5 hours of sleep, respectively, as compared to their self-reported sleep needs of about 7.5 hours, 7 hours, and 7.5 hours. Thus, the PF received less sleep than normal in the 24 hours before the accident. The hours of sleep reportedly obtained by each pilot during the 24 hours before the accident occurred in multiple sleep periods. Nonconsolidated sleep is less restorative than consolidated sleep. Thus, although the PM and observer reported obtaining enough total sleep, their recent sleep was fragmented, reducing its restorative value.

NTSB Aircraft Accident Report 86 In addition, the accident occurred at a time when the PF, PM, and observer would normally have been asleep (about 4.5 hours, 3.5 hours, and 1 hour later than their normal bedtimes, respectively). As a result, the accident occurred during the pilots’ circadian trough, a period about midway through the normal sleep period when a person’s physiological state of arousal is normally at its lowest. The human body cannot adapt to transiting 8 time zones in the span of 10 hours; therefore, all three pilots were likely fatigued as a result of circadian disruption. Multiple lines of research indicate that cognitive performance is reduced during the circadian trough and that circadian-related performance reductions can be exacerbated by prior sleep loss. Cognitive measures that are sensitive to circadian effects include vigilance, reaction time, processing speed, working memory, and logical reasoning (Goel et al. 2013, 155-190). The PF made several errors that might be attributable, at least in part, to fatigue. These errors included his selection of FLCH SPD at 1,550 ft without remembering that he had already selected the go-around altitude in the MCP altitude window less than 1 minute earlier, being slow to understand and respond to the observer’s sink rate callouts, not noticing the decrease in airspeed between 500 and 200 ft, and not promptly initiating a go-around after he detected the low airspeed condition. The PM also made several errors that might be attributable, at least in part, to fatigue. These errors included not noticing the PF’s activation of FLCH SPD at 1,550 ft or subsequent indications on the FMA, not ensuring that a “stabilized” callout was made at 500 ft, not noticing the decay in airspeed between 500 and 200 ft, and not immediately ensuring a timely correction to thrust was made when he detected the low airspeed. Although the observer did not make as many errors during the approach, he made a significant error that might be attributable, at least in part, to fatigue. To monitor the approach, the observer had to monitor both PFDs because he could only see the right side of the PF’s PFD (not including the airspeed indicator) and the left side of the PM’s PFD (not including the altitude indicator). His callouts and recollections during his postaccident interview suggest that he became fixated on the altitude and vertical speed indicators on the PF’s PFD and did not adequately monitor airspeed information on the PM’s PFD.98 In summary, the pilots’ reported recent activities indicate that all three pilots were likely experiencing some fatigue at the time of the accident, and each made errors that were consistent with the effects of fatigue. Therefore, the NTSB concludes that the flight crew was experiencing fatigue, which likely degraded their performance during the approach. Asiana had taken several steps to prevent and mitigate fatigue. These included training pilots (including the accident crew) on the causes and effects of fatigue and strategies for minimizing fatigue, providing flight crew rest facilities (business class seats that reclined flat), and rotating the primary and relief pilots so that the pilots who had most recently napped conducted the approach. In addition, the airline had assigned the observer to monitor the

98 The observer stated that he could not see the PAPI lights below 500 ft due to the deck angle, so it is uncertain whether he made an error in not noticing the PAPI change to four red lights.

NTSB Aircraft Accident Report 87 performance of the primary flight crew during the approach, enhancing the flight crew’s monitoring capability. However, despite these countermeasures, the scheduling of the accident flight was likely to result in some fatigue. The NTSB acknowledges that it would be very difficult, if not impossible, to completely eliminate flight crew fatigue in the operation of all long-distance transmeridian flights. However, it is possible for an airline to collect data on pilot fatigue during line operations and make small adjustments in scheduling and other factors to maximize pilot rest and minimize the occurrence of fatigue during high-workload safety-critical phases of flight. Such an approach is advocated in ICAO guidance materials on the development of fatigue risk management systems (FRMS) (ICAO 2012). At the time of the accident, Asiana was at the preliminary planning stage of developing an FRMS. The NTSB believes that, once developed and implemented, an FRMS could potentially reduce flight crew fatigue during Asiana’s long-range transmeridian flights and encourages Asiana to expedite the development of its FRMS. Encouraging flight crew compliance to operator SOPs, enhancing flight crew training, and improving flight crew interface design might also help to mitigate the effects of fatigue on long-range flight operations. Improvements in each of these areas are recommended in other sections of this report. 2.3.2 Flight Crew Communication The PF, PM, and observer reported that they had normal crew interactions, callouts, responses, and actions during the accident approach. A review of CVR recordings revealed a relaxed but professional cockpit atmosphere. However, CVR recordings also indicated that the PF did not tell the PM that he was stressed about performing the approach without the benefit of an electronic glideslope to aid him in managing the airplane’s vertical path. If the PF had expressed his concern, the PM might have discussed the availability of cues like the altitude range arc or VPI or suggested alternate methods for conducting the approach, such as flying a VNAV approach that would have provided precise vertical guidance via the F/D. The PF was likely reluctant to acknowledge his lack of confidence in this area, and, as a result, the flight crew missed an opportunity to discuss ways that they could have effectively managed the airplane’s vertical path. An evaluation of flight crew communications during the approach also revealed that the flight crew did not consistently adhere to Asiana’s SOPs in the area of MCP selections and related callouts. When the A/P was on, the PF was supposed to make selections on the MCP and accompany these selections with a callout. The PM was supposed to respond “check” and call out every mode change displayed on the FMA. Throughout the approach, the pilots sometimes adhered to this procedure but did not consistently do so. For example, at 1121:12, the PM called “heading select” with no preceding callout from the PF. At 1123:51, one of the pilots selected an MCP speed of 172 knots, but there was no callout from the PF. At 1123:58, the PM called “V/S” with no preceding callout by the PF. At 1125:31, the PM called “one thousand,” referring to the

NTSB Aircraft Accident Report 88 MCP-selected vertical speed, with no preceding callout from the PF. At 1126:32, the PM called “flight director” with no preceding callout by the PF. All of these callouts were accompanied by changes to the MCP. These communications indicate that the PF was not consistently performing both the selection and the accompanying callout when the A/P was on, per Asiana’s SOPs. The pattern of nonadherence to standard procedure involving selections and callouts pertaining to the MCP is likely the reason the PF did not call out “flight level change” when he pushed the FLCH button at 1,550 ft. As a result, and for other reasons discussed earlier, the PM did not notice that FLCH SPD was engaged at 1,550 ft. A possible reason for the PF’s and PM’s lack of adherence to procedures may have been a lack of clarity concerning their roles. Confusion about their pilot roles may have been due, in part, to the fact that the PF and the PM were both captains, and the PF was performing the role of captain while the PM was the PIC and the PF’s OE instructor for the flight. This may have caused the PF to be more deferential towards the PM than he would have been to an FO, for example, waiting for guidance from the PM before initiating actions and following his lead regarding the initiation of changes to the AFCS and performance of related callouts. In addition, this was the PM’s first flight as an OE instructor, so he was new to the role of instructing another captain on the line. His job was to serve as the PIC and coach the PF as needed in terms of how to fly the aircraft while respecting the airline’s policies and procedures pertaining to the prescribed roles of the PF and PM during the flight. The PM’s inexperience in managing these multiple roles may have made it difficult for him to balance his multiple responsibilities. The NTSB concludes that nonstandard communication and coordination between the PF and the PM when making selections on the MCP to control the AFDS and A/T likely resulted, at least in part, from role confusion and subsequently degraded their awareness of the AFDS and A/T modes. A review of Asiana’s procedures for dealing with MCP selections and related callouts indicated that they would have been adequate if followed. Adherence to SOPs involving communication and coordination can be improved through training. Therefore, the NTSB recommends that Asiana reinforce, through its pilot training programs, flight crew adherence to SOPs involving making inputs to the operation of autoflight system controls on the Boeing 777 MCP and the performance of related callouts. 2.3.3 Flight Crew Monitoring The flight crew did not adequately monitor airspeed between 500 and 200 ft. This likely resulted from a combination of workload, expectancy, and a coincidence of timing. When the PF inadvertently disabled automatic airspeed control about 1,500 ft, he pulled the thrust levers to idle to counteract the momentary increase in thrust that resulted from the airplane trying to climb to the MCP altitude of 3,000 ft. He incorrectly believed that the A/T would use thrust to target the selected airspeed of 137 knots thereafter, which would have required the thrust levers to remain at or near the idle position for a significant period of time as the airplane slowed from 168 to 137 knots. Therefore, the lack of thrust lever movement between 1,500 and 500 ft was in line with the PF’s expectations and likely reinforced his incorrect understanding that the A/T system was controlling airspeed. At the 500-ft stable approach gate for the visual approach, the

NTSB Aircraft Accident Report 89 PM checked the airspeed and saw that (by coincidence) it was within a couple knots of the target approach speed. The decreasing trend even halted for a few seconds at 134 knots (although the airspeed trend arrow predicted a continued decrease). The fact that airspeed was very close to the target airspeed at 500 ft and stabilized briefly at 134 knots likely confirmed the PM’s expectation that airspeed was being controlled automatically. If the PM had continued monitoring airspeed and thrust, he would have noticed that the airplane was not truly stabilized at the target approach speed. However, the PM’s stable approach check occurred between multiple “sink rate” callouts from the observer (which resulted from the PF trying to descend rapidly to attain the desired glidepath by 500 ft), the PM’s radio exchanges with ATC obtaining landing clearance, the PM’s execution of the landing checklist, and his monitoring of the PF’s rapid interception of the glidepath (as indicated by the PAPI). The need to perform these multiple concurrent tasks in a short period of time would have required the PM to perform the stable approach check very quickly, which increased the probability of an error like the one he made. Thus, the quality of the PM’s monitoring of airspeed during the stable approach check and his failure to recognize that airspeed was not truly stabilized at the desired approach speed likely resulted from a period of increased workload involving multiple concurrent tasks. This increased workload was created, in part, by task compression resulting from the flight crew’s ineffective management of vertical path earlier in the approach. Below 500 ft, the airplane was getting close to the runway, and it was important to control the airplane precisely and promptly correct any flightpath deviations to ensure that the airplane would be in a position to land safely. Asiana SOPs stated that both pilots were supposed to alternate their visual attention inside and outside the airplane on final approach. Below 500 ft, however, the airplane began to sink below the desired glidepath. Although it was primarily the PF’s task to control these parameters, the PM knew that the PF was new to the airplane and likely felt that it was important to closely monitor the PF’s performance in these areas. Consequently, both the PF and PM recalled focusing their visual attention outside the airplane (on the runway environment and PAPI) between about 500 and 200 ft. As a result of their focus outside the airplane, they did not notice the continued decrease in airspeed that occurred below 500 ft. The PF appears not to have monitored the airspeed indicator for at least 24 seconds after the airplane descended below 500 ft (until the low airspeed alert activated), and the PM appears not to have monitored the airspeed indicator for about 17 seconds after the airplane descended below 500 ft (until the airplane was about 200 ft). The observer also demonstrated a delayed recognition of the decaying airspeed in that he did not recognize that airspeed had decreased below target speed until 200 ft or lower. The observer made several sink rate callouts between 1,000 and 500 ft, indicating that he was closely monitoring vertical speed during at least part of the approach. Effective monitoring would have required the observer to frequently alternate his visual attention between vertical speed and airspeed (as well as other sources of information) and mentally compare the values he perceived to desired targets. The observer’s delayed recognition of low airspeed indicates deficiencies in his visual scan and/or attention during the approach.

NTSB Aircraft Accident Report 90 The observer’s monitoring performance could have been adversely affected by the same increased workload that affected the PF and PM below 1,000 ft; however, because he was not required to perform many of the activities that they were assigned, his task load was less than theirs. The observer’s postaccident interview and investigator observations in the 777 simulator indicated that the observer’s view of the instrument panel was partially obscured by materials affixed to the PF’s and PM’s control wheel clipboards. From his position seated on the center jumpseat, the observer would likely have been able to see only the right half of the PF’s PFD (showing altitude and vertical speed) and the left half of the PM’s PFD (showing airspeed). This vantage point would not have prevented him from monitoring all necessary sources of information but would have increased the amount of effort required to effectively monitor. It is possible that the observer was fixated on the vertical speed information shown on the PF’s PFD as a result of the high descent rates he had previously observed. It is also possible that his monitoring performance, and that of the other flight crewmembers, was degraded by fatigue, which is known to influence attention and increase vigilance errors (Van Dongen et al. 2003, 117-126). Human factors research has demonstrated that system operators often become complacent about monitoring highly reliable automated systems when they develop a high degree of trust in those systems and when manual tasks compete with automated tasks for operator attention. This phenomenon occurs in both beginner and expert operators and cannot easily be overcome through practice (Parasuraman and Manzey 2010, 381-410). Attentional resources are limited, so shifting them away from automated tasks and toward manually controlled tasks during periods of increased workload can be viewed as adaptive because one of the functions of automation is to ease operator workload. However, the use of such systems has predictable adverse consequences on human performance. Specifically, it reduces monitoring and decreases the likelihood that a human operator will detect signs of anomalous or unexpected system behavior involving the processes under automatic control. In this case, the PF, PM, and observer believed the A/T system was controlling speed with thrust, they had a high degree of trust in the automated system, and they did not closely monitor these parameters during a period of elevated workload. Thus, the flight crew’s inadequate monitoring of airspeed and thrust indications appears to fit this pattern involving automation reliance. The NTSB concludes that insufficient flight crew monitoring of airspeed indications during the approach likely resulted from expectancy, increased workload, fatigue, and automation reliance. 2.3.4 Go-Around Decision-Making As stated earlier, the pilots did not initiate a go-around until reaching an altitude of 90 ft, which was about 7 seconds before the impact. This delay prevented a successful go-around because the airplane was not able to develop the power necessary to climb out in the time available before impact. As shown during testing, a go-around that was initiated 11 seconds before the impact (at an altitude of 124 ft) likely would not have resulted in the ground impact. In fact, the go-around should have been initiated well before that point: when the airplane reached 500 ft and the approach was unstabilized. The previous section discussed the role of insufficient monitoring in the flight crewmembers’ failure to execute a go-around between 500 and 200 ft. This section will discuss the possible reasons for their delay in executing the go-around below 200 ft.

NTSB Aircraft Accident Report 91 Either the glidepath-too-low indication of four red PAPI lights or the airspeed exceeding the low tolerance criterion for a stable approach should have prompted an immediate go-around. The PF indicated that he never saw a PAPI indication of four red lights and that he first noticed the airspeed was low when the “airspeed low” caution alert appeared on the EICAS display. The PM said that he first noticed four red lights and the low airspeed when the airplane was about 200 ft. However, he did not push the thrust levers forward to initiate a go-around until about 11 seconds after the airplane descended through 200 ft. The observer said that he was unable to see the PAPI due to a high deck angle and that he first noticed that the airspeed was low about 200 ft or just before the time when the PM pushed the thrust levers forward. Available evidence does not support the PF’s report that he did not see a PAPI indication of four red lights. Despite his statement that he never noticed the PAPI indication change to four red lights, he also stated that he was looking at the runway environment, noticed the change to one white and three red, and was very concerned about a change to four red because he believed that would cause him to “fail” his OE training flight. As a result, the PF would likely have been monitoring the PAPI lights very closely. In addition, the PAPI changes from two white/two red to one white/three red then to four red were followed immediately by step-wise increases in the airplane’s pitch. These pitch increases resulted from the PF’s control inputs, suggesting the PF saw and reacted to both changes. It is likely, therefore, that the PF saw the PAPI indication change to four red lights within 1 or 2 seconds after it occurred (at 1127:31 and 219 ft). Thus, he saw the PAPI indication change to four red lights about 11 to 12 seconds before the PM initiated the go-around. No evidence contradicts the PF’s statement that he was unaware of the low airspeed until the “airspeed low” caution alert message appeared on the EICAS. It is likely that his visual attention was focused primarily outside the airplane below 500 ft because he was manually flying the airplane and attempting to correct a vertical deviation that developed during this period. Therefore, the PF’s statement about his lack of awareness of low airspeed until after the chiming of the low airspeed caution alert is the best available evidence about his awareness of airspeed during that period. Accordingly, it is likely that the PF and PM were aware of unacceptably low PAPI indications for about 11 seconds, and the PM was aware of an unacceptably low airspeed indication for about 11 seconds before a go-around was initiated. The flight crew’s delay likely resulted from a combination of surprise, nonstandard communication, and role confusion. Both the PF and the PM were under the impression that the A/T had been controlling airspeed for them, and they were surprised and confused when they realized it was not. Human factors research indicates that reaction time is longer for unexpected than for expected events. When a flight crew is confronted with a sudden, abnormal event, responses are more likely to be delayed or inappropriate. In one study, for example, pilots who encountered an expected low-altitude aerodynamic stall during simulator training responded rather uniformly and quickly (an average of 1.33 seconds), but those who encountered an unexpected stall took much longer to respond (an average of 8.36 seconds). Moreover, there was a broad range of

NTSB Aircraft Accident Report 92 response times to the unexpected stall (from 1.9 to 18.2 seconds) (Casner et al. 2013, 477-485). Thus, the PF’s and PM’s surprise likely contributed to their delayed reaction. About a second after the PM noticed the PAPI was displaying four red lights and that airspeed was 120 knots, the CVR recorded the PM saying, “it’s low” and the PF responding “yeah.”99 Per Asiana SOPs, the PM should have called out “low glidepath” and “low speed” or simply “go around,” so his statement “it’s low” was nonstandard. As previously stated, the PF seemed to interpret the PM’s callout as referring to the airplane being low on the glidepath because he attempted to correct the situation by pulling back on the control column. Although this would have been an effective solution if power was also added, neither the PF nor the A/T was managing thrust and airspeed; therefore, the application of pitch alone was insufficient to achieve the desired glidepath. As discussed earlier, the PF was likely aware that the PAPI was indicating four red lights when the PM said “it’s low.” He would have known that this indication required an immediate go-around. He may have continued the approach because he believed he could correct the vertical path deviation, because he did not want to acknowledge the error and “fail” his OE training flight, or because he was deferring to the PM (a more senior crewmember). The PF appears to have remained unaware of low airspeed for at least another 7 seconds, until the quadruple chime sounded. Postaccident interviews indicate that at this point, both pilots’ eyes were drawn down to the EICAS display where they read the “airspeed low” message. Both then inspected airspeed indications and recognized the urgent necessity of a go-around. At this point, the PF recalled thinking about increasing thrust, but the PM acted first. The PF said he believed that only the PIC, in this case the PM, could call for a go-around. He said this was company policy resulting from a tail strike event that had occurred when an FO had initiated a go-around. This statement contrasted with Asiana’s written policy in the 777 POM, which stated, “The decision to make a missed approach rests with the captain. However, when the co-pilot (F/O) flies the aircraft as PF, the co-pilot (F/O) can make a missed approach.” In addition, multiple Asiana managers and pilots said there was no company policy preventing junior crewmembers from initiating a go-around. However, the Asiana FOM states only that the captain has the “authority and responsibility to make a landing or missed approach (go-around)”; it does not address the authority of the FO to initiate a go-around. The PF’s uncertainty about whether he had the authority to make a go-around decision could have stemmed from confusion due to the inconsistent written policy in this area. In either case, the PF’s deference to authority likely played some role in the fact that he did not initiate a go-around. The PM, on the other hand, said he believed that the PF was responsible for initiating a go-around. Thus, the PF and PM had differing understandings about whose role it was to initiate a go-around in the event that one was required. The NTSB concludes that the delayed initiation of a go-around by the PF and the PM after they became aware of the airplane’s low

99 The PM recalled telling the PF they were “slightly low” and applying a little backpressure on the control column when the airplane was on short final approach; however, he recalled that this occurred about 500 ft.

NTSB Aircraft Accident Report 93 path and airspeed likely resulted from a combination of surprise, nonstandard communication, and role confusion. 2.4 Autoflight System Training and Design In postaccident interviews, the PF made several statements that indicated he had an inaccurate understanding of some aspects of the airplane’s autoflight system. He said that although the A/T could be manually overridden by the flight crew, the A/T system was always working. He stated that pilots normally left the A/T engaged but it was not important whether the A/T system was engaged because the A/T moved the thrust levers automatically to maintain the selected speed. He stated that when the A/T was disconnected, the A/T would move the thrust levers to maintain airspeed. Asked whether the A/T would resume control of airspeed after a manual pilot override in FLCH SPD mode, he said the A/T would resume controlling speed. He said that if the 777 A/T system was turned off and airspeed became very low, the A/T would transition to TO/GA mode, and he believed that the airplane’s functionality in this respect was similar to that of the Airbus A320. These statements indicate that the PF had an inaccurate understanding of how the AFDS and A/T interact to control speed in FLCH SPD mode, what happens when the A/T is overridden and the throttles transition to HOLD in a FLCH SPD descent, and how the A/T automatic engagement feature operates. The complexity of autoflight systems can contribute to faulty mental models of automation logic. The systems installed on airplanes like the 777, for example, contain multiple subsystems. Each of these subsystems has various modes of operation, and these subsystems are intercoupled in various ways. Human factors research involving pilots suggests that they have difficulty comprehending the subtleties of the interconnections between various autoflight subsystems (Billings 1999). These difficulties lead to gaps in pilots’ mental models that can be particularly problematic in highly dynamic and/or nonroutine situations (Sarter and Woods 1997, 553-569). The problem of faulty pilot mental models of complex autoflight systems can be alleviated by improving systems training and reducing design complexity. 2.4.1 Autoflight System Training The PF’s Asiana 777 transition training included two instructor-led ground school lessons totaling 6 hours that addressed the 777 autoflight system. The presentations given in these lessons used slides based on screen captures of computer-based training lessons purchased from Boeing. Use of the AFDS and A/T systems was also covered in other ground and simulator lessons. Despite having completed all classroom and simulator training, the PF said he was not confident in his understanding of the system. Other Asiana pilots and instructors who were interviewed by investigators after the accident also appeared to have inaccurate mental models of AFDS and A/T system functionality in some of the same areas as the PF. A review of the Asiana 777 transition training slides revealed that they did not provide a complete picture of AFDS and A/T system design logic involving the functioning of the A/T in HOLD mode or the availability of minimum speed protection when the A/T was in HOLD mode. For example, a training slide labeled “stall

NTSB Aircraft Accident Report 94 protection features” made the unqualified statement that “autothrottles engage automatically (if armed).” No description was provided of the circumstances when the A/T will not automatically engage. These circumstances, which were listed in the 777 FCOM, include when the AFDS pitch mode is FLCH SPD (as it was during the accident flight) or TO/GA, or the airplane is below 400 ft above the airport on takeoff or below 100 ft RA on approach. Further, the Boeing 777 FCTM, upon which Asiana based much of its training, did not explain the conditions under which the A/T would not automatically engage. The FCTM recommended A/T use during all phases of flight, including manual flight, and presented a stall protection demonstration that did not include situations when the A/T would not automatically activate. Asiana adopted the FCTM stall protection demonstration in its 777 simulator training, and the PF had observed the demonstration. During the demonstration, A/P and A/T were disengaged, thrust levers were retarded to idle, MCP-selected speed was reduced below minimum speed on the speed tape, and the airplane was allowed to decelerate into the amber band on the airspeed tape (below minimum maneuvering speed). With no pilot intervention, the A/T system “woke up,” engaged in SPD mode, and returned the airplane to minimum maneuvering speed. The PF stated that when he saw the demonstration, he was “astonished” that the airplane would recover by itself from an approach to stall. Because the training the PF received did not adequately describe the circumstances in which the A/T would not automatically engage or expose him to such circumstances, this demonstration likely gave him false confidence that the A/T would provide speed protection at all times. Additionally, the PF was exposed to some informal, partially accurate information about the interrelationship between the FLCH SPD pitch mode and the HOLD A/T mode during his 777 transition training. An Asiana 777 ground school instructor stated that he had, on three occasions, experienced an “anomaly” in the behavior of the A/T in that it did not automatically engage while in FLCH SPD mode, and he personally explained this experience to pilots in his ground school classes. He stated that the PF had been in a class that had been given this explanation. Apparently, the PF was not able to recognize and apply this knowledge during the accident flight. The instructor’s description of these experiences as “anomalies” rather than a result of the system’s design logic and the fact that the instructor’s comments were not incorporated into Asiana’s 777 formal training curriculum indicate that this aspect of AFDS and A/T functionality was not accurately described or adequately emphasized. The NTSB concludes that, as a result of complexities in the 777 AFCS and inadequacies in related training and documentation, the PF had an inaccurate understanding of how the AFDS and A/T interacted to control airspeed, which led to his inadvertent deactivation of automatic airspeed control. As previously mentioned, interviews with other Asiana pilots and instructors indicated that they also lacked understanding of AFDS and A/T system functionality in some of the same areas as the PF. Further, the training materials that Asiana was using, including ground school materials and the FCTM, were supplied by Boeing, and these materials are not unique to Asiana

NTSB Aircraft Accident Report 95 but are used by numerous other airlines. Therefore, the NTSB recommends that the FAA require Boeing to develop enhanced 777 training that will improve flight crew understanding of A/T modes and automatic activation system logic through improved documentation, courseware, and instructor training. Further, the NTSB recommends that once the enhanced Boeing 777 training has been developed, as requested in Safety Recommendation A-14-37, the FAA require operators and training providers to provide this training to 777 pilots. The NTSB also recommends that the FAA require Boeing to revise its 777 FCTM stall protection demonstration to include an explanation and demonstration of the circumstances in which the A/T does not provide low speed protection. Further, the NTSB recommends that once the revision to the Boeing 777 FCTM has been completed, as requested in Safety Recommendation A-14-39, the FAA require operators and training providers to incorporate the revised stall protection demonstration in their training. It is unlikely that deficiencies in pilot training addressing the underlying logic and operational use of autoflight systems are limited to the 777. A 2012 study conducted by Boeing, the International Air Transport Association, and the International Federation of Airline Pilots Associations surveyed airline transport pilots across multiple regions, airlines, and airplane types. The findings of this survey suggest that incomplete mental models stemming from deficiencies in training are common among pilots transitioning to a new airplane type (Holder 2012). Forty-two percent of respondents reported that autoflight system training was minimal or inadequate. Few (23%) felt comfortable with autoflight system operation during their initial line flight in a new airplane type, and the majority (62%) did not feel comfortable until after they had operated on the line for 3 months or more. Respondents estimated that 42% of their autoflight system learning occurred during line flying, rather than during classroom training or self-study.100 In its 2013 study of flight deck automation, the FAA also recommended training enhancements to “improve pilot knowledge and skills for successful flightpath management” (FAA 2013). This report stated that regulatory guidance and requirements determining the content and duration for training and certification should include the following considerations:

 Management and use of automated systems, including achieving and maintaining mode awareness;  Handling known automated system anomalies or situations known to cause crew difficulties in line operations or in training;  The decision-making process concerning the selection for applicable modes. Pilot training could be improved across airplane types to support better pilot understanding of automated systems for flightpath management and their use in operational

100 In addition, most pilots surveyed thought autoflight system training could be improved through more attention to automation surprises (57%) and hands-on use of automation in operational situations (52%). A third (33%) thought training could be improved through greater attention to transitions between modes, and slightly more than a quarter (27%) thought training could be improved through greater emphasis on basic knowledge of the system.

NTSB Aircraft Accident Report 96 situations. Therefore, the NTSB recommends that the FAA convene an expert panel (including members with expertise in human factors, training, and flight operations) to evaluate methods for training flight crews to understand the functionality of automated systems for flightpath management, identify the most effective training methods, and revise training guidance for operators in this area. 2.4.2 Autoflight System Design As previously mentioned, reducing design complexity is another method by which faulty pilot mental models of complex autoflight systems can be alleviated. Human performance researchers have identified mode awareness as a significant and continuing area of concern in aviation safety (FAA 1996 and 2013). Lack of mode awareness can lead to automation surprise when an automated system causes an airplane to behave contrary to flight crew expectation, and late detection of this behavior can lead to undesirable system behavior. Three factors have been found to contribute to a lack of mode awareness: poor mental models, low system observability, and highly dynamic and/or nonroutine situations (Sarter and Woods 1997, 557-569). All three factors were present in this accident. The FAA has also highlighted problems involving pilot mode awareness. In its 2013 automation study, the FAA concluded that although current flight deck designs have incorporated many useful safety and operational improvements through new systems and technologies, the highly integrated nature of current flight decks has also increased flight crew knowledge requirements and introduced complexity that can lead to pilot confusion and error (FAA 2013). According to the FAA, short-term strategies for mitigating this problem include enhanced flight crew training, and long-term strategies should involve changes to equipment design. The 787 and the 777 share a common type rating and have very similar if not identical AFCS logic. Although the FAA accepted the design logic of this system when the 777 was certified in 1995, the FAA and EASA identified the potential need for a design modification during the 787 flight test certification program in 2010. Both organizations expressed concern that the system did not provide minimum speed protection when the AFCS was in FLCH SPD or VNAV SPD pitch mode with the A/T in HOLD mode. They expressed concern about the intuitiveness of this design from a pilot’s perspective and argued that safety would be enhanced by avoiding these exceptions in the design logic. Boeing did not modify the logic of the 787 AFCS as a result of these concerns. Instead, a note was added to the 787 AFM that stated, “During a descent in FLCH mode or VNAV SPD mode, the A/T may activate in HOLD mode. When in HOLD mode, the A/T will not wake up even during large deviations from target speed and does not support stall protection.” The FAA accepted this outcome. Similar information addressing these aspects of A/T automatic activation logic is not included in the 777 AFM but is included in the 777 FCOM. However, the information in the 777 FCOM must be carefully pieced together by the reader because it is provided in two different notes with dissimilar wording that could be interpreted as describing different issues.

NTSB Aircraft Accident Report 97 The PF’s statements indicate that he did not have an accurate understanding of the context in which the A/T would transition to and remain in HOLD mode as a result of manual thrust lever override. Interviews with other Asiana pilots, including some instructors, indicated that they also had inaccurate mental models of system design logic in these areas. Although this was likely due, in part, to inadequate training and documentation, it was also likely due, in part, to the complexity of the design logic and a lack of intuitiveness from a pilot’s perspective. On the accident approach, if the A/T automatic engagement feature had been available, it would have engaged the A/T about 1 second after the airspeed reached 124 knots, which occurred about 21 seconds before impact. The NTSB concludes that if the A/T automatic engagement function (“wakeup”), or a system with similar functionality, had been available during the final approach, it would likely have activated and increased power about 20 seconds before impact, which may have prevented the accident. System observability is another aspect of design that can influence the likelihood of mode confusion. Observability has been described as “the degree to which events, changes, and anomalies in the monitored process are effectively communicated to the operator through the interface” (Nikolic and Sarter 2007, 553-565). The 777 AFCS communicates AFDS and A/T mode status and changes to the pilot primarily through indications on the FMA. However, as discussed earlier in this report, pilots frequently do not notice mode changes that are presented in this fashion, especially when they are busy with other visual tasks or do not expect a mode change to occur. Although it can be argued that pilots could eventually become aware of such changes by noticing changes to flight parameters that are a result of undetected mode changes, flight crew monitoring of parameters they believe to be under the control of highly reliable automatic systems is imperfect. Due to the limitations of human attention and monitoring capabilities, modern flight deck systems have been designed to provide flight crews with alerts that draw their attention to critical changes. The 777 flight deck, for example, provides an aural warning alert when the A/P is disconnected. Unless this warning is canceled in advance by double clicking the A/P disconnect button, this alert actively informs the crew that the airplane is no longer controlling pitch and roll, and the flight crew needs to manually manage these parameters or reengage the A/P. Similarly, an aural caution alert sounds if the A/T is disconnected, informing the flight crew that the A/T is no longer controlling thrust. However, the A/T disconnect alert only sounds when the A/T is turned “off.” It does not sound when the A/T transitions, either autonomously or as a result of pilot action, to a mode where it is no longer controlling airspeed. This is potentially problematic when, as occurred in the accident, the A/T transitions to HOLD at a time when the pilot does not expect it to do so. The risk of this occurring is increased by faulty mental models of system logic and by system design characteristics that cause the same pilot inputs to have differing effects depending on the operating mode. For example, manually overriding the throttle levers in V/S pitch mode and SPD A/T mode has no effect on the A/T operating mode, but manually overriding the throttle levers during a climb in FLCH SPD pitch mode changes the A/T operating mode from THR to HOLD. This inconsistency increases the opportunity for pilot error, especially in situations that are nonroutine. The surprise of the

NTSB Aircraft Accident Report 98 accident pilot and the FAA’s 787 test pilot regarding A/T response to manual override in FLCH SPD suggests that a pilot’s manual intervention during a descent in FLCH SPD does not occur very often. Thus, flaws in a pilot’s mental model of system functioning in this particular context may remain undetected for some period of time until the pilot encounters this aspect of the system’s functionality. Such encounters are more likely to occur during dynamic, nonroutine situations, like a traffic collision avoidance system advisory during a FLCH SPD descent or a pilot’s unintentional initiation of a FLCH SPD climb. During such situations, a flight crew faces increased workload and operational distractions that can reduce systematic scanning of the FMA and flight instruments, thereby reducing the likelihood that such a change will be detected. This problem might be ameliorated by eliminating the inconsistency of the A/T’s behavior when the pilot’s manual throttle override occurs in different pitch modes. However, the HOLD mode is so thoroughly integrated into the 777 AFCS that removing this inconsistency might be impractical because it would require a fundamental redesign of the 777 and 787 AFCS. Another possibility would be to provide an alert to the pilot every time the A/T transitions to HOLD mode so that the pilot is more likely to notice that the A/T is no longer automatically controlling airspeed. However, the A/T normally enters HOLD mode many times during a flight, and providing an aural alert every time the HOLD mode activates would reduce the attention-getting property of the alert. Since the 777 was designed in the mid-1990s, much has been learned about human-centered design of automated systems, and it is possible that a review of lessons learned from this accident and other operational data could provide insights that could lead to improvements in the design of the 777 and 787 AFCS systems, as well as the autoflight systems featured in future flight deck designs. The NTSB concludes that a review of the design of the 777 AFCS, with special attention given to the issues identified in this accident investigation and the issues identified by the FAA and EASA during the 787 certification program, could yield insights about how to improve the intuitiveness of the 777 and 787 flight crew interfaces as well as those incorporated into future designs. The FAA has a process for postcertification evaluations known as a special certification review, which is described in FAA Order 8110.4. The order describes a special certification review as a way to evaluate potentially unsafe design features on previously approved products and includes a list of potential safety problem areas for which a special certification review may be appropriate that includes complex or unique design features and complicated interrelationships and unusual features. Therefore, the NTSB recommends that the FAA convene a special certification design review of how the Boeing 777 AFCS controls airspeed and use the results of that evaluation to develop guidance that will help manufacturers improve the intuitiveness of existing and future interfaces between flight crews and autoflight systems. 2.5 Pilot Training 2.5.1 Visual Approach Training To conduct a visual approach in a fast-paced busy terminal environment without an ILS glideslope, a flight crew must be able to plan an appropriate vertical profile, select an appropriate

NTSB Aircraft Accident Report 99 control strategy (manual flight or some combination of autoflight modes), and adapt this plan in real time to satisfy externally imposed constraints, such as airspeed restrictions. There are many acceptable strategies for executing such approaches, but all require a flight crew to be able to effectively manage thrust, drag, and pitch to control airspeed and vertical speed, which in turn allow the flight crew to manage energy and remain on a desirable glidepath. Managing drag in such scenarios often requires strategically adjusting the timing of configuration changes, and this must be done while simultaneously respecting the airplane’s operating limitations, the airline’s operational policies, and ATC clearances. Success requires in-depth knowledge and a broad array of skills. Pilots acquire the requisite knowledge and skills through training, operational experience, and informal exchange of information among other pilots. However, the FAA’s 2013 automation study indicated that pilots “often lack sufficient in-depth knowledge and skills to most efficiently and effectively accomplish the desired flightpath management related tasks” (FAA 2013). This accident reflects such a lack of knowledge and skills on the part of the PF. The PF was an Asiana captain who was transitioning from the A320 to the 777. He was about halfway through OE, which was the final portion of his training before being released to fly the 777 as PIC. The accident flight was the first time he had flown a visual approach without an ILS glideslope in the 777 outside the simulator. During a postaccident interview, the PF expressed a lack of confidence in his ability to fly a stabilized approach without an ILS glideslope, saying he was “stressed” about having to do so. The accident took place on a clear day with good visibility, and the pilots saw the airport early in the descent. The PF expected to be vectored by ATC to arrive both higher and faster than normal. However, the only ATC restriction the flight received applied to speed, and the flight was given ample distance to become established on an appropriate glidepath. As discussed earlier in this report, the PF did not descend rapidly enough early in the approach, which left the airplane significantly above the desired glidepath as he began the final portion of the approach. Additionally, once past the 5 nm point, the PF continued to have difficulty achieving the desired glidepath and did not properly use the airplane’s AFCS and the FMC’s VNAV function to help manage the airplane’s glidepath. In fact, his attempt to facilitate a more rapid descent by selecting FLCH SPD pitch mode when the MCP-selected altitude was above the airplane’s altitude led to the unintentional deactivation of automatic airspeed control. (When the PF responded to the resulting climb by disconnecting the A/P and manually retarding the thrust levers, the A/T transitioned to HOLD mode.) Further, because the FMC had been programmed with the LOC 28L procedure, the airplane’s VNAV system had computed a 3 glidepath from DUYET to the runway threshold, and a VPI was displayed on both pilots’ NDs. Once the airplane crossed DUYET (5.4 nm), the VPI showed the airplane’s distance above or below this computed 3° glidepath for the remainder of the approach. However, when asked about the VPI, the PF said he did not make use of it during the approach. These deficiencies suggest that the PF’s training in conducting visual approaches without an ILS glideslope was inadequate.

NTSB Aircraft Accident Report 100 All approaches the PF had flown during his OE training before the accident flight were ILS approaches. During the full flight simulator portion of the PF’s 777 transition training, he completed six visual approaches and landings. However, these approaches were accomplished in a standard traffic pattern using timed turns, computed guidance, visual displays, and A/P engagement until the simulator was positioned on final approach about 3 nm from the runway threshold. During one simulator period, the instructor reviewed a “high-energy landing technique” with the PF. Although it was unclear from the training record if a high-energy approach was flown or just discussed, it is unlikely it was flown because the 777 captain transition training syllabus in use at the time did not require a high-energy approach. As noted above, to fly a visual approach, a pilot must possess a broad array of skills, including the ability to accurately judge the airplane’s height, speed, and distance from the runway; anticipate the airplane’s altitude and speed changes in response to configuration changes; and make the necessary adjustments to remain stable. However, these skills can atrophy through lack of practice. Throughout his training, the PF used the A/P regularly and typically relied on the ILS glideslope as a cue to proper altitude and flightpath. Thus, he did not have an opportunity to practice the skills necessary to anticipate and control the airplane’s flightpath while making a straight-in speed-restricted approach with no ILS glideslope. The PF’s lack of exposure in 777 transition training to straight-in speed-restricted visual approaches played a role in the flight crew’s mismanagement of the airplane’s vertical profile. Following the accident, Asiana added straight-in speed-restricted approaches to its 777 transition training syllabus. 2.5.2 Instructor Pilot Training The PM was an experienced 777 captain who was on his first flight as an IP. He had never flown with the PF but observed him fly the takeoff, climb, and cruise from ICN proficiently, and he noted the PF communicated well, confirmed his actions, and made effective callouts and responses. As a result, the PM likely did not see the need to provide the PF with continuous active coaching. The PF made several errors during the initial part of the approach that should have alerted the PM that more active coaching was needed. After the flight was cleared for the visual approach and given the speed restriction, the PF did not descend aggressively enough. As the airplane remained high on profile, the PM said, “this seems a little high,” and the PF, who did not recognize he was not on the proper glidepath, said, “do you mean it’s too high?” The PM did not suggest a descent rate or ensure that the PF stayed on the desired glidepath, brief the PF about the need to decelerate and configure for landing as soon as the airplane reached the 5 nm point, or ensure that the subsequently selected vertical speed of -1,500 fpm was used long enough to recapture the desired glidepath. Even though the PF was demonstrating poor awareness of altitude and airspeed, the PM did not intervene or otherwise ensure that needed corrections were made to the airplane’s vertical path.

NTSB Aircraft Accident Report 101 Asiana 777 IP training included ground school, simulator instructor panel operation training, flight instructor training while operating in the right seat, and OE; examinations or checks were also performed for each of these phases of training. A review of the PM’s training records and interviews with his OE instructors showed he performed well during training. A review of the instructor training syllabus showed instruction techniques were taught, as well as execution of normal and nonnormal procedures. The syllabus included several events in which the instructor trainee had to identify poor or dangerous performance by the pilot in the left seat and take action to recover the airplane safely. For example, on two simulator training sessions, the instructor trainee had to take control of the flight from the left seat pilot because of a takeoff overrotation, and on another session, the instructor trainee had to take over because of no flare during landing at 30 ft above the runway. This training should have been adequate to prepare the PM to recognize and recover from the unstabilized accident approach. However, it took place in the structured environment of a flight simulator where the problems were known in advance. The final stage of instructor training consisted of two flight legs of OE instruction and two flight legs of a check in the aircraft. On the training flights and the check flights, the PM flew the airplane from the right seat but gave no instruction. The PM did not have the opportunity during his OE instructor training to supervise and instruct a trainee while being observed by an experienced instructor. Having the opportunity to supervise a trainee on an actual flight would have improved the PM’s awareness of the dynamic and often unpredictable challenges that he would encounter as an OE instructor. The NTSB concludes that if the PM had supervised a trainee pilot in operational service during his instructor training, he would likely have been better prepared to promptly intervene when needed to ensure effective management of the airplane’s flightpath. Therefore, the NTSB recommends that Asiana revise its flight instructor OE qualification criteria to ensure that all instructor candidates are supervised and observed by a more experienced instructor during OE or line training until the new instructor demonstrates proficiency in the instructor role. 2.6 Operations Issues 2.6.1 Cycling of Flight Director Switches In interviews, four Asiana flight instructors verified that it was Asiana’s informal practice, after the A/P was disconnected, to turn both F/Ds off and then turn the PM’s F/D back on when conducting a visual approach and that this was taught in training. However, in Asiana’s 777 POM guidance on visual approaches and Boeing’s 777 FCTM guidance on visual approaches, the subject of F/D switch position was not mentioned. The FCTM did contain guidance on the conduct of circling approaches, which included F/D switch cycling. It stated that turning both F/Ds off and then turning the PM’s F/D back on “allows continued FD guidance for the PM in the event of a go-around when pitch or roll mode is changed.” If a circling approach cannot be completed, the flight crew is expected to follow the

NTSB Aircraft Accident Report 102 published missed approach procedure, and F/D guidance can be beneficial. However, there is no instrument missed approach segment following a visual approach. A go-around from a visual approach must be done using visual references until specific instructions are received from ATC. F/D use is appropriate on both instrument and visual approaches when it provides valid navigational guidance. However, F/Ds cannot provide guidance when the underlying navigational signal or data is not available and should not be displayed when the pilot does not intend to follow it. During a visual approach, when F/D pitch and roll guidance is not needed, it can be a distraction. The FAA’s Airplane Flying Handbook, page 12-6, “Flight Director/Autopilot,” states that when an airplane is being hand-flown, if the F/D is not being used at any particular moment, it should be off so that the command bars are pulled from view. During the accident flight, after the A/P was disconnected, the PM loosely followed Asiana’s informal practice. However, because the two F/D switches were not both in the off position at the same time, the AFDS remained active with the pitch mode FLCH SPD, and the F/D command bars on the PM’s PFD provided unneeded pitch guidance. Also, the A/T remained in the HOLD mode. If the PM had turned both F/D switches off, the F/D command bars would have been removed from his PFD, and the A/T mode would have changed to SPD mode and maintained the MCP-selected speed of 137 knots. A review of the 777 FCOM and FCTM did not identify a specific statement that when the A/P is off and both F/D switches are turned off, the A/T mode goes to SPD and maintains the MCP-selected speed. Although this information can be inferred from FCOM information, it is critical for flight crews to have a complete understanding of the system functionality (as discussed above) and the effects of changes that they can make, particularly during critical phases of flight. The NTSB concludes that if Asiana had not allowed an informal practice of keeping the PM’s F/D on during a visual approach, the PM would likely have switched off both F/Ds, which would have corrected the unintended deactivation of automatic airspeed control. Therefore, the NTSB recommends that Asiana Airlines issue guidance in the Boeing 777 POM that after disconnecting the A/P on a visual approach, if F/D guidance is not being followed, both F/D switches should be turned off. The NTSB further recommends that Boeing revise the Boeing 777 FCOM to include a specific statement that when the A/P is off and both F/D switches are turned off, the A/T mode goes to SPD mode and maintains the MCP-selected speed. 2.6.2 Manual Flight Asiana’s automation policy, as stated in the POM, and interviews with Asiana pilots indicated that the company emphasized the full use of all automation and did not encourage manual flight during line operations. The Asiana POM stated that the PF and PM should make full use of the A/P and the A/T, and the A/T should be used even in manual flight. When interviewed, the Asiana 777 chief pilot supported the statement in the POM, stating that the airline recommended using as much automation as possible. He also agreed with the statement that Asiana pilots obtained most of their manual flying practice during approaches below 1,000 ft

NTSB Aircraft Accident Report 103 agl. Other Asiana pilots interviewed agreed that it was standard practice to leave the A/P on to about 1,000 ft on final approach before disengaging it to complete a manually flown approach. An Asiana contract simulator instructor stated that he believed that pilots avoided flying manually because of concern that they would do something wrong. He stated that manual flying training that included the approximate power settings and pitch attitudes required to achieve a 3° glidepath was not in the training syllabus. The maneuvering needed to place an airplane on the final approach course and stabilized at the appropriate altitudes prescribed by policy is highly variable and depends on a number of factors, including terrain, traffic, and flight crew interaction with ATC. Autoflight systems are very useful in minimizing crew workload during this maneuvering but function best when preprogrammed with the anticipated course and approach procedure. A change in ATC clearance can significantly revise the planned flightpath, changing the assumptions the crew made and requiring a rapid reassessment of the flight’s needed path and energy. A turn toward the airport sooner than anticipated, for example, can make the flight higher and faster than planned, requiring an adjustment in speed, descent rate, and drag required. Such an adjustment can often be made most easily by manually flying the airplane. Manual corrections to flight controls can be made more quickly than A/P inputs, and manual movement of the thrust levers can be made directly and without automatic control input, simplifying the pilot’s tasks. Not all approaches can be flown or completed using automation. For example, some runways have offset LOC approaches, which require that the A/P be disconnected and the airplane aligned with the runway manually. Occasionally, partial runway closures displace runway thresholds by significant amounts, as much as 3,000 to 4,000 ft, requiring A/P disconnect and manual landing. Certain charted visual approaches, such as the Parkway Visual Approach to runways 13L/R at New York’s John F. Kennedy International Airport or the River Visual Approach to runway 19 at Ronald Reagan Washington National Airport, require manual flight. Additionally, normal instrument approach navigational signals may experience failures or anomalies requiring the flight crew to disconnect the A/P and continue manually. Pilots must have both training and recent experience in manually manipulating the controls so as to have the skill and confidence to perform manual flight maneuvers safely. As the airplane slowed after the PF disconnected the A/P (about 81 seconds before impact), the amount of backpressure required to maintain a positive pitch attitude increased due to the airplane being below its trim reference speed of 170 knots, which was due to the PF not using any pitch trim after disconnecting the A/P. Normally, a 777 pilot would use pitch trim to relieve such control forces, but the PF did not do so. Instead, he gradually increased backpressure to maintain pitch. He did not recognize this important tactile cue that the airplane was out of trim. If he had trimmed the airplane when it reached approach speed, the increasing force on the control wheel would have been an unambiguous cue indicating that the airplane was getting slow. Additional practice in manual flight would have prepared him to trim the airplane at approach speed and add power to correct any low airspeed condition he detected as a result of changes in force feel. Had he had more opportunity to manually fly the airplane during training and line operations, he would most likely have used trim, recognized this tactile cue, and corrected the airspeed using power.

NTSB Aircraft Accident Report 104 Both SAFO 13002 and the FAA’s amendment to 14 CFR Part 121 addressed the lack of proficiency in manual flight that has developed as a result of pilot reliance on increasingly sophisticated, highly automated airplanes such as the 777. In this accident, the PF, an experienced pilot who had 9,684 hours of flight time, a background as an instructor for Asiana, and a record of successful completion of ground school and simulator training in the 777, lacked critical manual flying skills. This demonstrates that without greater opportunity for pilots to manually fly the airplane, their airplane handling skills degrade. Asiana provided statistical data that showed that in 2012, 77.7% of Asiana 777 landings were made manually. However, the data did not indicate at what point the A/P had been disengaged before the manual landing. Based on the interviews referred to above, it seems likely that most flight crews making manual landings did not perform manual airplane handling and maneuvering above 1,000 ft. By 1,000 ft on final approach, the airplane is typically already stabilized in its landing attitude, configuration, speed, and power setting, and usually only minor adjustments must be made to the flight controls until the flare. Under normal conditions, the flare only requires a 2º to 3 pitch change and thrust reduction. In the case of the 777, even the thrust reduction is performed for the pilot by the A/T. By manually flying only the last 1,000 ft of an approach, pilots do not get to experience the necessary control inputs and feedback performance of the airplane that takes place in climbs, descents, turns, accelerations, decelerations, and configuration changes and do not develop or maintain an ability to “stay ahead” of the airplane, meaning the ability to anticipate the airplane’s performance. The NTSB concludes that by encouraging flight crews to manually fly the airplane before the last 1,000 ft of the approach, Asiana would improve its pilots’ abilities to cope with maneuvering changes commonly experienced at major airports and would allow them to be more proficient in establishing stabilized approaches under demanding conditions; in this accident, the PF may have better used pitch trim, recognized that the airspeed was decaying, and taken the appropriate corrective action of adding power. Therefore, the NTSB recommends that Asiana Airlines modify its automation policy to provide for more manual flight, both in training and in line operations, to improve pilot proficiency. 2.7 Low Energy Alert The 777 was equipped with a low airspeed alerting system that was first certified on the 747-400 in 1996 and then certified for the 777-200B in 1997. This system, developed as a result of a safety-related incident reported by a customer airline in 1995,101 was designed to alert flight crews of decreasing airspeed to avoid imminent stalls. The system, which activates when airspeed decreases 30% into the amber band, was not designed to alert crews that their airspeed had fallen below Vref during approach. According to Boeing, the triggering threshold for the low airspeed alert was selected to avoid nuisance alerts during normal operations and to minimize them during intentional operations at low airspeeds. Minimizing nuisance alerts is an important

101 According to Boeing, this incident involved a slow, unintended deceleration during cruise, followed by stick shaker activation and the loss of several thousand ft of altitude during recovery.

NTSB Aircraft Accident Report 105 consideration in the design of alerts because too many false alerts can increase flight crew response times or cause crews to ignore alerts altogether. In this accident, the low airspeed alert triggered about 11 seconds before impact, and the PM advanced the thrust levers about 4 seconds later. However, the attempted go-around was not successful because there was not enough time for the engines to develop sufficient power to arrest the airplane’s descent before impact. The only way for an alert to facilitate a successful recovery in such a situation would be for the alert to activate at a higher airspeed, so kinetic energy (airspeed) could be traded for potential energy (altitude) until thrust increased, and/or at a higher altitude, so potential energy (altitude) could be traded for kinetic energy (airspeed) until thrust increased. Boeing classified the low airspeed alert as a “caution” rather than a “warning” alert. In accordance with the 777 centralized crew alerting system, the low airspeed caution alert was designed to sound a master caution alert (the quadruple chime) to draw the flight crew’s attention to the EICAS screen, where an “airspeed low” message would be displayed. Boeing expected that this type of alert presentation would result in a flight crew response time of about 4 seconds. (As stated above, in this accident, the PM did respond in about 4 seconds.) Boeing also expected that the low airspeed alert would activate at least 10 seconds before the onset of stall warning for common high-altitude stall scenarios and, therefore, concluded that an expected flight crew response time of about 4 seconds was sufficient to give the flight crew advance indication of the low airspeed condition and reduce the likelihood of a startle response. When the low airspeed alert activated in this accident, however, there was no question that immediate flight crew action was required due to low speed and low altitude. For the accident scenario, therefore, a warning level alert would have been more appropriate in order to reduce flight crew response time. However, even if the alert had been a warning that required immediate flight crew response, it likely would not have prevented this accident. The warning still would have occurred about 11 seconds before impact, and additional time would have been required for the flight crew to take corrective action. By this time, the airplane was in a very low energy condition (low airspeed, low altitude, and low thrust) and, based on the performance study, likely did not have the performance capability to accomplish a go-around. Nevertheless, this accident provides information that can be used as part of ongoing efforts to develop requirements for low airspeed alerting systems during all phases of flight. The NTSB has long recognized the need for low airspeed alerting systems, having issued recommendations in this area following the investigations of a 2002 accident involving a Raytheon (Beechcraft) King Air A100 (NTSB 2003) and a 2009 accident involving a Bombardier DHC-8-400 (NTSB 2010). Safety Recommendations A-03-53 and -54 asked the FAA to convene a panel of experts to determine whether a requirement for the installation of low airspeed alert systems in airplanes engaged in commercial operations under 14 CFR Parts 121 and 135 would be feasible, submit a report of the panel's findings, and, if feasible, establish requirements for such systems. These recommendations were superseded by Safety Recommendation A-10-12, which urged the FAA to require, for all airplanes engaged in commercial operations under 14 CFR Parts 121, 135, and 91 Subpart K, the installation of low airspeed alert systems that provide pilots with redundant aural and visual warning of an impending hazardous low airspeed condition.

NTSB Aircraft Accident Report 106 The FAA responded by tasking the Aviation Rulemaking Advisory Committee (ARAC) with developing recommendations for requirements to address low airspeed alerting systems. In February 2013, the FAA received the ARAC report that addressed scenarios for retrofitting low airspeed alerting systems in 14 CFR Part 25 airplanes operating under 14 CFR Part 121. The FAA has completed its evaluation of the ARAC recommendations and determined that low speed alerts are a highly effective safety enhancement for airplanes operating under 14 CFR Parts 121 and 129. On May 9, 2014, the FAA informed the NTSB that it was conducting a cost and effectiveness review for implementing low airspeed alerts, which it expected to complete by December 2014, and that it might pursue rulemaking pending this review. The FAA also said that it would continue to evaluate retrofit requirements for 14 CFR Part 25 airplanes operated under 14 CFR Parts 135 and 91 Subpart K. The 777’s low airspeed alerting system provided both an aural and a visual alert. However, this accident demonstrates that existing low airspeed alert systems that are designed to provide pilots with redundant aural and visual warning of an impending hazard due to low airspeed may not be adequately tailored to alert pilots to an impending hazard due to a combination of conditions (i.e., low airspeed combined with low altitude). During the approach phase of flight, an alert may need to be designed so that its activation threshold takes airspeed (kinetic energy), altitude (potential energy), and engine response time into account. In addition, the alert should take into account expected flight crew response time to an unexpected, critical event, based on the alert’s method of presentation. A context-dependent low energy alert system would take all of these variables into account to determine the most appropriate activation threshold and method of presentation. The terms “low airspeed” and “low energy” are sometimes used interchangeably, and indeed, both terms appear in the ARAC’s final report. However, both terms are ultimately linked to situations in which the airplane’s angle of attack is approaching or has exceeded a predetermined threshold and therefore are primarily concerned with the airplane’s proximity to stall warning and stall. Neither term in the ARAC final report refers specifically to an alert that includes either the airplane’s altitude above the ground or thrust setting in the logic that governs the triggering of the alert. Nonetheless, in general the term “energy,” when referring to the total energy of the airplane, encompasses both airspeed (kinetic energy) and altitude (potential energy). Furthermore, the engine power level will govern the rate of total energy increase or loss. Therefore, the NTSB will refer to an alert that considers airspeed, altitude, engine power level, and flight crew response time in its alerting logic as a “low energy alert.” The NTSB concludes that a context-dependent low energy alert would help pilots successfully recover from unexpected low energy situations like the situation encountered by the accident pilots. The complexity of a context-dependent low energy alerting system means that the development of such a system needs to carefully balance the requirement for timely alerts in different phases of flight with the requirement to avoid nuisance alerts in all phases of flight. These competing requirements need to be assessed to determine whether the development of such systems is feasible. The FAA’s Avionics Systems Harmonization Working Group (ASHWG) was tasked with evaluating the technical feasibility of low airspeed alerting systems. Doing so required the participation of human factors, aviation operations, and aircraft design specialists. Consideration of technological challenges and requirements for low energy alerting

NTSB Aircraft Accident Report 107 systems would require a collaboration across the same specialties. In addition, due to its past work, the ASHWG would likely have a high degree of familiarity with issues related to the development of low energy alerting systems. Therefore, the NTSB recommends that the FAA task a panel of human factors, aviation operations, and aircraft design specialists, such as the ASHWG, to develop design requirements for context-dependent low energy alerting systems for airplanes engaged in commercial operations. Further, the NTSB recommends that Boeing, using the guidance developed by the low energy alerting system panel created in accordance with Safety Recommendation A-14-43, develop and evaluate a modification to Boeing wide-body automatic flight control systems to help ensure that the aircraft energy state remains at or above the minimum desired energy condition during any portion of the flight. 2.8 Survival Aspects 2.8.1 Accident Survivability 2.8.1.1 Evacuation According to the PM and the cabin manager, after the airplane came to a stop, the cabin manager came forward to the cockpit and asked if the flight attendants should evacuate the airplane, and the PM told her to wait. The PM’s outside view was obscured by dust, and he did not fully realize the extent of damage to the airplane. In accordance with Asiana procedures, the PM contacted the ATCT (about 20 seconds after the airplane came to rest). The PM recalled that once he understood that emergency vehicles were responding, he completed the initial steps of the QRH checklist and issued the evacuation order. By this time, flight attendant L2A had already commanded the evacuation after observing fire outside door 2R. Upon hearing his command, the cabin manager opened door 1L and also began commanding passengers to evacuate. Review of video footage indicated that doors 1L and 2L were opened nearly simultaneously about 1 minute 33 seconds after the airplane came to a stop. Such a lengthy delay was not reported by any of the crewmembers in their statements; however, it is not unusual for human perceptions of time to be erroneous, especially when in disorienting, highly stressful events. The NTSB concludes that the flight attendants acted appropriately when they initiated an emergency evacuation upon determining there was a fire outside door 2R. Further, the delay of about 90 seconds in initiating an evacuation was likely due partly to the PM’s command not to begin an immediate evacuation, as well as disorientation and confusion. The flight attendants who opened doors 1L and 2L reported no problems with their doors or slide/rafts, and both were used during the evacuation. However, the slide/rafts on doors 1R and 2R inflated inside the airplane during the airplane’s final impact, injuring and temporarily trapping two flight attendants and rendering the doors unusable during the evacuation.102 The 1R slide/raft inflated into the forward galley area, which was forward of all passenger seats; because A-zone passengers on the right side of the airplane could cross through the seat rows to evacuate

102 For further information about why these slide/rafts inflated, see section 2.8.2.

NTSB Aircraft Accident Report 108 from door 1L, the inflation had little to no effect on passenger evacuation time. The 2R slide/raft inflated into the midcabin galley and blocked the right aisle between B-zone and A-zone, preventing B-zone passengers on the right side of the airplane from moving forward into A-zone and crossing to door 1L. Instead, these passengers crossed B-zone to reach door 2L creating a bottleneck at door 2L, making it difficult for passengers to move forward to reach door 1L. This helps to explain why the flow of passengers out of door 2L remained constant and heavy for about 2 minutes 30 seconds while the flow of passengers evacuating out of door 1L slowed considerably after about 30 seconds. Despite fastening her restraint before landing, flight attendant R3 was thrown to the floor and seriously injured during impact, and passengers assisted her from the airplane through door 3R after it was opened by passenger 30K. Therefore, flight attendant L3 was the only crewmember in the back half of the airplane who was capable of assisting with the evacuation. Her attempt to open door 3L was unsuccessful,103 so she stayed in the area of her jumpseat and directed passengers to evacuate from both doors 2L and 3R. In summary, the evacuation was accomplished by 5 of the 12 flight attendants (the cabin manager, L1B, L2A, L2B, and L3) using 3 of the 8 doors (1L, 2L, and 3R). 2.8.1.2 Fatalities Passengers 41B and 41E Fatally injured passengers 41B and 41E were both seated in triple seat unit 41DEG for landing; passenger 41B was in seat 41D and observed covered with a blanket; and passenger 41E was in her assigned seat and observed not wearing her seatbelt.104 Passenger 41G was in her assigned seat and reported wearing her seatbelt for landing; she remained in her seat during the impact sequence and sustained only minor injuries. Seat 41D’s seatbelt was found unbuckled and undamaged with no signs of stretch or other evidence of use during the crash. Passenger 41B was found on the right side on the runway, not far from where one of the aft flight attendants was found (see figure 15).

103 Door 3L was later opened by an emergency responder after the evacuation. 104 In postaccident interviews, students seated in the same row as passenger 41E reported that she was not wearing her seatbelt for landing. Flight attendants and passengers reported that at least two flight attendants performed prelanding seatbelt compliance checks in C-zone and were “very diligent” in ensuring compliance with seatbelt regulations.

NTSB Aircraft Accident Report 109

Figure 15. Location where ejected occupants were found.

Passenger 41E was found in front of the left wing. Three possible scenarios could explain how passenger 41E arrived in front of the left wing after the impact sequence: (1) she arrived at the location under her own power; (2) she was taken to the location by an emergency responder or other passenger after being rescued from the airplane and forgotten; or (3) she was ejected from the airplane and landed at that location. Seat 41E’s seatbelt was found unbuckled and undamaged with no signs of stretch or other evidence of use during the crash. Passenger 41E sustained multiple serious injuries, including a

NTSB Aircraft Accident Report 110 laceration of the aorta without associated rib fractures,105 which is a deceleration injury consistent with striking internal components of the aircraft or with ejection. She also sustained external abrasions that were similar to others who were ejected from the airplane and inconsistent with a vehicle rolling over her. The severity of these injuries would have precluded self-evacuation from the airplane. Additionally, passenger 41E was visible in a photograph on the ground in front of the left wing early in the evacuation before the arrival of emergency responders, and there were no reports of passengers helping her out of the airplane. Finally, independent observations by multiple medically trained first responders described a person who appeared to be deceased before the first vehicle rolled over her. The NTSB concludes that passengers 41B and 41E were unrestrained for landing and ejected through the ruptured tail of the airplane at different times during the impact sequence. It is likely that these passengers would have remained in the cabin and survived if they had been wearing their seatbelts. Passenger 42A Interviewed passengers made no observations regarding passenger 42A’s seat location for landing or seatbelt status. Review of medical records and first responder statements indicated it was likely that a total of five passengers were extricated from the rear of the airplane. Several firefighters reported extricating an unresponsive female passenger from the area near seat 42A, and video footage indicated that a passenger matching their descriptions was carried from the airplane at 1144:43. This was likely passenger 42A because the other four passengers who required extrication from the back of the airplane can be accounted for by matching their injuries to the descriptions given by first responders. Passenger 42A was one of only two passengers to sustain a skull fracture; however, other passengers who were assigned seats in her immediate area, including passenger 42B seated next to her, sustained only minor injuries in the accident. This suggests that an extremely violent event that was localized to the area around seat 42A caused her injuries. The separation of door 4L, which was torn from the airplane in the final impact, is consistent with such an event in her immediate environment. Further, seat pair 42AB was documented to have rotated completely backward such that the seatbacks were in contact with the floor, which would have left passenger 42A, who was closest to the door, in an extremely exposed position. Although seat 42A’s seatbelt was found unbuckled and undamaged with no signs of stretch or other evidence of use during the crash, this finding is not unexpected given the forces that caused the backward rotation of the seat pair. The NTSB concludes that passenger 42A was likely restrained for landing, and the severity of her injuries was likely due to being struck by door 4L when it separated during the airplane’s final impact.

105 This was a horizontal laceration at the level of the ligamentum artieriosum with a significant associated hematoma.

NTSB Aircraft Accident Report 111 2.8.1.3 Injuries Aft Flight Attendants The R4 and L4 jumpseats were ejected from the airplane and found still attached to large pieces of galley structure about 1,100 and 1,300 ft (respectively) down the runway from the airplane. Flight attendants R4 and L4 sustained major skin avulsion injuries, and flight attendant L4 additionally received serious leg, foot, spine, and sternum fractures; these injuries are indicative that these flight attendants were also ejected during the airplane’s slide. Although both four-point restraints were undamaged and unbuckled, large blood stains found on the ground beneath both jumpseats indicated that flight attendants R4 and L4 remained buckled in their jumpseats and slid with them down the runway. About 22 minutes after the accident, video footage showed an individual walking from the vicinity of the R4 jumpseat toward the airplane and numerous passengers running to assist the person in the vicinity of a distance remaining marker behind the airplane. Two ASOs described seeing an injured flight attendant who was laying on the ground in this area being attended to by a group of passengers. Based on the ASOs’ statements and the video footage, it is very likely that the person seen walking across the runway in the video was flight attendant R4. Flight attendants M4A and M4B were found on the runway more than 1,000 ft from their jumpseats and sustained injuries including major skin avulsions, fractures, and other serious internal injuries that indicated both were ejected during the airplane’s slide. Jumpseat M4B was ejected from the airplane and found about 50 ft behind the aft pressure bulkhead while jumpseat M4A remained in the airplane. Jumpseat M4B’s restraint was found still buckled and undamaged, as was the seatpan; therefore, it is not clear how flight attendant M4B became separated from her jumpseat during the ejection. Jumpseat M4A’s four-point restraint was unbuckled but had a fractured lap belt shackle and a damaged seatpan, which would have allowed flight attendant M4A to slip down and out of the restraint and seat. Given their final locations, it is likely that both flight attendants were pulled from their jumpseats during the airplane’s slide and were then completely unprotected from ground impact and abrasive injuries. Based on their injuries, the locations where they were found, and the statements of first responders, the four aft flight attendants were ejected out of the ruptured tail of the airplane during the airplane’s slide down the runway. Passengers The serious injuries sustained by passengers were analyzed in an effort to understand how they occurred. Three obvious patterns emerged. First, most of the seriously injured passengers (25/40) were seated in C-zone. This pattern corresponded with the airplane dynamics observed on video footage of the accident, which showed the right wing rise and the airplane spin counterclockwise while sliding down the runway. The aft end of the airplane rose off the ground higher than the rest of the airplane and then forcefully impacted the ground. This essentially caused the occupants in the back of the airplane to “fall” from the greatest height and experience higher g loads than the other occupants in the airplane. Higher g loads naturally lead to more significant injuries.

NTSB Aircraft Accident Report 112 The greater number of serious injuries in C-zone also matched the interior damage documented by investigators. Virtually the entire floor of C-zone was fractured due to the displacement of subfloor structure during the airplane’s final impact. Despite this fact, all but three of the seat units in C-zone remained attached to their respective seat tracks by at least one seat track attachment point. Most of the seat units in C-zone showed some deformation, with the overall pattern showing the seats shifting to the left and rotating aft (backward). The second pattern that emerged in the analysis of serious passenger injuries was that of the 11 passengers who sustained rib fractures, 10 sustained rib fractures on their left side. Again, this finding fits with the observed video footage and interior documentation. At the time of the airplane’s final impact, the airplane was continuing to spin in a counterclockwise direction. Evidence of this rotation can be seen on the exterior of the airplane where the underside of the fuselage bowed out significantly under the right side, causing the decreased doorsill height beneath door 3R. Restrained passengers inside the airplane would have been thrown to the left as the airplane came in contact with the ground and decelerated rapidly. Occupants in their seats would have continued their motion to the left until striking something to stop their motion. For most occupants, the first object they would have contacted would have been the left armrest of their seats with the left lower side of their chest and abdomen. This was the likely mechanism for most of the rib fractures. A further consequence of the left lateral impact forces appears to be the multiple skull fractures sustained by passenger 11C, a 45-year-old male, who was the only surviving passenger to sustain skull fractures. An examination of the airplane’s seating configuration provided insight into how he sustained these injuries. Like the other B-zone passengers, passenger 11C had only a lap belt for restraint, but he was the only passenger who had no seat directly in front of him with a seat to his left front (seat 10B). It is likely that the combined forward and lateral forces acting on his body and the absence of a seat back in front of him allowed passenger 11C’s head to strike the back of the very stiff inboard armrest of seat 10B. Any marks from this strike on the armrest were obscured by the postimpact fire. However, passenger 11C’s skull fractures included the left frontal skull, left temporal bone, left orbital roof and wall, the very areas that would be expected in such a strike scenario. Thus, it is highly likely that passenger 11C’s serious head injuries were caused by striking the inboard armrest of seat 10B. The NTSB concludes that the dynamics of the impact sequence in this accident were such that occupants were thrown forward and experienced a significant lateral force to the left, which resulted in serious passenger injuries that included numerous left-sided rib fractures and one left-sided head injury. The basic principle of 16g seat crashworthiness is that in addition to the seat pan, the seatback in front of the occupant serves as an impact absorber. The seatback is designed to “break over” when impacted from behind, slowing the occupant’s head acceleration and keeping it within a survivable envelope. For seats to be certified, the FAA requires testing using a crash test dummy to measure head acceleration to discern the level of head injury that might be sustained at different crash loads. In an accident with purely longitudinal deceleration, restrained occupants with open space in front of them would flail forward around the lap belt, but critical head decelerations may be avoided because there would be no object to strike. However, in this accident, the dynamics were such that occupants were thrown forward and experienced a significant lateral force to the left.

NTSB Aircraft Accident Report 113 While current FAA dynamic seat certification requirements do include testing row/row seat interactions with seats positioned slightly off the longitudinal axis, they would not likely approximate the forces encountered in this accident, and it is not clear how many different seat arrangements would need to be tested. The NTSB is aware of at least one technology—air bag seatbelts—that is already in service on some commercial airplanes and could potentially mitigate the type of injury sustained by passenger 11C. Therefore, the NTSB recommends that the FAA conduct research that examines the injury potential to occupants in accidents with significant lateral forces, and if the research deems it necessary, implement regulations to mitigate the hazards identified. The third pattern that emerged in the analysis of serious passenger injuries was a high number of serious injuries to the high thoracic spine.106 The majority of passengers who sustained spinal injuries (20/24) were seated in C-zone. Many of these passengers suffered more than one spinal injury including compression fractures of multiple vertebrae and ligament injuries spanning several levels. A total of 17 passengers suffered 43 injuries within the thoracic spine; 31 of these injuries occurred in the high thoracic spine. Five passengers experienced both a sternal fracture and high thoracic spine injuries. Generally, fractures of the upper thoracic spine are rare because of the thoracic spine’s relatively protected and immobile position within the thoracic cage. The exact mechanism of compression fractures of the upper thoracic spine is not well understood. Because of the normal curvature of the lumbar spine, vertical loads applied while in a seated position typically cause compression fractures in the high lumbar spine or at the junction between the thoracic and lumbar spines; only a few such lumbar spine injuries occurred in this crash. Although the exact mechanism causing these high thoracic spine injuries is not known, the combination of multiple, highly dynamic impacts and the ability of the upper body to flail about the lap-belted pelvis may have resulted in significant loading of the upper thoracic cage at the time of the final impact. The NTSB concludes that the reasons for the high number of serious injuries to the high thoracic spine in this accident are poorly understood. Therefore, the NTSB recommends that the FAA conduct research to identify the mechanism that produces high thoracic spinal injuries in commercial aviation accidents, and if the research deems it necessary, implement regulations to mitigate the hazards identified. 2.8.1.4 Accident Survivability Summary A total of six occupants (two of the three fatally injured passengers and the four seriously injured aft flight attendants) were ejected from the airplane during the impact sequence. The four aft flight attendants were likely wearing their restraints but were ejected due to the destruction of the aft galley, which resulted in severe damage to jumpseat M4A and the ejection of jumpseats R4, L4, and M4B. In contrast, none of the passenger seat units were ejected from the airplane. As stated above, had the two ejected passengers been restrained, they likely would have survived the accident.

106 From the head down, the spine consists of 7 vertebrae in the cervical (neck) area, 12 in the thoracic (chest) section, and 5 in the lumbar (low back) area. Within the thoracic section, the 8 upper vertebrae constitute the high thoracic spine.

NTSB Aircraft Accident Report 114 The airplane’s structure and seats absorbed a tremendous amount of energy, which, despite multiple spinal fractures, resulted in a complete lack of passenger paralyzations. Only two passengers who were not ejected sustained skull fractures, and one of those two was able to self-evacuate. Protecting people to the point they can get off the airplane by themselves and do not need to be rescued is one of the main goals of the FAA’s crashworthiness program. Despite the catastrophic nature of the crash, the airplane provided protection to the extent that 99% of the occupants survived and 98% of the passengers were able to self-evacuate. 2.8.2 Slide/Raft Performance 2.8.2.1 Slide/Rafts 1R and 2R As part of the effort to explain the inadvertent inflation of the 1R and 2R slide/rafts inside the cabin, a detailed examination of the release mechanisms of all the airplane’s slide/rafts was performed. While there was no damage to the 1L and 2L release mechanisms, the other six release mechanisms were all damaged with the 2R, 3R, and 4R release mechanisms sustaining damage that was described by the slide/raft manufacturer as “catastrophic.” In an effort to replicate the type of damage to the slide/raft release mechanisms that was observed, two series of destructive tests were performed. In the first series of tests, exemplar release mechanisms were subjected to increasing static tensile loads. The release mechanisms failed under g loads that were calculated to be three to four times higher than the loads required for certification of the slide/rafts. In the second series of tests, exemplar slide/raft packs were subjected to increasing dynamic loads. The release mechanisms of those slide/rafts failed at g loads of about twice the certification requirement in the down direction and about four times the certification requirement in the inboard direction. Due to the extremely complex nature of the airplane’s movements after impact with the seawall and a lack of reliable FDR data shortly after the initial impact, insufficient information was available to calculate the forces experienced by the airplane and occupants during the accident. However, as a result of the findings from both sets of destructive tests, it is evident that the forces experienced by the slide/rafts during the impact sequence far exceeded their certification limits, leading to overload failures of the slide/raft release mechanisms on the 1R and 2R slide/rafts. Measurements made after the testing indicated that once released from the packboard, despite its 65-inch inflation cable, a slide/raft would only need to fall inboard and move about 6 inches for the inflation cable to release from the valve on the inflation cylinder. The NTSB concludes that the release and inflation of the 1R and 2R slide/rafts inside the airplane cabin was a result of the catastrophic nature of the crash, which produced loads far exceeding design certification limits. Given the critical nature of these evacuation devices and their proximity to essential crewmembers, slides and slide/rafts must be certified to sufficient loads so that they will likely function in a survivable accident. Although this exact accident scenario is unlikely to occur again, the NTSB believes that the data obtained during this accident investigation could prove useful for future slide/raft design. Therefore, the NTSB recommends that the FAA analyze, in

NTSB Aircraft Accident Report 115 conjunction with slide/raft manufacturers, the information obtained in this accident investigation and evaluate the adequacy of slide and slide/raft certification standards and test methods specified in FAA regulations and guidance materials. If appropriate, modify certification standards and test methods for future slide and slide/raft design based on the results of this evaluation. 2.8.2.2 Slide/Rafts 3L and 3R About 20 minutes after the last passenger had been rescued, door 3L was opened by an emergency responder, and the 3L slide/raft pack fell about 53 inches onto the ground and did not inflate. When door 3R was opened by a passenger during the evacuation, the 3R slide/raft pack fell about 17 inches onto wreckage below the door sill and did not inflate. Both door sill heights were less than the 65-inch minimum distance required to increase the tension on the inflation cables sufficiently to open the valves on the inflation cylinders. Because the door sill heights were less than 65 inches, the 3L and 3R slide/rafts did not fully deploy and inflate. 2.8.2.3 Slide/Rafts 4L and 4R Door 4L was torn from the doorframe and found on the ground outside the airplane. The door 4L slide/raft was found still connected to the girt bar in the area that had been the aft galley with the inflation cylinder empty and ingested material in both aspirators. This indicated that the 4L slide/raft came free from its packboard at some point after the airplane’s initial impact and attempted to inflate inside the cabin, likely due to the destruction of the floor of the aft galley area. The 4R slide/raft’s girt bar was attached to the floor fittings; however, unlike the 4L slide/raft, the 4R slide/raft’s girt was torn. The slide/raft was found near the break in the aft pressure bulkhead with the pressure cylinder fully charged, and the cylinder safety pin was found installed in the valve. Records indicated that the most recent maintenance on the airplane that would have required installation and later removal of the safety pin took place in December 2012, and it is likely maintenance personnel installed but did not remove the safety pin at that time. Because maintenance personnel installed and then failed to remove the inflation cylinder safety pin, the 4R slide/raft would not have been functional in the event it was needed for an evacuation. In response to the finding of the safety pin installed in the inflation cylinder of the 4R slide/raft, the FAA conducted ramp inspections of airplanes operated by Part 129 air carriers and found no similar discrepancies. Additionally, Asiana changed its slide/raft maintenance procedure from issuing a single work order per airplane for the installation and removal of slide/raft safety pins to issuing two separate work orders per slide/raft (one for installation and one for removal).

NTSB Aircraft Accident Report 116 2.8.3 Emergency Response 2.8.3.1 Firefighting Tactics and Use of High-Reach Extendable Turrets SFFD-AB firefighting tactics accomplished the primary ARFF purpose by engaging the fire and protecting the egress path for passengers. Firefighters also performed a successful interior attack inside the cabin of the airplane. Three firefighters took initiative and entered the cabin with a handline through door 2L. They checked the cabin for occupants, found five injured passengers in the back of the airplane, and with the assistance of SFPD personnel, rescued them amid conditions that were rapidly deteriorating as the postcrash fire spread. It is likely these passengers would have died from the effects of the postcrash fire had they not been extricated by the firefighters and police officers. As further discussed below in section 2.8.3.3, the successful rescue of these five passengers who were unable to self-evacuate amid rapidly deteriorating cabin conditions was possible because the airport’s staffing level provided the opportunity for simultaneous interior and exterior fire attacks. The ARFF response could have been improved, however, in that the HRET-equipped vehicles (Rescue 9 and 10) were not used effectively in the initial response to this accident. About 1 minute after initially arriving on scene, the crew of Rescue 9 decided to reposition from a 1 o’clock position to the left rear and, eventually, the right rear of the airplane. However, from these positions, Rescue 9 could neither effectively apply agent to the fire near door 2R nor protect an evacuation path for passengers. Additionally, the path used to reposition Rescue 9 (around the nose and down the left side of the airplane) took the truck into the area where passengers and crew were still evacuating, increasing the risk of a vehicle strike (although one did not occur at that time). Eventually, Rescue 9 moved to a 3 o’clock position near the airplane’s right wing, and its HRET was first used to pierce the fuselage and dispense agent near door 2R about 20 minutes after it arrived on scene. Rescue 10 arrived on scene about 1 minute after Rescue 9, and the driver chose to take a 10 o’clock position near the airplane’s left wing tip. After about 4 minutes, Rescue 10 moved closer to the area of the missing left engine and applied bursts of foam for about 3 minutes, creating a foam blanket to protect against ignition of leaking fuel. However, Rescue 10 then returned to a position farther from the fuselage near the left wing tip, where it could not effectively apply agent to the growing fire in the midcabin area. Eventually Rescue 10 moved closer to the fuselage, and Rescue 10’s HRET was first used to pierce the fuselage and dispense agent near door 2L about 20 minutes after it arrived on scene. The positioning of both of SFFD’s most sophisticated vehicles near the left wing and aft areas of the airplane rendered them incapable of direct fire attack. There was a time window between about 1133 and 1144 when the exterior fire was knocked down or extinguished, and an HRET vehicle’s forward-looking infrared camera could have provided firefighters useful information about the status of an interior fire, which had already ignited inside the cheek area of the airplane below door 2R. Had an operator identified the interior fire below door 2R, the

NTSB Aircraft Accident Report 117 HRET’s skin-penetrating nozzle could have been used to inject agent into the airplane’s cheek area below the floor, potentially arresting or preventing the fire’s spread into the cabin.107 Additionally, neither HRET was used until after the last passenger was extricated from the back of the airplane (about 1147), well after it was amply evident that the interior of the airplane was fully involved with fire. The driver of Rescue 10 indicated in his postaccident interviews that he waited for an “all clear” from the firefighters inside the airplane before piercing the airplane; the assistant deputy chief in charge of SFFD-AB confirmed that at the time of the accident, SFFD-AB had no policy on when to use an HRET to pierce an airplane. It is not certain whether a more rapid attack using the HRETs could have extinguished or slowed the spread of the interior fire. However, FAA research has clearly demonstrated the effectiveness of using an HRET to aggressively fight an interior fire and increase occupant survivability. AC 150/5210-23 provides guidance on the use of HRETs and states that testing has shown that an HRET with a skin-penetrating nozzle can control and contain fire from spreading, reduce high cabin temperatures, and provide rapid smoke ventilation. Although the AC provides information on how and where to pierce an airplane, it does not include any guidance to firefighters on when to pierce. In summary, neither HRET-equipped vehicle was used to the best of its capabilities in the initial fire attack. This was initially due to improper decision-making and vehicle positioning on the part of the ARFF crewmembers. Once the vehicles were out of position, command personnel failed to properly reposition them such that they could be most effectively used. These errors, combined with the lack of guidance on when to use an HRET to pierce an airplane, led to the spread of the interior fire and the eventual destruction of both A-zone and B-zone. The NTSB concludes that clearer guidance is needed to resolve the concern among airport fire departments and individual firefighters that the potential risk of injuring airplane occupants while piercing aircraft structure with a skin-penetrating nozzle outweighs the potential benefit of an early and aggressive interior attack using this tool. The NTSB acknowledges that the issue is complex. Therefore, the NTSB recommends that the FAA and the ARFF Working Group work with equipment manufacturers to develop and distribute more specific policies and guidance about when, how, and where to use the HRET’s unique capabilities. 2.8.3.2 Medical Response Issues Emergency Buses

Multiple requests were reportedly made for the airport’s two emergency medical buses to respond to the scene; however, despite procedures in the airport’s emergency procedures manual indicating that ASOs would deliver them, neither of the medical buses arrived at the accident

107 It is unknown whether the HRET operator would have pierced the airplane below floor level, but it is unlikely given SFFD-AB’s operating guidance, which was to wait until all passengers were extricated from the airplane before piercing.

NTSB Aircraft Accident Report 118 site. As a result, there was initially a shortage of backboards for the seriously injured passengers at the scene. Although the initial shortage of backboards was eventually remedied by the arrival of mutual aid medical vehicles with additional backboards, the NTSB is concerned about this lack of adherence to the airport’s emergency plan. When questioned after the accident about why the buses did not respond to the scene, the airport’s chief operating officer reported that they were not driven to the scene by an ASO because all of the ASOs were busy with other duties, such as escorting mutual aid vehicles to the accident site. The SFO chief operating officer further stated that in the event of an Alert 3 at the airport, the specifics of the event determined what specific equipment needed to be deployed, and the medical buses would be delivered when requested by the incident commander. This response contradicts the airport emergency procedures manual, which stated that ASOs would deliver the buses “early in the response sequence.” This suggests that the timeliness of getting the buses to the scene of a mass casualty event may not have been appropriately prioritized by SFO airport operations staff and/or the ASOs were overtasked in the emergency procedures manual. Additionally, when the buses eventually responded to the airport terminal for secondary passenger triage, it was discovered that only one bus was operable, and several ASOs remarked about a lack of mechanical reliability with the 29-year-old buses before the accident. Further, the NTSB learned that the monthly emergency drills conducted by the airport did not include deployment of the buses either as a matter of routine or as part of the unique scenario being evaluated. The use of the buses in these drills would have helped to reinforce the utility of these resources in mass casualty events, and as a result, SFO airport operations staff may have placed a higher priority on responding with the emergency medical buses to the accident site. The NTSB concludes that medical buses were not effectively integrated into SFO’s monthly preparation drills, which played a part in their lack of use in the initial response to the accident and delayed the arrival of backboards to treat seriously injured passengers. In its posthearing submission, the City and County of San Francisco stated that it has budgeted for the purchase of two dedicated SFFD-AB mass casualty unit vehicles, each holding 250 backboards. According to its submission, one vehicle is to be purchased in 2014/2015, and the second is to be purchased in 2015/2016. The NTSB believes that the purchase of new mass casualty supply vehicles and the decision for SFFD-AB (rather than the airport) to maintain and operate the vehicles will enhance the capability of the on-airport medical response. To ensure that all vehicles are appropriately prepared, the NTSB recommends that the City and County of San Francisco routinely integrate the use of all SFFD medical and firefighting vehicles in future disaster drills and preparatory exercises. Triage of Passenger 41E

Of the four responders who saw passenger 41E before she was struck by any ARFF vehicles, two had the necessary medical training and were in a position to triage her. About 1137, there was a period of between 30 and 45 seconds when the passenger’s location had been

NTSB Aircraft Accident Report 119 identified and firefighters were in her immediate vicinity before she had been covered by foam or rolled over by a vehicle. At the NTSB’s investigative hearing, the assistant deputy chief in charge of SFFD-AB stated that the firefighters’ training and experience led them to the determination that she was “obviously deceased,” and they defaulted to the higher priority task of performing a rescue. However, the NTSB notes that there was a complete lack of blood around the passenger and that her body was not disfigured or dismembered in any way. Further, video evidence shows that there was adequate time for a brief triage examination for respiration, perfusion, and mental status that would not have significantly affected the preparations for the interior search. Although at least two firefighters had both the time and opportunity for triage to be performed on passenger 41E to verify their visual assessment of her condition, they did not do so. In this case, only one passenger was at significant risk of being rolled over by a vehicle due to her close proximity to the burning airplane, and there was an opportunity for triage; however, there are other accident scenarios where many injured persons could surround an accident airplane. The FAA’s position is that the primary purpose of ARFF is to begin a concentrated effort to knock down an aircraft fire so that crew and passengers will have a safe evacuation route. The ARFF personnel will be augmented by a mutual aid response from off-airport sources to provide personnel for rescue and medical triage purposes. The NTSB agrees with the FAA that responding ARFF personnel should focus on active fire suppression, maintaining an escape path for occupants, and occupant rescue as appropriate. However, the NTSB was unable to locate any guidance or training materials that specifically address the issue of task prioritization or how ARFF personnel should deal with the seriously injured or deceased persons who may be in the immediate vicinity of an accident airplane. In his interview, the assistant deputy chief in charge of SFFD-AB stated that throughout their training, firefighters were trained to try to maintain anything that was a potential crime scene and to disturb things as little as possible, including obviously deceased passengers. He thought this training might explain why his personnel did not move passenger 41E. Neither at the time of the accident nor at the time of his interview was there a policy on the movement of deceased victims. In talking with other ARFF chiefs about the topic, the assistant deputy chief could not find another department that had a policy on these topics. In a January 16, 2014, letter to the ARFF Working Group, the assistant deputy chief requested that the group convene to develop standard protocols for addressing deceased victims in ARFF operations. Also, in a letter to the San Mateo County Coroner, the assistant deputy chief requested any recommended protocols for the removal or retention of bodies at risk of being struck or rolled over by a vehicle during ARFF operations. The NTSB concludes that guidance on task prioritization for responding ARFF personnel that addresses the presence of seriously injured or deceased persons in the immediate vicinity of an accident airplane is needed to minimize the risk of these persons being struck or rolled over by vehicles during emergency response operations. Therefore, the NTSB recommends that the ARFF Working Group work with medical and medicolegal professional organizations to develop and distribute guidance on task prioritization for responding ARFF personnel that includes recommended best practices to avoid striking or rolling over seriously injured or deceased persons with ARFF vehicles in a mass casualty situation.

NTSB Aircraft Accident Report 120 Overall Triage

Given the large size of the accident site and the large number of seriously injured occupants, SFFD and the responding mutual aid agencies effectively and capably triaged more than 300 occupants in a timely manner. All occupants were transported from the accident site within about 90 minutes of ARFF’s arrival on scene, and 192 injured occupants were transported to local hospitals. On July 7, 2013, the chief of surgery at San Francisco General Hospital commended the triage and appropriate prioritization of patients that the hospital received. The NTSB concludes that the overall triage process in this mass casualty incident was effective with the exception of the failure of responders to verify their visual assessments of the condition of passenger 41E. 2.8.3.3 Staffing Seven SFFD-AB ARFF vehicles responded to the accident initially, and eventually at least 23 SFFD-AB ARFF personnel arrived on scene. This equipment level greatly exceeded the FAA minimums established in 14 CFR 139.317. Because of the amount of available ARFF vehicles and personnel, the SFFD-AB was able to simultaneously perform exterior and interior firefighting. Particularly, the extrication of the five passengers in the back of the airplane was successful because the airport’s staffing level provided the opportunity for multiple firefighters to perform an interior fire attack and search for injured occupants while other firefighters simultaneously performed an exterior suppression attack. The issue of ARFF staffing levels at airports is not a new one. After an accident in Little Rock, Arkansas, in 1999, the NTSB issued Safety Recommendation A-01-65, which asked the FAA to amend 14 CFR 139.319(j) to require a minimum ARFF staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. The FAA responded by asking the ARAC to establish an ARFF requirements working group. The working group reviewed 139.319 ARFF requirements, including ARFF staffing levels. On June 23, 2009, the ARAC stated the committee was unable to reach a consensus on the findings. According to the FAA, due to the lack of a consensus from the ARAC, it sponsored a research project through the Airport Cooperative Research Program (ACRP) that reviewed air carrier passenger aircraft accidents from 1989 through 2008 to determine if changes to ARFF standards would have reduced the number of fatalities or serious injuries resulting from these accidents. Completed in January 2011, ACRP Project 11-02, Task 12, “Risk Assessment of Proposed ARFF Standards,” concluded that a change in ARFF staffing standards would not have reduced fatalities or serious injuries in any of the accidents that were reviewed. The FAA agreed with the findings and did not amend Section 139.319(j). Therefore, the NTSB classified Safety Recommendation A-01-65 “Closed—Unacceptable Action” on October 28, 2011. As stated earlier, the FAA does not require a specific number of ARFF personnel to staff an airport; rather an Index E airport is required to have three vehicles carrying an adequate amount of extinguishing agent. This requirement could be met with only three vehicle drivers. It

NTSB Aircraft Accident Report 121 is fortunate that most (if not all) Index E airports in the United States are staffed with sufficient ARFF personnel to accomplish an interior fire attack, if needed; however, this is not the case at many small and midsize US airports. Therefore, passengers involved in an aviation accident at a smaller airport may not be afforded the same level of emergency response that the passengers of flight 214 had. The NTSB concludes that the SFFD’s ARFF staffing level was instrumental in the department’s ability to conduct a successful interior fire attack and successfully rescue five passengers who were unable to self-evacuate amid rapidly deteriorating cabin conditions. Although the FAA did not amend 14 CFR 139.319(j) in response to Safety Recommendation A-01-65, this accident again demonstrates that the need remains for ARFF staffing levels to be sufficient to allow for interior firefighting and rescue. The NTSB notes that the ARFF Working Group, which is a nonprofit international organization that facilitates the sharing of ARFF information between airport firefighters, municipal fire departments, and others concerned with aircraft firefighting, has considerable expertise regarding all aspects of ARFF. Therefore, the NTSB recommends that the ARFF Working Group develop a minimum ARFF staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. Further, the NTSB recommends that the FAA, once the minimum staffing level has been developed by the ARFF Working Group, as requested in Safety Recommendation A-14-60, amend 14 CFR 139.319(j) to require a minimum ARFF staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. 2.8.3.4 Incident Command When SFFD city supervisory personnel arrived about 24 minutes after the accident, a city assistant chief assumed incident command and assigned a city battalion chief as fire attack supervisor. Neither of these individuals had any previous experience working at an airport, nor had they been involved in a disaster exercise at SFO. When reviewing the video footage recorded on a helmet-mounted digital video camera worn by the fire attack supervisor, the NTSB noted that some of his decision-making reflected a lack of ARFF knowledge and training. For example, while personnel from one of the SFFD-AB vehicles (Rescue 37) were applying agent through the airplane’s windows near door 2L, the fire attack supervisor instructed the vehicle’s driver to discharge the agent through the 2L door instead. The fire attack supervisor was apparently unaware that there was a bulkhead inside the door that limited the effectiveness of applying agent through the door. Additionally, when approached by an SFFD rescue squad requesting to conduct a limited search inside the back of the airplane, the fire attack supervisor initially denied their request, stating that he had been notified everyone had already evacuated and remarking that it was not possible that anyone was still alive inside the airplane. Although it is always a difficult decision whether to send responders into harm’s way, there was no fire in the back of the airplane, the rescue squad had specialized training, and the final passengers had been extricated from the rear

NTSB Aircraft Accident Report 122 of the airplane only 15 minutes earlier.108 Due to the persistence of the rescue squad, the fire attack supervisor eventually relented and allowed the search to proceed. A fire attack supervisor with ARFF training would likely have had a better understanding of the potential for survivability inside a burning airplane and either ordered or agreed to the search without delay. Further, when notified that four “cabin crew” were missing, the fire attack supervisor made statements indicating that he considered the missing “cabin crew” to be the flight crewmembers and took subsequent actions based on that erroneous assumption, including ordering a search of the cockpit. It is also clear that he lacked an appreciation of the strength and thickness of cockpit windows by ordering one be broken from a ladder when door 1L was already open and would have provided quick access to the cockpit. In summary, the NTSB is concerned that the arriving incident commander placed a nonARFF trained officer in charge of the fire attack in this accident. The fire attack supervisor made statements and decisions that reflected a lack of ARFF knowledge and training. The NTSB concludes that although no additional injuries or loss of life were attributed to the fire attack supervisor’s lack of ARFF knowledge and training, the decisions and assumptions he made demonstrate the potential strategic and tactical challenges associated with having nonARFF-trained personnel in positions of command at an airplane accident. While reviewing the training records for the ARFF-trained personnel who responded to the accident, it was noted that the SFFD-AB shift captain who served as incident commander for a time had not yet participated in live fire training, which is required for some ARFF personnel by 14 CFR 139.319(i)(3). FAA AC 150/5200-31C, “Airport Emergency Plan,” defines the role of the incident commander as the individual who directs and controls personnel and equipment, as well as provides overall management at a specific incident site. In a legal interpretation provided to the NTSB on May 21, 2014, the FAA stated that it views this position as a “communications and coordination role for the various situations described in an airport’s emergency plan rather than a position limited to airport rescue and firefighting.” According to the interpretation, the FAA believes that the training requirements under 14 CFR 139.319(i)(2) and (i)(3) “may not apply to an Incident Commander because that person could rely on the trained firefighting command staff” to direct the firefighting operations. This interpretation allows for a situation in which an incident commander working at a Part 139 airport lacks the training that his subordinates have received but is tasked with making critical decisions and directing the actions of firefighters who are fully ARFF trained. This would be of particular concern at smaller airports where it is less likely for additional trained command staff to be present. The FAA requires specialized training for ARFF personnel because burning airplanes present unique challenges for firefighters, including an oddly shaped structure, difficult entry locations, and large amounts of fuel. In addition, the unique capabilities of the firefighting equipment and vehicles (such as the HRET) would be poorly understood by nonARFF-trained

108 The battalion fire chief arrived on the scene after the last passenger was extricated from the rear of the airplane and was likely not aware when the extrications had been completed.

NTSB Aircraft Accident Report 123 personnel. The NTSB is concerned that the FAA does not require even a minimum level of ARFF training for command officers working at a certificated airport. Therefore, the NTSB recommends that the FAA work with the ARFF Working Group to develop and distribute policy guidance and training materials to ensure that all airport and mutual aid firefighting officers placed in command at the scene of an aircraft accident have at least a minimum level of ARFF training. Further, the NTSB recommends that the ARFF Working Group develop and distribute, in conjunction with the FAA, guidance and training materials to ensure that all airport and mutual aid firefighting officers placed in command at the scene of an aircraft accident have at least a minimum level of ARFF training. While the FAA does not currently require a specific ARFF staffing level, 14 CFR 139.319(i)(6) states that sufficient rescue and firefighting personnel must be available during air carrier operations to “operate the vehicles, meet the response times, and meet the minimum agent discharge rates.” As an Index E airport, SFO was required by 14 CFR 139.317 to have three ARFF vehicles in order to meet its response time/agent requirements; therefore, the airport had a de facto minimum staffing of three trained firefighters in order to drive those vehicles. As stated earlier, SFO was staffed with 23 ARFF personnel on the day of the accident. The NTSB asked the FAA for a legal interpretation of 14 CFR 139.319(i)(6) to clarify exactly which on-airport ARFF personnel are required to be trained and when the required training must be received. The FAA responded that “all personnel assigned to rescue and firefighting duties must meet the initial and recurrent training and live-fire drill requirements, even if an airport assigns personnel to those duties above those minimally required to comply with 14 CFR 139.319(i)(6).” The FAA interpretation further stated that such responders must be fully trained before they perform ARFF duties and that untrained personnel would not be permitted to operate the airport’s firefighting equipment. This interpretation represents a significant change from the way inspectors from the FAA’s Office of Airport Certification and Safety have historically enforced these regulations. In the past, ARFF departments at Part 139 airports were considered in compliance with regulations when their de facto FAA minimum staffing level personnel were fully trained. Therefore, the NTSB recommends that the FAA issue a CertAlert109 to all Part 139 airports to distribute the information contained in the FAA’s legal interpretation of 14 CFR 139.319 that requires all personnel assigned to ARFF duties to meet the initial and recurrent training and live-fire drill requirements and clarify how the FAA will enforce this regulation. 2.8.3.5 Communication Numerous problems with radio communication during the emergency response were reported, the most critical of which was the inability of responding mutual aid units to speak directly with units from the airport on a common frequency. In addition, multiple firefighters reported significant problems reaching command staff and receiving additional assistance when

109 According to the FAA, CertAlerts provide the FAA’s Airport Safety and Operations Division a quick way of providing additional guidance on Part 139 airport certification and related issues to airport management, ARFF personnel, and FAA inspectors.

NTSB Aircraft Accident Report 124 requested. ASOs and SFPD personnel also expressed concern over the inability to communicate with one another on scene, and communication difficulties were reported by medical personnel. In all, at least 10 interviewed emergency responders described significant problems with the ability of individuals and agencies to communicate with one another during the event. Also, while en route to SFO, the eventual incident commander was given erroneous information about a lack of fire at the accident site, likely due to a lack of communication between the airport and city dispatch centers. To make proper decisions about the scale of a response, an incident commander must be provided timely, accurate information as quickly as possible. It was clear from the incident commander’s comments that he lacked the information required to make necessary decisions. These decisions were ultimately delayed until he reached the airport, when he first called a yellow then eventually a red alert. If made earlier, these alerts would have greatly expanded the size of the response and provided earlier notifications to hospitals that injured occupants would be arriving. Video footage indicates that the incident commander’s vehicle arrived at the scene at 1151:30, indicating a likely 15- to 20-minute delay in expanding the response based on a lack of specific information about the accident. Although it is not possible to determine exactly what, if any, impact this delay had in the emergency response to this accident, the breakdown in communications between the airport and city dispatch centers resulted in a delay in the incident commander receiving information needed to most effectively respond to the accident. Communication problems at the scene of a mass casualty event are common and, in fact, should be anticipated and planned for. That is one of the main purposes of the annual disaster drills and monthly RedCap drills conducted at SFO. While SFO did include mutual aid in at least some of its planning drills, the NTSB is nonetheless concerned that the problems discussed above were not identified and addressed before the accident. It is possible that the disaster drills at SFO were either not sufficiently realistic or did not include postdrill debriefs detailed enough to adequately identify the communications problems that occurred during the emergency response to the accident. Before the accident, the airport had taken steps to address some of the communication issues identified in this accident. For example, in 2012, SFO replaced its radio system in an attempt to improve communications with surrounding mutual aid resources through the establishment of a common interagency frequency. However, that frequency did not perform as intended in this accident because mutual aid responders had not yet installed the required equipment. Additionally, interviews conducted during the investigation suggest larger communications issues at the airport. For example, members of the command staff did not seem to recognize the problems that occurred under their command. Neither the incident commander nor the fire attack supervisor reported any problems with communications after arriving on scene, and the fire attack supervisor stated that relying on face-to-face communications was adequate. After the accident, SFO contracted with ICF International, a technology, policy, and management consulting company, to examine the airport’s response to the accident on multiple levels. In the area of communications, the company made numerous observations and

NTSB Aircraft Accident Report 125 recommendations including that the airport acquire new, more robust, communications alerting equipment; improve personnel training; and develop a communication plan annex to the emergency procedures manual. SFO has already begun addressing these recommendations. Notably, airport officials informed NTSB investigators that the common interagency frequency is now operational at the airport, allowing mutual aid units to speak directly with SFFD-AB personnel. The NTSB believes that had the recommended changes been made before the accident, the communications difficulties encountered would have been greatly alleviated. The NTSB concludes that although some of the communications difficulties encountered during the emergency response, including the lack of radio interoperability, have been remedied, others, such as the breakdown in communications between the airport and city dispatch centers, should be addressed. Therefore, the NTSB recommends that the City of San Francisco implement solutions to the communications deficiencies identified in ICF International’s after-action report as soon as practicable. 2.8.3.6 Airport Emergency Procedures Manual Title 14 CFR Part 139.325 requires that each certificated airport develop and maintain an airport emergency plan designed to minimize the possibility and extent of personal injury and property damage on the airport in an emergency. The NTSB noted during the investigation that although SFO had submitted, and the FAA had approved in December 2012, an updated emergency procedures manual, the airport had not yet distributed or trained personnel on the updated manual and was still actively operating with the manual approved by the FAA in December 2008. Although there were no significant changes to the Alert 3 section of the manual in the 2012 revision, this finding warrants increased oversight by the FAA. When considered with other findings in the report regarding the medical response, disaster drills, and communications, the NTSB concludes that the Alert 3 sections of SFO’s 2008 and 2012 emergency procedures manuals were not sufficiently robust to anticipate and prevent the problems that occurred in the accident response. As SFO moves forward with implementing changes from the lessons learned in the accident, the NTSB believes that it is critical for the FAA to proactively engage with the airport. Therefore, the NTSB recommends that the FAA conduct a special inspection of SFO’s emergency procedures manual and work closely with the airport to ensure that the airport meets its obligations under Part 139.325.

NTSB Aircraft Accident Report 126

1. Conclusions
2. 1 Findings
3. The following were not factors in the accident: flight crew certification and qualification;

flight crew behavioral or medical conditions or the use of alcohol or drugs; airplane certification and maintenance; preimpact structural, engine, or system failures; or the air traffic controllers’ handling of the flight.

Although the instrument landing system glideslope was out of service, the lack of a glideslope should not have precluded the pilots’ successful completion of a visual approach.

The flight crew mismanaged the airplane’s vertical profile during the initial approach, which resulted in the airplane being well above the desired glidepath when it reached the 5 nautical mile point, and this increased the difficulty of achieving a stabilized approach.

The flight crew’s mismanagement of the airplane’s vertical profile during the initial approach led to a period of increased workload that reduced the pilot monitoring’s awareness of the pilot flying’s actions around the time of the unintended deactivation of automatic airspeed control.

About 200 ft, one or more flight crewmembers became aware of the low airspeed and low path conditions, but the flight crew did not initiate a go-around until the airplane was below 100 ft, at which point the airplane did not have the performance capability to accomplish a go-around.

The flight crew was experiencing fatigue, which likely degraded their performance during the approach.

Nonstandard communication and coordination between the pilot flying and the pilot monitoring when making selections on the mode control panel to control the autopilot flight director system (AFDS) and autothrottle (A/T) likely resulted, at least in part, from role confusion and subsequently degraded their awareness of the AFDS and A/T modes.

Insufficient flight crew monitoring of airspeed indications during the approach likely resulted from expectancy, increased workload, fatigue, and automation reliance.

The delayed initiation of a go-around by the pilot flying and the pilot monitoring after they became aware of the airplane’s low path and airspeed likely resulted from a combination of surprise, nonstandard communication, and role confusion.

NTSB Aircraft Accident Report 127

1. As a result of complexities in the 777 automatic flight control system and inadequacies in

related training and documentation, the pilot flying had an inaccurate understanding of how the autopilot flight director system and autothrottle interacted to control airspeed, which led to his inadvertent deactivation of automatic airspeed control.

If the autothrottle automatic engagement function (“wakeup”), or a system with similar functionality, had been available during the final approach, it would likely have activated and increased power about 20 seconds before impact, which may have prevented the accident.

A review of the design of the 777 automatic flight control system, with special attention given to the issues identified in this accident investigation and the issues identified by the Federal Aviation Administration and European Aviation Safety Agency during the 787 certification program, could yield insights about how to improve the intuitiveness of the 777 and 787 flight crew interfaces as well as those incorporated into future designs.

If the pilot monitoring had supervised a trainee pilot in operational service during his instructor training, he would likely have been better prepared to promptly intervene when needed to ensure effective management of the airplane’s flightpath.

If Asiana Airlines had not allowed an informal practice of keeping the pilot monitoring’s (PM) flight director (F/D) on during a visual approach, the PM would likely have switched off both F/Ds, which would have corrected the unintended deactivation of automatic airspeed control.

By encouraging flight crews to manually fly the airplane before the last 1,000 ft of the approach, Asiana Airlines would improve its pilots’ abilities to cope with maneuvering changes commonly experienced at major airports and would allow them to be more proficient in establishing stabilized approaches under demanding conditions; in this accident, the pilot flying may have better used pitch trim, recognized that the airspeed was decaying, and taken the appropriate corrective action of adding power.

A context-dependent low energy alert would help pilots successfully recover from unexpected low energy situations like the situation encountered by the accident pilots.

The flight attendants acted appropriately when they initiated an emergency evacuation upon determining there was a fire outside door 2R. Further, the delay of about 90 seconds in initiating an evacuation was likely due partly to the pilot monitoring’s command not to begin an immediate evacuation, as well as disorientation and confusion.

Passengers 41B and 41E were unrestrained for landing and ejected through the ruptured tail of the airplane at different times during the impact sequence. It is likely that these passengers would have remained in the cabin and survived if they had been wearing their seatbelts.

NTSB Aircraft Accident Report 128

1. Passenger 42A was likely restrained for landing, and the severity of her injuries was

likely due to being struck by door 4L when it separated during the airplane’s final impact.

The dynamics of the impact sequence in this accident were such that occupants were thrown forward and experienced a significant lateral force to the left, which resulted in serious passenger injuries that included numerous left-sided rib fractures and one left-sided head injury.

The reasons for the high number of serious injuries to the high thoracic spine in this accident are poorly understood.

The release and inflation of the 1R and 2R slide/rafts inside the airplane cabin was a result of the catastrophic nature of the crash, which produced loads far exceeding design certification limits.

Clearer guidance is needed to resolve the concern among airport fire departments and individual firefighters that the potential risk of injuring airplane occupants while piercing aircraft structure with a skin-penetrating nozzle outweighs the potential benefit of an early and aggressive interior attack using this tool.

Medical buses were not effectively integrated into San Francisco International Airport’s monthly preparation drills, which played a part in their lack of use in the initial response to the accident and delayed the arrival of backboards to treat seriously injured passengers.

Guidance on task prioritization for responding aircraft rescue and firefighting personnel that addresses the presence of seriously injured or deceased persons in the immediate vicinity of an accident airplane is needed to minimize the risk of these persons being struck or rolled over by vehicles during emergency response operations.

The overall triage process in this mass casualty incident was effective with the exception of the failure of responders to verify their visual assessments of the condition of passenger 41E.

The San Francisco Fire Department’s aircraft rescue and firefighting staffing level was instrumental in the department’s ability to conduct a successful interior fire attack and successfully rescue five passengers who were unable to self-evacuate amid rapidly deteriorating cabin conditions.

Although no additional injuries or loss of life were attributed to the fire attack supervisor’s lack of aircraft rescue and firefighting (ARFF) knowledge and training, the decisions and assumptions he made demonstrate the potential strategic and tactical challenges associated with having nonARFF-trained personnel in positions of command at an airplane accident.

NTSB Aircraft Accident Report 129

1. Although some of the communications difficulties encountered during the emergency

response, including the lack of radio interoperability, have been remedied, others, such as the breakdown in communications between the airport and city dispatch centers, should be addressed.

• The Alert 3 sections of San Francisco International Airport’s 2008 and 2012 emergency

procedures manuals were not sufficiently robust to anticipate and prevent the problems that occurred in the accident response. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s mismanagement of the airplane’s descent during the visual approach, the pilot flying’s unintended deactivation of automatic airspeed control, the flight crew’s inadequate monitoring of airspeed, and the flight crew’s delayed execution of a go-around after they became aware that the airplane was below acceptable glidepath and airspeed tolerances. Contributing to the accident were (1) the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing’s documentation and Asiana’s pilot training, which increased the likelihood of mode error; (2) the flight crew’s nonstandard communication and coordination regarding the use of the autothrottle and autopilot flight director systems; (3) the pilot flying’s inadequate training on the planning and executing of visual approaches; (4) the pilot monitoring/instructor pilot’s inadequate supervision of the pilot flying; and (5) flight crew fatigue, which likely degraded their performance. NTSB Aircraft Accident Report 130

1. Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Aviation Administration: Require Boeing to develop enhanced 777 training that will improve flight crew understanding of autothrottle modes and automatic activation system logic through improved documentation, courseware, and instructor training. (A-14-37)

Once the enhanced Boeing 777 training has been developed, as requested in Safety Recommendation A-14-37, require operators and training providers to provide this training to 777 pilots. (A-14-38)

Require Boeing to revise its 777 Flight Crew Training Manual stall protection demonstration to include an explanation and demonstration of the circumstances in which the autothrottle does not provide low speed protection. (A-14-39)

Once the revision to the Boeing 777 Flight Crew Training Manual has been completed, as requested in Safety Recommendation A-14-39, require operators and training providers to incorporate the revised stall protection demonstration in their training. (A-14-40)

Convene an expert panel (including members with expertise in human factors, training, and flight operations) to evaluate methods for training flight crews to understand the functionality of automated systems for flightpath management, identify the most effective training methods, and revise training guidance for operators in this area. (A-14-41)

Convene a special certification design review of how the Boeing 777 automatic flight control system controls airspeed and use the results of that evaluation to develop guidance that will help manufacturers improve the intuitiveness of existing and future interfaces between flight crews and autoflight systems. (A-14-42)

Task a panel of human factors, aviation operations, and aircraft design specialists, such as the Avionics Systems Harmonization Working Group, to develop design requirements for context-dependent low energy alerting systems for airplanes engaged in commercial operations. (A-14-43)

Conduct research that examines the injury potential to occupants in accidents with significant lateral forces, and if the research deems it necessary, implement regulations to mitigate the hazards identified. (A-14-44)

NTSB Aircraft Accident Report 131

Conduct research to identify the mechanism that produces high thoracic spinal injuries in commercial aviation accidents, and if the research deems it necessary, implement regulations to mitigate the hazards identified. (A-14-45)

Analyze, in conjunction with slide/raft manufacturers, the information obtained in this accident investigation and evaluate the adequacy of slide and slide/raft certification standards and test methods specified in Federal Aviation Administration regulations and guidance materials. If appropriate, modify certification standards and test methods for future slide and slide/raft design based on the results of this evaluation. (A-14-46)

Work with the Aircraft Rescue and Firefighting Working Group and equipment manufacturers to develop and distribute more specific policies and guidance about when, how, and where to use the high-reach extendable turret’s unique capabilities. (A-14-47)

Once the minimum staffing level has been developed by the Aircraft Rescue and Firefighting (ARFF) Working Group, as requested in Safety Recommendation A-14-60, amend 14 Code of Federal Regulations 139.319(j) to require a minimum ARFF staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. (A-14-48)

Work with the Aircraft Rescue and Firefighting (ARFF) Working Group to develop and distribute policy guidance and training materials to ensure that all airport and mutual aid firefighting officers placed in command at the scene of an aircraft accident have at least a minimum level of ARFF training. (A-14-49)

Issue a CertAlert to all Part 139 airports to distribute the information contained in the Federal Aviation Administration’s (FAA) legal interpretation of 14 Code of Federal Regulations 139.319 that requires all personnel assigned to aircraft rescue and firefighting duties to meet the initial and recurrent training and live-fire drill requirements and clarify how the FAA will enforce this regulation. (A-14-50)

Conduct a special inspection of San Francisco International Airport’s emergency procedures manual and work closely with the airport to ensure that the airport meets its obligations under Part 139.325. (A-14-51) To Asiana Airlines: Reinforce, through your pilot training programs, flight crew adherence to standard operating procedures involving making inputs to the operation of autoflight system controls on the Boeing 777 mode control panel and the performance of related callouts. (A-14-52)

NTSB Aircraft Accident Report 132 Revise your flight instructor operating experience (OE) qualification criteria to ensure that all instructor candidates are supervised and observed by a more experienced instructor during OE or line training until the new instructor demonstrates proficiency in the instructor role. (A-14-53)

Issue guidance in the Boeing 777 Pilot Operating Manual that after disconnecting the autopilot on a visual approach, if flight director guidance is not being followed, both flight director switches should be turned off. (A-14-54)

Modify your automation policy to provide for more manual flight, both in training and in line operations, to improve pilot proficiency. (A-14-55) To Boeing: Revise the Boeing 777 Flight Crew Operating Manual to include a specific statement that when the autopilot is off and both flight director switches are turned off, the autothrottle mode goes to speed (SPD) mode and maintains the mode control panel-selected speed. (A-14-56)

Using the guidance developed by the low energy alerting system panel created in accordance with Safety Recommendation A-14-43, develop and evaluate a modification to Boeing wide-body automatic flight control systems to help ensure that the aircraft energy state remains at or above the minimum desired energy condition during any portion of the flight. (A-14-57) To the Aircraft Rescue and Firefighting Working Group: Work with the Federal Aviation Administration and equipment manufacturers to develop and distribute more specific policies and guidance about when, how, and where to use the high-reach extendable turret’s unique capabilities. (A-14-58)

Work with medical and medicolegal professional organizations to develop and distribute guidance on task prioritization for responding aircraft rescue and firefighting (ARFF) personnel that includes recommended best practices to avoid striking or rolling over seriously injured or deceased persons with ARFF vehicles in a mass casualty situation. (A-14-59)

Develop a minimum aircraft rescue and firefighting staffing level that would allow exterior firefighting and rapid entry into an airplane to perform interior firefighting and rescue of passengers and crewmembers. (A-14-60)

Develop and distribute, in conjunction with the Federal Aviation Administration, guidance and training materials to ensure that all airport and mutual aid firefighting officers placed in command at the scene of an aircraft accident have at least a minimum level of aircraft rescue and firefighting training. (A-14-61)

NTSB Aircraft Accident Report 133 To the City and County of San Francisco: Routinely integrate the use of all San Francisco Fire Department medical and firefighting vehicles in future disaster drills and preparatory exercises. (A-14-62)

Implement solutions to the communications deficiencies identified in ICF International’s after-action report as soon as practicable. (A-14-63)

Acting Chairman Hart and Members Sumwalt, Rosekind, and Weener filed the following statements. BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Acting Chairman Member

MARK R. ROSEKIND

Member

EARL F. WEENER

Member Adopted: June 24, 2014

NTSB Aircraft Accident Report 134 Board Member Statements Acting Chairman Christopher A. Hart filed the following concurring statement on July 3, 2014. It is a tribute to the safety robustness of the commercial aviation system that just one breached safety defense rarely causes injury or damage. This accident, however, was caused by an unfortunate combination of several safety weaknesses, each of which, by itself, is usually innocuous. Of the many safety issues addressed in this report, I would like to touch briefly on three: pilot training, instructor training, and approval of the automation logic. Pilot Training. It is troubling that, despite having nearly 10,000 hours of flying time, much of which was in airliners, the pilot was uneasy about conducting a visual approach into SFO without an ILS glideslope. Granted, his unease may have resulted in part from the fact that he had less than 40 hours in the airplane (as opposed to the simulator), and he had never done a visual approach in the airplane without a glideslope. Given his unblemished record, however, my concern is the extent to which his unease was a reflection of his training and experience with Asiana—in particular, the training and experience that was based upon a strong preference by Asiana for its pilots to use automation as much as possible. Although automation has a long history of improving safety and efficiency, too much reliance on automation can have unintended consequences. One unintended consequence is that it caused this highly experienced pilot with an unblemished record to be uncomfortable about manually accomplishing a very basic task—landing on an 11,000 ft runway on a clear day with very little wind. Hence, we issued our recommendation to Asiana about encouraging more manual flying, both in training and in line operations. Instructor Training. Although the instructor pilot had more than 12,000 hours, including more than 3,200 hours in the Boeing 777, the accident flight was his first flight as an instructor pilot. With more experience as an instructor pilot, he might have been more attentive to the indications that the pilot was “behind” the airplane, and he might have been more alert to the need to give additional guidance to the pilot, as well as the potential need to take control of the airplane. Those indications became apparent at least 15 miles out on the approach when the airplane first intercepted the localizer, and they were high and fast but the pilot failed to begin immediate corrections. The indications became more serious as they continued the approach and the pilot still had not remedied the exceedances. When the pilot failed to follow Asiana’s approach guidelines, e.g., rate of descent not to exceed 1,000 ft per minute below 1,000 ft, and mandatory go-around if the approach was not stable by the time the airplane has descended to 500 ft, the instructor should have either commanded a go-around or done it himself. Ideally, the pilot should have let the instructor know about his unease regarding the approach, but he did not; better training of the instructor, such as training with an instructor-observer to observe and counsel the instructor, may have enhanced the instructor’s ability to recognize the pilot’s unease even without the pilot admitting it. Hence, we issued our

NTSB Aircraft Accident Report 135 recommendation to Asiana, to revise their flight instructor operating experience qualification criteria so that instructor candidates are supervised and observed during line training. I hope that other airlines that do not supervise and observe their instructor candidates during line training will take a lesson from this accident and revise their instructor qualification criteria accordingly. FAA Approval of Automation Logic. The report notes that a 1996 flight test certification report for the Boeing 777 stated that “Per design, when the autopilot is controlling airspeed, the autothrottle automatic engage [“wake-up”] feature is disabled.” In 2010, as a result of the flight test certification program for the Boeing 787 (which, according to Boeing, has the same autothrottle “wake-up” feature as the Boeing 777), the primary project pilot, who had about 1,000 hours in Boeing airplanes, including about 500 hours in the Boeing 777, noted that the autothrottle did not function as he expected, and he referred to the failure of the autothrottle to “wake up” under certain circumstances as “less than desirable.” Consequently, the FAA required Boeing to add an explanation about the “wake-up” mode in the Boeing 787 AFM. Notably, no such language was required for the Boeing 777 AFM, even though the Boeing 777 “wake-up” feature behaved the same as in the Boeing 787. EASA also noted problems about the Boeing 787 autothrottle and wrote a “Major Recommendation for Improvement #3” in 2011, noting that the behavior of the system could “look from a pilot’s perspective as an inconsistency in the automation behavior of the airplane,” and further stating that “the manufacturer would enhance the safety of the product by avoiding [this behavior] in the ‘Autothrottle wake up’ mode condition.” In other words, fixing the problem is a much better remedy than warning about the problem, and what was needed was improved automation logic, not just additional language in the AFM. Hence, we issued our recommendation to the FAA to convene a special certification design review of how the Boeing 777 automatic flight control system controls airspeed. Inasmuch as this was the first fatal Boeing 777 accident since it was introduced into commercial service nearly two decades ago, we recognize that the autothrottle “wake-up” behavior has not previously led to any accidents or incidents in many millions of flights. Hence, borrowing language from a proposed recommendation that was not adopted by the Board, I trust that the FAA will begin the special certification design review by looking at the extensive existing databases in search of situations in which flight crews of Boeing wide-body aircraft (which share the same autothrottle “wake-up” feature) were uncertain or confused about whether the automatic flight control system was controlling airspeed, particularly during approach. The fact that this confusion about the autothrottle happened in this accident means that it could happen again, albeit probably very rarely; the more that is known and understood about the history of this problem, the greater the likelihood that an appropriate remedy can be developed that is unlikely to create unintended consequences. Perhaps the ultimate irony of this tragic accident is that if the airplane had encountered low ceiling and visibility conditions upon arriving at SFO, the approach would probably have been largely or fully automatic and would probably have been conducted without incident. Members Sumwalt and Rosekind joined in this statement.

NTSB Aircraft Accident Report 136 Member Robert L. Sumwalt filed the following concurring (in part) and dissenting (in part) statement on July 1, 2014. In the months after this accident, many have asked, “How could an airline crew crash an airplane on a perfectly clear day with calm winds on a visual approach?”

There was uninformed conjecture that placed the crew’s competency in question. As I stated in the board meeting, this accident is not one about crew competency. After all, the pilot flying had nearly 10,000 flight hours and had been a captain and instructor on the Airbus A320. The instructor pilot had 12,000 flight hours, including over 3,000 in the Boeing 777, and was selected from many to join the elite instructor corps of Asiana. Pilots simply don’t make it this far in their careers if they lack competency.

Contrary to what some may believe, this accident is not just another “pilot error” accident. Like most accidents, the causation of this accident is complex and involves the interaction of several elements of the system. It involves a set of circumstances that came together on this day to produce a tragic outcome.

I believe setting the stage for the crash was expectancy; the pilot flying expected the airplane to do something that it wasn’t designed to do. Specifically, he expected the autothrottle system to provide speed control for him, but unbeknownst to him, the system would not do so while in a HOLD mode.

This pilot was not the only one who didn’t understand this nuance of the automation, and I am convinced that misunderstandings of this system are actually fairly common. For example, somewhere during the pilot flying’s ground school training, a ground instructor supposedly mentioned to him—perhaps in passing—that on three occasions, he had experienced a similar situation where the autothrottle system did not maintain speed. To show that the ground instructor himself did not understand this situation, he described it as an “anomaly.” However, it’s not an “anomaly” at all—it’s the way the system was designed. This represents data point number one in a wider misunderstanding of the system logic.

Data point number two comes in the form of an FAA test pilot. In 2010, this pilot was flying a Boeing 787 on a test flight when he was alarmed to see that the autothrottle did not maintain speed while in FLCH and HOLD. The autothrottle logic on the 787 is essentially the same as the 777, and this pilot had 500 hours in the 777. Why would an experienced FAA test pilot not understand this system logic if it was that clear? He raised his concern throughout the FAA certification chain. Officials with EASA also became concerned. As a result, Boeing added additional and clearer guidance in the Boeing 787 manuals regarding this system logic. But for the Boeing 777—an airplane with the same basic system—nothing was done.

Data points three and onward are less well documented but are no less relevant or important. Before the Board meeting, I asked the head of 777 training for a very large airline how well this autothrottle “failure to wake-up while in HOLD mode” was understood prior to this accident. His answer: not well understood at all.

NTSB Aircraft Accident Report 137 After the Board meeting, I learned from credible sources that other airlines have noted similar problems. One airline estimated from its data sources that three times a day, pilots at that particular airline experienced the situation faced by the Asiana pilots: pilots expect the autothrottle to provide speed control, but because the system is in HOLD, that protection is not available. Another airline source noted that their Flight Operation Quality Assurance data showed seven such occurrences, including one in which speed decreased 19 knots below Vref before the pilots detected and corrected the situation. Another source stated, “It is true that the HOLD mode is poorly understood by the industry, and absolutely this accident could have happened in any airline.”

In spite of the number of anecdotal reports of this misunderstanding of the autothrottle HOLD mode, I am left wondering why the issue was not more widely reported through various data sources. As a former airline pilot myself, I can understand why pilots don’t report when automation doesn’t act the way they believe it should; after all, having automation do something unexpected, or not do something that was expected, is not terribly uncommon. If they did report it, a technician would likely test it and report “ops checks normal.” That may explain why there is little information through self-reporting systems such as Aviation Safety Action Systems or the National Aeronautics and Space Administration’s Aviation Safety Reporting System (ASRS).

Perhaps the key to learning of more incidents involving the 777 autothrottle HOLD mode could come from FOQA programs and from the Aviation Safety Information Analysis & Sharing (ASIAS) program. Regrettably, the NTSB’s Memorandum of Understanding (MOU) with ASIAS does not allow for querying ASIAS for a non-US air carrier accident.

In the absence of an MOU allowing the NTSB to learn more about the nature of the FLCH HOLD issue, through this statement, I urge the ASIAS Executive Board to search the ASIAS database to look for similar problems. Because some believe that the situation encountered by the crew of Asiana flight 214 was a “one off” event, I urge findings of this ASIAS study to be shared with the NTSB upon completion.

The NTSB Board members unanimously determined that “the complexities of the autothrottle and autopilot flight director systems that were inadequately described in Boeing’s documentation and Asiana’s pilot training, which increased the likelihood of mode error.” This concurring and dissenting statement enumerates some of those complexities and inadequacies.

As it relates to training, the Boeing 777 Flight Crew Training Manual contained a section titled “stall demonstration,” which outlined three scenarios. Each was designed to showcase features of the 777 that were intended to protect the aircraft in case, for whatever reason, airspeed becomes too slow. One scenario, for example, demonstrated that if the autopilot is on and airspeed gets too slow, the autopilot’s altitude hold mode will disengage and allow the aircraft to pitch over to regain speed. Another scenario demonstrated that if the autothrottles were disconnected, if speed gets too slow, the autothrottles will reactivate (“wake up”) and increase speed. While these demonstrations showed how and when the airplane will protect against critically slow speed, they did not demonstrate when the airplane would not intervene when speed got too slow—precisely the situation experienced by the crew of Asiana flight 214.

NTSB Aircraft Accident Report 138 What these demonstrations did, as indicated by the pilot flying’s postaccident interview statements, was instill in him a dangerously false belief that no matter what, the airplane would protect against a slow speed situation. The pilot flying told investigators that he was “astonished” that the airplane would do these things to keep him from stalling. I believe this may somewhat explain (but not excuse) why the pilot flying subconsciously relaxed his scan of the airspeed indicator.

From a design perspective, let me first applaud the designers of the 777 for creating an airplane that, indeed, has many safety features to protect against human error. That said, I believe from a pilot’s perspective there is something unintuitive about the speed protection logic: when the autothrottles are disconnected, they will wake up when speed gets slow; however, when they are in their normal operating mode in HOLD, the throttles will not wake up to protect speed.

The investigation found that if the autothrottle automatic engagement function (wake-up), or a system with similar functionality, had been available, it would likely have activated and increased power about 20 seconds before impact, which may have prevented the accident.

In spite of the unintuitive design feature from a pilot’s perspective, and in spite of the determination that an autothrottle wake up feature would probably have prevented the crash, the majority of the Board voted (3 to 1) against a recommendation proposed by staff and supported vigorously by me to require Boeing to redesign the system.

The gavel had barely dropped to end the Board meeting when Boeing issued a statement saying that it “respectfully disagrees with the NTSB's statement that the 777’s auto-flight system contributed to this accident, a finding that [Boeing does] not believe is supported by the evidence.” Denial is the enemy of change. Such statements are perhaps issued by public relations personnel intent on protecting their brand, or perhaps posturing against potential litigation. However, for those who are truly interested in making a safe aircraft even safer, my hope is that they will internalize the safety lessons from this report and make the necessary changes through a more error tolerant design.

In making safety improvements, the well-known system safety order of precedence should be followed: the largest potential for safety improvements comes from design and engineering enhancements, while the lowest form of safety improvement comes from training and procedures.110 Therefore, I hope changes will be made to the aircraft design and not just words added to a manual (although deficiencies in the manuals were certainly noted in this investigation, and wording should be clarified.)

The above remarks are an attempt to explain how the pilot flying may have relied on the aircraft to maintain a safe airspeed. Despite his reliance on the automated system, there is no doubt that he should have monitored airspeed. The investigation found that the pilot flying didn’t monitor for 24 seconds, and the instructor pilot didn’t monitor for 17 seconds. These were critical errors that were causal to the crash.

110 For example, see US Department of Defense, Standard Practice for System Safety, MIL-STD-882E, Section 4.3.4 (a) - (e); US Air Force System Safety Handbook, Section 3.3; and, FAA System Safety Handbook, Section 3.6.

NTSB Aircraft Accident Report 139 At NTSB’s December 2013 public hearing for this accident, a Boeing engineer testified: “So, when we design the airplane, we assume that aircrews are very good at monitoring when it’s a critical phase of flight…”. This is an assumption that is unsupported by data from accidents, incidents, normal flight operations, and considerable literature and research.

In preparation for this Board meeting, I reviewed 25 accidents—mostly air carrier accidents— in which poor monitoring of the flight path was cited in the accident’s causation. Of the 25 accidents reviewed, 17 (including this one) occurred on approach. Of those, six were the result of allowing speed to decrease to unacceptably slow values.

I also reviewed over 100 reports submitted to NASA ASRS—reports where pilots didn’t adequately monitor flightpath. Twenty percent of these reports involved cases where pilots didn’t sufficiently monitor during the approach.

Line Operations Safety Audit data from over 14,000 observed line operations flights show that between 15 to 20% of flights have poor monitoring/cross-checking performance in at least one phase of flight.

Research studies on pilot monitoring behavior are plentiful, but perhaps one of the most telling research studies was completed in 2000, where the principal researcher was a Boeing flight deck human factors engineer.111 That study involved observing crews flying full mission simulated flights in a Boeing 747-400 simulator, an aircraft that has flight deck displays and automation similar to the 777. That research revealed that pilots in the study did not often notice autoflight mode changes. The researchers attributed this to pilots failing to monitor and to pilots lacking an understanding of what the automation should be doing.

In short, to assume that pilots are very good at monitoring in a critical phase of flight is, unfortunately, an assumption that is unsupported by data. Instead, it would seem better to assume that pilots will, somewhere during the lifecycle of an aircraft, be ineffective at monitoring important flight path parameters and miss something critical, as did the Asiana flight 214 crew. Through such an assumption, the manufacturer would create additional layers of defense to trap those errors before consequential results occur. One such important layer of defense would be a design change so that autothrottles would wake up and prevent critically low airspeeds, even when the system is in a HOLD mode. I am disappointed that my colleagues did not join me in supporting a recommendation for such a change.

In my opinion, this accident was a systems accident. Yes, the pilots made grave errors in planning and executing the approach, and failed to monitor. However, I believe the pilot flying’s failure to monitor may have been precipitated by the false belief that the 777’s automation would provide speed control—a perilous error. As the report points out, insufficient flight crew monitoring of airspeed during the approach resulted, in part, from expectancy, increased workload, and automation overreliance.

111 Mumaw, R., N. Sarter, C. Wickens, S. Kimball, M. Nikolic, R. Marsh, W. Xu, and W. Xu. (2000). Analysis of Pilots’ Monitoring and Performance on Highly Automated Flight Decks. (NASA Ames Contract NAS2-99074). Mountain View, CA: NASA Ames Research Center.

NTSB Aircraft Accident Report 140 I’ve often said that as tragic as a transportation accident is, it is even more tragic to suffer the accident and not learn from it. I hope that lessons learned from this accident can be used to improve safety so that others don’t have to endure what the passengers, crew, and families of the victims have already endured.

NTSB Aircraft Accident Report 141 Member Mark R. Rosekind filed the following concurring statement on July 3, 2014.

Introduction On July 6, 2013, a Boeing 777 with Korean registration operating as Asiana Airlines flight 214 was on approach to San Francisco International Airport runway 28L when it struck a seawall. Three of the 307 people on board were fatally injured and 49 received serious injuries, though overall, 98% of those who flew Asiana flight 214 that day were able to self-evacuate successfully after the crash. Despite a catastrophic fire that destroyed the airplane, there was a 99% survival rate. This is extraordinary in modern aviation and reflects many years of advances across a spectrum of innovation that warrants further emphasis.

Safety While every airplane crash represents failure of some kind, there are significant success stories out of Asiana flight 214 amid the tragic loss of life and injuries suffered. This crash’s amazingly high survivability rate reflects years of safety progress in so many areas such as aircraft design and manufacturing, flight crew training, and emergency operations. The entire aviation industry played a role in safety that day, including progress that can be attributed to decades of NTSB research, analysis, investigations, and recommendations. Images of the broken, burned-out airplane fuselage underscore in graphic detail noteworthy advancements in safety engineering saving so many people in a crash that snapped off the Boeing 777’s tail and sent a 200-ton aircraft careening across the runway.

Survival The sheer number of survivors is astonishing to anyone who has seen the video of Asiana flight 214 showing the airplane’s violent contact with the seawall, its cartwheel along the runway, and the post-accident fire that consumed the fuselage. While the latest in aviation engineering has produced a resilient aircraft able to withstand significant impact forces, the number of deaths and injuries would have been significantly higher if seatbelts were not available and required. It is no coincidence that two of the three passenger fatalities sustained traumatic injuries as a result of unrestrained ejection from their seats while some of the adjacent passengers wearing seatbelts walked away from the crash.

The critical role of the emergency response personnel at San Francisco International Airport (SFO) and the firefighters from the San Francisco Fire Department cannot be underestimated. Although certain issues regarding communications, triage, and training became evident from the investigation and must be addressed, emergency responders were faced with the extremely rare situation of having to enter a burning airplane to perform rescue operations. Their quick and professional action in concert with a diligent flight crew evacuated the remaining passengers and prevented this catastrophe from becoming much worse. In addition, the emergency response infrastructure and resources at SFO that supported firefighting and recovery after the crash are admirable, significantly exceeding minimum requirements.

The evacuation of an airplane must happen immediately for the best chance to avoid death or injury by fire. A key safety element enabling sufficient time for survival is the development and use of flame-retardant materials for seating, insulation, flooring, and other

NTSB Aircraft Accident Report 142 interior components. Enormous strides have been made during the last decade regarding their flammability, propagation, heat release, and emissions in preventing an immediate outbreak of flames and allowing for a longer period to evacuate people and suppress postcrash fires.

Fatigue There were nearly a dozen fatigue-related cockpit crew errors throughout the approach, landing, and delayed go-around phases of Asiana flight 214, and these errors involved all three members of the cockpit crew over an extended period of time throughout the accident sequence. The degraded performance associated with sleep disruption and circadian rhythms is well established, with reduced vigilance and attention being classic decrements. Monitoring as expressed by the crew’s vigilance and attention would be affected by fatigue as would other basic elements of human performance such as memory, reaction time, and decision-making. The report establishes a solid foundation for fatigue’s effects on degraded performance, reduced vigilance, and decreased monitoring across a variety of functions that contributed to the crash.

This accident underscores the importance of acknowledging the distinction between the role of sleep and circadian rhythms, with emphasis on the circadian component and its inevitable biological nature. Sleep disruption was created through acute effects associated with this flight, while the circadian-related performance challenges were associated with operating during the hard-wired and physiologically programmed low-point of the circadian cycle.

Human Performance Over twenty incorrect actions and inactions leading up to the accident spell out a thorough, comprehensive story of the interrelated complexity of multiple events laying the foundation for the probable cause. Of particular importance is how the execution of divided tasks and an overreliance on automation produced a decrease in monitoring automated technology during the landing sequence. The investigation identified each of these human performance aspects and enables us to understand and differentiate these in detail. Delineating the differential effects of workload, expectancy, surprise, role confusion, mental models of aircraft systems, training, reduced monitoring, and fatigue as each relates to unintended actions or inaction throughout the accident sequence is critical to understanding the probable cause with emphasis on the classic human performance challenge related to the need for “human-centered” integration of automation design, operations, and training. Acting Chairman Hart and Member Weener joined in this statement.

NTSB Aircraft Accident Report 143 Member Earl F. Weener filed the following concurring (in part) and dissenting (in part) statement on July 3, 2014. The investigation of the Asiana Airlines flight 214 accident challenged the Board to reconcile a number of tangible facts with competing views on human performance. The final report, comprehensive in nature, and the probable cause statement reflect the outcome of this challenge. For the most part, as both an aerospace engineer and pilot, I concur with the final report and support the probable cause statement. However, in the pursuit of being comprehensive, I believe the report deemphasizes the significance of the crew’s performance as the cause of this accident. As well, I disagree the accident justifies recommendation number 6, a recommendation to the FAA to convene a special certification review (SCR) of the Boeing 777 automatic flight control system (AFCS), but reflects instead a misunderstanding on the Board’s part of the purpose and intent of the SCR process.

As stated in the probable cause statement, this accident was caused by the crew’s mismanagement of the airplane’s descent during the visual approach. In my view, this is the critical finding, and other articulated factors in the statement serve either as examples of mismanagement or as attempts to explain why it occurred. Fundamentally, though, this accident occurred due to crew mismanagement; efforts to deemphasize or excuse the crew’s substandard performance in operating the aircraft are not justified by the evidence adduced from the investigation.

The primary responsibility of a pilot (or a two or three pilot crew for that matter), as with other vehicular modes of transportation, is to safely operate the vessel, vehicle, or aircraft. Thus, a pilot bears the responsibility of thoroughly understanding the operation of the aircraft and systems he or she intends to operate. In this case, as the report details, both the pilot flying and the pilot monitoring/instructor pilot were seasoned pilots, both completed the requisite training to execute their responsibilities, and, I would argue, both fully understood their responsibilities as pilots, respectively. However, as the report also details, these pilots missed a number of cues and did not follow company standard operating procedures during the final descent. To characterize this accident as hinging on a single action taken by the pilot flying, such as the unintended deactivation of automatic airspeed control, is simply inaccurate and suggests a lack of understanding of the complexities involved in landing an aircraft. Further, to then suggest the complexity of an operating system excuses or exonerates a pilot from his responsibility to operate the aircraft safely, is incongruent—particularly when this safe operation occurs routinely, every day, using the same operating system logic on multiple models of aircraft all over the world, and has done so for over thirty years.

Undoubtedly, this pilot was confused or did not have a thorough understanding of the AFCS on the airplane, notwithstanding the training he received (including a briefing a few months prior to the accident where the autothrottle HOLD modes were specifically discussed). This is clear from the accident and from the evidence gathered during the investigation. Yet, the accident could have been averted had the crew—both the pilot flying and the pilot monitoring/instructor pilot—properly managed the descent profile from the outset, followed the company’s operating procedures with regard to callouts and stable approach criteria, monitored the airspeed, and paid attention to outside visual flight path cues. As well, the result likely would have been different had the pilot flying verbalized his concerns about executing the visual

NTSB Aircraft Accident Report 144 approach and alerted the pilot monitoring/instructor pilot and had the pilot monitoring/instructor pilot sufficiently executed his monitoring and instructing role. The fact is there were numerous opportunities during the descent to prevent this accident from occurring: the crew received multiple cues indicating corrections were necessary to achieve a stable flightpath, and there was sufficient time to execute the corrections during the initial approach. The report’s focus on and assertion that AFCS complexity is part of the primary cause of the accident mistakenly detracts from the weaknesses in crew performance. Automation technology is intended to aid flight crews in executing their responsibilities; it is not intended to replace a well-trained and proficient crew. When automation fails or does not react as expected, it remains incumbent upon the crew to be prepared and able to fulfill their responsibility of operating the aircraft safely.

I also disagree with the recommendation to the FAA requesting an SCR of the Boeing 777 AFCS. By design, SCRs are postcertification mechanisms for the FAA to evaluate a potentially unsafe design feature on a previously approved product and so are limited specifically to that product. Historically, the FAA has conducted SCRs on a limited basis and generally as a result of an accident or incident caused by a specific aircraft design feature.

Per the FAA’s guidance, an SCR may be initiated after certification requirements are met and the product receives approval or “as service experience dictates.” Certification requirements are intended to ensure a product under development will eventually show a satisfactory in-service accident risk. Over time, certification requirements incorporate accumulated knowledge, tested design concepts, and acceptable practices with historically demonstrated satisfactory accident risks. The degree of accident risk of a mature aircraft program is readily demonstrated by its in-service experience. Where in-service experience demonstrates unacceptable accident risk, it is appropriate to examine the certification requirements and processes. Simply put, the decision to undertake an SCR should be data driven.

In the case of the Boeing 777, as of this accident report, the Board has only a single data point concerning the AFCS. However, an examination of the in-service data of the AFCS accumulated over almost two decades would serve to show factually whether or not the system was responsible for unsatisfactory accident/incident performance. Further, because the AFCS is not unique to the 777 model, a more thoughtful approach to determining whether an issue exists would be to provide FAA flexibility to collect and evaluate data from other Boeing models with similar AFCS. As well, it would be prudent to provide FAA flexibility to address an issue, if so determined. Instead, recommendation number 6 limits the SCR solely to the 777 model. For these reasons, I proffered the following revision to the recommendation (although it did not receive the support of a majority of board members):

Conduct a review of available flight operations data, such as in the Aviation Safety Reporting System (ASRS), Aviation Safety Action Program (ASAP), and Flight Operation Quality Assurance (FOQA), to determine the circumstances of the situations in which flight crews of Boeing wide-body aircraft appeared to be uncertain or confused about whether the automatic flight control system was controlling airspeed, particularly during approach.

NTSB Aircraft Accident Report 145 The Board is charged with the responsibility of determining accident causes for the purpose of preventing their recurrence and enhancing transportation safety. In this case, the probable cause statement is well supported by the facts, although I believe it is sufficient to identify as the sole primary cause of this accident the crew’s mismanagement of the airplane’s descent. However, the Board’s recommendation to convene an SCR on the basis of a single event occurring in a fleet of aircraft in operation for more than 30 years, without assessing in- service data more broadly, is misguided. If the FAA pursues this recommendation based on one pilot’s confusion, we may miss a very real opportunity to enhance safety.

NTSB Aircraft Accident Report 146 References Billings, C.E. Aviation Automation: The Search for a Human-Centered Approach. Mahwah, NJ: Lawrence Erlbaum, 1999. Burin, J. “The Year in Review.” Paper presented at the Flight Safety Foundation’s 64th Annual International Air Safety Seminar. Singapore, 2011. Casner, S.M., R.W. Geven, and K.T. Williams. “The Effectiveness of Airline Pilot Training for Abnormal Events.” Human Factors, 2013: 477-485. FAA (Federal Aviation Administration). 2013. Final Report of the Performance-Based Operations Aviation Rulemaking Committee/Commercial Aviation Safety Team Flight Deck Automation Working Group. Washington, DC: Federal Aviation Administration. ——. 1996. The Human Factors Team Report on the Interfaces Between Flightcrews and Modern Flight Deck Systems. Washington, DC: Federal Aviation Administration. Goel, N., M. Basner, H. Rao, and D.F. Dinges. (2013). “Circadian Rhythms, Sleep Deprivation, and Human Performance.” Progress in Molecular Biology and Translational Science, Vol. 119 (2013): 155-190. Holder, B. “Airline Pilot Perceptions of Training Effectiveness.” Flight Deck Concept Center, Boeing Commercial Airplanes, 2012. ICAO. ICAO Document 9966, Fatigue Risk Management Systems - Manual for Regulators. Montreal, Quebec: ICAO, 2012. Nikolic, M.I. and N. B. Sarter. “Flight Deck Disturbance Management: A Simulator Study of Diagnosis and Recovery from Breakdowns in Pilot-Automation Coordination.” Human Factors 49, no. 4 (2007): 553-565. NTSB (National Transportation Safety Board). 2003. Loss of Control and Impact With Terrain, Aviation Charter, Inc., Raytheon (Beechcraft) King Air A100, N41BE, Eveleth, Minnesota, October 25, 2002. AAR-03/03. Washington, DC: NTSB. ——. 2010. Loss of Control on Approach, Colgan Air, Inc., Operating as Continental Connection Flight 3407, Bombardier DHC-8-400, N200WQ, Clarence Center, New York, February 12, 2009. AAR-10/01. Washington, DC: NTSB. Parasuraman, R. and D. H. Manzey. “Complacency and Bias in Human Use of Automation: An Attentional Integration.” Human Factors 52, no. 3 (2010): 381-410.

NTSB Aircraft Accident Report 147 Sarter, N.B. and D.D. Woods. “Team Play with a Powerful and Independent Agent: Operational Experiences and Automation Surprises on the Airbus A-320.” Human Factors, 1997: 553-569. Sarter, N.B., R.J. Mumaw, and C.D. Wickens. “Pilot’s Monitoring Strategies and Performance on Automated Flight Decks: An Empirical Study Combining Behavioral and Eye-tracking Data.” Human Factors Journal, 2007: 347-357. Van Dongen, H.P.A., G. Maslin, et al. “The Cumulative Cost of Additional Wakefulness; Dose-Response Effects on Neurobehavioral Functions and Sleep Physiology from Chronic Sleep Restriction and Total Sleep Deprivation.” Sleep 26, no. 2 (2003): 117-126.

NTSB Aircraft Accident Report 148

1. Appendixes

Appendix A: Investigation and Hearing Investigation The NTSB was notified about the accident on July 6, 2013. Staff from the NTSB arrived on scene that day and remained there until July 18, 2013, to conduct the field portion of the investigation. Then-Chairman Deborah A.P. Hersman accompanied the team. In accordance with the provisions of Annex 13 to the Convention on International Civil Aviation, the KARAIB participated in the investigation as the representative of the State of the Operator. Asiana Airlines and the KOCA participated as technical advisors to the KARAIB. Parties to the investigation were the FAA, Boeing Company, Pratt and Whitney, Air Cruisers, Honeywell International, and SFFD. Investigative Hearing An investigative hearing was held on December 11, 2013, in Washington, DC. All five Board Members participated in the hearing. The subjects discussed at the investigative hearing included flight deck design concepts and characteristics, pilot training on automated systems and visual approach procedures, pilot awareness in highly automated aircraft, emergency response, and cabin safety. Parties to the investigative hearing were the FAA, Boeing, Asiana Airlines, Asiana Pilot Union, City and County of San Francisco, and Air Cruisers.

NTSB Aircraft Accident Report 149 Appendix B: Cockpit Voice Recorder Transcript Transcript of a Honeywell 6022 (980-6022-001) solid-state cockpit voice recorder, serial number CVR120-07983, installed on a Boeing 777 (HL7742), which crashed during landing in San Francisco, California.

LEGEND

CAM Cockpit area microphone voice or sound source INT Intercom FA Flight attendant HOT Flight crew audio panel voice or sound source RDO Radio transmissions from HL7742 TWR Radio transmission from the airport tower controller -1 Voice identified as the Pilot Monitoring (PM) -2 Voice identified as the Pilot Flying (PF) -3 Voice identified as the jump seat -? Voice unidentified * Unintelligible word

Expletive @ Non-pertinent word ( ) Questionable insertion [ ] Editorial insertion { } Translated from Korean

Note 1: Times are expressed in Pacific Daylight Time (PDT). Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed. Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken. Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft.

NTSB Aircraft Accident Report 150 CVR Quality Rating Scale The levels of recording quality are characterized by the following traits of the cockpit voice recorder information: Excellent Quality Virtually all of the crew conversations could be accurately and easily understood. The transcript that was developed may indicate only one or two words that were not intelligible. Any loss in the transcript is usually attributed to simultaneous cockpit/radio transmissions that obscure each other. Good Quality Most of the crew conversations could be accurately and easily understood. The transcript that was developed may indicate several words or phrases that were not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other. Fair Quality The majority of the crew conversations were intelligible. The transcript that was developed may indicate passages where conversations were unintelligible or fragmented. This type of recording is usually caused by cockpit noise that obscures portions of the voice signals or by a minor electrical or mechanical failure of the CVR system that distorts or obscures the audio information. Poor Quality Extraordinary means had to be used to make some of the crew conversations intelligible. The transcript that was developed may indicate fragmented phrases and conversations and may indicate extensive passages where conversations were missing or unintelligible. This type of recording is usually caused by a combination of a high cockpit noise level with a low voice signal (poor signal-to-noise ratio) or by a mechanical or electrical failure of the CVR system that severely distorts or obscures the audio information. Unusable Crew conversations may be discerned, but neither ordinary nor extraordinary means made it possible to develop a meaningful transcript of the conversations. This type of recording is usually caused by an almost total mechanical or electrical failure of the CVR system.

NTSB

Aircraft Accident Report

151

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 09:22:28.7 [start of recording]

Start of Transcript

10:42:27.9 CAM-2

{I will give you a} approach briefing. {current weather is Juliet, variable is six, visibility is one zero mile cloud few is one thousand three hundred scattered is eighteen hundred, temperature seventeen Celsius, dew point is ten degree, and altimeter is twenty nine eighty two. Runway is twenty eight L, and I set approach with localizer. And I will fly through Point Reyes, Papa Yankee Echo, of Golden Gate Six Arrival and when close to San Francisco I will fly using radial three zero three to San Francisco. and when I receive vector of final turn twenty eight left or right. airport field elevation is thirteen feet and transition is one eight zero MSA. North of airport is five thousand one hundred and approach side is four thousand five hundred. Type of approach is localizer and MDA set at four hundred sixty. receiving visual approach at final, maintaining lateral, and I will descend using the V/S to keeping up with vertical when localizer captured. setting go-around altitude three thousand feet in case of missed-approach, and I will ascend following LNAV. it's not necessary for cold temperature and altitude correction. I will use autobrake two for landing and taxi. the landing distance is about six thousand three hundred feet. via Quebec or Kilo and Alpha or Bravo and taxiway Hotel, I will taxi at International Terminal between gate A one and gate A nine following diamond marks on center as I receive the gate number. There is no other information} approach briefing completed, sir.

10:43:29.8 CAM-1

{yeah.}

10:43:37.1 CAM-1

{yeah.}

NTSB

Aircraft Accident Report

152

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:45:09.0 CAM-1

{yeah.}

10:45:10.6 CAM-1

{when you land on 28 left, usually, **exit to taxiway Delta or Tango.}

10:45:12.9 CAM-2

{yeah.}

10:45:20.5 CAM-1

{in normal landing condition, exit through Bravo, then exit to Hotel, Mike, but sometimes they give us direct to Mike.}

10:45:26.3 CAM-2

{yeah.}

10:45:42.7 CAM-1

{getting into Hotel, from Bravo to Hotel, we sometimes receive number two. then before entering Bravo, we need to contact ramp tower.}

10:46:01.1 CAM-2

{understand.}

10:46:01.3 CAM-1

{at that time, please monitor ground. before entering, we receive clearance from ramp tower. through number two, we go Alpha five. usually we are given Alpha five.}

10:46:04.9 CAM-2

{yeah, I got it.}

10:46:20.8 CAM-1

{sometimes, they give us Alpha six, then just follow the instructions.}

10:46:31.2 CAM-1

{if you think you did not hear right or misunderstand ATC either in the air or ground. then you can confirm with ATC before setting MCP in air. when you read back, you are not sure of it, you can ask again to make sure and confirm on the ground. if you are not sure a hundred percent, then stop the aircraft, confirm again before you proceed.}

NTSB

Aircraft Accident Report

153

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:47:06.7 CAM-2

{yes, I will do it.}

10:47:25.4 CAM-1

{I will proceed, descent checklist.}

10:47:28.0 CAM-2

yes sir. descent checklist.

10:47:29.8 CAM-1

recall and notes. check. autobrake two. landing data.

10:47:35.1 CAM-2

VREF one three two, minimum four six zero.

10:47:38.4 CAM-1

VREF one three two, minimum four six zero.

10:47:46.3 CAM-1

approach briefing?

10:47:47.4 CAM-2

completed.

10:47:49.5 CAM-1

low visibility approach required?

10:47:52.2 CAM-2

no.

10:47:54.2 CAM-1

check list completed.

10:48:58.6 CAM-1

{if you have sunglasses, why don't you wear them? but I don't wear them because of depth perception.}

10:49:11.6 CAM-2

{I won't wear them also.}

10:49:13.9 CAM-1

{we usually wear sunglasses to protect eyes.}

NTSB

Aircraft Accident Report

154

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:49:21.1 CAM-1

{I understand that people, who have many outdoor activities, are recommended to wear them to protect eyes. But I can't wear sunglasses. I usually use them while in cruise flight, but always take them off when on approach.}

10:49:40.8 CAM-2

{I even take them off to focus when on approach.}

10:49:44.3 CAM-1

{approaching with wearing sunglasses when I flew seven six seven, I felt a bit uneasy from flare, I don't wear them since then.}

10:50:12.3 CAM-1

{I .}

10:50:44.4 CAM-2

{I am wondering how captain @ had a detached cornea.}

10:50:51.0 CAM-2

{Captain @ and other seven three seven captains were working under scorching sun without any problems without wearing sunglasses, and can read up to that old age.}

10:51:02.7 CAM-2

{nowadays, kids are having weak eyes, even my nephew who is sophomore in high school has bad eye sight 0.5.}

10:51:14.4 CAM-1

{my son had third grade of eye sight testing in physical.}

10:51:21.8 CAM-2

{oh, can you get third grade because of eye sight?}

10:51:25.6 CAM-1

{yeah, not exempted unless it is 0.01 like really bad.}

10:51:27.4 CAM-2

{yeah.}

10:51:33.6 CAM-1

{and lately there will be no exemption with only one item, especially bad eye sight, can't make it happen because eye glasses and so on are available.}

NTSB

Aircraft Accident Report

155

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:51:38.9 CAM-2

{aha.}

10:52:06.6 CAM-1

{I don't know whether my son should do Lasik or . some recommend to perform and some not. But my nephew, who had really bad eye sight, just did it and he said his life style has been changed since.}

10:52:23.6 CAM-2

{it really depends on how skilfully the doctor corrects the cornea; I mean how the doctor deals with the thickness of it. But it seems they are not operating well. That may be the reason pilots complained after the correction.}

10:52:43.2 CAM-2

{I know it corrects the sight, but there's some risk also. and I was told that Lasik is not recommended to those who have thin corneas.}

10:52:52.0 CAM-1

{humm.}

10:52:54.2 CAM-2

{captain @ who moved to Air Busan had a blocked artery, has high eye pressure always because his cornea is 1.5 thicker than average people.}

10:53:06.9 CAM-1

{aha.}

10:53:07.5 CAM-2

{whenever his physical performed, his eye pressure is always high.}

10:53:15.5 CAM-1

{I see captain @ is in Air Busan.}

10:53:19.6 CAM-2

{yeah, he is a manager in safety management team in Air Busan.}

NTSB

Aircraft Accident Report

156

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:53:31.1 CAM-1

{the company offered him a choice of either staying at a hotel or rent a house. and he chose to rent. the company provided $100,000 deposit for the rental property to accommodate his staying.}

10:53:47.4 CAM-1

{does he fly three two one?}

10:53:49.5 CAM-2

{he had flown seven four seven then changed to three two one because he also had the rating.}

10:54:08.1 CAM-1

{there's no particular reason to stay after age sixty.}

10:54:17.5 CAM-1

{the condition is about same or worse.}

10:54:23.0 CAM-1

{comparing Jeju Air and us, first, the physical is tougher. Jeju Air is a bit lenient on physical and give five year verbal extension contract immediately after passing the physical. However our company extends the contract annually, gives a new employee ID, start newly step one, sixty hours guaranteed, and no space available pass. literally everything accumulated is wiped out.}

10:55:03.0 CAM-1

{zone fare at point seventy would not be available also.}

10:55:08.9 CAM-2

{even we don't have that?}

10:55:10.4 CAM-1

{the company says use the annually provided passes. after age sixty, we usually get eight passes annually, which is half of the number of the years we have served.}

10:55:20.0 CAM-2

{eight passes annually?}

10:55:23.6 CAM-2

{so it won't matter international or domestic?}

NTSB

Aircraft Accident Report

157

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:55:26.1 CAM-1

{so the benefit is dramatically diminished. But we still can use them in case we move to Jeju at sixty. we can use Jeju's and .}

10:55:42.2 CTR

Asiana two fourteen descend pilots discretion maintain flight level two four zero.

10:55:47.4 UNK

(confirm Asiana two zero two.) 10:55:49.9 CAM-1

talk English.

10:55:51.7 CTR

negative, Asiana two one four, two fourteen descend pilots discretion maintain flight level two four zero

10:55:58.0 RDO-1

descend flight level two four zero pilot discretion Asiana two one four 10:56:02.1 CAM-2

yes sir two four zero pilots discretion.

10:56:05.8 CAM-2

{yes, you have control. I will make PA.}

10:56:08.6 CAM-1

{yeah, wait a moment.}

10:56:15.6 CAM-1

I have ATC and control.

10:56:17.2 CAM-2

yes sir. you have ATC and control.

10:56:24.9 CAM-2

{I will make thirty minutes of arrival time.}

10:56:29.5 CAM-1

{yeah.}

NTSB

Aircraft Accident Report

158

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT

10:56:44.3 RDO-1

Asiana two one four leaving three niner zero for two four zero.

10:56:50.6 CTR

Asiana two one four roger. 10:57:11.0 INT-2

{passenger announcement in Korean.}

10:57:42.8 INT-2

ladies and gentleman, this is your captain speaking. we hope you had a pleasant flight. we are now approaching San Francisco International Airport we'll be landing in about thirty minutes around eleven thirty AM local time. the current weather in San Francisco International Airport is clear temperature is one seven degrees Celsius and sixty two degrees Fahrenheit. we thank you for flying Asiana Airlines member of Star Alliance. enjoy your stay in San Francisco. hope to see you again soon.

10:58:24.4 FA

{passenger announcement in Korean} ladies and gentlemen in a few moments we will be closing our duty free shop to prepare safe landing. if you want to purchase a duty free item now or * flight please contact your cabin crew for more details. and now we end our entertainment system and we * -.

10:58:28.7 HOT-2

I have control sir.

10:58:30.4 HOT-1

you have a controls ahh. {I report to descent immediately as

• *.}

10:58:33.0 CAM-1

{then I will report we are descending two four zero. yes we are descending.}

10:58:36.7 HOT-2

check sir.

NTSB

Aircraft Accident Report

159

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 10:58:40.2 HOT-1

{closing speed window and let's descend VNAV eight two two nine zero.}

10:58:45.8 HOT-2

yes sir.

10:59:05.8 CAM-1

{when did captain @ leave the company?}

10:59:13.5 HOT-2

{I think it's been only about a year.}

10:59:13.7 CAM-2

{it's been about a year.}

10:59:17.6 HOT-1

{coming to annual ground training long ago.}

10:59:17.7 CAM-1

{they were at annual ground school with us.}

10:59:17.7 HOT-2

{ah, at that time, the annual ground school was contracted for Air Busan and I met him there.}

10:59:21.7 CAM-2

{they attended the school as Air Busan pilot. they attended Asiana annual ground school and I met them there while ago.}

10:59:36.5 CAM-1

{captain @, @ -.}

10:59:36.5 HOT-1

{long ago, the pre-selected.}

10:59:39.1 CTR

Asiana two one four contact Oakland Center one two five point eight five.

10:59:43.1 RDO-1

two five eight five Asiana two one four good day.

NTSB

Aircraft Accident Report

160

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT

10:59:58.4 RDO-1

NorCal control good morning Asiana two one four heavy descend flight level two four zero direct point Reyes.

11:00:05.7 CTR

Asiana two fourteen heavy Oakland center cross LOZIT at or maintain one one thousand San Francisco altimeter two niner eight two.

11:00:12.6 RDO-1

ah cross LOZIT one one thousand altimeter two niner eight two. 11:00:18.3 HOT-2

cross LOZIT one one thousand set.

11:00:20.2 HOT-1

check sir.

11:00:39.0 CAM-1

{captain @ and three people were good friends, might be an alumni.}

11:00:39.3 HOT-1

{it was a captain @. three were like an alumni.}

11:00:44.6 CAM-2

{do you mean captain @?}

11:00:45.7 CAM-1

{ah is he @?, captain @, @, and there is one more person. right he move to Air Busan.}

11:00:51.4 CAM-2

{they are @, and @ captain @ came to Airbus, Air Busan.}

11:00:55.6 HOT-2

{captain @ move to Air Busan .}

11:01:08.5 HOT-2

{captain @, @ had too much herb medicine and his liver numbers are too high.}

NTSB

Aircraft Accident Report

161

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:01:17.3 CAM-1

{It's absurd it works at Air Busan, but not in my company.}

11:01:23.0 HOT-2

{* his physical had been done at SamSeong general hospital in Ilwon Dong, and he's been cleared there.}

11:01:30.6 HOT-1

{so I mean why it is possible at Air Busan, but not at our company.}

11:01:39.5 HOT-1

{it's really strange.}

11:01:49.0 CAM-1

idle VNAV path.

11:01:50.6 CAM-2

check sir.

11:01:59.5 CAM-1

hold.

11:02:00.6 CAM-2

check.

11:02:01.5 CAM-1

{so, it means working condition of our company is that bad?}

11:02:01.6 CAM-1

{our health gets better because the physical is so tough.}

11:02:14.5 CAM-1

{if thinking the other way, they are passed even the physical condition is not as good at Air Busan.}

11:02:35.7 CAM-1

{small size aircraft was allowed, but not large size aircraft long ago.}

11:02:39.7 CAM-2

yeah.

11:03:36.1 CAM-1

{Is this air ops?}

NTSB

Aircraft Accident Report

162

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:03:38.7 CAM-2

{Yeah, it is air ops.}

11:03:39.5 CAM-2

I have ATC.

11:03:40.1 HOT-1

{ .}

11:03:40.7 CAM-1

{I will try contact.}

11:03:42.3 CAM-2

yes sir.

11:03:42.8 FA

{ to help the needy children throughout the world. we appreciate your contribution.}

11:03:48.3 CAM-1

air ops.

11:03:49.4 RDO-1

good morning Asiana two one four.

11:03:52.5 OPS

• * go ahead Asiana two one four.

11:03:55.7 RDO-1

ETA San Francisco one eight three zero remaining fuel three three decimal one.

11:04:03.7 OPS

copy I have you ETA one eight three zero you guys are going to gate Alpha four.

11:04:09.7 RDO-1

Alpha four thank you. 11:04:19.2 CAM-1

{received Alpha four.}

11:04:21.4 HOT-2

yes sir.

11:04:28.0 HOT-1

{it is in the back.}

NTSB

Aircraft Accident Report

163

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:04:28.6 CAM-1

{this side.}

11:04:28.6 CAM-2

{yeah.}

11:04:31.5 CAM-2

{yes, it is in the back.}

11:04:32.9 CAM-1

{yeah.}

11:04:45.7 HOT-1

{when you enter, it looks a bit narrow, but it won't matter. there's center line *.}

11:04:51.8 HOT-2

{acknowledged.}

11:04:55.5 HOT-1

{before the center line, first at abeam , entering all the way over the . at the left side, it won't get caught.}

11:05:04.3 RDO-2

{acknowledged.} 11:05:19.0 HOT

{ATIS information Echo.}

11:05:50.7 CAM

[sound similar to electronic seat adjustment]

11:05:58.5 CAM

[sound similar to electronic seat adjustment]

11:07:04.0 HOT-1

{flying time is about same as to LA.}

11:07:07.0 HOT-2

{yeah.}

11:07:21.3 HOT-1

{I will give a signal first.}

11:07:22.5 HOT-2

yes, sir. approach signal sir.

NTSB

Aircraft Accident Report

164

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:07:38.5 CAM-1

transition.

11:07:40.3 CAM-2

set QNH two niner eight two.

11:07:43.0 HOT-1

two niner eight two inches set.

11:07:45.3 HOT-2

check.

11:08:06.7 CAM-1

standby.

11:08:06.8 CAM-2

approach checklist sir.

11:08:06.9 HOT-1

stand by ah.

11:08:07.2 HOT-2

approach check two niner eight two set .

11:08:08.8 CAM-3

approach signal * with altimeter.

11:08:11.5 FA

{we will arrive at San Francisco international airport shortly. please put your seat belt on, and put the seat tray unfold. and please open the window curtain}

11:08:13.8 HOT-1

two niner eight two.

11:08:13.9 CAM-1

two niner eight two is set, checklist complete.

11:08:16.0 HOT-1

checklist complete.

11:08:17.2 HOT-2

check.

11:08:19.6 HOT-1

{announcement sent out.}

NTSB

Aircraft Accident Report

165

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:08:20.4 HOT-2

yes sir.

11:08:26.4 INT

{passenger announcement in Korean.}

11:08:36.9 FA

we are now making our descent into San Francisco international airport leg rest and tray tables in the upright position and open the window shade overhead bins thank you.

11:08:39.8 CAM-1

{it seems better to give approach signal earlier in long flight.}

11:08:46.5 HOT-1

{long hours working long flight *.}

11:08:46.6 CAM-2

{ah yeah.}

11:08:47.9 CAM-1

{ preparing hard and earlier, but it takes longer than thought. they want to start at ten thousand feet if possible in short distance travel because service should be provided.}

11:09:01.3 HOT-1

{long distance has .}

11:09:05.0 HOT-2

yeah.

11:09:15.5 CAM-1

{as a beginner, flying small size aircraft, they rush even for making an announcement. it becomes their habit doing it that way. small size aircraft in long flight even though they can relax and slow down in the process.}

11:09:36.7 HOT-1

{later it will become really busy when going Kansai or Fukuoka.}

11:09:41.5 HOT-1

{it will be very busy.}

NTSB

Aircraft Accident Report

166

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:10:06.8 CAM-1

{I turn off the weather radar.}

11:10:08.6 HOT-2

yes sir weather radar off.

11:10:52.7 CTR

Asiana two fourteen contact NorCal approach one three three point niner five.

11:10:56.9 RDO-1

three three niner five Asiana two one four good day. 11:10:59.7 HOT-2

• sir.

11:11:05.6 RDO-1

(NorCal) approach good morning Asiana two one four direct LOZIT one one thousand. 11:11:12.0 CAM

[sound of double chime]

11:11:13.7 APR

Asiana two one four heavy NorCal approach depart San Francisco VOR heading one four zero vector visual approach two eight left. 11:11:16.3 CAM

[sound of metallic clunks]

11:11:19.6 RDO-1

after San Francisco heading one four zero visual two eight left?

11:11:25.6 APR

ah two eight left affirmative.

11:11:27.1 RDO-1

thank you.

11:11:28.6 RDO-2

yes sir heading one four zero San Francisco.

NTSB

Aircraft Accident Report

167

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:11:31.3 HOT-1

after San Francisco.

11:11:33.1 HOT-2

yes sir.

11:11:36.4 CAM-1

{you don't get rest, do you?}

11:11:50.4 CAM-1

clear left visual approach.

11:11:52.4 HOT-2

yes sir two eight left approach.

11:12:23.9 HOT-1

VNAV ALT.

11:12:25.4 CAM-2

check.

11:12:33.7 HOT-1

{FO @, monitoring well please in the back.}

11:12:39.6 CAM-3

{yes sir.}

11:12:40.3 HOT-1

{let us know immediately if anything strange shows. and we received Alpha four.}

11:13:05.9 CAM-1

{ah, I can see well San Francisco.}

11:13:10.3 CAM-1

{Ahh, well.}

11:13:12.3 CAM-1

{ah. that bridge leads to Oakland.}

11:13:16.7 HOT-2

{is that the Golden Gate?}

11:13:18.6 CAM-1

{the Golden Gate is over there.}

11:13:20.1 HOT-2

yeah.

NTSB

Aircraft Accident Report

168

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:13:21.5 CAM-1

{this is to Oakland, and it leads to Sacramento, which is capitol of California, and location of University of Berkley.}

11:13:23.8 HOT-2

yeah.

11:13:30.9 HOT-2

ah *

11:13:36.1 CAM-1

{Golden Gate is that side, but can't see it because of clouds.}

11:13:53.4 HOT-1

{the water in the lake.}

11:13:55.1 APR

Asiana two one four heavy reduce speed to two one zero.

11:13:57.7 RDO-1

ah speed a two one zero Asiana two one four. 11:13:59.7 HOT-2

yes sir two one zero set.

11:14:01.5 HOT-1

check.

11:14:03.6 CAM-1

(check two one * set.)

11:14:07.9 HOT-1

{it's the water source of San Francisco.}

11:14:10.3 HOT-2

ah yeah.

11:14:13.2 HOT-1

{there's a golf course over there, which is Crystal Spring golf course. It's pretty good, but we can't get a car nowadays.}

11:14:16.7 HOT-2

yeah.

NTSB

Aircraft Accident Report

169

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:14:23.9 HOT-2

yeah.

11:15:13.9 HOT-1

{wow, there’s no airplane.}

11:15:20.5 HOT-1

{there's no plane on taxiway.}

11:15:22.5 HOT-2

yeah.

11:15:24.3 CAM-1

{they are landing. there is one on two eight left on final, short final.}

11:15:31.4 CAM-1

{one land at two eight right, and the other land at two eight left.}

11:15:35.5 HOT-2

yeah.

11:15:51.1 CAM-1

{that's Oakland.}

11:15:52.4 CAM-2

{yeah.}

11:16:08.9 CAM

[sound similar to electronic seat adjustment]

11:16:23.3 HOT-2

one four zero preset.

11:16:24.5 HOT-1

check.

11:16:42.6 CAM-2

heading select.

11:16:44.0 CAM-1

heading select.

11:16:48.9 HOT-1

San Fran-.

NTSB

Aircraft Accident Report

170

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT

11:16:50.3 APR

Asiana two one four heavy descend and maintain niner thousand contact approach one three five point sixty five good day.

11:16:57.7 RDO-1

ah descend nine thousand one two five six five Asiana two one four good day.

11:17:03.0 APR

ah just verify one three five point six five.

11:17:05.8 RDO-1

thirty five sixty five thank you. 11:17:07.4 HOT-2

yes sir.

11:17:07.5 APR

thank you have a good day. 11:17:11.6 HOT-1

{did I say two five?}

11:17:15.1 RDO-1

approach good morning Asiana two one four heading one four zero nine thousand speed two one zero.

11:17:21.4 APR

Asiana two one four heavy NorCal approach caution wake turbulence you'll be following a heavy Boeing triple seven.

11:17:26.9 RDO-1

• Asiana two one four.

11:17:29.7 HOT-2 sir nine thousand flight level change.

11:17:31.6 HOT-1

check sir.

11:18:02.3 CAM-2

descend .

NTSB

Aircraft Accident Report

171

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:18:04.8 CAM-1

{setting at this, I will keep .}

11:18:05.7 HOT-1

*.

11:18:07.2 HOT-2

{thank you.}

11:18:20.8 CAM-2

one zero thousand all lights on sir.

11:18:23.0 CAM-1

check (all lights).

11:18:51.5 CAM-1

speed alt sir.

11:18:52.5 CAM-2

check.

11:19:05.0 CAM

[sound similar to a click]

11:19:16.5 HOT-1

{it's there.}

11:19:19.6 HOT-2

traffic in sight.

11:19:25.0 APR

Asiana two one four heavy descend and maintain six thousand turn left heading one zero zero. 11:19:29.4 CAM

[sound similar to a click]

11:19:29.5 RDO-1

heading one zero zero descend six thousand Asian two one four. 11:19:31.3 CAM

[sound similar to a click]

11:19:31.7 CAM

[sound similar to a click]

NTSB

Aircraft Accident Report

172

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:19:32.9 CAM

[sound similar to a click]

11:19:33.1 HOT-2

one zero zero six thousand flight level change.

11:19:35.1 HOT-1

check.

11:19:41.0 HOT-1

hold flight level change speed.

11:19:42.9 HOT-2

check.

11:20:01.3 HOT-?

{*.}

11:20:03.4 HOT-1

{I will set it.}

11:20:05.8 HOT-2

{thank you.}

11:20:31.2 CAM

[sound similar to electronic seat adjustment]

11:20:38.8 HOT-1

{they are coming from both sides same time.}

11:20:57.0 APR

Asiana two one four heavy descend and maintain four thousand turn left heading zero three zero.

11:21:01.0 RDO-1

heading zero three zero descend four thousand Asiana two one four. 11:21:04.4 HOT-2

yes sir zero three zero four thousand.

11:21:06.3 CAM-1

check.

11:21:06.7 CAM-2

speed brake.

NTSB

Aircraft Accident Report

173

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:21:11.8 CAM-1

heading select.

11:21:13.3 CAM-2

yes, sir.

11:21:49.0 APR

Asiana two one four heavy San Francisco airport nine or ten o'clock one seven miles do you have it sight? 11:21:53.3 HOT-2

yes sir runway in sight.

11:21:55.1 HOT-1

in sight?

11:21:55.5 HOT-2

yes sir runway in sight.

11:21:56.2 RDO-1

okay runway in sight.

11:21:57.8 APR

Asiana two one four heavy turn left heading three one zero cleared visual approach runway two eight left.

11:22:02.7 RDO-1

cleared heading three one zero cleared visual two eight left Asiana two one four. 11:22:06.5 HOT-2

yes three one zero ID normal {I am intercepting} localizer.

11:22:09.0 HOT-1

yes.

11:22:12.7 HOT-1

localizer armed.

11:22:14.2 HOT-2

check, cleared visual approach.

11:22:17.2 HOT-1

check.

NTSB

Aircraft Accident Report

174

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:22:45.6 HOT-2

{next, three thousand one hundred.}

11:22:47.1 CAM-2

cleared visual approach.

11:22:48.4 CAM-1

check.

11:22:53.8 HOT-1

{since we did not receive HEMAN, but receive DUYET, let's descend slowly to one thousand eight hundred feet, and it's visual.}

11:22:56.8 HOT-2

{yes} yes sir {I will set to one thousand eight hundred.}

11:23:03.1 HOT-1

{because} clear visual {is given.}

11:23:04.0 HOT-1

yes sir.

11:23:05.2 HOT-1

localizer capture.

11:23:06.5 HOT-2

check, flaps one sir.

11:23:08.9 HOT-1

speed check flaps one set.

11:23:16.4 HOT-2

speed one nine two set.

11:23:17.3 APR

Asiana two one four heavy reduce speed to one eight zero maintain that till five mile final there's traffic behind and to the right that does have you in sight.

11:23:23.7 RDO-1

localizer speed one eighty final five mile * Asiana two one four.

NTSB

Aircraft Accident Report

175

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:23:30.7 CAM-2

speed one eight zero.

11:23:31.8 CAM-1

check.

11:23:32.9 HOT-2

flaps five.

11:23:36.0 HOT-1?

{ .}

11:23:42.4 CAM-2

flaps five sir.

11:23:43.5 CAM-1

speed check.

11:23:44.7 CAM-1

flaps five.

11:23:46.7 CAM-1

set.

11:23:47.8 HOT-2

check.

11:23:49.5 CAM-1

{ .}

11:23:53.2 HOT-2

{yeah, I am descending now.}

11:23:54.4 HOT-1

yeah.

11:23:58.0 HOT-1

V/S.

11:23:58.8 HOT-2

one thousand.

11:24:00.9 HOT-1

check.

11:24:32.2 CAM-3

to one eight zero five miles.

NTSB

Aircraft Accident Report

176

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:24:34.3 CAM-1

{Uhh?}

11:24:34.4 HOT-1

ah ah ah one eight zero.

11:24:35.0 CAM-3

one eight zero five miles.

11:24:36.0 CAM-2

huh?

11:24:36.8 CAM-3

• one eight zero.

11:24:37.9 HOT-2

okay one eight zero five miles.

11:24:50.6 HOT-2

okay gear down sir.

11:24:52.0 HOT-1

gear down.

11:24:53.1 CAM-1

{this seems a little high.}

11:24:53.3 CAM

[sound of increased background noise]

11:24:55.2 CAM-2

{yeah.}

11:24:55.6 CAM-1

{this should be a bit high}

11:24:58.9 HOT-2

{do you mean it's too high?}

11:24:59.6 HOT-1

*.

11:25:02.0 CAM-2

{I will descend more.}

11:25:13.1 FA

[passenger announcement made in Korean]

NTSB

Aircraft Accident Report

177

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:25:23.0 CAM-1

{ *.}

11:25:29.0 CAM-1

ok.

11:25:31.2 CAM-1

one thousand.

11:25:36.1 APR

Asiana two one four heavy contact San Francisco tower one two zero point five.

11:25:39.4 RDO-1

• five Asiana two one four good day.

11:25:43.4 HOT-2 (missed) approach three thousand .

11:25:50.3 CAM-?

(down flaps five).

11:25:56.0 RDO-1

ah tower good morning Asiana two one four final seven miles south two eight left. 11:26:01.1 HOT-2

flaps (twenty).

11:26:02.2 CAM-1

flaps five ahh.

11:26:04.9 CAM-1

flaps twenty.

11:26:05.9 CAM-2

yeah.

11:26:12.6 CAM-2

flaps thirty.

11:26:14.8 CAM-1

speed check flaps thirty (sir).

11:26:15.1 HOT-1

check.

NTSB

Aircraft Accident Report

178

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:26:21.2 HOT-1

{ speed. speed one three seven. one thousand speed. speed one three seven.}

11:26:21.2 CAM-1

speed .

11:26:24.6 CAM

[sound of click]

11:26:27.6 CAM

[sound of click]

11:26:28.3 CAM-1

flaps thirty.

11:26:29.5 HOT-2

• sir *.

11:26:32.5 CAM-1

flight director.

11:26:34.0 CAM-2

check.

11:26:35.7 CAM-1

speed.

11:26:36.8 CAM-2

target speed one three seven.

11:26:40.4 CAM-2

flight director off.

11:26:41.3 CAM-1

okay.

11:26:43.4 CAM

[sound of knock]

11:26:44.0 CAM-1

{it's high.}

11:26:52.2 CAM-1

one thousand.

11:26:54.2 CAM-2

check.

NTSB

Aircraft Accident Report

179

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:26:58.6 CAM-3

sink rate sir.

11:26:59.1 HOT-2

yes sir.

11:26:59.5 RDO-1

tower Asiana two one four short final. 11:27:05.1 CAM-3

sink rate sir.

11:27:06.1 HOT-1

cleared to land {?}

11:27:07.3 CAM-?

{(sink rate.)}

11:27:07.5 TWR

Asiana two one four heavy San Francisco tower runway two eight left cleared to land. 11:27:10.7 CAM

• *.

11:27:10.8 RDO-2

cleared to land two eight left Asiana two one four. 11:27:14.3 CAM-1

okay.

11:27:15.5 CAM

five hundred. [electronic voice]

11:27:16.6 HOT-2

landing checklist.

11:27:16.8 CAM

minimums, minimums. [electronic voice]

11:27:17.5 CAM-1

landing checklist complete cleared to land.

11:27:19.8 HOT-1

on glide path sir.

11:27:21.2 CAM-2

check.

NTSB

Aircraft Accident Report

180

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:27:32.3 CAM

two hundred. [electronic voice]

11:27:33.6 CAM-1

{it's low.}

11:27:34.8 CAM-2

yeah.

11:27:36.0 HOT-?

11:27:38.2 CAM

[sound similar to electronic seat adjustment]

11:27:39.3 CAM

[sound of quadruple chime]

11:27:41.6 CAM

one hundred. [electronic voice]

11:27:42.8 CAM-1

speed.

11:27:44.0 CAM-?

speed .

11:27:45.8 CAM

fifty. [electronic voice]

11:27:46.4 CAM

[sound similar to stick shaker lasting for approximately 2.24 seconds]

11:27:46.6 CAM

forty. [electronic voice]

11:27:47.3 CAM

thirty. [electronic voice]

11:27:47.8 HOT-1

oh # go around.

11:27:48.6 CAM

twenty. [electronic voice]

11:27:49.5 HOT-2

go around.

NTSB

Aircraft Accident Report

181

TIME and SOURCE INTRA-COCKPIT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 11:27:49.6 CAM

ten. [electronic voice]

11:27:50.3 HOT-?

oh.

11:27:50.3 CAM

[sound similar to impact]

11:27:51.9 HOT

[sound similar to telephone dial tone]

11:27:54.3 CAM

[sound of quadruple chime]

11:27:55.4 INT-?

ah what's happening over there?

11:27:55.9 CAM

[sound of quadruple chime]

11:27:57.8 CAM

[sound of quadruple chime]

11:28:00.2 CAM

{sound of quadruple chime]

End of Transcript

11:28:01.9 [end of recording]

COMMENTS OF THE REPUBLIC OF KOREA TO THE NATIONAL TRANSPORTATION SAFETY BOARD’S DRAFT REPORT CONCERNING THE INVESTIGATION OF THE ACCIDENT INVOLVING ASIANA AIRLINES FLIGHT 214

Prepared and submitted by: AVIATION AND RAILWAY ACCIDENT INVESTIGATION BOARD

June _16, 2014 Appendix C: The Republic of Korea Aviation and Railway Accident Investigation Board Comments 182

I. Overall Comment

o ARAIB believes that this accident is one of a series of recent accidents caused by a failure of the pilots to recognize unexpected operations of the autothrottle system.

o ARAIB is deeply concerned that the Report fails to engage in in-depth investigation and to address the issue of a deficiency in the low-speed alert and speed protection of the B777 automation system, particularly as it was a key agenda in the investigative hearing. The NTSB and ARAIB’s joint investigative efforts have been focused on this very issue, so it comes as a surprise that the issue was only dealt with superficially in the Report and not as a probable cause of the accident.

o ARAIB recognizes that a deficiency in the automation system related to speed protection has been a major cause of several recent aviation accidents. In this respect, international standards need to be developed and implemented to improve aviation safety.

II. B777 automation system A. Inconsistencies in the airspeed protection feature and inadequacy of the low- speed alert 1. Failure to maintain proper airspeed has been a major cause of several recent aviation accidents. a) In response to four recent accidents that involved a failure to maintain proper airspeed, the U.S. Federal Aviation Administration (“FAA”) released a safety policy statement in 2011 and the European Aviation Safety Agency (“EASA”) stated that an inconsistency in the automation behavior has been in the past a major contributing factor to aviation accidents. The Dutch Safety Board (“DSB”) recommended Boeing, along with other manufacturers, to improve a low-speed alert by introducing a unique, immediate alarming sound as a part of the alert system. Four accidents that involved a failure to maintain airspeed: 183

(1) Thomsonfly Ltd, Boeing Model 737-300, near Bournemouth, United Kingdom on September 23, 2007 (2) Empire Airlines, Model ATR-42-300, in Lubbock, Texas on January 27, 2009 (3) Colgan Air, de Havilland Model DHC-8-400, in Clarence Center, New York on February 12, 2009 (4) Turkish Air, Boeing Model 737-800, in Amsterdam, Netherlands on February 25, 2009 FAA Policy No PS-ANM-25-16 (2011) This policy statement is necessary to address a safety vulnerability, as evidenced in the following four recent incidents and accidents that involved the failure to maintain proper airspeed: Thomsonfly Ltd, Boeing Model 737-300, near Bournemouth, United Kingdom on September 23, 2007—This incident involved deceleration after the flightcrew did not notice the autothrottle failure or the autothrottle disengagement. The flightcrew allowed the airspeed to decrease 20 knots below Vref before they initiated recovery. After multiple stick shaker activations and an aerodynamic stall, the flightcrew eventually regained control, and the airplane landed safely. Empire Airlines, Model ATR-42-300, in Lubbock, Texas on January 27, 2009 — This accident involved a deceleration to stick shaker and autopilot disconnect following a flap anomaly. The probable cause was the flightcrew’s failure to monitor and maintain a minimum safe airspeed while executing an instrument approach in icing conditions, which resulted in an aerodynamic stall at low altitude. Colgan Air, de Havilland Model DHC-8-400, in Clarence Center, New York on February 12, 2009 — This accident involved decelerating to a low speed, which activated the stall warning while on approach. The probable cause of this accident was the captain’s inappropriate response to the activation of the stick shaker, which led to an aerodynamic stall from which the airplane did not recover. The flightcrew’s failure to monitor airspeed also contributed to this accident. Turkish Air, Boeing Model 737-800, in Amsterdam, Netherlands on February 25, 2009 — This accident involved a radio altimeter anomaly that led to an inappropriate autothrottle thrust reduction. The flightcrew failed to recognize the airspeed decay and the pitch increase 184

until the moment the stick shaker was activated. Subsequently, the approach-to-stall recovery procedure was not executed properly, causing the airplane to stall and crash. b) The FAA issued Alerts for Excursions Outside Acceptable Margins and Reliability of Protection/Alerts, respectively, with respect to a low-speed alert and speed protection function. FAA Policy No PS-ANM-25-16 : Reliability of Protection/Alerts. The reliability of the low-speed protection or alert required by § 25.1329(h) must meet the requirement of § 25.1309(b)(2). Failure of the low-speed protection or alert required by § 25.1329(h), which would reduce the capability of the airplane or the ability of the crew to cope with adverse operational conditions, must be improbable. AC 25.1329(h) (2) Compliance with § 25.1329(h). Standard stall warning and high- speed alerts are not always timely enough for the flight crew to intervene to prevent unacceptable speed excursions during FGS operation. The intent of § 25.1329(h) is for the FGS to provide a speed protection function for all operating modes, so that the airspeed can be safely maintained within an acceptable margin of the speed range of the normal flight envelope. 2. FAA AC 25.1329(h) specifies that it intends to ensure “a speed protection function for all operation modes.” However, the B777 did not provide a speed protection in HOLD mode. 3. FAA AC 25.1322-1 sets out that a low-speed alert “should be a time-critical warning” level alert that “gives the flight crew immediate awareness without further reference to other flight deck indications.” Contrary to the requirement, the B777 low-speed alert was a caution that did not require immediate pilot actions, and generated a master beeper that sounds identical to more than 60 other problems on the aircraft. FAA Policy No PS-ANM-25-16 : Alerts for Excursions Outside Acceptable Margins. If a low-speed alert is used as the means of compliance with § 25.1329(h), the alert should ensure that the flightcrew is immediately aware of any excursions beyond an acceptable margin from the speed range of the normal flight envelope. 185

In accordance with § 25.1322(b), this alert must be a caution or a warning. Since automatic flight control presupposes that the flightcrew will not have their hands on the controls, aural and visual indications are presumably the essential attention-getting senses required by § 25.1322(c)(2). In addition, the alert should be time-critical for warnings and for cautions, and be consistent with the elements of the related time- critical warning in accordance with AC 25.1322-1. AC 25.1322-1 b. Time-Critical Warning Alerts. Some warnings may be so time-critical for the safe operation of the airplane that general alerts such as a master visual alert and a master aural alert may not provide the flightcrew with immediate awareness of the specific alerting condition that is commensurate with the level of urgency of flightcrew response necessary. In such cases, warning elements dedicated to specific alerting conditions should be provided that give the flightcrew immediate awareness without further reference to other flight deck indications. Examples of such time-critical warnings include reactive windshear and ground proximity. The alerting elements for time-critical warnings should include:  Unique voice information or unique tone, or both, for each alerting condition, and;  Unique visual alert information in each pilot’s primary field of view for each alerting condition. 4. The EASA stated in its Debrief Note Ex 14-1 that the loss of speed protection in certain automation modes on the B787 can be a contributing factor to an accident. EASA characterized the automation inconsistency as “a strong contributor to aviation accidents” which must be improved upon. Autothrottle Wake-Up, speed protection feature: The “autothrottle wake up” feature has been considered by the certification team as a system improving significantly the safety of the aircraft to be certified. It protects the aircraft not only against stall but also against low energy states, anticipating on the stick shaker triggering. Unfortunately there are on the B787 (as well as some other previous Boeing models) at least two automation modes (FLCH in descent and VNAV speed in descent, with ATHR on HOLD) for which the “Autothrottle Wake up” function is not operative and therefore does 186

not protect the aircraft. Although the certification team accepts that this “Autothrottle wake up” feature is not required per certification requirements, these two exceptions look from a pilot’s perspective as an inconsistency in the automation behavior of the airplane. Inconsistency in automation behaviors has been in the past a strong contributor to aviation accidents. The manufacturer would enhance the safety of the product by avoiding exceptions in the “Autothrottle wake up” mode condition. 5. In its Final Report on Turkish Airlines Flight B737-800’s crash at Amsterdam Schiphol Airport in Netherlands on February 25, 2009 - the accident very similar to Asiana Flight 214 - the DSB recommended Boeing to “assess” an auditory low-speed warning signal and, if shown effective, “mandate its use.” In response, Boeing issued a Service Bulletin 737-34A2292 in April 2012, which instructed an electronic voice based low-speed alert which clearly enunciating “airspeed low” be installed on the B737 aircrafts within 12 months of issuance. Boeing, FAA and EASA should assess the use of an auditory low-speed warning signal as a means of warning the crew and - if such a warning signal proves effective - mandate its use. 6. Although the FAA, EASA and DSB had recommended Boeing to improve the design of the low-speed alert and speed protection logic on its aircrafts, Boeing failed improved the B777, which shares the same autothrottle operation and design as the B787. Boeing did not heed to these recommendations. As a result, at least four past accidents were attributable to the aircraft’s failure to protect airspeed and to give a timely and distinct low- speed alert.

B. Improper function of the low-speed alert 1. A low-speed alert, a quadruple chime, enunciated between 12 to 11 seconds prior to impact. Moreover, when the alert sounded it was just a general “caution” chime, which is used to signify more than 60 other problems on the aircraft. Unlike higher priority “warning” alerts, a general “caution” does not require immediate crew action. 2. The quadruple master chime is indistinguishable and under extraordinarily high workload, it would have increased the heavy pilot workload and caused confusion amongst the crew. Within 4 seconds after the master chime sounded, the PM pushed the thrust levers. On the accident flight, if a more direct aural 187

alert, such as an electronic voice clearly enunciating “low airspeed” was provided to the crew, they would have reacted immediately to such alert. 3. About 4 seconds after the alert sounded and 7 seconds prior to impact, the PM pushed the throttles forward to execute a go-around. About 3 seconds after the PM’s action and 4 seconds prior to impact, the stick shaker - a low-speed warning - activated. 4. The simulation study indicated that the accident flight had adequate performance capability to accomplish a go around initiated no later than 11 to 12 seconds prior to ground impact. If a smaller tolerance is built in to the simulation, a go-around initiated 1 to 2 seconds earlier may have prevented impacting the seawall. 5. If the low-speed alert was a “warning” which requires immediate crew action or a more direct aural alert, such as an electronic voice clearly enunciating “low airspeed,” the crew response time would have been shorter and the crew could have increased power earlier so that impacting the seawall could have been prevented. 6. Inadequacy of the B777 low-speed alert is attributable to the crew’s delayed execution of a go-around and confusion, which could have prevented the decaying airspeed had it warned the flight crew in time to permit a timely response from the pilots, and could have prevented the impact as a last resort in the safety features embedded in the aircraft.

C. Conclusions 1. The B777 did not provide adequate airspeed protection. Although the FAA recommends that airspeed protection be maintained in all flight modes, the B777 did not provide the necessary protection in HOLD mode. 2. The B777’s low-speed alert was inadequate. Although Boeing had improved the B737-800 low-speed alerts by introducing a unique aural cue for immediate pilot awareness, the low-speed alert of B777, which shares a similar logic, remains unchanged. The level of urgency of the low-speed alert on the B777 remains unchanged - it is not a warning, but a caution, which does not require immediate crew action. As it stands, the low speed caution alert is too late to provide the crew a window of opportunity to correct the developing low speed situation. 3. Boeing’s failure to comply with previous recommendations to improve the 188

design of the B777 As a result of four recent accidents involving a failure to maintain airspeed - a significant safety concern that is directly relevant to Asiana flight 214 - the FAA, EASA and DSB had recommended Boeing to improve the low airspeed alert and the airspeed protection features of its aircrafts. Boeing neither implemented any corrective measures to the B777 (which share the same automation system design and logic as the previous accident flights), nor provided a revised training material or issued notice to the B777 operators. Had Boeing complied with these recommendations, improved the speed control systems of its aircrafts and informed the airlines with respect to the automation inconsistencies in its aircrafts, the accident could have been averted.

III. ADDITIONAL CONTRIBUTING FACTOR ARAIB determines that additional Contributing Factor to the accident is “Inadequacy of the B777’s low airspeed alert and inconsistencies in the airspeed protection function”

IV. ADDITIONAL RECOMMENDATIONS Despite several recent aviation accidents, inadequate measures have been taken by international regulatory organizations to improve aviation safety. In response to four recent accidents that involved a failure to maintain proper airspeed, the FAA, EASA and DSB stated that an inconsistency in the automation behavior has been in the past a major contributing factor to aviation accidents and strongly encouraged the manufacturer to improve its automated system. Boeing, however, did not heed this recommendation. While Boeing made passive changes to certain aircraft type, it did not take proactive measures to improve the automated system, including a low-speed alert, across its aircraft types, despite the fact they share the same automation issue. ICAO should require all large commercial aircraft manufacturers to (1) install a more direct and distinct low-speed alert that permits a timely response from the pilots, and (2) improve the automation system to provide adequate speed protection in all modes. 189

FD07417 ｜ 2014_美国_AAR1402.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Crash During a Nighttime Nonprecision Instrument Approach to Landing UPS Flight 1354 Airbus A300-600, N155UP Birmingham, Alabama August 14, 2013

Accident Report NTSB/AAR-14/02 PB2014-107898

National Transportation Safety Board

NTSB/AAR-14/02 PB2014-107898 Notation 8533A Adopted September 9, 2014

Aircraft Accident Report Crash During a Nighttime Nonprecision Instrument Approach to Landing UPS Flight 1354 Airbus A300-600, N155UP Birmingham, Alabama August 14, 2013

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2014. Crash During a Nighttime Nonprecision Instrument Approach to Landing, UPS Flight 1354, Airbus A300-600, N155UP, Birmingham, Alabama, August 14, 2013. NTSB/AAR-14/02. Washington, DC.

Abstract: This report discusses the August 14, 2013, accident involving an Airbus A300-600, N155UP, operating as UPS flight 1354, which crashed short of runway 18 during a localizer nonprecision approach to runway 18 at Birmingham-Shuttlesworth International Airport, Birmingham, Alabama. The captain and first officer were fatally injured, and the airplane was destroyed. Safety issues relate to the need for clear communications to flight crews about weather conditions, between dispatchers and flight crews, and between flight crewmembers; off-duty time management, fatigue awareness, and counseling; use of the continuous descent final approach technique; standardized guidance; and altitude alerts. Safety recommendations are addressed to the Federal Aviation Administration, UPS, Airbus, and the Independent Pilots Association.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13MA133. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2014-107898 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Aircraft Accident Report i Contents Figures ........................................................................................................................................... iv Tables ..............................................................................................................................................v Abbreviations ............................................................................................................................... vi Executive Summary .......................................................................................................................x

1. Factual Information ...................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Injuries to Persons ......................................................................................................................9
4. 3 Damage to Aircraft ....................................................................................................................9
5. 4 Other Damage ..........................................................................................................................10
6. 5 Personnel Information ..............................................................................................................10
7. 5.1 The Captain ....................................................................................................................10
8. 5.1.1 The Captain’s Preaccident Activities ................................................................12
9. 5.2 The First Officer ............................................................................................................15
10. 5.2.1 The First Officer’s Preaccident Activities .........................................................16
11. 5.3 The Flight Dispatcher ....................................................................................................19
12. 6 Aircraft Information .................................................................................................................19
13. 6.1 General Information .......................................................................................................19
14. 6.2 Airplane Components, Systems, and Records ...............................................................19
15. 6.2.1 Flight Management System, Flight Management Computer, and Control

Display Unit ..................................................................................................................19 1.6.2.2 Primary Flight Display and Navigation Display ...............................................22 1.6.2.3 Mode Control Panel ...........................................................................................23 1.6.2.4 Autopilot/Autothrottle Operation ......................................................................23 1.6.2.5 Enhanced Ground Proximity Warning System .................................................23 1.6.2.6 Altitude Callouts ................................................................................................25 1.6.2.7 Flight Crew/System Interaction During an Instrument Approach ....................25 1.7 Meteorological Information .....................................................................................................33 1.7.1 Local Weather Information ............................................................................................33 1.7.2 UPS Weather Sources and Information .........................................................................35 1.8 Aids to Navigation ...................................................................................................................36 1.9 Communications ......................................................................................................................36 1.10 Airport Information ................................................................................................................36 1.10.1 General Airport Information ........................................................................................36 1.10.2 Precision Approach Path Indicator Information ..........................................................36 1.11 Flight Recorders .....................................................................................................................37 1.11.1 Cockpit Voice Recorder ..............................................................................................37 1.11.2 Flight Data Recorder....................................................................................................37 1.12 Wreckage and Impact Information ........................................................................................37 1.13 Medical and Pathological Information...................................................................................40 1.14 Fire .........................................................................................................................................40

NTSB Aircraft Accident Report ii 1.15 Survival Aspects ....................................................................................................................40 1.15.1 Airport Emergency Response ......................................................................................41 1.16 Tests and Research .................................................................................................................42 1.16.1 Flight Simulation .........................................................................................................42 1.16.2 Sequencing the Flight Plan ..........................................................................................45 1.17 Organizational and Management Information .......................................................................46 1.17.1 General Information .....................................................................................................46 1.17.2 Stabilized Approach Information ................................................................................47 1.17.3 Pilot Response to EGPWS Alerts ................................................................................48 1.17.4 Go-Around Policy ........................................................................................................49 1.17.5 BHM Approach Chart ..................................................................................................49 1.17.6 UPS Crew and Dispatcher Resource Management Policies and Training ..................50 1.17.6.1 UPS Crew Resource Management Training ...................................................50 1.17.6.2 UPS Crew Resource Management Preflight Safety Briefing ..........................50 1.17.6.3 UPS Crew Resource Management Steering Committee .................................51 1.17.6.4 UPS Dispatcher Resource Management Training and Policies ......................51 1.17.7 Pilot Flight and Duty Time ..........................................................................................53 1.17.8 UPS Fatigue Policies, Guidance, and Training ...........................................................54 1.17.8.1 Fitness for Duty Policy and Guidance .............................................................54 1.17.8.2 Fatigue Risk Management ...............................................................................54 1.17.8.3 Flight Crew Alertness Guide ...........................................................................55 1.17.8.4 Fatigue Training ..............................................................................................55 1.17.8.5 Fatigue Event Reporting and Review ..............................................................56 1.18 Additional Information ..........................................................................................................57 1.18.1 Postaccident Safety Actions ........................................................................................57 1.18.2 FAA Regulations and Guidance ..................................................................................57 1.18.2.1 Flight- and Duty-Time Regulations ................................................................57 1.18.3 Data Related to Unstabilized Nonprecision Approaches .............................................58

1. Analysis .....................................................................................................................................60
2. 1 General .....................................................................................................................................60
3. 2 Predeparture Planning ..............................................................................................................60
4. 3 Accident Sequence ...................................................................................................................61
5. 3.1 Approach to BHM .........................................................................................................61
6. 3.2 Vertical Deviation and Continuation of the Approach ..................................................62
7. 3.2.1 Failure to Capture the Glidepath .......................................................................62
8. 3.2.2 Pilot Monitoring ................................................................................................64
9. 4 Flight Crew Performance .........................................................................................................66
10. 4.1 Captain’s Performance ...................................................................................................67
11. 4.1.1 Fatigue Evaluation .............................................................................................67
12. 4.1.2 Captain’s Errors .................................................................................................68
13. 4.2 First Officer’s Performance ...........................................................................................69
14. 4.2.1 Fatigue Evaluation .............................................................................................69
15. 4.3 UPS and IPA Fatigue Mitigation Efforts .......................................................................71
16. 5 Operational Issues ....................................................................................................................73
17. 5.1 Dispatcher Training .......................................................................................................73
18. 5.2 Crew Briefings ...............................................................................................................75

NTSB Aircraft Accident Report iii 2.5.3 Enhanced Ground Proximity Warning System Alerts and Response ............................76 2.5.4 Continuous Descent Final Approach Technique ...........................................................77 2.5.5 Nonprecision Approach Proficiency ..............................................................................78 2.5.6 Weather Dissemination ..................................................................................................79 2.6 Systems Issues .........................................................................................................................81 2.6.1 Enhanced Ground Proximity Warning System Software ..............................................81 2.6.2 Terrain Awareness and Warning System Altitude Callouts ..........................................82 2.6.3 Flight Management System/Flight Management Computer ..........................................83

1. Conclusions ...............................................................................................................................87
2. 1 Findings....................................................................................................................................87
3. 2 Probable Cause.........................................................................................................................90
4. Recommendations ....................................................................................................................91
5. 1 New Recommendations ...........................................................................................................91
6. 2 Previous Recommendations Reclassified in This Report ........................................................93

Board Member Statements .........................................................................................................94

1. Appendixes..............................................................................................................................103

Appendix A: Investigation and Public Hearing ...........................................................................103 Appendix B: Cockpit Voice Recorder Transcript ........................................................................104 Appendix C: Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile Comments ...................................................................................................150 References ...................................................................................................................................152

NTSB Aircraft Accident Report iv Figures Figure 1. Maps showing (1) Birmingham, Alabama, and Louisville, Kentucky, on a US map; (2) Birmingham’s location within the State of Alabama; and (3) the crash site on the north side of BHM. ...........................................................................................................................................2 Figure 2. Instrument approach chart for the localizer approach for runway 18 at BHM at the time of the accident with the ball note circled in red. ..............................................................................4 Figure 3. UPS flight 1354’s actual descent and altitudes. ..............................................................6 Figure 4. Overhead photograph of the wreckage path. ...................................................................8 Figure 5. Still-frame photograph from an airport surveillance video camera showing the fire. ...10 Figure 6. Captain’s preaccident activities. ....................................................................................14 Figure 7. First officer's preaccident activities. ..............................................................................18 Figure 8. A300 mode control panel. .............................................................................................20 Figure 9. A300 control display unit. .............................................................................................21 Figure 10. PFD (top screen) and ND (bottom screen). .................................................................22 Figure 11. Photographs of an A300 CDU before and after activating final approach mode. .......32 Figure 12. Photograph of the VDI diamond depicted on the ND display. ....................................33 Figure 13. Photograph of the left side of the forward fuselage. ....................................................38 Figure 14. Photograph of the right side of the forward fuselage. .................................................39 Figure 15. Photograph of the aft fuselage and the right wing wreckage with runway 18 in the distance. .........................................................................................................................................40 Figure 16. Photograph of the A300 simulator CDU showing the flight plan discontinuity message. .........................................................................................................................................43 Figure 17. Photograph of the A300 simulator PFD and ND with the flight plan discontinuity (direct to KBHM) in the active flight plan.....................................................................................44 Figure 18. Photograph of the CDU FINAL APP page with the flight plan not verified. .............45

NTSB Aircraft Accident Report v Tables Table 1. Injury chart. .......................................................................................................................9 Table 2. Comparison of FAA duty-time regulations with the accident flight crew’s duty periods before the accident. ...................................................................................................58

NTSB Aircraft Accident Report vi Abbreviations AC advisory circular ACARS aircraft communication addressing and reporting system AFE above field elevation agl above ground level AOM aircraft operating manual ARFF aircraft rescue and firefighting ASOS automated surface observing system ASRS aviation safety reporting system ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service BHM Birmingham-Shuttlesworth International Airport CDFA continuous descent final approach CDT central daylight time CDU control display unit CFIT controlled flight into terrain CFR Code of Federal Regulations CRM crew resource management CVR cockpit voice recorder DRM dispatcher resource management EDT eastern daylight time EGPWS enhanced ground proximity warning system ETVS enhanced terminal voice switch

NTSB Aircraft Accident Report vii FAA Federal Aviation Administration FAF final approach fix FCOM flight crew operating manual FDP flight duty period FDR flight data recorder FMC flight management computer FOM flight operations manual FOTM flight operations training manual fpm feet per minute FRMP fatigue risk management plan FWC flight warning computer HAT height above touchdown HOU William P. Hobby Airport ICAO International Civil Aviation Organization ILS instrument landing system IMC instrument meteorological conditions IPA Independent Pilots Association MEL minimum equipment list METAR meteorological aerodrome report mi mile min minute msl mean sea level NAS National Airspace System NASA National Aeronautics and Space Administration ND navigation display

NTSB Aircraft Accident Report viii nm nautical mile NOTAM notice to airmen NTSB National Transportation Safety Board NWS National Weather Service OpSpec operations specification PAPI precision approach path indicator PED portable electronic device PF pilot flying PFD primary flight display PIA General Downing-Peoria International Airport PM pilot monitoring POI principal operations inspector PTG pilot training guide RFD Chicago/Rockford International Airport RNAV nonprecision en route area navigation RVR runway visual range SAFO safety alert for operators SAT San Antonio International Airport SDF Louisville International Airport-Standiford Field SNPRM supplemental notice of proposed rulemaking SOP standard operating procedure SPECI special weather observation TAWS terrain awareness and warning system TRACON terminal radar approach control TSO technical standard order

NTSB Aircraft Accident Report ix VDI vertical deviation indicator VGSI visual glideslope indicator VMC visual meteorological conditions VNAV vertical navigation

NTSB Aircraft Accident Report x Executive Summary On August 14, 2013, about 0447 central daylight time (CDT), UPS flight 1354, an Airbus A300-600, N155UP, crashed short of runway 18 during a localizer nonprecision approach to runway 18 at Birmingham-Shuttlesworth International Airport (BHM), Birmingham, Alabama. The captain and first officer were fatally injured, and the airplane was destroyed by impact forces and postcrash fire. The scheduled cargo flight was operating under the provisions of 14 Code of Federal Regulations Part 121 on an instrument flight rules flight plan, and dark night visual flight rules conditions prevailed at the airport; variable instrument meteorological conditions with a variable ceiling were present north of the airport on the approach course at the time of the accident. The flight originated from Louisville International Airport-Standiford Field, Louisville, Kentucky, about 0503 eastern daylight time. A notice to airmen in effect at the time of the accident indicated that runway 06/24, the longest runway available at the airport and the one with a precision approach, would be closed from 0400 to 0500 CDT. Because the flight’s scheduled arrival time was 0451, only the shorter runway 18 with a nonprecision approach was available to the crew. Forecasted weather at BHM indicated that the low ceilings upon arrival required an alternate airport, but the dispatcher did not discuss the low ceilings, the single-approach option to the airport, or the reopening of runway 06/24 about 0500 with the flight crew. Further, during the flight, information about variable ceilings at the airport was not provided to the flight crew. The captain was the pilot flying, and the first officer was the pilot monitoring. Before descent, while on the direct-to-KBHM leg of the flight, the captain briefed the localizer runway 18 nonprecision profile approach, and the first officer entered the approach into the airplane’s flight management computer (FMC). The intended method of descent (a “profile approach”) used a glidepath generated by the FMC to provide vertical path guidance to the crew during the descent from the final approach fix (FAF) to the decision altitude, as opposed to the step-down method (“dive and drive”) that did not provide vertical guidance and required the crew to refer to the altimeter to ensure that the airplane remained above the minimum crossing altitude at each of the approach fixes. When flown as a profile approach, the localizer approach to runway 18 had a decision altitude of 1,200 ft mean sea level (msl), which required the pilots to decide at that point to continue descending to the runway if the runway was in sight or execute a missed approach. As the airplane neared the FAF, the air traffic controller cleared the flight for the localizer 18 approach. However, although the flight plan for the approach had already been entered in the FMC, the captain did not request and the first officer did not verify that the flight plan reflected only the approach fixes; therefore, the direct-to-KBHM1 leg that had been set up during the flight from Louisville remained in the FMC. This caused a flight plan discontinuity message to remain in the FMC, which rendered the glideslope generated for the profile approach

1 In this report, BHM refers to the airport and KBHM refers to the waypoint.

NTSB Aircraft Accident Report xi meaningless.2 The controller then cleared the pilots to land on runway 18, and the first officer performed the Before Landing checklist. The airplane approached the FAF at an altitude of 2,500 ft msl, which was 200 ft higher than the published minimum crossing altitude of 2,300 ft. Had the FMC been properly sequenced and the profile approach selected, the autopilot would have engaged the profile approach and the airplane would have begun a descent on the glidepath to the runway. However, this did not occur. Neither pilot recognized the flight plan was not verified. Further, because of the meaningless FMC glidepath, the vertical deviation indicator (VDI), which is the primary source of vertical path correction information, would have been pegged at the top of its scale (a full-scale deflection), indicating the airplane was more than 200 ft below the (meaningless) glidepath. However, neither pilot recognized the meaningless information even though they knew they were above, not below, the glideslope at the FAF. When the autopilot did not engage in profile mode, the captain changed the autopilot mode to the vertical speed mode, yet he did not brief the first officer of the autopilot mode change. Further, by selecting the vertical speed mode, the approach essentially became a “dive and drive” approach. In a profile approach, a go-around is required upon arrival at the decision altitude (1,200 ft) if the runway is not in sight; in a “dive-and-drive” approach, the pilot descends the airplane to the minimum descent altitude (also 1,200 ft in the case of the localizer approach to runway 18 at BHM) and levels off. Descent below the minimum descent altitude is not permitted until the runway is in sight and the aircraft can make a normal descent to the runway. A go-around is not required for a “dive and drive” approach until the airplane reaches the missed approach point at the minimum descent altitude and the runway is not in sight. Because the airplane was descending in vertical speed mode without valid vertical path guidance from the VDI, it became even more critical for the flight crew to monitor their altitude and level off at the minimum descent altitude. About 7 seconds after the first officer completed the Before Landing checklist, the first officer noted that the captain had switched the autopilot to vertical speed mode; shortly thereafter, the captain increased the vertical descent rate to 1,500 feet per minute (fpm). The first officer made the required 1,000-ft above-airport-elevation callout, and the captain noted that the decision altitude was 1,200 ft msl but maintained the 1,500 fpm descent rate. Once the airplane descended below 1,000 ft at a descent rate greater than 1,000 fpm, the approach would have violated the stabilized approach criteria defined in the UPS flight operations manual and would have required a go-around. As the airplane descended to the minimum descent altitude, the first officer did not make the required callouts regarding approaching and reaching the minimum descent altitude, and the captain did not arrest the descent at the minimum descent altitude. The airplane continued to descend, and at 1,000 ft msl (about 250 ft above ground level), an enhanced ground proximity warning system (EGPWS)3 “sink rate” caution alert was triggered. The captain began to adjust the vertical speed in accordance with UPS’s trained procedure, and he reported the runway in sight about 3.5 seconds after the “sink rate” caution

2 Although the display was correct based on the information the flight crew input to the system, the information output was meaningless for the approach. 3 The airplane was equipped with a Honeywell EGPWS, which is a type of terrain awareness and warning system.

NTSB Aircraft Accident Report xii alert. The airplane continued to descend at a rate of about 1,000 fpm. The first officer then confirmed that she also had the runway in sight. About 2 seconds after reporting the runway in sight, the captain further reduced the commanded vertical speed, but the airplane was still descending rapidly on a trajectory that was about 1 nautical mile short of the runway. Neither pilot appeared to be aware of the airplane’s altitude after the first officer’s 1,000-ft callout. The cockpit voice recorder then recorded the sound of the airplane contacting trees followed by an EGPWS “too low terrain” caution alert. The safety issues discussed in this report relate to the need for the following:  Clear communications. This investigation identified several areas in which communication was lacking both before and during the flight, which played a role in the development of the accident scenario. – Dispatcher and flight crew. Before departure, the dispatcher and the flight crew did not verbally communicate with each other even though dispatchers and pilots share equal responsibility for the safety of the flight. In this case, the dispatcher was aware of a runway closure, approach limitations, and weather that warranted discussion between the dispatcher and the pilots. However, neither the dispatcher nor the flight crew contacted each other to discuss these issues. – Between flight crewmembers. During the flight, the captain did not rebrief the approach after he switched the autopilot from the profile to the vertical speed mode. Therefore, the first officer was initially unaware of the change and had to seek out information on the type of approach being flown. The purpose of briefing any change in the approach is to ensure that crewmembers have a shared understanding of the approach to be flown. Because the captain did not communicate his intentions, it was not possible for the first officer to have a shared understanding of the approach, and her situational awareness was degraded. – Weather. Lastly, the relevant weather was not provided to the crew: the meteorological aerodrome reports (METARs) provided to the crew did not contain information about variable ceilings at BHM because the weather dissemination system used by UPS automatically removed the “remarks” section of METAR reports, where this information was contained. Further, the air traffic controllers did not include the “remarks” information in the automatic terminal information service broadcast. The lack of communication about the variable ceilings may have played a role in the flight crewmembers’ expectation that they would see the airport immediately after passing 1,000 ft above the ground, when in fact they only saw the runway about 5 seconds before impacting the trees. If they would have had access to the METAR remarks, the flight crew may have been more aware of the possibility of lower ceilings upon arrival at BHM.  Off-duty time management, fatigue awareness, and counseling. Review of the first officer’s use of her off-duty time indicated that she was likely experiencing fatigue, primarily due to improper off-duty time management. Even though the first officer was aware that she was very tired, she did not call in and report that she was fatigued, contrary to the UPS fatigue policy. Further, fatigue and fitness for duty are

NTSB Aircraft Accident Report xiii not required preflight briefing items; if they were, the first officer would have had the opportunity to identify the risks associated with fatigue and mitigate those risks before the airplane departed. Further, fatigue counseling for pilots would help to increase awareness and understanding about fatigue and the circumstances surrounding fatigue calls and better equip operators to provide guidance for managing fatigue while fostering an environment wherein all pilots call in fatigued when necessary.  Use of continuous descent final approach technique. Nonprecision approaches do not provide any ground-based vertical flightpath guidance to flight crews and therefore can be more challenging to fly than precision approaches. These factors may contribute to the higher occurrence of unstabilized nonprecision approaches compared to precision approaches. Federal Aviation Administration (FAA) Advisory Circular 120-108, “Continuous Descent Final Approach [CDFA],” outlines a nonprecision approach technique that uses a stable, continuous path to the runway. Flight crews should be able to easily set up a CDFA approach using available airplane technology that generates vertical flightpath guidance internally when ground-based vertical navigation equipment is not available. The use of CDFA techniques while flying nonprecision approaches can provide an additional means of standardization for flight crews when they are conducting nonprecision approaches and reduce the risk of an unstabilized approach.  Standardized guidance. UPS flight crews received guidance from several UPS publications, including the aircraft operating manual, the flight operations manual, and the pilot training guide (PTG). However, the PTG is not a required manual and is only an internal UPS reference manual. The National Transportation Safety Board (NTSB) found a lack of standardization among the documents, and some critical procedures contained within the PTG were not found in the other manuals, such as EGPWS alert responses; planned approach procedures, such as the CDFA technique; and procedures critical to approach setup and sequencing. It is critical that such procedures be contained in an FAA-accepted or -approved document that is onboard the airplane so that they will be subject to FAA review and so that pilots can be both trained and tested on the procedures.  Altitude alerts. The airplane was equipped with an EGPWS that could, if activated, provide a 500-ft alert. This feature is required by terrain awareness and warning system Technical Standard Order C151A, but there is no FAA requirement for operators to activate the feature. Airbus operators typically use the flight warning computer 400-ft alert in lieu of the EGPWS 500-ft alert, but UPS had not activated either alert on its A300 fleet. Additionally, the flight warning computer was equipped with an automated aural “minimums” alert, but UPS had not activated this alert either. Although it cannot be known how the accident crew would have responded to these alerts had they been activated, in general the alerts can provide a beneficial reminder to pilots about the airplane’s altitude above terrain. The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s continuation of an unstabilized approach and their failure to monitor the aircraft’s altitude during the approach, which led to an inadvertent descent below the minimum approach altitude and subsequently into terrain. Contributing to the accident were

NTSB Aircraft Accident Report xiv (1) the flight crew’s failure to properly configure and verify the flight management computer for the profile approach; (2) the captain’s failure to communicate his intentions to the first officer once it became apparent the vertical profile was not captured; (3) the flight crew’s expectation that they would break out of the clouds at 1,000 feet above ground level due to incomplete weather information; (4) the first officer’s failure to make the required minimums callouts; (5) the captain’s performance deficiencies likely due to factors including, but not limited to, fatigue, distraction, or confusion, consistent with performance deficiencies exhibited during training; and (6) the first officer’s fatigue due to acute sleep loss resulting from her ineffective off-duty time management and circadian factors. As a result of this investigation, the NTSB makes safety recommendations to the FAA, UPS, Airbus, and the Independent Pilots Association.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1 History of Flight

On August 14, 2013, about 0447 central daylight time (CDT),1 UPS flight 1354, an Airbus A300-600, N155UP, crashed short of runway 18 during a localizer nonprecision approach to runway 18 at Birmingham-Shuttlesworth International Airport (BHM), Birmingham, Alabama. The captain and first officer were fatally injured, and the airplane was destroyed by impact forces and postcrash fire. The scheduled cargo flight was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121 on an instrument flight rules flight plan, and dark night visual flight rules conditions prevailed at the airport; variable instrument meteorological conditions (IMC) with a variable ceiling were present north of the airport on the approach course at the time of the accident. The flight originated from Louisville International Airport-Standiford Field (SDF), Louisville, Kentucky, about 0503 eastern daylight time (EDT) (see figure 1).2 A notice to airmen (NOTAM) in effect at the time of the accident noted that runway 06/24, which is 11,998 ft long, would be closed from 0400 to 0500 due to runway lighting system maintenance. Because UPS flight 1354’s scheduled arrival time was 0451, only runway 18, which is 7,099 ft long, would have been available. Accordingly, the UPS dispatcher planned for the flight to land on runway 18. Because the Jeppesen approach chart noted (erroneously) in the minimums section that the nonprecision localizer3 approach to runway 18 was not authorized at night,4 the dispatcher thought that the nonprecision area navigation (RNAV)5 GPS approach would be required. The pilots’ flight briefing package contained the NOTAM for the runway 06/24 closure and landing performance data for runway 18.

1 Unless otherwise noted, all times in this report are CDT based on a 24-hour clock. 2 The National Transportation Safety Board (NTSB) public docket for this accident investigation, NTSB case number DCA13MA133, is available online at www.ntsb.gov . 3 Instrument approach procedures fall into two categories: precision and nonprecision. Whereas precision approaches use ground-based navigation aids to provide lateral and vertical guidance to the desired touchdown point on the runway, nonprecision approaches use ground-based navigation aids (or satellite-based GPS) to provide only lateral guidance to the runway. Vertical guidance is provided by the designation of minimum altitudes at specified points, or fixes, that are progressively lower the closer the fixes are to the runway threshold. A localizer is an electromagnetically defined course line usually along the extended centerline of a runway that provides lateral course guidance. 4 Jeppesen indicated that at the time of the accident, this note regarding the localizer approach was a publishing error and was corrected after the accident. 5 According to Federal Aviation Administration (FAA) Advisory Circular 90-100A, “U.S. Terminal and En Route Area Navigation (RNAV) Operations,” RNAV is “a method of navigation [that] permits aircraft operation on any desired flight path within the coverage of station-referenced navigation aids or within the limits of the capability of self-contained aids, or a combination of these.” Some RNAV (GPS) approaches use satellite signals to provide vertical guidance to the runway, just as precision approaches use ground-based signals to provide this guidance. However, these RNAV approaches are still considered nonprecision approaches.

NTSB Aircraft Accident Report 2 Figure 1. Maps showing (1) Birmingham, Alabama, and Louisville, Kentucky, on a US map; (2) Birmingham’s location within the State of Alabama; and (3) the crash site on the north side of BHM. Although the dispatcher thought that the only approach available to the flight crew was the RNAV GPS approach to runway 18, he did not inform the pilots, and nothing in the paperwork advised the flight crew that this was the only approach available to runway 18. In addition, the forecast ceiling for the approach to runway 18 was predicted to be below the minimum descent altitude for the RNAV GPS approach at the time of arrival.6 As a result, the flight may have had to divert to its alternate of Hartsfield-Jackson Atlanta International Airport, Atlanta, Georgia, or hold until the longer runway opened. However, the dispatcher did not discuss this possibility or remind the flight crew that runway 06/24 would reopen about 0500. The flight departed SDF about 0403. Cockpit voice recorder (CVR) and flight data recorder (FDR) data indicate that the en route portion of the flight from SDF to BHM appeared

6 The minimum descent altitude for the RNAV GPS 18 approach at BHM is 1,200 ft mean sea level, and the required visibility is 1 1/2 miles.

NTSB Aircraft Accident Report 3 routine. CVR and dispatch information indicated that the captain was the pilot flying (PF) and the first officer was the pilot monitoring (PM). At 0421:28, the CVR recorded the first officer stating, “they’re sayin’ six and two-four is closed. They’re doin’ the localizer to one eight,” after the flight crew listened to BHM automatic terminal information service (ATIS) Papa,7 which included the 06/24 runway closure. The captain responded, “localizer (to) one eight, it figures.” Between 0423 and 0430, the captain briefed the localizer runway 18 approach using the UPS Profile Briefing Guide from the UPS Aircraft Operating Manual (AOM). The briefing items included determining that the decision altitude was 1,200 ft,8 verifying the vertical navigation (VNAV)/profile path9 on the approach chart, reading the profile path ball note10 on the approach chart, loading the approach in the flight management computer (FMC),11 selecting the profile button on the mode control panel, and verifying that profile was armed.12 The captain then continued to review the localizer 18 approach chart including the following items: 1,200-ft decision altitude with 560 ft on the radio altimeter, touchdown zone elevation, minimum sector altitude, charted missed approach, aircraft configuration for the missed approach, runway environment and lighting, expected turnoff taxiway, and low brakes. At no time did the captain or first officer mention that the localizer approach was not available, as indicated on the Jeppesen chart. At 0433:33, air traffic control (ATC) cleared the flight to descend to 11,000 ft mean sea level (msl), and the captain commented, “They’re generous today. Usually they kind’a take you to fifteen and they hold you up high.” At 0441:44, while flying level at 11,000 ft msl, the first officer contacted BHM approach control advising that they had ATIS information Papa and requesting a lower altitude. The BHM approach controller issued a descent clearance to 3,000 ft and said, “uhm...runway six is still closed. you want…the localizer one eight?” The flight crew accepted the localizer 18 approach (see figure 2).

7 ATIS is the continuous broadcast of recorded noncontrol information in selected high-activity terminal areas. At 0453, ATIS Papa reported, “Zero eight five three zulu observation. Sky condition ceiling one thousand broken seven thousand five hundred overcast. Temperature two three dew point two two altimeter two niner niner seven. Localizer runway one eight in use. Landing and departing runway one eight. Notice to Airmen runway six/two four closed. All departing aircraft contact tower one one niner point niner for clearance, taxi and takeoff. Advise controller on initial contact you have PAPA.” 8 On a precision approach, the decision altitude is the altitude at which a missed approach must be initiated if the required visual reference is not in sight. On a typical nonprecision approach that does not provide a VNAV vertical guidance, the airplane descends to the minimum descent altitude (see section 1.6.2.7). 9 VNAV is a function of certain RNAV systems that presents computed vertical guidance to the pilot referenced to a specified vertical path. The computed vertical guidance is based on barometric altitude information and is typically computed as a geometric path between two waypoints or an angle based on a single waypoint. The A300 autopilot flight director system’s profile mode is used to fly the VNAV path computed by the flight management computer while in final approach mode. Profile mode is authorized on the A300 to fly the VNAV path down to a barometric decision altitude or derived decision altitude as applicable, after final approach mode is activated by the flight crew. For the purposes of this report, “profile glidepath” and “VNAV path” are synonymous. 10 A “ball note” on a Jeppesen chart is a note on the chart that provides additional information (see figure 2). 11 When setting up the FMC for the profile approach, the pilot verifies the glidepath angle that is used to construct the desired glidepath. The height of the glidepath at any given time is computed based on this angle and the airplane’s distance from the runway threshold, as determined by the FMC. This FMC-computed distance is not simply the length along the ground of a straight line drawn from the airplane’s current position over the ground to the threshold; rather, the distance is the sum of the length of all the navigation legs between the airplane’s current position over the ground and the runway threshold, as entered in the FMC. 12 The PM loaded the approach into the FMC and reviewed it for accuracy. The PF was to verify the approach accuracy during the approach briefing.

NTSB Aircraft Accident Report 4 (Used by permission of Jeppesen Sanderson Inc. NOT TO BE USED FOR NAVIGATION.) Figure 2. Instrument approach chart for the localizer approach for runway 18 at BHM at the time of the accident with the ball note circled in red. The glidepath for the runway 18 localizer approach, indicated by the dashed line and 3.28° at the bottom of figure 2, is defined by the minimum crossing altitude at three approach fixes (COLIG, BASKN, and IMTOY) aligned north of the extended runway 18 centerline. The localizer approach to runway 18 had a minimum descent altitude of 1,200 ft msl. Because the crew was initially flying a profile approach, they were to descend to a decision altitude (also

NTSB Aircraft Accident Report 5 1,200 feet), rather than the minimum descent altitude.13 At the decision altitude, the pilot would make a decision to continue descending to the runway, if the runway was in sight, or execute a missed approach. For a step-down approach, the minimum descent altitude is the altitude the airplane cannot descend below until the required visual reference is obtained; if visual reference is not obtained, the pilot must conduct a go-around at the missed approach point.14 At 0442:05, the approach controller began to vector the flight for the approach and cleared the flight crew to “turn ten degrees right, join the localizer, maintain three thousand.” During that time, the PM would normally configure the FMC by resequencing15 the computer to reflect only the anticipated fixes to be flown on the approach. Resequencing is a common action by flight crews and is accomplished on all UPS approaches. Between the heading clearance at 0442:05 and 0443:53.5, when the localizer began to capture, the crew was engaged in a conversation about the lack of approach options to the runway and their perception that ATC had left them high on the approach. At 0443:24, as the airplane descended through about 6,900 ft msl with the landing gear extended and the autopilot engaged, the approach controller cleared the flight for the approach stating, “maintain two thousand five hundred [msl] till established on localizer, cleared localizer one eight approach.” However, because the flight crew did not verify the flight plan, the FMC was still on a direct course to KBHM16 rather than on a course to the appropriate approach fix, which, at this point, would have been COLIG. The airplane was 2.4 nautical miles (nm) from COLIG and 10.5 nm from the BASKN final approach fix (FAF) at this time (see figure 3, which shows the airplane’s descent path). It was established on the localizer when it descended through 3,800 ft msl and was aligned laterally with the extended centerline of runway 18; the airplane maintained lateral alignment with the extended centerline for the remainder of the flight. When the airplane reached 2,500 ft msl about 4 nm from BASKN (about 9 nm from the runway), it leveled off, even though it was established on the localizer and could have descended to 2,300 ft, as shown in figure 3.

13 The later change in approach type would have required a minimum descent altitude. 14 For the localizer 18 approach to BHM flown as a step-down approach, the missed approach point was the approach end of runway 18, or 1.3 distance-measuring-equipment miles on the localizer. 15 For the purposes of this report, “sequencing the flight plan” refers to clearing the route discontinuity and undesired waypoints so the FMC flight plan only reflects the anticipated waypoints to be flown for the approach. 16 In this report, BHM refers to the airport and KBHM refers to the waypoint.

NTSB Aircraft Accident Report 6 Figure 3. UPS flight 1354’s actual descent and altitudes. 1

NTSB Aircraft Accident Report 7 As the airplane neared the BASKN FAF, the controller cleared the pilots to land on runway 18, and the first officer performed the Before Landing checklist. The airplane approached BASKN at an altitude of 2,500 ft msl, which was 200 ft higher than the FAF’s minimum crossing altitude and contrary to the UPS A300 Pilot Training Guide (PTG) recommendation that the airplane descend to the FAF crossing altitude before intercepting the profile path. Because the approach was still sequenced for a direct-to-KBHM course, the airplane continued flying toward BASKN at 2,500 ft and did not capture the desired profile glidepath. During this time, the captain changed the autopilot mode from the previously briefed profile approach to vertical speed mode,20 initially setting the vertical descent rate to about 700 ft per minute (fpm), then increasing it to 1,000 fpm; however, he did not brief the first officer about the autopilot mode change. At 0446:24.7, about 7 seconds after the first officer completed the Before Landing checklist, she noted the change to vertical speed mode. The captain responded, “Yeah I’m gonna do vertical speed. yeah he kept us high.” At 0446:29.6, the first officer said, “kept ya high. could never get it over to profile (we didn’t) do it like that.” The captain then increased the vertical descent rate to 1,500 fpm, and the airplane continued to descend at that rate as it approached the IMTOY stepdown fix. At 0447:03, when the airplane was about 1,530 ft msl, the first officer stated, “there’s a thousand ft [above airport elevation]…instruments cross checked no flags.” The captain responded, “alright ah DA [decision altitude] is twelve ah hundred [msl].”21 At 0447:10.9, as the airplane passed the IMTOY stepdown fix at an altitude near the charted minimum crossing altitude of 1,380 ft msl, the captain stated “two miles.” However, the airplane continued to descend at 1,500 fpm and passed through and continued below the desired glidepath. As the airplane approached and then descended through the minimum descent altitude of 1,200 ft msl, neither pilot made the required callouts regarding approaching and reaching the minimum descent altitude. At 0447:19.6 the first officer said, “it wouldn’t happen to be actual [chuckle].”22 At an altitude of about 1,000 ft msl (about 250 ft above ground level [agl]), an enhanced ground proximity warning system (EGPWS)23 “sink rate” caution alert was triggered.24 About 1 second later, the captain began to reduce the selected vertical speed to about 600 fpm. The captain reported the runway in sight about 3.5 seconds after the “sink rate” caution alert, and the first officer then confirmed that she also had the runway in sight. About 2 seconds after reporting the runway in sight, the captain further reduced the selected vertical speed to 400 fpm. At 0447:31.5, the captain disconnected the autopilot, and a second later, the CVR recorded the sound of rustling, corresponding to the airplane’s first contact with trees. The CVR then recorded

20 Vertical speed mode maintains the pilot-selected vertical speed. 21 Although the captain said, “DA,” based on the change to the approach, the decision altitude would have changed to a minimum descent altitude. 22 CVR transcript-related items in square brackets are editorial comments and a description of sounds other than words. 23 The airplane was equipped with a Honeywell EGPWS, which is a type of terrain awareness and warning system. 24 Review of recorded radar data indicated that the flight remained well above the current and predicted warning slopes within the BHM minimum safe altitude warning area, thus no minimum safe altitude warning alerts were generated.

NTSB Aircraft Accident Report 8 an EGPWS “too low terrain” caution alert and several additional impact noises until the recording ended. Postaccident examination revealed that the airplane struck several trees and ingested tree debris into both engines during its descent toward runway 18. Pieces of airplane wreckage associated with the initial impacts were found about 1 1/4 miles (mi) north of the runway threshold and consisted mostly of small fragments of left wing, engine nacelle, and engine inlet material. The airplane struck more trees, a power pole, and power lines before it impacted downsloping terrain in a large gulley north of the runway 18 threshold. The debris path continued to the bottom of the gulley and up the adjacent side. Figure 4 is an overhead photograph of the wreckage path. Figure 4. Overhead photograph of the wreckage path.

NTSB Aircraft Accident Report 9 1.2 Injuries to Persons Table 1. Injury chart. Injuries Flight Crew Cabin Crew Passengers Other Total Fatal 2 0 0 0 2 Serious 0 0 0 0 0 Minor 0 0 0 0 0 None 0 0 0 0 0 Total 2 0 0 0 2 1.3 Damage to Aircraft The airplane was destroyed by impact forces and postcrash fire. Images recorded by several surveillance video cameras based at the airport showed the fire associated with the airplane’s ground impact and the presence of low clouds above the impact area (see figure 5). The forward fuselage was largely intact; however, the lower portion of the fuselage, especially under the cockpit, sustained severe impact damage. The left wing was highly fragmented. The right wing, aft fuselage, and tail sustained significant fire damage. For additional wreckage information, see section 1.12.

NTSB Aircraft Accident Report 10 Figure 5. Still-frame photograph from an airport surveillance video camera showing the fire. 1.4 Other Damage The accident airplane damaged trees and utility poles and lines during its descent, which resulted in minor damage to local properties. Also, aircraft rescue and firefighting (ARFF) personnel cut an opening in a fence so that they could access and apply foam to the wreckage. 1.5 Personnel Information 1.5.1 The Captain The captain, age 58, was the PF on the accident flight. He held an airline transport pilot certificate with a type rating on the A310,25 a flight engineer certificate (turbojet), and a flight instructor certificate (airplane single engine, instrument airplane). The captain’s current

25 According to FAA Order 8900.1, Figure 5-88, “Pilot Certification Aircraft Type Designations – Airplane,” the A300-600 and A310 are common type ratings.

NTSB Aircraft Accident Report 11 first-class medical certificate was issued by the Federal Aviation Administration (FAA) on April 16, 2013, and included the limitation, “Must have available glasses for near vision.” Before UPS hired the captain, he was employed by Trans World Airlines as a Boeing 727 flight engineer and then as a 727 first officer. He had previously flown for a regional airline as a flight instructor and in the military; however, the captain’s UPS records did not list flight times at his previous employers or his military flight time. The captain was hired by UPS on October 29, 1990, as a 727 flight engineer and transitioned to a 727 first officer in August 1994. UPS records indicate that the captain attempted to upgrade to Boeing 757 captain twice—in July 2000 and September 2002—but voluntarily withdrew from training during classroom instruction, returning to the position of 727 first officer on both occasions. In April 2004, the captain transitioned to first officer on the A300 and subsequently upgraded to captain on the A300 in June 2009. A review of UPS records26 indicated that the captain had about 6,406 hours total flight time at UPS, of which 3,265 hours were in the A300. His most recent pilot-in-command line check was accomplished on March 21, 2013, and his most recent proficiency training and check were accomplished on June 26, 2013. The captain was current and qualified in accordance with UPS and FAA requirements. A review of FAA records found no prior accident or enforcement actions and one incident.27 A search of records at the National Driver Register found no history of driver’s license revocation or suspension. UPS reported the captain had no recorded disciplinary actions. The UPS training department did not retain the training records for the captain’s two uncompleted 757 upgrade attempts. Records indicated that the captain also had multiple failures of home study programs in 1991 and 1992 and that he failed maneuvers validation28 in 2007. Further, the captain’s training records revealed multiple substandard elements29 related to nonprecision approaches (most recently June 2013). The training deficiencies noted for the captain were during recurrent training, and for those, the company check airman or instructor provides additional training. Because recurrent training involves training to proficiency, it is not unusual for a pilot to repeat an item. During postaccident interviews, one pilot who had flown with the accident captain described him as “average to above average” in flying ability, stating that he managed the cockpit better than most and accepted input from first officers. Another pilot stated that the captain was a “very normal and standard” pilot, was very routine, and did nothing out of the ordinary. The captain reportedly followed all company procedures, provided good briefings, and

26 Although the captain reported 8,600 hours of total flight time on his most recent first-class medical application, no documentation of that time was available. Therefore, the times listed here are UPS flight times only. 27 On August 20, 2010, the captain was involved in an incident in which the A300 he was operating departed a taxiway after landing. According to FAA records, remediation training was accomplished by the UPS A300 chief pilot. 28 This validation addressed an individual’s proficiency in the execution of maneuvers. For a Qualification Curriculum, crewmembers were expected to have reached a satisfactory level of proficiency in the maneuvers before this validation event. 29 During recurrent training in 2013, the captain was required to redo an item when he set his minimums bug (an adjustable indicator on the barometric altimeter) incorrectly while performing a nonprecision approach. He also had deficiencies noted during his captain upgrade training in 2009 that required repeating or being debriefed on a number of scenarios.

NTSB Aircraft Accident Report 12 used the appropriate checklists. No pilots interviewed expressed concerns about flying with the captain. The captain’s colleagues indicated that, in the weeks before the accident, the captain had expressed concern that the flying schedules were becoming more demanding.30 He mentioned that they were flying more legs per night and “day/night flops.” He further stated that flying 1 week on then 1 week off made it difficult to get back into a routine the first couple of days of a trip and that the end of the trip was also difficult. He told one colleague, “I can’t do this until I retire because it’s killing me.” 1.5.1.1 The Captain’s Preaccident Activities At the time of the accident, the captain lived in Matthews, North Carolina, with his wife and teenage daughter, and he commuted to the UPS base at SDF. His wife described the captain’s health as good and said it had improved in the last 12 months because he had started exercising. He did not smoke, exercised regularly, and drank alcohol occasionally. Although no medications were listed in the captain’s FAA medical records, the captain’s wife said that he took a prescription medication to treat his high blood pressure and occasionally took vitamins. The captain was off duty from August 5 to 9, 2013. On August 9, 2013, about 1645, the captain called UPS crew scheduling and reported being sick and cancelled the trip he was scheduled to fly beginning on August 10. He told the crew scheduling technician that he would pick up his scheduled trip on August 13 in SDF.31 The captain’s wife did not recall when the pilot woke up on Sunday, August 11 but said they went to church that morning before attending the last day of family reunion events. They returned home about 1700, took their daughter to dinner, and watched television. Records show that the captain logged into the UPS crew flight operations system about 1836. The captain’s wife could not recall when they went to bed that night but said they usually went to bed between about 2130 and 2200 and watched television for a while. It is not known when the captain awoke on August 12; however, records show that he logged into the UPS crew flight operations system about 0552 and again about 0859. The captain’s wife said that he performed normal activities and took a nap. A records review and device examination showed portable electronic device (PED) activity32 between 1000 and 1114 then again from 1852 to 2109. The captain logged into the UPS crew flight operations system about 2023, and the captain’s wife and daughter then drove him to the UPS facility at Charlotte/Douglas International Airport, Charlotte, North Carolina. The captain commuted to SDF, riding on the jumpseat of a UPS flight, where he arrived about 2232. He requested a sleep

30 The CVR recorded similar related comments between the captain and first officer. 31 According to the captain’s wife, she was not aware of any recent illness or injury that precipitated his sick call on August 9. She said that she and her husband participated in nearby family reunion activities throughout the weekend of August 9 to 11. According to UPS records, the captain had called in sick for 15 total days in five occurrences over the previous 13 months. As a result, the pilot’s sick call on August 9 triggered a review by the assistant chief pilot, with nothing unusual noted. UPS retains absence records indefinitely. 32 The captain’s PEDs included two cell phones, a tablet, and an e-reader.

NTSB Aircraft Accident Report 13 room33 about 2247 and entered the sleep room about 9 minutes (min) later. At 2334 on August 12, the captain accessed photos on his e-reader. It is unknown whether the captain slept or when he exited the sleep room on August 13. There was a break in his PED activity from 2334 to 0057. About 0057, he used the PED for 3 min. The captain went on duty about 0214, and a colleague and friend reported speaking with the captain about 0230. The accident pilots departed SDF about 0326 and flew to General Downing-Peoria International Airport (PIA), Peoria, Illinois, then to Chicago/Rockford International Airport (RFD), Rockford, Illinois, where they arrived about 0553. The pilots took a hotel shuttle to the hotel, arriving about 0601. Hotel key swipe logs indicate that the captain entered his room about 0621. Data showed periodic PED activity between 0638 and 0656, followed by extended breaks in PED activity between 0656 and 1047, 1048 and 1510, and 1645 and 1835. The captain left his hotel room at some time during the day and returned to his room about 1834. The captain’s wife said she spoke with the captain about 1930, and he told her he got sleep during the day. The accident pilots were picked up by the shuttle about 2006 and went on duty at RFD about 2036. They flew to PIA, then SDF, arriving at SDF about 2357. Upon arrival at SDF, the flight crew took the shuttle to the UPS air services center, where the captain requested a sleep room about 0009 on August 14 and entered the room about 7 min later. Data indicate PED activity from 0024 to 0044. The captain left the sleep room about 0247 and logged into the UPS crew flight operations system about 0254. Records indicate that the accident flight pushed back for departure from SDF about 0355. The captain’s preaccident activities are shown in figure 6.

33 UPS provides rest facilities at SDF, available to pilots on a first-come, first-served basis. The SDF rest facility includes 124 private sleep rooms available for pilot use for up to 12 hours. UPS also provides three “quiet” rooms outfitted with recliners. One of the quiet rooms was more suitable for sleeping, with dimmed lights and blankets available for pilot use. The other two quiet rooms could be used to watch television, read, or perform other activities.

NTSB Aircraft Accident Report 14

1

2

3

4 Figure 6. Captain’s preaccident activities. 5

NTSB Aircraft Accident Report 15 1.5.2 The First Officer The first officer, age 37, was the PM on the accident flight. She held an airline transport pilot certificate with numerous type certificates, including a type rating on the A310 (second-in-command) and a flight engineer certificate (turbojet). The first officer’s current first-class medical certificate was issued by the FAA on January 7, 2013, and included no limitations. Before being hired by UPS, the first officer flew for corporate and regional operators. UPS hired her as a 727 flight engineer on November 16, 2006. She upgraded to a 757 first officer in October 2007, then transitioned to the Boeing 747-400 and was based at Ted Stevens Anchorage International Airport, Anchorage, Alaska, in June 2009. On June 7, 2012, she transitioned to the A300 and was based at SDF. According to UPS records, at the time of the accident, the first officer had about 4,721 hours of total flight time, including 403 hours as second-in-command in the A300. Her most recent proficiency training and check were accomplished on June 26, 2013. The first officer was current and qualified in accordance with UPS and FAA requirements. A review of FAA records and Pilot Records Improvement Act34 records on file with UPS revealed no accident, incident, or enforcement history. A search of the National Driver Register found no history of driver’s license revocation or suspension. UPS reported the first officer had no recorded disciplinary actions. UPS records showed that the first officer called in sick six times in the 13 months before the accident; four of those calls were made in 2013, most recently on July 14, 2013. She was contacted by her assistant chief pilot after a sick call on March 20, 2013, and again after the most recent sick call. She provided her assistant chief pilot with a doctor’s note in March and said she had a doctor’s appointment in July. The assistant chief pilot said he found nothing unusual about her most recent sick call. One pilot who flew with the first officer described her as a “top notch person” who was very approachable and as a professional aviator who followed procedures. Another pilot who flew with the first officer stated that she was efficient, did her job, was on time, was someone you could depend on, and used the procedures as trained. No pilots who were interviewed were concerned about flying with the first officer or with her crew resource management (CRM) skills, and all of them believed that she would speak up to a captain if necessary. In the context of schedule-related discussions with her husband, the first officer had indicated that cargo pilots were increasingly being “pushed.” The first officer had spoken to her husband in the past about being tired at the end of the day, but he said that, if she was not able to, she would not fly. However, a colleague of the first officer stated that he did not think she would call in fatigued; he said she was more of the type to “fly under the radar.” She had told the colleague within the month before the accident that she had been having trouble staying awake in

34 The Pilot Records Improvement Act requires that a hiring air carrier under 14 CFR Parts 121 and 135, or a hiring air operator under 14 CFR Part 125, request, receive, and evaluate certain information concerning a pilot/applicant’s training, experience, qualification, and safety background before allowing that individual to begin service as a pilot with their company. The act went into effect in 1996. The captain was hired by UPS on October 29, 1990, and thus was not subject to a pilot records improvement act check.

NTSB Aircraft Accident Report 16 the cockpit. He stated it was something that had become an epidemic among flight crews and indicated that the first officer and her colleague frequently discussed how the schedules had deteriorated and crews were flying more legs. A pilot walking through the SDF “ready room” in March 2013 saw the first officer with her face down on the table. She told him that she was “totally exhausted” and that, although she had a sleep room, it was an exterior room. The pilot indicated to investigators that the exterior rooms were noisier than the interior rooms. He encouraged her to call in fatigued. Another pilot who recently flew with the first officer on a week-long trip stated that, toward the end of the week, although she was responding to radio calls, she was “zoning out” during the cruise portion of the flight. He commented to her that she looked tired, and she told him she was a little tired. 1.5.2.1 The First Officer’s Preaccident Activities At the time of the accident, the first officer lived in Lynchburg, Tennessee, with her husband, and she commuted via car to the UPS base at SDF. The first officer’s husband said she was “as healthy as you get” and although she did not exercise regularly, she worked with her horses a lot and got a “farm workout.” She did not take any prescription medication but took vitamins daily. She drank alcohol rarely and did not use tobacco products. She had no recent illness or injuries. The first officer’s husband reported that, when she was off duty, she tried to be in bed by about 2000. She would sleep through the night and awake about 0600 to 0700. She had no major changes to her health, financial situation, or personal life that would have impacted her performance on the day of the accident. The first officer was off duty from August 4 to 9. Although it is not known what time the first officer commuted from her home in Tennessee to SDF on August 9 to report for duty on August 10, her husband reported that SDF was about 3 1/2 to 4 hours driving time from their home. The first officer’s PED data35 indicated usage from 2346 on August 9 to 0259 on August 10. On August 10, the first officer went on duty about 0256. The first officer’s flight departed SDF about 0357 and arrived at San Antonio International Airport (SAT), San Antonio, Texas, about 0610. About 0625, the first officer went off duty for about 62 hours 30 min. During this off-duty period, the first officer traveled (using jumpseat privileges on Southwest Airlines) from SAT to William P. Hobby Airport (HOU), Houston, Texas, to visit a friend, arriving in Houston about 1105 on August 10. PED data showed periodic activity between 0942 and 1323, followed by a break in activity from 1324 to 1506. PED activity resumed about 1507 with no extended breaks until 2327. It is unknown when the first officer went to bed or awoke on August 11. Although it is not known when the first officer awoke on August 11, records show her PED activity began about 0858 and continued throughout the day with several extended breaks. Her husband said she texted him during the day and told him she was resting. She said she was tired and felt bad that she was not able to spend as much time with her friend because she was sleeping the whole time. PED activity continued from 2344 until 0117 on August 12 and then

35 The first officer’s PED included a cell phone and a tablet.

NTSB Aircraft Accident Report 17 resumed about 0744. The first officer logged into AirUPSers.com36 about 0927 and the UPS crew flight operations system about 0942. There was a break in activities until 1044, and the first officer departed HOU for SAT about 1325. PED data indicated activity from 1401 to 1720. A break in activity occurred from 1720 to 1841, when PED activity resumed. According to a friend who spoke to the first officer on August 12, she told him via text that she would “pay big money to sleep” but that it was time for her to get ready. The first officer departed the hotel for SAT about 2030 and began her duty day about 2053, arriving at SDF about 0022 on August 13. After arriving at SDF, the first officer talked with a colleague in the crew briefing room about 0025, briefly engaged in PED activity, and logged into the UPS crew flight operations system about 0037 and 0106. Her activities between 0106 and her departure from SDF about 0326 are unknown; no sleep room was secured. The accident flight crew departed for RFD via PIA, arrived in RFD about 0553, and checked into the hotel in Rockford about 0601. A review of the hotel’s key swipe logs indicated that the first officer entered her hotel room about 0620. The first officer logged into the UPS crew flight operations system about 0642 and engaged in PED activity between 0645 and 0649. A break in PED activities occurred from 0649 to 1043. A member of the hotel staff reported speaking with the first officer in the hotel restaurant about 1100. PED activity stopped about 1148 and resumed from 1343 to 1705. Hotel key swipe logs indicated that the first officer reentered her room about 1522. PED activity resumed about 1827. The first officer spoke to her husband about 1915, and he said that it was a regular conversation and that she did not discuss how she was feeling or how she slept. The accident flight crew departed the hotel for the airport about 2006, and the first officer went on duty about 2036. PED activity resumed from 2106 to 2124, and, 10 min later, the flight crew departed RFD for SDF via PIA, arriving in SDF about 2357. Upon arrival in SDF, the flight crew took the shuttle to the air services center about 2358. The first officer logged into the crew flight operations system about 0009 on August 14 and checked in to a sleep room about 0011. She spoke to a colleague in the briefing room about 0020 before entering the sleep room about 0048. PED activity stopped about 0050. About 0241, closed circuit television footage showed the first officer exit the sleep room. The flight crewmembers took the shuttle to the airplane about 0306, and they pushed back from the gate at SDF about

1. The first officer’s preaccident activities are shown in figure 7.

36 AirUPSers.com is a website for UPS employees in the company’s flight district, particularly pilots, that features flight-related news and information and several job aids, such as route cards for international flights.

NTSB Aircraft Accident Report 18

1

2

3

4 Figure 7. First officer's preaccident activities. 5

NTSB Aircraft Accident Report 19 1.5.3 The Flight Dispatcher The flight dispatcher, age 53, was hired by UPS on June 4, 2012. According to UPS records, before being hired by UPS, the dispatcher had been employed as an independent consultant for Atlas Air Worldwide and Baltia Air Lines since 1998. During most of that time, the dispatcher was also the director and senior manager of flight dispatch operations at Atlas Worldwide Holdings. On his application for employment at UPS, the dispatcher stated that he left Atlas because of company layoffs. The dispatcher received his dispatcher training from Phoenix East Aviation in 1996. He held an FAA aircraft dispatcher certificate dated December 7, 2005.37 1.6 Aircraft Information 1.6.1 General Information The airplane was an Airbus A300 F4-622R that was built in 2004, registered to UPS, and held a transport-category airworthiness certificate dated March 24, 2004. Powered by two Pratt & Whitney PW4158 turbofan engines, the airplane was configured for cargo transport. It was equipped with two pilot seats and one observer seat in the cockpit and four forward-facing passenger jumpseats on the right side of the cabin just aft of the cockpit. According to the weight and balance form and the flight release information found on the accident airplane, the airplane’s estimated landing weight at BHM was about 291,577 lbs, including 34,650 lbs of fuel and 89,227 lbs of cargo. The airplane’s landing weight limit was 308,650 lbs. The forms also indicated that the airplane’s center of gravity was within limits. There were no unresolved maintenance discrepancies in the airplane’s maintenance records. 1.6.2 Airplane Components, Systems, and Records 1.6.2.1 Flight Management System, Flight Management Computer, and Control Display Unit The airplane was equipped with a flight management system, which provided automation of all the navigation and flight management tasks. The flight management system integrates the FMC with many aircraft subsystems. According to the Airbus Flight Crew Operating Manual (FCOM) and the UPS A300 Systems Manual, these subsystems are designed to allow the flight crew to select the desired level of automation and to help control the lateral and vertical flightpath of the aircraft. The FMC also performs optimization and in-flight fuel monitoring and predictions and, as a secondary function, provides data relative to the flight plan for display on the navigation display (ND) for orientation and situational awareness. The FMC combines flight plan information entered by the flight crew, information stored in the FMC database, and data received from the supporting flight management system

37 UPS dispatchers are certified under the provisions of 14 CFR 65.55, “Knowledge Requirements” and 14 CFR 65.57, “Experience or Training Requirements,” and qualified to dispatch under 14 CFR 121.463, “Aircraft Dispatcher Qualifications.”

NTSB Aircraft Accident Report 20 subsystems. The computer uses this information to calculate the airplane’s present position relative to the flightpath selected by the flight crew. With this information, the FMC calculates vertical and lateral guidance including thrust target and updates the navigation data, flight plan corrections, navigation adjustments, and thrust to maintain the aircraft on the flight plan. The primary crew interface with the FMC is through the mode control panel and two control display units (CDU) (see figures 8 and 9). The navigational information selected by the flight crew is displayed on two NDs and two CDU displays. The two CDU displays are located on each side of the pedestal in front of the throttle levers (see figure 9).38 (Source: Airbus A300 FCOM, section 1.03.12.) Figure 8. A300 mode control panel.39

38 For more information about the CDU, see Attachment 26: A300 Flight Management System of the Operations Group Chairman Factual Report in the public docket for this accident, which is available at www.ntsb.gov. 39 In the Airbus A300 FCOM, section 1.03.12, “Autoflight System AFS—Pilot Interface,” the panel is called the flight control unit. For consistency with UPS manuals and guidance, the term “mode control panel” is used in this report.

NTSB Aircraft Accident Report 21

(Source: UPS A300 Systems Manual, section 12.01.03, “CDU.”) Figure 9. A300 control display unit. An FMC mode40 can be armed or engaged by pressing the corresponding pushbutton on the mode control panel. If a mode is armed or engaged, pressing its pushbutton switch a second time disarms or disengages the mode. Turning a selector knob on the mode control panel clockwise increases the target value, and turning it counterclockwise decreases the target value. The pushbuttons include three green bars that illuminate green when the corresponding mode is armed and stay green when engaged. The two FMCs were recovered from the wreckage debris field. Data were recovered from one of the system’s mass memory cards, which contained information from both FMCs because the FMCs were set to dual operation. The following information, in part, was decoded from the downloaded data:  The flight plan showed a discontinuity between KBHM and COLIG, which would prohibit the engagement of a profile approach.41

40 Lateral and vertical (longitudinal) modes typically refer to the type of function that the autopilot/flight director system is controlling. 41 The flight plan was such that it prevented the engagement of the profile mode at this time.

NTSB Aircraft Accident Report 22  Neither the “profile mode armed” nor the “profile mode engage” bits42 were set when the power was lost.  Vertical and lateral navigation modes were not engaged when the FMC lost power. 1.6.2.2 Primary Flight Display and Navigation Display The UPS A300 uses two upper primary flight displays (PFDs) and two lower NDs to display most of the data needed for flightpath and navigation monitoring. One PFD/ND pair is located on each side of the cockpit for the captain and first officer (see figure 10). (Source: Airbus A300 FCOM, sections 1.10.20 and 1.15.24.) Figure 10. PFD (top screen) and ND (bottom screen).

42 The profile mode’s status is stored in the FMC nonvolatile memory as a logical state (a bit) when the profile mode is armed.

NTSB Aircraft Accident Report 23 The flight mode annunciator at the top of each PFD provides annunciation of the various autoflight system modes. The flight mode annunciator is divided into as many as five sections depending on the operational mode of the autoflight systems. Modes displayed in green are active, and modes displayed in blue are armed.43 The flight mode annunciator is the primary source of information to the crew regarding the status of the autoflight system, including the active and armed autothrust, autopilot, and flight director modes. Selected speed and altitude are indicated on the PFD, and selected heading is indicated on the ND. When immediate time constraints preclude making inputs to the FMC through the CDU, the mode control panel is the short-term interface between the flight crew and the flight management system. The flight crew can arm and engage guidance for vertical and lateral navigation, aircraft speed, and altitude through the mode control panel. The flight mode annunciator is the primary source for verification of the active and armed modes of the autopilot and flight director. 1.6.2.3 Mode Control Panel According to the UPS A300 AOM, when the autopilot is engaged, the PF should make all mode control panel mode selections except setting the altitude, which is done by the PM. The PF then manipulates the mode control panel to climb or descend to that new altitude. The AOM recommends verbalizing mode control panel changes to increase the PM’s situational awareness. The AOM further recommends that the PM make all mode control panel selections at the PF’s direction when the autopilot is not engaged and that the PM should repeat the PF’s commands to ensure that the proper command was executed. The primary method of making mode selections is using the associated mode control panel mode pushbutton switch. 1.6.2.4 Autopilot/Autothrottle Operation According to the UPS A300 AOM, when disengaging the autopilot or autothrottles, the PF must verbally state that the autopilot/autothrottles are being disengaged to ensure that both pilots are aware of the autoflight system status. It further stated, if the autopilot is not providing precise airplane control or maintaining the desired flightpath, the PF must immediately disconnect the autopilot and assume manual control of the airplane. After the airplane flightpath is stabilized, the autopilot may be reengaged if desired. 1.6.2.5 Enhanced Ground Proximity Warning System The airplane was equipped with a Honeywell EGPWS, which was installed in February 2004. The installation complied with 14 CFR 121.354, “Terrain Awareness and Warning System [TAWS],” pertinent technical standard orders (TSO), and supplemental type

43 For more information about flight mode annunciator mode indications, see Attachment 26: A300 Flight Management System of the Operations Group Chairman Factual Report in the public docket for this accident, which is available at www.ntsb.gov.

NTSB Aircraft Accident Report 24 certificates.44 The EGPWS provides two types of alerts: caution and warning.45 Caution alerts call attention to the aircraft state or presence of terrain but do not issue a command to the pilot; these alerts include “sink rate,” “don’t sink,” “too low terrain,” and “terrain ahead” alerts, among others. Warning alerts call attention to terrain or obstacles and also issue a command to the pilot; these alerts include the “pull up,” “terrain, terrain, pull up,” “terrain ahead, pull up,” and “obstacle ahead, pull up” alerts. Accident data showed that the EGPWS provided a “sink rate” caution alert at 0447:24.5 when the airplane was descending through about 250 ft agl at a vertical speed of about 1,500 fpm. The captain then reduced the airplane’s descent rate. About 8 seconds later, the CVR recorded the first sounds of the airplane impacting trees, and, 1 second later, the EGPWS provided a “too low terrain” caution alert. The investigation determined that a version of the Honeywell EGPWS software (part number 965-0976-003-218-218) newer than that used on the accident airplane improves the terrain clearance floor alert envelope46 and provides earlier alerts.47 Examination of the radio altitude relative to the distance to the runway threshold for the accident flight indicated that the newer EGPWS software would have provided a “too low terrain” caution alert about 6.5 seconds earlier and 150 ft higher than the EGPWS software installed in the airplane. However, because of the high descent rate of the airplane, simulator testing showed that the effectiveness of the terrain clearance floor envelope would be compromised, even with the newer EGPWS software. Simulator tests and a performance study were completed based on the new EGPWS software to determine if a response to the “too low terrain” caution alert would have enabled the pilots to avoid impacting the trees.48 Results showed that, if a pilot applied aggressive manual inputs to avoid terrain within 2.4 seconds of the alert or if a pilot pressed the automated takeoff/go-around switch on the throttles within 0.6 second of the alert, it was possible to avoid terrain.49 For additional information on UPS guidance on appropriate pilot responses to EGPWS alerts, see section 1.17.3.

44 The EGPWS model installed on the accident airplane was designed to provide terrain alerts to pilots based on a combination of airplane information (such as geographic position, attitude, altitude, and airspeed) and database information about terrain, obstacles, and the landing runway. The EGPWS used these inputs to predict a potential conflict between the airplane’s flightpath to the runway and terrain or obstacles and provided a visual and audio caution or warning alert if such a conflict was detected. 45 A caution alert has a lower priority than a warning alert. According to the UPS AOM, “All warning alerts require that the crew immediately perform the controlled-flight-into-terrain…recovery maneuver, except under the following conditions: the terrain alert occurs during day visual meteorological conditions, and the flight crew can immediately and unequivocally determine that terrain clearance is not a factor.” The UPS AOM further indicated, “When any GPWS/EGPWS alert is activated, regardless of its duration, or if a situation is encountered resulting in unacceptable flight toward terrain, take immediate and positive corrective action.” 46 The terrain clearance floor alert is a function of the airplane’s radio altitude and distance relative to the center of the nearest runway in the database. It enhances the basic EGPWS by alerting the pilot of descent below a defined “terrain clearance floor” regardless of the aircraft configuration. 47 On July 30, 2014, the UPS party representative stated that the EGPWS software on UPS airplanes will be upgraded to the newer version. 48 Performance data also showed that had the captain performed the controlled-flight-into-terrain-avoidance maneuver or a go-around in response to the “sink rate” alert, the airplane could have avoided terrain. 49 These times are measured from the time the alert sounds to the time the pilot decides to take action (perception/reaction time); therefore, they account for the time it takes for the pilot to decide to act and then move his or her hands to the appropriate controls (for example, to advance the throttles manually or to press the takeoff/go-around switches).

NTSB Aircraft Accident Report 25 To reduce nuisance alerts, some Honeywell EGPWS alert modes are desensitized when the airplane is in landing configuration or within 2 miles of the airport. For example, the Mode 2 “Excessive Terrain Closure Rate” alert envelope50 is smaller when the airplane is configured for landing and when descent rates are higher. The radio altimeter data are also filtered to eliminate nuisance warnings, which further reduces the envelope. Also, the EGPWS terrain look-ahead alert mode is desensitized because nuisance alerts would occur due to technology limitations.51 Because of these factors, no Mode 2 or terrain look-ahead alerts were generated for the accident flight. Additionally, the EGPWS on the accident airplane was manufactured in accordance with TSO-C151A, issued in 1999, which included a requirement for a 500-ft callout capability. The TSO was revised in 2012 (TSO-151C ) and emphasized that TAWS equipment must provide a 500-ft voice callout when the airplane descends to 500 ft above the terrain or nearest runway elevation. The EGPWS was capable of producing the callout, but the 500-ft callout had not been activated on the accident airplane. An Airbus standard is to use the flight warning computer (FWC) for callouts in lieu of the EGPWS callouts, but operators may implement any Honeywell EGPWS altitude/height callouts at their discretion. 1.6.2.6 Altitude Callouts On the Airbus A300, many operators use a 400-ft callout generated by the FWC in lieu of the EGPWS 500-ft callout. Airbus also offers its customers the option of an automated height-above-touchdown callout of “minimums”52 intended to activate when an airplane flying a nonprecision approach reaches the pilot-entered minimum descent altitude. However, UPS did not have these callouts activated on its A300 fleet. If activated, an automated aural “approaching minimums” alert would have sounded at 0447:17, which was 20.8 seconds before impact. An automated 500-ft callout would have sounded at 0447:14, about 18.5 seconds before impact. Additionally, the aural “minimum” alert would have sounded at 0447:16, about 16.5 seconds before impact (the 400-ft callout also would have activated about this time). 1.6.2.7 Flight Crew/System Interaction During an Instrument Approach Nonprecision Approaches An instrument approach procedure defines a three-dimensional trajectory that will guide an aircraft from the en route airspace structure down to a point where a pilot can accomplish a landing using visual references outside the airplane. The pilot can guide the airplane along this trajectory solely by reference to the airplane’s instruments and displays so that outside visual references are not required until the end of the trajectory is reached. At the end of the trajectory

50 The Mode 2 “Terrain Closure Rate” alert provides alerts to help protect the airplane from impacting the ground when the EGPWS detects that the airplane is rapidly approaching terrain. 51 The terrain look-ahead alert mode provides the ability to look ahead of the airplane and detect terrain or obstacle conflicts to provide greater alerting time. This is accomplished based on airplane position, flightpath angle, track, and speed relative to the terrain forward of the airplane contained in the terrain database. Within close proximity to the ground, small errors in the airplane’s position and in the terrain database are accentuated, thus creating nuisance alerts. 52 It is standard UPS operating procedure on nonprecision approaches for the PM to announce “approaching minimums” at 100 ft above the minimum descent altitude and “minimums” at the minimum descent altitude.

NTSB Aircraft Accident Report 26 (called the “missed approach point”), the pilot must decide to either land (if the runway environment has been visually acquired and the airplane is in the proper configuration and state for landing) or, if these conditions are not met, perform the missed-approach procedure. If the autopilot is used to fly the approach and/or missed-approach procedures, the pilot must still monitor the airplane’s instruments to ensure that the desired trajectories are being followed. During a nonprecision approach, the pilot uses the barometric altimeter to ensure that the airplane is at or above the minimum altitude defined between approach fixes; once a fix is crossed, the pilot can “step down” to the lower minimum altitude. The “minimum descent altitude” for the approach is the lowest altitude to which the airplane may descend before reaching the missed approach point. Once past the final step-down fix, an aircraft may descend to the minimum descent altitude but no lower. If the pilot can then see the runway environment before reaching the missed approach point and believes a landing can be accomplished, he or she can descend below the minimum descent altitude and attempt the landing. If the pilot does not see the runway environment, the airplane must remain at or above the minimum descent altitude and, upon reaching the missed approach point, the pilot must execute the missed-approach procedure. Lateral and Vertical Path Guidance on Final Approach When the airplane is aligned with the runway heading and approaching the runway during final approach, both precision and nonprecision approaches provide lateral guidance information that the airplane’s systems use to display to the pilot the airplane’s position to the left or right of the desired track (that is, its “lateral deviation”). This guidance information can be ground-based (such as the localizer beam used for the BHM runway 18 localizer approach) or GPS-based (as used for the various RNAV approaches to the runways at BHM). Whether ground- or GPS-based, the lateral deviation information is presented to the pilot as a horizontal scale with a vertical diamond. The position of the diamond indicates the position of the desired track relative to the airplane. Thus, if the diamond is in the center of the horizontal scale, the airplane is on the desired track; if the diamond is to the left of center, the airplane is to the right of the desired track and must correct to the left. If the diamond is on the left or right limit of the scale, it is at “full deflection” or “pegged.” A pegged diamond indicates that the airplane is far off course but does not provide a measure of exactly how far; a deviation that is just large enough to peg the diamond appears as half a diamond. Precision approaches also provide ground-based vertical guidance information used by the airplane’s systems to display the airplane’s position above or below the desired glidepath to the touchdown point. This vertical guidance is typically an instrument landing system (ILS) glideslope, and the airplane’s position relative to the glideslope is presented to the pilot as a vertical scale with a horizontal needle (the glideslope diamond). The position of the diamond indicates the vertical position of the glideslope relative to the airplane. When flying a precision approach, a primary task of both pilots is to constantly scan the horizontal and vertical deviation and make immediate corrections to keep the airplane centered on the desired lateral and vertical flightpaths. For many operators, large lateral or vertical deviations on final approach are considered indicators of an unstabilized approach and serve as triggers for executing the missed-approach procedure.

NTSB Aircraft Accident Report 27 When flying a nonprecision approach with vertical guidance, a primary task of both pilots is to constantly cross-check the vertical deviation diamond on the vertical scale to ensure that the airplane remains on the flightpath. In the case of a localizer approach with a vertical guidance, the pilot must also make flightpath corrections as necessary to keep the lateral and vertical deviation diamonds centered. “Dive and Drive” Final Approach Technique As mentioned earlier, nonprecision approaches do not provide ground-based vertical guidance information, and some, such as localizer approaches and some RNAV approaches also do not provide GPS-based vertical guidance.53 For these approaches, there is no source of information from outside the airplane (such as a glideslope or GPS signal) that can be used to determine the airplane’s position relative to the desired glidepath or display any deviation from that glidepath to the pilot. Instead, vertical guidance is provided via altitude step-down fixes depicted on the approach chart, and the pilot uses navigation aids and the barometric altimeter to stay at or above the minimum altitude at each step. Consequently, nonprecision approaches can result in variations in the airplane’s descent rate and flightpath angle between the FAF and the runway, as the pilot levels off between step-down fixes and then resumes the descent after reaching the next step-down fix. For example, for the BHM localizer 18 approach, if an airplane descended at a flightpath angle steeper than 3.28° after passing BASKN, the airplane would reach an altitude of 1,380 ft before reaching the IMTOY stepdown fix and would have to level off at 1,380 ft until passing IMTOY. Then the pilot could resume the descent to the minimum descent altitude of 1,200 ft. If the airplane descended to 1,200 ft before reaching the missed approach point, the pilot would have to again level the airplane at 1,200 ft, looking for the runway while approaching the missed approach point. If the pilot saw the runway before reaching the missed approach point, the airplane could then descend once again, and the pilot could attempt the landing. This stair-step approach to the runway is commonly referred to as a “dive and drive” technique. According to Advisory Circular (AC) 120-108, “Continuous Descent Final Approach [CDFA]” guidance, “Stepdowns flown without a constant descent will require multiple thrust, pitch, and altitude adjustments inside the final approach fix (FAF). These adjustments increase pilot workload and potential errors during a critical phase of flight.” Continuous Descent Final Approach Technique and Stabilized Approaches The CDFA technique (or constant-angle-of-descent technique) is a specific technique for flying the final approach segment of a nonprecision instrument approach as a continuous descent, without level-off, from an altitude/height at or above the FAF minimum crossing altitude/height to a point about 50 ft (15 meters) above the landing runway threshold or the point where the flare maneuver should begin for the type of aircraft flown. The National Transportation Safety Board (NTSB) has long been a proponent of the CDFA technique for nonprecision approaches and of promoting pilot proficiency in conducting

53 Some RNAV approaches do provide GPS-based vertical guidance information. For these approaches, the vertical deviation from the desired glidepath to the runway is presented to the pilot in much the same way as glideslope deviation information is presented for an ILS approach.

NTSB Aircraft Accident Report 28 nonprecision approaches. After investigating numerous accidents related to nonprecision approaches (NTSB 1991, 1996, 2000),54 the NTSB noted that the complexity of such approaches and the absence of precise vertical guidance create more demands on pilot skills and cognitive performance than precision approaches. Additionally, pilots have less opportunity to conduct nonprecision approaches. As a result, on January 27, 2000, the NTSB issued Safety Recommendation A-00-11, which asked the FAA to do the following: Issue guidance to air carriers to ensure that pilots periodically perform nonprecision approaches during line operations in daytime visual conditions in which such a practice would not add a risk factor. On August 21, 2001, the FAA responded that it had developed an industry-wide strategy that focused on stabilized approaches, including always using a constant angle of descent, for all nonprecision approaches. The FAA issued general guidance regarding stabilized approaches in AC 120-71 and through Flight Standards Information Bulletins for Air Transportation 00-08, 99-08, and 00-18. On January 23, 2002, the NTSB indicated that the use of a constant-angle-of-descent stabilized approach profile when conducting nonprecision approaches eliminated the need for flight crews to periodically perform nonprecision approaches during line operations. Consequently, the NTSB determined that the FAA’s issuance of this guidance material addressed Safety Recommendation A-00-11 through alternate actions and classified Safety Recommendation A-00-11 “Closed—Acceptable Alternate Action.” In 2004, near Kirksville, Missouri, the pilots of Corporate Airlines flight 5966 failed to follow established standard procedures during a nonprecision approach at night in IMC, including their descent below the minimum descent altitude before required visual cues were available, which continued until the airplane struck the trees (NTSB 2006). The NTSB concluded that the use of a constant-angle-of-descent approach technique, with its resultant stabilized, moderate rate-of-descent flightpath and obstacle approach clearance, would have better positioned the accident airplane for a successful approach and landing. Therefore, the NTSB issued Safety Recommendation A-06-8, which asked the FAA to do the following: Require all 14 Code of Federal Regulations Part 121 and 135 operators to incorporate the constant-angle-of-descent technique into nonprecision approach procedures and to emphasize the preference for that technique where practicable. On May 21, 2009, the FAA issued Safety Alert for Operators (SAFO) 09011, which recommended that 14 CFR Part 121 and 135 operators always use a constant-angle-of-descent stabilized approach technique when conducting nonprecision approaches. On January 12, 2009, and May 20, 2011, the FAA published a notice of proposed rulemaking and a supplemental notice of proposed rulemaking (SNPRM), respectively, titled “Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers,” which proposed a requirement for 14 CFR Part 121

54 The NTSB found similar nonprecision approach-related factors in the Aeronautica Civil, Republica de Colombia investigation of the 1995 accident involving an American Airlines Boeing 757 on a nonprecision approach to Cali, Colombia; and the 1989 accident investigated by the Malaysia Department of Civil Aviation involving a Flying Tigers Boeing 747 that crashed while performing a nonprecision approach to Kuala Lumpur, Malaysia.

NTSB Aircraft Accident Report 29 operators to train and incorporate the constant-angle-of-descent technique into their nonprecision approach procedures. On November 14, 2012, the NTSB indicated that it agreed with the FAA that the SNPRM (if it resulted in a satisfactory final rule) satisfied this safety recommendation with regard to Part 121 operators and that SAFO 09011 satisfied the recommendation with regard to Part 135 operators. Therefore, pending the issuance of a final rule as described in the SNPRM and a review of information confirming that SAFO 09011 has been widely adopted by the Part 135 community, the NTSB classified Safety Recommendation A-06-8 “Open–Acceptable Alternate Response.” However, the final rule, which was published on November 12, 2013, did not contain any requirements regarding nonprecision approach techniques. On January 20, 2011, the FAA issued AC 120-108, “Continuous Descent Final Approach,” to promote the technique of a stable continuous descent path to the minimum descent altitude in lieu of the traditional “dive and drive”55 type of nonprecision approach; however, an AC is not mandatory and only provides guidance. According to AC 120-108, the CDFA operating concept is to fly nonprecision instrument approaches at a continuous descent rate maintaining the published nominal vertical profile using basic piloting techniques, aircraft flight management system and RNAV systems. They can use altitude-versus-range points defined by a distance measuring equipment fix, crossing radial, or GPS distance from the runway on the approach plate to track their progress along both the lateral and vertical approach paths to the missed approach point. The most critical aspect of CDFA is that when a missed approach is conducted, the pilot executes a missed approach at the minimum descent altitude plus an additive buffer altitude (to prevent descent below minimum descent altitude) instead of leveling off at the minimum descent altitude. The AC also states that, based on near-term safety benefits (such as controlled flight into terrain [CFIT] reduction) of using stabilized approach criteria on a continuous descent with a constant, predetermined vertical path to the runway and the desire to move to three-dimensional operations where possible, operators have indicated their intent to apply the CDFA technique to nonprecision instrument approaches. The A300 Profile Final Approach Mode The Profile Final Approach mode (“profile mode”) on the A300 autopilot flight director system approximates a CDFA. It uses the airplane’s FMC to compute a desired glidepath extending from a point above the runway threshold56 along the approach course and displays the airplane’s vertical deviation from this glidepath to the pilot using a vertical scale and diamond (the vertical deviation indicator [VDI]). The UPS A300 PTG, section 02.04.01.01, “Non-Precision Approaches—General,” outlines the advantages of the profile mode over a “dive-and-drive” technique for conducting nonprecision approaches, stating, in part, the following: Executing a nonprecision instrument approach is one of the most demanding tasks placed on a flight crew. The safe execution of nonprecision approaches places increased challenges on the aircrew in the areas of:

55 The AC describes the “dive and drive” concept as a situation in which an aircraft remains “at the minimum descent altitude until descending for the runway or reaching the missed approach point.” 56 Typically, the height of this point above the runway is the threshold crossing height.

NTSB Aircraft Accident Report 30  Strategy and decision making  Crew coordination (monitoring and callouts)  CFIT awareness (responses) Nonprecision approaches may be flown either using the VNAV guidance (Profile Approach Mode) or a conventional manner using Vertical Speed (V/S Approaches). If available, a Profile Approach is highly recommended over a V/S approach due to having VNAV guidance. The VNAV guidance referred to in the training guide is the VDI, which includes a scale and an indicator57 that shows the airplane’s vertical position relative to the desired glidepath. The VDI appears on the right side of each crewmember’s ND. Like the glideslope diamond on an ILS approach, the VDI is the primary source of information about the airplane’s vertical position relative to the desired glidepath for a profile mode approach. Consequently, a critical task of the PF and PM when flying a profile mode approach is to constantly scan and monitor the VDI to ensure that the airplane remains centered on the desired glidepath. When the profile approach is set up properly, the airplane should be navigating along the extended runway centerline toward the threshold, and the sum of the remaining navigation legs should equal the straight-line path over the ground between the airplane and the threshold. When this occurs, the computed height of the desired glidepath will be correct, and the VDI will correctly display any vertical deviations from this glidepath.58 On the accident flight, however, the first officer, who was the PM, did not set up the profile approach correctly in the FMC because the direct navigation leg to KBHM remained active when it should have been removed. Consequently, the sum of the remaining navigation legs in the FMC was unrealistically long, and the computed height of the desired glidepath was unrealistically high. In addition, a flight plan discontinuity59 was introduced in the FMC. One of the steps in properly setting up a profile approach is for the PM to remove unnecessary navigation legs from the FMC to prevent flight plan discontinuities, such as the one that occurred on the accident flight. The navigation waypoints were set up in the FMC as KBHM followed by a flight plan discontinuity, then the COLIG initial approach fix, the BASKN FAF, and the runway threshold. The flight plan discontinuity was built by the FMC when the approach was entered into the FMC to prevent the autopilot from navigating beyond KBHM in the flight plan. Once a flight is no longer navigating via the flight plan in the FMC (that is, when the accident flight received a heading away from the direct-to-KBHM navigational leg to intercept the localizer), UPS guidance recommends clearing the flight plan discontinuity by removing the waypoints that are no longer valid so that the flight plan reflects only the waypoints for the approach to be flown.

57 This indicator is referred to as the “football” by UPS and is referred to as a diamond throughout this report. 58 The glidepath constructed by the FMC extends backwards from the runway threshold indefinitely; hence, as long as the airplane is on the extended runway centerline, it does not have to be on an FMC navigation leg for the glidepath height and VDI indications to be correct. 59 The Airbus FCOM Volume 1, page 1.19.20, defines a discontinuity as a break in the lateral flight plan where two successive path terminations (waypoints/navigation aids) are disconnected.

NTSB Aircraft Accident Report 31 The improper setup of the flight plan introduced a longer computed distance between the airplane’s current position and the runway threshold. While the display was correct based on the geometry that was computed in the FMC as a result of the crew’s omissions, it was not an accurate display for the actual position of the airplane relative to the glidepath. This meaningless longer distance, in turn, resulted in a higher altitude from the FMC-generated glidepath compared to what would have been computed had the flight plan been entered correctly. Consequently, from about 0444:17 (when the airplane was about 11.6 nm from the threshold) onward, the VDI was pegged on the upper limit of the scale, indicating that the airplane was well below the FMC-generated glidepath. UPS required the use of the autopilot or flight director and autothrust systems when conducting profile mode approaches. However, because the flight crew did not verify that the flight plan was sequenced, the autopilot could not engage in profile mode. Activating Final Approach For the A300 to fly a profile path to a decision altitude, the UPS A300 PTG indicates that the pilot must first select the approach in the CDU and insert the applicable decision altitude/minimum descent altitude (in the case of the BHM LOC 18 approach, this value would be 1,200 ft) into the minimum descent altitude field with the 5 right button, and then line select the 6 right button on the Approach page to activate the approach. In the case of the BHM LOC 18 approach, by selecting the 6 right button, the Approach page title would change from APPROACH to FINAL APPROACH 3.360 (see figure 11). The pilot would then push the profile button on the mode control panel to arm the profile mode to intercept the profile path.

60 The BHM localizer 18 approach called for a 3.28º VNAV [profile] path angle from the BASKN FAF to the threshold crossing height of the runway. The A300 is allowed to fly the VNAV path from within .1º difference between the FMC-generated path angle and the charted path angle.

NTSB Aircraft Accident Report 32 Figure 11. Photographs of an A300 CDU before and after activating final approach mode. Vertical deviation (shown as VDEV in figure 11) is displayed on the CDU’s APPROACH and PROG pages in digital format and depicted on each ND VDI, where one dot equals 100 ft (200 ft full-scale deflection) (see figure 12). Once final approach mode is activated, the profile path computation changes from performance descent mode to final approach mode.

NTSB Aircraft Accident Report 33 Figure 12. Photograph of the VDI diamond depicted on the ND display and indicated by a white arrow. 1.7 Meteorological Information 1.7.1 Local Weather Information The National Weather Service (NWS) Surface Analysis Chart for 0400 on August 14 depicted a stationary front immediately north of the Birmingham area with a weak pressure gradient over the area. The 0247 terminal aerodrome forecast issued by the NWS for BHM was included in the flight crew’s flight briefing package. For the time period encompassing the

NTSB Aircraft Accident Report 34 flight’s estimated time of arrival, the terminal aerodrome forecast called for variable wind at 3 knots, greater than 6 statute mi visibility, and a ceiling broken at 400 ft agl. The observations at the time the forecast was prepared indicated that ceilings of 400 ft were occurring at BHM. Other weather reporting locations in the immediate area reported ceilings as low as 200 ft during the period. In the hours leading up to the accident, METAR remarks data showed the ceiling and the variability of the ceiling changing hourly. The normally scheduled BHM meteorological aerodrome report (METAR) at 0353 indicated calm wind, visibility unrestricted at 10 mi, a ceiling broken at 1,000 ft agl, overcast at 7,500 ft, temperature 23° C, dew point 22° C, and altimeter 29.97 in of mercury. Remarks from the observation indicated a variable ceiling from 600 to 1,300 ft agl. After 0400, the BHM automated surface observing system (ASOS) at the airport reported ceilings improving over the airport with a variable ceiling between 700 to 1,100 ft agl. The aircraft communication addressing and reporting system (ACARS) provided the flight crew with en route updates that showed the ASOS observation and METARs with ceilings broken to overcast at 800 to 1,000 ft. The METAR remarks of variable ceilings of 600 to 1,300 ft were not provided due to specifications by UPS to its weather service provider. A special weather observation (SPECI) was issued61 at 0404 and reported calm wind, visibility 10 mi, scattered clouds at 1,000 ft agl, ceiling broken at 7,500 ft, temperature 23° C, dew point 22° C, and an altimeter of 29.96 in of mercury. Variable ceilings were no longer being reported. The SPECI information was not uplinked to the flight crew via ACARS because they did not request it. The BHM ATIS recordings were manually prepared by the controllers in the BHM air traffic control tower (ATCT). To accomplish this, controllers reviewed METAR information shown on the ASOS display and, along with other information appropriate to an ATIS transmission, manually recorded each ATIS broadcast. The pilots received ATIS information Papa, which was current at the time of the accident, and was prepared based on the 0353 METAR observation; but, it did not include the information from the remarks section about the observed ceiling being variable between 600 and 1,300 ft agl because the air traffic controller did not append the remarks to the broadcast. Although the air traffic controller was aware of the 0404 SPECI, he chose not to update the ATIS, and it retained the lower ceilings observed in the 0353 observation (broken instead of scattered clouds at 1,000 ft). FAA Order JO7110.65, “Air Traffic Control,” paragraph 2-9-3a, states that the following elements should be included in an ATIS broadcast: Airport/facility name, phonetic letter code, time of weather sequence (coordinated universal time). Weather information consisting of wind direction and velocity, visibility, obstructions to vision, present weather, sky condition, temperature, dew point, altimeter, a density altitude advisory when appropriate and other pertinent remarks included in the official weather observation.

61 The SPECI was issued due to a change in the ceiling height over the airport sensors, from a ceiling broken at 1,000 feet agl to scattered clouds.

NTSB Aircraft Accident Report 35 NWS Federal Meteorological Handbook No. 1—Surface Weather Observations and Reports covers the coding of the METAR remarks section and is more specific about what should be included. The handbook indicates that remarks should be included in all reports, if appropriate. Present weather coded in the body of the report may be further described through remarks, noting cloud cover direction from the station or distant weather observed. Movement of clouds or weather may also be coded in the remarks section of the report. Numerous remarks generally elaborate on parameters reported in the main body of the report. These can include peak wind, variable ceiling height, thunderstorm location and movement, beginning and ending of precipitation and thunderstorms, and wind shift or frontal passage and time of occurrence. FAA Order JO7110.65, paragraph 2-9-2a, requires that ATC make a new ATIS recording upon receipt of any new official weather regardless of whether there is or is not a change in values. Birmingham Tower Standard Operating Procedures, BHM Order 7232.3 J, paragraph 2-2-4J1a, directs that a new ATIS recording be made with the receipt of new official weather regardless of whether a change is involved. 1.7.2 UPS Weather Sources and Information In 2004, UPS flight control department dispatchers began using the Lufthansa Systems Lido Operations Center flight-planning system62 to calculate the most efficient route between two points based on weather, wind, terrain, and other factors. When Lido was originally deployed at UPS, the inclusion of the remarks data from the North American METARs was required, along with the weather. In late 2010, the UPS flight control department adopted updated dispatcher workflows regarding use of the Lido in-flight monitoring tool. This tool monitored the weather information coming into the system and provided an alerting mechanism for the dispatcher. After adopting the new workflow, it became apparent that duplicate METAR data streams63 also resulted in duplicate weather alerts for all potentially relevant airports, which affected dispatcher and pilot workload. In March 2011, the UPS flight control standards group requested that Lido be modified so that the remarks were removed from METAR messages. In response to UPS’s request, Lido discontinued sending the remarks data from METARs to populate the flight departure papers and ACARS effective in September 2011. According to UPS, although the UPS flight control standards group for the dispatchers was aware that the remarks data were no longer provided to the pilots, information regarding the change was not communicated to UPS pilots; further, UPS’s director of flight operations told the NTSB that he was unaware that the METAR remarks had been removed. Although UPS pilots could access an online source that included METARs with remarks before departure, pilots would not have access to online sources after departure and would have to directly request such information from the dispatcher.

62 UPS is currently the only US air carrier using the Lido system, which consolidated multiple applications into a single system. According to the UPS flight-planning support manager, before the Lido flight-planning system, UPS dispatchers had to rely on a variety of other systems and business applications to perform their work planning and flight dispatch. 63 METAR data streams are obtained from multiple sources through the Weather Message Switching Center. The UPS Lido system used a weather feed from the London World Area Forecast Center and Washington Internet File Service as its source of weather information.

NTSB Aircraft Accident Report 36 1.8 Aids to Navigation No problems with any navigational aids were reported. 1.9 Communications No communications equipment problems related to the accident were reported. 1.10 Airport Information 1.10.1 General Airport Information BHM is located about 4 mi northeast of Birmingham, Alabama, at a field elevation of 650 ft msl. BHM has two runways: runway 06/24 and runway 18/36. Runway 06/24, the primary runway for air carrier use, was 11,998 ft long and 150 ft wide and was equipped for precision instrument approaches for landing in both directions. However, at the time of the accident, a one-time NOTAM had been issued noting that runway 06/24 was closed between 0400 and 0500 for maintenance of runway edge lights related to an ongoing runway repair and obstruction removal project.64 Therefore, at the time of the accident, runway 18/36 was the only runway open and in use. Runway 18/36 is 7,099 ft long and 150 ft wide and is equipped for nonprecision localizer approaches and nonprecision RNAV GPS approaches for landing on runway 18, as well as a nonprecision RNAV GPS approach to runway 36, but the approach to runway 36 was not authorized at night. 1.10.2 Precision Approach Path Indicator Information A four-unit precision approach path indicator (PAPI) system was installed on the left side of runway 18, 1,166 ft beyond the runway threshold.65 The PAPI for runway 18 was set to project a glidepath of 3.2° to accommodate the rising terrain off the approach end of the runway. The published threshold crossing height was 48 ft. Ground tests of the PAPI on May 8, 2013, and after the accident on the morning of August 14, 2013, found that the PAPI was adjusted correctly. A postaccident flight check of the PAPI conducted by the FAA on August 16, 2013, indicated that it was functioning properly and within specifications. A postaccident airplane performance study showed that, because the pilots did not report the runway in sight until they were descending through about 900 ft msl (250 ft above airport elevation), the PAPI indications would have been visible for less than 1 second before becoming obscured by rising terrain.

64 Runway 06/24 was reopened after the accident about 0455. 65 The PAPI system for runway 18 consists of a row of four light units installed on the side of the runway that provide visual glidepath indications. The on-glidepath angle (typically about 3°) indication is two red and two white lights. Other light combinations indicate when an airplane’s position is above the glidepath (four white), slightly above (three white and one red), slightly below (three red and one white), and below (four red). According to the FAA’s Aeronautical Information Manual, PAPI lights are visible from about 5 mi during the day and up to 20 mi at night.

NTSB Aircraft Accident Report 37 1.11 Flight Recorders 1.11.1 Cockpit Voice Recorder The accident airplane was equipped with a solid-state L-3/Fairchild FA2100-1020 CVR designed to record the most recent 2 hours of cockpit audio information. Specifically, it contains a 2-channel recording of the last 2 hours of operation and separately contains a 4-channel recording of the last 30 min of operation.66 Although the CVR exhibited significant heat and minor structural damage, the circuit boards in the memory module were undamaged, and data were successfully downloaded. The CVR’s 2-hour recording contained good quality audio information on both channels; the 30-minute recording contained excellent-to-good quality audio information on three channels.67 When the recording began, a different flight crew was flying the accident airplane from Benito Juárez International Airport, Mexico City, Mexico, to SDF, where the accident pilots began the flight to BHM. A full transcript was prepared for the accident flight and is provided in appendix B. 1.11.2 Flight Data Recorder The airplane was equipped with an L-3/Fairchild FA2100 FDR, which recorded flight information in a digital format using solid-state flash memory as the recording medium. Although the FDR exhibited significant heat and minor structural damage, the circuit boards in the memory module were undamaged, and data were successfully downloaded. The FDR contained about 70.4 hours of data. The accident flight duration was about 46 min. The parameters evaluated were in accordance with the federal FDR carriage requirements, except the recording of the first officer’s input control force, which recorded a “no computed data” pattern for the duration of the flight. According to UPS, the failure of this parameter is common in their A300 fleet; the parameter was functional at the airplane’s last maintenance check and had not yet been detected by its maintenance program. 1.12 Wreckage and Impact Information An aerial survey of the airplane’s flightpath identified the initial point of impact as a tree strike in a forested area about 6,387 ft north of the runway 18 threshold. Ground scars indicated that the airplane first contacted downsloping terrain in a large gulley about 1,365 ft beyond the initial tree strike. The airplane was destroyed, and the debris field extended down to the bottom of the gulley and up the south side about 2,760 ft south of the initial tree impact. Two major portions of wreckage were found in the main debris field. The forward fuselage was located about 4,061 ft from the runway 18 threshold on the top of the southern ridge of the gulley and was displaced slightly to the left side of the main debris field as viewed

66 The fourth channel was configured to record an observer pilot, and, on the accident flight, this channel did not contain any information that was not on the other three channels. 67 The NTSB uses the following categories to classify the levels of CVR recording quality: excellent, good, fair, poor, and unusable. A good quality recording is one in which most of the flight crew conversations could be accurately and easily understood.

NTSB Aircraft Accident Report 38 along the intended flightpath to the runway (see figures 13 and 14). The aft fuselage, including the tail section, right wing, and inboard portions of the left wing, were located farther forward, about 3,629 ft from the runway 18 threshold on the downsloping terrain to the runway. The two engines were located within 25 ft of each other about 171 ft west-northwest of the forward fuselage. Figure 13. Photograph of the left side of the forward fuselage.

NTSB Aircraft Accident Report 39 Figure 14. Photograph of the right side of the forward fuselage. Postaccident examination of the wreckage path revealed extensive ground scarring and a distinct fuel odor from the initial ground impact throughout the debris field. Several pieces of left wing structure were embedded in the dirt starting at the initial ground impact. The first evidence of fire began about 4,636 ft from the runway threshold and continued all the way to the aft fuselage section. An extensive postcrash fire consumed most of the aft fuselage of the airplane (see figure 15 for a photograph of the aft fuselage and the right wing wreckage). No evidence of fire was found on the forward fuselage section. The entire airplane was accounted for at the accident site. Postaccident examination of both engines revealed no evidence of uncontainment or preimpact fire.

NTSB Aircraft Accident Report 40 Figure 15. Photograph of the aft fuselage and the right wing wreckage, with runway 18 in the distance. 1.13 Medical and Pathological Information Toxicological analyses performed on fluid and tissue specimens from both pilots by the FAA’s Civil Aerospace Medical Institute did not detect the presence of carbon monoxide, ethanol, or any of an extensive list of over-the-counter, prescription, and illicit drugs. 1.14 Fire A postcrash fire occurred, largely affecting the aft fuselage and wings. No evidence of fire was found in or around the forward portion of the fuselage. 1.15 Survival Aspects Both pilots were fatally injured during the impact sequence. The Jefferson County Coroner/Medical Examiner’s Office determined the cause of death for both flight crewmembers was blunt force injuries and provided photographs that showed that, before the pilots were removed from their respective seats, they were wearing their seat restraints, including shoulder harnesses.

NTSB Aircraft Accident Report 41 1.15.1 Airport Emergency Response The accident site was about 1.2 mi north of the runway and on property owned by the airport but outside of the airport operations area and beyond the airport perimeter fence. The local air traffic controller activated the crash phone at 0449:22, about 1 min 17 seconds after observing the accident.68 When interviewed, the local air traffic controller said that the notification call was delayed because he was not immediately able to determine exactly where the airplane had crashed (on or off airport property) and did not know whether to notify ARFF or to call 911 (procedures required that ARFF be contacted on all accidents on or near the airport). Further, he had difficulty locating the button needed to activate the crash phone circuit on the enhanced terminal voice switch (ETVS)69 display panel because the system had been reconfigured to accommodate consolidation of the ATCT and terminal radar approach control (TRACON) functions for the midnight shift. The reconfiguration resulted in various selection buttons on the ETVS display appearing in different positions during day and evening operations. The local air traffic controller scrolled through several pages of frequency information before locating the correct button, which was on the first page of the information but in a different location than the daytime configuration. After the accident, the ATCT and TRACON changed their procedures to ensure that the location of the crash phone buttons remained unchanged regardless of facility status or shift. When the crash phone notification was made, the phones at all four airport emergency response locations rang simultaneously. After the first person picked up the phone, all phones stopped ringing. The firefighter answering the phone at the ARFF station only heard half a ring. When he picked up the phone, the air traffic controller had already begun to describe the nature and location of the emergency. ARFF personnel acknowledged the notification but missed the initial part of the call. Consequently, ARFF personnel did not know that the airplane had crashed and believed that it was still inbound. Due to the miscommunication, when the ARFF units responded about 0453, they initially intended to go to their airport standby positions instead of proceeding to the accident site. After leaving the fire station, ARFF crews contacted the controller to get clearance to enter the movement area and additional information; they were told the nature of the emergency and the location of the accident site. Although emergency response personnel were initially given incomplete information about the accident location, they received corrected information en route to the site and noted that the initial error did not delay their arrival. After the accident, the BHM airport authority addressed the emergency response issue with all parties and reiterated the correct communications procedures for aircraft accident and incident notification. The airport authority also issued procedures indicating that parties on the crash phone circuit are to answer the crash phone immediately after it stops ringing or after

68 The BHM ATC facility is an FAA level 8 facility that operates 24 hours a day, 7 days a week, comprising an ATCT and terminal radar approach control (TRACON). At the time of the accident, during the midnight shift ATCT provided TRACON services, which required certain TRACON capabilities to be transferred to the tower. This included radio frequencies on the enhanced terminal voice switch and reconfiguration of the tower radar display. 69 The BHM ATCT is equipped with an ETVS communications system that provides access to various communications circuits, including the airport crash phone, which is the primary method for immediate notification to the airport’s first responders of an accident or incident located on or near the airport. The crash phone circuit connects the ATCT, ARFF station, Air National Guard operations, the Kaiser/Pemco maintenance facility, and the BHM airport authority operations office.

NTSB Aircraft Accident Report 42 counting to three to ensure that all parties hear the ring, and ARFF has opportunity to join the line as quickly as possible. Additionally, the airport authority has installed a computer-controlled crash phone circuit that will not cause phones at other stations on the circuit to stop ringing if a party on the circuit answers the phone. 1.16 Tests and Research 1.16.1 Flight Simulation The NTSB conducted simulator testing in an A300 simulator at the UPS training facility on December 4, 2013. During the testing, NTSB investigators entered the accident airplane’s decoded flight plan data and the BHM localizer 18 approach into the simulator FMC. The accident flight was simulated from 280 nm north of BHM to the point of impact. The flight plan was consistent with the flight crew navigating directly to KBHM. The localizer 18 approach did not have a feeder route from KBHM; the last waypoint in the active flight plan that the airplane flew while navigating directly to BHM was KBHM. As a result, a F-PLN DISCONTINUITY was created before the first waypoint (COLIG) of the approach and was visible on each of the simulators CDUs (see figure 16). The ND also showed the active routing (directly to KBHM) and the approach routing, as entered in the FMC, with the F-PLN DISCONTINUITY still in the active flight plan (see figure 17). At the point where the flight crew was directed by ATC to turn right 10˚ and join the localizer, the PM would normally configure the FMC by verifying that the flight plan in the computer reflected only the anticipated waypoints to be flown on the approach, clearing the discontinuity. However, based on the FMC data, this was not done. The flight plan discontinuity remained in the flight plan throughout the flight. In addition, the FINAL APP page on the CDU would have shown a 9,990 value in the vertical deviation field, indicating that it was below the glidepath (see figure 18). According to the UPS A300 check airman, this value is the maximum value able to be displayed.

NTSB Aircraft Accident Report 43 Figure 16. Photograph of the A300 simulator CDU showing the flight plan discontinuity message (indicated by white arrow).

NTSB Aircraft Accident Report 44 Figure 17. Photograph of the A300 simulator PFD and ND with the flight plan discontinuity (direct to KBHM) in the active flight plan indicated by white arrow.

NTSB Aircraft Accident Report 45 Figure 18. Photograph of the CDU FINAL APP page with the flight plan not verified. 1.16.2 Sequencing the Flight Plan About 0442, ATC directed the flight crew to “turn ten degrees right, join the localizer, maintain three thousand.” This clearance took the flight off its navigation routing directly to KBHM. According to the UPS A300 PTG, once vectored off of the FMC lateral track, A300 pilots should verify that the flight plan in the FMC reflects the anticipated approach waypoints to be flown, clearing the discontinuity. However, based on the FMC data, this was not done. The

NTSB Aircraft Accident Report 46 UPS A300 PTG instructed pilots to use an “H.O.V.E.” check to properly sequence an approach in the FMC.70 The UPS A300 PTG, “Initial Approach,” states, in part, the following: Proper management of the AFDS [autopilot flight director system] significantly enhances the efficiency of the crew when flying any approach. A good “rule-of-thumb” to remember is the “H.O.V.E.” check. (H) = HDG/S - Mode must be used when being radar vectored in the terminal area to comply with ATC instructions. (O) = Out of Profile - Once vectored off of the FMC lateral track, PROFILE mode is inaccurate and of little use. Therefore, to comply with ATC altitude instructions, the use of LVL/CH [level change] or V/S [vertical speed] modes allows the crew direct control over the vertical path of the aircraft.71 = V/N/I switch - Select the V/N/I switch to the appropriate mode for the approach being flown.72 = Extend the Centerline - The [PF] should ask the PM to load the expected approach (or runway if accomplishing a visual approach) and extend the centerline. Once the approach has been properly loaded and verified in the FMC, the F-PLN page should reflect the correct sequence of waypoints and altitudes to be flown on the approach. This is also known as sequencing the approach. During the December 4, 2013, simulator testing, the BHM localizer 18 approach was entered into the FMC; the H.O.V.E. check was then used to verify the flight plan in the FMC. Following the resequencing of the flight plan, the F-PLN DISCONTINUITY could no longer be seen in the active flight plan on the CDU, and the previous navigation path that showed a direct routing to KBHM on the ND was no longer present. 1.17 Organizational and Management Information 1.17.1 General Information UPS was founded in 1907 as a private messenger and delivery service company in Seattle, Washington. In 1988, UPS received FAA authorization to operate its own airplanes and was certificated under 14 CFR Part 121 as an air carrier.

70 According to UPS A300 instructors and check airmen, the H.O.V.E. check is to be used by A300 flight crews on all normal approaches (precision and nonprecision); therefore, the check is not unique to nonprecision approaches. 71 This bullet refers to Profile Performance Descent mode. According to the UPS A300 PTG, the A300 FMC provides two VNAV functions, one used during en route and terminal operations, called Profile Performance Descent mode, and the other to be used during nonprecision approaches, called Profile Final Approach mode. Profile Performance Descent mode computes a geometric path from an altitude constraint backwards to cruise altitude, resulting in an FMC calculated top-of-descent point. This concept is most used when planning a descent from cruise altitude. Profile Final Approach mode computes a geometric path of a fixed angle from a single reference waypoint (usually the threshold crossing height) extending infinitely upward. Profile Final Approach mode is only used to provide vertical guidance during an approach. 72 The V/N/I switch displays VOR, NAV, or ILS course and deviation information on the ND.

NTSB Aircraft Accident Report 47 At the time of the accident, UPS corporate headquarters was located in Atlanta, Georgia, and the airline’s headquarters was located at SDF. The company employed 331,457 employees, including 2,584 pilots. Records show that, as of December 31, 2012, UPS operated 562 airplanes, which it either owned, operated on capital or short-term leases, or chartered, and had 8 additional airplanes on order. Title 14 CFR 121.141 requires that the FAA-approved airplane flight manual or an equivalent manual be carried onboard each aircraft. The UPS A300 AOM satisfies the requirement of an equivalent manual, and UPS A300 pilots were required to operate the A300 per the limitations and procedures contained in the AOM. UPS uses the FAA-approved AOM, flight operations manual (FOM), and flight operations training manual (FOTM) as required by 14 CFR 121.135 and 121.403 to provide guidance to flight crews. The AOM contains the aircraft limitations, normal/abnormal/emergency procedures, supplemental procedures, and performance information. The FOM contains regulations and policies and procedures that pertain to the conduct of flights that are designed primarily for crewmembers and dispatchers and included information from UPS operations specifications (OpSpecs) and other required and appropriate sources. The FOTM provides training guidance. UPS pilots are trained and evaluated on the information contained in the AOM, FOM, and FOTM. Because these manuals are FAA-approved, they are subject to continual FAA review and oversight. In addition, UPS A300 pilots can reference the guidance contained in the UPS A300 PTG, which outlines UPS policies and recommended techniques to be followed during initial and recurrent training, as well as during line operations. This manual is a reference guide only to assist UPS crewmembers in flying the A300 airplane and to provide a basis for standardization; the UPS A300 PTG is not an FAA-approved or -accepted manual. Information in this manual expands on procedures in the A300 AOM and is intended to illustrate procedures with further, in-depth explanations in how to execute specific maneuvers. In summary, UPS pilots are required to operate per the limitations and procedures contained in the AOM. In addition, pilots could reference the PTG, which expanded on procedures in the AOM and was intended to illustrate procedures with further, in-depth explanations in how to execute specific maneuvers. UPS also provided information to crewmembers on policies, guidance, and training through its FOM and FOTM. 1.17.2 Stabilized Approach Information According to the UPS FOM section titled “Stabilized Approach Criteria,” all approaches must be stabilized by 1,000 ft above field elevation. At UPS, an approach was considered stabilized when all of the following conditions were met:  Aircraft is in the landing configuration and the landing checklist has been completed  Airspeed is within +10 or -5 knots of computed final approach speed  Sink rate is 1,000 fpm or less and stable

NTSB Aircraft Accident Report 48  Aircraft is on a stable vertical path that will result in landing within the touchdown zone  Engine thrust is stabilized at a level that results in target speed (as listed above)  Aircraft is aligned with the lateral confines of the runway by 200 ft AFE [above field elevation] – Note: *Airspeed must be within 5 knots of target by 500 AFE – Note: **Vertical speed up to 1,200 fpm may be acceptable under approach conditions that require higher airspeed/ground speeds due to non-normal aircraft system configuration The UPS FOM also states the following: During an instrument approach, crews are encouraged to stabilize the approach before 1,000 AFE. However, all stabilized approach criteria must be met no later than 1,000 AFE. Under no circumstances will safety-of-flight be compromised. If at any time during the approach the captain feels that the stabilized approach criteria cannot be achieved or maintained, a go-around must be initiated. Guidance on stabilized approach criteria is also found in the UPS A300 PTG, which states, in part, the following: A good landing begins with a stabilized approach. Stabilized approach requirements are defined in the FOM. All approaches are required to be stabilized no later than 1,000 HAT [height above touchdown], in all flight conditions. Below 1,000 ft HAT only minimum thrust and pitch changes should be necessary to maintain [approach speed] on a normal 3 degree glidepath to the runway, to land in in the touchdown zone. If an approach becomes destabilized below 1,000 HAT a go-around is required. 1.17.3 Pilot Response to EGPWS Alerts UPS guidance in the A300 AOM section titled “GPWS/EGPWS Alert Procedures” lists the “sink rate” alert as a “caution,” requiring a pilot to “adjust pitch attitude and thrust to silence the warning.” The AOM also states, in part, the following: When any GPWS/EGPWS alert is activated, regardless of its duration, or if a situation is encountered resulting in unacceptable flight towards terrain, take immediate and positive corrective action. Further, the UPS A300 PTG includes the following EGPWS response guidance: If the EGPWS caution alert “Sink Rate, Sink Rate” occurs during a VMC [visual meteorological conditions] approach, the pilot flying must immediately alter the airplane’s flight path sufficiently to stop the alert. If the alert continues, or the flight is operating in IMC, the [PF] must perform a go-around or the controlled flight into terrain recovery maneuver, as appropriate. Be advised that using an

NTSB Aircraft Accident Report 49 excessive rate-of-descent above 1,000 ft agl, such as during a nonprecision approach, can activate an EGPWS alert. The AOM states that when a “too low terrain” caution alert is activated, the pilot should adjust the flightpath or go around. The PTG advises pilots to perform the aggressive CFIT avoidance maneuver, which involves disengaging the autopilot, rotating the airplane 20º nose up, applying maximum thrust, retracting the speedbrakes, and rotating further, up to stick shaker if required. 1.17.4 Go-Around Policy UPS’s go-around policy is covered in the UPS A300 AOM: Go-Around Guidance:  The [PF] may initiate a go-around at any time during an approach.  Any operating crewmember…shall make a “go-around” callout if an unsafe condition exists or as required by procedure.  The [PF] response to a go-around callout shall be an immediate go-around/missed approach procedure. NOTE: The captain retains ultimate responsibility and authority for the safe operation of the flight….Therefore, if the captain determines that the execution of a go-around/missed approach presents a greater risk than continuing the approach, the approach may be continued at the captain’s direction.  If either pilot initiates a go-around/missed approach, it must be flown to its conclusion. 1.17.5 BHM Approach Chart UPS had tailored its Jeppesen airport information chart for BHM, and UPS pilots were required to review the chart each time they flew into BHM. The chart contained a safety alert (originally requested for inclusion on the airport information chart in October 2005) that stated, in part, the following: Arrival  Flight operational quality assurance information indicates a high number of unstable approaches to this airport.  ATC may keep aircraft at high altitudes before approach.

During the investigation, UPS historical data and archived files were reviewed to determine UPS’s basis for adding the safety alert to its BHM airport information chart. No specific information was found, but records showed that, at the time the alert was added, UPS requested multiple safety alert updates to its approach charts. A review of archived data from 2008 to the time of the accident did not reveal any information identifying BHM as a high-risk

NTSB Aircraft Accident Report 50 airport for unstabilized approaches. UPS representatives said that, based on this review, the safety alert should have been removed from the airport information chart; however, the most recent review occurred in 2007 and determined that no changes were needed. Further, a UPS postaccident examination of the BHM airport and pilots’ perspectives of the approaches at BHM revealed no information that would identify BHM as high-risk airport for unstabilized approaches. The Jeppesen 11-2 BHM localizer runway 18 approach chart in effect at the time of the accident had the note “NIGHT: NA” 73 in its minimums section, indicating that the approach was not authorized at night.74 Therefore, based on the information available to the flight crew on the chart, the localizer runway 18 approach would not have been authorized at the time of the accident. However, in December 2011, the FAA issued NOTAM 1/3755 (amendment 2A) stating, “Delete note: procedure NA at night. Chart note: When VGSI [visual glideslope indicator] inop [inoperative], procedure NA at night.” According to the FAA, NOTAM 1/3755 was cancelled on March 8, 2012, and, although the chart used by the flight crew indicated that amendment 2A had been incorporated, the minimums section of the chart was not changed to reflect the NOTAM. Jeppesen cited “human error” for the omission and on September 13, 2013, reissued the 11-2 BHM localizer runway 18 chart removing the NIGHT: NA restriction in the minimums section. 1.17.6 UPS Crew and Dispatcher Resource Management Policies and Training 1.17.6.1 UPS Crew Resource Management Training Both the captain’s and first officer’s most recent CRM training took place during their proficiency training and checks on June 26, 2013. Throughout all aspects of A300 ground and flight training, UPS pilots are trained on the “Big Six” model of CRM: communications and briefings, “what if” planning, time management, teamwork and leadership, automation management, and situational awareness. The ground training includes CRM exercises that require pilots to apply CRM skills and exhibit adequate knowledge of communication processes, crew coordination, situational awareness, and problem solving/decision-making processes. Captain upgrade training includes 2 hours of CRM training focused on applying CRM skills to being an effective captain and includes CRM responsibilities such as leadership, clear communication, good decision-making, situational awareness, and technical proficiency. Training also reviews the consequences of fatigue, including increased vulnerability to mistakes, decreased situational awareness, poor decision-making, overestimation of one’s level of ability, and fixation/slowed reaction time. 1.17.6.2 UPS Crew Resource Management Preflight Safety Briefing Pilots are required to perform a CRM/safety briefing before flight. The UPS FOM states, in part, that “the CRM/Safety briefing serves dual roles: allowing the Captain to set a good CRM

73 NA indicates not authorized. 74 The dispatcher reviewed the nonprecision localizer 18 approach at BHM and determined that the approach was not available due to this note in the minimums section.

NTSB Aircraft Accident Report 51 tone for the flight and allowing complicated procedures to be discussed in detail before engine start when workload and distractions can be minimized.” CRM briefing objectives as outlined in the FOM include the following: 1) Setting a good tone in the cockpit to encourage safe and efficient flight crew coordination; 2) Establishing open lines of communications between all crewmembers, including encouraging the communication of all known threats as soon as they become apparent; 3) Setting the expectation that standard operating procedures [SOP] will be followed; 4) Stimulating good situational awareness and communication when situational awareness has degraded 5) Rejected takeoff procedures and philosophy (include any safety-related issues which may affect the decision to reject such as weather, MEL [minimum equipment list] deferrals, windshear etc.) During postaccident interviews, the FAA aircrew program manager and UPS crewmembers indicated that a check item for fatigue was not included in a briefing before takeoff. 1.17.6.3 UPS Crew Resource Management Steering Committee UPS has a CRM steering committee composed of management and line pilots from each airplane model fleet. At the time of the accident, the committee met quarterly to review CRM issues and recommend any changes to CRM training to the director of training and standards. The committee focused primarily on the threat-and-error management model, which committee members reinforced through training, facilitated debriefs between pilots and their instructors, and encouraged pilots to use threat error management during operations as much as possible. In 2013, the committee developed a training character called “Max Threat,” who represented various hazards to pilots while in the cockpit. Its purpose was to instruct pilots how to use CRM principles and techniques to rid themselves of “Max Threat.” The committee produced several videos featuring the character that were included in UPS CRM training. 1.17.6.4 UPS Dispatcher Resource Management Training and Policies Much like pilots are taught CRM principles and techniques, UPS dispatchers are taught dispatcher resource management (DRM).75 As outlined in the UPS FOTM, one of the objectives of DRM is to teach dispatchers how to “better interface with each [pilot-in-command], consistent with the joint responsibility concept” outlined in 14 CFR 121.533, “Responsibility for

75 Flight dispatchers are required to be trained under the provisions of 14 CFR 121.415, “Crewmember and Dispatcher Training Requirements” and 14 CFR 121.422, “Aircraft Dispatchers: Initial and Transition Ground Training.”

NTSB Aircraft Accident Report 52 Operational Control. Domestic Operations.”76 This objective is also mentioned as a benefit in FAA AC 121-32A, “Dispatch Resource Management Training” (issued November 21, 2005), which provides guidance to operators for developing, implementing, reinforcing, and assessing DRM training programs for aircraft dispatchers. The AC states that a second expected benefit of DRM training for aircraft dispatchers is “better management of information that has a direct impact on safe flight operations.” According to the AC, a goal of DRM training is to “address the challenge of optimizing communication between diverse groups within an airline and the related interpersonal issues while using available resources.” Further, the AC advises operators that DRM should include all operational personnel (including pilots) to improve teamwork. The UPS FOTM outlines the training curriculum for the company’s dispatchers. According to a UPS flight control shift manager, after initial training, general subjects and all classroom instruction, dispatchers undergo specific on-the-job training, including performance problems, looking at MEL problems, and explaining what they would do and how they would apply penalties and restrictions. They are required to spend a specific number of days on the desk, as well as take a written practical and oral examination, each of which is 9 hours long. Flight dispatchers are also required to receive recurrent training to the requirements specified in 14 CFR 121.427 (a)(b)(c) and 14 CFR 121.463(c). The course must provide refresher training in those subjects and procedures as required by 14 CFR 121.422(a) and 14 CFR 121.629. Recurrent dispatcher training is required every 12 months, and the UPS dispatcher initial and recurrent training curriculums are outlined in the UPS FOTM. According to the UPS flight control shift manager, dispatchers have 1-day recurrent training in the fall and spring. Dispatchers are also required to receive an annual competency check. According to UPS, dispatchers receive about 18 hours of total training each year, including 1 hour of DRM training. However, dispatchers and pilots, who share equal responsibility for the safety of a flight as noted in the UPS FOTM and FAA AC 121-32A, did not train together. UPS does not require its pilots and dispatchers to communicate directly during normal dispatch operations or have a verbal dispatch briefing before every flight. However, a UPS flight control shift manager said that UPS dispatchers had multiple means to interact with a flight crew, including cell phone or landline phone, satellite communications, the Aircom Server77 on most airplanes, or the ACARS. The accident dispatcher stated that he was not required to and generally did not talk with pilots. He indicated that he typically only spoke with pilots when they initiated the conversation, usually when they discovered a MEL item that was not listed on the flight plan during the initial boarding process, if there was something new on the airplane, or if there was significant weather en route or at the destination. According to UPS, a dispatcher would be required to inform the pilots of an issue under some circumstances. For example, a UPS manager indicated that the dispatcher would be required78 to inform the pilots if an approach was unauthorized for the

76 During the NTSB’s February 20, 2014, investigative hearing for this accident, the UPS flight control manager testified that “better interface” meant “contact with the [pilot-in-command].” He indicated that the interface included talking with the pilot on the phone or the ACARS system. 77 The Aircom Server provides air-to-ground communications management. 78 Title 14 CFR 121.601(a) states, “The aircraft dispatcher shall provide the pilot in command all available current reports or information on airport conditions and irregularities of navigation facilities that may affect the safety of the flight.”

NTSB Aircraft Accident Report 53 approach runway. However, during postaccident interviews, the accident dispatcher stated that he did not want to “insult” the captain by informing him of what the dispatcher viewed as an unavailable approach to the runway 18.79 The accident dispatcher reported that his typical workload in a shift involved planning 20 flights on the domestic side and flight-watching 10 flights.80 He said that, for international flights, his workload was about 10 to 15 flights because of the difficulty involved. On the night of the accident, he had planned 20 flights and flight-watched 10 to 15 flights. At the time of the accident, he was working the accident flight, and all of his other watch flights had already landed. 1.17.7 Pilot Flight and Duty Time The accident flight was operating under the provisions of 14 CFR Part 121 Subpart Q (at 14 CFR 121.471[a]), which lists the flight-time limitations and rest requirements for domestic operations as follows: (a) No certificated holder conducting domestic operations may schedule any flight crewmember and no flight crewmember may accept an assignment for flight time in scheduled air transportation or in other commercial flying if that crewmember’s total flight time in all commercial flying will exceed— (1) 1,000 hours in any calendar year; (2) 100 hours in any calendar month; (3) 30 hours in any 7 consecutive days; (4) 8 hours between required rest periods. The UPS contract with the Independent Pilots Association (IPA) provides additional limitations on flight and duty times and rest requirements for flight operations during an early duty window, which is defined as between 0230 and 0459 local domicile time. Any operation that reported in, blocked in, or overlapped with the early duty window is considered an early duty window period. The UPS/IPA contract limits a crewmember flying a domestic early duty window from being scheduled a duty period that exceeded 11 hours on duty or being on actual duty for more than 13 hours. The 13 hours may be extended to 14 hours only if a flight was delayed due to weather, mechanical, or ATC delays. The contract further states that early duty window operations cannot exceed four segments in a scheduled duty period and that a crewmember cannot be scheduled more than four consecutive duty periods that contain four early duty window segments. After completing an early duty window period, a crewmember should receive 10.5 duty-free hours of layover rest. If an early duty window period is scheduled for 10.5 hours or more, or contains four segments, the crewmember should receive 12 duty-free hours of

79 As noted previously, due to an error on the BHM chart, the dispatcher believed that the runway 18 localizer approach was not available. 80 Watching flights is another term for flight-following. Dispatchers are responsible for a flight from planning until safe completion. They either follow their own flights or those from a dispatcher who they have relieved.

NTSB Aircraft Accident Report 54 layover rest. The 12-hour rest period may be reduced to 10.5 hours in the event of weather, mechanical, sort, or ATC delays. 1.17.8 UPS Fatigue Policies, Guidance, and Training 1.17.8.1 Fitness for Duty Policy and Guidance The UPS FOM introduction regarding crewmember fitness for duty states the following: UPS crewmembers are expected to report for all assignments fit for duty. Further, UPS crewmembers are prohibited from operating aircraft if they are not fit for duty. Fitness for duty is defined as being physiologically and mentally prepared and capable of performing assigned duties. Crewmembers must notify Crew Scheduling immediately if they are not fit for duty for any reason. This decision is vital to safety and the notification must occur without hesitation. Crew Scheduling will remove the crewmember from service and provide further assistance, as required. Fitness for duty includes, but may not be limited to, being free from illness, injury, fatigue, scuba diving restrictions, blood donations, alcohol, drugs, etc. The UPS FOM addressed fatigue as follows: Do not operate as a crewmember if fatigue compromises your ability to safely perform your assigned duties. Crewmembers are expected to report for duty rested and prepared for scheduled duty periods. Duty periods may include revision or reschedule as defined by the Collective Bargaining Agreement. NOTE: In addition to notifying Crew Scheduling, crewmembers who determine they cannot perform assigned duties due to fatigue, are required to complete a Fatigue Event Report. 1.17.8.2 Fatigue Risk Management The UPS fatigue risk management plan (FRMP) is outlined in the UPS FOM chapter on CRM and states the following: Fatigue risk management is a continuous improvement process that identifies, assesses and mitigates the risk of fatigue by guiding organizational and/or policy change and fatigue risk management promotion through training and communication. A comprehensive UPS fatigue risk management plan collects and analyzes fatigue data to proactively manage fatigue threats and ensures unacceptable risks are mitigated. Fatigue training is incorporated into annual training for all crewmembers, crew schedulers/crew resource personnel, dispatchers and

NTSB Aircraft Accident Report 55 operational decision-makers. The UPS FRMP has been approved by the FAA. The FRMP scheduling limits are representative of the UPS/IPA Collective Bargaining Agreement. The global, 24-hour nature of operations, including backside-of-the-clock flying, flights crossing multiple time zones, and the range associated with modern aircraft can create challenges for air carriers and pilots in managing rest. Therefore, it is imperative that UPS Flight Operations personnel proactively manage alertness and mitigate fatigue. 1.17.8.3 Flight Crew Alertness Guide The UPS fatigue safety action group,81 which is responsible for UPS fatigue education, developed the Flight Crew Alertness Guide provided to crewmembers in the FOM. The guidance contains practical tips for obtaining adequate sleep, recovering from a sleep debt, and identifying sleep problems/disorders when at home and away. The alertness guide was developed in conjunction with an outside consultant and provided to the IPA to review before publication. 1.17.8.4 Fatigue Training UPS presents its pilots with fatigue training during initial CRM training and subsequently in the one-time CRM flight crew factors seminar. According to the FOTM, the fatigue curriculum segment covers the following areas: 1) Review of FAA flight, duty, and rest regulatory requirements. 2) Awareness of the FRMP program itself, including fatigue-related policies and procedures, and the responsibilities of management and employees to mitigate or manage the effects of fatigue and improve flight crewmember flight deck alertness. 3) The basics of fatigue, including sleep fundamentals and circadian rhythms. 4) The causes and awareness of fatigue. 5) The effects of operating through multiple time zones. 6) The effects of fatigue relative to pilot performance. 7) Fatigue countermeasures, prevention, and mitigation.

81 The fatigue safety action group includes a safety manager and a data analyst from the company’s safety department, two members from the chief pilot’s office, one member from the crew scheduling department planning office, one member from the industrial engineering department, a flight operations compliance manager, and a flight-qualified supervisor. The group is responsible for a fatigue review and the development of education at UPS and the Flight Crew Alertness Guide. In addition, the fatigue safety action group reviews deidentified information for each fatigue event and performs a root cause analysis.

NTSB Aircraft Accident Report 56 8) The influence of lifestyle, including nutrition, exercise, and family life, on fatigue. 9) Familiarity with sleep disorders. 10) The effects of fatigue as a result of commuting. 11) Pilot responsibility for ensuring adequate rest and fitness for duty. 12) Operational procedures to follow when one identifies, or suspects, fatigue risk in oneself or others. 13) Lessons learned regarding the effects of fatigue and mitigation initiatives relative to the certificate holder’s operations. UPS also presented fatigue causes and countermeasures training during its annual advanced qualification program and continuing qualification training in either forum or home study format, as outlined in the advanced qualification program manual. The 2013 continuing qualification home study document’s review of fatigue addressed the UPS FRMP, safety culture, and joint responsibility between the company and crewmembers to ensure fitness for duty. The first officer completed the training on June 5, 2013, and the captain completed it on June 6, 2013. The document provided additional guidance, which stated the following: It cannot be overstated that sleep or lack of sleep greatly affects our level of performance. Sleep is a resource that must be managed. Managing our sleep is imperative if we are to maximize our ability to handle both routine flying tasks and possible emergency situations. Sleep deprivation is cumulative and diminishes your ability to operate safely. It is each crewmember’s responsibility to assure that they manage their duty free periods so as to report to work fully rested. Because UPS operates worldwide in all time-zones it can be a challenge to properly manage your rest. Your ability to communicate to other crewmembers and the company on the status of your readiness to fly is important in evaluating your ability to function as a viable crewmember. Proper exercise and eating habits also help minimize the effects of fatigue. Studies show that moderate exercise completed several hours before bedtime can help in assuring restful sleep. Also, before bedtime avoid large or heavy meals and alcohol, which have been found to interfere with sound sleep. 1.17.8.5 Fatigue Event Reporting and Review If a UPS pilot reports a fatigue event that requires removal from duty, related information is reviewed at least twice: first by the UPS flight compliance supervisor then by the scheduling supervisor. The two supervisors meet once a week to review fatigue calls and decide whether to debit the pilot’s sick bank for the fatigue call.82 Final determination about sick bank debits is

82 The pilot’s sick bank would be debited for the time not flown if it was determined that the pilot was responsible for being fatigued (for example, if the pilot mismanaged off-duty time).

NTSB Aircraft Accident Report 57 made by the UPS fatigue working group, which consists of personnel from UPS (such as the flight compliance supervisor who is co-chair of the working group) and IPA. In addition to reviewing fatigue events, the working group also reviews pilots’ submitted schedule complaints and schedule trends for the month. If the UPS fatigue working group cannot agree on whether to debit a pilot’s sick bank, the event is elevated to the IPA president and the system chief pilot for review. If no determination can be agreed upon by the IPA president and system chief pilot, UPS can debit the pilot’s sick bank in accordance with the memorandum of understanding between IPA and UPS. Every fatigue call is subsequently deidentified for root cause analysis and identification of any corrective action by the fatigue safety action group. According to the UPS fatigue working group, most of its pilots’ fatigue calls resulted in no reschedules or major delays. Of the 13 pilots interviewed during this investigation, 6 said that they had called in fatigued 4 of these said they would feel comfortable calling in fatigued again. One pilot had called in fatigued three times. He said that he was thoroughly questioned after the second occasion and that his sick bank was debited on the third occasion. He said he was now concerned about future responses if he called in fatigued. Another pilot indicated there were no negative consequences when he called in fatigued. A review of UPS records from 2011 to the day of the accident found no fatigue event reports filed by either the captain or the first officer during that time. 1.18 Additional Information 1.18.1 Postaccident Safety Actions Following the accident, the BHM airport authority and BHM control tower replaced the emergency phone system and updated procedures so that the appropriate emergency response parties are notified in a timely manner. The BHM control tower management also provided refresher training to controllers on entering remarks data and updating ATIS reports. 1.18.2 FAA Regulations and Guidance 1.18.2.1 Flight- and Duty-Time Regulations On January 4, 2012, the FAA published the final rule for 14 CFR Part 117, which prescribed new flight- and duty-time regulations for all flight crewmembers and certificate holders conducting passenger operations under Part 121. The final rule became effective on January 4, 2014, about 4 1/2 months after the accident. All-cargo operators were not required to implement the provisions of Part 117 although they could voluntarily comply with the new requirements. Table 2 compares the Part 121 and 117 flight- and duty-time requirements, the UPS early duty window operations policy, and the accident pilots’ duty periods before the accident.

NTSB Aircraft Accident Report 58 Table 2. Comparison of FAA duty-time regulations with the accident flight crew’s duty periods before the accident.

Part 121a Part 117b UPS early duty window operations Accident flight crew’s schedulec Maximum duty time N/A 11 hours 11 hours 8 hours 11 minutes Maximum flight hours 8 hours 8 hours 8 hours 2 hours 29 minutes Minimum rest requirement 9 hours 10 hours 10.5 hours 14 hours 28 minutes Maximum consecutive nights N/A 5 nightsd 4 nights 2 nights a. Minimum rest requirements under 14 CFR Part 121 Subpart Q are based on the number of flight hours scheduled in 24 consecutive hours. b. Maximum duty time under 14 CFR Part 117 is based on scheduled start time and number of flight segements. Maximum flight hours is based on scheduled start time. The data presented are based on the flight crew’s schedule the day of the accident. See Exhibit 14-G Excerpts – 14 CFR Part 117 in the public docket for more information. c. These are the actual times based on the accident flight crew’s schedule. d. Title 14 CFR Part 117 limits consecutive nights to three if there is no opportunity to obtain 2 hours of rest in a suitable location during the flight-duty period.

The NTSB asked the FAA to review the accident flight crewmembers’ schedules to determine if the schedules would comply with the limitations prescribed in Part 117 (even though these rules were not in effect at the time of the accident and do not apply to all-cargo operations). The NTSB provided the FAA with the accident crew’s schedules for the 60 days before the accident and the trip pairing that included the accident flight.83 The FAA concluded that “on June 29, 2013, [the accident captain] had a scheduled rest period of 9 hours and 56 minutes and his actual rest period was 9 hours and 51 minutes. Part 117 would have required 10 hours rest as measured from the release of all duty (§ 117.25(e)). The 10-hour rest period must have provided a minimum of 8 uninterrupted hours of sleep opportunity.” Also, from July 16 through 21, 2013, and again from July 30 through August 4, 2013, the accident captain “was scheduled for six (6) consecutive nighttime duty periods. Part 117 would have limited [the accident captain] to a maximum of five (5) consecutive nighttime flight duty periods (FDPs) provided each of the five FDPs provided a minimum of 2 hours rest in a suitable accommodation (§ 117.27). Otherwise, he would have been limited to three (3) consecutive nighttime FDPs.” Lastly, the FAA concluded that for the captain, “no [P]art 117 cumulative FDP or flight time limitations would have been exceeded.” The FAA also concluded that for the first officer’s schedule “no prescribed limitations in [P]art 117 would have been exceeded.” 1.18.3 Data Related to Unstabilized Nonprecision Approaches A review of the National Aeronautics and Space Administration’s (NASA) aviation safety reporting system (ASRS) reports84 showed 62 reports at 17 airports related to nonprecision

83 For the captain, the pairing began 1 day before the accident and for the first officer, it began 4 days before the accident. 84 According to NASA ASRS, “ASRS reports referencing safety incidents are considered soft data. The reports are submitted voluntarily and are subject to self-reporting biases. Such incidents, in many cases, have not been corroborated by the FAA or NTSB. The existence in the ASRS database of records concerning a specific topic cannot, therefore, be used to infer the prevalence of that problem within the National Airspace System. Reports submitted to ASRS may be amplified by contact with the individual who submitted them, but the information provided by the reporter is not investigated further. At best, it represents the perception of a specific individual involved in or witnessing a given issue or event.”

NTSB Aircraft Accident Report 59 approaches involving Part 121 operations. Nine reports were most closely related to the UPS flight 1354 accident. In four events,85 the crew descended below an altitude constraint, and in three events,86 the crew received an EGPWS terrain alert. In another event,87 a crewmember indicated “inadequate and poorly administered training on VNAV/autoflight nonprecision approach procedures.” In the last event,88 a dispatcher reported a “communication breakdown between himself and the flight crew” regarding the approach that was going to be flown to the runway. He further stated that he “had several Captains in the past who were interpreting approaches, charts and regulations incorrectly.” Industry analysis of data for operations across the National Airspace System indicates that most flights comply with commonly accepted industry standards for stable approach. A similar industry analysis was applied to operations at a subset of 31 airports that have at least one runway without an ILS,89 a situation more similar to that of the accident flight, which was on approach to a runway without an ILS.90 Approaches to runways with and without an ILS91 at 31 airports were compared with respect to vertical speed metrics. The vertical speed of flights on approach to runways with an ILS at these airports exceeded a vertical speed of 1,450 fpm92 at 1/3 of the rate of approaches to runways without an ILS. A TAWS alert indicates a heightened risk of flight into terrain and is not expected during a stable approach, especially when vertical guidance is available. Industry analysis of data for operations across the national airspace system indicates that TAWS alerts are very rare, occurring in fewer than 1 in 10,000 approaches. Additionally, in the analysis of 31 airports that have at least one runway without an ILS, the rate of TAWS alerts93 was compared for runways with and without an ILS with the following findings:  The rate of Mode 2 alerts94 for approaches to runways with an ILS was 1/10 of the rate of Mode 2 alerts for approaches to runways without an ILS.  The rate of EGPWS alerts for approaches to runways with an ILS was 1/3 of the rate of EGPWS alerts for approaches to runways without an ILS.

85 See ASRS report numbers 1133632, 932134, 1010118, and 722952, which can be accessed at http://asrs.arc.nasa.gov/. 86 See ASRS report numbers 824453, 732267, and 605041, which can be accessed at http://asrs.arc.nasa.gov/. 87 See ASRS report number 955740, which can be accessed at http://asrs.arc.nasa.gov/. 88 See ASRS report number 987675, which can be accessed at http://asrs.arc.nasa.gov/. 89 The dataset included approximately 1.4 million approaches for commercial airline operations over the past 3 years. 90 Since many of the nonILS runways have rising terrain near the airport, terrain alerts would be expected to occur more often than in the national airspace system overall. Rising terrain features can prohibit installation of an ILS. 91 The analysis distinguishes between approaches to runways with and without an ILS, but cannot be used to infer the type of approach that was flown. The results are indicators of the effect of ILS vertical guidance availability, not evidence of use. 92 Below 500 ft height above touchdown. 93 Two types of TAWS alerts were measured in industry data: Mode 2 (Terrain) alert, a GPWS Pull Up Warning preceded by a GPWS Terrain Caution; EGPWS alert, a Terrain Awareness Warning preceded by Terrain Awareness Caution. 94 The analysis does not distinguish between versions of TAWS software or GPS-enabled TAWS.

NTSB Aircraft Accident Report 60

1. Analysis
2. 1 General

The pilots were properly certificated, qualified, and trained for the 14 CFR Part 121 flight in accordance with FAA regulations. No evidence was found indicating that the flight crew’s performance was affected by any behavioral or medical condition or by alcohol or drugs. The accident airplane was loaded within weight and center of gravity limits and was equipped, certificated, and maintained in accordance with FAA regulations and the manufacturer’s recommended maintenance program. Postaccident examination found no evidence of any preimpact structural, engine, or system failure or anomaly. The air traffic controller activated the airport crash phone 1 min 17 seconds after the accident. The controller was uncertain of the exact location of the accident and did not know whether to notify ARFF or call 911 (procedures required that ARFF be contacted on all accidents on or near the airport). Additionally, due to an equipment reconfiguration, the call was delayed because the controller was not able to locate the button needed to activate the crash phone circuit on the ETVS display panel in a timely manner. The NTSB concludes that, although the activation of the crash phone was delayed, the ARFF response proceeded rapidly, and ARFF operations began in a timely manner. This analysis discusses the predeparture planning, the accident sequence, the flight crew’s performance, and operational and systems issues. 2.2 Predeparture Planning A NOTAM had been issued closing the longest runway at BHM, 06/24, which was equipped with an ILS precision approach, from 0400 to 0500 on the morning of the accident. This closure left only the shorter runway, 18/36, available for the UPS flight 1354 landing, which was scheduled for 0451. The dispatcher was aware of the NOTAM closure for runway 06/24 when he was flight-planning and included the NOTAM in the flight release paperwork; however, he did not bring the NOTAM to the flight crew’s attention. The flight crewmembers’ preflight review should have cued them to consider the limited approach options available to the remaining runway; however, the investigation could not confirm whether the flight crewmembers became aware of the NOTAM during their paperwork review. Because of the closure, the dispatcher planned for UPS flight 1354 to land on runway 18. He reviewed the Jeppesen approach chart at BHM and determined that the nonprecision localizer runway 18 approach was not available due to a note in the minimums section of the chart stating the approach was not authorized at night.95 Thus, from the

95 As noted previously, although this NOTAM was cancelled on March 8, 2012, and the Jeppesen 11-2 BHM localizer 18 chart used by the dispatcher and flight crew indicated that an amended NOTAM was incorporated, the minimums section of the chart was never changed to reflect the amended NOTAM. Jeppesen reissued the 11-2 BHM localizer 18 chart on September 13, 2013, removing the NIGHT: NA restriction in the minimums section of the chart.

NTSB Aircraft Accident Report 61 dispatcher’s perspective, the only available approach to runway 18 for the flight was the RNAV approach. At the time the flight was dispatched, the forecast cloud ceiling at BHM about the time of arrival was below the minimum descent altitude for the RNAV 18 approach. As a result, there was a strong possibility that the flight would have to hold or divert to its alternate in Atlanta, Georgia, if the RNAV approach was used. The accident flight dispatcher did not notify the captain about the runway restrictions because, as he reported to the NTSB, he did not want to “insult” the captain by informing him of what he viewed as an unavailable approach to the shorter runway 18. Although the flight crew should have known about the limited options for arrival at BHM and could have initiated communication with the dispatcher, the dispatcher should have ensured that the pilots were aware of this information. The CVR recorded the pilots performing normal preflight checklists and checks and a conversation about recent changes to cockpit flight- and duty-time regulations. During a typical preflight, the captain should have verified the available approaches to the runways, the runway closure window, and forecast ceilings below nonprecision approach minimums; he should have also considered delaying his arrival into BHM to allow for the ILS approach to the longer runway. Although no discussion of these areas was recorded on the CVR, the flight crew may have discussed them at an earlier time. The NTSB concludes that the dispatcher of UPS flight 1354 should have alerted the flight crew to the limited options for arrival at BHM, especially that runway 18 was the only available runway, because doing so would have further helped the pilots prepare for the approach to BHM and evaluate all available options. See section 2.5.1 for a discussion about DRM training. 2.3 Accident Sequence 2.3.1 Approach to BHM After departing SDF, the flight crew navigated using the FMC direct to KBHM. At 0421:28, after listening to the BHM ATIS Papa mentioning the 06/24 runway closure, the first officer said, “they’re sayin’ six and two-four is closed. They’re doin’ the localizer to one eight,” and the captain responded, “localizer (to) one eight, it figures.” Based on these comments, it is likely that the flight crew did not realize before departure that runway 06/24 would be closed at the time of arrival. At 0433:33, the approach controller cleared the flight to descend to 11,000 ft msl, and the captain commented, “They’re generous today. Usually they kind’a take you to fifteen and they hold you up high,” indicating that, although the captain may have been kept at a higher altitude in the past, he was given a lower altitude on this leg. At 0441:44, the first officer requested a lower altitude, and the controller cleared the flight to descend to 3,000 ft msl. At 0442:05, the controller vectored the flight 10º right to join the localizer and to maintain 3,000 ft. According to UPS guidance, once vectored off of the FMC lateral track, the first officer, as PM and at the direction of the PF, should have used the CDU to clear the previous navigation routing and flight plan discontinuity and to sequence the FMC so that it only reflected the anticipated approach waypoints to be flown. However, postaccident review of downloaded FMC data indicated that, although the first officer activated the approach, she did

NTSB Aircraft Accident Report 62 not verify the flight plan was sequenced for the approach. Additionally, the captain did not call for the first officer to verify the flight plan. These omissions resulted in the FMC generating meaningless vertical guidance to the runway. See section 2.6.3 for more information on sequencing of the FMC. Several cues could have led the flight crew to believe the approach was set up properly, such as (1) the localizer was captured, (2) the airplane icon was positioned on the localizer on the ND, and (3) the first officer was able to activate the approach to runway 18 in the FMC. Further, the PFD and ND did not provide a specific indication that the approach had not been properly sequenced.96 Nonetheless, multiple cues on the NDs could have alerted the pilots that the flight plan was not verified. Specifically, (1) the lateral flight plan displayed on the ND had an unusual line shape due to the discontinuity with the next approach fix to be flown, (2) the VDI was pegged to the upper scale as the airplane approached the FMC-generated glidepath capture area near BASKN and “-9999 ft” was displayed on the CDU page, (3) instead of showing the course and distance to the BASKN FAF on the ND, the course and distance to KBHM would have been shown; (4) the lateral course deviation displayed on the ND would not have been counting down to zero appropriately when the airplane intercepted the localizer; (5) once the approach was activated by the first officer, the VDI would have appeared with a full-scale deflection up, indicating that the airplane was significantly below the glidepath, even though the airplane was above the glidepath, which the flight crew was aware of, and (6) there was a major discrepancy between distance to destination and distance to runway on the CDU progress page. However, the flight crewmembers did not detect these cues. They were engaged in a conversation about the localizer 18 approach option to the runway and their concern that ATC had left them high on the approach. Although this conversation involved operational issues, it focused on past activities and would have been a distraction to the flight crew’s focus on the present and future actions necessary to successfully complete the remainder of the flight. The cues associated with the flight crew’s failure to verify the flight plan would have been especially salient as the airplane aligned with the localizer, and the flight crew’s discussion came at an inopportune time. The NTSB concludes that the captain, as PF, should have called for the first officer’s verification of the flight plan in the FMC, and the first officer, as PM, should have verified the flight plan in the FMC; their conversation regarding nonpertinent operational issues distracted them from recognizing that the FMC was not resequenced even though several salient cues were available. 2.3.2 Vertical Deviation and Continuation of the Approach 2.3.2.1 Failure to Capture the Glidepath At 0443:24, the approach controller cleared the flight for the approach stating, “maintain two thousand five hundred till established on localizer, cleared localizer one eight approach.” The airplane was 11 mi from the BASKN FAF at this time. According to radar and CVR data, the airplane became established on the localizer when it descended through 3,800 ft and, consistent with the minimum altitude for that segment of the approach, could have descended to

96 A specific indication that the approach had not been properly sequenced was the F-PLN DISCONTINUITY message on the FMC F-PLN page if the first page of the flight plan was selected in the FMC.

NTSB Aircraft Accident Report 63 the FAF minimum crossing altitude of 2,300 ft when inside of COLIG. However, the captain did not do so, and he maintained 2,500 ft. The UPS A300 AOM and PTG recommended descending to the FAF crossing altitude before intercepting the profile glidepath on nonprecision approaches because intercepting the profile glidepath outside the FAF did not guarantee step-down fix compliance for those fixes that occur before the FAF. Although the flight crew repeatedly commented about being high on the approach, they did not discuss descending to 2,300 ft after they became established on the localizer between COLIG and BASKN. Additionally, it is important to note that, at this stage in the approach and well before the FAF of BASKN, the airplane was only 200 ft above the minimum altitude, which could have been corrected with minimal effort. For the autopilot to capture the profile glidepath, the autopilot profile mode must be armed by pushing the profile button, and the flight plan must be verified in the FMC. Because the flight plan had not been properly sequenced in the FMC and the autopilot profile mode may not have been armed,97 the autopilot was unable to capture the profile glidepath as the airplane approached it, and the airplane never began a descent on the 3.28° profile glidepath to runway 18. As the airplane neared the BASKN FAF, the controller cleared the pilots to land on runway 18, and the first officer performed the Before Landing checklist. During this time, the captain likely perceived that the autopilot did not capture the profile glidepath and chose to change the autopilot from profile mode to vertical speed mode to manually command a descent to the minimum descent altitude of 1,200 ft msl. This change in method of descent occurred before the FAF and was not consistent with the originally briefed approach plan, but the captain did not communicate this change to the first officer. Although the flight crew may have thought that they were kept high during the approach into BHM, if the captain thought that they were too high, or higher than he was comfortable with, he was responsible for mitigating the perceived risk by discontinuing the approach. At 0446:25, about 10 seconds after completing the Before Landing checklist, the first officer queried the captain about the airplane’s descent, stating, “let’s see you’re in…vertical speed…okay,” and the captain responded “…yeah I’m gonna do vertical speed, yeah he kept us high.” The captain initially set the descent rate at 700 fpm and 17 seconds later changed it to 1,000 fpm. Then, 14 seconds later, the captain then increased it to 1,500 fpm. At 0446:54, the captain commented, “and we’re like way high,” to which the first officer responded, “about...a couple hundred ft...yeah.” With limited time and altitude available on the approach, the first officer’s workload was further increased because she had to mentally process the change from the profile approach to vertical speed approach method. Additionally, the pace of her PM duties would have further increased her workload because the 1,500 fpm descent rate was about twice as fast as the normal

97 Downloaded FMC data indicated the profile path was not armed at impact (either the profile button was never pushed to arm the profile descent, or the profile button was pushed twice, first arming the profile path then again, disarming it). Normally, the profile mode is armed by pushing the profile button on the mode control panel and is indicated on the flight mode annunciator with a blue P. DES light indication. Capture of the profile descent path would be indicated on the flight mode annunciator with an initial flashing of the blue P.DES, then a steady green P.DES indicating path capture. The first officer’s comment, “could never get it over to profile,” may have been in response to the captain’s attempt to capture the profile by pushing the profile button twice.

NTSB Aircraft Accident Report 64 descent rate on approach of 700 to 800 fpm. The NTSB concludes that the captain’s change to a vertical speed approach after failing to capture the profile glidepath was not in accordance with UPS procedures and guidance and decreased the time available for the first officer to perform her duties. 2.3.2.2 Pilot Monitoring The NTSB has long recognized the importance of flight crew monitoring skills in accident prevention. For example, an NTSB safety study of 37 major flight-crew-involved accidents found that, for 31 of these accidents, inadequate monitoring and/or cross-checking had occurred (NTSB 1994). The study found that flight crewmembers frequently failed to recognize and effectively draw attention to critical cues that led to the accident sequence. Pilots’ poor flightpath monitoring has continued to be causal and/or contributing to accidents over the last 20 years. The flight crew’s performance in this accident appears consistent with pilot monitoring errors that have been identified in other recent major NTSB investigations (NTSB 2004, 2006, 2010, 2011, and 2014). At 0447:03, when the airplane was about 1,530 ft msl and 2.3 mi from the runway, the first officer made the required 1,000-ft HAT callout. After the 1,000-ft callout, the flight crew did not adequately monitor the descent rate. The airplane was still descending at 1,500 fpm, which was far in excess of the UPS stabilized approach criteria, which required no more than 1,000 fpm below 1,000 ft agl. The NTSB concludes that the flight crew did not monitor the descent rate and continued to fly the airplane with a vertical descent rate of 1,500 fpm below 1,000 ft agl, which was contrary to SOPs, resulting in an unstabilized approach that should have necessitated a go-around. The flight crew should have continued to monitor the airplane’s altitude but did not; neither crewmember noticed that the airplane was nearing or had reached the minimums altitude and the first officer did not make the subsequent required altitude callouts of “approaching minimums” (1,300 ft msl) and “minimums” (1,200 ft msl). These callouts should have elicited either a “landing/continuing” (if the airport was in sight) or “go-around, thrust, flaps” (if the airport was not in sight) response from the captain and would have further alerted the crew to their proximity to the ground. Because the flight crew was flying a nonprecision approach in instrument conditions, extra vigilance was required to ensure that the airplane did not descend below the minimums altitude without the airport being in sight. The NTSB considered whether, once the profile path did not capture, the captain may have been attempting to use vertical speed to reintercept the glidepath from above or was using a vertical speed “dive-and-drive” approach. Because he did not brief the first officer on his intentions, the captain’s exact intentions could not be determined. Although the captain may not have intended to fly a “dive-and-drive” approach, the approach essentially became a “dive-and-drive” approach based on his actions: (1) there was no indication of a glideslope for him to descend to because the VDI never moved from its full-up scale indication; (2) he did not maintain a constant vertical speed descent as depicted on the approach chart;98 and (3) the captain selected a vertical descent of 1,500 fpm, which is the maximum vertical speed guidance outlined in the AOM for a vertical speed method consistent with “dive and drive.”

98 The approach chart indicated that the rate of descent was 813 fpm to conduct a CDFA.

NTSB Aircraft Accident Report 65 The captain’s belief that the airplane was “way high” on the approach and/or fatigue (see section 2.4.1) likely contributed to his failure to adequately monitor the airplane’s descent rate and altitude. The time compression resulting from the excessive descent rate, the first officer’s diverted attention, and/or fatigue (see section 2.4.2) likely impeded the first officer’s ability to comply with the requirement for these callouts. The airplane reached these altitudes far faster than the first officer would have expected because of the excessive descent rate. Further, although the first officer should have been looking at the barometric altimeter to ensure timely callouts for the PF, given that she did not make the callouts, her attention may have been diverted. At 0447:05, the captain stated that the decision altitude (which, as noted, should have been the minimum descent altitude because of the approach change) was 1,200 ft and, at 0447:08, the first officer replied, “twelve hundred yeah.” At this point, the airplane was still about 200 ft above the minimum descent altitude, so it is unlikely that the first officer used this as an unconventional callout at that time. The airplane continued its descent rate of 1,500 fpm. At 0447:11, the captain stated “two miles,” which could be consistent with him momentarily referencing the approach chart that indicated that IMTOY was 2 mi from the end of the runway. The airplane passed the IMTOY stepdown fix at an altitude near the prescribed altitude of 1,380 ft msl but continued to descend at 1,500 fpm. At 0447:19.6, as the airplane was about 90 ft below the minimum descent altitude, the first officer remarked, “it wouldn’t happen to be actual [chuckle],” to which the captain responded, “oh, I know,” followed 1.5 seconds later by the aural “sink rate” caution alert. The first officer’s statement was inconsistent with any known callout and was not likely associated with any annunciation or cue inside the cockpit. Instead, the first officer’s remark appears to be more consistent with the weather conditions the flight was encountering during the approach— either a query about the weather as a result of the captain not having announced the airport in sight or a commentary associated with her own observations out the window. Therefore, the NTSB concludes that the flight crew did not sufficiently monitor the airplane’s altitude during the approach and subsequently allowed the airplane to descend below the minimum altitude without having the runway environment in sight. Because the ATIS reported a ceiling of 1,000 ft, the first officer may have expected to break out of the clouds at that altitude. It is quite possible that, after making the 1,000 ft HAT callout, the first officer began to look out the window because she expected that they would soon see the airport environment, even though, unknown to the flight crew, the estimated cloud base was about 350 ft above airport elevation.99 Her remark of “it wouldn’t happen to be actual [chuckle]” likely indicated her realization that her expectations were not being met and that the ceiling was, in fact, lower because although the airplane was continuing to descend, she still did not see the airport. If the remark was associated with the first officer’s own attempts to search for the airport environment, she would not be attending to the barometric altimeter to make the callouts. As pilot monitoring, the first officer could quickly glance outside the airplane, but her primary duty was to monitor the instruments.100 It is conceivable that the first officer believed

99 Information from video images recorded by a surveillance video camera based at the airport, correlated with information from the CVR and FDR, indicated that the airplane emerged from the clouds at about 1,000 ft msl, or about 350 ft above airport elevation. 100 UPS procedures required that the PM primarily monitor the instruments and at the “approaching minimums” callout, the PF then would divide attention between inside the cockpit and outside in an attempt to acquire visual reference with the runway environment. The PM would continue to monitor the instruments to make the “minimums” callout.

NTSB Aircraft Accident Report 66 that looking out the window would not be of consequence (especially because she did not hear the captain call out that the airport was in sight and she expected it to be); however, with the time compression resulting from the excessive descent rate and her fatigued state, it proved catastrophic. The NTSB concludes that the first officer’s failure to make the “approaching minimums” and “minimums” altitude callouts during the approach likely resulted from the time compression resulting from the excessive descent rate, her momentary distraction from her PM duties by looking out the window when her primary responsibility was to monitor the instruments, and her fatigue. See section 2.4.2.1 for a discussion of the first officer’s fatigue. Although the first officer did not make the “minimums” callouts, the captain had adequate instrumentation to ensure that he leveled off at 1,200 ft until the airport environment was in sight. As PF in instrument conditions, he should have been primarily monitoring the flight’s altitude and dividing his visual scan between the instruments and outside the forward window attempting to acquire the PAPI lights to continue his descent below 1,200 ft msl. Because the captain also likely expected to break out of the clouds at 1,000 ft, he may have been distracted from his PF duties by looking out the window in an attempt to acquire the PAPI lights. The NTSB concludes that, although it was the first officer’s responsibility to announce the callouts as the airplane descended, the captain was also responsible for managing the approach in its final stages using a divided visual scan that would not leave him solely dependent on the first officer’s callouts to stop the descent at the minimum descent altitude. The NTSB also concludes that the captain’s belief that they were high on the approach and his distraction from his PF duties by looking out the window likely contributed to his failure to adequately monitor the approach. The EGPWS “sink rate” caution alert sounded when the airplane was about 1,000 ft msl (about 250 ft radio altitude and 200 ft below the minimum descent altitude), and the captain reduced the commanded vertical descent speed to about 400 fpm and then reported having the runway in sight. The first officer also reported the runway in sight (further evidence that she was looking out the window and not at the instruments), and the captain disconnected the autopilot. About 1 second later, which was about 30 seconds after the first officer’s 1,000-ft height-above- touchdown callout, the CVR recorded the first sounds of impact. The ASOS at BHM was found to be working normally without any system malfunctions. Although the ATIS reported a 1,000 ft-broken ceiling, the 350-ft cloud cover encountered over the approach path was likely some of the earlier reported clouds that did not continue drifting southward over the ASOS ceilometer equipment and was not noticeable to the weather observer or ATC tower controller. VMC was officially reported over the airport at the time of the accident. 2.4 Flight Crew Performance The NTSB evaluated a number of criteria, including recent sleep, sleep quality, circadian factors, and time awake, to determine whether the flight crewmembers were experiencing fatigue at the time of the accident. Scientific research and accident and incident data have shown that operating when fatigued can lead to performance decrements (Caldwell 1997, 932-938; Kruger 1989, 129-141; Previc 2009, 326-346; NTSB 2011; and NTSB 2011). The following sections will discuss how fatigue might have affected each pilot’s performance during the accident sequence.

NTSB Aircraft Accident Report 67 The flight crew had been on duty for 1 day before the accident. The previous day’s schedule was not unusually demanding and did not result in an extended duty day or reduced rest period the day before the accident. However, the accident occurred about 0447, and the flight crewmembers were awake in opposition to their normal circadian rhythm. Humans naturally follow a diurnal schedule, and the primary circadian trough is from about midnight to 0600, with the window of circadian low generally occurring between 0300 and 0500. Implementing good sleep habits, taking a short nap before reporting for duty, strategically using caffeine, and getting regular exercise are just some of the strategies that pilots can use to prepare for operating during the circadian low (Caldwell and others 2009, 29-59). 2.4.1 Captain’s Performance 2.4.1.1 Fatigue Evaluation Interviews with pilots who knew the captain revealed that he was concerned about his schedules over recent years and that he had told them that the schedules were “killing” him and becoming more difficult. Staff reviewed the captain’s schedules for the 60 days before the accident flight to determine if his schedules would result in chronic fatigue (Lasseter 2009, 10-15).101 Although the captain flew 6 days in a row on his previous three trip pairings, he generally was off duty for 7 or more days between trips, including just before the accident pairing, allowing for adequate time to recover from any sleep debt he may have acquired while on duty. In addition, his wife indicated that he was in good health, exercised often, and was very happy in the days before the accident. This description of the captain is not characteristic of someone experiencing chronic fatigue. Because the captain had adequate off-duty time to recover from any sleep debt obtained during his previous duty period and his schedule showed that he had adequate rest time available, the captain was not experiencing chronic sleep debt at the time of the accident. The captain’s wife indicated that he slept well the 2 nights preceding the accident, and no information was available to suggest that he did not receive adequate rest on those nights. His wife stated he went to bed between 2130 and 2200 on Sunday night and that his first known activity was on Monday, August 12, about 0552. The captain took several steps to minimize the effects of fatigue due to the circadian clock before going on duty Monday night. He napped during the day and, after jumpseating to SDF, secured a sleep room at the UPS facility. Based on the available data, he had about 1 hour 20 min of rest opportunity in SDF. Following a 3-hour 54-min duty period on the morning of Tuesday, August 13, the captain had 14 hours 30 min of scheduled rest. According to cell phone and hotel records, the captain had a sleep opportunity of about 9 hours 45 min broken into three rest periods the day before the accident. Daytime sleep is more likely to be fragmented due to the body’s inclination to be awake during daylight hours, and fragmented sleep has been shown to be

101 Symptoms of chronic fatigue include being tired all of the time, having a loss of motivation, and becoming withdrawn.

NTSB Aircraft Accident Report 68 less restorative than unfragmented sleep (Stepanski 2002, 268-276). However, the captain had adequate opportunity to obtain a full 8 hours of sleep. The captain spoke with his wife about 1930 and told her that he rested during the day. The captain went on duty about 2036 and flew from RFD to PIA and then PIA to SDF. In SDF, he secured a sleep room. Based on cell phone records and UPS data, the captain had a 2-hour opportunity to nap before departing SDF on the accident flight. The CVR recorded a conversation between the flight crew while on the ramp in Louisville. Between 0341:53 and 0343:34, the crew discussed schedules and rest and fatigue. At 0342:54, the first officer explicitly said she “slept good” in Rockford, and the captain responded “me too.” The first officer further stated that she “was out in that sleep room when my alarm went off I mean I’m thinkin’ I’m so tired.” The captain made no explicit reference to his own rest in SDF but responded, “I know.” Based on the available data, the captain had the opportunity to obtain adequate rest before the accident flight and was not experiencing acute sleep loss. Although research suggests that appropriately placed naps can improve alertness for up to 24 hours (Dinges 1987), because the accident occurred about 0447 (a time of day associated with a dip in the circadian rhythm), the captain may have been experiencing some fatigue at the time of the accident. Even when well rested, operating during this time of day increases the likelihood of performance decrements (Caldwell 1997; Kruger 1989; Previc and others 2009). However, the captain, in this case, had employed fatigue countermeasures, and most operations that occur during this time of day do not result in accidents. Although other issues, could explain the captain’s performance, the errors and decisions made by the captain may be attributed to factors including, but not limited to, fatigue, distraction, and confusion, consistent with performance deficiencies exhibited during training. The NTSB concludes that for the captain, fatigue due to circadian factors may have been present at the time of the accident. 2.4.1.2 Captain’s Errors Although pilots who flew with the captain reported that he was qualified and followed procedures, his training records indicate past performance deficiencies that are consistent with the types of errors made during the accident flight. While the deficiencies noted during the captain’s training may not be unusual, they can be predictive of future deficiencies, especially for skills that are not practiced routinely. The captain twice withdrew voluntarily from upgrade training on the 757 (in 2000 and 2002) because he reportedly felt overwhelmed with the program.102 During captain upgrade training in the A300 in 2009, the captain had deficiencies that required repeating or being debriefed on the scenarios for the following reasons: looking at the radio altimeter instead of the barometric altimeter for height above airport, getting behind on a localizer approach using vertical speed, descending to an incorrect altitude on a nonprecision approach using vertical speed, using vertical speed during a descent when profile or level change would have worked better, using decision altitude instead of minimum descent altitude and flying below minimums, and failing to communicate to the PF that he had an inadequate descent rate. He successfully upgraded to captain on the A300 in June 2009. During recurrent training in 2013, he was required to redo an item when he set his minimums bug incorrectly while

102 The captain reported this information to one of his former instructors.

NTSB Aircraft Accident Report 69 performing a nonprecision approach. Most of these errors were associated with flying a nonprecision approach. The captain is responsible for setting the tone in the cockpit for the entire flight, and this is even more critical during the approach and landing phase of flight when workload is higher. The captain did perform the approach briefing in accordance with the operator’s guidance and adhere to SOPs for the takeoff, cruise, and initial descent phases of flight. However, during this flight, the captain demonstrated poor decision-making by continuing the approach after the profile did not capture, failing to communicate the change in the approach method, not monitoring the descent rate and altitude, and failing to initiate a go-around when the approach was unstabilized below 1,000 ft. The NTSB concludes that the captain’s poor performance during the accident flight was consistent with past performance deficiencies in flying nonprecision approaches noted during training; the errors that the captain made were likely the result of confusion over why the profile did not engage, his belief that the airplane was too high, and his lack of compliance with SOPs. See section 2.5.5 for a discussion on nonprecision approach proficiency. 2.4.2 First Officer’s Performance 2.4.2.1 Fatigue Evaluation The first officer started the trip pairing on August 10, flying from SDF to SAT for a scheduled layover of more than 62 hours. After arriving in SAT, the first officer took a commercial flight to Houston, Texas, to visit a friend. The first officer’s husband reported that, when she was not working, she would typically sleep an estimated 9 to 10.5 hours of sleep per night. On August 10, the first officer had a sleep opportunity of 9 hours 31 min, consistent with her reported off-duty sleep habits. However, despite having over 62 hours off duty, a review of the first officer’s PED data revealed that, on the subsequent nights leading up to the accident flight, the first officer did not manage her off-duty time sufficiently to obtain adequate sleep before resuming duty on August 12 about 2053. Specifically, on the night of August 11, the first officer had a sleep opportunity of only 6 hours 27 min. She spent the morning of August 12 in Houston and returned to SAT on a commercial flight, which departed about 1325. Based on her known activities that day, the first officer had only two opportunities to nap before returning to duty: 1 hour 2 min before departing Houston and 1 hour 21 min after arriving in SAT. It could not be determined if the first officer took advantage of these sleep opportunities. Based on the available data, it appears that the first officer chose to revert to a diurnal schedule during her 62-hour layover, sleeping at night and being awake during the day. During the layover, the first officer visited a friend in Houston. While she reported to her husband that she was tired and sleeping all the time, her PED usage indicated few opportunities for sleep during the layover. Although she was not required to stay in SAT, she was required to arrive for work fit for duty and should have ensured that she received adequate sleep before reporting for duty on August 12. Additionally, UPS would have paid for a hotel room in SAT for the layover, which the first officer could have used to adjust her schedule to a nocturnal one. Adjustment to night activity is possible, and, under ideal conditions, the adjustment occurs about 1 hour per day (Wever 1980, 303-327). However, research suggests that it can be difficult for humans to flip their sleep-wake habits. A NASA study examining pilots in overnight cargo operations found that the circadian clock of pilots did not shift completely. Further, the circadian low is delayed

NTSB Aircraft Accident Report 70 about 3 hours after 5 days of night flying (Gander and others 1998, B26-B36). Because the accident occurred during the window of circadian low, the first officer was awake in opposition to her normal body clock and would have been more vulnerable to the negative effects of fatigue that she was already experiencing. Even if the first officer did take advantage of the sleep opportunities available on August 12, she would not have been adequately rested for duty. She had likely been up for about 13 hours before reporting for duty with less than a 2 1/2 hour opportunity for sleep, and her duty day required her to be awake for another 9 1/2 hours. Less than 90 min before going on duty, the first officer texted a friend stating, “I’m getting sooo tired.” About 2 hours later, she sent another text stating, “hey, ba[c]k in the…office, and I’m sleepy....” The first officer’s duty period consisted of three legs: SAT to SDF, SDF to PIA, and PIA to RFD, departing SAT about 2151 and arriving in RFD about 0553 on August 13 (during the 2 hours 59 min in SDF, she did not secure a sleep room). At this point, the first officer would likely have been experiencing a sleep debt in excess of 9 hours. During the 14-hour 30-min layover in RFD on August 13, based on her known activities, the first officer had two sleep opportunities of about 3 hours 54 min and 1 hour 22 min (from 0649 to 1043 and 1705 to 1827).103 This total sleep opportunity was less than the recommended 7 to 9 hours for adults and less than her typical sleep. In addition, she did not afford herself the opportunity to obtain additional sleep as evidenced by her repeated PED usage and the fact that she was out of her room from about 1100 to 1522. As noted previously, fragmented sleep has been shown to be less restorative than unfragmented sleep. A pilot is responsible for taking measures to obtain adequate rest and be fit for duty. The first officer was aware of her fatigued state as she texted a friend about 1118, stating, “u got that rite, i fell asleep on every…leg last nite- n rfd now, got here at 6 am n bed by 645 ish, now…up, slept like 4…hrs…hoping i will nap again this afternoon.” Given the first officer’s discussions with friends about her fatigue, she should have used her off-duty time more effectively to obtain as much sleep as possible. The first officer went back on duty about 2036 and flew with the accident captain from RFD to PIA and then from PIA to SDF. In SDF, the first officer obtained a sleep room and had a sleep opportunity of about 1 hour 51 min. The CVR recorded the first officer telling the accident captain that she slept in the sleep room. As noted previously, she further stated she was tired when her alarm went off before the accident flight. About an hour had elapsed when this conversation was recorded on the CVR and, at the time of the accident, about 2 hours had elapsed from when the first officer awoke from her nap; therefore, she should not have been experiencing sleep inertia during the accident flight.104 There was no follow-up discussion by the captain about whether the first officer was fit for duty. Even if the first officer had been able to take advantage of the full rest period in RFD and the sleep opportunity in SDF, due to the excessive sleep debt acquired over the previous 2 days due to her personal choices and the accident flight occurring during the window of circadian low, it is unlikely that she would have

103 A third extended break in the first officer’s known activities of 1 hour 55 min (from 1148 to 1343) occurred on August 13; however, after the first officer was observed in the hotel restaurant having breakfast, she did not swipe her key back into her room until 1522. Her whereabouts during that time could not be determined. 104 Sleep inertia is the grogginess or sleepiness that a person may feel after awakening and typically dissipates about 10 to 15 min after awakening but can last about 35 min (Rosekind and others 1995, 62-66). Either the first officer’s acquired sleep debt or sleep inertia could explain why she felt tired when she awoke from her nap.

NTSB Aircraft Accident Report 71 been able to fully recover and be adequately rested for any of her duty period that began on the evening of August 13. Although the errors the first officer made during the accident flight cannot be solely attributed to fatigue, the first officer made several errors consistent with the known effects of fatigue. Specifically, the first officer did not clear the route discontinuity in the FMC (something that should be almost automatic, as it is done on every UPS flight), did not recognize cues suggesting the approach was not set up properly, did not adequately cross-check and monitor the approach (especially below 1,000 ft), and missed critical callouts. Although some of these errors may have resulted, in part, from distraction while looking for the airport, time compression, and her confusion about the change in approach modes, fatigue likely further negatively affected the first officer’s performance. Nothing in the first officer’s training records indicated any problems with her PM skills. In summary, there were several decisions made by the first officer that contributed to her fatigue, which could have been mitigated by alternate choices. The first officer could have more effectively managed her sleep/wake schedule during her extended layover in San Antonio to minimize further adverse effects when she returned to night duty on August 12. Additionally, the first officer could have taken full advantage of her sleep opportunities in the days preceding the accident but instead she had extensive PED use, the timing of her return trip from Houston to SAT, did not secure a sleep room in SDF on the morning August 13, and later that day was outside of her hotel room for about 5 hours. Finally, when the first officer recognized that she was tired, she could have followed company guidance and called in fatigued. The NTSB concludes that the first officer poorly managed her off-duty time by not acquiring sufficient sleep, and she did not call in fatigued; she was fatigued due to acute sleep loss and circadian factors, which, when combined with the time compression and the change in approach modes, likely resulted in the multiple errors she made during the flight. 2.4.3 UPS and IPA Fatigue Mitigation Efforts UPS has a comprehensive FRMP that includes fatigue training, stricter flight- and duty-time limitations than required by Part 121 Subpart Q per the UPS/IPA collective bargaining agreement, and data collection and analysis. UPS also encourages joint responsibility between the company and the pilots to prevent and mitigate fatigue. UPS provides the Flight Crew Alertness Guide, which contains recommendations and tips for obtaining adequate rest and maintaining alertness on the flight deck. As noted previously, the accident occurred during the window of circadian low, a time that many cargo operators conduct their flights. UPS pilots were required to perform a CRM/safety briefing before each flight, in part, for the captain to set the tone in the cockpit, but the briefing did not include the threat of fatigue. UPS and FAA personnel indicated that while fatigue could be briefed as a threat, it was not required; therefore, the frequency that fatigue was briefed as a threat varied from every flight to never based on the pilot’s preference. UPS fitness for duty policy notes, “This [fitness for duty] decision is vital to safety and the notification must occur without hesitation. UPS Crew Scheduling will remove the crewmember from service and provide further assistance, as required.” The NTSB concludes that, given the increased likelihood of fatigue during overnight operations, briefing the threat of fatigue before every flight would give pilots the opportunity to identify the risks associated with fatigue and mitigate those risks before taking off and throughout the flight. Therefore, the NTSB recommends that the FAA require principal

NTSB Aircraft Accident Report 72 operations inspectors (POIs) to ensure that operators with flight crews performing 14 CFR Part 121, 135, and 91 subpart K overnight operations brief the threat of fatigue before each departure, particularly those occurring during the window of circadian low. Additionally, the NTSB recommends that UPS and IPA work together to conduct an independent review of the fatigue event reporting system to determine the program’s effectiveness as a nonpunitive mechanism to identify and effectively address the reported fatigue issues. Based on the findings, implement changes to enhance the safety effectiveness of the program. The NTSB has had longstanding concerns about fatigue in aviation, and, for many years, this issue was on the NTSB’s Most Wanted List. The FAA recently issued new flight- and duty-time regulations for Part 121 operations that went into effect on January 4, 2014. However, these regulations do not apply to all-cargo operations. The NTSB has stated that it believes that the FAA should include all Part 121 operations under the new rules. Although all-cargo operators can voluntarily choose to follow these regulations, UPS has not. Following the NTSB’s investigative hearing, the UPS director of safety submitted correspondence stating that the Part 117 rules “would not enhance safety for cargo carriers, yet would impose high and unnecessary costs.” He added that UPS “has been a pioneer in fatigue management techniques, going above and beyond the regulations where appropriate” and that its collective bargaining agreement with IPA “contains a detailed scheduling article on flight, duty, and rest time…[that] ha[s] enhanced UPS’s safe and effective approach to these issues.” Although, at the time of the accident, Part 117 was not in effect for any operations, the NTSB asked the FAA to compare the accident flight crew’s schedule for their entire pairing105 to Part 117 regulations. The FAA determined that the pairing would have met Part 117 regulations for both flight crewmembers. However, for the previous 60-day schedule, the captain would have had one rest period that did not meet the minimum requirement (it was 9 min short), and twice his schedule would have been 1 day beyond the Part 117 nighttime flight duty period requirements. The NTSB reviewed the FAA’s determination and concurs with its findings. The NTSB concludes that the schedule the flight crew was flying would have been in compliance with 14 CFR Part 117 requirements had those requirements been in effect and applied to all-cargo operators. The UPS fatigue policy stated that crewmembers who called in fatigued would be immediately removed from duty until they felt fit to fly again. The crewmember was then required to complete a fatigue event report that would be reviewed by company and union representatives to determine if the company or the crewmember was responsible for the fatigue. If it was determined that the crewmember was responsible for being fatigued (for example, if the crewmember mismanaged off-duty time), the crewmember’s sick bank would be debited for the time not flown. The UPS fitness for duty policy stated, “UPS crewmembers are expected to report for all assignments fit for duty. Further, UPS crewmembers are prohibited from operating aircraft if they are not fit for duty… Fitness for duty includes, but may not be limited to, being free from illness, injury, fatigue, scuba diving restrictions, blood donations, alcohol, drugs, etc.” Additionally, the FOM stated the following:  Do not operate as a crewmember if fatigue compromises your ability to safely perform your assigned duties. Crewmembers are expected to report for duty rested

105 The pairing was 4 days for the captain and 7 days for the first officer.

NTSB Aircraft Accident Report 73 and prepared for scheduled duty periods. Duty periods may include revision or reschedule as defined by the Collective Bargaining Agreement.  NOTE: In addition to notifying Crew Scheduling, crewmembers who determine they cannot perform assigned duties due to fatigue, are required to complete a Fatigue Event Report.  Refer to the “Fatigue Risk Management” section of Chapter 05, Crew Resource Management (CRM) for additional guidance. Although no letter would be placed in a crewmember’s file for calling in fatigued, it would be noted in the crewmember’s record that a fatigue call was made. An IPA representative believed this to be a punitive action; however, four of the six pilots interviewed who had called in fatigued said that having done so would not stop them from calling in fatigued again. Company documentation of a fatigue call is understandable because it ensures that crewmembers are not abusing the system and helps determine whether a particular crewmember has a systemic issue causing fatigue. Further, pilots’ salaries are not directly affected by a fatigue call; rather, their sick banks are debited if it is determined that their personal activities led to the fatigued state. However, UPS’s unique sick bank policy, in which pilots are paid at the end of each year for any sick time not used throughout the year, could discourage pilots from calling in fatigued because they wanted to maximize this year end “bonus.” However, it should be noted that crewmembers whose sick bank is debited following a fatigue call can repay their sick bank within the current or next two pay periods by picking up an extra trip. Therefore, the NTSB concludes that the first officer did not adhere to the UPS fatigue policy; she could have called in fatigued for the accident flight if she were not fit for duty and been immediately removed from duty until she felt fit to fly again. Crewmembers are responsible for arriving at work fit for duty, and the union can serve an important function in encouraging and educating its members on being fit for duty. During the NTSB’s February 20, 2014, investigative hearing on this accident, the IPA representative stated that the IPA had published a few articles on fatigue (for example, in 2011, it published an article in the IPA SAFER Skies magazine that focused on good sleep habits and fatigue countermeasures) but that it provided no additional guidance on fatigue to its members. The union can play a critical role in counseling its members on whether they are fit for duty and counseling them to call in fatigued when necessary. The union can also provide additional information on fatigue countermeasures and personal responsibility to members who do call in fatigued and whose sick bank is debited. The NTSB concludes that, by providing fatigue counseling, UPS and IPA would help to increase pilot awareness and understanding about fatigue and may provide a valuable resource in understanding fatigue calls. Therefore, the NTSB recommends that IPA and UPS work together to counsel pilots who call in fatigued and whose sick bank is debited to understand why the fatigue call was made and how to prevent it from recurring. 2.5 Operational Issues 2.5.1 Dispatcher Training Per 14 CFR 121.533, the pilot-in-command and the dispatcher work together to ensure that all aspects of the operation of a flight are conducted safely. This cooperation depends on

NTSB Aircraft Accident Report 74 both the pilot-in-command and dispatcher working from the same information related to the flight to make safety-related decisions. Dispatchers are taught DRM principles, much like CRM principles are taught to pilots. According to the UPS FOTM and the flight control manager who testified at the NTSB’s investigative hearing, one of the objectives of DRM is improved interface or contact with each pilot-in-command. FAA AC 121-32A, “Dispatch Resource Management Training,” provides guidance on DRM. The AC encourages joint training between dispatchers and all operational personnel (including pilots) and notes the importance of communication and instruction in developing and refining the dispatchers’ communication skills. UPS dispatchers received about 18 hours of initial DRM training and 1 hour of DRM training during recurrent annual training, none of which is conducted jointly with pilots. Because pilots and dispatchers do not interact during DRM training (and because pilots do not even receive DRM training), communication between a dispatcher and pilot may be hampered by misunderstandings about the role each one plays in the flight-planning process. The accident flight dispatcher told investigators that he typically did not talk to pilots unless they initiated the conversation. However, a UPS flight control shift manager said that UPS dispatchers had multiple means to interact with a flight crew, including via cell phone or land line, satellite communications, the Aircom Server on most airplanes, or the ACARS. Reasons for interaction could include discussion about significant weather en route or at the destination or limited approach options. The accident flight dispatcher reported that he and the accident pilots did not communicate with each other before the accident flight. Although it is not required that pilots and dispatchers communicate before every flight during normal operations and a verbal dispatch briefing is not required before every flight, the basic tenets of CRM and DRM suggest that both pilots and dispatchers share information that may affect the safety of a flight and should not assume the other is already aware of any issue identified. Further, both dispatchers and pilots have the operational authority to delay a flight, although UPS did not have a specific policy as to when or under what specific circumstances a dispatcher could delay a flight. Because the dispatcher and flight crew were jointly responsible for the safety of the flight, if the dispatcher or captain had delayed the flight by 9 min from its scheduled 0451 arrival time,106 runway 06 with an ILS precision approach was scheduled to be open and potentially would have provided the flight crew with the option to execute a more familiar ILS precision approach to runway 06. However, as noted earlier, while the dispatcher was aware that runway 06 was closed, the flight crew did not appear to be aware of this closure based on their apparent surprise when they received the ATIS briefing for a runway 18 landing. While the dispatcher may have been reluctant to communicate with the flight crew by alerting them to the closure, DRM training could have given him the confidence to communicate with and ensure the flight crew was aware of this information. Further, the flight crew, with joint dispatcher training, may have been more apt to converse with the dispatcher about any potential safety issues for the flight.

106 The NTSB is aware of at least one cargo operator scheduled to land at BHM around the same time as the accident flight that delayed its arrival in order to land on runway 6.

NTSB Aircraft Accident Report 75 As noted, UPS dispatchers and pilots, who are jointly responsible for the safety of a flight per 14 CFR 121.597, do not train together, which may have hampered communication between the dispatcher and the flight crew. If pilots and dispatchers are aware of their roles and responsibilities and understand where communication breakdowns may occur, the communication between them could be improved. Therefore, the NTSB concludes that a joint dispatcher/pilot training module, specific to CRM and DRM principles, would facilitate improved communication between pilots and dispatchers and enhance their understanding of the challenges and capabilities of the pilot/dispatcher roles in the safe operation of the flight. As a result, the NTSB recommends that the FAA require operators to develop an annual recurrent DRM module for dispatchers that includes participation of pilots to reinforce the need for open communication. 2.5.2 Crew Briefings The UPS A300 AOM stated, “crew briefings are a critical part of the cockpit communications process. They should be used to supplement SOPs; aiding each crewmember in understanding exactly what is expected during taxi, takeoff, approach and landing.” According to the UPS flight standards and training manager’s testimony at the NTSB’s investigative hearing, an approach briefing provides both pilots a “shared mental model” (that is, an understanding) of how the approach is going to be conducted. The UPS flight standards and training manager further stated that “if an element within that approach briefing were to change, the expectation would be either to re-brief it if there’s time to do that before initiating the actual approach, or build yourself some time, which would be either take a turn in holding, take radar vectors, or essentially abandon that particular approach.” The UPS AOM does not specifically instruct pilots to rebrief or abandon the approach if the type of approach changes. However, when the UPS director of operations was asked during the NTSB’s investigative hearing about the flight crew’s responsibility to rebrief or abandon the approach, he stated, “it would be the expectation.” Yet the captain, when he noticed that the airplane was not descending on the profile as planned, changed the autopilot from the profile mode to the vertical speed mode without briefing the first officer. She had to seek out information on this autopilot mode change. The purpose of briefing any change in the approach is to ensure that crewmembers have a shared understanding of how the approach will be flown. By not briefing the autopilot mode change, the first officer’s situational awareness was degraded. Therefore, the NTSB concludes that by not rebriefing or abandoning the approach when the airplane did not capture the profile glidepath after passing the FAF, the flight crewmembers placed themselves in an unsafe situation because they had different expectations of how the approach would be flown. Therefore, the NTSB recommends that the FAA require POIs to work with operators to ensure that their operating procedures explicitly state that any changes to an approach after the completion of the approach briefing should be rebriefed by the flight crewmembers so that they have a common expectation of the approach to be conducted.

NTSB Aircraft Accident Report 76 2.5.3 Enhanced Ground Proximity Warning System Alerts and Response At 0447:24.5, CVR and FDR data indicated that the pilots received an EGPWS aural “sink rate” caution alert at an altitude of about 250 ft agl while descending about 1,500 fpm.107 The FDR recorded a reduction in the commanded vertical speed on the mode control panel shortly thereafter. However, the airplane began to strike the trees 8 seconds after the sink rate alert. About 1 second after striking the trees, the CVR recorded an EGPWS “too low terrain” caution alert. In accordance with the A300 AOM, UPS A300 pilots were trained to respond to a “sink rate” caution alert by either adjusting the pitch attitude or applying thrust to silence the alert.108 However, EGPWS guidance in the UPS A300 PTG stated that if a “sink rate” caution alert was received while operating in IMC, the PF must perform a go-around or the CFIT recovery maneuver, as appropriate. Thus, the PTG distinguished between the appropriate responses to a “sink rate” caution alert in IMC and VMC, and that distinction was absent from the AOM guidance. During the NTSB’s investigative hearing for this accident, the UPS flight standards and training manager said that “for a sink rate alert to go off, [the approach has] to be unstabilized,” and, thus, a go-around would be the appropriate response. However, this statement goes beyond the AOM guidance that indicated that only adjusting the vertical speed using pitch attitude or applying thrust in response to a “sink rate” caution alert (which the captain did) was necessary. The captain’s actions in response to the alert were consistent with the guidance provided in the AOM, but not the PTG. Another example of inconsistent guidance relates to the EGPWS “too low terrain” alert. Although the pilots did not receive a caution alert until after the airplane had struck the trees, a review of the AOM and PTG guidance indicated differences between the recommended responses to a “too low terrain” alert, which could create confusion for pilots on which procedure to use when such an alert occurs. Specifically, the PTG contained more aggressive guidance than the AOM for pilots addressing “too low terrain” alerts, indicating that pilots should perform the aggressive CFIT avoidance maneuver, which involved disengaging the autopilot, rotating the airplane 20º nose up, applying maximum thrust, retracting the speedbrakes, and rotating further, up to stick shaker if required. The AOM stated that the pilot should adjust the flightpath or go around. Although the PTG included more aggressive response procedures, UPS A300 pilots were trained and evaluated on their responses to the EGPWS alert based on the less aggressive guidance contained in the FAA-approved AOM, which was similar to the Airbus information. Because the EGPWS provides critical information to help a pilot avoid terrain, it is imperative that pilots receive appropriate and consistent training so that the response is immediate. Had the captain performed the CFIT-avoidance maneuver in response to the “sink rate” alert as specified in the PTG, performance data showed that the airplane could have avoided terrain. Additionally, there may have been adequate time to perform a successful go-around. Therefore, the NTSB concludes that the captain’s moderate response to the EGPWS “sink rate” caution alert (adjusting the flight’s vertical speed) was consistent with AOM

107 The NTSB notes that the approach was unstabilized when the airplane passed through 1,000 ft AFE at a descent rate of 1,500 fpm and that the pilots should have conducted a go-around at that point. 108 Review of Airbus guidance showed that for a sink rate alert, the flight crew should adjust the pitch attitude and thrust to silence the alert.

NTSB Aircraft Accident Report 77 guidance and training; however, the response was not sufficient to prevent striking the trees on the approach and was not consistent with the more conservative guidance in the PTG. Therefore, the NTSB recommends that the FAA require POIs to ensure consistency among their operators’ training documents, their operators’ FAA-approved and -accepted documents, such as the AOM, and manufacturers’ guidance related to TAWS caution and warning alert responses, and ensure that responses are used during night and/or IMC that maximize safety. 2.5.4 Continuous Descent Final Approach Technique As noted previously, a CDFA is a specific technique for flying the final approach segment of a nonprecision instrument approach as a continuous descent, without level-off, from a specific altitude near the FAF to a point about 50 ft above the landing runway threshold or the point where the flare maneuver should begin for the type of aircraft flown. FAA AC 120-108 describes and recommends the use of the technique of a stable continuous descent path in lieu of the traditional “dive and drive” type of nonprecision approach, which can lead to unstabilized approaches because of multiple thrust, pitch, and altitude adjustments inside the FAF. Although the flight crew set up and briefed a CDFA approach using the profile method, when the captain changed the autopilot to vertical speed mode, the approach essentially became a “dive and drive” approach. Per the guidance and training provided at UPS, both approach options were available to flight crews. Although CDFA was one of the techniques taught at UPS, the guidance for CDFA was found in the PTG, which is not an FAA-approved or -accepted manual. As stated in FAA AC 120-108, CDFA requires no specific aircraft equipment other than that specified by the nonprecision approach procedure. It also minimizes the risk of unstabilized approaches and CFIT.109 The NTSB concludes that the CDFA technique provides a safer alternative to “dive and drive” during nonprecision approaches. As noted previously, in response to Safety Recommendation A-06-8, which asked the FAA to incorporate the constant-angle-of-descent technique into their nonprecision approach procedures and to emphasize the preference for that technique where practicable, the FAA stated that it would include a requirement for training on and incorporation of the constant-angle-of-descent technique in its final rule on “Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers.” However, the final rule did not contain such a requirement. While the FAA has indicated that it favors the use of CDFA, the use of the approach is in guidance material only, and operators are not required to incorporate the

109 International Civil Aviation Organization (ICAO) Doc 8168, Vol. I, Part I, Amdt 3, 1.7.1, states “Studies have shown that the risk of controlled flight into terrain (CFIT) is high on non-precision approaches. While the procedures themselves are not inherently unsafe, the use of the traditional step down descent technique for flying non-precision approaches is prone to error, and is therefore discouraged. Operators should reduce this risk by emphasizing training and standardization in vertical path control on non-precision approach procedures. Operators typically employ one of three techniques for vertical path control on non-precision approaches. Of these, the continuous descent final approach (CDFA) technique is preferred. Operators should use the CDFA technique whenever possible as it adds to the safety of the approach operation by reducing pilot workload and by lessening the possibility of error in flying the approach.” Further, many ICAO Contracting States require the use of the CDFA technique and apply increased visibility or runway visual range (RVR) requirements when the technique is not used. For instance, the EU Ops 1, OPS 1.430, Appendix 1, (d)2, states: “All non-precision approaches shall be flown using the continuous descent final approaches (CDFA) technique unless otherwise approved by the Authority for a particular approach to a particular runway. When calculating the minima in accordance with Appendix 1 (New), the operator shall ensure that the applicable minimum RVR is increased by 200 metres (m) for Cat A/B aeroplanes and by 400 m for Cat C/D aeroplanes for approaches not flown using the CDFA technique, providing that the resulting RVR/CMV value does not exceed 5000 m.”

NTSB Aircraft Accident Report 78 information into their manuals; the FAA also has no mechanism to ensure that carriers are using the CDFA technique and training flight crews to use it. Further, although UPS included the CDFA technique in its PTG and trained flight crews on the technique, it did not require flight crews to use the CDFA when performing nonprecision approaches. In addition, the FAA did not require that the CDFA be included in UPS’s FAA-approved documents nor did they require the inclusion of a prohibition against the use of “dive and drive” approaches in those documents. 110 Because of the safety benefits associated with CDFA, the NTSB believes that FAA-approved nonprecision instrument landing procedures should comply with guidance in AC 120-108 and the FAA must do more to ensure that operators incorporate the CDFA technique in their training and manuals for all nonprecision approaches. Therefore, the NTSB recommends that the FAA require principal operations inspectors of 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to ensure that FAA-approved nonprecision instrument approach landing procedures prohibit “dive and drive” as defined in AC 120-108. Because the FAA did not incorporate the constant-angle-of-descent technique in their final rule on flight crew training, the NTSB classifies Safety Recommendation A-06-8 “Closed—Unacceptable Action/Superseded.” 2.5.5 Nonprecision Approach Proficiency Flight crews can conduct precision or nonprecision approaches. Due to the improved navigation guidance associated with precision approaches, which have a ground-based vertical component, pilots typically conduct them rather than nonprecision approaches, which create a vertical component through navigation systems on the airplane (such as a CDFA approach) or use a step-down approach. Nonprecision approaches with GPS-based vertical guidance are also becoming more prevalent at airports previously only equipped with lateral guidance to the runway as a result of technology advancements and aircraft capabilities. The precise lateral and vertical guidance provided by an ILS allows lower minimums and promotes more stable approaches; therefore, ILS approaches are preferred by operators and are more familiar to pilots than nonprecision approaches. According to interviews and testimony from the UPS A300 check airman at the NTSB’s investigative hearing, although pilots are trained annually on nonprecision approaches, they rarely conduct actual nonprecision approaches during line operations. In most cases, a UPS pilot’s only opportunity to practice nonprecision approaches would likely occur once a year during recurrent training. An unintended consequence of the operational preference for precision approaches is that pilots have lost proficiency with the unique procedures associated with infrequently conducted nonprecision approaches. The NTSB notes that, if pilots practice procedures that they do not use frequently during line operations, their knowledge and skills relative to those procedures will be reinforced. In SAFO 13002, “Manual Flight Operations,” dated January 4, 2013, the FAA states that the continuous use of autoflight systems (for example, autopilot or autothrottle/autothrust) on modern aircraft does not reinforce pilots’ knowledge and skills in manual flight operations; the SAFO encourages operators to promote manual flight operations when appropriate. Similarly, one reason for the higher occurrence of unstabilized approaches noted in FAA AC 120-108 may be line pilots’ lack of reinforced skills in flying nonprecision approaches. Although the flight

110 Several carriers have voluntarily revised their procedures and require crews to conduct CDFA descents for all nonprecision approaches, prohibiting “dive and drive.”

NTSB Aircraft Accident Report 79 crew had been trained to proficiency in nonprecision approach procedures, due to their limited use of nonprecision approaches, some of that proficiency was likely lost. In response to Safety Recommendation A-00-11, which asked the FAA to require nonprecision approach practice under specific conditions, the FAA stated that practicing nonprecision approaches was not necessary because it had developed an industrywide strategy that focused on stabilized approaches, including always using a constant-angle-of-descent technique, for all nonprecision approaches. However, even though 14 years have passed, this technique has not been universally implemented throughout industry. Simply issuing an AC does not ensure that operators incorporate the guidance. As stated above, although UPS trained its flight crews on the CDFA technique, it was not required to be used, and its use was abandoned in this accident when the captain switched to a vertical descent method (essentially a “dive and drive”). Further, UPS did not require that its flight crews practice nonprecision approaches, and the FAA has no such requirement for operators. An ASRS search revealed 62 reports related to nonprecision approaches, 9 of which were similar to the circumstances of this accident. In addition, industry data showed that, when comparing the approaches to ILS runways with nonILS runways at the 31 airports examined, the rate of vertical speed exceedance on approaches to ILS runways was 1/3 the rate of exceedance on nonILS runways. The industry data also showed that, at those same airports, the rate of EGPWS warning alerts for ILS approaches was 1/3 the rate for nonILS approaches; such a warning is not expected for a stabilized approach. The NTSB concludes that, if operators identified and implemented ways for pilots to receive more opportunities to maintain proficiency in nonprecision approaches, pilots could conduct such approaches more safely. 2.5.6 Weather Dissemination Maintaining awareness of weather conditions for landing is critical to the safety of flight. In this accident, the pilots were not aware that the variable ceiling was so close to ground level because they did not receive this pertinent information in their flight departure papers, via ACARS in flight, or from ATIS on approach even though the remarks sections in METAR and SPECI reports noted the information. Dispatch paperwork provided to pilots typically includes multiple METARs that enable the pilots to assess trending weather information. Further, the remarks section of METARs disseminated to flight crews via the dispatch paperwork, ACARS, or ATIS can contain valuable information to assist in the crew’s assessment of potential weather conditions at the airport and along the approach. In this case, had the remarks section of the METARs been provided to the crew, they may have identified that the ceilings were varying for several hours before the accident and this information may have made them more aware that the ceiling may not be what they expected. Although the 0404 CDT SPECI reported that variable ceilings were no longer present, the flight crew never received this report. Making the flight crew aware of the variable ceilings present earlier may have raised their expectations that there could be clouds fairly low to the ground along the approach. This lack of awareness of the pertinent remarks may have played a role in their expectation that they would see the airport immediately after passing the minimum descent altitude; however, they did not see the airport and continued the descent while they continued to look for the airport.

NTSB Aircraft Accident Report 80 The Lido weather feed provides information to a UPS database that supplies weather information for the flight departure papers and ACARS weather requests. However, in September 2011, in response to UPS’s request to delete the remarks section due to duplicate weather alerts, Lido discontinued providing the supplemental feed of METAR data and the remarks section for METARs to flight departure papers and ACARS. Although all remarks may not be pertinent to flight crews, having critical information readily available can help pilots assess current and anticipated weather conditions. For the accident flight, the UPS Lido system issued a weather document that included the reports and forecasts for the departure, destination, and alternate airports; however, the weather document did not include clarifying information in the remarks section of the METAR or SPECI observation concerning the variable ceilings. Omission of the remarks section of the reports in this case prevented the pilots and dispatcher from seeing the information about the variable ceilings from 600 to 1,300 ft that was being reported at the destination; instead, they would only have been aware of the reported sky condition. Title 14 CFR 121.601 requires the dispatcher to provide all available weather reports and forecasts of weather phenomena that may affect the safety of flight. However, by removing the remarks, UPS failed to provide the accident flight crew with pertinent weather information they could have used in planning their approach to BHM. Specifically, the variable ceiling remarks would have indicated that the approach would likely require descent closer to the ground in IMC below the ceiling information provided to the crew. Although UPS has modified its Lido system to provide the remarks section of METARs, other dispatchers or dispatch systems may not provide the remarks, and, as stated above, the remarks can be critical. ATC personnel based the ATIS Papa report of 1,000-ft broken ceiling on the 0353 METAR observation, which included a reported variable ceiling between 600 and 1,300 ft agl in its remarks section; however the remarks were not included in ATIS Papa. ATC personnel did not update the ATIS with the 0404 SPECI, which no longer included a report of a low ceiling. The FAA requires ATC personnel to include “pertinent remarks” in the ATIS broadcast, but limited guidance on what constitutes pertinent remarks is available to controllers; therefore, the interpretation of a “pertinent remark” remains subjective. Other weather guidance, such as the NWS Federal Meteorological Handbook, provides much more detail on what types of weather would require a pertinent remark. If the flight crewmembers had been aware of the variable ceilings reported on the 0353 METAR, they may not have expected to break out of the clouds at 1,000 ft agl. Although the controller’s failure to update the ATIS with pertinent METAR remarks was satisfactorily addressed locally by ATC facility management after the accident, the NTSB determined during the investigation that similar errors related to the lack of inclusion of pertinent remarks in ATIS broadcasts had occurred at facilities throughout the United States. A random sampling of ATIS broadcasts found that many cases of variable ceiling and visibility in the METAR remarks section, similar to those reported in this accident, were not typically included and were not provided to pilots in the terminal area. The NTSB concludes that, due to the importance of pertinent remarks, such as variable cloud ceilings, to the flight crew’s understanding of weather conditions, it is critical that flight dispatch papers, ACARS, and ATIS contain pertinent remarks for weather observations because

NTSB Aircraft Accident Report 81 such remarks provide flight crews a means to understand changing weather conditions. Had the flight crew been provided with the pertinent remarks in this accident, they may have been aware of the possibility of changing visibility and ceilings upon their arrival at BHM. Therefore, the NTSB recommends that FAA require that the remarks section of METAR reports be provided to all dispatchers and pilots in flight dispatcher papers and through ACARS. Additionally, the NTSB recommends that the FAA expand the current guidance available in FAA Order 7110.65, “Air Traffic Control,” to further define METAR pertinent remarks. The NTSB also recommends that the FAA issue a safety advisory bulletin to air traffic controllers providing examples of the types of METAR remarks information considered pertinent and reminding them of the requirement to add such pertinent remarks to ATIS broadcasts. 2.6 Systems Issues 2.6.1 Enhanced Ground Proximity Warning System Software Postaccident evaluation of the accident EGPWS indicated that it operated per its design during the accident flight. However, the NTSB notes that, if the airplane had been equipped with a newer version of EGPWS software available at the time of the accident, the airplane would have entered the terrain clearance floor alert envelope about 200 ft agl and 1.3 nm from the runway threshold, and a “too low terrain” caution alert would have sounded about 6.5 seconds earlier and 150 ft higher than the EGPWS alert the flight crew received. As noted previously, the airplane’s descent rate when it entered the terrain clearance floor envelope was about 1,450 fpm, which would have reduced the effectiveness of the alert. Although simulator results indicate that the updated EGPWS software would provide a significant improvement in alert safety margins and that the airplane could have avoided terrain if the CFIT avoidance maneuver had been executed within 2.4 seconds of the earlier “too low terrain” alert, it was not possible to determine whether the pilots would have, in fact, performed that maneuver or performed it in time to avoid terrain.111 The NTSB concludes that the newer EGPWS software, part number 965-0976-003-218-218 or later, will provide an advanced alert and significantly improve safety margins, although its effect on the outcome of this accident is unknown because it cannot be determined how aggressively the pilots would have responded to an earlier “too low terrain” alert. As a result, the NTSB recommends that the FAA issue a special airworthiness information bulletin to notify operators about the circumstances of this accident and the potential safety improvements related to the Honeywell EGPWS part number 965-0976-003-218-218 or later software update. Although TAWS have significantly reduced the frequency of CFIT accidents, they are still constrained by inherent limitations in data112 that can significantly affect their performance, even to the point of rendering certain warnings useless (such as the “too low terrain” caution alert in this case). In this accident, the “sink rate” caution alert was the only useful EGPWS alert

111 The NTSB notes that the descent was unstabilized and the flight crew should have gone around much earlier in the approach. 112 These limitations include uncertainties in the airplane’s knowledge of its own position and uncertainties in the database containing the position of runway thresholds. These uncertainties act to lower the terrain clearance floor envelope (moving them closer to the terrain) so as to avoid nuisance alerts.

NTSB Aircraft Accident Report 82 received before impact. Because of the desensitized nature of the alerts as the airplane neared the airport, no warning alert was provided. A warning alert would have required a more aggressive response from the pilots to prevent impact with terrain. The intent of providing two levels of alerts is that the pilot will receive an escalating series of alerts (for example, one or more caution alerts followed by one or more warning alerts) as a collision with terrain or obstacles becomes more imminent. Consistent with this intent, pilots are instructed to respond more aggressively to warning level alerts than to caution alerts. For example, the UPS guidance for a response to a warning level alert is to perform the CFIT recovery maneuver, while the guidance for the response to a caution level alert varies from “adjust pitch attitude and thrust to silence the warning” to “perform a go-around.” In this accident, the captain’s response was consistent with UPS AOM guidance and training to the “sink rate” caution alert. The UPS guidance is consistent with the intent of two levels of the EGPWS alerts and with guidance provided by the airplane manufacturer. This guidance reflects the expectation that an inadequate response to a caution level alert will lead to a more urgent warning level alert as the airplane nears terrain and that the warning level alert will occur in time for an aggressive response (such as the CFIT recovery maneuver) to prevent a collision. However, this accident demonstrates that this sequence of events may not occur in certain situations, particularly when an airplane is in the landing configuration and close to the airport. Therefore, the NTSB concludes that an escalating series of TAWS alerts before impact with terrain or obstacles is not always guaranteed due to technological limitations, which reduces the safety effectiveness of the TAWS during the approach to landing. Therefore, the NTSB recommends that the FAA advise operators of aircraft equipped with TAWS of the circumstances of this accident including that, in certain situations, an escalating series of TAWS warnings may not occur before impact with terrain or obstacles. Encourage operators to review their procedures for responding to alerts on final approach to ensure that these procedures are sufficient to enable pilots to avoid impact with terrain or obstacles in such situations. As stated above, the EGPWS alerting envelopes are reduced when an airplane is in the landing configuration and close to the airport to provide a balance between safe alert timing and nuisance alerts. However, the circumstances of this accident reveal that the EGPWS terrain clearance floor envelope can be ineffective when the airplane is descending at an unusually high descent rate, which is precisely when it is critical that a flight crew receive a warning alert as the airplane nears the ground. In March 2014, a special committee was established to develop an industry consensus set of TAWS standards reflecting the mature nature of this technology and incorporating enhanced requirements and new capabilities. This minimum operational performance standard will form the basis for the next TSO for TAWS and will take into account the improved technology available today. Therefore, the NTSB recommends that the FAA revise the minimum operational performance standards to improve the effectiveness of TAWS when an airplane is configured for landing and near the airport, including when the airplane is descending at a high rate and there is rising terrain near the airport. 2.6.2 Terrain Awareness and Warning System Altitude Callouts The Airbus A300 FWC is equipped with an automated aural “minimums” alert that would have sounded at 0447:14, about 3 seconds after the captain said “two miles.” However, UPS had not activated the alert. Further, Airbus A300 airplanes can issue altitude callout alerts

NTSB Aircraft Accident Report 83 through the airplane’s FWC. Rather than the 500-ft callout, many Airbus A300 operators use the 400-ft callout generated within the FWC. Additionally, TSO-151C requires the TAWS to provide a 500-ft callout when descending within 500 ft above terrain or the nearest runway elevation. However, it does not require operators to enable the 500-ft callout feature. Neither the 500-ft TAWS callout (through the EGPWS) nor the 400-ft callout (through the Airbus FWC) were activated on the accident airplane; therefore, these callouts did not occur when the airplane neared the terrain. Although the PM is responsible for making altitude callouts, the NTSB concludes that an automated “minimums” and/or altitude above terrain alert would have potentially provided the flight crewmembers with additional situational awareness upon their arrival at the minimum descent altitude and made them aware that their continued descent would take them below the minimum descent altitude. Additionally, in the absence of the automated “minimums” alert, either the EGPWS 500-ft callout or the Airbus 400-ft callout could have made the flight crewmembers aware of their proximity to the ground, and they could have taken action to arrest the descent. Therefore, the NTSB recommends that the FAA require all operators of airplanes equipped with the automated “minimums” alert to activate it. Furthermore, for those airplanes not equipped with an automated “minimums” alert, the NTSB recommends that the FAA require all operators of airplanes equipped with TAWS to activate the TAWS 500-ft voice callout or similar alert. 2.6.3 Flight Management System/Flight Management Computer According to UPS check airmen, all approaches (precision and nonprecision) must be sequenced in the FMC. The process of sequencing approaches ensures that there are no undesired navigation legs remaining in the FMC that could result in flight plan discontinuities and provides pilots with additional awareness of the airplane’s position relative to the approach path. When the Profile Final Approach mode (“profile mode”) is used to fly a nonprecision approach, sequencing the FMC is even more critical because, otherwise, the FMC-generated glidepath might not be correct (as in this accident). The A300 profile approach is an implementation of the CDFA technique. The profile approach uses the airplane’s FMC to compute a desired profile glidepath extending from a point above the runway threshold back along the approach course and displays the airplane’s vertical deviation from this glidepath to the pilot using the VDI on the ND.113 The profile approach allows nonprecision approaches to be flown in a manner similar to the more familiar ILS approach, which provides vertical guidance via a glideslope signal. By not properly sequencing the approach and leaving the original navigation path direct to KBHM in the FMC, a flight plan discontinuity was introduced that prevented the autopilot from engaging in profile mode, even though the 3.28˚ glidepath was programmed into the FMC and the profile mode was armed.114 Further, and in spite of the flight plan discontinuity, the FMC constructed a glidepath for the approach using the 3.28˚ angle and the total length of all the navigation legs in the FMC, including the improper direct-to-KBHM leg. Because this length was

113 For an ILS approach, lateral course correction information is provided by the localizer deviation diamond, and the primary source for vertical path correction information is the glideslope diamond. 114 This sequence of events was confirmed by information downloaded from the FMC and by simulator testing.

NTSB Aircraft Accident Report 84 unrealistically long, the altitude of the glidepath was unrealistically high for the airplane’s actual distance from the runway, rendering the glidepath meaningless. The flight crew should have been familiar with the process for sequencing the FMC for the localizer runway 18 approach because it is a common practice in training and necessary for any approach to be properly setup in the FMC. The NTSB found, however, that this essential task is not described in any FAA-approved or -accepted manual at UPS and is only described in the UPS PTG. The NTSB believes that fundamental procedures like sequencing the FMC are more likely to be standardized and retained by pilots if contained in FAA-approved or -accepted manuals like the AOM, which are subject to the manual review oversight process defined in FAA Order 8900.1, Flight Standards Information Management System. Including this information in documents reviewed by the FAA also means that pilots can be evaluated on their knowledge of the material. In addition, the Profile Briefing Guide used by the captain to initially brief the approach did not contain guidance indicating that the FMC flight plan had to be properly sequenced for the autopilot to capture the FMC-generated glidepath or to ensure that the FMC-generated glidepath was correct. It is imperative that flight crews properly enter and sequence the flight plan information accurately, and correct and consistent flight crew guidance is an important tool for reinforcing the criticality of the sequencing step. Although the flight crew configured the FMC for an approach on every flight and should have been familiar with the procedure, the NTSB concludes that consistent training in and FAA oversight and evaluation of fundamental procedures necessary to conduct an approach, such as sequencing the FMC, are critical to flight safety. Therefore, the NTSB recommends that the FAA require POIs of 14 CFR Part 121, 135, and 91 subpart K operators to verify that procedures critical to approach setup, like configuring an approach in the FMC for those approaches dependent on that step, are included in FAA-approved or -accepted manuals. While on final approach, particularly in IMC, it is imperative that pilots vigilantly monitor the flight instruments to ensure that the airplane remains on course and on speed and so that any deviation from the desired lateral and vertical paths can be corrected promptly. For a localizer approach flown in profile mode, the primary source for lateral course correction information is the localizer deviation diamond, and the primary source for vertical path correction information is the VDI on the ND. From the time that the first officer activated the final approach, the VDI diamond was pegged at the top of its scale, indicating that the airplane was at least 200 ft below the glidepath constructed by the FMC. When the airplane was at 2,500 ft msl and still more than 1 nm from BASKN, this would be the expected VDI indication because the (correct) glidepath would indeed be more than 200 ft above the airplane. However, within 1 nm of BASKN, the pilots should have expected that the VDI diamond would start to move down toward the center of the scale, as the airplane intercepted the glidepath from below. On the accident flight, however, the VDI would have remained pegged at the top of the scale even as the airplane passed BASKN. At BASKN, the pilots were very aware that they were above, not below, the desired glidepath, but neither seemed to comment about the VDI indication. It is not known whether either pilot ever looked at the VDI throughout the approach, including when they were discussing the airplane being high at 0446:54. It is also unknown what

NTSB Aircraft Accident Report 85 information the pilots were using to conclude that the airplane was high at that time, when the primary source of such information (the VDI) would have indicated that it was at least 200 ft low.115 If the captain realized that the VDI was unusable but decided to proceed with the approach anyway, he would have had to revert from a CDFA-type approach to a “dive and drive” technique, relying on the step-down altitudes for vertical guidance. Consistent with an awareness of the step-down altitudes, at 0446:46.8, while descending through 1,920 ft msl (1,390 ft agl), the captain stated, “alright so at three point three should be at thirteen eighty,” referencing the minimum crossing altitude at IMTOY at 1,380 ft msl. The airplane crossed IMTOY very close to this altitude, at which point it intersected the proper glidepath; however, the captain did not decrease the rate of descent, and the airplane passed through the glidepath descending at 1,500 fpm. Further, the captain did not arrest the rate of descent as the airplane approached and then descended through the minimum descent altitude of 1,200 ft, even though he had commented that “DA [decision altitude] is twelve hundred” only about 11 seconds earlier, when the airplane was descending through 1,470 ft. The captain’s failure to decrease the rate of descent at IMTOY and to completely arrest it at the minimum descent altitude is inconsistent with his evident awareness of the minimum crossing altitude at IMTOY (1,380 ft) and the decision altitude (1,200 ft). Thus, if the captain indeed planned to conduct a “dive and drive” approach after BASKN, he did not do so properly once he reached IMTOY. It is also possible that both pilots misinterpreted the VDI indication even though it should have been very familiar to them since it was identical to an ILS glideslope indication. The captain’s comment at 0446:53.7 that “we’re like way high … or higher” directly contradicted the information that would have been displayed on the VDI unless he was misinterpreting it. Similarly, the first officer’s response (“about … a couple hundred feet … yeah”) confirmed the captain’s statement but was also inconsistent with the VDI display.116 Nonetheless, if the pilots knew that they were 200 ft above the desired glidepath at BASKN and then observed the VDI pegged at the top of the scale, they may have associated that indication with the airplane being above the desired path, even though the opposite was true. Once this misinterpretation was made, the persistent full-scale deflection of the VDI could have convinced both pilots that the airplane was quite high throughout the descent from BASKN. Such confusion could explain why the captain maintained a very large rate of descent (1,500 fpm) for such a long time (he may have been expecting to see the VDI diamond move as he descended to intercept the glidepath from above) and why he stated “we’re like way high...or higher” at 04:46:53.7. The “or higher” part of this phrase suggests that the captain was not sure exactly how high the airplane was, only that the airplane was very high, as would be the case if he were reversing the meaning of the full-scale deflection of the VDI. As described above, the VDI was displaying meaningless information because the flight crew did not verify that the flight plan was sequenced in the FMC. If the pilots had observed the VDI at BASKN and correctly interpreted it as indicating that the airplane was more than 200 ft

115 Analysis of the FDR indicates that at 0446:54, the airplane was in fact about 145 ft above the FMC-generated glidepath to the runway. 116 Full-scale deflection of the VDI corresponds to being 200 ft from the desired glidepath, so it is possible that the first officer, too, referenced the VDI and reversed its meaning when responding that they were a couple hundred feet high.

NTSB Aircraft Accident Report 86 below the glidepath (when at BASKN, the flight crew was aware that the airplane’s position was actually above the glidepath), they should have been alerted to the improper sequencing of the FMC flight plan. While the VDI is a critical and primary part of the instrument scan when conducting a profile mode approach, secondary indications also could have alerted them to the improper sequencing, including the vertical deviation readout on the CDU takeoff/approach page, KBHM being identified as the next approach fix, the extra line direct to KBHM on the ND, and the F-PLN DISCONTINUITY indication on the CDU flight plan page. Aside from the meaningless VDI indication (and the failure of the autopilot to engage in profile mode), there were several cues in the pilots’ primary instrument scans that would have alerted them that the FMC was improperly sequenced. On the contrary, as stated earlier, the crew may have believed that the sequencing was proper because (1) the localizer was captured, (2) the airplane icon was positioned on the localizer on the NAV display, and (3) the first officer was able to activate the approach to runway 18 in the FMC. Hence, the flight crew may have followed cues that supported their expectation of a properly sequenced approach and ignored those that did not support that expectation. As noted previously, the VDI provides vertical guidance for a profile approach in the same way that glideslope provides vertical guidance for an ILS approach, but there was no VDI indication to the flight crew that would indicate the display was based on meaningless information. Throughout the approach, the VDI indicated that the airplane was low, not high. If the crew observed and correctly interpreted the VDI, they would have believed that the VDI was instructing them to climb, not descend. Nonetheless, the presence of the meaningless VDI indication may have obscured the fact that the FMC was not sequenced correctly. The NTSB concludes that a VDI constructed from information known to be anomalous (for example, containing a flightpath discontinuity) could be confusing to flight crews. Therefore, the NTSB recommends that Airbus develop and implement, for applicable Airbus models, means of providing pilots with a direct and conspicuous cue when they program the FMC flight plan incorrectly such that it contains such elements as improper waypoints or discontinuities that would allow the VDI to present misleading information for an approach. Additionally, the NTSB recommends that the FAA work with industry, for all applicable aircraft, to develop and implement means of providing pilots with a direct and conspicuous cue when they program the FMC flight plan incorrectly such that it contains such elements as improper waypoints or discontinuities that would allow the VDI to present misleading information for an approach.

NTSB Aircraft Accident Report 87

1. Conclusions
2. 1 Findings
3. The pilots were properly certificated, qualified, and trained for the 14 Code of Federal

Regulations Part 121 flight in accordance with Federal Aviation Administration regulations. No evidence was found indicating that the flight crew’s performance was affected by any behavioral or medical condition or by alcohol or drugs.

1. The accident airplane was loaded within weight and center of gravity limits and was

equipped, certificated, and maintained in accordance with Federal Aviation Administration regulations and the manufacturer’s recommended maintenance program. Postaccident examination found no evidence of any preimpact structural, engine, or system failure or anomaly.

1. Although the activation of the crash phone was delayed, the aircraft rescue and firefighting

(ARFF) response proceeded rapidly, and ARFF operations began in a timely manner.

1. The dispatcher of UPS flight 1354 should have alerted the flight crew to the limited options

for arrival at Birmingham-Shuttlesworth International Airport (BHM), especially that runway 18 was the only available runway, because doing so would have further helped the pilots prepare for the approach to BHM and evaluate all available options.

1. The captain, as pilot flying, should have called for the first officer’s verification of the flight

plan in the flight management computer (FMC), and the first officer, as pilot monitoring, should have verified the flight plan in the FMC; their conversation regarding nonpertinent operational issues distracted them from recognizing that the FMC was not resequenced even though several salient cues were available.

1. The captain’s change to a vertical speed approach after failing to capture the profile glidepath

was not in accordance with UPS procedures and guidance and decreased the time available for the first officer to perform her duties.

1. The flight crew did not monitor the descent rate and continued to fly the airplane with a

vertical descent rate of 1,500 ft per minute below 1,000 ft above ground level, which was contrary to standard operating procedures, resulting in an unstabilized approach that should have necessitated a go-around.

1. The flight crew did not sufficiently monitor the airplane’s altitude during the approach and

subsequently allowed the airplane to descend below the minimum altitude without having the runway environment in sight.

1. The first officer’s failure to make the “approaching minimums” and “minimums” altitude

callouts during the approach likely resulted from the time compression resulting from the excessive descent rate, her momentary distraction from her pilot monitoring duties by looking out the window when her primary responsibility was to monitor the instruments, and her fatigue.

NTSB Aircraft Accident Report 88

1. Although it was the first officer’s responsibility to announce the callouts as the airplane

descended, the captain was also responsible for managing the approach in its final stages using a divided visual scan that would not leave him solely dependent on the first officer’s callouts to stop the descent at the minimum descent altitude.

1. The captain’s belief that they were high on the approach and his distraction from his pilot

flying duties by looking out the window likely contributed to his failure to adequately monitor the approach.

1. For the captain, fatigue due to circadian factors may have been present at the time of the

accident.

1. The captain’s poor performance during the accident flight was consistent with past

performance deficiencies in flying nonprecision approaches noted during training; the errors that the captain made were likely the result of confusion over why the profile did not engage, his belief that the airplane was too high, and his lack of compliance with standard operating procedures.

1. The first officer poorly managed her off-duty time by not acquiring sufficient sleep, and she

did not call in fatigued; she was fatigued due to acute sleep loss and circadian factors, which, when combined with the time compression and the change in approach modes, likely resulted in the multiple errors she made during the flight.

1. Given the increased likelihood of fatigue during overnight operations, briefing the threat of

fatigue before every flight would give pilots the opportunity to identify the risks associated with fatigue and mitigate those risks before taking off and throughout the flight.

1. The schedule the flight crew was flying would have been in compliance with 14 Code of

Federal Regulations Part 117 requirements had those requirements been in effect and applied to all-cargo operators.

1. The first officer did not adhere to the UPS fatigue policy; she could have called in fatigued

for the accident flight if she were not fit for duty and been immediately removed from duty until she felt fit to fly again.

1. By providing fatigue counseling, UPS and the Independent Pilots Association would help to

increase pilot awareness and understanding about fatigue and may provide a valuable resource in understanding fatigue calls.

1. A joint dispatcher/pilot training module, specific to crew resource management and

dispatcher resource management principles, would facilitate improved communication between pilots and dispatchers and enhance their understanding of the challenges and capabilities of the pilot/dispatcher roles in the safe operation of the flight.

1. By not rebriefing or abandoning the approach when the airplane did not capture the profile

glidepath after passing the final approach fix, the flight crewmembers placed themselves in an unsafe situation because they had different expectations of how the approach would be flown.

NTSB Aircraft Accident Report 89

1. The captain’s moderate response to the enhanced ground proximity warning system “sink

rate” caution alert (adjusting the flight’s vertical speed) was consistent with aircraft operating manual guidance and training; however, the response was not sufficient to prevent striking the trees on the approach and was not consistent with the more conservative guidance in the pilot training guide.

1. The continuous descent final approach technique provides a safer alternative to “dive and

drive” during nonprecision approaches.

1. If operators identified and implemented ways for pilots to receive more opportunities to

maintain proficiency in nonprecision approaches, pilots could conduct such approaches more safely.

1. Due to the importance of pertinent remarks, such as variable cloud ceilings, to the flight

crew’s understanding of weather conditions, it is critical that flight dispatch papers, the aircraft communication addressing and reporting system, and automatic terminal information service contain pertinent remarks for weather observations because such remarks provide flight crews a means to understand changing weather conditions. Had the flight crew been provided with the pertinent remarks in this accident, they may have been aware of the possibility of changing visibility and ceilings upon their arrival at Birmingham-Shuttlesworth International Airport.

1. The newer enhanced ground proximity warning system software, part number 965-0976-003-

218-218 or later, will provide an advanced alert and significantly improve safety margins, although its effect on the outcome of this accident is unknown because it cannot be determined how aggressively the pilots would have responded to an earlier “too low terrain” alert.

1. An escalating series of terrain awareness and warning system (TAWS) alerts before impact

with terrain or obstacles is not always guaranteed due to technological limitations, which reduces the safety effectiveness of the TAWS during the approach to landing.

1. An automated “minimums” and/or altitude above terrain alert would have potentially

provided the flight crewmembers with additional situational awareness upon their arrival at the minimum descent altitude and made them aware that their continued descent would take them below the minimum descent altitude.

1. In the absence of the automated “minimums” alert, either the enhanced ground proximity

warning system 500-ft callout or the Airbus 400-ft callout could have made the flight crewmembers aware of their proximity to the ground, and they could have taken action to arrest the descent.

1. Consistent training in and Federal Aviation Administration oversight and evaluation of

fundamental procedures necessary to conduct an approach, such as sequencing the flight management computer, are critical to flight safety.

1. A vertical deviation indicator constructed from information known to be anomalous (for

example, containing a flightpath discontinuity) could be confusing to flight crews.

NTSB Aircraft Accident Report 90 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s continuation of an unstabilized approach and their failure to monitor the aircraft’s altitude during the approach, which led to an inadvertent descent below the minimum approach altitude and subsequently into terrain. Contributing to the accident were (1) the flight crew’s failure to properly configure and verify the flight management computer for the profile approach; (2) the captain’s failure to communicate his intentions to the first officer once it became apparent the vertical profile was not captured; (3) the flight crew’s expectation that they would break out of the clouds at 1,000 feet above ground level due to incomplete weather information; (4) the first officer’s failure to make the required minimums callouts; (5) the captain’s performance deficiencies likely due to factors including, but not limited to, fatigue, distraction, or confusion, consistent with performance deficiencies exhibited during training; and (6) the first officer’s fatigue due to acute sleep loss resulting from her ineffective off-duty time management and circadian factors.

NTSB Aircraft Accident Report 91

1. Recommendations
2. 1 New Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Aviation Administration: Require principal operations inspectors to ensure that operators with flight crews performing 14 Code of Federal Regulations Part 121, 135, and 91 subpart K overnight operations brief the threat of fatigue before each departure, particularly those occurring during the window of circadian low. (A-14-72) Require operators to develop an annual recurrent dispatcher resource management module for dispatchers that includes participation of pilots to reinforce the need for open communication. (A-14-73) Require principal operations inspectors to work with operators to ensure that their operating procedures explicitly state that any changes to an approach after the completion of the approach briefing should be rebriefed by the flight crewmembers so that they have a common expectation of the approach to be conducted. (A-14-74) Require principal operations inspectors to ensure consistency among their operators’ training documents, their operators’ Federal Aviation Administration- approved and -accepted documents, such as the aircraft operating manual, and manufacturers’ guidance related to terrain awareness and warning system caution and warning alert responses, and ensure that responses are used during night and/or instrument meteorological conditions that maximize safety. (A-14-75) Require principal operations inspectors of 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to ensure that Federal Aviation Administration-approved nonprecision instrument approach landing procedures prohibit “dive and drive” as defined in Advisory Circular 120-108. (A-14-76) (Supersedes Safety Recommendation A-06-8) Require that the remarks section of meteorological aerodrome reports be provided to all dispatchers and pilots in flight dispatcher papers and through the aircraft communication addressing and reporting system. (A-14-77) Expand the current guidance available in Federal Aviation Administration Order 7110.65, “Air Traffic Control,” to further define meteorological aerodrome report pertinent remarks. (A-14-78) Issue a safety advisory bulletin to air traffic controllers providing examples of the types of meteorological aerodrome report remarks information considered

NTSB Aircraft Accident Report 92 pertinent and reminding them of the requirement to add such pertinent remarks to automatic terminal information service broadcasts. (A-14-79) Issue a special airworthiness information bulletin to notify operators about the circumstances of this accident and the potential safety improvements related to the Honeywell enhanced ground proximity warning system part number 965 0976-003-218-218 or later software update. (A-14-80) Advise operators of aircraft equipped with terrain awareness and warning systems (TAWS) of the circumstances of this accident, including that, in certain situations, an escalating series of TAWS warnings may not occur before impact with terrain or obstacles. Encourage operators to review their procedures for responding to alerts on final approach to ensure that these procedures are sufficient to enable pilots to avoid impact with terrain or obstacles in such situations. (A-14-81) Revise the minimum operational performance standards to improve the effectiveness of terrain awareness and warning systems when an airplane is configured for landing and near the airport, including when the airplane is descending at a high rate and there is rising terrain near the airport. (A-14-82) Require all operators of airplanes equipped with the automated “minimums” alert to activate it. (A-14-83) For those airplanes not equipped with an automated “minimums” alert, require all operators of airplanes equipped with terrain awareness and warning systems (TAWS) to activate the TAWS 500-ft voice callout or similar alert. (A-14-84) Require principal operations inspectors of 14 Code of Federal Regulations Part 121, 135, and 91 subpart K operators to verify that procedures critical to approach setup, like configuring an approach in the flight management computer for those approaches dependent on that step, are included in Federal Aviation Administration-approved or -accepted manuals. (A-14-85) Work with industry, for all applicable aircraft, to develop and implement means of providing pilots with a direct and conspicuous cue when they program the flight management computer flight plan incorrectly such that it contains such elements as improper waypoints or discontinuities that would allow the vertical deviation indicator to present misleading information for an approach. (A-14-86) To UPS: Work with the Independent Pilots Association to conduct an independent review of the fatigue event reporting system to determine the program’s effectiveness as a nonpunitive mechanism to identify and effectively address the reported fatigue issues. Based on the findings, implement changes to enhance the safety effectiveness of the program. (A-14-87) Work with the Independent Pilots Association to counsel pilots who call in fatigued and whose sick bank is debited to understand why the fatigue call was made and how to prevent it from recurring. (A-14-88)

NTSB Aircraft Accident Report 93 To the Independent Pilots Association: Work with UPS to conduct an independent review of the fatigue event reporting system to determine the program’s effectiveness as a nonpunitive mechanism to identify and effectively address the reported fatigue issues. Based on the findings, implement changes to enhance the safety effectiveness of the program. (A-14-89) Work with UPS to counsel pilots who call in fatigued and whose sick bank is debited to understand why the fatigue call was made and how to prevent it from recurring. (A-14-90) To Airbus: Develop and implement, for applicable Airbus models, means of providing pilots with a direct and conspicuous cue when they program the flight management computer flight plan incorrectly such that it contains such elements as improper waypoints or discontinuities that would allow the vertical deviation indicator to present misleading information for an approach. (A-14-91) 4.2 Previous Recommendations Reclassified in This Report One recommendation to the Federal Aviation Administration is reclassified “Closed— Unacceptable Action/Superseded.” Require all 14 CFR Part 121 and 135 operators to incorporate the constant-angle- of-descent technique into nonprecision approach procedures and to emphasize the preference for that technique where practicable. (A-06-8) Members Sumwalt, Rosekind, and Weener filed the following statements. BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Acting Chairman Member

MARK R. ROSEKIND

Member

EARL F. WEENER

Member Adopted: September 9, 2014

NTSB Aircraft Accident Report 94 Board Member Statements Member Robert L. Sumwalt filed the following concurring statement on September 18, 2014. Fatigue and Part 117

Going into the Board Meeting, there was much outside speculation about the role that fatigue may have played in the accident. The UPS pilots union, the Independent Pilots Association, called for an end of the cargo carve-out (known as Part 117), where cargo airline pilots are excluded from the more stringent flight and duty time regulations imposed earlier this year for passenger airlines. To be clear, NTSB has gone on record opposing the cargo carve-out. On July 29, 2013, just two weeks before the UPS 1354 crash, NTSB wrote to FAA Administrator Huerta, stating: “The NTSB disagrees with this exclusion, as many of the fatigue-related accidents that we have investigated over the years involved cargo operators. We also believe that, because of the time of day that cargo operations typically occur, such operations are in greater need of these requirements.” The letter stated that the NTSB is “very concerned about the cargo exclusion.” That concern aside, the facts are clear that the accident crew’s schedule was far more conservative than those contained in Part 117. To use an accident to make a point when the facts surrounding the accident don’t support that point – is not simply an illogical conclusion, but also one that must be viewed as purely politically motivated. The NTSB will not sacrifice our credibility by making illogical conclusions or those that are politically motivated. Before the Board Meeting and even after, there have been comments reported in various media sources, where some have purported that the accident pilots “told us on the CVR that they were fatigued.” Indeed, there was a conversation recorded by the CVR about the Part 117 carve- out, beginning at 03:41:58.0 and ending at 03:43:30.9. However, after listening to the CVR, I equated this conversation to many I heard in my 24-year airline pilot career, where pilots complained of working conditions. Oftentimes it is just that – complaining and making conversation. Although the first officer did state that when she woke up in the sleep room an hour earlier, she was “so tired,” I suspect that anyone who wakes up at that time of day would initially suffer from sleep inertia and feel groggy. It is not, as reports have portrayed it, as some eerie statement from the crew, ominously signaling that, in case of a crash, they wanted the world to know they were tired. Testimony received at the NTSB’s investigative hearing for this accident, and party submissions from IPA and UPS, revealed cavernous gaps between how the company and its pilots viewed the company’s fatigue policies. Further evidence of these differences was exhibited by a survey of UPS pilots conducted by IPA in March 2014. That survey yielded 2,202 responses – a return rate of 92.59 percent of UPS pilots. All surveys have biases, and there is no reason to believe this one is an exception. However, when such a high number of responses are so highly skewed in one direction, it is reasonable to believe that there is some truth to what is being reported; it is doubtful that such a large number of respondents would collude or exaggerate their responses in the same way.

NTSB Aircraft Accident Report 95 The consistency and number of responses to this survey as it relates to fatigue are striking. For example, consider the survey statement: “Calling in fatigued will invite adverse scrutiny from UPS.” Eight-eight percent of the respondents answered this as either “strongly agree” (58%) or “somewhat agree” (30%). Another statement, “The UPS culture encourages you to call in fatigued when you are fatigued,” yielded 91% of the survey respondents replying either “strongly disagree” (68%) or “somewhat disagree” (23%). These answers and others on the survey, as well as testimony during the investigative hearing, should be a stark wake-up call to UPS. However, UPS management remains defiant. At the conclusion of the board meeting where I expressed concern over the results of this survey, UPS representatives were quick to approach me and deny these problems exist. Denial is the enemy of change. Rather than trying to convince others that an estranged culture does not exist, UPS and its pilots would be better served by working to improve the working conditions. That’s why the Board issued recommendations to UPS and IPA to work together on fatigue reporting. It’s quite indicative of a poor working relationship when it takes an NTSB recommendation to get two groups to engage in constructive dialogue on such an important topic. EGPWS Software and Auto-callouts

The report states that, had the aircraft’s EGPWS software been updated by the company, a “too low terrain” caution alert would have sounded 6.5 seconds earlier and 150 feet higher than the EGPWS alert the flight crew received. That said, due to the airplane’s excessive descent rate, and because it could not be conclusively determined if the pilots would have responded within 2.5 seconds, the investigation was unable to determine whether these software enhancements would have prevented the accident. Although it cannot be said for certain that these upgrades would have prevented the crash, I can say for certain that it would have provided the crew with a greater opportunity for avoiding the crash. Numerous industry publications, including information presented at Airbus safety conferences, have emphasized the importance of maintaining up-to-date terrain databases and software. These software upgrades are offered free of charge. It is therefore incomprehensible that a company such as UPS would not upgrade this critically important software. Another safety enhancement that UPS did not take advantage of was activating auto- callouts, also known as “smart callouts.” With smart callouts, equipment on the airplane announces altitudes as the aircraft descends. Industry best practices call for operators to activate smart callouts. For example, Flight Safety Foundation’s seminal document on CFIT accidents1 states that “operators should … activate smart callouts at 2,500 feet, 1,000 feet, 500 feet, at the altitude set in the decision height (DH) window and at 50 feet, 40 feet, 30 feet, 20 feet, and 10 feet for better crew terrain awareness.” The Board unanimously approved a finding that had these callouts been activated, “it would have made the crew aware of their close proximity to the ground and they could have taken action to arrest the descent.”

1 Flight Safety Foundation, Killers in Aviation: FSF Task Force Facts About Approach and Landing and Controlled Flight Into Terrain Accidents (1999). Flight Safety Digest, 17(11-12). Retrieved from http://flightsafety.org/fsd/fsd_nov-feb99.pdf.

NTSB Aircraft Accident Report 96 Oddly, although other aircraft in the UPS fleet have these smart callouts, UPS did not activate smart callouts on their A-300 fleet, despite industry recommendations that they be used. As in the case of EGPWS software upgrades, had the smart callouts been activated, valuable life- saving cues would have been presented to the crew, possibly preventing the crash. I hope this crash can serve as an important reminder of the need for operators to provide these critical safety enhancements. Interruptions and Distractions

While there were several errors involving this flight, I believe there were two critical errors committed by the crew. The first was failure to properly sequence the flight plan, which compromised the ability to conduct a profile approach. However, even with this error, the crew could have safely conducted a raw data localizer approach. I kept asking myself how a flightcrew could miss something as basic as sequencing the flight plan – something that is done on nearly each and every flight. My final audition of the CVR provided me, as a former airline pilot who flew Airbus aircraft myself, with an “ah-ha moment,” to help me understand how that error likely occurred. When the crew was directed by ATC to turn 10 degrees right and intercept the localizer, that would be the point where a crew would typically sequence the flight plan to extend the centerline of the runway. In this case, however, the first officer initiated a few lighthearted comments, joined by the captain, pertaining to runway 18 being the only available alternative for landing. F/O: “I don’t think we have many choices if runway 6 is closed” [laughter] Captain: “Ahhh [laughter] I know. What else can we do” [laughing]. F/O: “I’m like, ahhh, well, what else ahh you gonna – unroll another one out there for us real quick or whatever” [chucking] Captain: “It’s like, okay, yeah, you got another… yeah you got an ILS on some’m else?” [chuckling] F/O: “Uhh… I know” [chuckling]

Although not a violation of the sterile cockpit rule, because the flight was about 10,000 feet msl, I believe it did interrupt the typical flow of actions on the flight deck. Research on interruptions and distractions has shown that a return to an intended task is often missed when faced with an interruption. I recognize that it is important to be comfortable in the cockpit, and FAA guidance on CRM states that that the tone in the cockpit should be “friendly, relaxed, and supportive.” But it also points out that the crew must ensure that cockpit discipline is maintained, crew vigilance is not reduced and critical items are not missed. And on this flight, critical items were missed. Many years ago, then-NTSB Board Member John Lauber put this in perspective: “There is a fine line separating a relaxed and easy atmosphere in a cockpit from a lax one where distractions can result in critical failures. Professionalism may be described as knowing the difference between the two.” There is a time and a place to be lighthearted and there is a time and place to set all else aside and focus on the task at hand.

NTSB Aircraft Accident Report 97 Even missing the sequencing of the flight plan, the approach still should have been able to be flown safely using only the raw data from the localizer beam and adhering to step-down fixes, or the approach could have been abandoned once things didn’t look right. Unfortunately, those opportunities were missed. The second critical error, in my opinion, was failure to monitor altitude during the approach, and this failure led to the CFIT. As such, the Board identified this error as one that was causal to the crash. Even with weather reports that may have set an expectation for a less demanding approach due to reported weather conditions; even with the crew not properly sequencing the flight plan in the FMS; even with the captain not verbalizing his intentions after not capturing the profile; even with the captain exceeding stabilized approach parameters and not executing a missed approach; and, even with an first officer who was fatigued, the crash would not have occurred if the crew had monitored altitude and not allowed the aircraft to descend below the minimum altitude unless the runway was in sight.

One question that cannot be answered with absolute certainty is how the crew missed the indication on the VDI that clearly showed that they were below the desired glidepath – not above it, as the captain apparently was convinced. We can never know for certain, but I believe it is plausible that the captain had a mindset that he was high, and because of that strong belief, he disregarded all information that contradicted that belief. In other words, he could have had “tunnel vision” in which the need to descend may have prompted him to disregard altitude, vertical speed, and VDI indications. The below comments from the CVR support the notion that he was focused on being high: Time before first impact Captain’s comments

12 min, 30 sec

They’re generous today. Usually they kind’a take you to fifteen and they hold you up high. 4 min, 36 sec. And they keep you high. 4 min, 35 sec. Eh, I know. It’s unbelievable. 4 min, 23 sec. Divin’ for the airport. Unbelievable. 2 min, 43 sec. Unbelievable. 1 min, 14 sec. Unbelievable. Kept us high. 1 min, 8 sec. Yeah, I’m gonna do vertical speed. Yeah, he kept us high. 39 sec And we’re like way high… 36 sec …or higher

From the captain’s comments, it is clear that he believed he was high. As the report mentions, the crew likely had the expectation that, because of the reported weather, they would break out of the clouds at 1,000 feet above ground and see the runway right in front of them. It is plausible that the captain’s tunnel vision that he was high, combined with the false expectation they would break out of the clouds at 1,000 feet, allowed him to have reduced attention to altitude awareness. A plaque at the NTSB’s training center states, “From tragedy we draw knowledge to improve the safety of us all.” I sincerely hope that knowledge will be gained from this tragedy,

NTSB Aircraft Accident Report 98 and the involved organizations will work cooperatively to move forward, so that others don’t have to endure the pain suffered by the families and friends of the crew of UPS flight 1354.

NTSB Aircraft Accident Report 99 Member Mark R. Rosekind filed the following concurring statement on September 16, 2014. “The captain’s colleagues indicated that, in the weeks before the accident, [he] had expressed concern that the flying schedules were becoming more demanding. He further stated that flying 1 week on then 1 week off made it difficult to get back into a routine the first couple of days of a trip and that the end of the trip was also difficult. He told one colleague, ‘I can’t do this until I retire because it’s killing me.’” – Report Section 1.5.1 The Captain Tragically, the captain’s words here are prophetic, as fatigue was one of the factors that contributed to this accident and his death. The lives lost in the crash of UPS Flight 1354 herald the fact that, while aviation has made tremendous strides to address fatigue in flight operations, it has much further to go. I commend NTSB investigators and staff for preparing an excellent report that provides a thorough and accurate analysis of fatigue’s pivotal role in the events causing this accident. It is only through a precise and complete understanding of how sleep loss and circadian factors affected the crew’s management of the landing approach that we can help avoid incidents like this in the future, see where the related safety gaps are in aviation, and apply what we have learned to safety across all transportation modes. This begins with acknowledging the effects on human performance that result from fatigue through multiple sources; in this accident it was sleep loss AND/OR circadian disruption. The presence of either or both while flying an aircraft can degrade skills and compromise safety with deadly results as the catastrophic outcome of Flight 1354 attests. Circadian factors affected both the captain and first officer, with the first officer suffering from additional sleep-related fatigue as well. Recommendations approved by the Board on September 9th represent significant innovation and real progress in the NTSB’s approach to combating fatigue. Three, in particular, have far-reaching implications. First, by requiring flight crews assigned to overnight operations to brief about the threat of fatigue before departure, particularly those crews scheduled to fly during the window of circadian low; the NTSB goes beyond a recommendation that simply addresses the safety risks presented by sleep loss alone. It acknowledges the scientifically proven fact that all humans are biologically affected by the deep physiological trough in the daily cycle that routinely occurs during overnight operations with known safety risks. Flight crews must understand and take actions to mitigate the adverse effects on human performance. Briefing the specific threats and strategic countermeasures beforehand is critical, and represents a great step forward in aviation fatigue management. Unfortunately, even though the FAA’s new pilot fatigue rules promulgated earlier this year do not apply to cargo pilots; these would not have influenced the outcome of Flight 1354 even if they had been followed. This places added emphasis on the report’s treatment of fatigue and the need for great accuracy and thoroughness. The report does an excellent job describing the analysis of this issue and addressing it directly in the findings. Second, the recommendation to UPS and the Independent Pilots Association (IPA) to collaborate on a program to counsel pilots who call in fatigued and whose sick bank is debited represents another innovation to fatigue management in aviation providing an important opportunity to address individual knowledge and actions. The concept of shared responsibility

NTSB Aircraft Accident Report 100 reflected in making the recommendation complementary to both UPS and IPA is an important model to highlight. It emphasizes the need to understand why a pilot calls in fatigued and how that condition may be prevented from recurring. Third, counseling on fatigue calls only works well if the program is carefully reviewed and evaluated. The recommendation to UPS and IPA to conduct an independent review of the fatigue event reporting system to determine its efficacy in identifying and addressing the reported fatigue issues will help ensure they are providing the highest level of safety. Based on the findings of an independent review and implementing any changes to enhance effectiveness, these programs can provide an invaluable early warning system to confront fatigue issues before they result in accidents and incidents. For more than 45 years, NTSB investigations have found that fatigue either caused or contributed to accidents in all transportation modes and the agency has issued over 200 safety recommendations addressing diverse areas such as hours of service regulations, scheduling policies, education and training, diagnosis and treatment of sleep disorders, research, and vehicle technologies. I am pleased the Board unanimously approved the recommendations arising from the crash of 1354 to advance the NTSB’s efforts on fatigue, call attention to what remains to be done, and help provide everyone who flies – even in the quiet darkness of night – the safest skies possible. Acting Chairman Hart and Members Sumwalt and Weener joined in this statement.

NTSB Aircraft Accident Report 101 Member Earl F. Weener filed the following concurring statement on September 17, 2014. The final report, and particularly the statement of probable cause, concerning the UPS Flight 1354 accident were thoughtfully deliberated and determined, and have my full support. I believe, though, there is a fundamental message from this accident worth emphasizing: the importance of personal responsibility, particularly in terms of making choices affecting fitness for duty. As documented in the final report, this flight occurred during a time of day when the likelihood of performance decrements increases due to a dip in the circadian rhythm. However, the research findings on fatigue and its effects on human performance, specifically with regard to pilot operations, has led to the development of various mitigation strategies which, generally, include providing education, adjusting operations schedules, and putting in place fatigue risk management plans (now a statutory requirement) which include fatigue countermeasures. Fatigue countermeasures are an important factor in this strategy in order to offset the risks of fatigue impairing performance, and provide the fundamental underpinnings for allowing operations with inherently higher levels of risk to be conducted with acceptable levels of risk, such as those scheduled to take place during periods of circadian low. When implemented effectively, this approach has worked. As noted in the report, most operations occurring during a time period of circadian low do not result in accidents. However in this accident scenario, we have two pilots who, as the investigation documented, made very different choices – both in terms of their personal and professional lifestyle. The captain’s decisions with regard to his time at work and at home reflect an awareness and effort to mitigate the risk of being fatigued on the job. In other words, he employed countermeasures, such as having adequate off-duty time for rest, exercising, controlled napping, and use of the company sleep rooms, to mitigate the risk and ensure he reported fit for duty. Alternatively, the same cannot be said of the first officer. In fact, the report documents a disturbing pre-accident history of fatigue inducing choices, both in her personal and professional life. Although the accident investigation was unable to determine whether fatigue affected the captain’s performance, the effects of fatigue on the first officer’s performance were conclusively determined. Fatigue countermeasures make a difference – they provide the underlying basis for enabling inherently risky activities to be undertaken in a safe and productive manner by mitigating the effects of fatigue and the likelihood of degradation in performance. Fatigue risk management plans and countermeasures will be ineffective, though, if pilots fail to employ such mitigation strategies in their personal and professional lives. The bigger issue is fitness for duty – a more comprehensive concept requiring an evaluation of whether a pilot is both physiologically and mentally prepared to assume his or her duties. Fitness for duty is an individual, personal assessment to be undertaken by every pilot prior to every flight; it is not a single, periodic determination nor is it established by obtaining a medical certificate from a Federal Aviation Administration (FAA) aviation medical examiner. Fatigue is one of several important considerations, when making a fitness for duty determination. As the accident report illustrates, failure to make the appropriate determination can have deadly consequences. UPS recognized the importance of fatigue in determining fitness for duty by explicitly mentioning it in the introduction of its fitness for duty policy found in its Flight Operations Manual, and by providing explicit training on pilot responsibility in terms of rest and fitness for duty. Sadly, the first officer disregarded company policy as well as fatigue training by making poor choices both on and off duty. Worth noting from the accident report, the first officer maintained a 3.5-4 hour commute schedule from home to the UPS base at Louisville; with a typical need for 9+ hours of

NTSB Aircraft Accident Report 102 sleep per night, she failed to obtain adequate sleep in the days leading up to the accident flight; instead of taking advantage of numerous sleep opportunities during that time period, she engaged in PED usage and travel; rather than maintaining a nocturnal schedule in support of her current assignment, she chose to revert to a diurnal schedule during a 62-hour layover; after reporting to colleagues and relatives she was tired, she did not take advantage of company provided sleep opportunities, whether by taking a hotel in San Antonio or using a sleep room between flights; and after arriving to work on the evening of August 13, knowingly tired, she failed to inform the company or captain that she was tired and unfit for duty. The first officer made several decisions contributing to her fatigue and ultimately made the wrong decision in arriving to work not fit for duty. In the interest of safety, although contrary to the FAA’s interpretation, it is important to note fitness for duty is not limited to, or an alternative way of describing fatigue. Fatigue is one, but not the only factor that can affect performance; other factors can play a role as well. For example, recently the NTSB concluded a safety study, entitled Drug Use Trends in Aviation: Assessing the Risk of Pilot Impairment. Although the study was based on accident data primarily from General Aviation operations, it nonetheless documented a concerning upward trend in the use of both potentially impairing medications and illicit drugs by pilots, some of whom also held airline transport pilot certificates (15%). Additionally, the study suggested the performance impairing effects of one of the most commonly used ingredients in over-the-counter medicines, diphenhydramine, are not widely understood by pilots. Like fatigue, medication and drug use can impair performance, again illustrating the need for a fitness for duty determination before climbing into a cockpit. Fitness for duty, though, should not be viewed as a concept exclusive to pilots; a fitness for duty determination is equally applicable to any safety related transportation position, including the maintenance, dispatch, operations and air traffic control environments in aviation. In sum, the National Transportation Safety Board can recommend actions to address fatigue, drug and alcohol usage, and more broadly, fitness for duty. The FAA can issue regulations to require drug and alcohol testing and fatigue management programs, all in an attempt to ensure fitness for duty. The airlines can develop and implement policies and programs to comply with regulations, promote fitness for duty, educate/train on fatigue mitigations and provide disincentives to drug and alcohol usage. But the bottom line is: fitness for duty comes down to personal assessment and decision-making. The UPS Flight 1354 accident permanently changed the lives of two families in a very tragic manner. To the aviation industry, as a whole, it is a poignant reminder: the choices we make, both on and off duty, can be a matter of life or death. Acting Chairman Hart and Members Sumwalt and Rosekind joined in this statement.

NTSB Aircraft Accident Report 103

1. Appendixes

Appendix A: Investigation and Public Hearing Investigation The National Transportation Safety Board was initially notified of this accident on August 14, 2013. The following investigative groups were formed: Operations, Human Performance, Air Traffic Control, Meteorology, Airports/Survival Factors, Airworthiness, Powerplants, Structures, Systems, Aircraft Performance, and Maintenance Records. Board Member Robert Sumwalt accompanied the team. Parties to the investigation were the Federal Aviation Administration (FAA), UPS, Birmingham Airport Authority, Pratt & Whitney, National Air Traffic Controllers Association, Teamster Local Union 2727, and the Independent Pilots Association (IPA). In accordance with the provisions of Annex 13 to the Convention on International Civil Aviation, the Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile (BEA) appointed an accredited representative to participate in the investigation as the representative of the State of Design and Manufacture of the airframe. Airbus investigators participated in the investigation as technical advisors to the BEA. Investigative Hearing An investigative hearing was held on February 20, 2014, in Washington, D.C. Then-Chairman Deborah A.P. Hersman presided. The subjects discussed at the investigative hearing included performance of nonprecision approaches, human factors issues as applicable to this accident, and dispatch procedures, including the limitations of dispatch-related software. Parties to the investigative hearing were the FAA, UPS, IPA, Airbus, and Transport Workers Union.

NTSB Aircraft Accident Report 104 Appendix B: Cockpit Voice Recorder Transcript

Transcript of an L-3/Fairchild FA2100-1020 solid-state cockpit voice recorder1, installed on an UPS Airbus A300-600 (N155UP), which crashed during approach at the Birmingham-Shuttlesworth International Airport (KBHM) in Birmingham, Alabama.

LEGEND

CAM Cockpit area microphone voice or sound source

HOT Flight crew audio panel voice or sound source

INT Intercom sound source

RDO Radio transmissions from N155UP

GND Radio transmissions from Louisville ground controller

TWRSDF Radio transmissions from Louisville airport tower controller

APRSDF Radio transmissions from Louisville approach controller

CTRINDY Radio transmissions from Indianapolis center controller

CTRMEM1 Radio transmissions from first Memphis center controller frequency

CTRMEM2 Radio transmissions from second Memphis center controller frequency

CTRATL1 Radio transmissions from first Atlanta center controller frequency

CTRATL2 Radio transmissions from second Atlanta center controller frequency

TWRBHM1 Radio transmissions from first Birmingham tower controller frequency

TWRBHM2 Radio transmissions from second Birmingham tower controller frequency

UPSRAMP Radio transmissions from UPS ramp controller

VEH Radio transmissions from a ground vehicle at Birmingham

AC Radio transmissions from another aircraft

ATIS Automated Terminal Information Service

EPGWS Enhanced Ground Proximity Warning System

TCAS Traffic Alert and Collision Avoidance System

WXRADAR Weather Radar

-1 Voice identified as the captain

-2 Voice identified as the first officer

-MECH Voice identified as a mechanic

-WB Voice identified as weight and balance personnel

-? Voice unidentified

1 Due to damage, the serial number of the recorder could not be determined.

NTSB Aircraft Accident Report 105

Unintelligible word Expletive

( ) Questionable insertion

] Editorial insertion

Note 1: Times are expressed in central daylight time (CDT).

Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed.

Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken.

Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft.

NTSB Aircraft Accident Report 106 CVR Quality Rating Scale

The levels of recording quality are characterized by the following traits of the cockpit voice recorder information:

Excellent Quality Virtually all of the crew conversations could be accurately and easily understood. The transcript that was developed may indicate only one or two words that were not intelligible. Any loss in the transcript is usually attributed to simultaneous cockpit/radio transmissions that obscure each other.

Good Quality Most of the crew conversations could be accurately and easily understood. The transcript that was developed may indicate several words or phrases that were not intelligible. Any loss in the transcript can be attributed to minor technical deficiencies or momentary dropouts in the recording system or to a large number of simultaneous cockpit/radio transmissions that obscure each other.

Fair Quality The majority of the crew conversations were intelligible. The transcript that was developed may indicate passages where conversations were unintelligible or fragmented. This type of recording is usually caused by cockpit noise that obscures portions of the voice signals or by a minor electrical or mechanical failure of the CVR system that distorts or obscures the audio information.

Poor Quality Extraordinary means had to be used to make some of the crew conversations intelligible. The transcript that was developed may indicate fragmented phrases and conversations and may indicate extensive passages where conversations were missing or unintelligible. This type of recording is usually caused by a combination of a high cockpit noise level with a low voice signal (poor signal-to- noise ratio) or by a mechanical or electrical failure of the CVR system that severely distorts or obscures the audio information.

Unusable Crew conversations may be discerned, but neither ordinary nor extraordinary means made it possible to develop a meaningful transcript of the conversations. This type of recording is usually caused by an almost total mechanical or electrical failure of the CVR system.

NTSB Aircraft Accident Report 107 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT START OF RECORDING1

03:14:07.3 CDT START OF TRANSCRIPT

03:13:39.5 CAM

[power applied to CVR]

03:14:07.3 CAM

[unintelligible voice likely of first officer (f/o) of accident flight talking to an unidentified other person. f/o seems to be talking about range vs. payload mode.]

03:15:08.8 CAM

[multiple sounds of tone, similar to ACARS message alerts, received prior to engine start] [also, multiple sounds of various unidentified voices and clicks and clunks and warnings]

03:26:42.7 WXRADAR

monitor radar display. go around. windshear ahead. windshear ahead. windshear ahead. [crew initiated weather radar test]

03:28:21.7 EGPWS

glideslope. pull up. terrain ahead pull up. [crew initiated EGPWS test]

03:28:39.6 CAM

[accident crew talking about fuel transfer, mostly unintelligible]

03:31:40.8 TCAS

TCAS Test. TCAS Test Pass. [crew initiated TCAS test]

03:32:21.3 CAM

[first officer tests a panel, notes progress to captain]

1 The CVR recording began 30 minutes and 20 seconds before the start of the transcript.

NTSB Aircraft Accident Report 108 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:34:11.1 CAM

[crew discussion and entry of preliminary weight and balance information, partly unintelligible]

03:36:10.9 CAM-1

before start to the line.

03:36:12.8 CAM-2

okay.

03:36:13.9 CAM-2

oxygen.

03:36:14.7 CAM-1

checked one hundred percent.

03:36:15.3 CAM-2

checked one hundred percent.

03:36:16.3 CAM-2

flight *.

03:36:17.4 CAM-1

alright right side. fifteen twenty two and three zero zero eight.

03:36:23.3 CAM-2

fifteen twenty two and three zero zero eight set.

03:36:26.6 CAM-2

fuel quantity.

03:36:27.3 CAM-1

(** six) takeoff fuel (* four).

03:36:30.6 CAM-2

overhead panel.

NTSB Aircraft Accident Report 109 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:36:32.2 CAM-1

set.

03:36:32.7 CAM-2

brakes.

03:36:33.6 CAM-1

checked norm on.

03:36:34.2 CAM-2

parking brake.

03:36:34.8 CAM-1

set.

03:36:35.9 CAM-2

(down to the line complete).

03:36:37.2 CAM-1

alright.

03:36:38.5 CAM-1

captain begins takeoff brief. (left seat three hundred and three thousand pound take off. flaps fifteen zero). profile.

03:36:46.1 CAM-1

five thousand three five right. pink page. basically ah...

03:36:53.5 CAM-1

** weight * (thirty) five right. ** climbing right hand turn.

03:36:59.8 CAM-1

DME off the localizer. to a magnetic heading of zero zero five. basically stay clear of ah Humana. [chuckle].

03:37:07.7 CAM-2

(okay).

NTSB Aircraft Accident Report 110 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:37:08.5 CAM-1

and uhhh. **. gonna be runway heading. five thousand. turn on course.

03:37:15.5 CAM-1

as far as the reject. eighty knots. call it out loud and clear. ahhh. after v-one ahh. high speed. critical items only. after v-one ** pink page. transition altitude eighteen thousand ft.

03:37:31.0 CAM-1

this is ramp six so ahh push outt'a here right turn. runway (three five right) is close. so uhm probably won't be a problem on the engines. (* call it complete).

03:37:41.9 CAM-2

(sounds good).

03:37:44.1 CAM-1

numbers.

03:37:45.7 CAM-2

• we're gonna be [unintelligible].

03:38:14.4 CAM

[crew discussion, mostly unintelligible]

03:40:55.2 CAM

[sound similar to ACARS alert, captain notes weight and balance]

03:40:58.8 INT-MECH

good morning captain maintenance standing by.

03:41:22.5 CAM

[first officer and captain discuss weight and balance and acknowledging ACARS message.]

03:41:53.0 CAM-1

we have two extra hours today in Birmingham.

NTSB Aircraft Accident Report 111 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:41:58.0 CAM-1

Rockford is only fourteen hours and * minutes rest. so you figure a thirty minute ride to-for hotel....

03:42:04.1 CAM-2

I know by the time you...

03:42:06.0 CAM-1

...fourteen hours...

03:42:08.1 CAM-1

...by the time you go to sleep you are down to about twelve. (wow).

03:42:14.5 CAM-1

this is where ah the passenger side you know the new rules they're gonna make out.

03:42:17.0 CAM-2

they're gonna make out.

03:42:18.3 CAM-1

yeah. we need that too.

03:42:20.2 CAM-1

I mean I [stammer2] don't get that. you know it should be one level of safety for everybody.

03:42:23.1 CAM-2

it makes no sense at all.

03:42:24.3 CAM-1

no it doesn't at all.

2 Stammer is used to describe an utterance with many quick hesitations.

NTSB Aircraft Accident Report 112 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:42:25.5 CAM-2

I know. I know.

03:42:26.2 CAM-1

nope.

03:42:27.9 CAM-1

which means that you know * real pilot.

03:42:30.4 CAM-1

you know.

03:42:32.1 CAM-2

and to be honest. [stammer] it should be across the board. to be honest in my opinion whether you are flying passengers or cargo or you know box of chocolates at night. if you're flying this time of day...

03:42:36.9 CAM-1

mm hmm.

03:42:44.9 CAM-1

yup.

03:42:48.2 CAM-1

(we work).

03:42:49.1 CAM-2

...the you know [stammer] * fatigue is definitely...***.

03:42:49.7 CAM-1

yeah...yeah...yeah...**.

03:42:54.0 CAM-2

I was out and I slept today. I slept in Rockford. I slept good.

03:42:59.3 CAM-1

me too.

NTSB Aircraft Accident Report 113 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:43:00.1 CAM-2

and I was out in that sleep room and when my alarm went off I mean I'm thinkin' I'm so tired...

03:43:06.1 CAM-1

I know.

03:43:06.1 CAM-2

...and I slept today.

03:43:07.6 CAM-1

exactly.

03:43:08.1 CAM-2

I you know and we just are goin' to Birmingham. what if I was goin' to Burbank?

03:43:10.6 CAM-1

and these people---

03:43:11.8 CAM-1

really God I know these people have no clue. I know.

03:43:14.8 CAM-2

and I just don't understand what they---

03:43:17.5 CAM-1

and they you know they talk about cost. well on the passenger side it just costs just as much. the same thing. you know I mean give me a break. (and these companies are the ones that are really making the money). they got a lot nerve.

03:43:22.0 CAM-2

exactly.

03:43:23.6 CAM-2

exactly.

NTSB Aircraft Accident Report 114 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:43:28.2 CAM-2

making the money.

03:43:29.9 CAM-2

I know (I).

03:43:30.9 CAM-1

yeah they do that [stammering] * says [stammering] a lot about what they how they think about you.

03:43:34.3 CAM-2

• says a lot *.

03:43:38.6 CAM-WB

**. [weight and balance personnel]

03:43:41.0 CAM-WB

you'all ready to go?

03:43:42.6 CAM-1

yessir.

03:43:46.9 CAM-WB

there you go.

03:44:05.6 CAM

[individual words mostly unintelligible. crew discussing final weight and balance].

03:45:38.8 CAM

[sound of clicks and snaps, indistinct voice saying thank you]

03:46:31.3 RDO-2

thirteen fifty four is load complete.

03:46:36.8 UPSRAMP

thirteen fifty four you are cleared for immediate. you have a nice flight.

NTSB Aircraft Accident Report 115 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

03:46:40.3 RDO-2

cleared for immediate have a good one.

03:46:47.2 CAM

[sound of clicks, clunks, similar to main entry door closing and captain sitting down in cockpit]

03:47:08.1 CAM

**.

03:47:50.7 CAM-1

** I think we are the lone ones on this ramp.

03:47:56.7 CAM-2

** I think you're right.

03:47:58.5 CAM-1

yep. yeah.

03:48:02.3 INT

[captain and mechanic discuss engine start]

03:48:11.4 CAM-1

below the line.

03:48:19.8 HOT-2

logbook.

03:48:20.5 HOT-1

on board and signed.

03:48:21.4 HOT-2

seat belt sign.

03:48:22.5 HOT-1

it's on.

NTSB Aircraft Accident Report 116 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:48:24.0 HOT-2

I'm supposed to say onboard and signed too.

03:48:25.9 HOT-2

v-speeds.

03:48:26.3 HOT-1

one fifty three. one fifty seven. one sixty set.

03:48:28.2 HOT-2

fifty three. fifty seven. sixty set.

03:48:29.9 HOT-2

CDU.

03:48:30.6 HOT-1

set.

03:48:30.9 HOT-2

set. doors and windows.

03:48:31.9 HOT-1

closed slide armed.

03:48:32.5 HOT-2

closed slide armed. before start complete.

03:48:34.2 HOT-1

thank you.

03:48:35.1 INT-1

okay sir we are ready to start when you guys get all set down there.

03:48:39.3 INT-MECH

copy.

03:50:14.6 HOT-1

okay come on let's go.

NTSB Aircraft Accident Report 117 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:50:16.8 HOT-2

I know. * what's goin' on now.

03:50:53.9 INT-MECH

alright captain. marshalling is finally clear. you are cleared for start your discretion.

03:50:58.3 INT-1

okay turning two.

03:50:59.6 HOT-1

turn two.

03:51:04.4 HOT-2

two's turning.

03:51:16.1 CAM

[sound of engine, similar to engine start]

03:52:16.9 INT-1

turning one.

03:52:19.0 INT-MECH

copy cleared for start.

03:52:21.0 HOT-1

turn one.

03:52:24.2 CAM

[sound of engine, similar to engine start]

03:53:49.7 HOT-1

after start.

03:53:50.7 HOT-2

after start.

NTSB Aircraft Accident Report 118 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:53:51.7 CAM

[sound of clicks and clunks, similar to after start first officer flow]

03:54:04.4 HOT-2

after start. anti-ice.

03:54:05.7 HOT-1

off.

03:54:06.3 HOT-2

ignition.

03:54:06.7 HOT-1

off.

03:54:07.1 HOT-2

auto-brakes.

03:54:07.7 HOT-1

max.

03:54:08.1 HOT-2

speed brakes.

03:54:08.7 HOT-1

armed.

03:54:09.2 HOT-2

trim.

03:54:09.7 HOT-1

zero. zero. point four nose down set.

03:54:12.8 HOT-2

checked. after start checklist complete.

NTSB Aircraft Accident Report 119 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:54:14.8 INT-1

okay so we have two good starts and you're cleared to disconnect. appreciate your help. and we'll see you next time.

03:54:20.6 INT-MECH

copy. you got two good starts. bypass pin never installed. doors are secured. have a safe and pleasant trip. see you next time through.

03:54:42.3 HOT-2

clear over here as far as I can see.

03:54:44.4 HOT-1

okay.

03:54:50.0 HOT-2

here. here he comes. **.

03:54:52.6 HOT-1

okay.

03:54:56.5 HOT-2

I don't see nobody now.

03:54:58.3 HOT-1

okay clear left.

03:55:01.5 HOT-1

slats extend.

03:55:02.8 HOT-2

slats extend.

03:55:03.8 CAM

[sound of clicks, similar to flap handle]

03:55:58.8 RDO-2

hello ground UPS thirteen fifty four heavy alpha spot six ready to taxi.

NTSB Aircraft Accident Report 120 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:56:04.4 HOT-2

of course. of course. of course.

03:56:07.1 GND

two people calling at once. the woman calling ground say again.

03:56:11.0 RDO-2

UPS thirteen fifty four heavy information alpha spot six taxi.

03:56:19.5 GND

UPS thirteen fifty four heavy Louisville Ground. follow heavy MD- eleven ahead and to your left for runway three five right. taxi via Delta.

03:56:29.4 RDO-2

we'll follow the MD out to three five right via Delta for UPS thirteen fifty four heavy.

03:56:33.5 HOT-1

alright follow the airplane to the left.

03:56:37.2 HOT-1

clear on the tops when you get a chance.

03:56:38.8 HOT-2

all righty.

03:57:00.2 HOT-2

tops are good.

03:57:01.1 HOT-1

okay right rudder.

03:57:03.1 HOT-2

right box.

03:57:04.1 HOT-1

and left rudder.

NTSB Aircraft Accident Report 121 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:57:06.4 HOT-2

left box rudder checks.

03:58:13.8 HOT-1

okay left seat. three hundred and two thousand pound take-off. flaps fifteen zero profile up to five thousand. off the right side. pink page [stammering] is going to be reviewed and its complete. unless there's any questions?

03:58:26.8 HOT-2

sounds good.

03:58:27.8 HOT-1

before takeoff check.

03:58:28.5 HOT-2

before takeoff checklist flaps.

03:58:30.8 HOT-1

fifteen zero.

03:58:32.0 HOT-2

fifteen zero. flight controls.

03:58:33.8 HOT-1

checked.

03:58:34.3 HOT-2

checked. TRP V speeds.

03:58:35.8 HOT-1

set.

03:58:36.6 HOT-2

set. ignitions. continuous relight. bleeds and packs are set. one's off just for noise. takeoff configuration is normal for takeoff. before takeoff checklist complete.

NTSB Aircraft Accident Report 122 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 03:58:46.1 HOT-1

thank you.

04:00:03.9 TWRSDF

Louisville International information Bravo current.

04:00:39.2 TWRSDF

UPS thirteen fifty four heavy Louisville Tower runway three five right line up and wait.

04:00:43.0 RDO-2

line up and wait three five right. thirteen fifty four heavy.

04:00:46.0 HOT-1

alright line up and wait three five right. right side verified.

04:00:47.8 HOT-2

line up and wait.

04:00:51.1 HOT-2

final's cleared. three zero zero nine's the new altimeter.

04:00:54.1 HOT-1

thirty oh nine.

04:01:50.8 HOT-2

three five right's verified.

04:01:53.0 HOT-1

yeah.

04:02:17.9 TWRSDF

UPS thirteen fifty four heavy fly runway heading runway three five right cleared for takeoff.

04:02:22.0 RDO-2

fly runway heading runway three five right cleared for takeoff UPS thirteen fifty four heavy.

NTSB Aircraft Accident Report 123 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:02:26.1 HOT-1

cleared to go.

04:02:26.7 HOT-2

cleared to go runway heading.

04:02:28.6 CAM

[sound of increased noise, similar to engine spool up]

04:02:33.6 HOT-1

set takeoff thrust.

04:02:45.6 HOT-2

thrust set.

04:02:49.1 HOT-2

eighty knots.

04:02:49.8 HOT-1

checked.

04:03:05.3 HOT-2

v-one rotate. v-two.

04:03:13.2 HOT-2

positive rate.

04:03:14.0 HOT-1

gear up.

04:03:21.8 HOT-1

heading select.

04:03:22.7 HOT-2

heading select.

04:03:46.9 TWRSDF

UPS thirteen fifty four heavy contact departure have a good flight.

NTSB Aircraft Accident Report 124 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:03:50.1 RDO-2

departure have a good one.

04:03:53.2 RDO-2

(hello) departure UPS thirteen fifty four heavy two point six climbing to five thousand runway heading.

04:03:57.7 APRSDF

UPS thirteen fifty four heavy Louisville Departure good morning you're radar contact. climb and maintain one zero thousand.

04:04:03.1 RDO-2

one zero thousand UPS thirteen fifty four heavy.

04:04:05.5 HOT-1

ten thousand.

04:04:07.0 HOT-1

slats retract.

04:04:07.0 HOT-2

ten thousand.

04:04:07.8 HOT-2

slats retract.

04:04:08.5 HOT-1

after takeoff checklist.

04:04:09.5 HOT-2

after takeoff checklist.

04:04:22.1 HOT-2

after takeoff checklist complete.

04:04:23.9 HOT-1

thank you.

NTSB Aircraft Accident Report 125 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:04:24.5 APRSDF

UPS thirteen fifty four heavy turn right heading zero niner zero.

04:04:27.4 RDO-2

right turn zero niner zero UPS thirteen fifty four heavy.

04:04:31.0 HOT-1

zero nine zero.

04:04:33.4 HOT-2

zero nine zero.

04:05:21.6 APRSDF

UPS thirteen fifty four heavy turn right direct Bowling Green.

04:05:25.2 RDO-2

right turn direct Bowling Green UPS thirteen fifty four heavy.

04:05:27.7 HOT-1

right turn going to Bowling Green.

04:05:35.8 HOT-1

look's good. I'll take it.

04:05:43.6 HOT-2

nav's available.

04:05:45.2 HOT-1

nav.

04:05:45.7 HOT-2

nav is selected.

04:05:46.8 HOT-1

thank you.

NTSB Aircraft Accident Report 126 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:06:10.2 APRSDF

UPS thirteen fifty four heavy contact Indy Center one two one point one seven. twenty one seventeen. we'll see ya.

04:06:15.8 RDO-2

twenty one seventeen. have a good day. thirteen fifty four.

04:06:26.8 HOT-1

nine for ten.

04:06:27.7 HOT-2

one to go.

04:06:28.5 RDO-2

(Indy) Center UPS thirteen fifty four nine point three for one zero thousand direct Bowling Green.

04:06:34.5 CTRINDY

UPS thirteen fifty four Indy Center roger cleared direct Birmingham climb maintain flight level two three zero.

04:06:39.8 RDO-2

direct Birmingham and up to two three zero for thirteen fifty four.

04:06:43.9 HOT-1

twenty three is in the box. out of ten. direct Birmingham.

04:06:44.3 HOT-2

twenty three and direct Birmingham.

04:07:02.7 HOT-2

nav is available and selected.

04:07:04.5 HOT-1

roger. roger nav's armed.

04:07:13.5 HOT-2

ops normal away.

NTSB Aircraft Accident Report 127 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:07:32.6 HOT-2

winds are calm still in Birmingham. ten miles. broken at a thousand.

04:07:43.0 HOT-1

autopilot one command.

04:07:44.7 HOT-2

autopilot one command.

04:10:02.5 CTRINDY

UPS thirteen fifty four climb and maintain flight level two eight zero.

04:10:07.0 RDO-2

two eight zero thirteen fifty four.

04:10:09.4 HOT-1

two eight oh.

04:10:10.1 HOT-2

twenty eight.

04:10:18.4 HOT-1

alright ninety two set.

04:10:19.7 HOT-2

ninety two set.

04:13:34.3 CTRINDY

UPS thirteen fifty four contact Memphis Center one two four point one two.

04:13:39.4 RDO-2

twenty four twelve UPS thirteen fifty four goodnight.

04:13:47.6 RDO-2

good morning Memphis UPS thirteen fifty four twenty four eight climbing two eight zero.

NTSB Aircraft Accident Report 128 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:13:52.9 CTRMEM1

UPS thirteen fifty four Memphis Center roger.

04:14:48.3 HOT-2

one to go.

04:14:49.6 HOT-1

one to go.

04:16:03.2 HOT-1

**.

04:16:06.0 HOT-2

I like it.

04:16:11.6 HOT-1

**.

04:16:12.3 HOT-2

that's the way every flight should be.

04:16:23.2 HOT-1

(you can't bid to hold *.)

04:16:24.8 HOT-2

I know. I know.

04:16:26.2 HOT-1

• you might get something *.

04:16:28.1 HOT-1

this bid period and the next one you get something completely different. yep.

04:16:30.3 HOT-2

• it's crazy.

NTSB Aircraft Accident Report 129 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:20:53.4 ATIS

Birmingham Airport information Papa zero eight five three Zulu observation wind calm visibility one zero. sky condition ceiling one thousand broken. seven thousand five hundred overcast. temperature two three. dewpoint two two. altimeter two niner niner seven. localizer runway one eight in use. landing and departing runway one eight. notice to airmen runway six two-four closed. all departing aircraft contact tower one one niner point niner for clearance taxi and takeoff. advise controller on initial contact you have Papa.

04:21:23.9 HOT-2

well. did you hear any of Papa?

04:21:27.1 HOT-1

I didn't hear any of it.

04:21:28.1 HOT-2

they're sayin' six and two-four is closed. they're doin' the localizer to one eight.

04:21:33.0 HOT-1

localizer (to) one eight. it figures.

04:21:35.3 HOT-2

I know. especially since were [stammer] a little heavy. I mean [chuckle].

04:21:40.8 HOT-1

yep.

04:23:15.5 HOT-1

alright. I guess I'll brief it. briefing guide.

04:23:17.9 HOT-2

(okay).

NTSB Aircraft Accident Report 130 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:23:22.1 HOT-1

so review profile approach summary table for approach set-up. aaaaannnndddd.

04:23:31.7 HOT-1

GPS primary doesn't apply to localizer. RNP doesn't apply.

04:23:36.9 HOT-1

FMC disagree doesn't apply. temperature not applicable.

04:23:45.7 HOT-1

ahhh. verify VNAV path on approach chart. ah it is.

04:23:56.6 HOT-1

ILS glideslope out approaches.

04:24:00.5 HOT-1

VNAV path is the same as the ILS glideslope.

04:24:11.2 HOT-1

alright and uh. determine DA or D-DA and set altimeter bugs. and there is a note there only-only authorized operators may use VNAV DA in lieu of uhm MDA. alright so it will be twelve hundred for us. and uhhh.

04:24:19.4 HOT-2

mmm hmm.

04:24:25.9 HOT-2

twelve hundred huh.

04:24:34.3 HOT-1

okay. and in case uh a barometric DA may be utilized on the following approaches. ILS glideslope out. or approaches titled ILS or localizer runway. which is this case. or ILS or localizer DME runway bla bla bla.

NTSB Aircraft Accident Report 131 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:24:52.8 HOT-1

all approaches with VNAV ball note. ball note states only authorized operators may use VNAV DA in lieu of MDA.

04:25:00.8 HOT-1

alright. this is US airspace. load approach in FMC database. enter DA. or D-DA on approach page.

04:25:17.2 HOT-1

okay and uh. verify database vertical path angle agrees with approach chart within one degree.

04:25:29.9 HOT-2

[mumbling] ** verify approach to point one degrees.

04:25:30.8 HOT-1

okay.

04:25:35.3 HOT-1

and.

04:25:37.8 HOT-1

adjust approach on approach page if necessary. v-approach. that's not necessary.

04:25:42.5 HOT-1

accomplish the brief. briefing and activate final approach mode.

04:25:47.0 HOT-1

and in the last note. select profile and verify P descent on an ILS glideslope out approaches or localizer approaches when the VNAV path crosses the final approach fix below the FAF minimum altitude. start a one thousand ft per minute descent at the FAF and immediately select profile mode to capture the path.

NTSB Aircraft Accident Report 132 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:26:06.5 HOT-1

so. ahhh eleven dash two is the plate. seventeen august twelve. localizer frequency is one eleven three. final approach course is one eight three. and ah.

04:26:27.4 HOT-1

BASKN is the ahhh final approach fix. twenty three hundred ft. down to a ah DA of twelve hundred. five sixty ah on the radio altimeter.

04:26:41.2 HOT-1

touchdown zone is six forty four and airport's six fifty. MSA is thirty seven hundred ft and it’s based on the Vulcan VOR.

04:26:49.4 HOT-1

missed approach climb to fifteen hundred ft on a heading one eight three. and a climbing left turn to thirty eight hundred ft on the Vulcan one thirty seven radial. and outbound to handle [missed approach fix is HANDE]. twenty seven point--twenty eight point six off of Vulcan and hold or as directed by ATC.

04:27:08.9 HOT-1

so if that's the case this morning then we'll just follow the nav path for the missed.

04:27:13.4 HOT-1

missed approach will be go-around thrust flaps positive rate gear up. four hundred ft nav. thousand ft autopilot one command. fifteen hundred ft climb thrust and at alt star we'll set green dot and clean it up on schedule.

04:27:23.3 HOT-1

for the discontinued approach outside of anap [stammer] a thousand I'll announce discontinued approach. altitude hold probably one sixty...

04:27:29.8 HOT-1

once we're ahhh accelerating and stable it'll be ahhh flaps and gear. the runway we just talked about...

NTSB Aircraft Accident Report 133 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:27:33.6 HOT-2

okay.

04:27:37.7 HOT-1

...it's short.

04:27:38.5 CTRMEM1

UPS thirteen fifty four contact Atlanta Center one two eight point seven two.

04:27:45.6 RDO-2

twenty eight seventy two UPS thirteen fifty four.

04:27:53.2 RDO-2

Atlanta UPS thirteen fifty four two eight zero.

04:27:56.5 CTRATL1

UPS thirteen fifty four Atlanta Center roger.

04:27:59.9 HOT-1

alright it’s got REIL PAPI on the left...

04:28:01.9 HOT-1

it’s a three point two degree angle....and uh...

04:28:03.2 CTRATL1

attention all aircraft hazardous weather inf-- AIRMET for Tennessee, Kentucky, West Virginia, Louisiana, Mississippi, and Alabama available on HIWAS Flight Watch Flight Service frequencies.

04:28:11.3 HOT-1

probably use most of this today. probably either probably Golf at the end. and uh.

04:28:20.7 HOT-1

I think on this one they bring you off on ah Bravo--

NTSB Aircraft Accident Report 134 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:28:22.4 CTRATL1

Delta thirteen fifty four Atlanta approach one two five point seven.

04:28:23.4 HOT-2

(okay)

04:28:27.4 AC

uh that was twenty five point seven Delta thirteen fifty four.

04:28:30.7 RDO-?

altimeter two niner niner seven.

04:28:30.8 HOT-1

Delta thirteen fifty four. wow.

04:28:33.7 HOT-2

what was that?

04:28:34.4 HOT-1

Delta thirteen fifty four. it’s the same as our number.

04:28:36.3 HOT-2

I know it’s the same as ours *.

04:28:37.5 HOT-1

yeah.

04:28:39.9 HOT-1

okay so it'll be Bravo to ah...Foxtrot...which will be a left turn and then down to the UPS ramp. low brakes.

04:28:55.0 HOT-1

and the only other thing we gotta do is when I come out of ahh...I guess I'll do that now--

04:28:58.4 CTRATL1

UPS thirteen fifty four descend at pilot's discretion maintain flight level two four zero.

NTSB Aircraft Accident Report 135 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:29:03.2 RDO-2

pilot's discretion two four zero UPS thirteen fifty four.

04:29:06.2 HOT-1

oh pilot's discretion two four zero. okay.

04:29:09.6 HOT-1

so that's good three point three...and...ahhh...twelve hundred...and we'll just activate final when we start down.

04:29:16.4 HOT-2

we'll just activate that once we're on the uh. you notice this radio hasn't shut up since we took-- I mean it’s been chatter the whole time [chuckle].

04:29:17.6 HOT-1

(yeah). (yeah). oh I know. I know. on this particular trip. yeah.

04:32:08.2 HOT-1

two four zero.

04:32:12.7 RDO-2

and UPS thirteen fifty four leaving two eight zero for two four zero.

04:32:18.7 CTRATL1

FedEx thirteen fifty four roger.

04:32:21.0 HOT-1

UPS.

04:32:21.1 RDO-2

no it's UPS thirteen fifty four.

04:32:22.9 CTRATL1

sorry UPS thirteen fifty four roger.

04:32:25.9 HOT-1

the other airline [chuckle].

NTSB Aircraft Accident Report 136 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:32:26.9 HOT-2

I know. it’s the other one. the F word er. not the F word * [trails off to chuckle].

04:32:35.7 HOT-2

I just want'a make sure---you remember that in recurrent? you remember there was like ah...

04:32:38.7 HOT-1

[chuckle].

04:32:40.3 HOT-2

...some other aircraft following another...when there's...cause I thought you said there was a Delta thirteen fifty four. so I wanted to make sure (they) [trails off to chuckle].

04:32:46.8 HOT-1

mmm hmmm.

04:32:49.4 HOT-2

so he knew who was doin' what [chuckle].

04:32:51.1 HOT-1

yeah...exactly [chuckle].

04:32:53.4 HOT-1

like who we are.

04:32:54.6 HOT-2

mmm hmmm.

04:33:09.8 CTRATL1

UPS thirteen fifty four contact Memphis Center one two zero point eight.

04:33:14.3 RDO-2

one two zero point eight UPS thirteen fifty four. good night.

NTSB Aircraft Accident Report 137 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:33:20.6 RDO-2

morning Memphis UPS thirteen fifty four twenty five seven for two four zero.

04:33:26.0 CTRMEM2

UPS thirteen fifty four Memphis Center roger descend at pilot's discretion maintain one one thousand. Birmingham altimeter two niner niner six.

04:33:32.7 RDO-2

pilot's discretion one one thousand. Birmingham twenty nine-ninety six for thirteen fifty four.

04:33:37.5 HOT-1

alright discretion level we'll keep it goin'.

04:33:39.9 HOT-2

keep 'er goin'.

04:33:42.2 RDO-2

and for UPS thirteen fifty four we're just keep 'er goin' down to eleven.

04:33:45.8 CTRMEM2

roger.

04:34:09.9 HOT-1

they're generous today. usually they kind'a take you to fifteen and they hold you up high.

04:34:11.0 HOT-2

I know. hold you up there.

04:37:03.7 CTRMEM2

UPS thirteen fifty four contact Atlanta Center one two seven point three.

NTSB Aircraft Accident Report 138 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:37:08.1 RDO-2

one twenty seven point three UPS thirteen fifty four.

04:37:15.8 RDO-2

er Atlanta UPS thirteen fifty four out of one eight oh for one one thousand.

04:37:18.1 CAM

[sound of four clacks/clunks]

04:37:21.3 CTRATL2

UPS thirteen fifty four latest weather Birmingham altimeter two niner niner six.

04:37:25.1 RDO-2

ninety six thirteen fifty four.

04:37:27.3 HOT-1

ninety six. approach checklist.

04:37:29.4 HOT-2

ninety six. approach checklist.

04:37:34.1 HOT-2

seat belt sign is on. landing elevation is set to six fifty. autobrakes are set to low. ECAM status is checked. standby airspeed bugs...

04:37:42.9 HOT-1

one thirty seven. two ahhh seventeen set.

04:37:45.4 HOT-2

...thirty seven. two seventeen set. altimeters.

04:37:48.5 HOT-1

two nine nine six set twice.

04:37:50.2 HOT-2

twenty nine ninety six set. approach checklist complete.

NTSB Aircraft Accident Report 139 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:37:53.2 HOT-1

alright thank you.

04:40:24.3 HOT-1

one to go.

04:40:25.3 HOT-2

one to go.

04:40:49.5 CAM

[background sound decreases, similar to reduction in airspeed. lower sound continues until gear extension]

04:41:26.1 HOT-2

(let) me ask him for lower or?

04:41:28.6 HOT-1

mmm hmm.

04:41:30.6 RDO-2

is there any chance for lower for UPS thirteen fifty four?

04:41:33.1 CTRATL2

UPS thirteen fifty four contact Birmingham Approach one two seven point six seven. goodday.

04:41:37.3 RDO-2

twenty seven sixty seven goodday.

04:41:43.6 RDO-2

Birmingham UPS thirteen fifty four we're at one one thousand we have papa look'n for lower.

04:41:49.4 TWRBHM1

UPS thirteen fifty four heavy Birmingham Tower descend and maintain three thousand and uhm...runway six is still closed. you want to ah want the localizer one eight?

NTSB Aircraft Accident Report 140 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:41:59.5 HOT-1

yep.

04:42:00.2 RDO-2

yessir the localizer one eight will work.

04:42:02.0 TWRBHM1

[static] copy that.

04:42:04.8 TWRBHM1

UPS thirteen fifty four heavy turn ten degrees right join the localizer maintain three thousand.

04:42:09.2 RDO-2

okay. ten right join the localizer. maintain three thousand. thirteen fifty four heavy.

04:42:13.1 HOT-1

ten right join the localizer.

04:42:14.9 CAM

[sound of click]

04:42:16.1 HOT-2

I don't think we have many choices if runway six is [laughter].

04:42:17.7 HOT-1

ahhh [laughter] I know what else can we do [laughing]?

04:42:19.0 HOT-2

and when he said there for me I'm like ahhh well what else ahh you gonna unroll another one out there for us real quick or whatever [chuckling].

04:42:20.9 HOT-1

it's like...okay....yeah you got another ... yeah you got an ILS on some'n else? [chuckling]

NTSB Aircraft Accident Report 141 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:42:25.2 HOT-2

uhh...I know [chuckling].

04:42:38.1 HOT-1

gear down.

04:42:40.3 HOT-2

gear down speed checks.

04:42:40.7 CAM

[sound of multiple clicks, similar to landing gear handle movement]

04:42:42.1 CAM

[sound of snap and increased noise, similar to landing gear extension]

04:42:52.1 HOT-1

and they keep you high [laughter].

04:42:53.8 HOT-2

at at'll getch'ya down [chuckling]...

04:42:55.2 HOT-1

oh I know. I * [chuckling].

04:42:55.7 HOT-2

...yeah they were doin' good until...then...

04:42:57.0 HOT-1

eh I know it's unbelievable [chuckling].

04:42:58.5 HOT-2

...I kept seein' COLIG come closer and closer. and I'm like oh brother.

04:43:00.2 HOT-1

I know it's like...it's like comin' comin' fast. ah yup [chuckling].

NTSB Aircraft Accident Report 142 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:43:09.4 HOT-1

divin' for the airport. unbelievable.

04:43:24.3 TWRBHM1

UPS thirteen fifty four heavy is one one miles from BASKIN maintain two thousand five hundred till established on localizer. cleared localizer one eight approach.

04:43:32.0 RDO-2

two thousand five hundred till established. cleared for the localizer one eight approach UPS thirteen fifty four heavy.

04:43:37.4 HOT-1

two point five till established cleared for the localizer.

04:43:40.4 HOT-2

least there's like eight miles between...

04:43:42.0 HOT-1

oh I know this is---

04:43:43.3 HOT-2

...COLIG and BASKIN [chuckle].

04:43:53.5 HOT-2

there's loc star.

04:43:53.6 HOT-1

loc's alive.

04:43:55.7 HOT-1

one eight three set.

04:44:05.5 HOT-2

[dash dash dash...dot dot dash dot dot dash] [may be two idents at same time, one sounds similar to DME]

NTSB Aircraft Accident Report 143 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:44:11.6 HOT-1

you can activate that...

04:44:12.1 HOT-2

good ident on the localizer.

04:44:13.1 HOT-1

...activate that final if you haven't already.

04:44:15.0 HOT-2

alright.

04:44:18.2 HOT-1

thirty five for twenty five.

04:44:19.6 HOT-2

thirty five for twenty five. final's activated.

04:44:37.5 HOT-1

slats extend.

04:44:39.1 HOT-2

speed checks. slats extend.

04:44:40.3 CAM

[sound of click, similar to flap handle movement]

04:44:49.2 HOT-1

unbelievable.

04:44:51.3 HOT-2

I know [chuckling].

04:44:60.0 TWRBHM1

FedEx fourteen eighty eight Birmingham.

04:45:07.0 TWRBHM1

ah should be closed ah about another fifteen minutes.

NTSB Aircraft Accident Report 144 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:45:08.4 HOT-1

flaps fifteen.

04:45:10.2 HOT-2

speed checks. flaps fifteen.

04:45:13.8 CAM

[sound of multiple clicks, similar to flap handle]

04:45:18.5 TWRBHM1

UPS thirteen fifty four heavy change to my frequency one one niner point niner.

04:45:22.4 RDO-2

nineteen nine.

04:45:28.9 RDO-2

thirteen fifty four up nineteen nine.

04:45:31.3 TWRBHM2

UPS thirteen fifty four heavy runway one eight cleared to land wind calm.

04:45:34.8 RDO-2

one eight cleared to land thirteen fifty four heavy.

04:45:38.3 HOT-1

flaps twenty.

04:45:39.9 HOT-2

speed checks flaps twenty.

04:45:43.3 CAM

[sound of multiple clicks, similar to flap handle]

04:45:50.6 CAM

[sound of background noise continues to decrease, similar to airspeed decreasing]

NTSB Aircraft Accident Report 145 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:45:50.9 HOT-1

flaps forty speed one thirty seven landing check.

04:45:53.8 HOT-2

okay...

04:45:54.7 HOT-1

set the missed approach altitude.

04:45:55.0 HOT-2

[sound of multiple clicks, similar to flap handle] speed checks flaps forty landing checklist missed approach altitude.

04:45:58.5 TWRBHM2

airport fifteen tower.

04:46:05.2 HOT-2

landing gears down three green pressure check. TRP thrust limit GA.

04:46:09.1 HOT-2

flaps thirty forty.

04:46:09.4 VEH

tower Airport Twelve * two go ahead.

04:46:12.7 TWRBHM2

Airport Twelve ah are we ah on schedule to open back up at ah one zero Z?

04:46:14.2 HOT-2

speed brakes armed. ignition continuous relight.

04:46:17.4 HOT-2

landing checklist complete.

04:46:18.4 HOT-1

unbelievable kept us high...

NTSB Aircraft Accident Report 146 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT

04:46:19.0 VEH

affirm uhm they're very close to the end right now uh.

04:46:24.7 HOT-2

let's see you're in...vertical speed...okay.

04:46:24.8 TWRBHM2

roger.

04:46:27.0 HOT-1

...yeah I'm gonna do vertical speed. yeah he kept us high.

04:46:29.6 HOT-2

kept ya high. could never get it over to profile (we didn't) do it like that.

04:46:31.4 HOT-1

uh uh I know.

04:46:33.7 HOT-2

I'll put your missed approach altitude in there.

04:46:35.7 HOT-1

yeah. thank you.

04:46:46.8 HOT-1

alright so at three point three should be at thirteen eighty.

04:46:49.2 HOT-2

damn I'm gonna actually have to...

04:46:53.7 HOT-1

and we're like way high...

04:46:56.8 HOT-1

...or higher [chuckle].

NTSB Aircraft Accident Report 147 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:46:57.1 HOT-2

about...a couple hundred ft...yeah.

04:46:59.4 HOT-1

yeah.

04:47:02.9 HOT-2

there's a thousand ft instruments cross checked no flags.

04:47:05.4 HOT-1

alright ah DA is twelve ah hundred.

04:47:08.1 HOT-2

twelve hundred yeah...

04:47:10.9 HOT-1

two miles.

04:47:19.6 HOT-2

it wouldn't happen to be actual [chuckle].

04:47:21.4 CAM

[sound of snap]

04:47:23.0 HOT-1

oh I know.

04:47:24.5 EGPWS

sink rate.

04:47:25.9 EGPWS

sink rate.

04:47:26.6 HOT-2

(there it is) [mumbling].

04:47:26.7 HOT-1

uhhhr.

NTSB Aircraft Accident Report 148 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:47:27.9 HOT-1

oh I got the runway out there twelve o'clock.

04:47:28.5 HOT-2

got the runway in sight, eh.

04:47:29.7 HOT-1

autopilot's off.

04:47:29.9 HOT-2

eh.

04:47:30.6 HOT-2

alrighty.

04:47:31.5 CAM

[sound of click, similar to autopilot paddle switch]

04:47:31.9 CAM

[sound of cavalry charge, similar to autopilot disengagement continues for 4.3 seconds]

04:47:32.5 CAM

[sound of rustling, similar to impact, volume increases for about 5.4 seconds]

04:47:32.9 HOT-2

ooh.

04:47:33.4 HOT-1

oh # #.

04:47:33.5 EGPWS

too low terrain [recorded on CAM]

04:47:35.1 HOT-1

oh did I hit (somethin')?

NTSB Aircraft Accident Report 149 TIME and SOURCE INTRA-COCKPIT CONTENT TIME and SOURCE COCKPIT-GROUND COMMUNICATION CONTENT 04:47:36.6 HOT-1

oh...oh # [exclaiming].

04:47:37.9 HOT-2

oh.

04:47:37.9 CAM

[cessation in rustling/impact sounds]

04:47:38.3 HOT-1

oh. oh God.

04:47:38.8 CAM

[sound of rustling, similar to impact, continues at higher volume until end of recording]

04:47:39.9 HOT-?

[grunting].

04:47:41.1 HOT

[static].

04:47:41.3 CAM

[end of loudest noise]

04:47:41.6 HOT

[end of recording]

END OF TRANSCRIPT 04:47:41.7 CDT

END OF RECORDING 04:47:41.7 CDT

NTSB Aircraft Accident Report 150 Appendix C: Bureau d’Enquêtes et d’Analyses pour la Sécurité de l’Aviation Civile Comments

NTSB Aircraft Accident Report

NTSB Aircraft Accident Report 152

References Caldwell, JA. “Fatigue in the Aviation Environment: An Overview of the Causes and Effects as well as Recommended Countermeasures.” Aviation, Space, and Environmental Medicine 68 (1997): 932-938. Caldwell, M and others. “Fatigue Countermeasures in Aviation.” Aviation, Space, and Environmental Medicine 80, no. 1 (2009): 29-59. Dinges, DF and others. “Temporal Placement of a Nap for Alertness: Contributions of Circadian Phase and Prior Wakefulness,” Sleep 10, no. 4 (1987): 313-329. Gander, PH and others. “Flight Crew Fatigue IV: Overnight Cargo Operations.” Aviation, Space, and Environmental Medicine 69, no. 9 (1998): B26-B36. Kruger, GP. “Sustained Work, Fatigue, Sleep Loss, and Performance: A Review of the Issues.” Work and Stress 3 (1989): 129-141. Lasseter, JA. “Chronic Fatigue: Tired of Being Tired.” Home Health Care Management & Practice 22, no. 1 (2009): 10-15. NTSB. Controlled Flight into Terrain, MarkAir, Inc., Boeing 737-2X6C, N670MA, Unalakleet, Alaska, June 2, 1990. NTSB/AAR-91/02, Washington, DC: National Transportation Safety Board, 1991. . A Review of Flightcrew-Involved, Major Accidents of U.S. Carriers, 1978 through 1990, Safety Study NTSB/SS-94/01, Washington, DC: NTSB, 1994.

—. Collision with Trees on Final Approach, American Airlines Flight 1572, McDonnell Douglas MD-83, N566AA, East Granby, Connecticut, November 12, 1995. NTSB/AAR-96/05, Washington, DC: National Transportation Safety Board, 1996. . Controlled Flight Into Terrain, Korean Air Flight 801, Boeing 747-300, HL7468, Nimitz Hill, Guam, August 6, 1997. NTSB/AAR-00/01, Washington, DC: National Transportation Safety Board, 2000. . Crash During Approach to Landing, Business Jet Services, Ltd., Gulfstream G-1159 A (G-III), N85VT, Houston, Texas, November 22, 2004. NTSB/AAB-06/06, Washington, DC: National Transportation Safety Board, 2006. . Collision with Trees and Crash Short of the Runway, Corporate Airlines Flight 5966, BAE Systems BAE-J3201, N875JX, Kirksville, Missouri, October 19, 2004. NTSB/AAR-06/01, Washington, DC: National Transportation Safety Board, 2006. . Loss of Control on Approach, Colgan Air, Inc., Operating as Continental Flight 3407, Bombardier DHC-8-400, N200WQ, Clarence Center, New York, February 12, 2009, NTSB/AAR-10/01, Washington, DC: National Transportation Safety Board, 2010.

NTSB Aircraft Accident Report 153

. Crash During Approach to Landing, Empire Airlines Flight 8284 Avions de Transport Regional Aerospatiale Alenia ATR 42-320, N902FX, Lubbock Texas, January 27, 2009. Aircraft Accident Report NTSB/AAR-11/02, Washington, DC: National Transportation Safety Board, 2011. . Crash During Attempted Go-Around After Landing, East Coast Jets Flight 81, Hawker Beechcraft Corporation 125-800A, N818MV, Owatonna, Minnesota, July 31, 2008. Aircraft Accident Report NTSB/AAR-11/01, Washington, DC: National Transportation Safety Board, 2011. . Descent Below Visual Glidepath and Impact with Seawall, Asiana Airlines Flight 214, Boeing 777-200ER, HL7742, San Francisco, California, July 6, 2013, Aircraft Accident Report NTSB/AAR-14/01, Washington, DC: National Transportation Safety Board, 2014. Previc, FH and others. “The Effects of Sleep Deprivation on Flight Performance, Instrument Scanning, and Physiological Arousal in Pilots.” The International Journal of Aviation Psychology 19 (2009): 326-346. Rosekind, MR and others. “Alertness management: Strategic naps in operational settings.” Journal of Sleep Research, 4 (Suppl. 2) (1995): 62-66. Stepanski, EJ. “The Effect of Sleep Fragmentation on Daytime Function.:” Journal of Sleep 25, no. 3 (2002): 268-276. Wever, R. “Phase Shifts of Circadian Rhytms Due to Shifts of Artificial Zeitgebers.” Chronobiologia 7 (1980): 303-327.

FD07418 ｜ 2014_美国_AAR1403.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Crash Following Encounter with Instrument Meteorological Conditions After Departure from Remote Landing Site Alaska Department of Public Safety Eurocopter AS350 B3, N911AA Talkeetna, Alaska March 30, 2013

Accident Report NTSB/AAR-14/03 PB2014-108877

National Transportation Safety Board

NTSB/AAR-14/03 PB2014-108877 Notation 8602 Adopted November 5, 2014

Aircraft Accident Report Crash Following Encounter with Instrument Meteorological Conditions After Departure from Remote Landing Site Alaska Department of Public Safety Eurocopter AS350 B3, N911AA Talkeetna, Alaska March 30, 2013

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2014. Crash Following Encounter with Instrument Meteorological Conditions After Departure from Remote Landing Site, Alaska Department of Public Safety, Eurocopter AS350 B3, N911AA, Talkeetna, Alaska, March 30, 2013. Aircraft Accident Report NTSB/AAR-14/03. Washington, DC.

Abstract: This report discusses the March 30, 2013, accident involving a Eurocopter AS350 B3 helicopter, N911AA, operated by the Alaska Department of Public Safety, which impacted terrain while maneuvering during a search and rescue flight near Talkeetna, Alaska. The airline transport pilot, an Alaska state trooper serving as a flight observer for the pilot, and a stranded snowmobiler who had requested rescue were killed, and the helicopter was destroyed by impact and postcrash fire. Safety issues include inadequate pilot decision-making and risk management; lack of organizational policies and procedures to ensure proper risk management; inadequate pilot training, particularly for night vision goggle use and inadvertent instrument meteorological condition encounters; inadequate dispatch and flight following; lack of a tactical flight officer program; punitive safety culture; lack of management support for safety programs; and attitude indicator limitations. Safety recommendations are addressed to the Federal Aviation Administration, the state of Alaska, 44 additional states, the Commonwealth of Puerto Rico, and the District of Columbia. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID ANC13GA036. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2014-108877 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Aircraft Accident Report i Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iv Abbreviations .................................................................................................................................v Executive Summary .................................................................................................................... vii

1. Factual Information ...................................................................................................................1
2. 1 History of the Flight .................................................................................................................1
3. 1.1 Mission Coordination ......................................................................................................1
4. 1.2 Outbound Flight to Remote Rescue Location .................................................................2
5. 1.3 Accident Flight ................................................................................................................4
6. 2 Personnel Information ................................................................................................................7
7. 2.1 Pilot ..................................................................................................................................7
8. 2.1.1 Training and Performance at Alaska DPS .........................................................7
9. 2.1.2 Work/Sleep/Wake History .................................................................................9
10. 2.1.3 Previous Accident ............................................................................................10
11. 2.1.4 Schedule and Compensation ............................................................................10
12. 2.1.5 Colleagues’ and Others’ Perceptions ...............................................................11
13. 2.2 Flight Observer ..............................................................................................................13
14. 3 Helicopter Information.............................................................................................................13
15. 3.1 Maintenance ...................................................................................................................15
16. 3.2 Pilot’s Concerns about Maintenance .............................................................................16
17. 4 Meteorological Information .....................................................................................................16
18. 4.1 Weather Information Available Before Departure ........................................................17
19. 4.2 Weather and Lighting Conditions at Accident Site and Time .......................................18
20. 5 Cockpit Image, Audio, and Data Recorder ..............................................................................19
21. 6 Wreckage and Impact Information ..........................................................................................23
22. 7 Medical and Pathological Information.....................................................................................24
23. 8 Organizational and Management Information .........................................................................24
24. 8.1 General ...........................................................................................................................24
25. 8.2 Aircraft Section Policies and Procedures ......................................................................26
26. 8.2.1 Operational Control and Go/No-Go Decisions ................................................26
27. 8.2.2 Flight and Duty Time Policies .........................................................................27
28. 8.2.3 Preflight Risk Assessment and Weather Minimums .......................................28
29. 8.2.4 Safety Program.................................................................................................28
30. 8.3 Response to Pilot’s Previous Accident and Events .......................................................30
31. 8.3.1 Accident in 2006 ..............................................................................................30
32. 8.3.2 Engine and Rotor Overspeed Event in 2009 ....................................................32
33. 8.3.3 Overtorque Event in 2011 ................................................................................33
34. 8.4 Use of Flight Observers .................................................................................................34
35. 8.5 Use of MatCom Dispatch Services ................................................................................35

NTSB Aircraft Accident Report ii 1.8.6 Alaska DPS Changes Since This Accident ....................................................................36 1.9 Previously Issued Safety Recommendations ...........................................................................38 1.9.1 Airborne Law Enforcement Association Safety Policies Guidance ..............................38 1.9.2 HEMS Operations ..........................................................................................................39 1.9.2.1 Pilot Training on Inadvertent IMC Encounters ...............................................39 1.9.2.2 Preflight Risk Assessment ...............................................................................40 1.9.3 Inconsistencies Among Weather Information Products ................................................42

1. Analysis .....................................................................................................................................45
2. 1 General .....................................................................................................................................45
3. 1.1 Pilot Qualifications and Fitness for Duty ......................................................................45
4. 1.2 Helicopter Maintenance and Wreckage Examinations ..................................................45
5. 1.3 Weather Conditions .......................................................................................................46
6. 2 Accident Flight.........................................................................................................................47
7. 3 Pilot’s Risk Management Considerations ................................................................................50
8. 3.1 Decision to Accept Mission ...........................................................................................50
9. 3.2 Preparations for Departure .............................................................................................51
10. 3.3 Decision to Continue Mission .......................................................................................53
11. 4 Organizational Issues ...............................................................................................................54
12. 4.1 Risk Assessment ............................................................................................................54
13. 4.2 Pilot Training .................................................................................................................56
14. 4.3 Use of Trained Observers ..............................................................................................58
15. 4.4 Safety Management and Safety Culture ........................................................................59
16. 5 Similarities with Other Public Aircraft Operations Accidents ................................................63
17. 6 Attitude Indicator Limitations..................................................................................................64
18. 7 Investigative Benefits of Onboard Recorder............................................................................66
19. Conclusions ...............................................................................................................................69
20. 1 Findings....................................................................................................................................69
21. 2 Probable Cause.........................................................................................................................71
22. Recommendations ....................................................................................................................72

References .....................................................................................................................................74

NTSB Aircraft Accident Report iii Figures Figure 1. End of GPS flight track from Sunshine to landing site with flight track shown in orange. ............................................................................................................................................. 3 Figure 2. Aerial photograph of helicopter landing site. . ............................................................... 4 Figure 3. GPS-derived flight track of the accident flight (shown in orange). ................................ 5 Figure 4. Aerial view of the accident site with helicopter wreckage circled in red. ...................... 6 Figure 5. Preaccident photograph of the helicopter. .................................................................... 14 Figure 6. Appareo Vision 1000 unit from the accident helicopter. .............................................. 20 Figure 7. Accident site showing main wreckage. ........................................................................ 23 Figure 8. Chain of command structure in place at the time of the accident. ................................ 25

NTSB Aircraft Accident Report iv Tables Table 1. Pilot’s estimated potential sleep. .................................................................................... 10 Table 2. Summary of select information from Appareo images .................................................. 21 Table 3. Summary of Alaska DPS safety improvements since the accident................................ 37

NTSB Aircraft Accident Report v Abbreviations AAWU Alaska Aviation Weather Unit agl above ground level ALEA Airborne Law Enforcement Association AMPA Air Medical Physicians Association AMRG Alaska Mountain Rescue Group ANC Ted Stevens Anchorage International Airport ASOS automated surface observing system AST Alaska State Troopers AWT Alaska Wildlife Troopers CDI course deviation indicator CFR Code of Federal Regulations DPS Department of Public Safety ELT emergency locator transmitter EMS emergency medical services FA area forecast FAA Federal Aviation Administration FLI flight limit indicator FLIR forward-looking infrared fpm feet per minute FSS flight service station HEMS helicopter emergency medical services HSI horizontal situation indicator IFR instrument flight rules IMC instrument meteorological conditions in Hg inches of mercury METAR meteorological aerodrome report min Minutes

NTSB Aircraft Accident Report vi msl mean sea level NMSP New Mexico State Police NTSB National Transportation Safety Board NVG night vision goggles NWS National Weather Service OCC operations control centers PAQ Palmer Municipal Airport PED portable electronic device PIC pilot-in-command RCC Alaska Air National Guard Rescue Coordination Center SAR search and rescue SFAR special federal aviation regulation SMS safety management system TAF terminal aerodrome forecast TFO tactical flight officer TKA Talkeetna Airport TSO technical standard order VFR visual flight rules

NTSB Aircraft Accident Report vii Executive Summary On March 30, 2013, at 2320 Alaska daylight time, a Eurocopter AS350 B3 helicopter, N911AA, impacted terrain while maneuvering during a search and rescue (SAR) flight near Talkeetna, Alaska. The airline transport pilot, an Alaska state trooper serving as a flight observer for the pilot, and a stranded snowmobiler who had requested rescue were killed, and the helicopter was destroyed by impact and postcrash fire. The helicopter was registered to and operated by the Alaska Department of Public Safety (DPS) as a public aircraft operations flight under 14 Code of Federal Regulations Part 91. Instrument meteorological conditions (IMC) prevailed in the area at the time of the accident. The flight originated at 2313 from a frozen pond near the snowmobiler’s rescue location and was destined for an off-airport location about 16 mi south. After picking up the stranded, hypothermic snowmobiler at a remote rescue location in dark night conditions, the pilot, who was wearing night vision goggles (NVG) during the flight, encountered IMC in snow showers within a few minutes of departure. Although the pilot was highly experienced with SAR missions, he was flying a helicopter that was not equipped or certified for flight under instrument flight rules (IFR). The pilot was not IFR current, had very little helicopter IFR experience, and had no recent inadvertent IMC training. Therefore, conducting the flight under IFR was not an option, and conducting the night flight under visual flight rules in the vicinity of forecast IFR conditions presented high risks. After the helicopter encountered IMC, the pilot became spatially disoriented and lost control of the helicopter. At the time the pilot was notified of the mission and decided to accept it, sufficient weather information was available for him to have determined that the weather and low lighting conditions presented a high risk. The pilot was known to be highly motivated to accomplish SAR missions and had successfully completed SAR missions in high-risk weather situations in the past. The investigation also identified that the Alaska DPS lacked organizational policies and procedures to ensure that operational risk was appropriately managed both before and during the mission. Such policies and procedures include formal pilot weather minimums, preflight risk assessment forms, and secondary assessment by another qualified person trained in helicopter flight operations. These risk management strategies could have encouraged the pilot to take steps to mitigate weather-related risks, decline the mission, or stay on the ground in the helicopter after rescuing the snowmobiler. The investigation also found that the Alaska DPS lacked support for a tactical flight officer program, which led to the unavailability of a trained observer on the day of the accident who could have helped mitigate risk. Any organization that wishes to actively manage safety as part of an effective safety management system must continuously strive to discover, understand, and mitigate the risks involved in its operations. Doing so requires the active engagement of front-line personnel in the reporting of operational risks and their participation in the development of effective risk mitigation strategies. This cannot occur if a focus of the organization’s approach to dealing with safety-related events is to punish those whose actions or inactions contributed to the event.

NTSB Aircraft Accident Report viii Although front-line personnel may, on rare occasions, be involved in intentional misdeeds, the majority of accidents and incidents involve unintentional errors made by well-intentioned personnel who are doing their best to manage competing performance and safety goals. An organizational safety culture that encourages the adoption of an overly punitive approach to investigating safety-related events tends to discourage the open sharing of safety-related information and to degrade the organization’s ability to adapt to operational risks. The Alaska DPS safety culture, which seemed to overemphasize the culpability of the pilot in his past accident and events, appears to have had this effect. The pilot had adopted a defensive posture with respect to the organization, and he was largely setting his own operational limitations and making safety-related operational decisions in a vacuum, masking potential risks, such as the risk posed by his operation of helicopter NVG flights at night in low IFR conditions. This had a deleterious effect on the organization’s efforts to manage the overall safety of its SAR operations. The investigation found that Alaska DPS had a punitive safety culture that impeded the free flow of safety-related information and impaired the organization’s ability to address underlying safety deficiencies relevant to this accident. The National Transportation Safety Board (NTSB) determines that the probable cause of this accident was the pilot’s decision to continue flight under visual flight rules into deteriorating weather conditions, which resulted in the pilot’s spatial disorientation and loss of control. Also causal was the Alaska Department of Public Safety’s punitive culture and inadequate safety management, which prevented the organization from identifying and correcting latent deficiencies in risk management and pilot training. Contributing to the accident was the pilot’s exceptionally high motivation to complete search and rescue missions, which increased his risk tolerance and adversely affected his decision-making. It is important to note that the investigation was significantly aided by information recovered from the helicopter’s onboard image and data recorder, which provided valuable insight about the accident flight that helped investigators identify safety issues that would not have been otherwise detectable. Images captured by the recorder provided information about where the pilot’s attention was directed, his interaction with the helicopter controls and systems, and the status of cockpit instruments and system indicator lights, including those that provided information about the helicopter’s position, engine operation, and systems. Information provided by the onboard recorder provided critical information early in the investigation that enabled investigators to make conclusive determinations about what happened during the accident flight and to more precisely focus the safety investigation on the issues that need to be addressed to prevent future accidents. For example, the available images allowed the investigation to determine that the pilot caged the attitude indicator in flight. This discovery resulted in the development of important safety recommendations related to attitude indicator limitations. Although the recording device on board the accident helicopter was not required and was not a crash-protected system, the NTSB has a long history of recommending that the Federal Aviation Administration (FAA) require image recording devices on board certain aircraft. Some of these safety recommendations, which were either closed or superseded after the FAA indicated that it would not act upon them, date as far back as 1999. The NTSB notes that, had the FAA required all turbine-powered, nonexperimental, nonrestricted-category aircraft operated under Parts 91, 135, and 121 to be equipped with crash-protected image recording system by

NTSB Aircraft Accident Report ix January 1, 2007 (as the NTSB had recommended in 2003), 466 aircraft involved in accidents would have had image recording systems; in 55 of these accidents, the probable cause statements contained some element of uncertainty, such as an undetermined cause or factor. As a result of this investigation, the NTSB makes 3 safety recommendations to the FAA and 7 safety recommendations to the state of Alaska, 44 additional states, the Commonwealth of Puerto Rico, and the District of Columbia that conduct law enforcement public aircraft operations.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1 History of the Flight

On March 30, 2013, at 2320 Alaska daylight time, a Eurocopter AS350 B3 helicopter,1 N911AA, impacted terrain while maneuvering during a search and rescue (SAR) flight near Talkeetna, Alaska. The airline transport pilot, an Alaska state trooper serving as a flight observer for the pilot, and a stranded snowmobiler who had requested rescue were killed, and the helicopter was destroyed by impact and postcrash fire. The helicopter was registered to and operated by the Alaska Department of Public Safety (DPS) as a public aircraft operations2 flight under 14 Code of Federal Regulations (CFR) Part 91. Instrument meteorological conditions (IMC) prevailed in the area at the time of the accident. The flight originated at 2313 from a frozen pond near the snowmobiler’s rescue location and was destined for an off-airport location about 16 mi south. 1.1.1 Mission Coordination At 1935, the snowmobiler used his cell phone to call 911 to request rescue after his snowmobile became stuck in a ditch under the Intertie (a major power transmission line) between Larson Lake and Talkeetna. According to the MatCom3 dispatcher who handled the call, the snowmobiler reported that he bruised his ribs but was more concerned about developing hypothermia if not rescued soon. After receiving notification from MatCom, the trooper on duty at the Alaska State Troopers (AST) Talkeetna post tried to coordinate a ground rescue mission.4 The trooper found that no local Alaska Wildlife Troopers (AWT) units were on duty and that other local resources (residents with snowmobiles and SAR experience) did not want to participate because of the distance involved and the deteriorating weather, which included rain and poor snow conditions on the ground. After the trooper’s attempts to coordinate a ground rescue were unsuccessful, at 2009, he telephoned the AST on-duty SAR coordinator,5 and they agreed that it would be appropriate to use the Alaska DPS’s primary SAR helicopter to retrieve the snowmobiler.

1 Eurocopter is now known as Airbus Helicopters, a wholly owned subsidiary of the Airbus Group, which is headquartered in France. 2 The term “public aircraft” refers to a subset of government aircraft operations that, as such, are not subject to some of the regulatory requirements that apply to civil aircraft. Because public aircraft operators (like the Alaska DPS) are exempted from certain aviation safety regulations, government organizations conducting public aircraft operations supervise their own flight operations without oversight from the Federal Aviation Administration. 3 MatCom, a public safety dispatch center located in Wasilla, Alaska, is a division of the Wasilla Police Department. 4 The Alaska DPS has two major divisions, the AST and the Alaska Wildlife Troopers (AWT). The AST is charged with statewide law enforcement, prevention of crime, pursuit and apprehension of offenders, service of civil and criminal process, prisoner transport, central communications, and SAR. The AWT is charged with enforcing fish and game regulations; AWT troopers also enforce criminal laws and participate in SAR operations. 5 According to the Alaska DPS SAR protocol, the SAR coordinator handled all requests for the use of the accident helicopter. If the SAR coordinator approved, then the coordinator would notify the pilot, who would evaluate the weather and determine if the mission was acceptable.

NTSB Aircraft Accident Report 2 According to records from the pilot’s portable electronic device (PED),6 at 2019, he received an incoming call from the SAR coordinator. The SAR coordinator stated that he relayed details of the situation to the pilot, and the pilot said he would check the weather. The pilot’s spouse recalled that, immediately after the pilot received the call, he went upstairs to check the weather. The pilot called the SAR coordinator soon after and said he would accept the mission.7 The pilot’s spouse recalled that she asked her husband about the weather, and he said that it was “good.” The pilot then drove to Ted Stevens Anchorage International Airport (ANC), Anchorage, Alaska, where the helicopter was based. At 2051, the pilot called a fixed-base operator and asked for help towing the helicopter out of its hangar. Two line service technicians drove a tug across the airport to the hangar, arriving about 2100. They towed the helicopter out of the hangar and watched as the pilot performed a walk-around inspection, went through cockpit checks, and started the engine. They estimated that the helicopter’s rotors were turning about 10 or 15 minutes (min) after they disconnected the tug, and they watched the helicopter depart shortly thereafter. 1.1.2 Outbound Flight to Remote Rescue Location At 2117, the pilot radioed the MatCom dispatcher that he had departed ANC, and, at 2142, he reported to the dispatcher that he was landing at “Sunshine,” a landing zone near the AST Talkeetna post, to pick up the trooper/flight observer. At 2154, the pilot radioed the dispatcher that he had spotted the snowmobiler and would land nearby and walk to his location. GPS data8 showed that the helicopter departed Sunshine and proceeded north until it reached the Intertie. As shown in figure 1, the helicopter continued north along the Intertie for about 0.6 mi at an altitude of about 1,100 to 1,200 ft mean sea level (msl), made a right 360° turn over the Intertie, and landed immediately west of it on a frozen, snow-covered pond at 2156. The flight duration was about 11 min, and the landing site pond was about 16 mi north of Sunshine. The landing site elevation was about 460 ft above msl. Hand-written coordinates on the pilot’s kneeboard that was recovered from the wreckage indicate that the snowmobiler’s location was about 0.2 mi from the landing site.

6 Records recovered from the pilot’s PED, which was an Apple iPhone 4, included call and text message log information for the 3 days leading up to the accident and six photographs of the helicopter’s cockpit, which were dated July 18, 2012. 7 The pilot’s PED records did not show a second call with the SAR coordinator; however, it is possible that the pilot used his home phone. 8 The helicopter was equipped with a Garmin GPSMAP 296 portable GPS unit capable of storing flight route information. References in this report to the helicopter’s position (at specific times), altitude, and groundspeed are based on information retrieved from the unit’s nonvolatile memory.

NTSB Aircraft Accident Report 3

Figure 1. End of GPS flight track from Sunshine to landing site with flight track shown in orange. At 2159, the trooper radioed the dispatcher that they were walking to the snowmobiler’s location. At 2209, he asked the dispatcher, who had cell phone contact with the snowmobiler, to have the snowmobiler stand up so that he would be easier to spot in the deep snow, but the dispatcher advised that the snowmobiler was too weak to stand. At 2220, the pilot and the trooper reached the snowmobiler. The pilot and trooper did not report to the dispatcher how they assisted the snowmobiler or transported him to the helicopter. However, the snowmobile was later found parked on the frozen pond (not under the Intertie) near two parallel linear marks in the snow with dimensions that corresponded to the helicopter’s landing skids (see figure 2).

NTSB Aircraft Accident Report 4

Figure 2. Aerial photograph of helicopter landing site. (Red arrows point to marks consistent with helicopter’s landing skids. Green arrow points to the snowmobile.) 1.1.3 Accident Flight As shown in figure 3, GPS data for the accident flight (which lasted about 7 min) showed that the helicopter departed the frozen pond about 2313. It climbed to about 700 ft msl (about 250 ft above ground level [agl]) and accelerated to about 60 knots. The helicopter flew southwest and then southeast, circumnavigating a 1,000-ft msl hill at altitudes of 700-800 ft msl (about 150-200 ft agl, depending on terrain elevation), and then it slowed to about 20 knots as it approached the Intertie. About 2315, the helicopter turned right and headed south along the Intertie for about 30 seconds at altitudes of about 900-1,100 ft msl (about 200-300 ft agl) and a speed of 60 knots. Before the helicopter reached an area where the Intertie crossed over another 1,000-foot msl hill (which was one of several in a cluster of low-lying hills directly ahead of the helicopter’s flightpath), the helicopter turned right and deviated toward a slight gap in the hills at a speed of 70 knots. At 2316, the flight observer radioed the dispatcher that the helicopter was en route back to Sunshine, and he requested that an ambulance meet the flight to receive the hypothermic snowmobiler. No further radio communications were received from the flight.

NTSB Aircraft Accident Report 5 At 2317:14, the helicopter was flying about 1,000 ft msl over 900-ft terrain in the middle of the cluster of low-lying hills and had slowed to 23 knots.9 At 2317:31, the helicopter was about 1,100 ft msl and 44 knots. At 2317:49, the helicopter was at 1,060 msl (about 200 ft agl) and 16 knots. At 2317:59, the helicopter began to climb and turn left rapidly with little forward airspeed. According to images recovered from the helicopter’s onboard Appareo Systems Vision 1000 recorder (see section 1.5), at 2318:40, as the helicopter completed about a 360º turn, the pilot caged the attitude indicator.10 Caging an attitude indicator sets it to display a level flight attitude (0° pitch and 0° roll). This action is meant to be performed only when an aircraft is in a level flight attitude, such as on the ground or in straight-and-level, unaccelerated flight. After this, the helicopter entered a series of erratic turns, climbs, and descents. The GPS data for the accident flight ended at 2320:17, and the last position recorded placed the helicopter about 3 mi south of the takeoff point and 13 mi north of Sunshine.

Figure 3. GPS-derived flight track of the accident flight (shown in orange).

9 The presence of many tall trees in the area meant that obstacle clearance was much less than 100 ft. 10 The attitude indicator, also known as an artificial horizon, displays a visual representation of the helicopter’s pitch and roll relative to the Earth’s horizon.

NTSB Aircraft Accident Report 6 At 0039 on March 31, 2013 (about 1.5 hours after being notified to meet the helicopter), emergency medical services (EMS) personnel awaiting the helicopter’s arrival at Sunshine contacted a MatCom dispatcher to request the helicopter’s estimated time of arrival. The dispatcher’s attempts to locate the helicopter via radio and phone and by contacting personnel at Sunshine and the Talkeetna flight service station (FSS) were unsuccessful. The dispatcher had only limited information from Alaska DPS about the helicopter, and DPS personnel did not perform any flight tracking. (For more information about dispatch and DPS activities to locate the helicopter, see section 1.8.5.) No signals were received from the helicopter’s 406-MHz emergency locator transmitter (ELT). At 0217, the Alaska Air National Guard Rescue Coordination Center (RCC) advised that the National Guard helicopters could not fly for 3 hours (due to crew rest requirements, however, the weather was also adverse), and, at 0230, the decision was made to search for the helicopter using snowmobiles. About 0700, after the weather improved, a 210th Air National Guard Rescue Squadron Sikorsky HH-60 Pave Hawk helicopter departed from Anchorage to join the search. The wreckage was located by the National Guard helicopter crew about 0930 on March 31, 2013 (see figure 4). The accident site was about 200 ft north of the last recorded GPS position at an elevation of about 940 ft.

Figure 4. Aerial view of the accident site with helicopter wreckage circled in red.

NTSB Aircraft Accident Report 7 1.2 Personnel Information 1.2.1 Pilot The pilot, age 55, held a commercial pilot certificate with ratings for helicopters, single-engine and multiengine land airplanes, and single-engine sea airplanes, and he was instrument-rated for helicopters and airplanes. He also held a flight instructor certificate for helicopters and single-engine land airplanes and an airline transport pilot certificate with a rating for multiengine land airplanes. The pilot’s most recent Federal Aviation Administration (FAA) second-class medical certificate was dated August 23, 2012, with the limitation, “Must wear corrective lenses [and] possess glasses for near/intermediate vision.” The pilot also held an airframe and powerplant mechanic’s certificate. Based on available records,11 the pilot had accumulated about 10,693 total flight hours, of which about 8,452 hours were in helicopters. His logbooks showed a total of 247.1 hours simulated instrument time and 141.3 hours of actual instrument time, primarily in airplanes and all logged before 2001. The logbooks documented 38.3 hours of instrument flight in helicopters, of which 0.5 hour was actual instrument time. The most recent instrument helicopter flight was logged in 1986. 1.2.1.1 Training and Performance at Alaska DPS Alaska DPS hired the pilot in December 2000 to be the primary pilot for the accident helicopter. He had flown a total of 3,415 flight hours for Alaska DPS, which included 1,738 hours flown during SAR missions. He flew 242 hours in the year before the accident, of which 239 hours were in the accident helicopter. The pilot flew 23 hours in the 90 days before the accident, with 8 hours flown in the last 30 days. His most recent flight in the accident helicopter before the day of the accident took place on March 17, 2013. That flight was a SAR mission to retrieve an injured hiker. The pilot’s most recent Alaska DPS check flight took place on March 18, 2013. The check flight was conducted in a Robinson R-44 by an independent instructor and included a flight review in accordance with 14 CFR 61.56 and the special awareness training required by Special Federal Aviation Regulation (SFAR) 7312 to act as pilot-in-command (PIC) of a Robinson R-44. On November 20, 2012, the pilot completed an AS350 B3 pilot recurrent training course at the American Eurocopter training center in Grand Prairie, Texas. According to

11 Total flight times were derived from the pilot’s logbooks (which contained no recent entries) and DPS records. For more information about the pilot’s flight experience, see the Operations/Human Performance Factual Report contained in the public docket for this accident. 12 SFAR 73 imposes training requirements (in addition to those contained in Part 61) that are specific to the Robinson R-22 and R-44 model helicopters. The rule requires special awareness training covering energy management, mast bumping, low rotor rpm (blade stall), low G hazards, and rotor rpm decay.

NTSB Aircraft Accident Report 8 the training record, the pilot received a total of 1.5 hours of flight training, which included normal and emergency procedures. The training did not include any instrument flight.13 The pilot’s logbooks did not reference night vision goggle (NVG)14 flight time, and Alaska DPS did not maintain pilot NVG flight time records.15 Log sheets for the helicopter showed that the pilot flew 16.2, 13.2, and 2.2 hours using NVGs within the 6 months, 90 days, and 30 days before the accident, respectively. His most recent flight using NVGs was on March 15, 2013. The pilot’s performance evaluation report for 2009 listed as a goal for 2010, “attend a commercial initial NVG course to update his training in the NVG environment.” A quotation dated October 13, 2009, for an NVG course including 8 hours of ground school and 5 hours of flight training to be given by Aviation Specialties Unlimited of Boise, Idaho, was found in the pilot’s office. However, the pilot’s performance evaluation report for 2010 stated that “it was decided not to send [the pilot] to a commercial initial NVG course due to the cost of the course.” The pilot had previous military helicopter flying experience, and one of the Alaska DPS pilots who provided the pilot with his NVG training at DPS reported that the pilot had previous NVG experience in the military. Investigators could find no record that the pilot received formal NVG training in the military. According to the pilot’s Alaska DPS training records, he completed NVG training on December 18, 2003, and was authorized to use NVGs in accordance with “the department NVG and policy manual.” According to the records, the NVG training included 6 hours of ground school and 4.4 hours of flight training, which was provided by other Alaska DPS pilots. The records specify that during one of the NVG training flights, inadvertent IMC operations were performed and that, during another flight, blowing snow takeoffs were performed. There were no records found indicating that any subsequent recurrent NVG or instrument training in helicopters was provided. Alaska DPS provided the pilot with instrument flight training in a Cessna 208 airplane at a FlightSafety training center in 2001. In the “Weather Restrictions” section of the pilot’s Alaska DPS Flight Authorizations/Limitations form dated December 18, 2003, the box for “VFR [visual flight rules] Flight” was checked with no restrictions noted, and the box for “Night Flight” was checked with the restriction “[NVG] use w/ 500’ ceiling and 2 miles visibility.” This was the most recently completed copy of this form found in the pilot’s records.

13 None of the pilot’s previous training at American Eurocopter included instrument flight. He received training there in 2002, 2005, 2006, 2008, 2009, 2010, and 2011. 14 NVGs are used during night operations to provide a brighter visual scene, allowing the user to more easily see external references. NVG limitations include a reduced field of view, reduced image resolution, and the presence of digital noise. Also, low lighting conditions can result in lower contrast images that are more difficult to interpret and may cause a tendency to fly lower in an effort to maintain an acceptable image. The use of NVGs in low light conditions also requires high levels of gain, which worsens digital noise and can lead to “scintillation.” Further, the presence of meteorological obscurants, like rain and snow, has the potential to further degrade NVG image quality. 15 DPS required that the pilot maintain a record showing that he met the NVG operating experience required by 14 CFR 61.57. This requirement was satisfied by the pilot completing a form titled “State of Alaska Department of Public Safety NVG Operating Experience…on an AS350B3 (Astar).” Copies of completed forms dating back to December 7, 2010, were located in the pilot’s personnel file. The most recent form was dated March 15, 2013.

NTSB Aircraft Accident Report 9 Review of the pilot’s Alaska DPS personnel file revealed that he had received ratings of “outstanding” or “high acceptable” on his yearly performance evaluations since joining the agency.16 The pilot had been commended numerous times by state officials, including the governor. Most recently, in 2011, the pilot received an honorable mention for the Governor’s Denali Peak Performance Award in the category of Crisis Responder. Also, in 2008, the pilot and the on-duty SAR coordinator (who was a sergeant stationed in Girdwood, Alaska, at the time) received the Governor’s Denali Peak Performance Award in the category of Exceptional Performance Team and a Commendation for Meritorious Service for saving the life of a kayaker on July 29, 2007. According to the commendation, the kayaker became caught in a bore tide,17 and the pilot flew the helicopter steady close to the turbulent water’s surface while the sergeant leaned out of the helicopter and pulled the kayaker from the water. The pilot’s personnel file also contained numerous letters and e-mails of appreciation from people the pilot had rescued and their families. For example, one of three people who had become stranded on a gravel bar with two airplanes due to rising water sent an e-mail dated September 27, 2012, to the pilot’s supervisor that stated, in part, the following: I wanted to tell you thank you for rescuing us during the flooding.…Our situation was pretty grim. We were surrounded by rising waters with no way to get out… . Your pilot who was only asked to do a weather check pushed on through to get us out of that situation…. The weather wasn’t all that great when he flew in and got us back. 1.2.1.2 Work/Sleep/Wake History The pilot’s spouse said that the pilot was a morning person who woke every day at 0530 but sometimes went back to sleep until about 0800 on weekend mornings. He normally left for work between 0600 and 0615 Monday through Friday. He typically went to bed early in the evening (about 2100 on weeknights and 2130 on Friday and Saturday nights) so that he would be rested if called to fly a mission. He had no difficulty falling asleep at night. The pilot’s spouse said that the pilot had not recently experienced any significant negative life events, and she reported no recent changes in his daily habits. He normally ate breakfast at a fast food restaurant on the way to work, ate lunch at home about 1100, ate dinner at home between 1700 and 1800, and sometimes ate a late evening snack. He visited a gym for cardiovascular exercise and strength training 3 or 4 days a week, normally in the afternoon. Based on the pilot’s spouse’s recollections of his schedule and a review of his PED activity, the pilot’s estimated potential sleep time for the 3 nights before the accident is summarized in table 1.

16 The rating levels were unacceptable, low acceptable, mid acceptable, high acceptable, and outstanding. There was no performance evaluation report for the rating period January 16, 2008, to January 15, 2009, in the pilot’s personnel file. 17 A bore tide is a wave or series of waves formed by a rush of seawater as the incoming tide from a wide bay is funneled into a shallow and narrowing inlet.

NTSB Aircraft Accident Report 10 Table 1. Pilot’s estimated potential sleep. Date Went to Bed Awoke Potential Sleep March 27-28 2100 0530 8.5 hours March 28-29 2100 0530 8.5 hours March 29-30 2200 0800 to 0900 10 to 11 hours 1.2.1.3 Previous Accident The pilot was involved in a previous accident in the helicopter on April 21, 2006. According to the National Transportation Safety Board (NTSB) report for the accident, the pilot stated that, just after takeoff, as the helicopter transitioned from a hover to forward flight, blowing snow from the helicopter’s main rotor momentarily reduced his visibility, and he lost all visual reference with the surface. He elected to abort the takeoff while he was attempting to regain a visual reference, and the helicopter’s tail rotor guard and vertical stabilizer struck the surface of the lake. The NTSB determined that the probable cause of the accident was “the pilot’s failure to maintain adequate altitude/clearance from terrain during an aborted takeoff in whiteout conditions, which resulted in an in-flight collision with terrain. A factor associated with the accident was whiteout conditions.”18 As a result of the accident, the FAA requested that the pilot undergo a commercial pilot reexamination given by an FAA inspector in accordance with 49 United States Code 44709(a). The pilot successfully completed the reexamination on May 15, 2006, in a Robinson R-44 helicopter. There were no records of any other certificate actions in the pilot’s FAA records. Also as a result of the accident, DPS required the pilot to undergo training on takeoffs in blowing snow conditions with one of the department’s senior pilots. Alaska DPS conducted an internal investigation of the accident and other events19 involving the pilot. (For more information, see section 1.8.3.1.) 1.2.1.4 Schedule and Compensation The pilot’s work schedule was Monday through Friday, 0700 to 1530, with an hour lunch break from 1200 to 1300. According to his wife and colleagues, he was always on call except when he took leave for a special family occasion or to use a few days of leave that he would otherwise have to forfeit.20 An examination of the pilot’s time sheet for the period of March 16-31, 2013, indicated that he was on “standby” every day during that period. According to the pilot’s wife and colleagues, the pilot sometimes went off call temporarily when he exceeded flight or duty time limits and needed to rest.

18 The NTSB report for this accident, ANC06TA047, can be accessed from the NTSB web site at www.ntsb.gov. 19 The events, each of which did not meet the criteria to be classified as an accident, were not investigated by the NTSB or the FAA. 20 The pilot was required to use a minimum of 5 days of vacation time or forfeit it at the end of the year.

NTSB Aircraft Accident Report 11 The pilot’s last day off was Saturday, March 9, 2013, and his last extended time off was a week-long family vacation in January 2013. Alaska DPS records indicated that, before the accident, the pilot had not done any flying since he completed a flight review on March 18, 2013, and had not worked outside of his normal office hours since Sunday, March 17, 2013. The pilot was paid for his work on an hourly basis and was expected to work at least 40 hours per week. He received additional compensation (premium pay) for additional hours worked (overtime), for working in the evenings or at night (swing shift or graveyard shift pay differentials), for working on a holiday, and for being on call outside of normal work hours (standby pay). DPS records indicated that, for calendar year 2012, about 37% of the pilot’s total earnings consisted of premium pay. 1.2.1.5 Colleagues’ and Others’ Perceptions 1.2.1.5.1 Proficiency The aircraft section commander, who was a nonhelicopter-rated pilot and had flown with the pilot, said that the pilot had a “high level of proficiency” and was “always very professional.” He characterized him as a “by the book” pilot. The relief pilot for the accident helicopter, who had flown with the pilot numerous times (most recently in November 2012), said that the pilot was the “best helicopter pilot” he had ever flown with. He described the pilot as “a sound professional.” An Alaska Mountain Rescue Group (AMRG) observer who often flew with the pilot described him as an excellent pilot who he “completely trusted.” (The Alaska DPS’s use of flight observers is further described in section 1.8.4). The former relief pilot, who had provided the pilot with his NVG training in 2003 and had most recently flown with the pilot in December 2010, rated the pilot’s skill level as “average.” 1.2.1.5.2 Attitude Regarding Weather Risks The aircraft section commander said that he knew the pilot was aware of weather-related safety issues because when he talked with the pilot about his SAR missions, the pilot always discussed the conditions he encountered and how he compensated for them. He said that the pilot did not display hazardous attitudes and that he did not consider him to be a “risk-taker.” He recalled a discussion he had with the pilot about the risks involved in some of the SAR missions the pilot conducted, including flying in bad weather and at night, and he said that the pilot told him, “I told them when I took this job that I would do this, and that’s what I am going to do.” The aircraft section commander expressed the opinion that the pilot knew what the risks were and felt a self-imposed obligation to conduct SAR missions in difficult conditions. The relief pilot had received helicopter flight instruction from the pilot and had flown missions with him. The relief pilot said that the pilot was “extremely safe” and that for “everything [the pilot] did, he had a backup plan.” The relief pilot recalled that, on one occasion, he expressed concern to the pilot about the weather conditions for a particular mission, and the

NTSB Aircraft Accident Report 12 pilot had encouraged him to decline it. He recalled that the pilot had repeatedly told him not to “fight” or “push” the weather. The AMRG observer said that the pilot did not take risks flying in bad weather and that he had been on missions with the pilot numerous times where they had to turn around because the weather was too bad to continue. He said that, after the pilot’s 2006 accident, the pilot was “extra careful” because he wanted to avoid another accident or incident. The pilot had previously briefed him that, if they ever encountered zero-visibility conditions, he would climb and transition to instrument flight rules (IFR) flight while the observer monitored the cockpit display for terrain conflicts. The pilot told the observer he would then continue the flight under IFR until they reached the nearest airport or exited the bad weather. The observer told investigators the pilot had never been forced to execute this plan during the 300-plus missions they had conducted together because, aside from momentary whiteouts during takeoff or landing, they had never encountered zero-visibility conditions in flight. The recently retired aircraft section supervisor, who was a nonhelicopter-rated pilot and left the Alaska DPS about 3 weeks before the accident, characterized the pilot as a “very careful pilot.” She said that although she had never flown with the pilot, she knew this because she had seen him in the office checking the weather before accepting a mission, and she had also received notifications that the helicopter had been assigned to a SAR mission but was on hold because of poor weather conditions such as low ceilings or freezing rain. 1.2.1.5.3 Pilot’s Motivational Factors The pilot’s spouse stated that the pilot enjoyed flying the helicopter and was highly motivated about flying-related tasks. She said that he was very close to his family and found it rewarding to rescue people and bring them back safely to their families. Describing the September 2012 mission that the pilot performed to rescue three people from two airplanes that had become stranded on a gravel bar by rising water,21 the aircraft section commander stated that a 210th Air National Guard Rescue Squadron crew attempted to reach the location in a Sikorsky HH-60 Pave Hawk helicopter but had to turn back when they were unable to cross a mountain pass due to poor weather conditions. The pilot stayed up all night and continued to check the weather until he saw a “weather window on the radar” that he thought would allow him to reach the location. About 0300, the pilot launched, and, by using a different route that avoided the mountain pass where the Air National Guard crew was forced to turn back, he reached the location and rescued the three people. The aircraft section commander said that this mission demonstrated how “motivated and driven” the pilot was to perform rescues. 1.2.1.5.4 Attitude Regarding Overtime The recently retired aircraft section supervisor said that the pilot considered overtime “an expected part of his job.” Also, the aircraft section commander said that it was difficult to get the pilot to take time off. He said that any time he talked to the pilot about adjusting his schedule or bringing in another pilot to share the standby duty, the pilot would complain that this was going to take away from his overtime pay.

21 One of the individuals who was rescued wrote an e-mail commending the pilot.

NTSB Aircraft Accident Report 13 The major who was the AWT deputy director said that he had recently become aware of the number of days the pilot was on standby and that his concern about this prompted him to discuss it with the aircraft section commander. He said that if a pilot were paid a salary rather than hourly pay, this might be beneficial because it would remove the incentive to work more hours to make more money. The relief pilot said that the pilot wanted to be on standby because he wanted the overtime. The relief pilot said that he had offered to cover for the pilot if he needed a break and that he had done so when the pilot wanted time off, such as when he went on vacation or got sick. He said that the pilot had expressed to him that he was afraid that he would be replaced if other pilots were allowed to fly more of the helicopter’s missions. The relief pilot recalled that, on Thursday, March 28, the pilot had visited him at Alaska DPS headquarters between 0700 and 1200. During the conversation, he discussed a proposed change with the pilot regarding the pilot scheduling for the helicopter. The AWT deputy director had proposed that the relief pilot serve as the primary pilot for the helicopter 2 days a week. The AWT deputy director said that he made this decision when he realized that the pilot was continuously on call. The purpose of the change was to allow the pilot to have some time off duty each week. The relief pilot said that the pilot was upset about this scheduling change. 1.2.2 Flight Observer The trooper who served as a flight observer held a commercial pilot certificate with ratings for single-engine land, multiengine land, single-engine sea, and instrument airplanes. He was issued an FAA second-class medical certificate on August 20, 2012, with no limitations. He owned a Piper PA-18 Super Cub airplane, which he flew on his days off. According to the flight observer’s spouse, the flight observer had previously accompanied the pilot on several missions and enjoyed flying with him. According to the pilot’s mission records, the flight observer most recently accompanied him on a March 15, 2013, SAR mission. The flight observer received no Alaska DPS training for using NVGs or assisting with helicopter flight tasks, such as operating some of the helicopter’s navigational equipment. 1.3 Helicopter Information The accident helicopter, pictured in figure 5, was a Eurocopter AS350 B3 model powered by a single Turbomeca Arriel 2B turboshaft engine with a single three-bladed main rotor system using a conventional two-bladed tail rotor for antitorque and heading control. The helicopter had four large doors, two located on either side of the helicopter, for access to the cockpit and passenger seating area. For the SAR mission, the left seat controls had been removed, and the

NTSB Aircraft Accident Report 14 seating capacity was for a pilot and six passengers. The helicopter was not certified for IFR flight operations.22

Figure 5. Preaccident photograph of the helicopter. The helicopter was equipped with a Garmin GNS 430 GPS mounted in the center of the instrument panel; a Garmin GPSMAP 296, which was mounted on the lower right side of the instrument panel; an Avalex Technologies™ mapping flight display system that had various map display capabilities; and a forward-looking infrared (FLIR) system.23 The Garmin 430 unit could be connected to the horizontal situation indicator (HSI) such that the course deviation indicator (CDI) could be used for additional course guidance. The Garmin 296 unit was capable of showing color-coded terrain elevation information and terrain alerts if selected by the pilot. The helicopter had an AIM 1200 attitude indicator that was limited to indicating ± 25° of pitch (that

22 None of the Alaska DPS helicopters were IFR-certified. Helicopters that are certified for IFR operations are typically more stable than VFR-only helicopters because the certification requirements are often met through the use of stabilization and/or automatic flight control systems. According to chapter 10-1-1 in the FAA Aeronautical Information Manual, the systems typically fall into categories that include aerodynamic surfaces that impart some capability or control capability not found in the basic VFR configuration, stability augmentation systems, attitude retention systems, and/or autopilot systems, among others. 23 The FLIR system was not operational at the time of the accident. The external components had been removed.

NTSB Aircraft Accident Report 15 is, if the helicopter’s pitch exceeded the limitation, the pitch indicator would stop at the limit and remain there until the helicopter’s pitch no longer exceeded the limit).24 Modifications included high skid landing gear; inflatable skid floats; snow shoes; a 406-MHz ELT; an Appareo Systems Vision 1000 cockpit image, audio, and data recorder;25 and a lighting system that was compatible with the flight crew’s use of NVGs. The helicopter also carried survival equipment and rescue gear. Aircraft section personnel estimated the weight of this equipment at 275 lbs. The AMRG volunteer who frequently flew with the pilot said that the survival equipment included two sleeping bags, a tent, a trauma kit, food, a satellite phone, a personal locator beacon, and snowshoes. 1.3.1 Maintenance Alaska DPS had operated and maintained the helicopter for about 10 years since acquiring it new. A review of the helicopter logbooks revealed that, at the time of the departure from ANC, the helicopter had accumulated 2,518.8 hours and 5,179 landings, and the engine had accumulated 2,476.7 hours. The last inspection that was performed on the helicopter was a 150-hour inspection on March 17, 2013, and the helicopter had accumulated 2,518.8 hours at that time. A certified repair station mechanic at the AST hangar performed the inspection. The helicopter was approved for return-to-service and released for flight. The last 100-hour inspection was performed on October 1, 2012, by the same mechanic who performed the last 150-hour inspection, and the helicopter had accumulated 2,466.4 flight hours at that time. A review of the helicopter logbook for the last 30 days revealed that all maintenance write-ups had been cleared; there were no open or deferred items. All maintenance was listed as accomplished in accordance with Eurocopter’s maintenance procedures, and the helicopter was returned to service. Witnesses reported that the pilot kept the turn-and-bank indicator disabled by pulling its circuit breaker. No one was certain of the pilot’s reason for doing this. The AMRG observer said that the turn-and-bank indicator worked but that there was “a problem with it.” Another of the pilot’s colleagues thought that the pilot disabled the instrument when it was not needed to extend its life by reducing wear. The most recent maintenance record related to the turn-and-bank

24 The operating manual for the AIM 1200 did not include information about its pitch and bank indicating range limits. The manufacturer provided this information during the investigation. The AIM 1200 attitude indicator’s pitch indication range met the requirements of the FAA’s technical standard order (TSO) for bank and pitch instruments, TSO-C4c. TSO-C4c states that bank and pitch instruments manufactured for installation on civil aircraft after April 1, 1959, shall meet the standards set forth in the Society of Automotive Engineers’ Aeronautical Standard AS-396B, dated July 15, 1958. AS-396B states, under the heading “Indicating Range,” that “the range of indication in pitch shall be at least plus or minus 25 degrees. The range of indication in bank shall be at least plus or minus 100 degrees.” Under the heading “Operating Range,” AS-396B states that “the instrument shall be operable following maneuvers of 360 degrees in bank and 360 degrees in pitch.” 25 The recorder installation was accomplished as a modification under an FAA supplemental type certificate. Airbus, which is the current type certificate holder for the AS350 models, equips all new AS350 helicopters with Appareo units.

NTSB Aircraft Accident Report 16 indicator was from 2004. The record stated, “T&B makes noise in headset. Removed T&B to facilitate testing, not able to duplicate problem. Note: T&B is powered from avionics [bus].” The helicopter was signed off and returned to service on November 3, 2004, and no other records or maintenance write-ups regarding the turn-and-bank indicator were found. A review of the maintenance records revealed incident and inspection findings that included an April 21, 2006, hard-landing accident; a May 13, 2009, main rotor overspeed26 event; a March 23, 2011, tail rotor pitch change link replacement (due to a suspected crack); and an April 15, 2011, overtorque27 event. 1.3.2 Pilot’s Concerns about Maintenance A friend of the pilot, who worked for the aviation section as a mechanic from 1988 to 2009, said that during a conversation with the pilot on March 22, 2013, the pilot said that he was “disgusted” with the quality of the maintenance being done on the helicopter. In particular, the pilot expressed his concern that some hoses had not been replaced within the specified time. Another friend of the pilot, who worked for the aviation section as a mechanic from 2004 to 2007, said that the pilot “didn’t have any confidence in the department as far as their ability to properly maintain the helicopter.” According to some of the pilot’s colleagues, the pilot did not have a very good relationship with the helicopter’s lead mechanic and often disagreed with the mechanic about how the maintenance should be performed and how long it should take. The lead mechanic for the helicopter said that the pilot disliked not being in charge of the helicopter’s maintenance. The mechanic said that he and the pilot did not get along well for several years, but the relationship recently improved. He attributed the improvement, in part, to a complaint that he made to the FAA about the pilot. (The complaint, discussed in section 1.8.3.3, resulted in Alaska DPS disciplinary action against the pilot.) He also attributed the improvement to an agreement in which the pilot was allowed to be responsible for the maintenance recordkeeping for the helicopter. 1.4 Meteorological Information There is no record of the pilot obtaining a weather briefing by calling FSS or accessing the direct user access terminal service.28 It is unknown what weather information sources the pilot may have accessed before deciding to accept the mission. A former Alaska DPS relief pilot said that the most relevant weather information for the search area that he would have checked were the area forecast (FA) for Cook Inlet and Susitna Valley and the meteorological aerodrome

26 Overspeed is a condition in which an engine or rotor system operates at a speed (rpm) greater than the maximum allowable. 27 Overtorque is a condition in which an engine produces more torque (power) than the maximum allowable. 28 According to chapter 7-1-4 of the Aeronautical Information Manual, an FSS is the primary source for obtaining preflight briefings and inflight weather information. Flight service specialists are authorized to translate and interpret available forecasts and reports directly into terms describing the weather conditions expected along a pilot’s flight route and destination. These include, but are not limited to, reported weather conditions summarized from all available sources (such as meteorological aerodrome reports [METAR], special METARs, and pilot reports), the en route forecast for the proposed route, and the destination forecast for the estimated time of arrival.

NTSB Aircraft Accident Report 17 reports (METARs) and terminal aerodrome forecast (TAF) for the Talkeetna Airport (TKA) and ANC (the departure airport). TKA was located 5 nautical mi west of the search area (and about 4 mi west of the accident site) at an airport elevation of 358 ft. The current and former relief pilots for the accident helicopter both said that they typically obtained weather information from the National Weather Service (NWS) Alaska Aviation Weather Unit (AAWU) website29 and followed up with a call to FSS to speak to a briefer only if they had a concern about the weather. The current relief pilot said that the accident pilot also used the AAWU website. The AAWU website displays links to various weather information products for pilots, including FAs, METARs, and TAFs. Its default homepage displays a map of Alaska with any AIRMET30 advisory areas highlighted in yellow and SIGMET31 advisory areas highlighted in red. Hovering the cursor over these highlighted areas produces a popup window displaying the text of an advisory. 1.4.1 Weather Information Available Before Departure At the time that the pilot received the call about the mission (at 2019), the TAF for TKA issued at 2008 (valid for the 20-hour period beginning at 2000) forecasted a calm wind, visibility greater than 6 mi, light rain, a broken ceiling at 1,000 ft agl, broken clouds at 1,800 ft agl, and overcast skies at 2,800 ft agl. The FA issued at 1745 forecasted scattered clouds at 2,000 ft, scattered to broken clouds at 6,000 ft, broken to scattered clouds at 12,000 ft, and cloud tops to flight level 180.32 A widely scattered area of broken ceilings at 2,000 ft with light rain showers was forecast. The forecast included isolated light rain and snow showers with visibility down to 4 mi at times. The FA contained no forecasted turbulence, icing, or IFR conditions, and there were no AIRMETs for IFR conditions.33 The NWS Office in Anchorage, Alaska, issued the updated Zone Forecast Product at

1. The information about the search area and accident area had not been updated since 1600,

and it forecasted cloudy skies with scattered snow showers. Rain was forecasted to mix with snow during the evening hours with light winds. The observed weather conditions at TKA reported in the 1953 METAR were wind calm, 10 mi visibility, light rain, a broken ceiling at 1,000 ft agl, broken clouds at 1,800 ft agl, overcast skies at 2,800 ft agl, temperature of 2° C, dew point temperature of 1° C, and an altimeter setting of 30.20 in of mercury (in Hg).

29 The AAWU website can be accessed at http://aawu.arh.noaa.gov. 30 An AIRMET is an advisory that includes significant weather phenomena that contain details about IFR, extensive mountain obscuration, turbulence, strong surface winds, icing, and freezing levels. AIRMETs describe conditions at intensities lower than those that require the issuance of a SIGMET. 31 A SIGMET is an advisory that advises of nonconvective weather that is potentially hazardous to all aircraft. These phenomena include severe icing not associated with thunderstorms, severe or extreme clear air turbulence not associated with thunderstorms, dust storms or sand storms lowering surface visibilities to below 3 mi, volcanic ash, and, in Alaska and Hawaii, tornadoes, lines of thunderstorms, embedded thunderstorms, and hail greater than or equal to 3/4-in diameter. 32 A flight level is a standard nominal altitude of an aircraft, in hundreds of feet. This altitude is calculated from the international standard pressure datum of 29.92 in of mercury, the average sea-level pressure. 33 The criteria for IFR conditions are a ceiling below 1,000 ft agl and/or less than 3 mi visibility.

NTSB Aircraft Accident Report 18 A review of weather radar imagery available at the time that the pilot received the call about the mission showed scattered showers around the Palmer Municipal Airport (PAQ) in Palmer, Alaska (PAQ is located 50 mi south-southeast of the accident site at an elevation of 242 ft), and the Wasilla Airport in Wasilla, Alaska. The imagery depicted these showers as moving northward (toward TKA). 1.4.2 Weather and Lighting Conditions at Accident Site and Time The accident occurred at 2320. Observed weather conditions at TKA reported in the 2253 METAR were wind calm, 6 mi visibility, light rain and mist, few clouds at 500 ft agl, a broken ceiling at 1,500 ft agl, overcast skies at 2,400 ft agl, temperature of 1° C, dew point temperature of 1° C, and an altimeter setting of 30.22 in Hg. The observed weather conditions at TKA reported in the 2312 METAR were wind calm, 7 mi visibility, light snow, a broken ceiling at 900 ft agl, broken skies at 1,300 ft agl, overcast skies at 2,400 ft agl, temperature of 1° C, dew point temperature of 1° C, and an altimeter setting of 30.22 in Hg. The remarks stated that unknown precipitation began at 2310 and ended at 2312 and that snow began at 2312. The NWS Surface Analysis Chart for 0100 on March 31, 2013, depicted a stationary front north of the Alaska Range that stretched west to east into northwest Canada. The station models around the accident site depicted temperature-dew point spreads of 4° F or less, light and variable winds, cloudy skies, and light snow. A review of weather radar imagery showed a line of echoes extending from PAQ to TKA around the time of the accident. The imagery depicted this line of showers as moving northward from PAQ (which had earlier surface reports of precipitation) through TKA and the accident site around the time of the accident. A witness, who regularly makes “go/no-go” decisions for SAR operations for the National Park Service, was located 3 mi west of the accident site. He reported that the clouds began lowering around 2020, with light rain mixed with sleet at times, and about 10 mi visibility. He was located inside until 2300, when he walked to his vehicle and noticed that it was raining with a temperature of 34° F reported on his vehicle. This witness began driving home in the rain when it began to snow so heavily that he had to turn off his bright lights so that he could see. He continued to drive and arrived at his home, located about 5 mi southwest of the accident site, about 2315, and the heavy snow continued. Two witnesses 10 mi southwest of Larson Lake reported a mix of rain and sleet with the temperature around freezing when the accident helicopter flew overhead around 2130. One of those witnesses reported a changeover to snow between 2130 and 2300 with the snow coming down like a “son of a gun.” This witness reported 4 in of new snow at 1,700 ft the next morning. A witness 2 mi northeast of Larson Lake reported light freezing drizzle and rain around 2200 with 1 in of fresh “crusted up” snow around their property the next morning. Sunset was at 2043, the end of civil twilight was at 2130, and moonrise occurred the following morning at 0104. According to the FAA, night VFR lighting conditions can be classified as “high level” or “low level.” Low-level lighting conditions are present when clouds cover at least 5/8 of the sky, the moon is below the horizon, or the moon is less than 50% illuminated, and little significant cultural or reflected cultural lighting is present.

NTSB Aircraft Accident Report 19 The TAF for TKA issued at 2137 (valid for the 24-hour period beginning at 2200) forecasted a calm wind, visibility greater than 6 mi, a broken ceiling at 900 ft agl, broken clouds at 4,500 ft agl, and overcast skies at 6,000 ft agl. These forecasted IFR conditions were not referenced in an AIRMET or an updated FA. (Typically, TAFs and FAs are consistent with each other with regard to references to IFR conditions. During other accident investigations, the NTSB noticed inconsistencies among other weather information products and issued safety recommendations to address these issues. These recommendations are discussed in section 1.9.3.) 1.5 Cockpit Image, Audio, and Data Recorder The helicopter’s Appareo Systems Vision 1000 cockpit imaging and flight data monitoring device was mounted on the cockpit ceiling. The self-contained unit is designed to record cockpit images and two-track audio, and it has a GPS receiver for satellite-based time, position, altitude, and groundspeed information. It also has a self-contained real-time inertial measuring unit that provides three-axis accelerations as well as aircraft pitch, roll, and yaw data.34 The unit recovered from the accident helicopter showed damage on the exterior case and power connector (see figure 6). The removable memory card was undamaged, and its data were downloaded. Recovered data included about 2 hours of image and audio data and about 100 hours of parametric data. Review of the data revealed that no external audio source (such as the helicopter’s intercom or radios) was connected to audio track “one” for recording (which is an optional audio link referred to by Appareo as the “ICS,” or “Intercom System”). Audio track “two” recorded sound from the unit’s internal microphone, which captured only loud helicopter engine/transmission sounds and no intelligible voices. Review of the data also revealed that the unit’s internal attitude data were subject to inaccuracies.35 The recorded images captured a view of the cockpit from behind the pilot looking forward. Some navigation and system instruments and displays, the helicopter’s master caution warning panel, a partial view out the cockpit windscreen, and some of the pilot’s left arm and head motions (the pilot was seated in the right seat) were visible at times.

34 The helicopter was not required to be equipped with a cockpit voice recorder or flight data recorder. The optional device was not required to comply with TSO C197, “Information Collection and Monitoring Systems.” 35 The investigation found that the unit was not properly configured when it was installed. The Appareo Systems Vision 1000 installation instructions (revision dated October 22, 2010) did not contain instructions for configuring the unit; configuration instructions were contained in a separate publication. Appareo has since issued revised installation instructions (dated October 29, 2013) that contain a section dedicated to configuring the unit.

NTSB Aircraft Accident Report 20

Figure 6. Appareo Vision 1000 unit from the accident helicopter. Images from the flight from ANC to the remote rescue location (via the Sunshine site) showed that, before departure from ANC, the pilot adjusted the Avalex display brightness down, changed the type of map it displayed from a street map to a topographic map, and changed the map orientation from “north up” to “track up.” The imagery showed that the helicopter’s turn-and-bank indicator was not operating during the outbound flight from ANC or during the accident flight. During the flight from ANC to the Sunshine site, the pilot raised, lowered, and adjusted his NVGs several times. He lowered them before landing and used them during landing at the Sunshine site. The pilot did not shut down the helicopter while at the Sunshine site. The flight observer, who did not use NVGs, boarded and sat in the left seat, and the flight departed. The pilot used the NVGs during liftoff from the Sunshine site and during landing at the remote rescue location.

NTSB Aircraft Accident Report 21 Images for the accident flight showed that, before takeoff from the frozen pond, the pilot turned on the “lip light”36 attached to his helmet and kept it on during the entire flight. The light cast an area of illumination about 1 ft in diameter that moved when the pilot moved his head. The light at times illuminated parts of the helicopter’s instrument panel and flight controls. The pilot also made inputs to the Garmin 296 unit, which displayed a track-up map and a magenta course line that extended to the southwest, consistent with a direct route to Sunshine. The Avalex display powered up and displayed a north-up street map. As the helicopter lifted off from the frozen pond, no blowing snow was visible and, once the helicopter left the ground, no outside lights or ground references were seen by the Appareo unit for the remainder of the flight. The helicopter’s master caution warning panel and engine instruments (including the first limit indicator [FLI], which displays engine power information) are visible at times. No warning or caution lights from the helicopter’s master caution warning panel and no abnormal engine instrument readings appear. Table 2 summarizes some of the navigational instrument readings and other information obtained from reviewing the imagery from the accident flight. Some pitch indications on the attitude indicator are approximate. Pitch indications higher than about 17° could not be accurately measured due to a combination of low image resolution, the dark night condition, shadows, and the construction of the instrument. Table 2. Summary of select information from Appareo images. Time Altimeter (barometric) Airspeed indicator Comments 2310:19

Start of engine 2310:44

Avalex display is powering up 2310:54

Garmin entry screen is acknowledged 2310:57

Pilot selecting entry on Garmin 296 2312:11

Garmin 296 display changes to track heading screen 2312:45

Avalex display unit comes up in street map mode - north up orientation 2312:47 400 ft 0 kts Attitude indicator shows 0° pitch, 0° roll, aircraft level line set at 0° pitch, vertical speed is 0 ft per min (fpm), turn indicator is at zero (where it remains for the entire flight) 2313:00

Helicopter is lifting off surface, no blowing snow, only light is from red position light, once aircraft leaves ground, no outside lights or ground references are seen during remainder of flight 2313:08

Garmin 296 display is showing a magenta course line about 30° to the right of the helicopter’s heading of 180° 2313:16

Pilot with NVG in down position

36 The pilot’s lip light consisted of a row of several LED bulbs embedded in plastic and attached to the pilot’s boom microphone with a button on the back of the unit that the pilot could toggle on or off with his mouth. According to other DPS helicopter pilots, the lip light helps a pilot see cockpit instrumentation and controls. When using NVGs, the pilot could look through the NVG binoculars to see outside and could look below them to view the cockpit instruments.

NTSB Aircraft Accident Report 22 Time Altimeter (barometric) Airspeed indicator Comments 2314:40

Helicopter starts left turn off of GPS track, 500 fpm climb, 20° left roll, 300 ft radio altimeter 2315:17 800 ft 20 kts 7° right roll, 150 ft radio altimeter 2317:23 1,050 ft 40 kts Level attitude, 300 fpm climb, 200 ft radio altimeter, on Garmin 296 course 2317:29

Two fingers from left seat observer are seen in front of Avalex screen (no buttons were pushed), 2.5° left roll, 0° pitch 2317:56

0° roll, 0° pitch, 15 knots indicated airspeed, 950 fpm climb, 450 ft radio altimeter, 9.5 FLI, 1,250 ft altimeter, Garmin 296 course line not visible 2318:02

10 kts 2.5° left roll, 5° up pitch, 1,400 ft altimeter, 1,000 fpm climb, 600-700 ft radio altimeter, 9.1 FLI

2318:07 1,410 ft 0 kts Pilot’s left hand is visible adjusting CDI indicator, nav red flag is visible, 1,100 fpm climb, 2.5° right roll, 5° up pitch 2318:12 1,510 ft 0 kts 0° roll, 7.5° up pitch, 1,200 fpm climb, 550 ft radio altimeter, 10 FLI, T4 (turbine outlet/exhaust gas temperature) yellow underline, torque underline in yellow 2318:17 1,620 ft 0 kts 7.5° right roll, 10° up pitch, 900 ft radio altimeter, 1,200 fpm climb, 10 FLI, T4 yellow underline, torque underline in yellow 2318:20 1,700 ft 0 kts 5° right roll, 12.5° up pitch, 1,000 fpm climb, 10 FLI, 900 ft radio altimeter, Garmin 296 course line back in view 2318:21

0 kts 5° right roll, 12.5° up pitch, 900 fpm climb, 7.8 FLI 2318:24

Left seat observer pointing at Avalex display, 15° right roll, 12.5° up pitch 2318:27

1. 5° right roll, 17.5° up pitch

2318:28

Pitch exceeds 17.5° from this time until 2318:40. 2318:40

0 kts Pilot cages the attitude indicator, 0° pitch, 0° roll, 800 fpm climb, 9 FLI 2318:43 1,800 ft

0° pitch, 20° left roll, 0 fpm vertical speed, 9.5 FLI 2319:06 1,790 ft 0 kts 85° right roll, 0° pitch, 500 fpm climb, 8 FLI, 2319:33 1,550 ft 0 kts 0° pitch, 30° right roll, 800 ft radio altimeter, 200 fpm descent, 7 FLI 2319:35 1,500 ft 0 kts 85° right roll, 0 fpm vertical speed, 7.5 FLI 2319:43

Attitude indicator tumbled 2319:48 1,500 ft 0 kts 30° left roll, 10° up pitch, 7 FLI, 0 fpm vertical speed, 600 ft radio altimeter 2319:48 1,500 ft 0 kts 30° right roll, 10° up pitch, 0 fpm vertical speed, 500 ft radio altimeter, 7.3 FLI, no warning/caution lights 2320:02

End of recording

NTSB Aircraft Accident Report 23 1.6 Wreckage and Impact Information The helicopter was found on snow-covered, wooded terrain (see figure 7). The helicopter was destroyed by impact forces and postcrash fire, and the ELT showed impact and fire damage. The initial ground impact site was about 3 ft before the beginning of the wreckage debris field, and the debris path measured about 75 ft long on a magnetic heading of 029°, which was also the flightpath direction (in-line with the tree damage). A tree near the initial impact site exhibited strikes with about a 60° angle (relative to the horizon and along the flightpath direction). The tree branch ends were smooth and even. The entire helicopter was accounted for at the crash site. The helicopter came to rest inverted with the landing gear and tailboom forward of the main debris area. Fragments outside the main debris crater were not fire damaged and had no soot streaks. The center section of the fuselage was largely missing, with the main transmission case predominately consumed by fire. The main transmission gears showed evidence of postcrash fire and did not exhibit missing gear teeth, galled areas, or other evidence of mechanical malfunction.

Figure 7. Accident site showing main wreckage.

NTSB Aircraft Accident Report 24 Fragments of the cyclic, collective, and yaw controls were found loose in the debris. Continuity could not be established due to the breaks in the system and missing portions of the push-pull tubes; however, some breaks were matched and examined for evidence of malfunction or failure. None was found. The breaks were examined and exhibited characteristics consistent with overload fractures and melting. The damage to the flight control system was consistent with ground impact and exposure to postimpact fire. The red, yellow, and blue main rotor blade hub ends remained attached to the hub. The main rotor blades were broken, mostly thermally consumed, and the spars were bent and twisted. The tailboom was separated from the fuselage near the forward bulkhead, and the tail rotor driveshaft was fractured at the junction of the tailboom and fuselage. Tail rotor control and drive continuity were established from the tailboom separation at the fuselage to the flange of the tail rotor gearbox drive coupling. The engine was found upside down covered by the engine deck and in the proper orientation to the tailboom (also upside down). The rear engine mount was broken away from the engine, and the front engine mount was still connected to the coupling tube. The transmission shaft was inside the coupling tube, and the engine side flexible coupling group was relatively undamaged with the transmission side showing rotation and tension splaying. The tail rotor drive flexible coupling displayed rotational splaying. The freewheel shaft functionality was verified to be correct. The reduction gearbox was removed in the field for inspection of the input pinion slippage mark. The slippage mark was offset in the torqueing (tightening direction) about 0.10 in, which is consistent with significant power at the time the main rotor system struck the ground and stopped. 1.7 Medical and Pathological Information Autopsy reports provided by the State of Alaska Medical Examiner’s Office concluded that the cause of death for each occupant was “blunt force and thermal injuries sustained during a helicopter crash.” The FAA’s Civil Aerospace Medical Institute performed toxicology testing on samples from the pilot. The report indicated that no ethanol or drugs were detected in the samples tested. 1.8 Organizational and Management Information 1.8.1 General The Alaska DPS aircraft section is a specialized unit of AWT responsible for maintaining the department-owned aircraft fleet and for providing training to all department pilots, the majority of whom are commissioned troopers. At the time of the accident, the DPS fleet included 38 airplanes and 4 helicopters (3 Robinson R-44s and the accident helicopter), and the aircraft section had an assigned staff of 13 people consisting of 6 mechanics, 3 pilots, 2 administrative assistants, the aircraft section supervisor, and the aircraft section commander. All aircraft section

NTSB Aircraft Accident Report 25 staff members had offices in the aircraft section’s hangar located in Anchorage. The aircraft section supervisor’s position was vacant due to the March 8, 2013, retirement of the person who held that job. Each of the department’s aircraft is assigned to a particular AST or AWT section, and it is considered to be an asset of that section, not of the aircraft section. The aircraft section directly employs civilian pilots (such as the accident pilot) whose primary job functions are to operate aircraft and provide flight training. When a trooper is designated as a pilot, their pilot duties are performed in addition to their regular trooper duties, and that trooper remains assigned to their detachment and is supervised by the detachment chain of command. Figure 8 illustrates the chain of command structure that was in place at the time of the accident, based on interviews with DPS personnel.

Figure 8. Chain of command structure in place at the time of the accident. (*Note: Although the SAR coordinator is part of the AST, the AST chain of command personnel are omitted because they are not discussed in this report.) The aircraft section commander (lieutenant) said that the captain and major were not pilots and that the AWT director was a pilot. He said that “generally he was able to go directly”

NTSB Aircraft Accident Report 26 to the AWT director, who made “a lot of the ultimate decisions.” He said that his position had been created by the AWT director in August 2011 and that his function was to act as a liaison between the aircraft section supervisor, who was a civilian, and the commissioned troopers. He provided direction to the aircraft section supervisor who “ran the business” and oversaw the aircraft section mechanics and administrative staff. Before the aircraft section commander joined the aircraft section, the aircraft section supervisor would ask the AWT director for guidance “when troopers in the field had questions about needing maintenance or an airplane or something”; after the aircraft section commander came on board, he responded to troopers’ questions instead of the aircraft section supervisor asking the AWT director. Since the aircraft section supervisor retired, the aircraft section commander had been filling that position as well as his own. He said that he was planning to retire on September 27, 2013. The recently retired aircraft section supervisor, who held the position from August 24, 2009, to March 8, 2013, said that she initially reported to the captain, then she reported to the AWT director, and beginning in 2012 she reported to the aircraft section commander. She said that she supervised the maintenance shop foreman, three pilots, and the administrative assistant; the maintenance shop foreman supervised five mechanics, and the administrative assistant supervised the office assistant. The recently retired aircraft section supervisor explained that she was listed as the pilot’s supervisor, but “in reality” he was supervised by the AST SAR coordinator, and she was not involved in any of his flights. The SAR coordinator contacted the pilot directly regarding SAR missions. The aircraft section supervisor was responsible for approving the pilot’s time cards and writing his performance appraisals, and she was involved if he needed to purchase equipment for the helicopter. According to the department’s aircraft operations manual, the aircraft section supervisor is responsible for the content and currency of the manual. The recently retired aircraft section supervisor stated that her positon “[did]n’t have any authority.” She explained that some of the position’s duties are specified in the department’s aircraft operations manual, but that, in reality, headquarters would direct or make the decisions. She said that if she made decisions the aircraft section staff did not like, they would just bypass her to consult headquarters. According to NTSB records, the Alaska DPS had 18 previous accidents that occurred between July 1, 1999, and June 30, 2012. One accident was fatal, one resulted in a minor injury, and 16 involved substantial aircraft damage but resulted in no injuries. 1.8.2 Aircraft Section Policies and Procedures 1.8.2.1 Operational Control and Go/No-Go Decisions The Alaska DPS aircraft operations manual did not include requirements for anyone other than the pilot to be involved in flight planning, risk analysis, and decision-making responsibilities. The manual chapter titled “Pilot Responsibility and Authority” stated, in part, “in preparation for every flight, pilots will evaluate aircraft performance, route of flight information, and weather conditions in the context of their own abilities and experience and base mission decisions on a totality of the information available to them.” Further, this section stated

NTSB Aircraft Accident Report 27 that “the PIC is responsible for the safe operation of the aircraft and is the ultimate decision maker with regard to the conduct of the flight.” The aircraft section commander said that the “ultimate responsibility” to go or not to go on a flight rested with the pilot. He said that he had told the pilots during seminars and other discussions, “if you don’t feel like going, for whatever your reasons, maybe it’s below minimums for weather, or other conditions…then don’t go on the flight.” He said that during his 25-year career with DPS he had never seen any supervisor push back if a pilot decided not to go on a flight. The relief pilot and a former relief pilot for the accident helicopter reported that they did not feel pressed to fly, but two other former DPS personnel recalled one instance in 2009 in which a pilot was pressured to fly.37 The aircraft section commander said that the pilot did not normally call him when he launched on a SAR mission and that many times, if a launch occurred on the weekend, he would not know until the following Monday when he came to work that there had been a flight. He said that the pilot did not need to obtain his permission to fly because he did not have control over the helicopter. He explained that the helicopter was an AST asset and that the “go-to person” for requesting it was the AST SAR coordinator. The AST SAR coordinator explained that his job was to act as a central point of contact for everything having to do with the resources that a trooper needed to conduct a SAR operation, including aircraft, equipment, and volunteers. He said that, at the time of the accident, he and two other people were taking turns as the on-call SAR coordinator after hours and on weekends and holidays and that he was not on call the night of the accident. His normal procedure when he received a request for assistance from a trooper was to evaluate whether sending the helicopter would be the best tool for the job. If that was the case, he would call a pilot and ask him to evaluate the weather, the location, and other factors to determine whether he could go or not. He said that he relied on the pilots to determine whether or not they could safely accept the mission and that “there was absolutely no pressure whatsoever” on pilots to accept a mission. 1.8.2.2 Flight and Duty Time Policies The Alaska DPS aircraft operations manual stated that, for a single pilot, the maximum duty period was limited to 12 hours, the maximum flight time within the duty period was limited to 8 hours, and the rest period was 10 hours. During emergencies, which included SAR operations, an extension of the maximum duty period to 15 hours, the maximum flight time within the duty period to 10 hours, and the rest period to 12 hours was allowed with “the approval of a DPS supervisor who is or has been a pilot and who can assess the need as well as the pilot’s personal condition at the time.” The recently retired aircraft section supervisor said that the pilots tracked their own time and that they were “very good” about tracking it. When she first started, the accident pilot called her a couple of times to let her know that he was going to exceed his duty time limit but then he

37 Two former Alaska DPS personnel described an event in 2009 in which the AWT director pressured a fixed-wing pilot to accept a flight in weather conditions that the pilot felt were potentially unsafe. The pilot completed the flight without incident.

NTSB Aircraft Accident Report 28 stopped, and she believed he was instead calling the colonel (AWT director). The AWT director recalled that the pilot called him “a couple of times” to ask for an extension of his maximum flight or duty time, as permitted by the Alaska DPS aircraft operations manual. The aircraft section commander was unfamiliar with the details of the section’s flight and duty time policy. When asked whether the AST SAR coordinator monitored the accident pilot’s flight and duty time, he said “no” and added that “we leave almost all of that up to the pilot to know to follow.” He said that the pilot was familiar with the policy because he had brought the limits to his attention on several occasions. He said the pilot was “quite aware of the policy,” and he followed it. 1.8.2.3 Preflight Risk Assessment and Weather Minimums The Alaska DPS aircraft operations manual did not include a preflight risk assessment procedure. The recently retired aircraft section supervisor said that she was in the initial stages of developing a risk assessment procedure for the section when she retired. She had obtained a form that looked like it could be modified to meet their needs, and she had discussed with the aircraft section commander trying it out with the aircraft section pilots. She stated that the accident pilot had vigorously objected to the proposed implementation of this procedure because he thought that only the SAR pilot should be able to turn down a SAR mission. The manual did not specify any weather minimums for the operation of DPS aircraft other than the applicable FAA requirements. The aircraft section commander said that pilots’ minimums depended on their experience. Alaska DPS policy indicated that any change had to be approved in writing by the aircraft section supervisor. The most recent Alaska DPS Flight Authorizations/Limitations form for the pilot was completed in 2003, shortly after he was hired. As discussed in section 1.2.1.1, it stated that the pilot’s night VFR NVG weather minimums were a 500-ft ceiling and 2-mi visibility. The aircraft section commander stated, however, that by the time of the accident, the pilot was expected only to comply with FAA weather minimums, which did not require any minimum visibility or cloud clearance below 1,200 ft agl in class G airspace.38 However, there was no record of this change in the pilot’s file. The recently retired aircraft section supervisor said the same but also stated that the pilot used his own personal weather minimums. In a 2009 e-mail, the pilot wrote a colleague that his personal minimums for NVG operations at night were a 200-ft ceiling and 5-mi visibility.39 1.8.2.4 Safety Program The recently retired aircraft section supervisor told investigators that the AWT captain in the aircraft section’s chain of command asked her to get DPS involved in the Medallion

38 Title 14 CFR 91.155 specifies that, within 1,200 ft of the surface, “A helicopter may be operated clear of clouds if operated at a speed that allows the pilot adequate opportunity to see any air traffic or obstruction in time to avoid a collision.” 39 In the same e-mail, the pilot wrote, “Please note 7.06 NVG Operational Limitations, dated 3/12/07, gives no specific limitation other than slowing down for the weather condition during the flight. In addition, you must have sufficient ambient light (lums) to continue with flight.”

NTSB Aircraft Accident Report 29 Foundation,40 and, beginning in 2010, she worked to develop Alaska DPS’s safety management system (SMS).41 This effort included the development of a hazard reporting system, safety committee, and other safety mechanisms that enabled DPS to earn one of the Medallion Foundation’s five stars, the safety star.42 To pass the Medallion Foundation audit for the safety star, Alaska DPS was required to have various safety policy components in place, including procedures for safety reporting, hazard identification, risk assessment, safety committees, and internal safety auditing. The hazard reporting system was designed to allow employees in all departments to report accidents, incidents, and injuries and to make suggestions or voice concerns. The reporting system was to be nonpunitive with an anonymous reporting option, and reported hazards were to be evaluated for risk by a formal safety committee that met on a regular schedule to use the information to make safety improvements. In addition, the program was required to have a full or part-time safety manager with the authority necessary to run the program and a direct report to a high-level manager who was held accountable for safety performance. Interviews with DPS personnel indicated that all of these elements were in place when the organization passed its initial Medallion Foundation audit in January 2012 and followup audit in July 2012. However, the recently retired aircraft section supervisor stated that the safety program lacked high-level Alaska DPS support and, as a result, there was a lack of Alaska DPS pilot confidence and participation in the program. She said that she had only received “a couple” of pilot reports involving aircraft operations and that most of the reported issues had involved safety hazards located in or near the aircraft hangar. In addition, she stated that the section did not have enough money for training and that, in 2012, headquarters canceled the annual 3-day pilot safety seminar because of a lack of funds. She said that she thought that it was important to have the seminar every year because it was the only time when about 40 trooper pilots were brought together from their stations around the state to receive information about safety issues. Further, in 2012, her chain of command changed such that instead of reporting to the colonel who was the AWT director (a high-ranking manager), she reported to the lieutenant who

40 The Medallion Foundation was formed by the Alaska Air Carriers Association in 2001 as a nonprofit organization for the purposes of improving pilot safety awareness and reducing air carrier insurance rates. The organization’s stated mission is to reduce aviation accidents by fostering a proactive safety culture and promoting higher safety standards through one-on-one mentoring, research, education, training, auditing, and advocacy. 41 According to International Civil Aviation Organization and FAA guidance materials, a comprehensive SMS program should contain four major components: safety policy, safety risk management, safety assurance, and safety promotion. Safety policy defines the policies, procedures, resources, and organizational structures that provide a foundation for the program’s functional elements. Safety risk management is a formal system for identifying hazards and managing related risks. Safety assurance is a process for evaluating the effectiveness of existing risk controls. Safety promotion involves the promotion of safety as a core value and the development of an organizational culture that is conducive to safety management. 42 The Medallion Foundation describes its Five Star/Shield Program for aircraft operators as “a step-by-step approach to building an [SMS] by providing program and process guidelines, specific training classes, one-on-one company mentoring and auditing to determine if the applicant meets the specific program requirements.” To earn the safety star, an operator is required to have implemented a safety program with commitment from top management that includes a nonpunitive and anonymous safety reporting system, an emergency response plan, a safety committee, and a viable safety information collection and distribution system. (See the Medallion Foundation website at http://medallionfoundation.org.)

NTSB Aircraft Accident Report 30 served as the aircraft section commander, a lower-ranking new position. She said that this change undermined her influence as safety manager and that trooper pilots and middle managers felt comfortable ignoring the safety policies that she had attempted to put in place. When she made a decision staff disagreed with, they would just go around her and appeal directly to headquarters. She said that she decided to leave the organization after an AST supervisor directed a pilot to fly an airplane that had been repaired by someone other than a qualified mechanic. She said that she assumed that the aircraft section commander would take over as the manager of the safety program when she left. However, the aircraft section commander said that he was not well versed in the former aircraft section supervisor’s activities in her role as safety manager, and that, since she left, he had not “been able to keep up with all that stuff.” A safety policy statement posted in the main hangar that was signed by the AWT director stated, “A safety manager who is experienced in safety programs will be appointed and will have the responsibility and authority to manage the Alaska DPS aviation safety program. The safety manager should be contacted in regards to any questions or recommendations.” Three months after the aircraft section supervisor retired, no safety manager had been formally appointed, and no safety committee meetings had been held. The AWT director said that he realized that the civilian aircraft section supervisor ran the aircraft section safety program, but, when she retired in March 2013, he delayed selecting her replacement because he was retiring in May 2013 and wanted to allow his replacement to select the new aircraft section supervisor to help facilitate any necessary operational changes. 1.8.3 Response to Pilot’s Previous Accident and Events 1.8.3.1 Accident in 2006 Following the pilot’s accident in 2006, the AWT director appointed an Aircraft Accident Review Board that conducted an internal investigation separate from the NTSB’s. The review board, which consisted of an AWT captain, the aircraft section supervisor, the former relief pilot for the helicopter, and another AWT helicopter pilot (who later became the relief pilot), met on April 28, 2006. A memorandum dated May 2, 2006, that documented the review board’s investigation included the following “aggravating factors,” among others:  The pilot was aware of the blowing snow, low visibility condition before takeoff.  The pilot depended on a visual reference by using the edge of the lake.  The pilot did not execute an instrument takeoff when confronted with a blowing snow condition and choose to hover and use a reference point.  The pilot had worked for 18 days straight without a day off. The memorandum stated: The direct cause of the incident was the pilot’s loss of visual reference with the ground while taking off. …The loss of visual reference was a direct result of blowing snow caused from the rotor downwash as power was applied during takeoff. The pilot’s landing site selection; positioning of the helicopter on landing;

NTSB Aircraft Accident Report 31 choice of VFR departure vs. an IFR instrument departure under the existing weather conditions when linked together led to this incident. Based upon the evidence presented it is this board’s determination that the incident was a result of pilot error. Under the heading “Recommendations,” the memorandum stated, in part, that “an instrument departure under the weather conditions and night operations would have been prudent.” Also, it stated that “[t]he intent of this board is not to provide any disciplinary action on the employee, [the pilot], but rather to suggest avenues for him to return to flight status for the Department.” On May 2, 2006, the pilot successfully completed an Alaska DPS postaccident evaluation check flight in a Robinson R-44. The check airman was one of the Alaska DPS pilots who had given the pilot his initial NVG training in 2003.43 On the form used to document the check flight, the flight time was listed as 0.3 hour, and the remarks section of the form stated, “although no blowing snow conditions were present, techniques used for blowing snow operations were discussed and evaluated. Recommend continued status as PIC.” As noted in section 1.2.1.3, the pilot also successfully completed the FAA-requested checkride on May 15, 2006. A memorandum dated August 29, 2006, with the subject, “Memorandum of Warning,” addressed to the pilot from the highest ranking member of the Aircraft Accident Review Board, discussed the board’s findings. The memorandum stated, in part, that “the cause of the incident was due to pilot error. Specifically your momentary distraction within the cockpit from your instruments during the departure and the inability to transition from instrument to VFR flight resulted in a momentary loss of aircraft control.” Further, the memorandum stated that “the damage to the aircraft was significant,” and “the cost and impact on the department being without its search and rescue helicopter…was also significant.” The memorandum stated, “…[you] are hereby warned. Any future occurrence of a similar incident may result in more severe disciplinary action.” The memorandum also noted that “the fact that you took responsibility for the accident and showed great remorse weighs heavily in how the department views this incident.” The pilot’s performance evaluation report dated January 23, 2007, included the following statement with regard to the accident: Although the accident caused damage to the helicopter which has since been repaired, no one was injured and both the Aircraft Section and [the pilot] learned some very valuable lessons. His cooperation during the investigation allowed the Alaska DPS to make significant changes to the aircraft operations manual and address in the open the challenges that fatigue places upon flight crew during extreme operational demand periods. The [manual] now provides clear guidance for all flight crews on duty day and flight duty limitations aimed at making aircraft section flight operations safer.

43 The check airman was also one of the members of the Aircraft Accident Review Board.

NTSB Aircraft Accident Report 32 1.8.3.2 Engine and Rotor Overspeed Event in 2009 The pilot was landing the accident helicopter at ANC on May 13, 2009, when an engine and rotor overspeed occurred.44 The former relief pilot suspected that the pilot had initiated the event by moving the collective in an aggressive manner, and the AWT director requested that an AST captain investigate the event. According to the report of the investigation prepared by the AST captain, the pilot stated that he was attempting to land the helicopter on its ground cart when the helicopter bounced slightly, and the pilot increased collective pitch to lift the helicopter off the cart. The pilot told the AST captain that he did not move the collective in an aggressive manner when landing on the cart. The engine was removed and sent to Turbomeca for overspeed inspection and repair. The Turbomeca report of the inspection indicated that the fuel metering needle had frozen in position, and its findings noted corrosion contamination on the metering needle assembly and other components, as well as wear on other components. The Turbomeca report concluded that it was “probable that a combination of the findings observed led to the reported event.” The “Conclusion” section of the Alaska DPS investigation report stated, in part, “the final cause of the overspeed, based on the available information, is inconclusive.” According to the Alaska DPS report, on the day of the incident, the pilot started work at 0800, had been on duty for 12 hours when the event occurred, and had flown the helicopter 5.8 hours that day. When interviewed by NTSB investigators, the AWT director recalled the overspeed event and said that “ultimately it wasn’t determined that it was pilot error or a mechanical issue. It was unclear.” The AWT director also said that another event involving the pilot occurred around the same time as the overspeed event. In the other event, the pilot was flying a Robinson R-44 helicopter, and the tail rotor “may or may not” have struck water during a water landing.45 The AWT director said that the pilot denied that a water strike occurred. The AWT director also mentioned the pilot’s 2006 accident and said that when the pilot was asked about any of these events, “it was never his fault.” He said that there was nothing he could do to “take sanctions” against the pilot without some reliable information to refute the pilot’s statements. The combination of the overspeed and the R-44 events prompted the AWT director to ask the aircraft section supervisor to research onboard monitoring equipment that could be installed in the accident helicopter to monitor the pilot’s actions. Once the AWT director learned of the Appareo system, he had it purchased and installed. The AMRG observer stated that the pilot was “always worried” about losing his job. He said that the pilot told him he thought he was going to be fired after the 2006 accident and that he was being blamed for damaging the helicopter after the 2009 overspeed event. The pilot’s spouse stated that the pilot “fought tooth and nail” to be exonerated of the event. According to the lead mechanic and others, the pilot felt that everybody in the organization was against him.

44 This event was not investigated by the NTSB. 45 According to the Alaska DPS maintenance shop foreman, the Robinson R-44 sustained damage on the tail rotor assembly that a manufacturer’s technical representative stated was consistent with a water strike. Inspection of the tail rotor assembly by a manufacturer’s technical representative following a flight by the pilot indicated that the damage could have resulted from a water strike.

NTSB Aircraft Accident Report 33 1.8.3.3 Overtorque Event in 2011 The pilot was conducting an external load operation in the accident helicopter at Lake George, Alaska, about 1630 Alaska daylight time on April 15, 2011, when an overtorque condition occurred.46 In a written statement dated May 9, 2011, the pilot said that the purpose of the flight was to recover a Piper PA-18 from a frozen lake using a sling and long-line. The pilot’s statement said that, while the airplane was suspended beneath the helicopter, wind buffeted the helicopter, which led him “to use more pedal, which robbed additional power from the main rotor causing a momentary settling.” The pilot said that he reacted to the settling by increasing collective and that this induced an overtorque event. After the pilot finished moving the airplane, he checked the vehicle and engine multifunction display and found that it had recorded an overtorque spike of 107% for 1 second. He performed an inspection of the rotor head and transmission support arms, found no damage, and signed off the inspection on the helicopter’s log sheet for the day. The pilot did not inform the helicopter’s lead mechanic or the aircraft section supervisor about the event. Maintenance personnel later saw the pilot’s signoff on the inspection sheet, and the lead mechanic reported the discrepancy to the FAA, which sent inspectors to examine the maintenance records.47 Although the AWT asked the aircraft section to review the Appareo data for the overtorque event, section staff discovered that the data card was not formatted and that no data had been recorded during the flight. A memorandum dated May 5, 2011, from the aircraft section supervisor to the pilot addressed the overtorque incident stating, in part, the following: The over-torque condition necessitated a manufacturer-required inspection of the aircraft. You hold [an FAA] airframe & powerplant license and conducted this inspection yourself. After you inspected the aircraft, you failed to ensure that the incident was properly reported. …. It was not until 04/27/11, that Aircraft Section maintenance staff was made aware of the over-torque due to the discovery of the over-torque inspection documentation in the aircraft logbook by an FAA inspector, and not until 04/28/2011, that I, as your immediate supervisor, was notified.

46 This event was not investigated by the NTSB. 47 FAA Program Tracking and Reporting System records for the helicopter indicated that on April 18, 2011, the Anchorage Flight Standards District Office received an anonymous complaint via a safety hotline that a pilot was performing maintenance on the helicopter without writing up the discrepancies. (The helicopter’s lead mechanic told investigators that he made the anonymous complaint.) The FAA inspection determined that the pilot was qualified to perform and sign off the inspection.

NTSB Aircraft Accident Report 34 The memorandum continued with a discussion of the pilot’s handling of a discrepancy with the helicopter’s tail rotor pitch change links that he had found during a visual inspection on March 23, 2011. It then stated the following: As your immediate supervisor, it’s my expectation that you will notify me of any condition which occurs to the aircraft that can affect the flight status of that aircraft. By not notifying me as soon as practical that the over-torque condition occurred or that there was a problem with the tail rotor pitch links, you did not follow the appropriate…policy as outlined in Chapter 3.04(E).”[48] You are also expected to notify the Aircraft Section shop foreman, either directly or through me, of any problems or concerns regarding the DPS aircraft that you fly. The memorandum concluded by stating, “this letter is intended to be instructional in nature, correct this type of behavior, and for you to follow the appropriate course of action with respect to our rules and procedures in the future.” 1.8.4 Use of Flight Observers The primary Alaska DPS SAR coordinator stated that the use of trained volunteer observers was up to the pilots and based on their personal relationships with members of the volunteer SAR community. Current and former relief pilots for the helicopter said that they liked to have a trained observer in the left seat to operate the Garmin 430 and Avalex display for them, especially when flying at night using NVGs. When the accident pilot used a trained observer, he relied mostly on one particular individual from the AMRG; however, this AMRG observer was out of town on the day of the accident. The AMRG observer estimated that he had flown over 300 SAR missions with the pilot, with the most recent flight in February 2013. Both the AMRG observer and the Alaska DPS on-duty SAR coordinator said that, if the AMRG observer had been available, he likely would have accompanied the pilot during the mission to rescue the snowmobiler. The AMRG observer was trained in the use of NVGs. The AMRG observer said that, if he had been on the helicopter during the accident mission, he would have operated the Garmin 430 and Avalex displays for the pilot and performed other tasks, including setting up navigational courses and selecting radio frequencies. In addition, he said he would have been wearing NVGs and assisted the pilot by calling out terrain and obstacles. He was also familiar with the pilot’s practice of disabling the turn-and-bank indicator (which was located on his side of the center pedestal), and he knew how to reset the circuit breaker to enable the instrument to function. The AMRG observer said that operating the Garmin 430 and Avalex display required significant training and familiarization.

48 Chapter 3.04(E) of the Alaska DPS aircraft operations manual stated, “All mishaps involving a DPS aircraft including any accident, incident, injury or ground damage associated with an aircraft in any way shall be immediately reported verbally to the Aircraft Supervisor and the direct supervisor of the pilot responsible for the aircraft followed as soon as possible by an email synopsis of the event.”

NTSB Aircraft Accident Report 35 A former Alaska State Trooper who served as the state SAR coordinator from 2004-07 and 2010-11 said that the pilot had, with his approval, developed a tactical flight officer (TFO)49 training program. This training program was designed to familiarize volunteer TFOs with the Avalex display, FLIR, spotlight, and the use of NVGs. The pilot planned to train six to eight volunteer TFOs in the hangar during his normal duty hours so that a TFO would always be available for helicopter SAR missions. However, after the former SAR coordinator left that role in 2011, there was little management support for the TFO training program. Many missions require law enforcement personnel, but the helicopter had a limited payload. Alaska DPS management decided that, in many cases, it would be more appropriate to have the pilot pick up an on-duty state trooper rather than fly with a SAR volunteer. Commissioned troopers generally did not have the same level of training in helicopter operations as volunteer TFOs. The former SAR coordinator stated that he believed that the Alaska DPS management did not adequately consider the impact of this change on operational safety. The former relief pilot for the helicopter said that the aircraft section had attempted to train some troopers in the use of helicopter equipment but that those trained officers were often unavailable for SAR missions due to scheduling conflicts. The current aircraft section commander said that he had never met any of the volunteer observers, including the AMRG observer who routinely flew with the accident pilot, and was not familiar with the training they had received. 1.8.5 Use of MatCom Dispatch Services The Alaska DPS contracts with MatCom for dispatch services. The MatCom dispatch center for the geographic area that includes Talkeetna is located in Wasilla, Alaska. The Alaska DPS did not perform any flight tracking or flight-following, and no one was aware that the accident helicopter was overdue until the EMS personnel waiting at Sunshine contacted MatCom dispatch to inquire about its estimated time of arrival. Interviews with MatCom personnel revealed that dispatchers had clear guidance, training, and defined responsibilities and duties for AST ground vehicle operations and could provide very specific status and location information for every ground vehicle at any time. MatCom dispatchers had no aircraft-specific training and were not provided any specific flight plan information for the accident flight.50 After EMS personnel inquired about the helicopter at 0039 on March 31, 2013, the MatCom dispatcher attempted to locate it by radio and phone and by contacting personnel at Sunshine and the Talkeetna FSS. The dispatcher was unable to provide the FSS personnel the registration number of the helicopter (the dispatcher knew it only as “Helo-1”). At 0052, the dispatcher received a call from a sergeant asking for contact information for the on-duty SAR

49 TFOs are typically law enforcement personnel trained to conduct a wide array of flight operation support duties with a responsibility for assisting with flight safety. TFOs often assist with equipment operation (including systems used for aviation navigation, mapping, recording, and tracking) and collision avoidance and serve in a tactical decision-making capacity. 50 When the pilot departed on the previous flight from ANC to Sunshine, he told the MatCom dispatcher that he had 2 hours 37 min of fuel on board and that his estimated time en route was 27 min. The pilot did not provide the dispatcher with such information for the accident flight.

NTSB Aircraft Accident Report 36 coordinator for Alaska DPS; the sergeant told the dispatcher to stand by on contacting cell phone providers to initiate “accident circumstance” procedures for locating the cell phones of the helicopter occupants until the sergeant could talk with the SAR coordinator. At 0109, the SAR coordinator called dispatch for contact information for the aircraft section commander (so that he could obtain the helicopter’s satellite telephone number) and asked for the coordinates for the snowmobiler’s location. At 0110, the dispatcher called a cell phone provider to attempt to obtain coordinates from the pilot’s, flight observer’s, and snowmobiler’s cell phones. Over the course of the next several hours, the MatCom dispatch center changed shifts three times from the start of the initial search and rescue call to the time in which the accident site was located, and some difficulties with the transfer of information over multiple shifts occurred. 1.8.6 Alaska DPS Changes Since This Accident On August 7, 2014, representatives from the Alaska DPS met with NTSB investigators to discuss the safety improvements the department has made since the accident. Among these was the establishment of a new safety officer position, which incorporates a clear chain of command to the AWT director, captain, and lieutenant for any safety-related program issues. The safety officer, who is a pilot with aviation safety experience, is a dedicated full-time employee located at the Alaska DPS aviation section headquarters in Anchorage. Also, a third-party maintenance audit was completed in August 2014, an operations audit began in August 2014, and a training audit is to follow. All audits include a safety component that is being included in the safety program. Table 3 summarizes the department’s improvements as of the date of this report. Many of these improvements are consistent with safety issues identified in completed NTSB investigations of accidents involving another law enforcement SAR helicopter, helicopter emergency medical services (HEMS) operators, and public operators of EMS helicopters and the safety recommendations that were issued as a result of those investigations. (See sections 1.9.1 through 1.9.3.)

NTSB Aircraft Accident Report 37 Table 3. Summary of Alaska DPS safety improvements since the accident. Flight Operations All active AS350 helicopter pilots have attended inadvertent IMC training from a commercial vendor51 and will receive inadvertent IMC training from a department check airman at least every 90 days. Airplane pilots received the training annually.

NVG operations are suspended until a formal NVG training program for pilots is implemented.

Pilots are adhering to standard operating procedures that specify that the maximum duty day for a single-pilot crew is 12 hours with 8 flight hours maximum and 10 hours rest. Exceptions during emergencies require approval.

Formal TFO program being developed; SAR aircraft availability reduced to meet current staffing level.

Night SAR operations are no longer being conducted. Situations involving loss of life or limb are evaluated case by case with regard to weather minimums.

Pilots are required to adhere to personal and department weather minimums. Satellite phones issued for communications at remote sites. Operational Control Safety officer reviews Appareo data monthly.

Clear chain of command established for personnel in a pilot’s chain of command. Nonaviation supervisors do not participate in mission go/no-go decision-making.

Formal risk assessments are used for all helicopter missions and are under development for remote airplane operations.

For flight-tracking, Spidertracks has been installed in about 34 of the 42 aircraft (plans are to equip all aircraft). Flight-following is being performed by the RCC, MatCom, and authorized supervisors. Organizational Culture Formal chain of command to AWT director, captain, and lieutenant established and enforced.

Safety officer periodically audits pilot flight and duty time limits and is authorized to communicate directly with aircraft section commander or director of public safety about safety-related findings.

Created a safety manager position that is a required part of the safety/management team.

Statewide pilot safety seminar planned for November 18-20, 2014.

SMS is being developed with plans to include “just culture.”52

Third-party maintenance audit completed in August 2014. An operations audit began in August 2014, and a training audit is to follow.

Department participates in Airborne Law Enforcement Association, Medallion Foundation, and Helicopter Association International. Maintenance Appareo system installation now includes use of the wire link to the aircraft intercom system to record voice audio.

Department reviewing options to meet recommendations from third-party audit to address maintenance turnaround times, staffing, and aircraft availability.

New responsibilities and roles are being established to ensure maintenance oversight.

51 Alaska DPS personnel stated to NTSB investigators during the August 2014 meeting that the pilots had questions about the effectiveness of the training they received. 52 Just culture has been described as “an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information” (Reason 1997), and “a culture in which front line operators or others are not punished for actions, omissions, or decisions taken by them that are commensurate with their experience and training but where gross negligence, willful violations, and destructive acts are not tolerated” (Chapter 1, Article 2 [k] of European Union regulation No. 691/2010).

NTSB Aircraft Accident Report 38 1.9 Previously Issued Safety Recommendations 1.9.1 Airborne Law Enforcement Association Safety Policies Guidance The Airborne Law Enforcement Association (ALEA) was founded in 1968 as a nonprofit association composed of local, state, and other public aircraft operators engaged in law enforcement activities. The organization’s stated mission is to support, promote, and advance the safe and effective use of aircraft by governmental agencies through training, networking, advocacy, and educational programs. On June 9, 2009, an Agusta S.p.A. A-109E helicopter operated by the New Mexico State Police (NMSP) impacted terrain during a VFR flight into IMC during a SAR mission near Santa Fe, New Mexico (NTSB 2011). As a result of the investigation, the NTSB issued several safety recommendations, including Safety Recommendations A-11-57 to the ALEA, A-11-53 to the state of New Mexico, A-11-60 to the National Association of State Aviation Officials, and A-11-64 to the International Association of Chiefs of Police.

To the ALEA: Revise your accreditation standards to require that all pilots receive training in methods for safely exiting inadvertently encountered instrument meteorological conditions for all aircraft categories in which they operate. (A-11-57, classified “Closed—Acceptable Action”)

In response to this recommendation, the Airborne Law Enforcement Accreditation Commission revised Sections 04.03.01 and 04.03.02, “Pilot in Command Initial and Recurrent Training,” of its accreditation standards to require pilot training in inadvertent encounters with IMC during initial pilot training and at least annually during pilot recurrent training for both fixed and rotary wing aircraft.

To the state of New Mexico: Require the New Mexico Department of Public Safety to bring its aviation section policies and operations into conformance with industry standards, such as those established by the Airborne Law Enforcement Association. (A-11-53, classified “Closed—Acceptable Action”) To the National Association of State Aviation Officials: Encourage your members to conduct an independent review and evaluation of their policies and procedures and make changes as needed to align those policies and procedures with safety standards, procedures, and guidelines, such as those outlined in Airborne Law Enforcement Association guidance. (A-11-60, classified “Closed—Acceptable Action”) To the International Association of Chiefs of Police: Encourage your members to conduct an independent review and evaluation of their policies and procedures and make changes as needed to align those policies and procedures with safety standards, procedures, and guidelines, such as those outlined in Airborne Law Enforcement Association guidance. (A-11-64, classified “Closed—Acceptable Action”)

NTSB Aircraft Accident Report 39 In response to these safety recommendations, each of the addressees performed actions that were responsive to the recommendations and satisfied their intent. 1.9.2 HEMS Operations HEMS operations, like SAR operations conducted by law enforcement departments, involve missions that require a high level of urgency to protect human life and are unpredictable in terms of when, where, and in what weather conditions they occur. Because of these mission similarities, many of the risks inherent in HEMS operations affect SAR operations as well. An NTSB safety study identified that pressure to complete a mission, weather, nighttime flight, spatial disorientation, and inadequate pilot training and experience were common risk factors for HEMS operations (NTSB 1988). A study by the Air Medical Physicians Association (AMPA) acknowledged these risks and cited additional risks such as unprepared landing sites, complacency, and situational stress. Safely operating in such a high-risk environment calls for systematic evaluation and management of those risks. According to AMPA, an effective flight risk evaluation program acknowledges and identifies threats, evaluates and prioritizes risks, considers the probability that a risk will materialize, and mitigates loss. In a 2006 special investigation report, the NTSB found that, in both the HEMS and airplane EMS environment, conducting a flight risk evaluation requires the pilot and possibly another person (a manager, a flight dispatcher, or another flight crewmember) to assess the situation without being influenced by the sense of urgency that can come with an initial call requesting services (NTSB 2006). 1.9.2.1 Pilot Training on Inadvertent IMC Encounters As a result of an NTSB public hearing on the safety of HEMS flights that revealed that most HEMS pilots did not have adequate training to recognize the conditions that indicate when they are encountering IMC, how to effectively avoid IMC encounters, and how to escape safely should they encounter IMC, the NTSB issued Safety Recommendation A-09-87 to the FAA and A-09-97 to the 40 public operators of HEMS flights. Develop criteria for scenario-based helicopter emergency medical services (HEMS) pilot training that includes inadvertent flight into instrument meteorological conditions and hazards unique to HEMS operations, and determine how frequently this training is required to ensure proficiency. (A-09-87, classified “Closed—Unacceptable Action”) Conduct scenario-based training, including the use of simulators and flight training devices, for helicopter emergency medical services (HEMS) pilots, to include inadvertent flight into instrument meteorological conditions and hazards unique to HEMS operations, and conduct this training frequently enough to ensure proficiency. (A-09-97) In response to Safety Recommendation A-09-87, on February 21, 2014, the FAA published a final rule, “Helicopter Air Ambulance, Commercial Helicopter, and Part 91

NTSB Aircraft Accident Report 40 Helicopter Operations,” which revised Section 135.293 to include the following new pilot testing requirements53 (among others):

(a)(9) … For rotorcraft pilots, procedures for aircraft handling in flat-light, whiteout, and brownout conditions, including methods for recognizing and avoiding those conditions…. (c) Each competency check given in a rotorcraft must include a demonstration of the pilot’s ability to maneuver the rotorcraft solely by reference to instruments. The check must determine the pilot’s ability to safely maneuver the rotorcraft into visual meteorological conditions following an inadvertent encounter with instrument meteorological conditions. For competency checks in non-IFR-certified rotorcraft, the pilot must perform such maneuvers as are appropriate to the rotorcraft’s installed equipment, the certificate holder’s operations specifications, and the operating environment. … (h) Rotorcraft pilots must be tested on the subjects in paragraph (a)(9) of this section when taking a written or oral knowledge test after April 22, 2015. Rotorcraft pilots must be checked on the maneuvers and procedures in paragraph (c) of this section when taking a competency check after April 22, 2015. However, the FAA’s revisions to the regulation did not include criteria for scenario-based training to address hazards unique to helicopter air ambulance operations, such as interfacility helicopter air ambulance flights or remote helispot landings or takeoffs. As a result, on September 11, 2014, the NTSB classified Safety Recommendation A-09-87 “Closed— Unacceptable Action.” Since Safety Recommendation A-09-97 was issued, many of the public HEMS operators now provide the training discussed in the recommendation to their pilots, as well as other flight crew, such as paramedics and flight nurses, involved in their HEMS flights. In recognition of this training being provided to more than just HEMS pilots, Safety Recommendation A-09-97 is classified “Closed—Exceeds Recommended Action” to 15 of the 40 public HEMS to which it was issued. 1.9.2.2 Preflight Risk Assessment The NTSB has issued several recommendations regarding formal preflight risk assessment procedures and the involvement of another qualified helicopter pilot when making launch decisions for HEMS missions. As a result of the 2006 special investigation on EMS safety, Safety Recommendations A-06-13 and -14 were issued to the FAA. Safety Recommendation A-06-13 addressed the importance of flight risk evaluation programs and asked the FAA to do the following:

53 The final rule’s original effective date was April 22, 2014. On April 21, 2014, the FAA amended the final rule to change the effective date to April 22, 2015, for certain sections, including 135.293 (a)(9) and (c).

NTSB Aircraft Accident Report 41 Require all emergency medical services (EMS) operators to develop and implement flight risk evaluation programs that include training all employees involved in the operation, procedures that support the systematic evaluation of flight risks, and consultation with others trained in EMS flight operations if the risks reach a predefined level. (A-06-13, classified “Open—Acceptable Response”) On August 1, 2005, the FAA published Notice 8000.301, “Operational Risk Assessment Programs for Helicopter Emergency Medical Services,” which provided guidance to FAA inspectors on promoting risk assessment, risk management tools, and training for HEMS operations. The notice contained a formalized risk assessment matrix, which could be used by HEMS crews when making decisions to launch or to continue a mission. When Safety Recommendation A-06-13 was issued, the NTSB was aware of the notice but was not confident that the new guidance would be widely adopted by EMS operators because most HEMS operators examined during the 2006 special investigation did not have a decision-making or a risk evaluation program in place as suggested by FAA guidance issued in 1991. FAA notices are, by design, temporary documents that expire after 1 year. On January 28, 2006, the FAA published Safety Alert for Operators 06001, “Helicopter Emergency Medical Services Operations,” which included the information from the notice. On May 1, 2008, the FAA incorporated the risk assessment information into FAA Order 8900.1, “Flight Standards Information Management System.”54 On February 21, 2014, the FAA published a final rule titled “Helicopter Air Ambulance, Commercial Helicopter, and Part 91 Helicopter Operations,” which amended FAA regulations in Section 135.617 to require that all helicopter air ambulance operators establish and document, in their operations manual, an FAA-approved preflight risk analysis that includes management approval in situations where a predetermined risk level is exceeded. The FAA incorporated guidance for developing risk assessment matrix tools to determine risk level (such as “low,” “medium,” “serious,” and “high”) for use in go/no-go decision-making into Section 5 of FAA Order 8900.1. Safety Recommendation A-06-14 addressed the importance of formalized dispatch and flight-following procedures. The NTSB recommended that the FAA do the following: Require emergency medical services operators to use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance in flight risk assessment decisions. (A-06-14, classified “Open— Acceptable Response”) In response to this recommendation, on May 5, 2008, the FAA issued Advisory Circular 120-96, “Integration of Operations Control Centers [OCC] into Helicopter Emergency Medical Services Operations,” which provided guidance on the establishment and operation of an OCC by a HEMS operator. The February 21, 2014, final rule contains a requirement in Section 135.619 for certificate holders with 10 or more helicopter air ambulances to establish OCCs and document operations control specialist duties and training in their operations manuals.

54 FAA Order 8900.1 provides guidance to FAA inspectors to use when reviewing and approving the flight operations programs of commercial operators.

NTSB Aircraft Accident Report 42 As a result of a public hearing the NTSB held on HEMS safety on February 3-6, 2009, Safety Recommendation A-09-98 was issued to 40 public aircraft operations HEMS operators that are not subject to FAA oversight: Implement a safety management system program that includes sound risk management practices. (A-09-98) Among the 40 public operators receiving this recommendation was STAR Flight of Austin-Travis County, Texas Emergency Medical Services, an operator that conducted both HEMS and other public aircraft missions, including SAR. On October 20, 2009, STAR Flight replied that it had implemented a risk assessment tool for HEMS operations in 2008 and that it was, at that time, developing a risk assessment tool for its SAR, firefighting, and law enforcement operations. On June 2, 2010, the NTSB replied that STAR Flight, by developing the risk-assessment tool for various operations, exceeded the intent of the HEMS recommendation. Consequently, Safety Recommendation A-09-98 to STAR Flight was classified “Closed— Exceeds Recommended Action.” As a result of the September 27, 2008, accident involving an Aerospatiale (Eurocopter) SA365N1, registered to and operated by the Maryland State Police as a public HEMS flight in District Heights, Maryland, the NTSB issued Safety Recommendations A-09-131 and -132 to the 40 public HEMS operators (NTSB 2009): Develop and implement flight risk evaluation programs that include training for all employees involved in the operation, procedures that support the systematic evaluation of flight risks, and consultation with others trained in helicopter emergency medical services flight operations if the risks reach a predefined level. (A-09-131) Use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance in flight risk assessment decisions. (A-09-132) To date, 15 public HEMS operators have indicated to the NTSB that they have implemented a flight risk evaluation program and use formalized dispatch and flight-following procedures, including 5 state police departments. 1.9.3 Inconsistencies Among Weather Information Products Recent NTSB accident investigations found instances in which nonaviation-specific weather products from the NWS advised of conditions that were more severe than those described in the NWS aviation weather products. As a result, on May 6, 2014, the NTSB issued four safety recommendations to the FAA (Safety Recommendations A-14-13 through -16) and five to the NWS (Safety Recommendations A-14-17 through -21).55 The NTSB recommended that the FAA do the following:

55 For more information about Safety Recommendations A-14-13 through -16, which are addressed to the FAA, and Safety Recommendations A-14-17 through -21, which are addressed to the NWS, see the Safety Recommendations search page, available on the NTSB website at www.ntsb.gov.

NTSB Aircraft Accident Report 43 Ensure that all FAA preflight weather briefings include any products modified or created by the [NWS] in response to Safety Recommendation A-14-17. (A-14-13) Require that the [NWS] provide a primary aviation weather product (as recommended in Safety Recommendation A-14-18 to the NWS) that specifically addresses the potential for and existence of mountain wave activity and its associated aviation weather hazards. (A-14-14) In cooperation with the [NWS], revise the Interagency Agreement between the [FAA] and the National Oceanic and Atmospheric Administration/NWS for the center weather service units (CWSU) and its accompanying statement of work if needed to add the new responsibilities of CWSU personnel in response to Safety Recommendations A-14-17 and/or A-14-18 to the NWS, which are in addition to the other responsibilities currently performed by the NWS under this agreement. (A-14-15) Include center weather advisories in the suite of products available to pilots via the flight information services-broadcast data link. (A-14-16) The NTSB also recommended that the NWS do the following: Modify [NWS] aviation weather products to make them consistent with NWS nonaviation-specific advisory products when applicable, so that they advise of hazardous conditions including aviation hazards less than 3,000 square miles in area that exist outside of terminal aerodrome forecast coverage areas. (A-14-17) Provide a primary aviation weather product that specifically addresses both the potential for and the existence of mountain wave activity and the associated aviation weather hazards (as recommended in Safety Recommendation A-14-14 to the [FAA]). (A-14-18) In cooperation with the [FAA], revise the Interagency Agreement between the FAA and the National Oceanic and Atmospheric Administration/[NWS] for the [CWSUs] and its accompanying statement of work if needed to add the new responsibilities of CWSU personnel in response to Safety Recommendations A-14-17 and/or A-14-18 to the NWS, which are in addition to the other responsibilities currently performed by the NWS under this agreement. (A-14-19) Establish a protocol that will enhance communication among meteorologists at the [CWSUs], the Aviation Weather Center, and, as applicable, other [NWS] facilities to ensure mutual situation awareness of critical aviation weather data among meteorologists at those facilities. (A-14-20) Establish standardized guidance for all [NWS] aviation weather forecasters on the weighting of information reported in pilot reports (PIREPs) that will (1) promote consistent determination of hazard severity reported in a PIREP and (2) assist in aviation weather product issuance. (A-14-21)

NTSB Aircraft Accident Report 44 The NTSB notes that, at the time that the safety recommendations were issued, the NWS in Alaska was already working to address consistency among weather advisory products in Alaska. The FAA replied on July 24, 2014, and the NWS replied on July 29, 2014. Both organizations stated that they were working together to take the actions recommended. On September 16, 2014, Safety Recommendations A-14-13 through -16 were classified “Open— Acceptable Response,” and, on September 26, 2014, Safety Recommendations A-14-17 through -21 were classified “Open—Acceptable Response.”

NTSB Aircraft Accident Report 45

1. Analysis
2. 1 General
3. 1.1 Pilot Qualifications and Fitness for Duty

The pilot had substantial experience flying helicopters and flying SAR missions for Alaska DPS. All of the pilot’s SAR missions were flown under VFR, and he had a significant amount of NVG experience. However, he had received no formal NVG training while employed by Alaska DPS. (NVG training is discussed further in section 2.4.2.) The pilot had relatively little instrument flying experience, and he was not current for instrument flight. His most recent instrument helicopter flight was logged in 1986, and he had received no instrument training within the past decade. Toxicological tests were negative for impairing substances, and images from the onboard recorder provided no indication that the pilot experienced any medical impairment or incapacitation during the flight. Information about the pilot’s recent activities provides no indication of sleep restriction or circadian disruption in previous days. Further, the accident occurred well before the period of the circadian trough (when alertness is lowest), so it is unlikely the pilot was fatigued. The pilot spent about an hour on the ground with the trooper between flights, during which time the two men searched for and retrieved the snowmobiler in deep snow. This entailed physical activity and exposure to cold, wet weather. However, the pilot and helicopter were equipped with a wide range of outdoor gear, and evidence suggests that the pilot and trooper used the snowmobiler’s snowmobile to transport him to the helicopter. Thus, it is also unlikely that the pilot’s performance was degraded as a result of his participation in the ground phase of the SAR mission. The NTSB concludes that the pilot was qualified to fly SAR missions in VMC (but not IMC) in the accident helicopter, and his performance was unlikely affected by medical factors, fatigue, or physical activities associated with the ground portion of the rescue activity. 2.1.2 Helicopter Maintenance and Wreckage Examinations Although some acquaintances of the pilot reported that he had voiced concerns about the helicopter’s maintenance, some of these same people also noted that they thought that he would not fly the helicopter if he believed it to be unsafe. Alaska DPS personnel stated that the pilot and the helicopter’s mechanic were often in disagreement about issues such as how the helicopter should be maintained and how long repairs should take. A review of the helicopter’s maintenance records found that it was maintained in accordance with applicable regulations and Eurocopter’s maintenance procedures. A review of the helicopter logbook for the 30 days before the accident revealed that all maintenance write-ups had been cleared and that there were no open or deferred items. Although the pilot was known to intentionally disable the turn-and-bank indicator by pulling its circuit breaker, the reason he did this is uncertain (thus, it is unknown if there was a problem with the instrument).

NTSB Aircraft Accident Report 46 The wreckage examinations found no anomalies with the flight controls and no characteristics that were inconsistent with impact damage and exposure to postcrash fire. Examination of the input pinion slippage mark found that the amount of offset in the torqueing (tightening direction) was consistent with significant power at the time the main rotor system struck the ground and stopped. In addition, images from the Appareo unit showed no instrument readings or system status lights (from the master caution warning panel) that would indicate problems with the helicopter’s engine or systems during the accident flight. The image information provided confirmation that the helicopter was responding to the pilot’s control inputs and that the engine was providing torque to the rotor drive system; for example, an engine power increase (determined from engine instrument readings) correlated with the helicopter’s climb. Additional investigative benefits of the onboard recording system are discussed in section 2.7. The NTSB concludes that the in-flight image recording and wreckage examinations showed that the helicopter and its engine were operating normally throughout the flight. No mechanical abnormalities with the helicopter were identified. 2.1.3 Weather Conditions It is not known what weather resources the pilot consulted for the flight; the information that would have been available to him and its potential effect on his flight planning are discussed in section 2.3.1. A review of the available weather information found that the environment would have been conducive for rain and snow shower activity, with reduced visibilities in heavy rain or snow environments. TKA reported light rain and ceilings varying between VFR and IFR conditions in the 2 hours before the accident with the changeover to snow occurring at 2312, as reported in the 2314 METAR observation. Weather radar images depicted a line of showers moving northward from PAQ through TKA during the accident time. Also, the mountainous terrain in and around the accident site would have acted to enhance any vertical motion associated with the shower activity and help increase the strength of the showers; thus, worse surface conditions than were observed at PAQ would have been expected at TKA and the accident site. Based on the various weather observations and the nearby witness reports of light rain, sleet, and snow, moderate or worse icing would have been likely in the vicinity of the accident site. Although the cockpit image recording showed no evidence that it was snowing at the remote landing site at the time that the helicopter departed (blowing snow, if present, should have been visible), rain and sleet were likely present. The NTSB concludes that, soon after departure from the remote landing site, the helicopter likely encountered IMC, which included low clouds, heavy snow, and near-zero-visibility conditions. The presence of sleet would also increase the likelihood of icing conditions above the surface. Although encounters with such icing conditions can adversely affect helicopter performance, the review of image data from the Appareo unit revealed no evidence of an abnormal engine power reduction (as could occur with engine induction icing) or requirements for more power to maintain flight (as could occur with the gradual accumulation of structural icing). Therefore, the NTSB concludes that, although icing conditions were likely present during the accident flight, the performance of the helicopter does not appear to have been degraded at the time of the accident.

NTSB Aircraft Accident Report 47 Although the 2137 TAF for TKA forecasted a ceiling less than 1,000 ft agl at the airport, an updated FA for the area surrounding TKA referencing a forecast for IFR conditions was not issued, and there was no AIRMET issued for IFR conditions. Typically, these weather information products should be consistent with each other with regard to references to IFR conditions (as discussed in section 1.9.3); the omission of the AIRMET from the FA would also be reflected in the graphical depictions of AIRMETs on the AAWU website. In this accident, because the pilot was already en route at 2137 (when the TKA TAF was issued), it is unlikely that this inconsistency in weather information products had any effect on his decision-making. 2.2 Accident Flight The helicopter departed about 2313, and the flight lasted only about 7 min before it crashed in a wooded area about 3 mi south of the remote landing site. According to images from the Appareo unit, the pilot used his NVGs during the entire flight and had configured the Garmin 296 GPS, which was in the “track up” orientation, to show a magenta course line that extended southwest on the map display. The pilot did not make any adjustments to the Garmin 430 GPS unit (including not slaving it to the HSI) or the Avalex system, and the turn-and-bank indicator remained disabled for the flight. Three min after takeoff, the trooper radioed the dispatcher that the helicopter was en route back to Sunshine, and he requested that an ambulance meet the flight to receive the hypothermic snowmobiler. No further radio communications were received from the flight. After takeoff, the pilot initially climbed the helicopter to an altitude of about 700 ft msl (about 250 ft agl in that area) and flew it southwest for about 1 min at a 60-knot groundspeed then southeast for about 1 min. This course allowed the pilot to fly around a 1,000-ft-high hill while remaining below the cloud ceiling. At times, the helicopter slowed to about 20 knots and flew as low as about 100 ft agl. The helicopter’s subsequent climb and acceleration over the Intertie, followed by its descent to less than 100 ft agl, deceleration to ground speeds as low as 27 knots, and circuitous route through a cluster of hills near the accident location indicate that the pilot likely encountered deteriorating weather conditions and responded by flying the helicopter closer to trees and terrain in an effort to maintain external visual references. As discussed previously, however, the helicopter likely encountered very low clouds and near-zero visibility conditions near the accident site, and these conditions likely degraded the pilot’s NVG image to the point where continued flight under VFR was impossible. The pilot was using a lip light throughout the accident flight, and this light was directed at knobs and buttons on the instrument panel when the pilot manipulated them. In addition, the movement of the lip light beam was suggestive of purposeful scanning inside the cockpit. Although it was not possible to determine when the pilot was looking through his NVGs rather than below them at the instrument panel, and, although it was not possible to determine where the pilot was looking within the beam of light when it was directed at a particular area of the instrument panel, the absence of the beam from the primary flight instruments was indicative of periods when he was not closely attending to them. Thus, the lip light provided some indication of the pilot’s visual attention inside the cockpit.

NTSB Aircraft Accident Report 48 About 3 min into the flight, as the pilot encountered deteriorating weather and rising terrain, the pattern of the pilot’s lip light movement changed. Whereas the light had been frequently on and off the instrument panel, it was now lingering in other locations, primarily the lower right portion of the cockpit where the Garmin 296 was mounted. During the period that this was occurring, the helicopter’s indicated airspeed dropped from about 60 to 25 knots, and the helicopter slowly climbed from about 100 to 200 ft agl. (By comparison, the minimum airspeed for IFR flight in comparable IFR-equipped helicopters ranges from 40 to 55 knots.56) This indicates that the pilot’s attention was directed away from the primary flight instruments just before the attempted transition to IFR flight and that the helicopter slowed down during this time, making it less stable and more difficult to control in IMC. After the pilot finished attending to the Garmin 296, the beam of the lip light resumed frequent coverage of the primary flight instruments, and the pilot initiated the rapid climb. This maneuver was not necessary to clear any immediate obstacle threat, but it was consistent with a contingency plan for escaping zero-visibility conditions that the pilot had previously discussed with the AMRG observer. Therefore, the NTSB concludes that the pilot experienced a total loss of external visual references while operating in close proximity to terrain, which led him to attempt to transition to instrument flight. During the climb, which was executed with little forward airspeed, the helicopter turned rapidly to the left. Although it is possible that the pilot initiated the turn (either to try to escape the IMC or because he was aware of a 1,000-foot hill ahead along the original flightpath), it is also possible that the left turn simply resulted from the pilot not applying enough right antitorque pedal to counter the increased torque that accompanied his application of climb power. As the helicopter turned away from its previous direction of travel, the magenta course line on the Garmin 296 rotated out of sight at the bottom of the unit’s display screen. Shortly after this occurred, the pilot adjusted the knob on the HSI so that the CDI needle was aligned with a heading that pointed in the direction the helicopter had come from. The pilot, however, did not take any action to halt the turn when the helicopter was pointing in the opposite direction. Rather, the rapid left turn continued without pause. Thus, the turn may or may not have been intentional, and the pilot may or may not have been attempting to reverse course. Regardless, the pilot likely manipulated the knob on the HSI (which was rapidly spinning) to provide a course reference that would aid his navigation. Thus, the pilot was attending to a navigational task during the attempted transition to instrument flight, and this introduced some distraction from primary control tasks that were already quite challenging, given the helicopter’s low speed and the encounter with IMC. About 17 seconds after the pilot adjusted the CDI, the trooper pointed at the Avalex display, possibly attempting to assist the pilot’s navigation. Seconds after that, the helicopter entered an uncoordinated maneuver, yawing left, rolling right, and pitching up as the pilot made frequent inputs on the controls. A 2011 simulator study of helicopter pilot performance during inadvertent flight into IMC found that such episodes were marked by increased workload, as evidenced by pitch and

56 According to the flight limitations section of their corresponding flight manuals, the minimum speed for IFR flight for the Agusta A-109C, Bell 430, and AS-355 helicopters is 40, 40, and 55 knots, respectively.

NTSB Aircraft Accident Report 49 bank angle oscillations of increasing amplitude and higher-frequency, higher-amplitude cyclic control inputs (Krognale and Krebs 2011). Both of these features were apparent during the pilot’s climbing turn, suggesting that, during the pilot’s attempted transition to instrument flight, he experienced operational distractions, task saturation, and difficulties with aircraft control. These difficulties may have been exacerbated by spatial disorientation, which is an inaccurate perception of one’s own orientation and direction of motion that can result from the vestibular sensations that accompany maneuvering flight in zero-visibility conditions. Several seconds later (at 2318:40), with the helicopter at high pitch and roll angles, the pilot pulled a knob on the instrument panel to cage the attitude indicator (which sets it to display a level flight attitude). Caging an attitude indicator is meant to be performed only when an aircraft is in a level flight attitude, such as on the ground or in straight-and-level, unaccelerated flight. As an experienced pilot and mechanic, he would have understood the conditions under which the attitude indicator could be safely caged. Therefore, the NTSB concludes that the pilot’s action to cage the attitude indicator outside those conditions under which it could be safely caged indicates that he distrusted the information he was seeing. (Possible reasons for this distrust are discussed in section 2.6.) By caging the attitude indicator while the helicopter was at high pitch and roll angles, the pilot caused the instrument to provide erroneous attitude indications that would be difficult to ignore in a high-stress situation. With external visual references gone and the attitude indicator providing erroneous, misleading information, the pilot’s only possibility of maintaining control lay in using alternative forms of attitude information from other flight instruments. During instrument helicopter training, which the pilot had completed many years earlier, he was trained in partial-panel techniques, including using the turn-and-bank indicator as a secondary source of obtaining information about the helicopter’s bank attitude. However, the turn-and-bank indicator was inoperative during the accident mission because the pilot had previously disabled it. Thus, this source of bank information was not available to help the pilot determine the helicopter’s attitude as he tried to maintain turn-and-bank control. The absence of a functioning turn-and-bank indicator might have been moot because the pilot had minimal (0.5 hour) helicopter actual instrument flying experience, lacked helicopter instrument flying currency, and had no recent instrument training. Therefore, it is unlikely that he would have been able to maintain control of the helicopter using partial-panel techniques during the climbing turn, even with a working turn-and-bank indicator. Research involving instrument-rated, fixed-wing pilots suggests that maintaining aircraft control following a simulated attitude instrument failure in actual instrument conditions with a working turn-and-bank indicator is extremely difficult and leads to loss of control in at least 10% of cases (Roy and Beringer 2002). The success rate for a helicopter pilot during aggressive, low-speed maneuvering in a nonIFR-certificated helicopter would likely be much lower, due to the inherently unstable nature of such helicopters (compared to IFR-equipped helicopters) and the even greater dependence of their pilots on external visual cues for maintaining helicopter control. Therefore, the NTSB concludes that the pilot’s caging of the attitude indicator made it very unlikely that he would regain control of the helicopter in IMC. The NTSB further concludes that the helicopter’s erratic maneuvers are consistent with the pilot’s spatial disorientation, a loss of control in flight, and his inability to recover the helicopter because of his lack of instrument experience and the lack of accurate attitude information.

NTSB Aircraft Accident Report 50 2.3 Pilot’s Risk Management Considerations 2.3.1 Decision to Accept Mission The pilot did not call a flight service specialist for a weather briefing, and the investigation was unable to determine which weather information sources the pilot may have examined before deciding to accept the mission. Based on the available weather information products and the standard services provided by a qualified weather briefer, it is likely that, had the pilot called for a briefing at the time that he was notified of the mission, the briefer would have informed the pilot about the radar-depicted line of light-to-moderate echoes that was moving toward TKA. A review of the typical sources used by Alaska DPS pilots revealed that the FA forecasted visibilities as low as 4 mi in places that included the search area with isolated rain and snow showers, and the TKA TAF issued at 2008 forecasted a cloud ceiling of 1,000 ft agl at the airport. Because the search area was only about 5 nautical mi east of TKA, the pilot likely checked the TKA TAF, and this should have alerted him to the possibility of ceilings in the search area between 350 and 950 ft agl (terrain elevations in the search area ranged from about 400 to 1,000 feet msl). Low night VFR lighting conditions existed for the accident flight, which the pilot could have determined based on the times of sunset and moonrise, the overcast clouds, and the lack of ground lighting in the search area. Low lighting conditions can have a profound effect on the safety of helicopter night VFR operations by compromising a pilot’s ability to maintain visual contact with the horizon and to see and avoid clouds, obstacles, and terrain.57 Alaska DPS did not apply across-the-board VFR weather minimums to its helicopter pilots. Some personnel indicated that the pilots had individual weather minimums that may be changed based on experience, whereas other personnel stated that pilots were expected to comply only with the FAA requirements to remain clear of clouds. However, Alaska DPS had minimums on file for the accident pilot. A form dated 2003 indicated that the pilot’s night VFR NVG weather minimums were a 500-ft ceiling and 2-mi visibility, and the pilot indicated in a 2009 e- mail to a colleague that his personal minimums for night NVG operations were a 200-ft ceiling and 5-mi visibility. Therefore, the NTSB concludes that, when the pilot was contacted about the mission, forecasts indicated that conditions in the search area would be IFR and that forecast cloud ceilings and visibility would likely be below the pilot’s Alaska DPS weather minimums and possibly below his last known personal weather minimums. The risk of helicopter night VFR operations can be mitigated by use of NVGs, which the pilot used routinely. However, NVGs have a number of limitations, including a reduced field of

57Section 10-2-2, “Helicopter Night VFR Operations,” in the Aeronautical Information Manual states, in part, “Even in conditions in which visibility and ceiling are determined to be visual meteorological conditions, the ability to discern unlighted or low contrast objects and terrain at night may be compromised. The ability to discern these objects and terrain is the seeing condition, and is related to the amount of natural and man-made lighting available, and the contrast, reflectivity, and texture of surface terrain and obstruction features. In order to conduct operations safely, seeing conditions must be accounted for in the planning and execution of night VFR operations.”

NTSB Aircraft Accident Report 51 view, reduced image resolution, and the presence of digital noise. Low lighting conditions can result in a lower contrast NVG image and increased digital noise. Such images are more difficult to interpret and may cause a tendency to fly lower in an effort to improve image quality. The presence of meteorological obscurants like rain or snow has the potential to further degrade NVG image quality. The effect of precipitation on image quality can be unpredictable and can change with the nature and intensity of the precipitation. Thus, meteorological and astronomical forecasts that included low light, rain, and snow indicated the potential for degraded NVG effectiveness and increased risk of an inadvertent encounter with IMC. Therefore, the NTSB concludes that, at the time the pilot was notified about the stranded snowmobiler, sufficient information was available to indicate that the mission carried a high degree of risk due to the weather and low lighting conditions. The investigation revealed no evidence that Alaska DPS managers ever pressured the pilot to accept or complete a flight. Thus, it does not appear that the pilot was subjected to any direct management pressure to accept or continue SAR missions. However, the pilot was described as having exceptionally high motivation for flying-related tasks, and he took great pains to make sure that he and the helicopter were always available for any DPS missions. He had frequent conflicts with maintenance personnel over the timeliness of required maintenance and rarely took time off because he did not want to miss opportunities for flying. The pilot reportedly enjoyed flying the helicopter and had achieved a high level of VFR helicopter flying proficiency. Putting this skill to use likely provided some intrinsic satisfaction. The pilot’s spouse said that the pilot was very close to his own family, and he appreciated being able to bring other people safely back to theirs. In addition, records indicate that the pilot had received a great deal of public recognition for past rescues. His personnel file contained many heartfelt letters of thanks from people he had rescued, and he had received several high-profile awards. In addition, a substantial amount of the pilot’s income came from being on call and flying missions outside of his scheduled work hours. Colleagues and supervisors said that the pilot was very sensitive to any changes in aircraft section operating policies that could reduce his pay, such as reducing his standby time by using the relief pilot. The relief pilot said that the pilot feared being replaced if other pilots were allowed to fly more missions. As a result of these multiple sources of motivation, the pilot carefully guarded his role as the helicopter’s primary pilot. The pilot’s exceptionally high motivation likely produced significant internal pressure to accept and complete missions, and this motivation stemmed from multiple factors, such as his awareness of the dire situations faced by the people he rescued, the way that his pay was structured, and the way that he had been rewarded for completing previous high-risk SAR missions. Thus, the NTSB concludes that the pilot’s exceptionally high motivation for conducting SAR missions, which was influenced by multiple factors, likely played a part in his acceptance of the accident mission. 2.3.2 Preparations for Departure After spending about 1 hour on the ground to assist the snowmobiler and transport him to the helicopter, the pilot had to decide whether to take off again. As mentioned previously, light rain and sleet were likely present at the time of departure. The pilot’s PED showed that he did not use that device to call for a weather update before departing the remote landing site; however, it is uncertain whether cellular service was available to do so. At the time, TKA was

NTSB Aircraft Accident Report 52 reporting a changeover from rain to snow. This information about observed snow nearby would have been available to the pilot via the radio on the TKA weather automated surface observing system (ASOS) frequency (and by phone). It is not known if the pilot could have received the TKA ASOS via the radio on the ground; however, in-flight capability was likely. The pilot’s only other preflight means of assessing the ceiling, visibility, and obscuring precipitation was by visual inspection of the surrounding area from the ground. However, it was dark and the remote landing site was in a low-lying area surrounded by trees, so the pilot’s ability to visually assess the weather conditions from the ground was probably limited. After starting the helicopter, the pilot configured the Garmin 296 GPS so that it displayed a magenta course line that extended southwest on the map display. The AMRG observer who often flew with the pilot said that the pilot preferred using only the Garmin 296 for navigation. The relief pilot said he also preferred using the Garmin 296 because its position in the cockpit allowed him to easily glance down under his NVGs to see the display in flight. A disadvantage of using the Garmin 296 (as opposed to the Garmin 430 in the center of the panel) was that the pilot’s selected course information could not be displayed on the HSI via the CDI. In the event of an encounter with IMC, the pilot’s workload would be increased because he would have to alternate his visual attention between the lower right side of the cockpit (where the Garmin 296 was mounted) and the center of the instrument panel (where the primary instruments were located) to both navigate and maintain primary control. (Using the Garmin 430, which can be “slaved” to the HSI, enables the pilot to use the CDI to display course information for the course selected on the Garmin 430, thereby supporting a centralized instrument scan.) The pilot did not make any adjustments to the Garmin 430, which is consistent with his reported preference for the Garmin 296 and with his not configuring the unit during the previous flight from ANC. The pilot also did not make any adjustments to the Avalex system, which powered up in the “north up” orientation and with a map that showed the outlines of rivers and lakes. This is inconsistent with the pilot’s previous flight from ANC, for which he configured the Avalex to show a “track up” orientation with a topographical map displayed. It is also inconsistent with a statement made by the AMRG observer that he and the pilot had agreed that they would always ensure that the Avalex display was powered up and configured properly before takeoff in reduced visibility conditions so that it could be used to maintain awareness of nearby terrain. This could be explained, however, by the fact that the Avalex unit was normally configured and operated by an observer, but the trooper who was serving as an observer had not been trained in its use. The pilot also did not reset the circuit breaker to enable the turn-and-bank indicator, which remained disabled for the flight. The only maintenance write-up regarding a reported noise problem with the instrument occurred 9 years ago. Alaska DPS personnel could not say with certainty why the pilot disabled the instrument. Although Alaska DPS sometimes used trained observers who could operate the Garmin 430 and Avalex displays and perform tasks for the pilot like setting up navigational courses, selecting radio frequencies, or calling out terrain and obstacles, the trooper for the accident mission had not been trained to use the helicopter’s navigational equipment. Therefore, during the accident flight, the pilot configured the avionics and handled all navigational tasks himself.

NTSB Aircraft Accident Report 53 2.3.3 Decision to Continue Mission Before the accident flight, when the pilot first arrived in the search area about 2200, he flew the helicopter between 1,100 and 1,200 ft msl, which suggests that the cloud ceiling was at least 650 to 750 ft agl about the time that he landed at the remote rescue location. However, the altitude that the pilot initially flew during the accident flight was about 700 ft msl (250 ft agl), suggesting that the cloud ceiling and/or visibility in the area had deteriorated significantly during the time the helicopter was on the ground. In addition, weather information and witness reports indicate a strong possibility of icing. The safest course of action at this point was to perform a precautionary landing. An examination of the terrain along the helicopter’s ground track identified several open areas that could have served as emergency landing areas for the helicopter. However, due to the changing precipitation and low lighting conditions, it is uncertain whether the pilot could see these potential landing areas well enough to determine whether they were suitable for landing. Although it is possible that the condition of the snowmobiler created a sense of urgency that prompted the pilot to push on in deteriorating conditions, there is insufficient evidence about the seriousness of the snowmobiler’s medical condition to know how it might have been perceived by the pilot and flight observer. Although the flight observer reported to a dispatcher that the snowmobiler was hypothermic, he did not communicate any detailed information about the snowmobiler’s condition, and hypothermia cases can range from mild to severe. A factor that likely influenced the pilot’s continued VFR flight in deteriorating weather was his high motivation for performing missions and accomplishing rescues. Although the pilot was described by colleagues as being very safety oriented, the aircraft section commander had expressed concern to the pilot about the riskiness of some flights, and the pilot had responded that he agreed to do such things when he was hired and planned to continue doing them. As a result of his conversations with the pilot, the aircraft section commander said he believed the pilot appreciated the hazards associated with risky decisions but that he felt a self-imposed obligation to take certain risks to accomplish rescues. Another factor that likely influenced the pilot’s continued VFR flight into deteriorating weather was an increased tolerance for risk as a result of successful past outcomes. Although the pilot had experienced a takeoff accident 7 years earlier involving white-out conditions and loss of visibility from snowfall and snow on the ground that billowed up in the rotor wash, he had not experienced any other accidents since, despite conducting additional missions that often involved high-risk activities, such as maneuvering through areas of poor weather at night and flying inches above fast-moving bore tides. The success of these past missions, particularly those involving poor weather, likely increased the pilot’s confidence that he could safely continue VFR flight at night in marginal weather conditions. A precautionary landing would have stranded the pilot, trooper, and hypothermic snowmobiler in an uncomfortable (but probably survivable) situation until the weather improved

NTSB Aircraft Accident Report 54 or ground resources could assist them.58 Executing a landing in the dark, reduced-visibility conditions in an unfamiliar clearing with heavy snow on the ground might also damage the helicopter. Continuing VFR flight, on the other hand, increased the pilot’s risk of experiencing a weather-related accident, but the risk of this type of accident probably seemed remote to the pilot, given his past experience. Thus, the pilot had to choose between two undesirable alternatives: one that involved a high perceived likelihood of inconvenience and possible helicopter damage and another that involved a low perceived likelihood of a serious accident. The pilot chose the latter option, and the risk of a serious accident was realized. The NTSB concludes that the pilot’s exceptionally high motivation for SAR missions and past successes likely increased his risk tolerance and influenced his decision to continue flying in deteriorating weather conditions and risk a weather-related accident rather than accept the certain inconveniences and potential hazards associated with a precautionary landing. 2.4 Organizational Issues 2.4.1 Risk Assessment The accident helicopter was a single-engine, nonIFR-certified platform and was crewed by a single pilot who was not instrument-current and had NVGs. This meant that the equipment/crew pairing was capable of operating in dark night VMC conditions but not in IMC. Inadvertent encounters with IMC would result in a high risk. One prudent organizational strategy for managing this risk should have entailed establishing minimum VFR weather requirements that provide some degree of separation between the helicopter and weather conditions that could obscure a pilot’s view of the natural horizon, with or without NVGs. However, as discussed previously, the Alaska DPS did not apply across-the-board VFR weather minimums to its helicopter pilots, other than FAA requirements. The Part 91 regulations that applied to Alaska DPS flights required only that the helicopter be operated clear of clouds below 1,200 ft. In contrast, for HEMS operations conducted under Part 135, the FAA established NVG weather minimums. These minimums, which are part of a HEMS-specific operations specification, range from an 800-ft ceiling and 3-mi visibility for a local flight in nonmountainous terrain to a 1,000-ft ceiling and 5-mi visibility for cross-country flights in mountainous terrain. Neither the pilot’s stated personal weather minimums for night NVG VFR helicopter operation (200 ft and 5-mi visibility) nor the minimums that Alaska DPS had on file for him (500 ft and 2-mi visibility) provided an adequate safety margin for the night SAR mission, particularly considering the adverse effects of precipitation and low light on both NVG image quality and the pilot’s ability to see and avoid clouds. The pilot’s lack of instrument currency and actual instrument experience in helicopters, as well as the helicopter’s VFR-only platform, further increased the risk. The pilot was not required to complete any standardized preflight risk assessment process, either before accepting a mission or while conducting a mission to help evaluate risk as new variables (such as deteriorating weather conditions) were introduced. In addition, Alaska

58 Although the outside air temperature was near freezing, survival gear reported to be on board the helicopter included sleeping bags, and the cabin heater could be used when the helicopter’s engine was running.

NTSB Aircraft Accident Report 55 DPS did not ensure that anyone with suitable aviation expertise other than the accident pilot was overseeing the go/no-go decision for each mission. Although an Alaska DPS SAR coordinator was required to authorize every mission for the accident helicopter, the SAR coordinator generally was not involved in weather-related decision-making. The SAR coordinator who authorized the accident mission was a low-time (about 150 hours of flight experience), fixed-wing pilot who had no helicopter experience. He did not discuss weather conditions with the pilot, and he said that he and the other Alaska DPS SAR coordinators normally relied on the pilots to decide whether it was appropriate for them to accept a mission. The accident pilot was not required to fill out any kind of operational risk form, and no Alaska DPS supervisor or manager was required to review or approve a pilot’s decision to accept a mission, even if a mission was determined to be high risk. As previously discussed, information available at the time the pilot was notified indicated that the mission was potentially high risk, and this risk increased during the mission as weather conditions deteriorated. One way for the Alaska DPS to mitigate the risk would be to assign two pilots or one pilot and one trained observer or TFO who could assist with aeronautical decision-making and other tasks that could ease the pilot’s workload. Alternatively, the Alaska DPS could have decided that the helicopter and pilot were not appropriate assets for this particular mission. In that case, the SAR coordinator could have organized a ground search party and, if air assets were deemed essential for the mission, referred it to the RCC. The RCC could then have requested a more appropriate platform from the Alaska Air National Guard, such as an IFR-capable HH-60 helicopter equipped with a two-pilot, IFR-trained and current crew. Although the Alaska Air National Guard was capable of flying under IFR in zero-visibility conditions, it followed Air Force training weather minimums of a 700-ft ceiling and 2-mi visibility for night NVG flights (a more conservative ceiling minimum than the accident pilot’s), so its pilots might have deferred the mission as well. In this case, the pilot was not required to perform a formal, systematic risk assessment before or during the mission, and no one else assisted the pilot in evaluating mission-related risk. Thus, the NTSB concludes that the Alaska DPS lacked organizational policies and procedures to ensure that operational risk was appropriately managed, such as formal pilot weather minimums, preflight risk assessment forms, or secondary assessment by another qualified person trained in helicopter flight operations that would have encouraged the pilot to decline the mission or take steps to mitigate weather-related risks. The development of formal risk assessment procedures and the involvement of another qualified helicopter SAR professional who is one step removed from the launch decision (similar to the procedures the NTSB has previously recommended for HEMS operators) could help Alaska DPS pilots systematically identify hazards and ensure that launch decisions are appropriate, any hazards are appropriately mitigated before the start of a mission, and the hazards are continuously evaluated as the mission progresses. Alaska DPS has made some progress since the accident by implementing the use of formal risk assessments for every helicopter mission. These measures are important improvements that can help enhance the safety of DPS flight operations. The NTSB, however, is concerned that these efforts do not ensure that employees who are supporting the flight crews in the systematic evaluation of flight risks are adequately trained and knowledgeable about aviation

NTSB Aircraft Accident Report 56 operations. Therefore, the NTSB recommends that the state of Alaska develop and implement a flight risk evaluation program that includes training for all employees involved in the operation and procedures that support the systematic evaluation of flight risks and consultation with others trained in flight operations if the risks reach a predefined level. In addition, although the MatCom dispatchers who were communicating with the accident flight were highly trained and capable of precisely tracking AST ground vehicle operations, they were not trained in aviation operations, did not handle aircraft flight plans, and could not provide up-to-date weather information or assist with other flight-risk assessment tasks. The Alaska DPS has taken measures since the accident to equip most aircraft with flight-tracking capability and to provide for flight-following using the RCC, MatCom, and authorized supervisors. The NTSB concludes that the Alaska DPS’s reliance on nonaviation-trained dispatchers for dispatch and flight-following support does not ensure that flight crews have adequate access to up-to-date weather information and qualified assistance with flight risk assessment tasks. For example, although it is unknown if the pilot had cell coverage at the remote landing site to call for updated weather information, the flight made radio contact with dispatch 3 min after departure. Had the pilot or the flight observer been communicating with an aviation-trained dispatcher dedicated to providing up-to-date weather information, flight-following, and assisting with other flight risk assessment tasks, it is possible that such a resource would have been aware that the weather conditions observed at TKA included a changeover to snow occurring at 2312 as reported in the 2314 special METAR and notified the flight, which had just departed. Also, the delays that occurred between the time that the helicopter crashed and when someone noticed that it was missing, and the difficulties in the passdown of accurate information on its status and its whereabouts, could have had severe consequences had there been survivors awaiting help. Therefore, the NTSB recommends that the state of Alaska use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance with flight risk assessment decisions. 2.4.2 Pilot Training Although the FAA requires certain commercial operators to receive FAA approval before conducting NVG operations, the Alaska DPS, as a public aircraft operator, was not subject to such requirements and did not have a formal NVG training program. The former relief pilot for the accident helicopter said that the accident pilot was the only person he had “ever qualified within the department to fly goggles and that was based on his previous military NVG qualification.” Investigators could find no record that the pilot received formal NVG training in the military. Formal NVG training emphasizes the limits of NVG capability, including the sudden and unpredictable effects that precipitation can have on NVG image quality and the tendency to fly lower when NVG images degrade. The pilot’s personal weather minimums and his actions during the accident flight suggest a lack of awareness or appreciation of these hazards. This might have been rectified through completion of a comprehensive NVG training course. The pilot’s accident in 2006 occurred while he was using NVGs, and a goal listed on his January 2010 performance evaluation was to update his training in the NVG environment by attending a commercial initial NVG course. However, the pilot’s 2011 performance evaluation indicated that this goal was reconsidered due to the cost of the course.

NTSB Aircraft Accident Report 57 The NTSB concludes that the Alaska DPS did not provide the pilot with training that could have helped him recognize the hazards that precipitation and low light conditions pose to NVG operations. Such training could improve safety, for the reasons discussed above, particularly for helicopter SAR operations. Further, such training is available from commercial vendors. The Alaska DPS reported that it has suspended NVG operations until a formal training program is implemented. Therefore, the NTSB recommends that the state of Alaska provide all pilots who will perform NVG operations with formal NVG ground and flight training and require them to complete this training on an annual basis to remain on flight status. The pilot also had not received any IFR helicopter training from Alaska DPS, and he was not IFR-current in the helicopter. In addition, he had not received simulator training on strategies and techniques for recognizing, avoiding, and escaping inadvertent encounters with IMC. This lack of training was problematic for an operation without conservative weather minimums where operations at night and in close proximity to clouds greatly increased the risk of inadvertent encounters with IMC. Research indicates that inadvertent IMC training can improve pilot control and increase the likelihood of surviving such encounters. Such training might have recalibrated the pilot’s risk tolerance for situations involving continued VFR flight in IFR conditions, motivated him to avoid them, and helped him to maintain control of the helicopter in the event of an inadvertent encounter with IMC. The NTSB investigated a previous accident in which a state law enforcement helicopter pilot lost control of a helicopter operated by the NMSP after inadvertently encountering IMC and was unable to safely escape the conditions. That pilot was not instrument qualified in helicopters. The NTSB concludes that pilots involved in SAR missions could benefit from initial and recurrent training on how to recognize, avoid, and safely recover from inadvertent flight into IMC. Although the Alaska DPS informed NTSB investigators that, since the accident, all of its active AS350 helicopter pilots attended inadvertent IMC training, its plans for ensuring ongoing training were unclear. Therefore, the NTSB recommends that the state of Alaska require all pilots who perform state law enforcement SAR missions to receive, on an annual basis, scenario-based simulator training in inadvertent IMC that includes strategies for recognizing, avoiding, and safely escaping the conditions. In the course of this investigation, investigators had difficulty identifying research validating the effectiveness of currently available commercial helicopter inadvertent IMC training programs or identifying guidelines on best practices for helicopter inadvertent IMC training programs. For example, the FAA’s Helicopter Instructor’s Handbook does not include any information on inadvertent IMC training. Feedback received from the Alaska DPS since the accident indicates that DPS pilots who participated in an inadvertent IMC training program (through a commercial vendor) had questions about its effectiveness. The NTSB concludes that operators lack adequate information about best practices for helicopter inadvertent IMC training. Beginning in 2015, helicopter inadvertent IMC training will be required for all helicopter pilots conducting operations under Part 135. It is essential that the effectiveness of this training be evaluated and that the most effective strategies for conducting such training be identified. Therefore, the NTSB recommends that the FAA work with operators, training providers, and industry groups to evaluate the effectiveness of current training programs for helicopter pilots in inadvertent IMC, and develop and publish best practices for such training.

NTSB Aircraft Accident Report 58 2.4.3 Use of Trained Observers The AMRG volunteer who often flew with the pilot was unavailable on the day of the accident. When flying with the accident pilot, he typically would have operated the Garmin 430 and Avalex displays and performed other tasks, including setting up navigational courses, selecting radio frequencies, resetting the circuit breaker to enable the turn-and-bank indicator, or calling out terrain and obstacles. Current and former relief pilots for the accident helicopter said that they liked to have a trained observer in the left seat to operate the Garmin 430 and Avalex for them, especially when flying at night using NVGs. The AMRG volunteer also had been trained to use NVGs and, if he had been with the pilot, likely would have been wearing NVGs. This would have been an additional person who could have helped to assess weather conditions and maintain visual contact with the ground. Operating the Garmin 430 and Avalex display requires significant training and familiarization. The trooper who was on the accident mission had no such exposure and, therefore, could not assist the pilot with such tasks. Also, the trooper was not trained on or equipped with NVGs; thus, he would not have been able to maintain visual contact with the ground or help visually identify obstacles. As discussed previously, the pilot had to handle all navigational tasks himself during the accident flight, and he did not optimally configure the helicopter’s navigational equipment and flight instruments before departure. A second crewmember trained in the use of the helicopter’s navigational and communications systems could have assisted with operating the systems and performing other flight-related tasks. This could have reduced the pilot’s workload and, thereby, reduced his potential for distraction and risk of spatial disorientation, particularly during his attempted transition to instrument flight. Aside from operating the onboard equipment, a second crewmember (such as a TFO) trained in aeronautical decision-making could have assisted the pilot by helping him obtain updated weather information on the ground or in the air, encouraging him to defer his departure from the remote landing site, or urging him to land when the helicopter encountered extremely low ceilings and visibility. A TFO could also evaluate other courses of action such as choosing a route over lower terrain, which may have been free from clouds or afforded more emergency landing opportunities. Thus, the pilot’s decision-making could have been enhanced during the accident flight through the support of a trained observer or TFO. Therefore, the NTSB concludes that a TFO who was capable of assisting the pilot with aeronautical decision-making and operating the helicopter’s navigational systems and displays could have helped mitigate risk. The primary Alaska DPS SAR coordinator stated that the decision to use trained volunteer observers was totally up to the pilot and was based on the pilot’s personal relationships with members of the volunteer SAR community. The former relief pilot for the helicopter said that the aircraft section had attempted to train some troopers in the use of helicopter equipment such as the FLIR but that those trained officers were often unavailable for SAR missions due to scheduling conflicts. The current aircraft section commander said he had never met any of the volunteer observers, including the AMRG observer, and was not familiar with the training they had received. A former Alaska state trooper who served as the state SAR coordinator from 2004-07 and 2010-11 said that the pilot had, with his approval, developed a TFO training program. This

NTSB Aircraft Accident Report 59 training program was designed to familiarize volunteer TFOs with the Avalex display, FLIR, spotlight, and the use of NVGs. The pilot planned to train six to eight volunteer TFOs in the hangar during his normal duty hours so that a trained observer would always be available for helicopter SAR missions. However, after the former SAR coordinator left that role in 2011, management support for the TFO training program waned and the training program faded away. Because the helicopter had a limited payload and many missions required law enforcement personnel, Alaska DPS management decided that in many cases it would be more appropriate to have the pilot pick up an on-duty state trooper rather than fly with a SAR volunteer. Commissioned troopers generally did not have the same level of training in helicopter operations as volunteer TFOs, and the former SAR coordinator believed Alaska DPS management did not adequately consider the impact of this change on operational safety. Following the accident, the Alaska DPS reported that it has reduced its SAR aircraft availability to meet the current staffing levels of the aircraft section and that it is developing a formal TFO training program. However, the NTSB notes that the pilot’s efforts to start such a program in the past were unsuccessful. The NTSB concludes that, although a TFO program had been recognized by Alaska DPS personnel as a means of improving the safety of helicopter SAR operations, inadequate support for the program at various levels of the organization led to the unavailability of a TFO or other trained observer on the day of the accident. Therefore, the NTSB recommends that the state of Alaska create a formal TFO training program that includes training on aeronautical decision-making, crew resource management, and operating aircraft navigational and communications equipment, and use TFOs during SAR operations. 2.4.4 Safety Management and Safety Culture The Alaska DPS investigations of the pilot’s previous accident and other events involving the pilot and the accident helicopter provided some insight into the organization’s approach to safety management and its underlying safety culture. During its internal review of the pilot’s accident with the helicopter in 2006, in which the pilot became disoriented when his vision became obscured by blowing snow during a night NVG takeoff from a frozen lake, the Alaska DPS cited the choice of a VFR departure versus an IFR instrument departure as causal to the accident. This determination that the accident resulted, in part, from the pilot’s decision to perform a VFR rather than an IFR takeoff, was inappropriate and failed to acknowledge critical underlying safety issues. Because the pilot was not IFR current in helicopters and the helicopter was not certificated or equipped for IFR flight, performing an IFR takeoff was not an option. Had the Alaska DPS’s investigation been more focused on identifying systemic safety issues, it may have identified that it had not provided the pilot with simulator training in IFR flying or inadvertent IMC encounters and had not imposed adequate weather minimums to maintain separation between the VFR-only operation and IMC. As a result, the Alaska DPS missed an opportunity to identify and correct some of the latent safety deficiencies that again presented themselves in the 2013 accident. Without improvements to pilot training and operational policies, the risk of another inadvertent IMC accident remained high. DPS investigations of other events also narrowly focused on the actions of the pilot while disregarding the organization’s management of flight-related risks. For example, although the

NTSB Aircraft Accident Report 60 Alaska DPS investigations of the pilot’s 2006 accident and the 2009 engine and rotor overspeed event both mentioned the pilot’s work schedule, in 2013, the pilot was still allowed to schedule himself for long workdays and extended periods without a day off.59 Thus, the Alaska DPS did not effectively manage its flight time and duty policies or evaluate the adequacy of its staffing levels to support around-the-clock, on-call SAR availability (or reduce the helicopter’s availability based on the available staff). The NTSB concludes that the Alaska DPS’s investigation and analysis of the pilot’s previous accident and other events were focused on the actions of the pilot and did not adequately identify and address systemic factors that could reduce the likelihood of a recurrence. The Alaska DPS investigations of the pilot’s aircraft accident and other events were focused on apportioning blame or liability. After a committee appointed by the AWT director completed its investigation of the pilot’s 2006 accident, the pilot received a memorandum of warning informing him that the accident was due to “pilot error,” specifically, his momentary distraction and inability to transition to instrument flight. The memorandum stressed the cost of the accident and warned the pilot that future events could lead to more severe disciplinary action. It stated, “the fact that you took responsibility for the accident and showed great remorse weighs heavily in how the department views this incident,” indicating that the pilot’s acceptance of liability was considered an important part of the investigation. The AMRG observer indicated that the pilot was concerned about losing his job in the wake of the accident. The Alaska DPS investigation of the 2009 overspeed event also focused extensively on the culpability of the pilot. Although the pilot reported that a malfunction of the fuel control had initiated the event, the former relief pilot suspected that the pilot had initiated it by moving the collective in an “aggressive manner,” and he arranged to have a captain from an outlying post lead an investigation of the incident. The AMRG observer said the pilot was again concerned about losing his job, and the pilot’s wife said that he “fought tooth and nail” to be exonerated. Physical findings from a manufacturer’s inspection of engine components suggested that a corroded fuel metering needle had frozen in place, initiating the event. However DPS officials determined the cause of the incident to be “inconclusive.” After that, the pilot felt distrustful of his colleagues in the aircraft section. According to the lead mechanic and others, the pilot felt that everybody in the organization was against him. Although the Appareo unit provided the NTSB’s investigation with valuable information (discussed in section 2.7), the Alaska DPS management had not installed it for safety-related purposes, such as image and data reviews by the safety officer to monitor the safety of flight operations.60 Around the time of the 2009 overspeed event, the AWT director suspected that the pilot had tried to conceal his role in some damage that was done to the tail rotor of a Robinson R-44 helicopter. Inspection of the tail rotor assembly indicated that the damage could have resulted from a water strike, but the pilot denied that he had experienced a water strike. The AWT director said that when the pilot was questioned about events like the overspeed or the damaged tail rotor, “it was never his fault” and there was nothing that the AWT director could do

59 Shortly before the accident, the AWT deputy director proposed that the relief pilot serve as the primary pilot for the helicopter 2 days a week to give the pilot regularly scheduled days off. However, the accident occurred before this schedule could be implemented. 60 The Alaska DPS reported in August 2014 that such reviews now occur.

NTSB Aircraft Accident Report 61 to “take sanctions” against the pilot. As a result, the AWT director told the aircraft section supervisor to research onboard monitoring equipment that could be installed in the helicopter. As a result, the AWT director learned about the Appareo recorder, and he insisted that it be purchased and installed. Thus, Alaska DPS investigations of the pilot’s past incidents and accident appeared to be punitive in nature. As a result, it appears that the pilot was motivated to conceal safety-related information. After experiencing a brief overtorque event in the helicopter in 2011, for example, the pilot inspected the helicopter, determined that costly repairs were not needed, and signed off the inspection without notifying his supervisor or the helicopter’s maintenance personnel. Maintenance technicians later discovered the pilot’s sign-off in the helicopter’s maintenance logbook, and one of them called an FAA safety hotline, prompting an FAA inspection of the helicopter’s maintenance records. Although the FAA determined that the pilot (as an airframe and powerplant mechanic) was qualified to perform and sign off the inspection, the pilot’s handling of the matter prompted a meeting between the pilot and the AWT director, as well as the issuance of a formal letter by the Alaska DPS stating that the pilot should report any similar future events to the maintenance department in a timely manner. Any organization that wishes to actively manage safety as part of an effective SMS must continuously strive to discover, understand, and mitigate the risks involved in its operations. This includes establishing a just culture in which mutually agreed principles are established to draw a clear line between acceptable and unacceptable employee behaviors and in which employees are not punished for most unintentional errors. Closely related to just culture is the concept of a reporting culture in which employees are encouraged and even incentivized to participate in the reporting of hazards. Also important is a flexible culture that is capable of adapting to shifting demands and a learning culture that fosters change as a result of information generated by SMS-related activities, including the internal review of past accidents. All of these activities can foster the open sharing of safety-related information that can be used to implement more effective strategies for mitigating related risks. However, an effective SMS requires the active engagement of front-line personnel in the reporting of operational risks and their participation in using the information obtained to develop effective risk mitigation strategies. This cannot occur if a focus of the organization’s approach to dealing with safety-related events is to punish those whose actions or inactions contributed to the event. Although front-line operators may, on rare occasions, be involved in intentional misdeeds, the majority of accidents and incidents involve unintentional errors made by well-intentioned operators who are doing their best to manage competing performance and safety goals. An organizational safety culture that encourages the adoption of an overly punitive approach to investigating safety-related events tends to discourage the open sharing of safety-related information and degrade the organization’s ability to adapt to operational risks. The Alaska DPS safety culture, which seemed to overemphasize the culpability of the pilot in his past accident and events, appears to have had this effect. The pilot had adopted a defensive posture with respect to the organization and was concealing—rather than openly sharing—safety-related information. He was largely setting his own operational limitations and making safety-related operational decisions in a vacuum, masking potential risks, such as the risk posed by his operation of helicopter NVG flights at night in low IFR conditions. This had a deleterious effect on the organization’s efforts to manage the overall safety of its SAR operations

NTSB Aircraft Accident Report 62 and hindered its ability to implement more effective strategies for mitigating related risks, such as the development of SAR prelaunch and midlaunch risk assessment protocols. Therefore, the NTSB concludes that the Alaska DPS had a punitive culture that impeded the free flow of safety-related information and impaired the organization’s ability to address underlying safety deficiencies relevant to this accident. The recently retired aircraft section supervisor identified other cultural and structural deficiencies in the organization’s approach to safety management. She told investigators that an Alaska DPS captain asked her to get the DPS involved in the Medallion Foundation and that, beginning in 2010, she devoted considerable effort to developing Alaska DPS’s SMS program in accordance with Medallion Foundation guidelines. This effort included the development of a hazard reporting system and safety committee. Although the development of these and other safety mechanisms were sufficient to earn a Medallion Foundation star, the aircraft section supervisor told investigators that the safety program lacked high-level Alaska DPS support and, as a result, there was a lack of Alaska DPS pilot confidence and participation in the program. Trooper pilots did not see the value in participating in the program and would only participate if directed to do so by their supervisors, but the recently retired aircraft section supervisor had little authority to encourage their participation. She was not a uniformed trooper, so she was not in their chain of command and trooper pilots did not report to her. Further, the chain of command for her position was modified in 2012 so that instead of reporting to a high-ranking manager (the colonel who was the AWT director), she reported to the lieutenant who served as the aircraft section commander, a lower-ranking new position. This undermined her influence as safety manager. As a result, trooper pilots and middle managers felt comfortable ignoring the safety policies that she, as safety manager, attempted to put in place. In addition, the recently retired aircraft section supervisor had very little control over the aircraft section’s budget. In 2012, for example, headquarters canceled the annual pilot safety seminar because of a lack of funds. The recently retired aircraft section supervisor said that she felt that the 3-day seminar was important because it was the only time when about 40 trooper pilots were brought together from their stations around the state to receive information about safety issues. However, she had little budgetary control and could not directly countermand this or other decisions affecting safety resources. As a result of these and other factors, she felt that the impact of the safety program on the safety of Alaska DPS aircraft operations was limited. The recently retired aircraft section supervisor said that she assumed that the aircraft section commander would take over as the manager of the safety program when she left. However, the aircraft section commander said that he was not well versed in the aircraft section supervisor’s activities in her role as safety manager. A safety policy statement posted in the main hangar that was signed by the AWT director stated, “A safety manager who is experienced in safety programs will be appointed and will have the responsibility and authority to manage the Alaska DPS aviation safety program. The safety manager should be contacted in regards to any questions or recommendations.” However, 3 months after the aircraft section supervisor’s retirement, no safety manager had been formally appointed, no safety committee meetings had been held, and the Alaska DPS safety program had effectively ceased operating. The NTSB concludes that, as a result of inadequate high-level management support, the Alaska DPS lacked

NTSB Aircraft Accident Report 63 a safety program that was capable of correcting latent deficiencies identified in this accident, including deficiencies in training and risk management. Correcting these deficiencies can be accomplished by ensuring high-level management support, dedicating sufficient resources to safety, and modifying Alaska DPS’s safety program structure, policies, and procedures so that they are in line with industry best practices and tailored to the department’s mission. Research indicates that the involvement of senior management in sponsoring and supporting safety policies and related resources is key to the continued success of organizational safety programs (Smith and others 1978; Shannon, Mayr, and Haines 1997). Through their policies and actions, senior managers also play a key role in fostering an organizational safety culture that is conducive to the development of an effective SMS. In recent years, the International Civil Aviation Organization (through its Safety Management Manual), the FAA (through its Safety Management Systems for Aviation Service Providers advisory circular), the International Helicopter Safety Team (through its Safety Management System Toolkit), ALEA (through its Safety Management System Toolkit), and the NTSB (through accident investigations and safety recommendations [NTSB 2007, 2009]) have encouraged aviation service providers to adopt SMS programs. As noted in the NTSB’s Safety Recommendation A-11-53 to the state of New Mexico, suitable guidance tailored to the needs of law enforcement agencies conducting public aircraft operations is available from organizations such as ALEA. Therefore, the NTSB recommends that the state of Alaska develop and implement a comprehensive SMS for aircraft operations that (1) holds senior state personnel accountable for the safety of state law enforcement aircraft operations, (2) is tailored to the department’s missions, and (3) is based on industry best practices. Since the accident, the Alaska DPS had a third-party maintenance audit conducted and, at the time of this report, had scheduled operation and training audits. The Alaska DPS stated that all audits include a safety component for inclusion in the safety program. The NTSB is encouraged by such progress and believes that ongoing reviews are vital to ensuring the program’s effectiveness, improvement, and success. Therefore, the NTSB recommends that the state of Alaska arrange for an audit of the SMS implemented in response to Safety Recommendation A-14-105 to be conducted every 3 years by an outside organization. 2.5 Similarities with Other Public Aircraft Operations Accidents As referenced in sections 1.9.2 and 1.9.3, the NTSB has investigated previous accidents involving state law enforcement helicopters that crashed while conducting public aircraft operations, such as during SAR or HEMS missions (as with the NMSP and Maryland State Police accidents, respectively). Because of the similarities between the safety issues identified in those accidents and this accident, the NTSB is concerned that the problems may be widespread. The NTSB concludes that all law enforcement agencies of each state, territory, and the District of Columbia that conduct public aircraft operations61 can benefit from an effective flight risk evaluation program, formalized dispatch and flight-following procedures, NVG and inadvertent

61 An NTSB review found that, at the time of this report, the law enforcement agencies of the following states and territories do not conduct public aircraft operations: Hawaii, Idaho, Rhode Island, Vermont, Wyoming, Guam, American Samoa, US Virgin Islands, and Northern Mariana Islands.

NTSB Aircraft Accident Report 64 IMC training for pilots, a formal TFO program, and a comprehensive SMS. Therefore, the NTSB recommends that, in addition to Alaska, 44 states, the Commonwealth of Puerto Rico, and the District of Columbia do the following: Develop and implement a flight risk evaluation program that includes training for all employees involved in the operation and procedures that support the systematic evaluation of flight risks and consultation with others trained in flight operations if the risks reach a predefined level. Use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance with flight risk assessment decisions. Provide all pilots who will perform NVG operations with formal NVG ground and flight training and require them to complete this training on an annual basis to remain on flight status. Require all pilots who perform state law enforcement SAR missions to receive, on an annual basis, scenario-based simulator training in inadvertent IMC that includes strategies for recognizing, avoiding, and safely escaping the conditions. Create a formal TFO training program that includes training on aeronautical decision-making, crew resource management, and operating aircraft navigational and communications equipment, and use TFOs during SAR operations. Develop and implement a comprehensive SMS for aircraft operations that (1) holds senior state personnel accountable for the safety of state law enforcement aircraft operations, (2) is tailored to the department’s missions, and (3) is based on industry best practices. Arrange for an audit of the SMS implemented in response to Safety Recommendation A-14-105 to be conducted every 3 years by an outside organization. 2.6 Attitude Indicator Limitations As discussed in section 2.2, about 40 seconds after the helicopter entered IMC, the pilot caged the attitude indicator, likely because he distrusted the information the instrument was displaying. Although the reason the pilot distrusted the information cannot be known, the investigation considered two possible explanations. One possible explanation is that the pilot might have distrusted the attitude display because he was spatially disoriented. Maneuvering flight without external visual references can lead to a variety of illusions of motion, which can result in inaccurate perceptions of an aircraft’s attitude and trajectory. A number of risk factors for spatial disorientation preceded the pilot’s operation of the caging knob. These included the pilot’s lack of instrument flying currency, the loss of external visual references, his unplanned transition to instrument flight, aggressive maneuvering, and operational distractions related to setting up the navigational instruments for

NTSB Aircraft Accident Report 65 flight in IMC. Research indicates that spatial disorientation can result in false perceptions of instrument malfunction. In a 2002 spatial disorientation survey, for example, 18% of US Air Force pilots operating rotary wing aircraft reported having experienced at least one instance of illusory instrument malfunction (Matthews and others 2002). Another possible explanation is related to the instrument’s limitations. According to information provided by the attitude indicator’s manufacturer, the AIM 1200 attitude indicator is limited to indicating ± 25° of pitch. Thus, if an aircraft were to operate at a pitch that exceeded the limitation, the pitch indicator would stop and remain at the limit until the pitch no longer exceeded the limitation. Image evidence shows that, during the first 30 seconds after the helicopter entered IMC, the pitch increased from about 0° to at least 17° nose up. Although pitch indications on the attitude indicator higher than about 17° could not be accurately measured from the cockpit images, the images show that the indicated pitch remained above 17° from 2318:28 to 2318:40. This is consistent with the attitude indicator stopping at 25° and remaining there as the helicopter continued pitching up. Although the operating manual for the AIM 1200 did not include information about the pitch indicating range limits, even if it had, and the pilot were aware of it, it is uncertain whether the pilot would have immediately understood this instrument behavior upon encountering it in a high-stress, high-workload situation. Therefore, it is possible that the helicopter’s attitude indicator reached its pitch limit and stopped moving, and the pilot interpreted this as a malfunction and instinctively attempted to “unstick” the instrument by pulling the caging knob. The AIM-1200, a model commonly installed in many airplanes and helicopters, meets the FAA’s technical standard order (TSO) for bank and pitch instruments, which requires a pitch indication range of at least ± 25°. However, the instrument’s operating manual did not note the pitch indication limits. Further, a review the FAA’s Helicopter Flying Handbook, Instrument Flying Handbook, and Pilot’s Handbook of Aeronautical Knowledge revealed that they do not inform pilots that attitude indicators have pitch and bank indication limits, that the pitch indicating range is required to be at least ± 25°, and that if an aircraft operates at a pitch that exceeds the indicating limits, the pitch indicator may stop and remain at the limit until the pitch no longer exceeds the limitation, or the pitch indicator may tumble. Further, the NTSB’s review of the information on attitude indicators in the Pilot’s Handbook of Aeronautical Knowledge revealed that it contains information on attitude indicator limitations that is unclear and may be misleading. The handbook states the following: The pitch and bank limits depend upon the make and model of the instrument. Limits in the banking plane are usually from 100° to 110°, and the pitch limits are usually from 60° to 70°. If either limit is exceeded, the instrument will tumble or spill and will give incorrect indications until realigned. It is unclear whether this passage is discussing operating limits or indicating limits. This could mislead a pilot into concluding that attitude indicators commonly have pitch indication ranges from ±60° to 70°, although the TSO requirement is only from ±25°. Further, the passage suggests that if an indication limit is reached, the instrument will tumble, rather than stop moving as the AIM-1200 does.

NTSB Aircraft Accident Report 66 Although it is uncertain whether knowledge of the attitude indicator’s limitations would have changed the pilot’s actions in this accident, the NTSB believes that it is critical for pilots to have a complete understanding of how each flight instrument functions to safely conduct flight in IMC. As stated in the FAA’s Helicopter Flying Handbook (FAA-H-8083-21A, Chapter 12, Attitude Instrument Flying, page 12-2), “when attitude instrument flying, it is crucial for the pilot to understand how a particular instrument or system functions, including its indications and limitations.” Without knowledge of the limitations of the attitude indicator, an instrument essential for maintaining aircraft control during instrument flight, pilots who encounter these limitations during a high-workload, high-stress situation may react improperly, as the accident pilot may have, by caging the attitude indicator. The NTSB concludes that because of the lack of accurate, comprehensive information about attitude indication limitations in FAA publications, such as the Helicopter Flying Handbook, Instrument Flying Handbook, and Pilot’s Handbook of Aeronautical Knowledge, pilots are likely unaware that attitude indicators have pitch indication ranges that may be limited to ± 25°. Therefore, the NTSB recommends that the FAA issue guidance to pilots explaining that attitude indicators have pitch and bank indication limits, that the pitch indicating range is required to be at least ± 25°, and that, if an aircraft operates at a pitch that exceeds the indicating limits, the pitch indicator may stop and remain at the limit until the pitch no longer exceeds the limitation, or the pitch indicator may tumble. Further, the NTSB recommends that the FAA revise the Pilot’s Handbook of Aeronautical Knowledge to clarify the information it contains on attitude indicator pitch and bank limitations to explain that attitude indicators have pitch and bank indication limits, that the pitch indicating range is required to be at least ± 25°, and that, if an aircraft operates at a pitch that exceeds the indicating limits, the pitch indicator may stop and remain at the limit until the pitch no longer exceeds the limitation, or the pitch indicator may tumble. 2.7 Investigative Benefits of Onboard Recorder Although the helicopter’s onboard Appareo unit was not a crash-resistant flight recorder system, it provided valuable information about the accident flight that helped investigators identify safety issues that would not have been otherwise detectable. Images captured by the recorder provided information about where the pilot’s attention was directed, his interaction with the helicopter controls and systems, and the status of cockpit instruments and system indicator lights, including those that provided information about the helicopter’s position (like the attitude indicator), engine operation, and systems. Because of these images, the investigation was able to determine precisely how the cockpit navigational displays were configured and that the pilot caged the attitude indicator in flight. The images, combined with the wreckage examination, also enabled the investigation to conclusively determine that icing was not a factor in the accident and that there were no mechanical anomalies with the helicopter. The NTSB concludes that the information provided by the onboard recorder provided critical information early in the investigation that enabled investigators to make conclusive determinations about what happened during the accident flight and to more precisely focus the safety investigation on the issues that need to be addressed to prevent future accidents.

NTSB Aircraft Accident Report 67 Because the unit was not a required installation, it was not required to comply with TSO C197. The Alaska DPS did not have the Appareo ICS optional audio link to the helicopter’s intercom connected, so voice audio was not recorded. Also, the unit had not been calibrated correctly, which subjected the internal attitude data to inaccuracies. The NTSB believes that voice audio information and accurate sensor data would have been helpful to the investigation and notes that Alaska DPS now uses the optional audio link, and Appareo has revised its installation instructions to include the calibration procedures. The NTSB has previously addressed the need for recording information on aircraft. On May 6, 2013, the NTSB issued Safety Recommendation A-13-13, which asked the FAA to do the following: Require all existing turbine-powered, nonexperimental, nonrestricted-category aircraft that are not equipped with a flight data recorder or cockpit voice recorder and are operating under 14 [CFR] Parts 91, 121, or 135 to be retrofitted with a crash-resistant flight recorder system. The crash-resistant flight recorder system should record cockpit audio and images with a view of the cockpit environment to include as much of the outside view as possible, and parametric data per aircraft and system installation, all as specified in [TSO] C197, “Information Collection and Monitoring Systems.”[62] On December 10, 2013, the NTSB classified Safety Recommendation A-13-13 “Open— Unacceptable Response” because the FAA stated that it had not found any compelling evidence to require installation of cockpit image recording systems. The FAA stated that it planned no further action to mandate flight deck image recording systems and considered its actions for this recommendation complete. In an August 14, 2014, letter, the FAA repeated to the NTSB its decision not to act, citing costs to the industry, its inability to estimate the number of lives that could be saved or accidents that could be prevented, and its position of promoting and incentivizing the voluntary equipage of such recording systems. Despite the FAA’s position, the NTSB continues to support the required installation of flight recorder systems because they enable accident investigators to identify safety issues that may not otherwise be detectable, which is critical to the prevention of future accidents. On October 23, 2014, the NTSB reiterated Safety Recommendation A-13-13 following its investigation of the November 10, 2013, fatal accident involving a Mitsubishi MU-2B-25 airplane.63 The airplane, which crashed after the pilot reported “a control problem” and “a left engine shutdown” to an air traffic controller, was not equipped with any type of recording device. The lack of available data significantly increased the difficulty in determining the safety issues that led to the accident. Specifically, the reasons for the pilot’s loss of control of the airplane and the engine shutdown could not be determined. Postaccident examination and testing did not reveal evidence of any malfunction that would have precluded normal operations.

62 On that date, the NTSB also issued Safety Recommendation A-13-12, which asked the FAA to require the installation of such recorders on all newly manufactured turbine-powered, nonexperimental, nonrestricted-category aircraft. Safety Recommendation A-13-12 is also classified “Open—Unacceptable Response.” 63 More information about this accident, NTSB cases number CEN14FA046, is available at www.ntsb.gov/aviationquery/index.aspx.

NTSB Aircraft Accident Report 68 Without any onboard recording devices, the investigation lacked valuable insight on the pilot’s control inputs, the airplane’s motions (such as pitch, bank, and yaw), and the time that the pilot’s reported control and engine problems began. The NTSB notes that it has a long history of recommending that the FAA require image recording devices on board certain aircraft.64 The NTSB notes that, had the FAA required all turbine-powered, nonexperimental, nonrestricted-category aircraft operated under Parts 91, 135, and 121 to be equipped with crash-protected image recording system by January 1, 2007 (as the NTSB had recommended back in 2003), hundreds of aircraft involved in accidents would have been equipped with crash-resistant recording devices that may have provided investigators with valuable safety information. For example, a review of NTSB accident data shows that, since January 1, 2007, there were 466 accidents involving such aircraft, and these accidents claimed 246 lives. In addition, in 55 of these accidents, the probable cause statements contained some element of uncertainty, such as an undetermined cause or factor.

64 Safety Recommendation A-13-13 superseded Safety Recommendation A-03-64, which was issued on December 22, 2003, and asked the FAA to “[r]equire all turbine-powered, nonexperimental, nonrestricted-category aircraft that are manufactured prior to January 1, 2007, that are not equipped with a cockpit voice recorder, and that are operating under 14 [CFR] Parts 91, 135, and 121 to be retrofitted with a crash-protected image recording system by January 1, 2007.” That safety recommendation (which superseded Safety Recommendation A-99-60) was superseded by Safety Recommendation A-09-10 and, therefore, was classified “Closed—Unacceptable Action/Superseded” on February 9, 2009.

NTSB Aircraft Accident Report 69

1. Conclusions
2. 1 Findings
3. The pilot was qualified to fly search and rescue missions in visual meteorological conditions

(but not instrument meteorological conditions) in the accident helicopter, and his performance was unlikely affected by medical factors, fatigue, or physical activities associated with the ground portion of the rescue activity.

1. The in-flight image recording and wreckage examinations showed that the helicopter and its

engine were operating normally throughout the flight. No mechanical abnormalities with the helicopter were identified.

1. Soon after departure from the remote landing site, the helicopter likely encountered

instrument meteorological conditions, which included low clouds, heavy snow, and near-zero-visibility conditions.

1. Although icing conditions were likely present during the accident flight, the performance of

the helicopter does not appear to have been degraded at the time of the accident.

1. The pilot experienced a total loss of external visual references while operating in close

proximity to terrain, which led him to attempt to transition to instrument flight.

1. The pilot’s action to cage the attitude indicator outside those conditions under which it could

be safely caged indicates that he distrusted the information he was seeing.

1. The pilot’s caging of the attitude indicator made it very unlikely that he would regain control

of the helicopter in instrument meteorological conditions.

1. The helicopter’s erratic maneuvers are consistent with the pilot’s spatial disorientation, a loss

of control in flight, and his inability to recover the helicopter because of his lack of instrument experience and the lack of accurate attitude information.

1. When the pilot was contacted about the mission, forecasts indicated that conditions in the

search area would be instrument flight rules and that forecast cloud ceilings and visibility would likely be below the pilot’s Alaska Department of Public Safety weather minimums and possibly below his last known personal weather minimums.

1. At the time the pilot was notified about the stranded snowmobiler, sufficient information was

available to indicate that the mission carried a high degree of risk due to the weather and low lighting conditions.

1. The pilot’s exceptionally high motivation for conducting search and rescue missions, which

was influenced by multiple factors, likely played a part in his acceptance of the accident mission.

NTSB Aircraft Accident Report 70

1. The pilot’s exceptionally high motivation for search and rescue missions and past successes

likely increased his risk tolerance and influenced his decision to continue flying in deteriorating weather conditions and risk a weather-related accident rather than accept the certain inconveniences and potential hazards associated with a precautionary landing.

1. The Alaska Department of Public Safety lacked organizational policies and procedures to

ensure that operational risk was appropriately managed, such as formal pilot weather minimums, preflight risk assessment forms, or secondary assessment by another qualified person trained in helicopter flight operations that would have encouraged the pilot to decline the mission or take steps to mitigate weather-related risks.

1. The Alaska Department of Public Safety’s reliance on nonaviation-trained dispatchers for

dispatch and flight-following support does not ensure that flight crews have adequate access to up-to-date weather information and qualified assistance with flight risk assessment tasks.

1. The Alaska Department of Public Safety did not provide the pilot with training that could

have helped him recognize the hazards that precipitation and low light conditions pose to night vision goggles operations.

1. Pilots involved in search and rescue missions could benefit from initial and recurrent training

on how to recognize, avoid, and safely recover from inadvertent flight into instrument meteorological conditions.

1. Operators lack adequate information about best practices for helicopter inadvertent

instrument meteorological conditions training.

1. A tactical flight officer who was capable of assisting the pilot with aeronautical

decision-making and operating the helicopter’s navigational systems and displays could have helped mitigate risk.

1. Although a tactical flight officer (TFO) program had been recognized by Alaska Department

of Public Safety personnel as a means of improving the safety of helicopter search and rescue operations, inadequate support for the program at various levels of the organization led to the unavailability of a TFO or other trained observer on the day of the accident.

1. The Alaska Department of Public Safety’s investigation and analysis of the pilot’s previous

accident and other events were focused on the actions of the pilot and did not adequately identify and address systemic factors that could reduce the likelihood of a recurrence.

1. The Alaska Department of Public Safety had a punitive culture that impeded the free flow of

safety-related information and impaired the organization’s ability to address underlying safety deficiencies relevant to this accident.

1. As a result of inadequate high-level management support, the Alaska Department of Public

Safety lacked a safety program that was capable of correcting latent deficiencies identified in this accident, including deficiencies in training and risk management.

NTSB Aircraft Accident Report 71

1. All law enforcement agencies of each state, territory, and the District of Columbia that

conduct public aircraft operations can benefit from an effective flight risk evaluation program, formalized dispatch and flight-following procedures, night vision goggles and inadvertent instrument meteorological conditions training for pilots, a formal tactical flight officer program, and a comprehensive safety management system.

1. Because of the lack of accurate, comprehensive information about attitude indication

limitations in Federal Aviation Administration publications, such as the Helicopter Flying Handbook, Instrument Flying Handbook, and Pilot’s Handbook of Aeronautical Knowledge, pilots are likely unaware that attitude indicators have pitch indication ranges that may be limited to ± 25°.

1. Information provided by the onboard recorder provided critical information early in the

investigation that enabled investigators to make conclusive determinations about what happened during the accident flight and to more precisely focus the safety investigation on the issues that need to be addressed to prevent future accidents. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the pilot’s decision to continue flight under visual flight rules into deteriorating weather conditions, which resulted in the pilot’s spatial disorientation and loss of control. Also causal was the Alaska Department of Public Safety’s punitive culture and inadequate safety management, which prevented the organization from identifying and correcting latent deficiencies in risk management and pilot training. Contributing to the accident was the pilot’s exceptionally high motivation to complete search and rescue missions, which increased his risk tolerance and adversely affected his decision-making.

NTSB Aircraft Accident Report 72

1. Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following recommendations: To the state of Alaska, 44 additional states, the Commonwealth of Puerto Rico, and the District of Columbia: Develop and implement a flight risk evaluation program that includes training for all employees involved in the operation and procedures that support the systematic evaluation of flight risks and consultation with others trained in flight operations if the risks reach a predefined level. (A-14-100) Use formalized dispatch and flight-following procedures that include up-to-date weather information and assistance with flight risk assessment decisions. (A-14-101) Provide all pilots who will perform night vision goggle (NVG) operations with formal NVG ground and flight training and require them to complete this training on an annual basis to remain on flight status. (A-14-102) Require all pilots who perform state law enforcement search and rescue missions to receive, on an annual basis, scenario-based simulator training in inadvertent instrument meteorological conditions that includes strategies for recognizing, avoiding, and safely escaping the conditions. (A-14-103) Create a formal tactical flight officer (TFO) training program that includes training on aeronautical decision-making, crew resource management, and operating aircraft navigational and communications equipment, and use TFOs during search and rescue operations. (A-14-104) Develop and implement a comprehensive safety management system for aircraft operations that (1) holds senior state personnel accountable for the safety of state law enforcement aircraft operations, (2) is tailored to the department’s missions, and (3) is based on industry best practices. (A-14-105) Arrange for an audit of the safety management system implemented in response to Safety Recommendation A-14-105 to be conducted every 3 years by an outside organization. (A-14-106) To the Federal Aviation Administration: Work with operators, training providers, and industry groups to evaluate the effectiveness of current training programs for helicopter pilots in inadvertent instrument meteorological conditions, and develop and publish best practices for such training. (A-14-107)

NTSB Aircraft Accident Report 73 Issue guidance to pilots explaining that attitude indicators have pitch and bank indication limits, that the pitch indicating range is required to be at least ± 25°, and that, if an aircraft operates at a pitch that exceeds the indicating limits, the pitch indicator may stop and remain at the limit until the pitch no longer exceeds the limitation, or the pitch indicator may tumble. (A-14-108) Revise the Pilot’s Handbook of Aeronautical Knowledge to clarify the information it contains on attitude indicator pitch and bank limitations to explain that attitude indicators have pitch and bank indication limits, that the pitch indicating range is required to be at least ± 25°, and that, if an aircraft operates at a pitch that exceeds the indicating limits, the pitch indicator may stop and remain at the limit until the pitch no longer exceeds the limitation, or the pitch indicator may tumble. (A-14-109)

NTSB Aircraft Accident Report 74 References Krognale, M.A. and W.K. Krebs. “Performance of Helicopter Pilots During Inadvertent Flight Into Instrument Meteorological Conditions.” The International Journal of Aviation Psychology 21, no. 3 (2011): 235-253. Matthews, R.S.J. and others. “USAF Spatial Disorientation Survey.” Paper presented at RTO HFM Symposium on Spatial Disorientation in Military Vehicles: Causes, Consequences, and Cures. La Coruna, Spain. April 15-17, 2002. NTSB (National Transportation Safety Board). 1988. Commercial Emergency Medical Service Helicopter Operations. NTSB/SS-88/01. Washington, DC: NTSB. . 2006. Special Investigation Report on Emergency Medical Services. NTSB/SIR-06/01. Washington, DC: NTSB. . 2007. Crash of Pinnacle Airlines Flight 3701, Bombardier CL-600-2B19, N8396A, Jefferson City, Missouri, October 14, 2004. NTSB/AAR-07/01. Washington, DC: NTSB. . 2009. In-flight Fire, Emergency Descent, and Crash in a Residential Area, Cessna 310R, N501N, Sanford, Florida, July 10, 2007. NTSB/AAR-09/01/SUM. Washington, DC: NTSB. . 2009. Crash During Approach to Landing of Maryland State Police Aerospatiale SA365N1, N92MD, District Heights, Maryland, September 27, 2008. NTSB/AAR-09/07. Washington, DC: NTSB. . 2011. Crash After Encounter with Instrument Meteorological Conditions During Takeoff from Remote Landing Site, New Mexico State Police, Agusta S.p.A. A-109E, N606SP, Near Santa Fe, New Mexico, June 9, 2009. NTSB/AAR-11/04. Washington, DC: NTSB. Reason, J.T. 1997. Managing the Risks of Organizational Accidents. Burlington, VT: Ashgate. Roy, K.M. and D.B. Beringer. “General Aviation Pilot Performance Following Unannounced In_Flight Loss of Vacuum System and Associated Instruments in Simulated Instrument Meteorlogical Conditions.” Technical Report No. DOT/FAA/AM-02/19 (FAA Office of Aerospace Medicine), 2002. Shannon, H.S., J. Mayr, and T. Haines, “Overview of the Relationship Between Organizational and Workplace Factors and Injury Rates.” Safety Science, vol. 26, no. 3 (1997): 201 217. Smith, M.J. and others, “Characteristics of Successful Safety Programs.” Journal of Safety Research, vol. 10, no. 1 (1978): 5–15.

NTSB Aircraft Accident Report 75

BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Acting Chairman Member

MARK R. ROSEKIND

Member

EARL F. WEENER

Member Adopted: November 5, 2014

FD07419 ｜ 2014_美国_AAR1404.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Crash Following In-Flight Fire Fresh Air, Inc. Convair CV-440-38, N153JR San Juan, Puerto Rico March 15, 2012

Accident Report NTSB/AAR-14/04 PB2015-101257

National Transportation Safety Board

NTSB/AAR-14/04 PB2015-101257 Notation 8601 Adopted November 17, 2014

Aircraft Accident Report Crash Following In-Flight Fire

Fresh Air, Inc. Convair CV-440-38, N153JR San Juan, Puerto Rico March 15, 2012

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2014. Crash Following In-Flight Fire, Fresh Air, Inc., Convair CV-440-38, N153JR, San Juan, Puerto Rico, March 15, 2012. Aircraft Accident Report NTSB/AAR-14/04. Washington, DC.

Abstract: This report discusses the March 15, 2012, accident involving a Convair CV-440-38, N153JR, operated by Fresh Air, Inc., which crashed into a lagoon about 1 mile east of the departure end of runway 10 at Luis Muñoz Marín International Airport, San Juan, Puerto Rico. The two pilots died, and the airplane was destroyed by impact forces. Safety issues include inadequate Federal Aviation Administration (FAA) oversight of 14 Code of Federal Regulations (CFR) Part 125 operations, inadequate evaluation of Fresh Air’s compliance with FAA-approved procedures, and evaluation of 14 CFR Part 125 pilots using another operator’s operations specifications. Safety recommendations are addressed to the FAA.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12FA051. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2015-101257 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Aircraft Accident Report

i

Contents Figures ........................................................................................................................................... iii Abbreviations ............................................................................................................................... iv Executive Summary .......................................................................................................................v

1. The Accident ...............................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Crew Information .......................................................................................................................4
4. 2.1 The Captain ......................................................................................................................4
5. 2.1.1 Certification and Experience..............................................................................4
6. 2.1.2 Currency of Captain’s Competency Check ........................................................5
7. 2.1.3 Preaccident Activities ........................................................................................5
8. 2.1.4 Recent Event with Fresh Air ..............................................................................6
9. 2.2 The First Officer ..............................................................................................................6
10. 2.2.1 Certification and Experience..............................................................................6
11. 2.2.2 Preaccident Activities ........................................................................................7
12. 3 Airplane Information .................................................................................................................7
13. 3.1 Accident Airplane’s Conversion ......................................................................................9
14. 3.2 Antidetonation Injection and Autofeather Systems .......................................................10
15. 3.3 Flight Characteristics .....................................................................................................11
16. 3.4 Airplane Performance Study ..........................................................................................12
17. 4 Wreckage and Impact Information ..........................................................................................13
18. 4.1 Postaccident Examination ..............................................................................................13
19. 5 Medical and Pathological Information.....................................................................................14
20. 5.1 Toxicology Testing ........................................................................................................14
21. 5.2 Crew Injuries .................................................................................................................14
22. 6 FAA Oversight .........................................................................................................................14
23. 6.1 Records Oversight .........................................................................................................14
24. 6.2 Operational and Airworthiness Oversight .....................................................................16
25. 6.3 Captain’s Evaluation Under Lateral Moves Provision ..................................................17
26. 6.4 Cargo Loading Procedures ............................................................................................17
27. Investigation and Analysis ......................................................................................................19
28. 1 General .....................................................................................................................................19
29. 2 Maximum Allowable Takeoff Weight .....................................................................................19
30. 3 Return to the Airport ................................................................................................................20
31. 4 Human Performance ................................................................................................................22
32. 4.1 Flight Crew Roles ..........................................................................................................22
33. 4.2 The Role of Fatigue/Impairment ...................................................................................23
34. 5 FAA Oversight .........................................................................................................................25
35. 6 En Route Inspections ...............................................................................................................27
36. 7 Evaluation of Pilot Knowledge ................................................................................................28

NTSB Aircraft Accident Report

ii

• Conclusions ...............................................................................................................................30

1. 1 Findings ..................................................................................................................................30
2. 2 Probable Cause........................................................................................................................31

• Recommendations ....................................................................................................................32

References .....................................................................................................................................33 NTSB Aircraft Accident Report

iii

Figures Figure 1. Radar ground track and ATC communications during N153JR’s takeoff and attempted return to SJU. ...................................................................................................................................3 Figure 2. Preaccident photograph of N153JR. ................................................................................8 Figure 3. View of the Convair CV-440’s augmentor and exhaust muffler assemblies. .................9 Figure 4. N153JR’s airspeed. ........................................................................................................12

NTSB Aircraft Accident Report

iv

Abbreviations AD airworthiness directive

ADI antidetonation injection

AFM airplane flight manual ASI air safety inspector ATC air traffic control CG center of gravity CFR Code of Federal Regulations CMO certificate management office FAA Federal Aviation Administration FSDO flight standards district office GA general aviation GM general manager GOM general operations manual mi mile min minute msl mean sea level NTSB National Transportation Safety Board OpsSpecs operations specifications PAI principal avionics inspector PF pilot flying PIC pilot-in-command PM pilot monitoring PMI principal maintenance inspector POI principal operations inspector PRPA Puerto Rico Port Authority SB service bulletin SIC second-in-command SJU Luis Muñoz Marín International Airport Vmc minimum controllable airspeed with one engine inoperative

NTSB Aircraft Accident Report

v

Executive Summary On March 15, 2012, about 0740 Atlantic standard time, a Convair CV-440-38, N153JR, operated by Fresh Air, Inc., crashed into a lagoon about 1 mile east of the departure end of runway 10 at Luis Muñoz Marín International Airport (SJU), San Juan, Puerto Rico. The two pilots died, and the airplane was destroyed by impact forces. The airplane was operated under the provisions of 14 Code of Federal Regulations (CFR) Part 1251 as a cargo flight. Visual meteorological conditions prevailed at the time of the accident, and a visual flight rules flight plan was filed. The flight had departed from runway 10 at SJU destined for Princess Juliana International Airport, St. Maarten. Shortly after takeoff, the first officer declared an emergency, and then the captain requested a left turn back to SJU and asked the local air traffic controllers if they could see smoke coming from the airplane (the two tower controllers noted in postaccident interviews that they did not see more smoke than usual coming from the airplane). The controllers cleared the flight to land on runway 28, but as the airplane began to align with the runway, it crashed into a nearby lagoon (Laguna La Torrecilla). Radar data shows that the airplane was heading south at an altitude of about 520 ft when it began a descending turn to the right to line up with runway 28. The airplane continued to bank to the right until radar contact was lost. The estimated airspeed at this point was only 88 knots, 9 knots below the published stall speed for level flight and close to the 87-knot air minimum control speed. However, minimum control speeds increase substantially for a turn into the inoperative engine as the accident crew did in the final seconds of the flight. As a result, the airplane was operating close to both stall and controllability limits when radar contact was lost. Pilots flying multiengine aircraft are generally trained to shut down the engine experiencing a problem and feather that propeller; thus, the flight crew likely intended to shut down the right engine2 by bringing the mixture control lever to the IDLE CUTOFF position and feathering the right propeller, as called out in the Engine Fire In Flight Checklist. This would have left the flight crew with the left engine operative to return to the airport. However, postaccident examinations revealed that the left propeller was found feathered at impact, with the left engine settings consistent with the engine at takeoff or climb setting. The right engine settings were generally consistent with the engine being shut down; however, the right propeller’s pitch was consistent with a high rotation/takeoff power setting. The accident airplane was not equipped with a flight data recorder or a cockpit voice recorder (nor was it required to be so equipped); hence, the investigation was unable to determine at what point in the accident sequence the flight crew shut down the right engine and at what point they feathered the left propeller, or why they would have done so.

1 Title 14 CFR Part 125 applies to large airplanes that are configured for 6,000 lbs or more of payload capacity or 20 or more passengers when these airplanes are being used for any purpose other than common carriage. A carrier becomes a common carrier when it holds itself out to the public, or to a segment of the public, as willing to furnish transportation within the limits of its facilities to any person who wants it. 2 Although the investigation was not able to determine why the crew chose to shut down the engine, they likely suspected an engine fire due to the smoke.

NTSB Aircraft Accident Report

vi

Postaccident examination of the airplane revealed fire and thermal damage to the airframe on the airplane’s right wing rear spar, nacelle aft of the power section, and in the vicinity of the junction between the augmentor assemblies and the exhaust muffler assembly. While the investigation was unable to determine the exact location of the ignition source, it appears to have been aft of the engine in the vicinity of the junction between the augmentor assemblies and exhaust muffler assembly. The investigation identified no indication of a fire in the engine proper and no mechanical failures that would have prevented the normal operation of either engine. The safety issues identified in this accident include the following:  Inadequate Federal Aviation Administration (FAA) oversight of Part 125 operations. The investigation found that many of the operator’s operation and maintenance records were incomplete or nonexistent. The FAA requires annual inspections of each certificated operator, including a review of pilot records, pilot currency, and aircraft maintenance. During the last documented main base inspection, which occurred just over 2 months before the accident, the principal operations inspector (POI) should have discovered the recordkeeping discrepancies and instructed the operator to verify the captain’s currency; however, he did not. Likewise, the principal maintenance inspector and the principal avionics inspector should have discovered Fresh Air’s deficient aircraft maintenance recordkeeping during the last documented aircraft records inspection, which was conducted 7 days before the accident, or during any of the six inspections conducted in the year before the accident; however, they did not. Further, the National Transportation Safety Board (NTSB) found evidence suggesting that FAA oversight of Part 125 operations was not seen as a priority. Fresh Air’s POI told investigators that Part 125 was generally “a GA [general aviation] operation,” not an air carrier operation. While most of its flights were relatively close to San Juan, Fresh Air’s FAA-approved operations specifications (OpsSpecs) authorized it to operate commercially over the 48 contiguous states, meriting far more scrutiny than “a GA operation.” Multiple FAA inspectors failed to perform effective, basic oversight of Fresh Air, possibly due to a belief that Part 125 operations merit less scrutiny than Part 121 and Part 135 operations, and despite the fact that Fresh Air’s airplanes fly over populated areas within the national airspace system.  Inadequate evaluation of Fresh Air’s compliance with FAA-approved procedures. The investigation revealed the FAA’s failure to detect and address discrepancies between Fresh Air’s approved procedures and its operations, including cargo loading, pilot currency, company recordkeeping, and pilot evaluation. For example, Fresh Air pilots were operating the airplane with the autofeather and antidetonation injection systems off, yet using a higher gross takeoff weight than permitted with these systems off, contrary to the FAA-approved airplane flight manual. Because the POI had never directly observed Fresh Air’s operation, he was unaware that the airplanes were being operated contrary to the limitations outlined in the airplane flight manual.  Evaluation of Part 125 pilots using another operator’s OpsSpecs. The investigation revealed confusion among operators and FAA personnel regarding the applicable OpsSpecs that check airmen must use during certain checkrides. While it

NTSB Aircraft Accident Report

vii

unlikely affected the captain’s capability to handle the accident, his competency check was not necessarily conducted using Fresh Air’s OpsSpecs or operations manual. While the investigation could not determine under which company’s OpsSpecs and operations manual the captain was evaluated for the Convair, the captain’s DC-4 evaluation was conducted using another company’s OpsSpecs and operations manual. The NTSB determines that the probable cause of this accident was the flight crew’s failure to maintain adequate airspeed after shutting down the right engine due to an in-flight fire in one of the right augmentors. The failure to maintain airspeed resulted in either an aerodynamic stall or a loss of directional control. As a result of this investigation, the NTSB makes three recommendations to the FAA.

NTSB Aircraft Accident Report

1

• The Accident

1. 1 History of Flight

On March 15, 2012, about 0740 Atlantic standard time,3 a Convair CV-440-38, N153JR, operated by Fresh Air, Inc., crashed into a lagoon about 1 mile (mi) east of the departure end of runway 10 at Luis Muñoz Marín International Airport (SJU), San Juan, Puerto Rico. The two pilots died, and the airplane was destroyed by impact forces. The airplane was operated under the provisions of 14 Code of Federal Regulations (CFR) Part 1254 as a cargo flight. Visual meteorological conditions prevailed at the time of the accident, and a visual flight rules flight plan was filed. The flight had departed from runway 10 at SJU destined for Princess Juliana International Airport, St. Maarten. Shortly after takeoff, the first officer declared an emergency, and then the captain requested a left turn back to SJU and asked the local air traffic controllers if they could see smoke coming from the airplane (the two tower controllers noted in postaccident interviews that they did not see more smoke than usual coming from the airplane). The controllers cleared the flight to land on runway 28, but as the airplane began to align with the runway, it crashed into a nearby lagoon (Laguna La Torrecilla). Flight logs indicated that early on the morning of the accident, the captain repositioned another airplane from Henry E. Rohlsen Airport, St. Croix, US Virgin Islands, to SJU. The captain then met the first officer at the accident airplane at SJU. According to the Holsum de Puerto Rico invoice for bread products, the accident airplane’s total cargo load was 12,100 lbs. The estimated ramp weight of the airplane was 47,710 lbs, but the maximum allowable takeoff weight of the airplane was 40,900 lbs.5 Before the flight, the captain started both engines and conducted a 15- to 20-minute (min) run-up; ground personnel did not report hearing or seeing anything unusual. The flight crew was issued departure instructions to fly the standard eastern departure for visual flight rules flight following to St. Maarten. The flight crew then requested a second engine run-up, which was typical according to an air traffic tower controller; the controller instructed the flight crew to conduct the run-up on taxiway Charlie while holding short of taxiway Bravo. After completing the second engine run-up, the flight crew requested clearance to taxi to runway 10, where the flight was cleared for takeoff at 0734:48. Visibility was 10 mi with a 5-knot wind from 120˚. The airplane lifted off at 0735:45; at 0737:27, the first officer contacted the SJU departure controller to declare an emergency and the captain then requested a left turn back to 3 The times in this report are Atlantic standard time, unless otherwise noted. 4 Title 14 CFR Part 125 applies to large airplanes that are configured for 6,000 lbs or more of payload capacity or 20 or more passengers when these airplanes are being used for any purpose other than common carriage. A carrier becomes a common carrier when it holds itself out to the public, or to a segment of the public, as willing to furnish transportation within the limits of its facilities to any person who wants it. 5 The Convair CV-440’s maximum allowable takeoff weight of 48,000 lbs requires use of both the antidetonation injection and autofeather systems; however, because neither system was used on the accident flight, the maximum allowable takeoff weight was 40,900 lbs. See section 1.3.2.

NTSB Aircraft Accident Report

2

the airport. He then asked if tower control personnel could see smoke coming from one of the airplane’s engines; the controller acknowledged the transmission but did not verify the smoke6 and, at 0738:05, cleared the flight to land on runway 10. Radar data indicate that as the airplane continued to climb, the airspeed varied between 140 and 160 knots. The captain then asked again if tower personnel could see any smoke coming from one of the airplane’s engines before stating, “…we’re gonna need to land on runway, ah, two eight (unintelligible).” The airplane reached a maximum altitude of about 935 ft mean sea level (msl) at 0738:14 during an approximate 30˚ left-banked turn back to the airport. The tower controller cleared the airplane to land on runway 28. At 0738:32, the captain replied, “…affirmative, uh, is runway eight available, to[o] high…,” which was the last transmission from the accident airplane; the airplane then descended to 500 ft msl. The airplane banked to the right starting at 0739:10; the airspeed was about 140 knots. The airplane continued to bank to the right. Before radar contact was lost at 0739:53, the last estimated airspeed was 88 knots, and the altitude was 110 ft msl. The controller reported that the airplane crashed at 0740:23. Figure 1 shows the radar ground track and air traffic control (ATC) communications during the accident airplane’s takeoff and attempted return to SJU.

6 Although the air traffic control transcript indicates that the controller stated, “uh the engine is smoking” after the flight crew asked “you see the smoke off of three juliett romeo,” the two tower controllers noted in postaccident interviews that they did not see more smoke than usual coming from the airplane. Thus, his statement was simply an acknowledgement of the pilot’s transmission.

NTSB

Aircraft Accident Report

3

Figure 1. Radar ground track and ATC communications during N153JR’s takeoff and attempted return to SJU.

NTSB Aircraft Accident Report

4 A Puerto Rico Port Authority (PRPA) official familiar with the accident airplane was in a truck near the south side of the airport terminal and observed the takeoff; he saw nothing unusual with the airplane’s departure. A security video briefly captured the accident airplane’s initial climb over the departure end of runway 10, and no smoke or fire was visible. A witness on the second floor of an apartment complex about 1 mi east of the airport and just south of the extended centerline of runway 10 observed the accident airplane’s departure and heard “a strange noise” in one of the engines that he described as an “intermittent surge.” He saw the airplane losing altitude and then begin a turn to the north. The PRPA official observed the flight returning to the airport before entering a sharp right-descending turn toward Laguna La Torrecilla, about 1 mi east of SJU. The PRPA video camera captured images of the airplane impacting the lagoon. Witnesses then observed, and the video showed, a large black plume of smoke rising from the lagoon. Rescue vehicles and PRPA officials arrived on scene about 0804, setting up a perimeter around the wreckage and beginning rescue operations. 1.2 Crew Information Pilots operating under Part 125 are not required to receive any specific training as defined by the Federal Aviation Regulations. However, per 14 CFR 125.287(b), captains are required to meet certain experience requirements, and both pilots are required to receive an annual competency check. In addition, per 14 CFR 125.291(a), each pilot-in-command (PIC) must receive an instrument proficiency check every 6 months. The instrument proficiency check is generally a more comprehensive check, so Part 125 allows the pilot to substitute an instrument proficiency check for the competency check. A competency or instrument flight rules proficiency check requires the pilot to physically manipulate the controls of the airplane and may include any of the maneuvers and procedures currently required for the original issuance of the particular pilot certificate or rating required for the operations authorized and appropriate to the category, class, and type of airplane involved. A check airman evaluation flight is also required for check airmen every 2 years in the specific type of airplane he or she plans to conduct evaluations in. Check airman evaluation flights are a practical test of the check airman’s ability to test other airmen, not of his or her flying ability. A proficiency check or Part 125 competency check, and a check airman observation, are separate evaluations and are not combinable on a single evaluation. 1.2.1 The Captain 1.2.1.1 Certification and Experience The captain, age 65, held an airline transport pilot certificate with airplane multiengine land instrument, commercial pilot, and airplane single-engine land ratings, issued on January 12,

1. His Federal Aviation Administration (FAA) second-class medical certificate was issued on

May 26, 2011 (valid for 2 years), with the limitation that he must wear corrective lenses. The captain was the co-owner of Fresh Air and the PIC for the accident flight. According to Fresh Air’s pilot records, the captain flew the Convair CV-440 for Miami Air Lease in 2005 and then received basic indoctrination training at Fresh Air on August 29, 2005, after purchasing Fresh Air. He was one of two full-time captains for the company, served as the Fresh Air director

NTSB Aircraft Accident Report

5 of operations, and was Fresh Air’s only check airman. Fresh Air’s employment records indicated that he had 22,586 hours of total pilot flying time, 21,925 hours of which were as PIC. The records indicated that he had flown about 9,000 hours in the Convair CV-340/440 and that he had 34 and 104 hours of total flying time in the 30 and 90 days before the accident, respectively. A former Fresh Air captain and a former Fresh Air first officer both stated that the accident captain typically flew the heavy loaded legs out of SJU and that the first officer would fly the empty return legs. Another captain also stated that while he was a first officer, the accident captain would usually fly the cargo, or heavy, legs, while he flew the lighter, empty legs, and that as he was getting close to becoming a Convair captain, the accident captain would let him fly the heavy legs to get a feel for the airplane. 1.2.1.2 Currency of Captain’s Competency Check The captain’s initial type rating in the Convair CV-340 was on September 19, 1977. On June 24, 2010, the captain received a Part 125 competency check (valid until June 30, 2011) in the Convair CV-440 from a Tiger Contract Cargo, Inc., check airman. The Fresh Air general manager (GM), who was also the captain’s son and whose duties included maintenance of pilot records, was unable to verify that the captain had received a competency check or instrument proficiency check in the 12 months before the accident. He said that the captain received his check airman observation in “September or October” of the previous year and that the GM understood that it was both a proficiency check and a check airman observation with the FAA. According to the FAA air safety inspector (ASI) at SJU who conducted the observation, the captain had a check airman observation on September 23, 2010, but this was not a competency check. Other Part 125 operators of the Convair indicated that none had provided a competency check on the accident captain in the 12 months before the accident. 1.2.1.3 Preaccident Activities Limited information was available regarding the captain’s activities in the 72 hours before the accident. The captain sent and received multiple phone calls and text messages on March 12, with several extended breaks7 in phone activity. Airport records from the airport indicated that the captain was processed through customs in St. Croix about 1238 after arriving on a Fresh Air flight. His other activities on March 12 were unknown, and the captain remained in St. Croix overnight. On March 13, 2012, the captain was precleared through customs in St. Croix about 1403. A flight itinerary for the captain indicated that he was scheduled to depart St. Croix on a commercial flight about 1500 and arrive in Santo Domingo, Dominican Republic, about 1744 after changing planes in San Juan. He remained in Santo Domingo overnight. On March 14, 2012, the captain was scheduled to depart Santo Domingo on a commercial flight about 1029 and arrive in St. Croix about 1404 after changing planes in San Juan. He

7 An extended break in phone activity consisted of no phone activity logged, incoming text messages logged without an outgoing text message in response, or incoming calls logged that were routed to voicemail.

NTSB Aircraft Accident Report

6 remained in St. Croix overnight. The captain made and received multiple phone calls and text messages from about 1147 until about 2343, at which time he checked his voicemail. On the day of the accident, the captain received a phone call about 0343. Cell phone activity consisted of multiple calls and text messages until about 0657 with an extended break in cell phone activity from about 0427 to about 0546. The captain then repositioned a DC-4 from St. Croix to San Juan. According to the Fresh Air DC-4 flight log, the captain departed St. Croix about 0510 and arrived in San Juan about 0540. Fresh Air’s general operations manual (GOM) stated that “As a general rule one hour prior to proposed or scheduled departure will be considered adequate for crew reporting to the operations base or departure airport.” 1.2.1.4 Recent Event with Fresh Air On January 17, 2011, the captain witnessed an in-flight fire aft of the left engine on a Tiger Contract Cargo Convair CV-440 shortly after takeoff from St. Thomas, US Virgin Islands.8 Fresh Air’s GM said that the captain was overflying that flight in another airplane, saw the fire, and radioed the pilots to tell them that they had a fire and needed to turn around; they made it back, according to the GM, “by the skin of their teeth.” Postaccident examination of the airplane’s left engine revealed a discrepancy in two cylinders in which the pistons did not move during rotation of the engine. This discrepancy may have resulted in unburned fuel or oil entering the exhaust system and igniting in the exhaust or augmentor assemblies. Although the augmentor assemblies were not available for examination, the location of the fire suggests that there was a leak in the vicinity of the augmentor assemblies and muffler junction, causing the fire to burn inside the nacelle rather than exit out the aft end of the muffler. 1.2.2 The First Officer 1.2.2.1 Certification and Experience The first officer, age 44, held a second-in-command (SIC) rating on the Convair CV-440. According to the FAA, the first officer’s commercial pilot certification was issued on September 3, 2008, and his FAA second-class medical certificate was issued on January 20,

1. The first officer was originally hired by Fresh Air as a Convair first officer in 2007 before

leaving on February 18, 2008, to work as a mechanic for Seaborne Airlines. He was rehired by Fresh Air and received basic indoctrination training on February 24, 2012. He also received an SIC proficiency check on the Convair CV-440 from the accident captain on February 24, 2012. Fresh Air’s employment records indicated that he had 2,716 hours of total pilot flying time, 200 hours of which were as PIC (none in the Convair CV-440) and 700 hours of which were as SIC of the Convair CV-340/440. He had 16 hours of total flying time in the last year, all within the 30 days before the accident. According to the FAA, the first officer received both his private and commercial airplane single-engine land and instrument airplane certificates in 1996 and his commercial airplane

8 More information about this event, NTSB case number ERA11LA117, is available online at www.ntsb.gov/aviationquery/index.aspx.

NTSB Aircraft Accident Report

7 single-engine and multiengine land and instrument airplane certificate in 2001. However, between 1996 and 2008, he received five notices of disapproval in the following areas: performing chandelles and lazy 8s, proper holding pattern entry and basic very high frequency omnidirectional radio range interception (twice) and tracking, very high frequency omnidirectional radio intercepts (again), preflight preparation and cross-country flight planning, and performance maneuvers. While at Seaborne Airlines, the first officer expressed interest in joining the flight operations department as a pilot, and in early 2009, he started ground school. After completing ground school, he began a 5-day simulator training course. Seaborne Airline’s director of operations indicated that he determined that the first officer was not “up to par” during simulator training. He stated that while the first officer did fine in ground school and passed the written tests, his piloting skills were below average and that he had trouble keeping up with the pace required to get through simulator training. Specifically, he recalled that the first officer struggled trying to “manage the platform while flying.” He added that the first officer was not a good pilot in general, rather than having specific areas of trouble in training. 1.2.2.2 Preaccident Activities Limited information was available regarding the first officer’s activities in the 72 hours before the accident. Cell phone records were obtained for the cell phone number registered to the first officer; however, no other information was available to determine his activities. The day before the accident, the first officer sent and received multiple calls and text messages, with several extended breaks in phone activity. The calls and text messages occurred between about 1030 and about 2255. On the day of the accident, the first officer received an incoming call about 0505. Cell phone activity consisted of multiple calls and text messages until about 0719. There was an extended break in phone activity of at least 1 hour from about 0556 until about 0659. 1.3 Airplane Information The accident airplane, a Convair CV-440-38, serial number 117, N153JR, was a two-pilot, all-metal, low-wing, pressurized airplane originally designed and built as a passenger airplane. (See section 1.3.1 for information on the airplane’s conversion.) Figure 2 shows a photograph of the accident airplane. The accident airplane was powered by two Pratt & Whitney R-2800-52W and -103W supercharged 18-cylinder radial engines9 with full feathering hydromatic propellers and was equipped with a fire detection and warning system, as well as an extinguishing system for the engines and nacelles. The detection system relied on a series of thermocouple sensors on two loops located in the power section and body section of each nacelle that would detect fires around the engine area, the engine accessory area, and the main landing gear wheel well area.

9 According to the type certificate data sheets for the engines, the Pratt & Whitney R-2800-52W and -103W are essentially the same except for a difference in carburetor settings and are equivalent to the civil dual-wasp model CB17.

NTSB Aircraft Accident Report

8

Figure 2. Preaccident photograph of N153JR. The CV-440 exhaust system includes two manifold assemblies, two tubular thrust augmentor assemblies, a transition assembly, and a muffler for each engine, as illustrated in figure 3. The augmentor tubes are located in the upper body section of the engine nacelle; their purpose is to channel engine exhaust gases and cylinder cooling air from the power section and exhaust them through a muffler. The augmentor tubes also serve as heat exchangers by circulating air through the spaces between the airplane’s inner and outer skin. This heated air is used directly for thermal anti-icing and as the source of heat for the cabin heat exchanger. A mechanic familiar with the Convair CV-440 noted that exhaust fires can occur in the augmentors on this type of airplane. Under normal conditions, the fire is exhausted out the muffler assembly and into the air, resulting in little or no damage to the airplane. However, the mechanic noted that oil and fuel leaks at the augmentor/muffler junction do occur.

NTSB Aircraft Accident Report

9

Figure 3. View of the Convair CV-440’s augmentor and exhaust muffler assemblies. Fresh Air’s GOM included an Engine Fire In Flight checklist for the CV-440. The checklist denoted calls for the nonflying pilot (N), flying pilot (P), and first officer (F). The checklist, shown below, was not a memory item. Engine Fire In Flight (N) Engine Failure Checks……………..……..Complete (P) (N)(No.1 or 2) T-Handle………………………Pulled (P) (N)(No.1 or 2) Mixture Idle-Cutoff……..…....Set (P) (N)(No.1 or 2) Boost Pump Off………………Off (P) (N)(No.1 or 2) Cowl Doors Closed……………Set (P) (N)(No.1 or 2) Emer. Heat Srce Valves………Closed (F) (N)Select Main Bottle…………………………Selected (P) (N)Discharge Main……………………………Discharged (P) If Required 1.3.1 Accident Airplane’s Conversion The accident airplane was originally manufactured in 1953 by Convair, a division of General Dynamics Corporation, as a CV-340 with twin circular exhaust muffler assemblies, one installed at the aft end of each augmentor and readily visible at the aft end of the wing. Convair

NTSB Aircraft Accident Report

10 developed and received approval for modifications to the CV-34010 that would allow an operator to modify it to the CV-440. The CV-440 has an improved exhaust muffler assembly that contained one rectangular exit duct at the aft edge of the wing. The exhaust transition assembly was attached to the aft end of each augmentor and routed the exhaust together into a common duct that was then fastened to the rectangular exhaust exit duct. The CV-440 also has modified engine cowlings, engines, flap seals, and certain engine instruments. The accident airplane’s external data plate designated the airplane model as a Convair CV-340/440-38, serial number 117. Two data plates were installed on the main entry door jamb: one designated the model as a 340 with serial number 117 and a manufacture date of September 21, 1953; the other stated, “THIS ACFT SN# 117 MODIFIED TO INCLUDE S/B 340-144B MEETS PERFORMANCE LIMITATIONS OF 440 CAA APPROVED FLIGHT MANUAL RHOADES AVIATION INC. CRS# JRAR338F.” The investigative team found no record of Convair Service Bulletin (SB) 340-144B being performed on the accident airplane. However, physical evidence from the wreckage was consistent with some, if not all, of the modifications associated with the SB having been incorporated on the accident airplane. Fresh Air’s GM said that the airplane had been converted from a Convair CV-340 to a CV-440 “years ago” and that they kept CV-440 manuals on board, including at the time of the accident. Fresh Air’s GOM required that the CV-440 airplane flight manual (AFM) be on board at all times, and the operations specifications (OpsSpecs) listed the airplane as a CV-440. 1.3.2 Antidetonation Injection and Autofeather Systems The accident airplane was equipped with a water injection system that served both engines to allow for operations at increased maximum power and for reserve power in the event of a go-around, obstacle clearance, or similar emergency. The water injection system generates additional power by leaning out the fuel-air mixture to best maximize mixture strength and by operating at a higher manifold pressure to permit the engine to operate safely at a higher power setting. To prevent detonation, water is injected to cool the intake charge from the engine supercharger and to retard the speed of the flame travel in the combustion chamber. The water injection fluid, commonly referred to as antidetonation injection (ADI) fluid, is a mixture of distilled water and methyl alcohol.11 A tank with a capacity of 22.5 US gallons (22 gallons usable), located in the right wing fillet, contained the water supply and water pump. The Convair CV-440 AFM required that the ADI system be operative for all takeoffs at the maximum allowable takeoff weight. The maximum allowable operating weight for a takeoff with the ADI system inoperative, according to the Convair CV-340 AFM (performance section C) and the CV-440 AFM (performance information part K), was 40,900 lbs. With the ADI system operative, the maximum allowable takeoff weight is 48,000 lbs.12 No actual weight and balance

10 Service Bulletin (SB) 340-144B, “Performance Improvement Program,” was issued in February 1958 and specified the incorporation of eight additional SBs that would modify the CV-340 to a CV-440. 11 The Fresh Air GM told investigators that the ADI system was a 50/50 water/alcohol mix and that they also added fish oil “to keep the lines clear.” For the most part, they used only water because there was little chance that the lines would freeze up during island operations. They typically loaded at least 11 gallons of water in the 22.5-gallon tank (that was a minimum to ensure that it was available for takeoff). 12 The AFM notes that a maximum takeoff weight of 49,100 lbs may be attained using 108/135 octane AvGas; however, the accident airplane was fueled with standard 100/130 octane AvGas.

NTSB Aircraft Accident Report

11 information or flight manifest was available, but investigators estimated the weight of the airplane at takeoff to be 47,510 lbs, which included 12,054 lbs of cargo. Takeoffs using the ADI system were referred to as “wet” takeoffs for performance calculations, and takeoffs not using the ADI system were referred to as “dry” takeoffs. A former Fresh Air captain stated that most pilots would use dry power settings, especially on long runways, rather than use the wet ADI system because it meant injecting a methanol/water mixture into the engine, which was corrosive. He did not think that there was a weight penalty for dry takeoffs. Another former Fresh Air Convair pilot noted that he rarely saw the ADI system used for a takeoff. He said that it was helpful when taking off at maximum gross weight but did not know if not using the ADI system would change the maximum gross takeoff weight. He recalled using the ADI system once when fully loaded and remembered that they got some backfire on takeoff, so they turned the ADI system off. Another former Fresh Air Convair pilot stated that they never used the ADI system for takeoff. When asked what the dry maximum takeoff weight was for the Convair CV-440, he said “48,000 [lbs] for all takeoffs.” A former Fresh Air first officer did not remember ever using the ADI system. The accident airplane’s propellers could be automatically feathered in the event of an engine failure if the autofeather system is activated before takeoff. If the autofeather system is not activated, the propellers could be manually feathered via two red push-pull buttons on the cockpit overhead switch panel. With the autofeather system activated, as one propeller was being feathered, a blocking relay would simultaneously be energized, which would prevent the opposite propeller from feathering. The maximum allowable operating weight for a takeoff with the autofeather system inoperative was 43,500 lbs. A former Fresh Air pilot said that he had been verbally briefed on the autofeather system but that it was not demonstrated. He also said that he was told that the autofeather system would activate with a backfire in the engine and that you would not necessarily want to feather the propeller in that case. Another former Fresh Air pilot said that the autofeather system was installed on the accident airplane but was not operative because its circuit breaker was pulled.13 Fresh Air’s GM said that the accident captain would use his discretion in using the autofeather system but that the captain did not like to use it because of his concern that it would feather an engine with a momentary power loss or backfire during a critical phase of flight. The GM added that he knew of no performance or weight penalty for not using the autofeather system. 1.3.3 Flight Characteristics Several Convair CV-340/440-rated pilots indicated that the airplane’s single-engine climb performance was limited when fully loaded. One stated that when the airplane was not fully loaded, it would climb about 500 ft per minute with a single engine. However, he and several other Convair pilots believed that the Convair CV-340/440 would only hold altitude, at best, on a single engine when heavily loaded. A former Fresh Air Convair first officer stated that the airplane would not maintain altitude in a turn while heavily loaded and operating with a single engine, adding that “Convair 340s and 440s were under powered.”

13 The automatic feather switch was found in the DOWN/UNARMED position after the accident; however, the state of the autofeather system’s circuit breaker could not be established due to impact damage.

NTSB Aircraft Accident Report

12 Fresh Air’s co-owner, president, and former director of maintenance was also a Convair captain. He stated that the Convair would maintain altitude with one operative engine during a bank if you “treated her like a baby” and added less than about 5 to 10˚ of bank angle. He further described the typical stall characteristic of the airplane as being “like a butterfly” because “she had so much wing, but a full stall was a different story. You’d be looking at the ground.” 1.3.4 Airplane Performance Study The National Transportation Safety Board (NTSB) conducted an airplane performance study to estimate the airplane’s position, airspeed, altitude, and other parameters throughout the accident flight. The study primarily relied on radar data because the airplane was not equipped with a flight data recorder or a cockpit voice recorder, nor was it required to be so equipped. The study established the accident flight’s radar-derived ground track, altitude, and airspeed during takeoff and the attempted return to SJU, using the wind and atmospheric conditions that were reported around the time of the accident. In addition, the study estimated the airplane’s attitude and heading for the 4-min flight. According to ATC communications, the flight crew declared an emergency about 2 1/2 min after being cleared for takeoff on runway 10. The airplane reached a maximum altitude of about 935 ft msl during an approximate 30˚ left-banked turn back to the airport. The airplane continued to climb throughout the flight until it was cleared to land. As seen in figure 4, the flight’s airspeed was nominally between 140 knots and 160 knots for most of the flight, except for a brief moment when the airplane descended to 500 ft msl and again in the final 15 seconds before radar contact was lost. The last estimated airspeed was 88 knots at an approximate altitude of 110 ft msl.

Figure 4. N153JR’s airspeed.

NTSB Aircraft Accident Report

13 According to the Convair CV-440 AFM, at an altitude just above sea level, the minimum control speed is 87 knots indicated for the Convair CV-440 and the stall speed for level flight14 is 97 knots. The estimated airspeed at the final radar point, 88 knots, was 9 knots below the published stall speed and close to the minimum control speed. However, minimum control speeds increase substantially for a turn into the operative engine, as the accident crew did in the final seconds of flight. As a result, the airplane was operating close to both stall and controllability limits when radar contact was lost. 1.4 Wreckage and Impact Information The right wingtip of the airplane initially struck trees on the southern shore of the lagoon, and a 5-ft-long section of the right wingtip and aileron were recovered near the struck trees. The remainder of the airplane was recovered from the lagoon. The right engine and propeller were found closer to the southern shore, and the left engine, propeller, cockpit, and fuselage aft of the wing section were found closer to the north shore. The fuselage and wing sections were fragmented from impact with the water. Measurements of the initial tree impact indicated that the airplane struck the trees at a bank angle of about 39˚ right-wing-down. 1.4.1 Postaccident Examination Postaccident examination of both engines revealed no mechanical failures that would have prevented their normal operation. No thermal distress or fire damage was observed on either the left or right engine or exhaust manifolds. The left engine’s throttle control lever and throttle valve were found in the fully OPEN position, and the engine mixture control was found almost against the FULL RICH stop, all consistent with the engine at takeoff or climb setting. The right engine’s throttle control lever was found in the CLOSED position, and the throttle valve was consistent with the engine being shut down; the engine mixture control was found against the FULL RICH stop, which was not consistent with the engine being shut down. A guarded automatic feather switch, located on the pilot’s pedestal, operates the feathering function for both propellers. This automatic feather switch was found in the DOWN position, and the guard was found impact-damaged but in the UP or unguarded position. The automatic feather switch in the DOWN position is consistent with it being in the UNARMED position. The left propeller was found feathered, but the right propeller’s pitch was consistent with a high rotation/takeoff power setting. Airframe fire and thermal damage were found on the airplane’s right wing rear spar, nacelle aft of the power section, and in the vicinity of the junction between the augmentor assemblies and the exhaust muffler assembly. Damage to the airframe extended from the right engine firewall aft to the flaps, with the damage greater on the outboard side compared to the

14 Stall speeds are published for level flight, zero thrust, and a forward center of gravity (CG). The accident airplane was descending at over 1,000 ft per min with an undetermined CG as the airspeed decreased. A load factor of less than 1g and a more aft CG would both result in a lower stall speed. Power would also tend to lower the stall speed.

NTSB Aircraft Accident Report

14 inboard side. The rear spar was intact with several areas of significant fire damage. Sooting was present on all of the rear spar aft surfaces, and the spar web exhibited evidence of burn-through in three areas concentrated toward the right side. The lower bulkhead that forms the aft end of the right wheel well remained attached, with several areas exhibiting heat damage. The right inboard flap had some melting and other heat-related signatures on the upper surface on the forward outboard corner, and sooting was present on the top surface of the flap; the inboard flap was otherwise intact. The inboard end of the right outboard flap exhibited fire damage, including a section of the attached flap track, as well as a section of the inboard edge that was missing and presumed destroyed in the fire. Damage to the remaining inboard portion of the right outboard flap extended about 14 in along the trailing edge and 28 in along the leading edge. 1.5 Medical and Pathological Information 1.5.1 Toxicology Testing The toxicology reports for the captain and the first officer indicated no evidence of significant preexisting medical pathology. Toxicology testing, performed by the FAA’s Civil Aerospace Medical Institute, detected the following ethanol levels for the captain: blood (27 mg/dL), brain (41 mg/dL), and muscle (26 mg/dL). 1.5.2 Crew Injuries Postaccident examination of the accident site revealed the handheld radio and cord wrapped around the captain’s left forearm. The first officer’s autopsy revealed fractures to both radii and both ulnas and a fracture of the left femur. 1.6 FAA Oversight The FAA certificate management office (CMO) located in Miramar, Florida (CMO-29), was responsible for oversight of Fresh Air, which was based in Davie, Florida. At the time of the accident, the principal operations inspector (POI), the principal maintenance inspector (PMI), and the principal avionics inspector (PAI) for the Fresh Air certificate were responsible for a total of 14 certificates (all Part 125 operations). 1.6.1 Records Oversight Flight and duty time records allow the POI to verify a pilot’s currency by ensuring the pilot has logged three takeoffs and landings within a 90-day period (per 14 CFR 125.285[a]) and also allow the POI to ensure that pilots comply with flight and duty time requirements and are not on duty for 8 consecutive hours during any 24-hour period (per 14 CFR 125.37). A review of pilot records at Fresh Air’s main office found many pilot records incomplete or nonexistent. The captain owned a home in St. Croix, and according to interviews with the FAA and the captain’s son, the captain would fly to St. Croix to conduct maintenance on the Fresh Air airplanes and store required aircraft flight logs, maintenance records, and flight documents

NTSB Aircraft Accident Report

15 before mailing them to Fresh Air’s office in Davie, Florida, on a weekly basis. While FAA airworthiness inspectors indicated that Fresh Air personnel were professional and provided all documentation requested during their inspections, Fresh Air was unable to provide the NTSB with numerous requested records, despite the issuance of a subpoena, including the following items:  Copies of any training materials provided to Convair CV-440 pilots by Fresh Air or any contracted training program;  First officer employment records (per GOM, chapter 3, page 2);  Copy of the captain’s FAA check airman letter of authority to conduct checkrides for Fresh Air (per FAA Order 8900.1, Chg 45, volume 3, section 3-1456);  Evidence of authority from the POI to allow Tiger Contract Cargo pilots to conduct proficiency checks of Fresh Air pilots;  Evidence of a check airman observation for the captain from 2005 through 2011, on either Fresh Air’s Convair CV-440 or DC-4;  Evidence of oral or written evaluation for 2011 for the captain on the Convair CV-440 (per 14 CFR 125.287[a]);  Evidence of PIC competency check for 2011 for the captain on the Convair CV-440 (per 14 CFR 125.287[b]);  Evidence of instrument proficiency for 2011 for the captain on the Convair CV-440 (per 14 CFR 125.291);  Copy of Fresh Air’s air carrier certificate;  Status of aircraft (total flight hours and flight cycles at the time of the accident) and Fresh Air master log (flight and maintenance log);  Status of all airworthiness directives (AD)/and SBs incorporated in the accident airplane;  All engine and propeller maintenance records, including part and serial numbers, times since overhaul, and when removed/replaced;  Listing of all supplemental type certificates incorporated on the accident airplane and when accomplished;  Status of the continuous airworthiness maintenance program (for example, all times for when an A-, B-, C-, or D-check or an airframe, propeller, or engine overhaul was performed);  List of all major repairs and alterations to the accident airplane;  Status of all time-limited components on the accident airplane;  Service difficulty reports submitted to the FAA, if any;  Minimum equipment lists present during the accident flight, if any; and  All mechanic training records. Fresh Air’s GOM, chapter 8, page 11, paragraph d, stated that the director of operations is responsible for retaining signed copies of the flight release/load manifests at the principle operations

NTSB Aircraft Accident Report

16 base for departing flights.15 However, a company flight controller who was present during the loading of the accident flight indicated that the flight crew did not leave a copy of the weight and balance information for the accident flight and that “the pilots never left copies of the weight and balance.” The POI said that Fresh Air used the flight logbook page as the flight release and that he received copies every 7 days from the operator after they were sent from the captain’s St. Croix home to the base of operations in Davie, Florida. Fresh Air’s GOM did not include a provision that allowed retaining the only copy of the flight manifest in the airplane then in St. Croix before sending it to Fresh Air’s Davie, Florida, office. The POI noted that he had spoken to Fresh Air about its failure to leave behind required paperwork. The POI acknowledged that no Fresh Air agent was in SJU; thus, no Fresh Air agent could retain copies of the required paperwork at SJU as required by the GOM.16 1.6.2 Operational and Airworthiness Oversight The FAA requires six annual airworthiness inspections on Part 125 operations: a ramp inspection, a spot inspection, an aircraft records inspection, an AD compliance inspection, a suspected unapproved parts procedures inspection, and an inspection of the operator’s approved aircraft inspection program. Fresh Air’s PMI and PAI had conducted all six of the required inspections the year before the accident and had completed three of the six for the year of the accident, including an aircraft records inspection 7 days before the accident. No airworthiness or recordkeeping deficiencies were noted during those inspections. In addition, the FAA requires the following operational inspections for Part 125 certificates: a main base inspection, a ramp inspection, and a manual procedures inspection. The Fresh Air POI stated that he conducted the required main base and manual inspections at Fresh Air’s Davie, Florida, office, which he considered their operational base. He did not conduct any ramp inspections on Fresh Air aircraft; all required ramp inspections were completed by flight standards district office (FSDO) personnel in San Juan. The POI had met the accident captain once and worked with the GM during inspections in Davie, Florida. According to FAA program tracking and reporting subsystem data for Fresh Air, the San Juan FSDO performed the last ramp inspection before the accident on February 18, 2011. Since 2006, nine ramp checks had been performed on Fresh Air Convair airplanes, six of which were on the accident airplane. The POI performed the last main base inspection, which included a review of pilot records and Fresh Air’s GOM, before the accident on January 6, 2012. The POI also performed Fresh Air’s last manual procedures inspection on January 6, 2012. The POI told investigators that he had never been to San Juan and had never ridden on or seen Fresh Air’s airplanes.

15 Title 14 CFR 125.405(d) states, “If a flight originates at a place other than the principal operations base of the certificate holder and there is at that place a person to manage the flight departure for the operator who does not depart on the airplane, signed copies of the documents…may be retained at that place for not more than 30 days before being sent to the principal operations base of the certificate holder.” 16 This is contrary to 14 CFR 125.405(e), which states that the certificate holder shall “Identify in its operations manual the person having custody of the copies of documents retained in accordance with paragraph (d) of this section.”

NTSB Aircraft Accident Report

17 Part 125 does not require line checks on the PIC, and FAA inspector guidance, per FAA Order 1800.56N, specifically notes that “The FAA does not require a cockpit en route inspection for scheduled cargo flights.” However, both FAA17 and Fresh Air18 policies allow an FAA inspector to conduct an en route inspection. The POI told investigators that he had never requested an en route inspection on a Fresh Air airplane or on any of the Part 125 operators for which he had oversight authority. Instead, he relied on the pilot/company owner, the only FAA check airman at the company able to conduct authorization rides, to provide information about the operation. 1.6.3 Captain’s Evaluation Under Lateral Moves Provision Pilot competency checks are typically conducted by an FAA examiner or a check airman from the company that employs the pilot. However, because the captain was the only check airman at Fresh Air, he received his competency check from a check airman at Tiger Contract Cargo, a separate Part 125 certificate holder that Fresh Air had recently purchased. This was allowed under a lateral moves provision19 in FAA inspector guidance. Because of the rarity of the airplane types typically operated under Part 125 (like the Convair) and the limited number of check airmen qualified to perform competency and instrument proficiency checks, pilots who received their 12-month competency and instrument proficiency check from one operator may receive credit for those checks with another operator. Such lateral moves evaluations are limited to Part 125 operations. According to 14 CFR 125.287(a)(1), under the lateral moves provision, pilots are required to be tested on the “operations specifications and manual of the certificate holder.” The manager of the FAA’s Accident Investigation Division indicated after the accident that a pilot should be evaluated on the OpsSpecs and manual of the certificate holder that employs the pilot. However, the POI stated that he did not know whether, under the lateral moves provision, the captain would be evaluated on Fresh Air’s or Tiger Contract Cargo’s OpsSpecs and GOM for the Convair. The captain’s evaluation in Fresh Air’s DC-4 was conducted by a pilot from Florida Air Transport using Florida Air Transport’s OpsSpecs, not Fresh Air’s; the POI stated that the captain “was required to be evaluated on the Florida Air Transport OpsSpecs and operation manual.” 1.6.4 Cargo Loading Procedures Bread pallets were weighed before shipment on a certified and regularly calibrated scale at the Holsum facility and clearly marked with the palletized weight for loading. A Fresh Air flight coordinator said that loads came in from the bread company palletized and that they would then offload and reweigh them on a scale in the hangar next to the airplane. When the weights were different, the reweighed weight was given to the captain as the actual cargo weight.

17 FAA Advisory Circular 125-1, “Operations of Large Airplanes Subject to Federal Aviation Regulations Part 125,” addressed en route inspections for Part 125 operators. 18 The Fresh Air GOM, chapter 4, page 10, authorized FAA inspector access to Fresh Air aircraft cockpits. 19 The lateral moves provision is defined in FAA Order 8900.1, volume 5, chapter 2, section 10, “Conduct a 14 CFR Part 125 Pilot Competency or Instrument Proficiency Check.”

NTSB Aircraft Accident Report

18 The POI was unaware of this procedure used by Fresh Air and indicated, “I would want to know about it, but I relied on the information from San Juan who did the checks.” The investigation uncovered no evidence that Fresh Air’s cargo loading procedures were inspected during any ramp inspection, either by the POI or any FSDO ASI in SJU to whom he assigned ramp inspections, and none were required. Further, the investigation did not reveal any documentation that ensured that the Fresh Air scale was calibrated and accurate.

NTSB Aircraft Accident Report

19

1. Investigation and Analysis
2. 1 General

The weather on the morning of the accident (10 mi of visibility and a 5-knot wind from 120˚) was not a factor in the accident. ATC services provided to the accident flight, including after the flight crew declared an emergency, were sufficient and were not a factor in the accident. Additionally, the airport’s response to the crash was both adequate and timely. This analysis will focus on the flight crew, the airplane, Fresh Air’s operation of the airplane, and the FAA’s oversight of Fresh Air. 2.2 Maximum Allowable Takeoff Weight According to the Convair CV-440 AFM, the ADI system was required to be operative for all takeoffs at the maximum allowable takeoff weight. The Convair CV-440 also had an autofeather system that automatically feathered the propeller in the event of an engine failure. Feathering the propeller on a failed engine decreases drag, assisting the flight crew with single-engine operation. For airplanes like the Convair CV-440, it is critical that the ADI and autofeather systems are operative for each takeoff to ensure that the engines are optimized for maximum performance in the event of an engine failure or in-flight shut down. Because the accident airplane had no flight data recorder to verify use of the ADI or autofeather systems on the accident flight, the NTSB interviewed former Fresh Air pilots who flew with the captain to understand how he typically used the systems on takeoff. The pilots indicated that the accident captain did not generally use either the ADI or the autofeather systems, and one pilot noted that the autofeather system on the accident airplane was not operative since the circuit breaker was pulled.20 Additionally, the Fresh Air GM told investigators that the captain would likely have had the autofeather off during the accident flight. Using documentation of the cargo weight provided by Holsum, the NTSB estimated that the ramp weight of the airplane for the accident flight was 47,710 lbs and that the takeoff weight was 47,510 lbs.21 The Convair CV-440 AFM allows a maximum takeoff weight of 48,000 lbs with the ADI system armed and 40,900 lbs with the ADI system unarmed. The maximum allowable operating weight for a takeoff with the autofeather system inoperative was 43,500 lbs. Thus, the takeoff weight of 47,510 lbs would have required that both the ADI system be armed and the autofeather system be on for takeoff. However, the autofeather switch was in the UNARMED position. The NTSB concludes that based on the captain’s history of ADI and autofeather nonuse and the postaccident position of the autofeather switch, the flight crew likely did not use the ADI and autofeather systems during the takeoff; as a result, the accident airplane exceeded the maximum allowable takeoff weight of 40,900 lbs.

20 Due to impact damage, the investigation was unable to determine the state of the autofeather circuit breaker. 21 Because of the absence of weight and balance paperwork, investigators were unable to determine the exact weight of the accident airplane at takeoff.

NTSB Aircraft Accident Report

20 2.3 Return to the Airport The airplane lifted off normally; however, within 2 min, the first officer contacted the departure controller to declare an emergency, and the captain then requested a left turn back to the airport. Following the announcement of an emergency after takeoff, the captain contacted the tower controller to ask if the controller saw smoke. The tower controller confirmed the transmission but did not see any indication of smoke. Pilots flying multiengine aircraft are generally trained to shut down the engine experiencing a problem and feather that propeller; thus, the flight crew likely intended to shut down the right engine22 by bringing the mixture control lever to the IDLE CUTOFF position and feathering the right propeller, as called out in the Engine Fire In Flight checklist. This would have left the flight crew with the left engine operative to return to the airport. However, postaccident examinations revealed that the left propeller was found feathered at impact, with the left engine settings consistent with the engine at takeoff or climb setting. The right engine settings were generally consistent with the engine being shut down; however, the right propeller’s pitch was consistent with a high rotation/takeoff power setting. Had the autofeather system been ARMED, the right propeller would have automatically started the feathering process and, simultaneously, a blocking relay would be energized, preventing the left propeller from feathering. Because the autofeather system was not activated, the flight crew had to manually feather the propeller and likely manually selected the left propeller to feather at some point before impact with the water. The accident airplane was not equipped with a flight data recorder or a cockpit voice recorder (nor was it required to be so equipped); hence, the investigation was unable to determine at what point in the accident sequence the flight crew shut down the right engine and at what point they feathered the left propeller, or why they would have done so. Other Convair pilots described the airplane as only holding altitude at best on a single engine and when heavily loaded. As noted earlier, the airplane was above the maximum allowable takeoff weight, making it even more difficult for the flight crew to maintain altitude or airspeed when operating with one engine. Radar data indicate that the airplane continued to climb at greater than the single-engine climb speed until the tower controller cleared the flight to land after the flight crew declared an emergency, indicating that the right engine was likely not shut down until the airplane was cleared to land. The radar data then indicate a relatively steady decline in altitude until the final right turn to align with runway 28. The calculated airspeed on the accident flight was around 140 knots when the airplane began to bank to the right to line up with runway 28, but then decreased during the right turn. The NTSB concludes that although the flight crew feathered the left propeller at some point during the return to the airport, the feathering likely occurred late in the accident sequence because the flight profile indicates that at least one engine was generating thrust until near the end of the flight. When operating with a single engine, the loss of the other engine’s thrust introduces an asymmetry that needs to be counteracted by pilot input. The rudder is used to offset the yaw from the engine thrust asymmetry; additionally, in the process of countering the yaw from the lack of thrust from one engine, roll effects are also introduced that the pilot must also control for. Pilots must always maintain a flying speed above the minimum controllable airspeed, Vmc, to ensure

22 Although the investigation was not able to determine why the crew chose to shut down the engine, they likely suspected an engine fire due to the smoke.

NTSB Aircraft Accident Report

21 effectiveness of the rudder and maintain positive control of the airplane. According to the Convair CV-440 AFM, at an altitude just above msl and for the maximum gross weight of the accident airplane, Vmc is 87 knots. Additionally, Vmc is sensitive to bank angle; the Vmc referenced in the AFM is determined using no greater than 5˚ of bank angle into the operating engine. Radar data show that as the airplane was heading south at an altitude of about 520 ft, it began a descending turn to the right to line up with runway 28. As the airplane reached a calculated bank angle of 30˚ right-wing-down, the calculated airspeed remained between 120 and 140 knots. The bank angle then reduced and the airplane leveled off near 200 ft; however, the calculated airspeed continually dropped as the airplane reduced its bank angle to stop the turn and align with the runway. At the end of the recorded radar data, the airplane was close to both aerodynamic stall and the controllability limit for one-engine-inoperative flight. Radar contact was lost with the airplane at 100 ft as it continued the right turn; shortly thereafter, the airplane struck trees with its right wingtip and crashed into the lagoon while traveling in a northerly direction. The NTSB concludes that the airspeed of the airplane reduced to a point where the airplane either experienced an aerodynamic stall or it dropped below the minimum control speed during the right turn to align with runway 28. Postaccident examination of the airplane indicated fire and thermal damage to the airframe on the airplane’s right wing rear spar, the right engine nacelle aft of the power section, and in the vicinity of the junction between the augmentor assemblies and the exhaust muffler assembly. All of the fire and thermal damage was located aft of the engine and the fire detection/warning system installed on the airplane. Additionally, the condition of the paint on the upper right wing skin within the nacelle area was consistent with long-term exposure to high heat exceeding normal operation. The paint discoloration and lack of oil residue on the right augmentors when compared to the left augmentors and when compared with augmentors from an exemplar airplane indicated that the right side was exposed to much higher temperatures than the left side. While the investigation could not determine the exact location of the ignition source, it appears to have been aft of the engine in the vicinity of the junction between the augmentor assemblies and exhaust muffler assembly. Statements from mechanics familiar with this type of airplane indicate exhaust fires do occur in the augmentors on this type of aircraft. Under normal conditions, the fire is exhausted out the muffler assembly, resulting in little or no damage to the aircraft. A fire leaking out of the augmentor assembly at the junction with the muffler assembly would have produced the damage that was found on the accident aircraft. Although the source of fuel for the fire could not be determined, oil or fuel leaks into the exhaust system are capable of igniting in the presence of the high heat within the augmentors and would have led to the exhaust fire. Thus, the NTSB concludes that the thermal damage to the airplane resulted from the ignition of a flammable liquid in one of the right augmentors, and a leak in the vicinity of the augmentor/muffler junction allowed the fire to exit the junction and damage portions of the right wing. Of note is that the captain witnessed a Tiger Contract Cargo Convair engine fire after takeoff from St. Thomas in January of 2011. The captain was flying over St. Thomas at the time; he witnessed the engine fire and radioed the pilot to land as soon as possible. NTSB investigators who examined the St. Thomas Convair characterized the engine fire experienced on the

NTSB Aircraft Accident Report

22 St. Thomas Convair as extensive, and the captain may have recalled the severity of that event when he experienced this engine fire, which could have affected his decision-making. While postaccident examination of the airplane from the San Juan accident indicated that the engine fire appeared to be less severe than the previous event, the flight crew would not have been aware of its severity during the flight. 2.4 Human Performance 2.4.1 Flight Crew Roles The investigation attempted to determine who was the pilot flying (PF) and who was the pilot monitoring (PM) on the accident flight. According to interviews with other Fresh Air pilots who flew with the accident captain, the captain typically flew the outbound flight loaded with cargo because it was the heaviest, and the first officer typically flew the return leg, which was usually empty. No evidence suggests that this flight warranted a different assignment of pilot duties, particularly because the first officer had only recently received Convair retraining 2 weeks earlier after Fresh Air rehired him. Fresh Air’s GM (the captain’s son) stated that the first officer made the initial transmission to ATC declaring an emergency, indicating that the captain was initially the PF and the first officer was handling communications. However, after the emergency declaration, the captain made all further communications with ATC, and the injuries incurred by the flight crew at impact23 were consistent with the first officer flying and the captain handling radio communications. The investigation was therefore unable to determine why the captain allowed the first officer to fly the airplane when faced with an emergency. However, the captain, as the PIC, was ultimately responsible for the operation of the airplane.24 The first officer received his commercial airplane multiengine land and instrument certificate in 2001. As noted earlier, between 1996 and 2008, the first officer received five notices of disapproval for his flight training. The first officer began pilot training (ground school) at Seaborne Airlines in early 2009 but did not successfully complete simulator training and was not hired by the company. At the time of the accident, the first officer had about 700 hours as SIC in the Convair CV-440. He had accrued 16 hours in the Convair CV-440 in the 30 days before the accident but had accrued no additional flight time in the 12 months before the accident. The NTSB concludes that flight crew injuries were consistent with the first officer flying the airplane at the time of impact; however, considering the first officer’s limited recent experience in the Convair CV-440 and the performance deficiencies identified in his training and certification history, he was likely not capable of handling the emergency without help from the captain.

23 The first officer sustained fractures to both radii and both ulnas and also a fracture of the left femur, indicating that he was likely flying the airplane at the time of impact; the captain was found with the airplane’s microphone and cord wrapped around his left forearm, suggesting that he was handling communications at the time of impact. 24 Title 14 CFR 91.3 states that “The pilot in command of an aircraft is directly responsible for, and is the final authority as to, the operation of that aircraft.”

NTSB Aircraft Accident Report

23 2.4.2 The Role of Fatigue/Impairment Toxicology testing detected a blood ethanol level of 27 mg/dL for the captain. Title 14 CFR 91.17(a) prohibits any person from acting or attempting to act as a crewmember of a civil aircraft while having 40.0 mg/dL or more ethanol in the blood. Although the amount of ethanol detected in the captain’s blood was below the maximum level stated in 14 CFR 91.17(a), adverse clinical symptoms have been noted with blood ethanol levels as low as 20.0 mg/dL (Ogden and Moskowitz 2004, 185-198). Accordingly, the investigation sought to determine whether some or all of the ethanol detected was from postmortem decomposition or if some was from ingestion and may have impaired the captain’s decision-making during the accident sequence. The captain’s activities on the night before the accident are not known with sufficient resolution to determine whether he ingested alcohol. However, because of the varied ethanol levels in the captain’s tissue,25 the ethanol was not likely from ingestion. Although an in-flight fire was an emergency situation, a flight crew applying effective crew resource management, adhering to their PF and PM duties, and properly using a checklist to handle the emergency should have been able to maintain positive control of the airplane. Flight crews encountering emergency situations, such as on this flight, are frequently faced with high levels of stress due to workload and time pressures, among other factors, and may make errors or face performance limitations directly linked to human cognitive limitations. Although moderate stress can improve performance, errors and performance degradations occur when a pilot experiences high stress and becomes overloaded. Research indicates that a pilot may focus on a narrow piece of information that is perceived to be most threatening or salient and exclude other important information (Wickens 1984, 417). For example, stress can lead to a phenomenon known as “tunnel vision,” or the narrowing of attention, in which basic information like airspeed can be overlooked as the scan of all environmental cues may be restricted. To determine why an experienced captain allowed the airplane’s airspeed to fall so low, the NTSB reviewed the limited available data to evaluate fatigue as a factor degrading the flight crew’s performance. Conditions that can lead to the development of a fatigued state include chronic or acute sleep loss,26 circadian disruption, and extended time since awakening.27 Circadian disruption and extended time since the flight crew awoke were not factors in this accident. Specifically, the accident occurred about 0740, a time not typically indicative of

25 The ethanol level in the captain’s brain was 41 mg/dL, and the ethanol level in his muscle was 26 mg/dL. Ethanol ingested by live individuals is distributed symmetrically throughout the body. Therefore, postmortem tests reflecting ingestion are very similar across different tissues. After death, ethanol can be produced by microbial action in the body’s tissues; results from this production tend to vary quite widely from one tissue to the next. 26 Acute sleep loss occurs when a person has total or partial sleep loss for no more than several days. 27 The NTSB’s 1994 study of flight crew-related major aviation accidents indicated that fatigue related to length of time since awakening may be related to errors made by flight crewmembers. The NTSB found that crews that had extended time since awakening (over 13 hours awake) made an average of 40% more errors than crews that did not have extended time since awakening (about 5 hours awake). Further, research into quantifying performance impairment associated with sustained wakefulness found that performance remains relatively stable throughout the time that coincides with a normal waking day but that prolonged wakefulness of 17 hours can result in measurable performance impairment comparable to having a blood alcohol concentration of 0.05% or higher (Dawson and Reid 1997, 235; Lamond and Dawson 1999, 255-262).

NTSB Aircraft Accident Report

24 reduced alertness due to circadian disruption. Cell phone records indicate that the captain had likely been awake about 4 hours at the time of the accident, so performance degradation resulting from an extended time since awakening was ruled out. Because of the limited data available, the investigation could not establish if the captain accumulated a chronic sleep debt beyond the 72 hours before the accident; based on cell phone records, he had adequate opportunity to sleep on March 12 and 13. The captain’s normal sleep pattern was not available. However, the day before the accident flight, the captain made and received multiple phone calls and text messages from about 1147 until about 2343. While it is possible that he took advantage of a break in cell phone activity to sleep between about 2208 and about 2342, his sleep would have been less than 90 min in duration, as he checked his voicemail about 2343. Further, the captain received a call about 0343 on the morning of the accident, giving him an uninterrupted sleep opportunity of only 4 hours the night before the accident flight, which is less than the average of 7 to 9 hours of sleep that adults typically need per night (National Sleep Foundation 2014). The captain was likely experiencing 3 to 5 hours of sleep loss at the time of the accident. Cell phone activity and flight logs from the captain’s flight from St. Croix to San Juan on the morning of the accident indicate that there were no additional opportunities for sleep before the flight. Scientific research and accident investigations have recognized the negative consequence of fatigue on human performance and as few as 2 hours sleep loss can lead to performance decrements (Carskadon and Roth 1991, 155-167). Even if the captain had taken advantage of the two sleep opportunities, the combined sleep is less than the average sleep needed for adults and fragmented sleep is less restorative than unfragmented sleep (Steptanski 2002, 268-276). Fatigue can cause reduced alertness and degraded mental and physical performance, such as slowed response time, a breakdown in vigilance, degraded decision-making and risk assessment, and reduced leadership (Caldwell 1997, 932-938; Haslam 1984, 216-221; Kruger 1989, 129-141; NTSB 2011; and NTSB 2006). Specifically, this sleep loss would have led to degraded decision-making, inadequate risk assessment, and reduced leadership, all skills that would have been critical during the accident sequence. Given the minimal amount of time the flight crew had to process the emergency and the overweight airplane with neither the ADI nor autofeather systems armed during takeoff, the captain would have had to assess the emergency and act quickly and appropriately to address it. Further, with a first officer who had relatively little recent time in the Convair as the PF, the need for the captain’s clear, unimpeded leadership would have been critical. The NTSB concludes that the captain was likely suffering from acute sleep loss at the time of the accident, which would have negatively affected his ability to guide the first officer in properly handling the emergency. According to the first officer’s cell phone records, on March 14, the first officer made and received multiple calls and text messages between about 1030 and about 2255. On March 15, cell phone activity began about 0505, providing a sleep opportunity of about 6 hours. He made and received multiple calls and text messages until about 0719, with a break in activity from about 0556 until about 0659. The first officer did not likely use this time as a sleep opportunity, as the Fresh Air GOM states that pilots should arrive 1 hour before the scheduled departure time; the first officer was likely commuting to and arriving at the airport during this break. The first officer’s normal sleep pattern was not available, so it is not possible to know if the limited sleep opportunity was unusual; however, it is likely that he was experiencing 1 to

NTSB Aircraft Accident Report

25 3 hours of sleep loss at the time of the accident. Because of the limited information available and his relative inexperience in the accident airplane, the investigation was unable to determine the extent to which fatigue played a role in the first officer’s performance at the time of the accident. 2.5 FAA Oversight The FAA CMO for Fresh Air was located in Miramar, Florida. At the time of the accident, the POI, PMI, and PAI for the Fresh Air certificate were all located in Orlando, Florida. The FAA requires three operational inspections on a Part 125 certificate holder each year: a main base inspection, a manual procedures inspection, and a ramp inspection. Fresh Air’s POI conducted all required main base and manual procedures inspections (including a review of pilot records and the GOM) at Fresh Air’s Davie, Florida, office, with the most recent inspections occurring on January 6, 2012. The San Juan FSDO performed the last ramp inspection before the accident on February 18, 2011. A review of the captain’s duty time records found numerous discrepancies, inaccuracies, and missing information. In addition, Fresh Air was unable to verify that the captain had successfully completed his annual competency check in the 12 months before the accident, as required by 14 CFR 125.401. Records indicate that on June 24, 2010, the captain received a 12-month Part 125 competency check28 in the Convair CV-440 from a Tiger Contract Cargo check airman. This competency check would have allowed him to operate the Fresh Air Convair CV-440 as PIC for 12 calendar months (until June 30, 2011). The captain should have received an annual competency check at some point between March 1, 2011, and March 15, 2012, to be current for the accident flight. There was no record that such a check occurred or that an instrument proficiency check had been completed. Fresh Air’s GM incorrectly assumed that one checkride covered both scenarios because he believed that competency checks and check airmen observations could be combined. A competency check requires the pilot to physically manipulate the controls of the airplane and may include any of the maneuvers and procedures currently required for the original issuance of the particular pilot certificate or rating required for the operations authorized and appropriate to the category, class, and type of airplane involved. A check airman evaluation flight, required every 2 years in the specific type of airplane in which the pilot plans to conduct evaluations, is considered to be a practical test of the check airman’s ability to test other airmen, not his flying ability. The POI failed to discover the anomaly. The investigation did not find any documentation showing that the accident captain was current to operate as PIC under the provisions of Part 125. Despite the FAA’s recent aircraft records inspection and Fresh Air’s cooperation, the investigation was unable to locate current documentation related to the accident airplane’s status, including AD and SB compliance, engine and propeller records, applicable supplemental type certificates, major airplane repairs and alterations, the status of time-limited components, service

28 Title 14 CFR 125.287(b) requires each pilot receive a competency check every 12 calendar months, and 14 CFR 125.291(a) requires the PIC to receive an instrument proficiency check every 6 calendar months. The instrument proficiency check required by 14 CFR 125.291 may be substituted for the competency check required by this section for the type of airplane used in the check.

NTSB Aircraft Accident Report

26 difficulty reports, minimum equipment lists, or continuous airworthiness maintenance program information. Additionally, Fresh Air was unable to provide current mechanic training records. As noted earlier, the investigation relied on physical evidence from the wreckage to determine that modifications associated with SB 340-144B, which permits operation of the Convair CV-340 in accordance with the performance limitations contained in the Convair CV-440 AFM, were incorporated on the accident airplane. The NTSB acknowledges that the certificate holder (Fresh Air) has the responsibility to maintain current records of its flight crewmembers and aircraft. However, the FAA’s required annual inspections of each certificated operator include a review of pilot records and currency and of aircraft maintenance records. During the last documented main base inspection before the accident, the POI should have discovered the recordkeeping discrepancies and instructed the operator to verify the captain’s currency. Likewise, the PMI should have discovered Fresh Air’s critically deficient recordkeeping during the last documented aircraft records inspection, conducted 7 days before the accident, or during any of the six inspections that the PMI and PAI conducted in the year before the accident. Thus, the NTSB concludes that Fresh Air failed to keep accurate and complete records, and the FAA did not address Fresh Air’s deficient recordkeeping; thus, the FAA’s oversight of Fresh Air’s recordkeeping was inadequate. Additionally, although Fresh Air operated cargo flights, the investigation found no evidence that its cargo loading procedures were inspected during any Fresh Air ramp inspection, either by the POI or any FSDO ASI in SJU to whom the POI assigned ramp inspections. Apparently unknown to the FAA, Fresh Air would reweigh pallets that arrived at the airport after being unloaded from the Holsum truck and before being loaded on the airplane, even though the pallets were weighed on a certified and regularly calibrated scale at Holsum. While this procedure to reweigh the pallets could be helpful when a pallet had to be broken down, Fresh Air reweighed all pallets, and the weight was given to the captain as the actual weight of the cargo. The investigation did not reveal any documentation ensuring the Fresh Air scale was calibrated and accurate. Thus, the pilots may not have been using appropriate weight information when calculating the airplane’s weight and balance, further reducing their margin of safety. The POI was unaware of this Fresh Air procedure. Although Fresh Air’s cargo loading procedures did not contribute to the accident, the FAA failed to detect and address discrepancies between Fresh Air’s approved procedures and operational reality, including cargo loading, pilot currency, company recordkeeping, and pilot evaluation. Effective oversight of Part 125 operations also relies on complete and thorough inspections of an operator’s recordkeeping and compliance with its own and FAA procedures. Multiple FAA inspectors visited the operation but failed to detect or address a litany of issues, including deficient pilot and maintenance recordkeeping and unapproved cargo loading procedures. During the investigation, the NTSB found evidence suggesting that oversight of Part 125 operations was not seen as a priority. For example, Fresh Air’s POI told investigators that Part 125 was generally “a GA [general aviation] operation,” not an air carrier operation. While most of their flights were relatively close to San Juan, Fresh Air’s OpsSpecs authorized it to operate commercially over the 48 contiguous states, meriting far more scrutiny than “a GA operation.” Another former Part 125 POI told investigators that Part 125 “has always been a loose regulation” because they are normally cargo operations and “not a big threat to the public.” Combined with the basic gaps in oversight by multiple FAA inspectors related to Fresh Air’s

NTSB Aircraft Accident Report

27 cargo loading, pilot currency, company recordkeeping, and pilot evaluation practices, such statements indicate an ineffective oversight regimen for Part 125 operations. As Fresh Air’s POI told investigators, “we need more oversight for these types of operators to promote a safety culture.” The NTSB concludes that multiple FAA inspectors failed to perform effective oversight of Fresh Air, possibly due to a belief that Part 125 operations merit less scrutiny than Part 121 and 135 operations, despite the fact that the airplanes fly over populated areas within the national airspace system. Therefore, the NTSB recommends that the FAA evaluate the effectiveness of its Part 125 oversight program and ensure that Part 125 operations are conducted at the same level of safety as that of Parts 121 and 135. 2.6 En Route Inspections Since 2007, when the POI began his oversight of Fresh Air, FAA personnel did not conduct any line checks or en route inspections on any Fresh Air airplane. As noted earlier, the POI relied on main base and manual procedures inspections at Fresh Air’s main office in Davie, Florida, to review Fresh Air’s pilot records, maintenance records, and manuals. When asked how he would know if Fresh Air was flying in accordance with its GOM, OpsSpecs, and the Convair CV-440 AFM, the POI said that he relied on the pilot/owner of the company, who was the only FAA check airman to conduct authorization rides, to provide information about the operation. He added that regular line checks are also important but also stated that he never conducted any. However, there is no evidence that the POI asked the SJU FSDO to verify Fresh Air’s operational compliance with its manuals. En route inspections provide the FAA an opportunity to verify that an operation complies with operational regulations, the operator’s FAA-approved procedures, and the limitations outlined in the FAA-approved AFM. Operations conducted under 14 CFR Parts 135 and 121 incorporate these annual en route inspections into their line checks, which include an observation of the PIC to ensure that the PIC satisfactorily performs his or her duties and responsibilities under the regulations.29 However, Part 125 does not require the FAA to conduct en route inspections on Part 125 operators to accomplish similar compliance verification. Both FAA30 and Fresh Air31 policies allow for an FAA inspector to conduct an en route inspection; however, FAA inspector guidance, in FAA Order 1800.56N, specifically notes that “The FAA does not require a cockpit en route inspection for scheduled cargo flights.”

29 In its report discussing the July 31, 2008, accident involving a Hawker Beechcraft 125-800A that crashed while attempting to go around after landing in Owatonna, Minnesota, the NTSB issued Safety Recommendation A-11-30, which asked the FAA to require that Part 135 PIC line checks be conducted independently from other required checks and be conducted on flights that represent typical revenue operations. The NTSB classified Safety Recommendation A-11-30 “Closed—Unacceptable Action” on November 7, 2013, after the FAA replied that it had reviewed its existing policy and guidance to POIs regarding PIC line checks and that the implications of the recommended action on inspector workload would be logistically problematic and would increase the FAA’s workload. 30 FAA Advisory Circular 125-1, “Operations of Large Airplanes Subject to Federal Aviation Regulations Part 125,” addressed en route inspections for Part 125 operators. 31 The Fresh Air GOM, chapter 4, page 10, authorized FAA inspector access to Fresh Air aircraft cockpits.

NTSB Aircraft Accident Report

28 En route inspections are a critical part of the FAA oversight responsibility to ensure that pilots and the operator properly adhere to the operational limitations and procedures outlined in the certificate holder’s FAA-approved GOM and AFM. It is of little value for the FAA to ensure that an operator complies with proper pilot records and manual requirements if the FAA does not ensure that flight crews are applying those procedures and limitations during the actual operation of the airplane. A former Part 125 POI told the NTSB, “there would be no way to know if an operator was operating in accordance with their OpSpecs and flight manual limitations unless you visited the operation in person and conducted en route observations.” Ultimately, the POI was responsible for the operational oversight of Fresh Air. In this case, Fresh Air pilots were operating the accident airplane contrary to the AFM by operating with the autofeather system disconnected and the ADI system off, yet using the higher gross takeoff weight than permitted with these systems off. Therefore, the NTSB concludes that because the POI had never directly observed Fresh Air’s operation, he was unaware that the airplanes were being operated contrary to the limitations outlined in the FAA-approved AFM. Thus, the NTSB recommends that the FAA require all POIs of Part 125 certificate holders to conduct at least one en route inspection annually on each airplane type operated by the certificate holder. 2.7 Evaluation of Pilot Knowledge An FAA examiner or a check airman from the company that employs the pilot typically performs instrument proficiency and Part 125 competency checks, and 14 CFR 125.287(a)(1) requires that pilots be tested on the “operations specifications and manual of the certificate holder.” However, because of the rarity of the airplane types typically operated under Part 125 (such as the Convair CV-440) and the limited number of check airmen qualified to perform these checks, pilots who received their 12-month required competency and instrument proficiency check from one operator could receive credit for those checks with another operator. According to the FAA, this was allowed under a lateral moves provision defined in FAA inspector guidance.32 During its investigation, the NTSB noted confusion among operators and FAA personnel regarding the applicable OpsSpecs that check airmen must use during certain checkrides made under the lateral moves provision. While it unlikely affected the captain’s capability to handle the accident, his competency check was not necessarily conducted using Fresh Air’s OpsSpecs or GOM. Because the captain of the accident flight was the only check airman at Fresh Air, he received his competency check on the Convair from a check airman at Tiger Contract Cargo, a separate Part 125 certificate holder that Fresh Air had recently purchased. While the investigation could not determine under which company’s OpsSpecs and operations manual the captain was evaluated for the Convair CV-440, Fresh Air’s POI stated that for the captain’s DC-4 evaluation, he “was required to be evaluated on Florida Air Transport’s OpsSpecs and operation manual.” The lateral moves provision does not clarify whether the pilot should be evaluated on the OpsSpecs and manual of the certificate holder of the check airman or of the certificate holder

32 The lateral moves provision is defined in FAA Order 8900.1, volume 5, chapter 2, section 10, “Conduct a 14 CFR Part 125 Pilot Competency or Instrument Proficiency Check.”

NTSB Aircraft Accident Report

29 that employs the pilot. In response to an NTSB inquiry, the FAA stated that the pilot should be evaluated on “the operation specifications and manual of each certificate holder that employs the pilot.” However, FAA guidance on the proper OpsSpecs and manuals to be used during a checkride is not clear, as evidenced by the Fresh Air POI’s belief that Florida Air Transport could conduct a lateral moves checkride on a Fresh Air pilot using Florida Air Transport’s OpsSpecs and manuals. The NTSB concludes that the FAA failed to ensure that the captain had been evaluated on his knowledge of Fresh Air’s OpsSpecs in the 12 months before the accident and that the FAA’s inspector guidance did not specify that pilots evaluated under the Part 125 lateral moves provision be evaluated on the OpsSpecs of the certificate holder that employs the pilot. Therefore, the NTSB recommends that the FAA require check airmen who evaluate pilots under the Part 125 lateral moves provision to use the OpsSpecs of the certificate holder employing the pilot who is receiving the proficiency check to ensure a proper evaluation of the pilot’s knowledge of these specifications.

NTSB Aircraft Accident Report

30

1. Conclusions
2. 1 Findings
3. Based on the captain’s history of antidetonation injection (ADI) and autofeather nonuse and

the postaccident position of the autofeather switch, the flight crew likely did not use the ADI and autofeather systems during the takeoff; as a result, the accident airplane exceeded the maximum allowable takeoff weight of 40,900 lbs.

Although the flight crew feathered the left propeller at some point during the return to the airport, the feathering likely occurred late in the accident sequence because the flight profile indicates that at least one engine was generating thrust until near the end of the flight.

The airspeed of the airplane reduced to a point where the airplane either experienced an aerodynamic stall or it dropped below the minimum control speed during the right turn to align with runway 28.

The thermal damage to the airplane resulted from the ignition of a flammable liquid in one of the right augmentors, and a leak in the vicinity of the augmentor/muffler junction allowed the fire to exit the junction and damage portions of the right wing.

Flight crew injuries were consistent with the first officer flying the airplane at the time of impact; however, considering the first officer’s limited recent experience in the Convair CV-440 and the performance deficiencies identified in his training and certification history, he was likely not capable of handling the emergency without help from the captain.

The captain was likely suffering from acute sleep loss at the time of the accident, which would have negatively affected his ability to guide the first officer in properly handling the emergency.

Fresh Air failed to keep accurate and complete records, and the Federal Aviation Administration (FAA) did not address Fresh Air’s deficient recordkeeping; thus, the FAA’s oversight of Fresh Air’s recordkeeping was inadequate.

Multiple Federal Aviation Administration (FAA) inspectors failed to perform effective oversight of Fresh Air, possibly due to a belief that Part 125 operations merit less scrutiny than Part 121 and 135 operations, and despite the fact that the airplanes fly over populated areas within the national airspace system.

Because the principal operations inspector had never directly observed Fresh Air’s operation, he was unaware that the airplanes were being operated contrary to the limitations outlined in the Federal Aviation Administration-approved airplane flight manual.

NTSB Aircraft Accident Report

31

1. The Federal Aviation Administration (FAA) failed to ensure that the captain had been

evaluated on his knowledge of Fresh Air’s operations specifications (OpsSpecs) in the 12 months before the accident and the FAA’s inspector guidance did not specify that pilots evaluated under the Part 125 lateral moves provision be evaluated on the OpsSpecs of the certificate holder that employs the pilot. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the flight crew’s failure to maintain adequate airspeed after shutting down the right engine due to an in-flight fire in one of the right augmentors. The failure to maintain airspeed resulted in either an aerodynamic stall or a loss of directional control.

NTSB Aircraft Accident Report

32

1. Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following recommendations to the Federal Aviation Administration: Evaluate the effectiveness of your 14 Code of Federal Regulations (CFR) Part 125 oversight program and ensure that 14 CFR Part 125 operations are conducted at the same level of safety as that of Parts 121 and 135. (A-14-110)

Require all principal operations inspectors of 14 Code of Federal Regulations Part 125 certificate holders to conduct at least one en route inspection annually on each airplane type operated by the certificate holder. (A-14-111)

Require check airmen who evaluate pilots under the 14 Code of Federal Regulations Part 125 lateral moves provision to use the operations specifications of the certificate holder employing the pilot who is receiving the proficiency check to ensure a proper evaluation of the pilot’s knowledge of those specifications. (A-14-112)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Acting Chairman Member

MARK R. ROSEKIND

Member

EARL F. WEENER

Member Adopted: November 17, 2014

NTSB Aircraft Accident Report

33 References Caldwell, John A. “Fatigue in the Aviation Environment: An Overview of the Causes and Effects as Well as Recommended Countermeasures.” Aviation, Space, and Environmental Medicine 68 (1997): 932-938. Carskadon, Mary A., and Thomas Roth. 1991. “Sleep Restriction,” Sleep, Sleepiness and Performance, Timothy H. Monk, ed. Chichester, England: John Wiley & Sons, 155–167. Dawson, Drew and Kathryn Reid. “Fatigue, Alcohol and Performance Impairment.” Nature, vol. 388, no. 6639 (1997): 235. Haslam, Diana R. “The Military Performance of Soldiers in Sustained Operations.” Aviation, Space, and Environmental Medicine 55 (1984): 216-221. Kruger, Gerald P. “Sustained Work, Fatigue, Sleep Loss, and Performance: A Review of the Issues.” Work and Stress 3 (1989): 129-141. Lamond, Nicole and Drew Dawson. “Quantifying the Performance Impairment Associated with Sustained Wakefulness.” Journal of Sleep Research, vol. 8 (1999): 255-262. National Sleep Foundation. “How Much Sleep Do We Really Need?” http://www.sleepfoundation.org/article/how-sleep-works/how-much-sleep-do-we-really- need. (accessed May 13, 2014). NTSB (National Transportation Safety Board). 2011. Crash During Attempted Go-Around After Landing, East Coast Jets Flight 81, Hawker Beechcraft Corporation 125-800A, N818MV, Owatonna, Minnesota, July 31, 2008. AAR-11/01. Washington, DC: NTSB. ---. 2006. Collision with Trees and Crash Short of Runway, Corporate Airlines Flight 5966, British Aerospace BAE-J3201, N875JX, Kirksville, Missouri, October 19, 2004. AAR-06/01. Washington, DC: NTSB. ---. 1994. A Review of Flightcrew-Involved, Major Accidents of U.S. Carriers, 1978 through

1. SS-94/01. Washington, DC: NTSB.

Ogden, Edward J.D., and Herbert Moskowitz. “Effects of Alcohol and Other Drugs on Driver Performance.” Traffic Injury Prevention 5 (2004): 185-198, doi10.1080/15389580490465201. Steptanski, Edward J. “The Effect of Sleep Fragmentation on Daytime Function.” Journal of Sleep 25, no. 3 (2002): 268-276. Wickens, Christopher D. 1984. Engineering Psychology and Human Performance. Edition 1. Columbus, OH: Charles F. Merill.

FD07420 ｜ 2014_美国_HAR1402.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Highway–Railroad Grade Crossing Collision Rosedale, Maryland May 28, 2013

Accident Report NTSB/HAR-14/02 PB2014-109131

National Transportation Safety Board

NTSB/HAR-14/02 PB2014-109131 Notation 8511A Adopted October 8, 2014

Highway Accident Report Highway–Railroad Grade Crossing Collision Rosedale, Maryland May 28, 2013

National Transportation Safety Board

490 L’Enfant Plaza SW Washington, DC 20594

National Transportation Safety Board. 2014. Highway–Railroad Grade Crossing Collision, Rosedale, Maryland, May 28, 2013. Highway Accident Report NTSB/HAR-14/02. Washington, DC.

Abstract: On May 28, 2013, about 1:59 p.m., a 2003 Mack Granite truck, operated by Alban Waste, LLC, was traveling northwest on a private road in Rosedale, Maryland, toward a private grade crossing. The truck was carrying a load of debris to a recycling center located 3.5 miles from the carrier terminal. About the same time, a CSX Transportation Company (CSXT) freight train—which consisted of two locomotives, 31 empty cars, and 14 loaded cars—was traveling southwest at a speed of 49 mph. As the train approached the crossing, the train horn sounded three times. The truck did not stop and was hit by the train. Three of the 15 derailed cars contained hazardous materials. The other derailed cars contained non-US Department of Transportation-regulated commodities, or were empty. One car loaded with sodium chlorate crystal and four cars loaded with terephthalic acid released their products. Following the derailment, a postcrash fire resulted in an explosion at 2:04 p.m., which caused widespread property damage. The fire remained confined to the derailed train cars. The truck driver was seriously injured in the collision. Three workers in a building adjacent to the railroad tracks and a Maryland Transportation Authority police officer who responded to the initial incident received minor injuries as a result of the explosion. Major safety issues identified in this investigation were distraction, federal oversight of new entrant motor carriers, obstructive sleep apnea, safety systems at private grade crossings, and oxidizing and flammable or combustible materials. The National Transportation Safety Board makes recommendations to the Federal Motor Carrier Safety Administration; the Federal Railroad Administration; the 50 states, the District of Columbia, and the Commonwealth of Puerto Rico; the Association of American Railroads; the American Short Line and Regional Railroad Association; the National Fire Protection Association; and CSXT.

The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations 831.4.

Assignment of fault or legal liability is not relevant to the NTSB statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code 1154(b).

For more detailed background information on this report, visit www.ntsb.gov/investigations/dms/html and search for NTSB accident number HWY13MH013. Recent publications are available in their entirety at www.ntsb.gov. Other information about publications may be obtained from the website or by contacting:

National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order report number PB2014-109131 from: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (www.ntis.gov)

NTSB

Highway Accident Report

iii Contents Figures and Tables .........................................................................................................................v Acronyms and Abbreviations .................................................................................................... vii Executive Summary ..................................................................................................................... ix Investigation Synopsis ................................................................................................................... ix Probable Cause............................................................................................................................... ix Recommendations ............................................................................................................................x 1 Factual Information ...................................................................................................................1 1.1 Crash Narrative .........................................................................................................................1 1.2 Injuries ......................................................................................................................................4 1.3 Emergency and Hazardous Materials Responses .....................................................................5 1.3.1 Emergency Response ......................................................................................................6 1.3.2 Hazardous Materials Response .......................................................................................7 1.4 Physical Damage .......................................................................................................................9 1.4.1 Truck Wreckage ..............................................................................................................9 1.4.2 Train and Track Damage ..............................................................................................10 1.4.3 Damage to Surrounding Area .......................................................................................11 1.5 Truck Driver............................................................................................................................11 1.5.1 Employment and Driving History ................................................................................11 1.5.2 Recent Activity and Sleep History ...............................................................................13 1.5.3 Alcohol and Drug Use ..................................................................................................15 1.5.4 Medical Factors ............................................................................................................15 1.5.5 Cell Phone Use .............................................................................................................17 1.5.6 Grade Crossing Approach .............................................................................................17 1.6 Motor Carrier ..........................................................................................................................18 1.6.1 Alban Waste Programs and Policies .............................................................................19 1.6.2 FMCSA Oversight ........................................................................................................20 1.6.3 State of Maryland Oversight .........................................................................................26 1.7 Train Crew ..............................................................................................................................26 1.8 Highway–Railroad Grade Crossing ........................................................................................27 1.8.1 Traffic at Grade Crossing .............................................................................................30 1.8.2 Grade Crossing Land Ownership and Responsibilities ................................................30 1.8.3 Other Collisions at Accident Site .................................................................................31 1.8.4 Grade Crossing Inventory Program ..............................................................................31 1.8.5 Sight Distance at Crossing ............................................................................................32 1.8.6 Review of Nearby CSXT Highway–Railroad Grade Crossings ...................................33 1.8.7 National Highway–Railroad Grade Crossing Accident Data .......................................34 1.8.8 Vegetation at Highway–Railroad Grade Crossings ......................................................35 1.8.9 Federal and State Laws on Private Grade Crossing Safety ..........................................36 1.9 Vehicles...................................................................................................................................37

NTSB

Highway Accident Report

iv 1.9.1 Accident Truck .............................................................................................................37 1.9.2 Train ..............................................................................................................................38 1.9.3 Auditory Study..............................................................................................................43 2 Analysis .....................................................................................................................................44 2.1 Introduction .............................................................................................................................44 2.2 Distraction ...............................................................................................................................47 2.2.1 Overview .......................................................................................................................47 2.2.2 Audibility of Train Horn and Driver Expectancies ......................................................47 2.2.3 Hands-Free Portable Electronic Devices ......................................................................49 2.2.4 Previous Safety Recommendations ..............................................................................50 2.2.5 Survey Data and Safety Recommendations ..................................................................50 2.3 FMCSA Oversight ..................................................................................................................51 2.3.1 Alban Waste as New Entrant ........................................................................................51 2.3.2 Previous Safety Recommendations ..............................................................................52 2.3.3 Revised New Entrant Safety Assurance Process ..........................................................54 2.3.4 Safety Recommendations .............................................................................................54 2.4 Obstructive Sleep Apnea.........................................................................................................55 2.4.1 Accident Truck Driver ..................................................................................................55 2.4.2 Previous Safety Recommendations ..............................................................................56 2.4.3 FMCSA Initiatives ........................................................................................................56 2.4.4 Safety Recommendations .............................................................................................58 2.5 Safety Systems at Private Grade Crossings ............................................................................58 2.5.1 Accident Grade Crossing ..............................................................................................58 2.5.2 Public–Private Design and Maintenance Responsibilities ...........................................59 2.5.3 Previous Safety Recommendations ..............................................................................60 2.5.4 DOT Oversight .............................................................................................................61 2.5.5 Safety Recommendations .............................................................................................63 2.6 Oxidizing and Flammable or Combustible Materials .............................................................65 2.6.1 Overview .......................................................................................................................65 2.6.2 Derailment, Fire, and Explosion ...................................................................................65 2.6.3 Safety Recommendations .............................................................................................67 3 Conclusions ...............................................................................................................................68 3.1 Findings...................................................................................................................................68 3.2 Probable Cause........................................................................................................................69 4 Recommendations ....................................................................................................................70 4.1 New Recommendations ..........................................................................................................70 4.2 Previous Recommendations Reiterated in This Report ..........................................................72 4.3 Previous Recommendations Reclassified in This Report .......................................................72 Appendix A: Investigation ..........................................................................................................74 Appendix B: Model State Law to Address Sight Obstructions at Passive Highway–Rail Grade Crossings .................................................................................................75 References .....................................................................................................................................82

NTSB

Highway Accident Report

v Figures and Tables Figure 1. Regional map and view of crash site .............................................................................. 2 Figure 2. Aerial view of accident highway–railroad grade crossing and surrounding area ........... 3 Figure 3. Burning rail cars containing terephthalic acid, May 28, 2013, 3:14 p.m. ...................... 8 Figure 4. Wreckage of Mack truck adjacent to railroad tracks ...................................................... 9 Figure 5. Aerial photograph, May 29, 2013, showing explosion site, derailed cars, and damaged tracks.............................................................................................................................. 10 Figure 6. Plotted damage reports near crash location in Rosedale, Maryland ............................. 12 Figure 7. Truck driver’s approach view of grade crossing when heading northwestward on private road from carrier terminal ............................................................................................ 28 Figure 8. View of STOP sign facing away from roadway, relative to road, railroad, and crossbuck sign ............................................................................................................................... 29 Figure 9. Detail view of STOP sign at grade crossing ................................................................. 29 Figure 10. Fatal accident rate per 10,000 grade crossings for public and private grade crossings in the United States, 2003–2012 ................................................................................... 34 Figure 11. Aerial photograph taken May 29, 2013, showing 15 derailed cars labeled by position in train (in parentheses), followed by car reporting marks ............................................. 39 Figure 12. Precrash photo of cylindrical aluminum covered sodium chlorate hopper car UNPX 128076, September 29, 2012............................................................................................. 41 Figure 13. Precrash photo of fluorosilicic acid tank car GATX 61416, July 10, 2011 ............... 42 Figure 14. Crash scene diagram ................................................................................................... 45 Figure 15. View from forward-facing locomotive video showing accident truck (at left of center) emerging from behind foliage ........................................................................................... 46

NTSB

Highway Accident Report

vi Table 1. Injury levels for the truck driver, train crew, and others (including emergency responders and workers in a nearby building) ................................................................................ 5 Table 2. Timeline of emergency and hazardous materials responses to the highway– railroad grade crossing collision, fire, and explosion, May 28, 2013 ............................................. 6 Table 3. Truck driver’s precrash activities, May 26–28, 2013 .................................................... 14 Table 4. Truck driver and accident truck roadside inspections .................................................... 22 Table 5. FMCSA behavior analysis and safety improvement categories .................................... 23 Table 6. BASIC thresholds........................................................................................................... 24 Table 7. Alban Waste BASIC scores exceeding thresholds ......................................................... 25 Table 8. Derailed cars for train Q40927 ....................................................................................... 40 Table 9. Train horn soundings and relative positions of train locomotive and truck from impact ............................................................................................................................................ 48 Table 10. Alban Waste critical events, February 11, 2011–September 13, 2013 ........................ 52

NTSB

Highway Accident Report

vii Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials ABS antilock brake system BASIC behavior analysis and safety improvement category [FMCSA] BCCC Baltimore County Central Communications BCFD Baltimore County Fire Department BMI body mass index CAP corrective action plan CDL commercial driver’s license CFR Code of Federal Regulations CMV commercial motor vehicle CPAP continuous positive airway pressure CR compliance review CSA Compliance, Safety, Accountability [FMCSA program] CSXT CSX Transportation Company CTEH Center for Toxicology and Environmental Health LLC DOT US Department of Transportation DVIR driver vehicle inspection report EPA US Environmental Protection Agency FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration FMCSRs Federal Motor Carrier Safety Regulations FR Federal Register FRA Federal Railroad Administration hazmat hazardous materials HOS hours of service IC incident commander LPR license plate reader MAP-21 Moving Ahead for Progress in the 21st Century Act

NTSB

Highway Accident Report

viii MCAC Maryland Coordination and Analysis Center [Anti-Terrorism Advisory Council of Maryland] MCSAC Motor Carrier Safety Advisory Committee [FMCSA] MCSAP Motor Carrier Safety Assistance Program MDE Maryland Department of the Environment MDSHA Maryland State Highway Administration MDTA Maryland Transportation Authority MEP medical expert panel [FMCSA] MRB Medical Review Board [FMCSA] MUTCD Manual on Uniform Traffic Control Devices for Streets and Highways MVA Motor Vehicle Administration [Maryland] NHTSA National Highway Traffic Safety Administration NPRM notice of proposed rulemaking NTSB National Transportation Safety Board OOS out-of-service OSA obstructive sleep apnea PED portable electronic device PHMSA Pipeline and Hazardous Materials Safety Administration PM preventive maintenance psi pounds per square inch RSIA Rail Safety Improvement Act of 2008 SMC safety management cycle [FMCSA] SMS Safety Measurement System [FMCSA] USAR urban search and rescue USC United States Code USDOT US Department of Transportation [motor carrier number] VECU vehicle electronic control unit WBAPS web-based accident prediction system [FRA]

NTSB

Highway Accident Report

ix Executive Summary Investigation Synopsis On May 28, 2013, about 1:59 p.m., a 2003 Mack Granite three-axle roll-off straight truck, operated by Alban Waste, LLC, was traveling northwest on a private road in Rosedale, Maryland, toward a private highway–railroad grade crossing. The grade crossing consisted of two tracks and was marked on each side with a crossbuck sign. The truck was carrying a load of debris to a recycling center located 3.5 miles from the carrier terminal. About the same time, a CSX Transportation Company (CSXT) freight train—which consisted of two locomotives, 31 empty cars, and 14 loaded cars—was traveling southwest at a recorded speed of 49 mph. As the train approached the crossing, the train horn sounded three times. The truck did not stop; and as the train traversed the crossing, it struck the truck on the right side, causing the truck to rotate and overturn before coming to rest on the earthen embankment on the northwest side of the tracks. The first 15 cars of the 45-car train derailed. Three of the 15 rail cars (cars 7, 8, and 15) contained hazardous materials. The other derailed cars contained non-US Department of Transportation (DOT)-regulated commodities, or were empty. The seventh car (loaded with sodium chlorate crystal)—and the ninth through twelfth cars (loaded with terephthalic acid)—released their products. Following the derailment, a postcrash fire resulted in an explosion at 2:04 p.m. The overpressure blast from the explosion shattered windows and damaged property as far as approximately 0.5 mile from the site. The fire remained confined to the derailed train cars. The truck driver was seriously injured in the collision. Three workers in a building adjacent to the railroad tracks and a Maryland Transportation Authority police officer who responded to the initial incident received minor injuries as a result of the explosion. Probable Cause The National Transportation Safety Board (NTSB) determines that the probable cause of the Rosedale, Maryland, crash was the truck driver’s failure to ensure that the tracks were clear before traversing the highway–railroad grade crossing. Contributing to the crash were (1) the truck driver’s distraction due to a hands-free cell phone conversation; (2) the limited sight distance due to vegetation and roadway curvature; and (3) the Federal Motor Carrier Safety Administration’s (FMCSA) inadequate oversight of Alban Waste, LLC, which allowed the new entrant motor carrier to continue operations despite a serious and consistent pattern of safety deficiencies. Contributing to the severity of the damage was the postcrash fire and the resulting explosion of a rail car carrying sodium chlorate, an oxidizer. The crash investigation focused on the following safety issues:  Distraction due to hands-free cell phone use.  FMCSA oversight of new entrant motor carriers.

NTSB

Highway Accident Report

x  Systems to prevent drivers with untreated obstructive sleep apnea from being granted unrestricted medical certification.  Systems to address safety at private highway–railroad grade crossings.  Proximity of oxidizing and flammable or combustible materials in a train. Recommendations As a result of this crash investigation, the NTSB makes recommendations to the FMCSA; the Federal Railroad Administration; the 50 states, the District of Columbia, and the Commonwealth of Puerto Rico; the Association of American Railroads; the American Short Line and Regional Railroad Association; the National Fire Protection Association; and CSXT. The NTSB reiterates two recommendations to the FMCSA and one to the 50 states and the District of Columbia. In addition, the NTSB reclassifies two recommendations previously issued to the DOT.

NTSB

Highway Accident Report

1 1 Factual Information 1.1 Crash Narrative About 1:59 p.m. on May 28, 2013, a 2003 Mack Granite three-axle roll-off straight truck, driven by a 50-year-old male and operated by Alban Waste, LLC, departed the carrier terminal and traveled northwest on a private road in Rosedale, Baltimore County, Maryland, toward a private highway–railroad grade crossing (US Department of Transportation [DOT] crossing 140833J).1,2 The private grade crossing, located approximately 0.2 mile from the carrier terminal (see figures 1 and 2), consisted of two tracks and was marked on each side with a crossbuck sign.3 The truck was carrying a load of debris to a recycling center located 3.5 miles from the carrier terminal. About the same time, a CSX Transportation Company (CSXT) freight train (Q40927)—which consisted of two locomotives, 31 empty cars, and 14 loaded cars—was traveling southwest and approaching the crossing at a recorded speed of 49 mph. The temperature was approximately 70°F with no precipitation, and the roadway was dry. As the train approached the crossing, the train horn sounded three times. The truck did not stop before it proceeded into the crossing. The train struck the truck on the right side near the rear drive axles, causing the truck to rotate and overturn before coming to rest on the earthen embankment on the northwest side of the tracks. Following the collision, the first 15 cars of the 45-car train derailed. Three of the 15 derailed rail cars contained hazardous materials (cars 7, 8, and 15). The other derailed cars contained non-DOT-regulated commodities or were empty. The seventh car (loaded with sodium chlorate crystal) and the ninth through twelfth cars (loaded with terephthalic acid) released their products. Following the derailment, a postcrash fire resulted in an explosion at 2:04 p.m. The overpressure blast from the explosion shattered windows and damaged property as far as approximately 0.5 mile from the crash site. The fire remained confined to the derailed train cars.

1 All times in this report are eastern daylight time. 2 A roll-off container is typically an open steel receptacle used to remove and contain construction, demolition, or other waste. 3 A crossbuck sign is an X-shaped warning symbol for vehicular traffic at a railroad grade crossing. The crossbuck displays the words “railroad” on one arm and “crossing” on the other.

NTSB

Highway Accident Report

2

Figure 1. Regional map and view of crash site.

NTSB

Highway Accident Report

3

Figure 2. Aerial view of accident highway–railroad grade crossing and surrounding area. (Source: Google Earth, August 2010) The train engineer and the conductor stated that their trip was normal until the collision. They went on duty in Philadelphia, Pennsylvania, at 8:15 a.m. Train Q40927 departed Philadelphia at 10:48 a.m. en route to Richmond, Virginia. At the time of the crash, the train had been operating on green (proceed) signal aspects for approximately 10 miles. The locomotive event recorder indicated that for 5 miles in advance of the crossing, the train speed was maintained below 50 mph, the maximum track speed. As the train approached the crossing, it was traveling 49 mph. According to the forward-facing locomotive audio/video recorder, the train horn sounded three times.4 A 3-second sounding began at 1:59:10, followed by a 4-second sounding at 1:59:15. The third sounding began at 1:59:21 and continued until impact approximately 6 seconds later.5 The truck driver was familiar with both the vehicle and the grade crossing, which he typically traversed several times daily. At the time of the crash, the air conditioning was on, the radio was off, and the cab windows were rolled up. The driver’s cell phone indicated that he answered a phone call using his wireless hands-free headset at 1:59:09, 1 second before the first train horn sounded. Following the crash, the driver said that he did not typically stop at the crossing but relied on the sound of the train horn to alert him if a train was approaching. He said that as he approached the crossing, he glanced left and right and did not see anything, so he continued across the tracks. Data from the truck’s vehicle electronic control unit (VECU) indicated no service brake applications or clutch depressions prior to the collision. The VECU

4 Train crews are not required to sound horns at private crossings. On approach to public highway–railroad grade crossings, the rules call for a pattern of two longs, a short, and a long horn sound. However, engineers will often continue sounding the horn when there is a pending collision. 5 Video data from the locomotive show the truck first coming into view from behind the foliage at 1:59:23.40. The right front tire crossed the nearest rail at 1:59:25.07, and the impact with the train occurred at 1:59:27.87.

NTSB

Highway Accident Report

4 showed that the truck speed decreased gradually during the 10 seconds prior to the collision, from about 16 to 8 mph. Using data from the forward-facing audio/video on the lead locomotive, investigators estimated that the truck averaged 9.9 mph as it began to traverse the grade crossing.6 The driver stated that he did not hear the train horn until right before the collision. Following the collision, the first 15 cars of the 45-car train derailed and separated from the locomotives, which remained on the tracks. The train engineer contacted the CSXT dispatcher to declare an emergency. The dispatcher advised the crew to continue moving the locomotives farther down the track away from the derailment and from possible exposure to hazardous materials. As the locomotives continued down the track, the conductor and the engineer heard and felt an explosion originating from the area where the cars had derailed. The explosion occurred approximately 1,000 feet from the grade crossing. Appendix A presents background information on the National Transportation Safety Board (NTSB) launch to Rosedale, Maryland. 1.2 Injuries As a result of the collision, the truck driver was seriously injured and was transported to an area hospital for treatment. Three workers in an adjacent building (7517 Lake Drive)—and a Maryland Transportation Authority (MDTA) police officer, who responded to the initial incident and was in her vehicle on Lake Drive approximately 100 yards from the explosion site—also received minor injuries as a result of the explosion. The train crew members were uninjured. Table 1 summarizes the injury data.

6 Video data showed that the truck slowed from about 10.7 to 8.7 mph as it began to traverse the crossing.

NTSB

Highway Accident Report

5 Table 1. Injury levels for the truck driver, train crew, and others (including emergency responders and workers in a nearby building). Injuriesa Truck Driver Train Crew Others Total Fatal 0 0 0 0 Serious 1 0 0 1 Minor 0 0 4 4 None 0

2

2 Total 1 2 4 7 a Title 49 Code of Federal Regulations (CFR) 830.2 defines fatal injury as any injury that results in death within 30 days of the accident. It defines serious injury as an injury that requires hospitalization for more than 48 hours, commencing within 7 days of the date of injury; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, or nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. 1.3 Emergency and Hazardous Materials Responses Table 2 provides a timeline of the emergency and hazardous materials (hazmat) responses to the Rosedale collision. The events are described in detail in the sections that follow.

NTSB

Highway Accident Report

6 Table 2. Timeline of emergency and hazardous materials responses to the highway–railroad grade crossing collision, fire, and explosion, May 28, 2013. Timea Event 2:00 p.m. 911 call received by Baltimore County Central Communications (BCCC) dispatch 2:04 p.m. MDTA police officer arrives on scene Explosion occurs 2:08 p.m. First Baltimore City Police Department officer arrives First Baltimore County Fire Department (BCFD) unit arrives (engine 16) First Baltimore City Fire Department unit arrives (engine 51) Initial incident command established BCCC dispatch notified of chemicals on train 2:14 p.m. First emergency medical service units arrive 2:17 p.m. BCFD Division Chief of Emergency Operations assumes incident commander (IC) role and establishes command post 2:22 p.m. Baltimore County Office of Emergency Management arrives on scene 2:23 p.m. Baltimore City hazmat unit arrives on scene, begins air monitoring, and establishes hazmat exclusion zone 3:10 p.m. Team inspects scene and IC decides to “allow the product to burn off” until all materials can be identified and confirmed 5:00 p.m. Fire suppression continues until fire is extinguished during early morning of May 29 a Times are truncated to the minute. 1.3.1 Emergency Response The Baltimore County Central Communications (BCCC) dispatch was notified of the crash through its 911 system at 2:00:34 p.m. The crash location was subject to the Baltimore Region Emergency Assistance Compact, which provides for mutual aid assistance among several regional agencies. The MDTA police officer arrived on scene at 2:04 p.m., and the explosion occurred less than 1 minute later.7 The first dispatched Baltimore City police officer, the first dispatched Baltimore County Fire Department (BCFD) unit (engine 16), and the first Baltimore City Fire Department unit (engine 51) arrived on scene at 2:08 p.m. The engine 16 captain immediately assumed the role of initial incident commander (IC). Also at 2:08 p.m., the BCCC dispatch received a call from CSXT informing it of four chemical placards on the train. Upon learning of the potential for hazardous materials on board the train, the IC initiated a “level II staging,” which required incoming fire department units to stop and wait at a designated location

7 According to video obtained from Eastern Truck and Trailer, a nearby facility, the explosion occurred at 2:04:51.

NTSB

Highway Accident Report

7 on 68th Street approximately three blocks from the explosion site until the IC allowed them to enter the incident area. Three additional BCFD units arrived within the next 3 minutes, and the first emergency medical service unit arrived at 2:14 p.m. The Baltimore County Office of Emergency Management, which is part of the BCFD, was en route at 2:10 p.m. and arrived at 2:22 p.m. While driving to the scene, the BCFD division chief of emergency operations heard that there had been an explosion with collapsed buildings, and he asked the BCCC dispatch to send the BCFD urban search and rescue (USAR) collapse assignment team. The division chief arrived on scene at 2:13 p.m., assumed the IC role at 2:17 p.m., and set up a command post in a parking lot at the corner of 68th Street and Pulaski Highway, approximately 1,000 feet upwind of the burning train cars. After the IC notified the BCCC dispatch that he had established a command post, the IC, the Baltimore City senior on-duty fire chief, and a Baltimore County police officer formed a unified command. Upon arrival on scene, the IC was told that the truck driver was trapped in his vehicle. He assigned a ladder company, an engine company, a rescue squad, and an ambulance to assist the driver and transport him to a hospital. It was later determined that the driver was not trapped in the truck, and no rescue tools were required. Meanwhile, the USAR team searched the damaged buildings along Lake Drive and determined that no occupants were trapped in any of the buildings. 1.3.2 Hazardous Materials Response The Baltimore City hazmat unit was dispatched at 2:12 p.m., arrived on scene at 2:23 p.m., and within 10 minutes set up air monitoring stations. Additionally, two CSXT environmental response contractors (Arcadis and the Center for Toxicology and Environmental Health LLC [CTEH]), the Maryland Department of the Environment (MDE), and the US Environmental Protection Agency (EPA) conducted air, water, soil, and waste sampling. Environmental monitoring was focused in the work area and within a 2-mile radius of the site. CTEH conducted fixed station monitoring, roaming hand-held monitoring, and analytical sampling. The BCFD firefighters initially directed unmanned master water streams at the fire, but then—following the recommendation of the hazmat unit director—they ceased this activity and delayed fire suppression efforts until they had identified the materials and confirmed the integrity of the tank cars.8 After considering the wind direction and determining that there were no pressurized containers or inhalation hazards, the BCFD established an exclusion zone of approximately 500 feet surrounding the explosion site.9

8 Master stream devices are used to produce high-volume water streams for large fires. Unmanned master streams are typically employed when there is a risk of explosion or injury. 9 A hazmat exclusion zone, also known as a “hot zone,” refers to an area that can only be entered by credentialed hazmat personnel with appropriate personal protective equipment. Although the 500-foot radius was lower than the 0.5-mile radius suggested by the Pipeline and Hazardous Materials Safety Administration Emergency Response Guidebook (PHMSA 2012), the BCFD determined that the smaller radius was justified because there were no dangerous toxic inhalation hazards, and it was conducting ongoing atmospheric monitoring.

NTSB

Highway Accident Report

8 At 3:10 p.m., 1 hour and 10 minutes following the crash, the BCFD, CSXT, and the MDE–Emergency Response Division first responders jointly entered the hazmat exclusion zone to inspect the scene and conduct a photographic survey. They discovered that two rail cars containing terephthalic acid (cars 9 and 10) were burning and severely damaged (see figure 3). Because the air monitoring did not detect any substances that were a threat to public health, the IC decided to “allow the product to burn off” until responders could identify and confirm all of the materials.10 As a precaution, the IC issued a voluntary evacuation of the adjacent community.

Figure 3. Burning rail cars containing terephthalic acid, May 28, 2013, 3:14 p.m. (Source: Maryland Department of the Environment) At 5:00 p.m., the BCFD and other assisting agencies resumed fire suppression by ground and elevated master water streams. At a 7:29 p.m. IC briefing, responders reported that they were continuing fire suppression and using thermal imaging to identify additional areas where fire was present. The postexplosion fire was extinguished during the early morning of the following day, May 29. The fire suppression consumed an estimated 750,000–1 million gallons of water. The IC role was transitioned to a CSXT hazardous materials manager on May 29, at the completion of the emergency response phase. After the fire was extinguished, no combustion gases or volatile organic compounds were detected in the surrounding community, and particulate matter was within normal limits for an urban area. Some of the surface water and sediment sampling locations closest to the derailment were within or adjacent to an EPA

10 The operations section chief also noted that concerns about contamination from water runoff influenced the decision to allow the fire to burn until 5:00 p.m.

NTSB

Highway Accident Report

9 Superfund site.11 Surface water and sediment sampling revealed that measurable levels of terephthalic acid and other contaminants had entered a tributary of the Back River downstream of the crash site. Remediation activities—including the removal and disposal of released sodium chlorate, terephthalic acid, and potentially contaminated debris—were completed on June 4. Total cleanup costs were estimated at $3.6 million. 1.4 Physical Damage 1.4.1 Truck Wreckage The lead locomotive struck the truck on the right side near the rear drive axles. The truck rotated, overturned, and came to rest in the earthen embankment northwest of the tracks. As shown in figure 4, the truck sustained severe damage, affecting all major mechanical systems. The driver’s seat was in place in the truck; however, because of the crush damage to the cab, the seat was touching both the rear of the cab and the steering wheel. The driver’s seat belt was found unbuckled, retracted, and hanging from the upper attachment point to the left of the driver’s seat location.12

Figure 4. Wreckage of Mack truck adjacent to railroad tracks.

11 A Superfund site is “an uncontrolled or abandoned place where hazardous waste is located, possibly affecting local ecosystems or people.” See www.epa.gov/superfund/sites/index.htm, accessed February 21, 2014. 12 Although hospital records stated “positive seat belt,” the driver told investigators that he was not wearing his seat belt at the time of the crash.

NTSB

Highway Accident Report

10 1.4.2 Train and Track Damage Damages to the railroad equipment, cars, and locomotives—and to the track structure— were estimated to be $502,920 and $100,000, respectively. The first 15 rail cars following the locomotives derailed approximately 500 feet beyond the highway–railroad grade crossing. Car 7, the aluminum hopper car containing sodium chlorate (UNPX 128076), failed catastrophically in the postcrash fire and explosion, and several other cars had thermal damage. The track ballast was displaced in the area of the explosion, leaving the surface with a cratered appearance. As shown in figure 5, approximately 80 feet of wooden crossties was missing from both sets of tracks in this area. Vegetation south of the tracks was burned, and trees were defoliated or blown over; the damaged area extended approximately 120 feet south of the approximate center of the explosion.

Figure 5. Aerial photograph, May 29, 2013, showing explosion site, derailed cars, and damaged tracks.

NTSB

Highway Accident Report

11 1.4.3 Damage to Surrounding Area The BCFD chief fire protection engineer conducted damage and safety assessments on four of the five steel frame storage/industrial buildings along Lake Drive parallel to the area of the explosion.13 All four buildings were placarded as unsafe due to overhead risks from loose exterior wall panel material, and damage to interior lighting and heat fixtures. The most severe damage was observed on the south façades of the three buildings closest to the explosion site. Several industrial buildings on the streets that run perpendicular between Lake Drive and Pulaski Highway and several residential dwellings in the Maryland Manor subdivision were also damaged. As of July 12, 2013, CSXT had received 64 damage reports from property owners within an approximate 0.5-mile radius of the crash site. Figure 6 depicts the locations of the properties named in the damage reports, which cited siding damage, broken windows, cracked walls, cracked pipes, and damaged furniture. 1.5 Truck Driver The driver of the 2003 Mack roll-off truck was a 50-year-old male. At the time of the crash, he held a Maryland class A commercial driver’s license (CDL) with a prescription glasses restriction.14 The license was issued on October 7, 2008, and expired on October 16, 2013. The driver held a current medical card with an issue date of March 7, 2012, and an expiration date of March 7, 2014. 1.5.1 Employment and Driving History In an interview with NTSB investigators, the truck driver stated that he obtained his CDL training during his employment with the BCFD and began operating commercial vehicles in

1. The driver operated fire trucks as a full-time firefighter for the BCFD until retiring in
2. Between 2005 and 2008, he held various positions at three roll-off container companies. In

2011, he began his own roll-off business, Alban Waste, LLC. In addition to being the company owner and president, he routinely drove the 2003 Mack roll-off truck involved in the crash.

13 The engineer assessed the buildings at 7455, 7475, 7501, and 7517 Lake Drive. The fifth building (7525 Lake Drive) was not as close to the explosion area and was not included in the formal assessment; however, it did sustain minor damage to the exterior and to interior ceiling panels. 14 A Maryland class A CDL allows the operation of any combination of vehicles with a gross combination weight rating of 26,001 pounds or more, provided that the gross vehicle weight rating of the vehicle or vehicles towed exceeds 10,000 pounds.

NTSB

Highway Accident Report

12

Figure 6. Plotted damage reports near crash location in Rosedale, Maryland. [Note: Map reflects only those property and business reports that were successfully geocoded based on submitted claims.]

NTSB

Highway Accident Report

13 At the time of the crash, the following violations were listed in the truck driver’s Maryland Motor Vehicle Administration (MVA) record:  June 10, 2011: Operation of handheld telephone while operating a motor vehicle.  October 5, 2006: Failure to carry registration card in vehicle; operating a motor vehicle while not restrained by seat belt.  May 31, 2002: Operating a motor vehicle while not restrained by seat belt.  August 26, 1998: Defective lights.  August 31, 1997: Exceeding maximum speed limit by 10 mph. 1.5.2 Recent Activity and Sleep History The truck driver’s activities in the days leading to the crash were reconstructed based on a variety of evidence sources, including a driver interview, cell phone records, receipts, logs, and electronic toll data. Table 3 summarizes the documented precrash activities. The driver was unable to recall his exact sleeping and waking times; however, he told investigators that he had approximately 7 hours of time in bed on each of the three nights prior to the crash. The driver stated that on days he has to work, he typically goes to bed by 9:00 or 10:00 p.m. and gets up between 4:00 and 5:00 a.m. The driver stated that he had not experienced any significant life changes or stressors in the days and weeks prior to the crash. He told investigators that he has no trouble falling asleep or awaking and that he does not take sleep aids. He stated that he generally sleeps well and described the quality of his sleep as good or average; however, he noted that he has been told by family members that he snores.

NTSB

Highway Accident Report

14 Table 3. Truck driver’s precrash activities, May 26–28, 2013. Time Event Source Sunday, May 26

Driver reports day off Alban records 7:24 a.m. Outgoing phone calla Phone records 7:44 p.m. Outgoing phone call Phone records Monday, May 27 5:23 a.m. Incoming phone call Phone records 2:31 p.m. EZ Pass toll, Baltimore Harbor Tunnel MDTAb 3:51 p.m. EZ Pass toll, Fort McHenry Tunnel MDTA 8:15 p.m. Incoming phone call Phone records Tuesday, May 28 4:41 a.m. Outgoing phone call Phone records 5:35 a.m. LPR tag scan, southbound Fort McHenry Tunnel MCACc 6:31 a.m. LPR tag scan, northbound Fort McHenry Tunnel MCAC 7:17 a.m. Baltimore Recycling Center entryd Entry/exit log 7:23 a.m. Baltimore Recycling exit Entry/exit log 8:07 a.m. Baltimore Scrap Corp entry Entry/exit log 8:30 a.m. Baltimore Scrap exit Entry/exit log 8:31 a.m. EZ Pass toll, Baltimore Harbor Tunnel MDTA 9:46/10:31 a.m. Baltimore Scrap scale photo/entry Entry/exit log 10:39/10:43 a.m. Baltimore Scrap scale photo/exit Entry/exit log 10:51/11:36 a.m. Baltimore Scrap scale photo/entry Entry/exit log 11:45/11:48 a.m. Baltimore Scrap scale photo/exit Entry/exit log 12:42 p.m. Baltimore Scrap entry Entry/exit log 12:53 p.m. Baltimore Scrap exit Entry/exit log 1:02 p.m. EZ Pass toll, Baltimore Harbor Tunnel MDTA 1:59 p.m. Incoming phone call Phone records 2:00 p.m. Crash occurs

a Cell phone calls listed include only the first and last calls of each day. b EZ Pass transactions were obtained from the Maryland Transportation Authority (MDTA). c License place reader (LPR) transactions were obtained from the Maryland Coordination and Analysis Center (MCAC). LPRs record license plates as vehicles pass stationary sensors located on interstate roads. d Baltimore Recycling Center transactions were documented from receipts.

NTSB

Highway Accident Report

15 1.5.3 Alcohol and Drug Use The truck driver told NTSB investigators that he drinks alcohol one or two times a month. He stated that he takes over-the-counter antihistamines for seasonal allergies and does not use any illicit drugs. A blood sample taken from the driver less than 2 hours after the crash was analyzed by the Federal Aviation Administration Civil Aerospace Medical Institute toxicology laboratory and found to be negative for alcohol and all tested classes of drugs.15 1.5.4 Medical Factors When interviewed by NTSB investigators, the truck driver described his general health as good and stated that he was not experiencing any health issues on the day of the crash. Medical records from the hospital that treated the driver did not indicate any serious medical conditions that would have affected him at the time of the crash. Investigators also reviewed medical records obtained from the driver’s personal physician and records from his DOT commercial driver fitness determination exams. Federal regulations require drivers to undergo a DOT fitness exam and be certified by a medical examiner as physically qualified before operating a motor vehicle.16 The driver’s medical records indicate that he underwent DOT fitness exams in November 2007, February 2010, and March 2012. The 2007 and 2010 exams were performed by the driver’s personal physician, and the 2012 exam was conducted by a physician assistant at a different practice. In each case, the driver did not report any medical conditions and was issued a 2-year certificate. 1.5.4.1 Vision and Hearing. At his March 2012 DOT fitness exam, the truck driver’s corrected Snellen distance visual acuity was recorded as 20/20 with both eyes, and his horizontal field of view was recorded as 85 degrees with each eye.17 The report noted that the driver could recognize and distinguish between standard red, green, and amber colors. The report stipulated that the driver met visual acuity requirements only when wearing corrective lenses. When interviewed by NTSB investigators, the driver stated that he wears glasses because he is nearsighted. He said that he was wearing his glasses at the time of the crash and was not experiencing any problems with his vision that day. With respect to his hearing, the truck driver told investigators that he has “high tone deafening” in his left ear, which was diagnosed several years ago during his employment with

15 The test results were negative for alcohol, amphetamines, opiates, marijuana, cocaine, phencyclidine, benzodiazepines, barbiturates, antidepressants, and antihistamines. 16 See 49 CFR 391.41 and 49 CFR 391.43. As of May 21, 2014, medical exams must be performed by a medical examiner listed on the National Registry of Certified Medical Examiners under 49 CFR 390(D). 17 The Snellen fraction is a measure of visual acuity (sharpness of sight). In the fraction, the first number represents the test distance (20 feet), and the second represents the distance at which the average eye could see the letters on a certain line of the chart. A fraction of 20/20 is considered normal vision.

NTSB

Highway Accident Report

16 the BCFD.18 His medical records contained no mention of treatment for this condition. During his most recent DOT fitness exam, the driver underwent a hearing examination and was noted to be able to hear a forced whispered voice at 5 feet in both ears. 1.5.4.2 Obstructive Sleep Apnea. According to the truck driver’s medical records, he sought treatment in January 2007 from his personal physician for excessive daytime sleepiness, impaired cognition, snoring, and insomnia. The driver was referred to a sleep medicine specialist and subsequently underwent a sleep study. As a result of the study, he was diagnosed with severe obstructive sleep apnea (OSA), a sleep disorder characterized by pauses in breathing during sleep that can affect sleep quantity and quality, and lead to daytime sleepiness and cognitive impairment.19 The driver’s personal physician prescribed continuous positive airway pressure (CPAP) therapy as treatment for the disorder in February 2007. The driver told NTSB investigators that he did not follow the prescribed treatment plan because in the months following the sleep study, he lost weight and no longer experienced symptoms.20 At the time of the diagnosis, his height was 74 inches and his weight was 318 pounds (BMI of 40.8).21 A historical review of the driver’s weight/BMI measured on 11 occasions between 2007 and 2013 showed that he lost 42 pounds between January and November 2007. Between 2008 and 2013, his weight fluctuated between 281 and 300 pounds (BMI of 36.1–38.5). The driver did not participate in a followup sleep study after the original 2007 diagnosis. Additionally, his medical records state that on three additional occasions, he complained to his personal physician about fatigue: in February 2010, May 2010, and September 2012. Notes from the May 2010 visit indicate that a referral request for a sleep study was filled out, and the physician recorded “OSA needs re-eval” and “Likely needs CPAP.” Notes from the September 2012 visit include “OSA needs to retest.” On his 2007 and 2010 DOT fitness exam forms, the driver indicated that he did not have a history of “sleep disorders, pauses in breathing while asleep, daytime sleepiness, or loud snoring.” In each instance, despite having diagnosed the driver with OSA and being aware that it was not being treated, the driver’s personal physician issued a 2-year unconditional medical certification. The physician made no note or other documentation of the driver’s condition or any reasons for issuing the certification without further intervention. The driver’s most recent DOT fitness exam prior to the crash was conducted in March 2012 by a physician assistant at another medical practice. His weight was recorded as

18 High frequency hearing loss is the most common form of acquired hearing loss, resulting most often from prolonged exposure to loud noises. This condition makes higher pitched sounds harder to hear. In terms of human hearing, 2,000 hertz and above is considered “high frequency.” 19 The driver’s apnea-hypopnea index was 43.6 episodes per hour. Normal is less than five episodes per hour, and more than 30 episodes per hour constitutes severe sleep apnea. In addition, the driver’s blood oxygen saturation dropped as low as 81 percent; normal is above 92 percent. 20 There is a significant relationship between obesity and OSA, with an increased risk of OSA with increasing body mass index (BMI). 21 The US Centers for Disease Control and Prevention classifies a BMI of 30 or greater as obese.

NTSB

Highway Accident Report

17 300 pounds, which corresponds to a BMI of 38.5. In that exam, the driver reported no prior history of medical issues or diagnosis other than seasonal allergies. He indicated that he took over-the-counter medication, as needed, to treat allergy symptoms. As a result of this DOT fitness exam, the driver was qualified for 2 years. Following the crash, the Federal Motor Carrier Safety Administration (FMCSA) cited the driver for making a false entry on his medical examiner’s certificate; however, no action was taken to disqualify his medical certification. In March 2014, the driver’s medical card expired. In his renewal application, he self-reported having OSA, and he was issued a 3-month medical certificate with an expiration date of June 2014.22 1.5.5 Cell Phone Use The truck driver stated that he was using his cell phone at the time of the crash. The cell phone indicated that he answered a voice call, for which he said he used a hands-free headset, approximately 18 seconds prior to the collision and 1 second before the first train horn sounded. The person who initiated the call was interviewed by NTSB investigators and acknowledged being on the phone with the driver for a short time before the call abruptly ended. Neither Maryland law nor federal regulations prohibit using a hands-free cell phone while driving. The truck driver stated that though there is no written company policy on cell phone use, he verbally counseled his employees to use a hands-free device when using a cell phone while operating company vehicles. When interviewed, both the driver and a relative said that he “always” uses his wireless earpiece. 1.5.6 Grade Crossing Approach The truck driver was familiar with the grade crossing because it must be traversed to travel to and from the carrier terminal. The driver said that he did not typically stop at the crossing but relied on the sound of the train horn to alert him if a train was approaching. He said that he has stopped at the crossing when he could see a train parked to check whether another train was approaching on the other track. However, he believed that it was not possible to see to the right without some portion of the truck being on the track. A review of security video from a nearby business for daylight hours during the 3 days prior to the crash and on the morning of May 28 indicated that the accident driver and others routinely drove across the grade crossing without slowing or stopping. During the observation period, trains traversed the crossing between two and seven times per day, and highway vehicles traversed the crossing between 10 and 23 times per day. Across the entire observed period, highway vehicles crossed the tracks 67 times, including five tractor-trailer trucks, 23 straight trucks, and 39 pickup trucks or passenger vehicles. Of these 67 crossings, in only eight instances did the vehicles stop in advance (11.9 percent). In two of those eight cases, a train was traversing

22 When NTSB investigators spoke to the driver at the end of June 2014, he reported that he was undergoing additional testing for OSA.

NTSB

Highway Accident Report

18 the crossing as the highway vehicle approached. The accident driver was observed driving through the crossing without stopping three times on the day of the crash. Both Maryland law and federal regulations require commercial motor vehicle (CMV) operators to slow down when approaching a crossing and ascertain that the course is clear before continuing.23,24 Additionally, the Maryland CDL Manual has two pages of material to inform commercial drivers about safely approaching and traversing highway–railroad grade crossings, including a section on passive crossings, which states, “Passive crossings require you to recognize the crossing, search for any train using the tracks and decide if there is sufficient clear space to cross safely.” 25 (MVA 2005, 2-28) According to Maryland MVA records, the truck driver successfully renewed his CDL on August 6, 2013. On October 1, 2013, he was found guilty of proceeding across a railroad crossing when unsafe (on the day of the Rosedale collision, May 28, 2013). In January 2014, the MVA sent the driver a license disqualification letter; however, the following month the disqualification was stayed, and a hearing was scheduled. At the hearing, the judge suspended the driver’s license for 60 days. The driver had his CDL reinstated on May 18, 2014. 1.6 Motor Carrier Alban Waste, LLC, specialized in the transport of construction debris, refuse, and recyclable materials in roll-off containers. It engaged in both interstate and intrastate commerce.26 The company registered with the FMCSA as a for-hire carrier and was issued US Department of Transportation (USDOT) number 2118654 on February 9, 2011. At the time of the crash, the carrier operated three straight trucks, two truck-tractors, one service truck, and one leased trailer, which was dedicated to a local scrap company. The carrier employed 10 commercial drivers, four of whom worked full time.

23 See Annotated Code of Maryland, Transportation Article, §21-703.1. “Procedure upon approaching a railroad crossing” states that the operator of every CMV must slow down and check that the tracks are clear of an approaching train and must stop before reaching the crossing if the tracks are not clear. 24 See 49 CFR 392.11, “Railroad grade crossings; slowing down required.” Every CMV other than those listed in 49 CFR 392.10 must, upon approaching a railroad grade crossing, be driven at a rate of speed that allows it to be stopped before reaching the nearest rail of such crossing and must not be driven on or over such crossing until due caution has been taken to ascertain that the course is clear. Title 49 CFR 392.10 states that buses transporting passengers and CMVs transporting hazardous materials must stop at all railroad grade crossings. 25 A passive crossing is a highway–railroad grade crossing without train-activated signals or gates to warn of an approaching train. 26 The carrier operated in Maryland, Pennsylvania, Virginia, West Virginia, New Jersey, Delaware, and Washington, DC.

NTSB

Highway Accident Report

19 1.6.1 Alban Waste Programs and Policies The Federal Motor Carrier Safety Regulations (FMCSRs) address motor carrier responsibilities concerning driver qualifications, drug and alcohol testing, hours of service (HOS), and vehicle maintenance. A postcrash review by NTSB investigators showed that Alban Waste was not compliant with several regulations in these areas. With respect to driver qualifications, 49 CFR 391.51 requires that motor carriers maintain a driver qualification file for each driver regardless of his or her shift or position, and that the file include the driver’s application for employment, state motor vehicle records, certificate of road test, and medical certificate. Alban Waste did not have driver qualification files for each of its drivers; for example, the carrier had no records for the four night-shift drivers who assisted with its shiploading operations. The owner stated that he only hired drivers with a CDL and experience in the roll-off business, but he did not say that he gathered any other information when hiring new drivers. According to the owner, Alban Waste was enrolled in a random drug and alcohol testing program; however, drivers used in the carrier’s occasional shiploading operations were not included in its random drug/alcohol testing pool. The carrier had a written drug and alcohol policy, but there was no evidence that drivers received a copy of the policy or educational materials pertaining to the misuse of alcohol or controlled substances as required in 49 CFR 382.601. The owner stated that the carrier exercised the 100-air-mile-radius driver exemption from the HOS regulations, which states that a driver may be exempt from the requirement to record his/her daily duty status if several criteria are met, including the maintenance and retention of 6 months of records showing driver time on duty.27 Although the owner provided drivers with time sheets to record their hours, he did not use a time clock, manual records, or a computer program for tracking drivers’ hours. Time sheets provided to investigators were missing the information required under 49 CFR 395.1(e)(1). The owner stated that he “was lackadaisical” and “had not been keeping 100 percent track of the drivers’ hours.” The owner stated that he performed “99 percent of all the maintenance” on his vehicles— including all brake work, tire maintenance, oil changes, and oil leaks—and that anything major would go to the dealer for repair. He was not a licensed mechanic and did not hold any brake certifications or mechanic credentials.28 The carrier did not record when vehicles were due for service, nor did it have a systematic method of inspecting, repairing, and maintaining vehicles as

27 As outlined in 49 CFR 395.1(e)(1), a driver is exempt from the requirements of 395.8 if: (i) the driver operates within a 100-air-mile radius of the normal work reporting location; (ii) the driver returns to the work reporting location and is released from work within 12 hours on duty; (iii) a property-carrying CMV driver has at least 10 consecutive hours off duty separating each 12 hours on duty; (iv) a property-carrying CMV driver does not exceed the maximum driving time in 395.3(a)(3) following 10 consecutive hours off duty; and (v) the motor carrier maintains and retains for a period of 6 months accurate and true time records showing the time the driver reports for duty each day, the total number of hours the driver is on duty each day, the time the driver is released from duty each day, and the total time for the preceding 7 days in accordance with 49 CFR 395.8(j)(2) for drivers used for the first time or intermittently. 28 Brake inspector qualifications are required under 49 CFR 396.25.

NTSB

Highway Accident Report

20 required under 49 CFR 396.3. No vehicle maintenance records were maintained for fleet vehicles except for receipts for vehicle parts, which lacked identifying information to match them to any particular vehicle. The carrier did not have any driver vehicle inspection reports (DVIRs) for any vehicles operating during the 30 days prior to the crash. The owner stated that he “was lackadaisical” in making the drivers fill out the required DVIRs. Although the FMCSRs do not require written safety policies, the carrier had no driver’s handbook, seat belt policy, cell phone policy, or disciplinary guidance. The carrier did not conduct any driver training or have any recurrent training program. The owner stated that he held occasional driver safety meetings that covered such topics as “wearing seat belts” and “using their Bluetooths if they’re talking on their cell phones,” but none of the safety meetings were documented. 1.6.2 FMCSA Oversight 1.6.2.1 New Entrant Program. In 2003, the FMCSA instituted the New Entrant Safety Assurance Program.29 A motor carrier can obtain a USDOT number and begin interstate operations as a new entrant after completing registration forms on the FMCSA website.30 After the new entrant satisfies a set of basic preoperational requirements, it is subject to an 18-month safety monitoring period. According to the FMCSA, during this period the carrier’s roadside inspections are monitored and it undergoes a safety audit to assess whether it is meeting regulatory requirements in the areas of driver qualification, driver duty status, vehicle maintenance, accident registry, and controlled substances and alcohol testing. The safety audit results in either a “pass” or “fail” determination. If the carrier passes the audit, it continues to be monitored for the remainder of the 18-month period, and if the carrier remains compliant, it is granted full authority. If the carrier fails the audit, it is given 60 days to provide a corrective action plan (CAP) identifying how it will remedy its safety practices.31 During the 18-month safety monitoring period, the carrier may also be subject to an expedited action in response to issues identified during roadside inspections or by other means. Examples of issues that may lead to expedited actions include using a driver who does not have a valid CDL, using a driver who tests positive for controlled substances or alcohol, operating with a driver or vehicle out-of-service (OOS) rate of 50 percent or greater, or operating a CMV without proper insurance.32 Expedited actions may result in an expedited safety audit or a compliance review (CR), or require a written response from the carrier.

29 See 67 Federal Register (FR) 31983, May 13, 2002, as amended at 73 FR 76490, December 16, 2008, FMCSA–New Entrant Safety Assurance Process, at www.fmcsa.dot.gov/safety/new-entrant-safety-assurance- program, accessed June 17, 2014. 30 See www.fmcsa.dot.gov/registration/getting-started, accessed May 16, 2014. 31 The requirement is 45 days for passenger and hazardous materials carriers. See www.fmcsa.dot.gov for additional information. 32 For a comprehensive list of issues that can lead to an expedited action, refer to 49 CFR 385.308.

NTSB

Highway Accident Report

21 Alban Waste became a new entrant on April 1, 2011.33 On November 21, 2011, the carrier failed its new entrant safety audit, conducted by the Maryland State Police, because of its failure to implement a random drug/alcohol testing program, maintain a driver qualification file on each driver, and require drivers to complete DVIRs.34 Alban Waste submitted a CAP to the FMCSA on February 1, 2012; however, it was rejected for lacking the following elements:  A copy of the carrier’s controlled substances and alcohol testing policy.  Evidence that drivers had received a copy of the carrier’s drug and alcohol testing policy.  Copies of any random drug or alcohol tests conducted on current drivers.  A copy of procedures for a consortium/third-party administrator of random testing if applicable.  Copies of any procedures if the carrier did not have a third-party administrator for random testing.  A list of drivers currently in the random testing program.  A written statement that the carrier would operate in compliance with the FMCSRs and hazardous material regulations. (This statement must be signed by a corporate official or the owner of the company.) The FMCSA placed Alban Waste out of service and revoked its registration effective February 3, 2012. Under 49 CFR 385.329, a new entrant whose DOT registration has been revoked, and whose operations have been placed out of service, may reapply for registration no sooner than 30 days after the date of revocation. If the registration was revoked because the carrier failed the safety audit, the new entrant must submit evidence that it has corrected the deficiencies, reapply, and restart the 18-month new entrant monitoring cycle if the application is approved. Alban Waste reapplied to the new entrant program and submitted a second CAP. The FMCSA accepted the CAP; granted Alban Waste operating authority on March 23, 2012; and notified the carrier that the new entrant safety monitoring period would restart on March 26, 2012. 1.6.2.2 Driver and Vehicle Roadside Inspections. Between May 30, 2012, and May 30, 2013, the carrier was subject to 33 driver inspections and 30 vehicle inspections, which resulted in no driver OOS violations and 16 vehicle OOS violations. The carrier’s vehicle OOS rate was 43.3 percent, compared to a national average of 20.7 percent. The carrier profile reflected that

33 A motor carrier typically becomes a new entrant shortly after requesting a USDOT number; however, in this case, there was a 2-month delay because of a legal dispute over rights to the carrier’s name. 34 The requirements concerning these three areas are described in 49 CFR 382.305, 49 CFR 391.51(a), and 49 CFR 396.11(a), respectively.

NTSB

Highway Accident Report

22 the accident truck had been subject to three roadside inspections over the 24 months prior to the crash. Those inspections resulted in violations regarding lights and tires, none of which placed the vehicle out of service. As shown in table 4, the truck driver was subject to nine roadside inspections over the previous 24 months. Those inspections resulted in four OOS violations for load securement. Table 4. Truck driver and accident truck roadside inspections. Date Truck Driver Inspections/Violations Accident Truck Inspections/Violations Inspection Levela 08/09/11 No violations No violations 2 04/10/12 Load securement (OOS), lights No violations 2 09/17/12 No violations Lights, tires, other 1 01/11/13 No violations No violations 2 03/18/13 Load securement (OOS) Lights 2 04/27/13 No violations No violations 2 04/29/13 Load securement (OOS) Lights 3 05/14/13 No violations Not applicable 3 05/25/13 Load securement (OOS) No violations 2 a A level 1 roadside inspection is a full inspection, of both the driver and the vehicle, to include the undercarriage of the vehicle and brake measurements. Level 2 is a walk-around inspection of the vehicle and a driver inspection. Level 3 is the driver only; level 4, special studies; and level 5, a terminal inspection conducted at the carrier’s terminal and without a driver. The FMCSA sent two expedited action letters to Alban Waste. The first letter, for operating CMVs with a driver or vehicle OOS rate of 50 percent or greater during the 90 days prior, was dated June 8, 2012. Alban Waste responded with a CAP dated July 11, 2012, which was accepted by the FMCSA, allowing the carrier to continue operating. Two days following the crash, on May 30, 2013, the carrier received a second expedited action letter for operating CMVs with an OOS rate of 50 percent or greater.35 An order to revoke the carrier’s new entrant registration and cease all interstate transportation went into effect on July 1, 2013. On the same day, the FMCSA received a CAP dated June 27, 2013, and the revocation order was rescinded. 1.6.2.3 Compliance, Safety, Accountability Program and Safety Measurement System. In 2010, the FMCSA introduced the Compliance, Safety, Accountability (CSA) program as an initiative to improve large truck and bus safety and ultimately to reduce CMV-related crashes, fatalities, and injuries. The new enforcement and compliance model allows the FMCSA and its state partners to contact a larger number of carriers earlier, with the goal of addressing safety problems before crashes occur. Along with the CSA, the FMCSA also instituted an operational model called the Safety Measurement System (SMS), which replaced its predecessor, Safestat.

35 The letter was unrelated to the crash.

NTSB

Highway Accident Report

23 The SMS is designed to help the FMCSA and its state partners identify high-risk carriers and drivers before they have a crash. The SMS uses motor carrier data from roadside inspections (including all safety-based violations), state-reported crashes, and the federal motor carrier census to quantify performance in the behavior analysis and safety improvement categories (BASICs) described in table 5. Table 5. FMCSA behavior analysis and safety improvement categories. BASIC Definition FMCSRs Example Violations Unsafe driving Operation of CMVs in a dangerous or careless manner Parts 392, 397 Speeding, reckless driving, improper lane change, inattention HOSa compliance Operation of CMVs by drivers who are ill, fatigued, or noncompliant with HOS regulations; includes violations pertaining to records of duty status as they relate to HOS requirements and management of CMV driver fatigue Parts 392, 395 Operating a CMV while ill or fatigued Driver fitness Operation of CMVs by drivers who are unfit due to lack of training, experience, or medical qualifications Parts 383, 391 Failure to have valid and appropriate CDL or being medically unqualified to operate a CMV Controlled substances/alcohol Operation of CMVs by drivers who are impaired due to alcohol, illegal drugs, and misuse of prescription or over-the- counter medications Parts 382, 392 Use or possession of controlled substances/alcohol Vehicle maintenance Failure to properly maintain a CMV or properly prevent shifting loads Parts 392, 393, 396 Brakes, lights, and other mechanical defects; failure to make required repairs; or improper load securement Hazardous materials compliance Unsafe handling of hazardous materials on a CMV Part 397; hazardous materials regulations parts 171, 172, 173, 177, 178, 179, 180 Release of hazardous materials from package; no shipping papers or no placards/markings when required Crash indicator Histories or patterns of high crash involvement, including frequency and severity; based on state-reported crashes Not applicable Not applicable a HOS = hours of service.

NTSB

Highway Accident Report

24 A carrier’s measurement for each BASIC depends on how many adverse safety events it experiences, the severity of violations or crashes, and when the adverse events occurred (more recent events are weighted more heavily). After a measurement is determined, the carrier is placed in a peer group with other carriers with similar numbers of inspections. Percentiles are then determined by comparing the BASIC measurements of the carrier with the measurements of other carriers in the peer group. A percentile of 100 indicates the worst performance. The FMCSA has established threshold levels, as summarized in table 6. When a carrier exceeds a threshold for one of the BASICs, a warning symbol is shown alongside the corresponding entry on the safer.com website. Table 6. BASIC thresholds. BASIC Passenger Carriers (%) Hazardous Materials Carriers (%) All Other Motor Carriers (%)a Unsafe driving HOS complianceb Crash indicator 50 60 65 Driver fitness Controlled substances/alcohol Vehicle maintenance 65 75 80 Hazardous materials compliance 80 80 80 Source: csa.fmcsa.dot.gov/FAQs.aspx. a Alban Waste is classified under “all other motor carriers.” b HOS = hours of service. Between May 2012 and May 2013, Alban Waste exceeded its BASIC thresholds eight times. These BASICs included unsafe driving and vehicle maintenance (improper loading). At the time of the crash, Alban Waste had an unsafe driving BASIC of 90.2 percent and a vehicle maintenance BASIC of 66.4 percent. Table 7 lists the carrier’s BASIC scores that exceeded thresholds.

NTSB

Highway Accident Report

25 Table 7. Alban Waste BASIC scores exceeding thresholds. Date BASIC Threshold (%) Alban Waste (%)a May 2012 Vehicle maintenance (improper loading) 80 98.3 June 2012 Vehicle maintenance (improper loading) 80 98.4 July 2012 Vehicle maintenance (improper loading) 80 98.7 August 2012 Vehicle maintenance (improper loading) 80 98.8 September 2012 Vehicle maintenance (improper loading) 80 98.7 October 2012 Vehicle maintenance (improper loading) 80 99.8 March 2013 Unsafe driving 65 89.9 April 2013 Unsafe driving 65 90.2 a A percentile of 100 indicates the worst performance. Percentages exceeding the established thresholds require agency action. 1.6.2.4 Compliance Reviews. In addition to safety audits for new entrants and roadside inspections to evaluate driver and vehicle safety, the FMCSA also conducts CRs to ensure adherence to the safety fitness standards defined in 49 CFR 385.5. There are two types of CRs: focused or comprehensive. A focused CR is conducted when two or fewer BASICs exceed the preestablished thresholds. Such reviews do not normally result in a formal safety rating. A comprehensive CR is conducted when three or more BASICs exceed their thresholds or when a carrier is subject to a fatal crash or a complaint. A comprehensive CR addresses all aspects of the carrier’s operation and normally results in a safety rating determined through a methodology that evaluates patterns of critical or acute violations.36 As a result of this crash, the FMCSA conducted a comprehensive CR of Alban Waste. One acute and nine critical violations were discovered, resulting in an “unsatisfactory” safety

36 Appendix B, 49 CFR Part 385, defines critical and acute violations. Safety ratings are “satisfactory,” “conditional,” or “unsatisfactory,” using the factors prescribed in 49 CFR 385.7 as computed under the safety fitness methodology. (1) A satisfactory rating means that a motor carrier has in place and functioning adequate safety management controls to meet the safety fitness standard prescribed in 49 CFR 385.5. (2) A conditional rating means that a motor carrier does not have adequate safety management controls in place to ensure compliance with the safety fitness standard, which could result in occurrences listed in §385.5 (a) through (k). (3) An unsatisfactory rating means that a motor carrier does not have adequate safety management controls in place to ensure compliance with the safety fitness standard, which has resulted in occurrences listed in §385.5 (a) through (k). (4) Unrated refers to a situation where the FMCSA has not assigned a safety rating to the motor carrier.

NTSB

Highway Accident Report

26 rating. As a property-carrying CMV operator, Alban Waste was given 60 days to comply. The carrier failed to do so and was placed out of service on September 13, 2013. 1.6.3 State of Maryland Oversight The Maryland Vehicle Law, title 23, subtitle 21, authorizes the state to regulate CMVs. The Maryland State Police performs roadside inspections, safety audits, and CRs of motor carriers located in Maryland. Additionally, the Maryland State Police monitors motor carrier compliance with the state preventive maintenance (PM) program. To comply with the PM program, the registrant of a vehicle with a registered weight, actual weight, or rated gross vehicle weight over 10,000 pounds must certify that he or she has personal knowledge of applicable federal and state motor carrier safety rules, regulations, and standards. This certification must be made when purchasing new registration plates and at the time of their renewal. Vehicle owners must also have the vehicles inspected, maintained, and repaired at least every 25,000 miles, or every 12 months (whichever occurs first), and retain maintenance records. On July 19, 2013, the Maryland State Police conducted a maintenance audit on Alban Waste and discovered that it failed to use any type of maintenance form that meets the PM requirements, failed to maintain maintenance records as required, and failed to produce records for the required time period. As a result of violations documented during the maintenance audit, the Maryland State Police issued the owner of Alban Waste a citation for $2,600. 1.7 Train Crew The train crew consisted of an engineer and a conductor. The engineer was hired by CSXT in 1996 as a brakeman, was promoted to engineer in 1998, and had been working as such for 14 years at the time of the crash. His regular run was operating trains between Richmond and Philadelphia. The engineer had a current 49 CFR Part 240 certification.37 He had been observed by supervisors 103 times in the 12 months preceding the crash and had properly complied with the railroad’s rules and procedures during all of the observations. CSXT hired the conductor in 2011. After training, he started working in January 2012. During that year, he was furloughed 6–7 months nonconsecutively. Because of his limited seniority, he had been on an “extra list” to cover other jobs when regular employees were not available. He had infrequently worked on the Richmond-to-Philadelphia territory; however, he stated that he had been “territory qualified” and felt comfortable being assigned to this job. The conductor had been observed by supervisors 78 times in the 12 months preceding the crash and had properly complied with the railroad’s rules and procedures in all but one observation, during which he was reminded to complete the reports associated with designating the placement of railroad cars.

37 Title 49 CFR Part 240 requires that engineers be certified every 3 years. The engineer must pass a written knowledge examination and operate a train while being monitored by a supervisor.

NTSB

Highway Accident Report

27 Both the engineer and the conductor were current with all required training programs, including a “hazardous materials awareness for transportation employees” class. According to cell phone records, neither the engineer nor the conductor was using his phone at the time of the crash. The train crew members did not undergo postcrash toxicological testing, nor were they required to do so.38 Their duty hours were within the requirements of the HOS regulations for railroad employees (49 CFR Part 228). Both crew members reported having had adequate sleep on the night of May 27, 2013, and feeling rested the following day. 1.8 Highway–Railroad Grade Crossing The crash occurred at the intersection of a private road known as “68th Street” or “Dump Road” and a CSXT railroad track at milepost BAK 87.40 (DOT crossing number 140833J).39 From the carrier terminal to the railroad crossing, the roadway exhibited an initial northwestward heading, perpendicular to the rail line. It then curved left 90 degrees and paralleled the rail line in a southwesterly direction for about 425 feet. The roadway curved to the right, northwestward, approximately 150–175 feet before the first set of tracks,. (See figure 2.) At the onset of the curve, its radius measured about 120 feet; the radius decreased to just over 60 feet closer to the crossing, at which point the curve ended with a short tangent segment that preceded the first set of tracks. The roadway crossed the tracks at an angle of 83–86 degrees. The average width of the road was 19–22 feet, and it widened slightly to 26–29 feet through the curve. The width of the paved crossing surface was about 31.4 feet. The railroad tracks in the surrounding area are essentially level and tangent, but the road approaching the crossing is on a grade. Pavement elevation 30 feet south of the nearside rail on the northwest approach was 31 inches lower than at the rail, resulting in a grade of 9.6 percent at that point. The grade varied from 8.8 to 12.3 percent slightly farther southeast of the crossing. Figure 7 shows the northwest approach to the highway–railroad grade crossing. No pavement stripes, advance railroad crossing warning signs, or railroad crossing pavement markings were present on this approach. No speed limit signs were posted on the private road.40

38 Title 49 CFR 219.201, Events for which testing is required. (b) Exceptions. No test may be required in the case of a collision between railroad rolling stock and a motor vehicle or other highway conveyance at a rail/highway grade crossing. 39 Baltimore County records show that a public road known as 68th Street ends at its connection with Lake Drive and that a private road provides access to several buildings on the south side of the railroad tracks. 40 The Annotated Code of Maryland, Transportation Article 21-801.1, states that 30 mph is the maximum speed limit in a business district.

NTSB

Highway Accident Report

28

Figure 7. Truck driver’s approach view of grade crossing when heading northwestward on private road from carrier terminal (STOP sign not visible). A crossbuck sign was located on each side of the crossing.41 On the southeast side, the crossbuck sign was 25 feet from the nearest rail; and on the northwest side, the sign was 17 feet from the nearest rail. STOP signs were located to the right of each crossbuck sign; however, the signs were not compliant with the Manual on Uniform Traffic Control Devices for Streets and Highways (MUTCD; Federal Highway Administration [FHWA 2009]). The yellow paint on both STOP signs had faded significantly, and both signs had been displaced from their original mountings prior to the crash. Both signs featured stamped metal embossed with the words “stop, look, listen.” The STOP sign that should have been regulating traffic moving northwestward, shown in figure 8, was facing away from the roadway, rusted bolt holes had allowed it to rotate upside down, and it was completely obscured from view by vegetation. Figure 9 shows a detail view of the STOP sign.

41 Because this grade crossing was considered private, it was exempt from all other traffic control and highway design guidelines and requirements as specified in the Railroad Safety Improvement Act of 2008 (RSIA).

NTSB

Highway Accident Report

29

Figure 8. View of STOP sign facing away from roadway, relative to road, railroad, and crossbuck sign.

Figure 9. Detail view of STOP sign at grade crossing. STOP Sign

NTSB

Highway Accident Report

30 On June 12, 2013, NTSB investigators requested that CSXT cut back vegetation at the crossing to improve sight lines and work with the Maryland State Highway Administration (MDSHA) to perform an engineering analysis to determine the need for upgraded warning devices. CSXT responded by removing the vegetation approximately 27.5 feet from the nearest rail and installing a YIELD sign at the southeast approach to the crossing; however, it said that it expected MDSHA to take the lead in determining if additional improvements were needed. The NTSB also asked MDSHA to work with CSXT in conducting an engineering study at the accident crossing; however, the agency refused, citing liability concerns and a prohibition in 23 United States Code (USC) Section 130 about using public funds for improvements at private crossings. 1.8.1 Traffic at Grade Crossing The maximum authorized train speed at DOT crossing 140833J was 50 mph. According to CSXT, average daily train frequency was between seven and nine trains southwestbound and 10 and 12 northeastbound, for a total of 17–21 trains every 24 hours. Additionally, a review of footage from a nearby security camera indicated that highway vehicles traversed the crossing between 10 and 23 times per day during daylight hours. 1.8.2 Grade Crossing Land Ownership and Responsibilities The land where the grade crossing is situated was deeded between 1851 and 1853 to the White family along with right-of-way agreements to the Baltimore and Ohio Railroad Company, which were dated in 1954.42 The 23.8-acre parcel of land located south and immediately adjacent to the railroad tracks was deeded to Marley Neck–Patapsco Company, a subsidiary of CSX Realty Inc., in February 1972. The Alban Waste terminal was situated on a 6.1-acre parcel of land located southeast of and adjacent to the CSX property. Real estate records listed Robb and Elizabeth Tyler as the owners of this property from February 1972 until January 1999. When the Tylers purchased the property in 1972, they entered into an agreement that gave them an easement to use the private roadway that extended from the property to the grade crossing. The Deed of Easement and Agreement states that Marley Neck–Patapsco Company has the right to use the private roadway “without any obligation for the maintenance of the same.” CSX has asserted that this language shows that it does not have a duty to maintain the roadway. In 1999, Pulaski & 68th Street LLC obtained ownership of the 6.1-acre property from the Tylers. According to CSX, easement rights and the responsibility for maintaining the roadway conveyed to Pulaski & 68th Street LLC when the change of ownership occurred. Consequently, CSX asserts that Pulaski & 68th Street LLC was the private landowner and responsible for maintaining the roadway on the date of the crash.

42 Right-of-way refers to the right to build and operate a railway line or a highway on land belonging to another, or the land so used (Garner 2014).

NTSB

Highway Accident Report

31 The NTSB was unable to locate any correspondence or other supporting agreements between CSX and Pulaski & 68th Street LLC that specified responsibilities for maintaining the private roadway, signage, and vegetation clearance at the crossing. 1.8.3 Other Collisions at Accident Site Two other highway–railroad grade crossing collisions have occurred at the accident site (DOT 140833J). In both cases, there were no fatalities, but each collision involved trucks that failed to stop before traversing the crossing and were struck by trains. One collision occurred on August 5, 1988, and the other on August 5, 2014—approximately 14 months after the May 28, 2013, collision that is the subject of this report. The operator of the truck involved in the August 2014 collision was Nova Services Inc. NTSB investigators documented preliminary information about the August 5, 2014, collision. It, too, involved a three-axle straight truck configured for roll-off service traveling northwest on the private road.43 Surveillance and forward-facing locomotive videos showed the truck emerging from behind foliage near the crossbuck sign at a speed inconsistent with having stopped in advance of the crossing. The truck was observed to continue at a fairly constant rate of speed into the crossing and onto the tracks, where it was struck by a CSXT locomotive in the vicinity of the third axle. The locomotive event data recorder indicated that the train was approaching the crossing at a speed of approximately 33 mph and that the locomotive was placed into emergency braking prior to the collision. The locomotive did not derail and was returned to service later in the day. The truck was towed from the scene. No injuries were reported. Examination of the crossing and surrounding area on August 5, 2014, indicated no apparent change in signage or foliage clearing compared to the time of the May 28, 2013, collision. 1.8.4 Grade Crossing Inventory Program The purpose of the DOT grade crossing inventory program is to provide a uniform national inventory database to facilitate the improvement of safety at highway–railroad grade crossings.44 The Federal Railroad Administration (FRA) has managed the database since 1975. Its web-based accident prediction system (WBAPS) uses accident data and grade crossing inventory data to estimate predicted collisions per year for public crossings. The resulting estimates can be used by state and local officials to identify and prioritize public grade crossings that may require specialized attention, including physical improvements or enhancements.45 WBAPS does not provide estimates for private crossings.

43 The truck involved in the August 5, 2014, collision was not carrying a roll-off container. 44 See www.fra.dot.gov/Page/P0111, accessed June 13, 2014. 45 Notably, a December 2013 WBAPS search for Baltimore County, Maryland, listed crossing 141518W (a closed spur crossing) as the crossing with the highest predicted collisions, which suggests that there are errors in either the grade crossing inventory or WBAPS.

NTSB

Highway Accident Report

32 As part of the grade crossing inventory program, every highway–railroad grade crossing in the United States is required to have a unique inventory number. Railroads are responsible for assigning FRA-generated numbers to crossing locations, filing grade crossing inventory reports with the FRA, and posting inventory numbers on both sides of crossings. Once an inventory number is assigned to a specific crossing, it permanently remains with that location and in the grade crossing inventory and cannot be reused. At the time of the crash, the emergency notification sign posted beneath the crossbuck sign at the accident crossing incorrectly listed DOT crossing number 141518W, which the grade crossing inventory identified as a public crossing with 2,300 highway vehicles traversing per day.46 Following the crash, CSXT corrected the grade crossing inventory by designating crossing 141518W as closed and also modified (and later replaced) the emergency notification sign at the crossing to read “140833J.”47 The grade crossing inventory entry for crossing 140833J at the time of the crash indicated that it was a private crossing. The inventory did not include any information about average daily highway traffic. Crossing 140833J was listed as being located at milepost 87.40, with latitude 39.3056830 and longitude -76.5619580; however, the coordinates were incorrect and indicated a location approximately 2.3 miles from the actual crossing. CSXT confirmed that the geographic coordinates of the crossing listed in the inventory did not accurately reflect the location of the accident crossing, and stated that it would measure the coordinates and correct the entry in the DOT inventory.48 1.8.5 Sight Distance at Crossing Postcrash, NTSB investigators examined the sight distance available at the southeastern quadrant of the crossing to determine the impact of vegetation in the area. Examination of three-dimensional scanner information revealed that the cutback distance of the foliage ranged from 13 to 24 feet from the southern nearest rail, though the cutback extended to about 27 feet immediately adjacent to the roadway. NTSB investigators conducted tests at the crossing with an exemplar truck to assess sight distances.49 The front of the truck was positioned northwestward on the private road 15 feet from the nearest rail (the minimum distance required by state statute

46 Investigators learned from MDSHA that this traffic count was taken from a nearby public location, 68th Street near the intersection with Biddle Street. 47 On December 12, 2013, in response to a request from the NTSB, CSXT stated that it had not determined why the incorrect DOT crossing number was posted; however, it explained that crossing 141518W was the identifier for the highway–railroad grade crossing of a defunct spur line that intersected a public section of 68th Street. 48 In June 2013 (and December 2013), NTSB investigators attempted to find the accident crossing using the FRA “rail crossing locator” smartphone application. The crossing listed for the location of the crash was identified as 140827F and designated as a public crossing that runs under the Southeast Freeway. When investigators entered the number of the accident crossing (140833J), the system erroneously indicated that it was located in the Orangeville industrial area between North Macon Street and East Federal Street. A recheck of the rail crossing locator was conducted in June 2014, and the errors had been corrected. 49 Investigators compared measurements of the exemplar truck, a Freightliner, to the Mack specifications and determined that it was a suitable exemplar for the sight distance tests.

NTSB

Highway Accident Report

33 for stopping before a crossing, and a standard design practice).50 The results of those tests showed that a driver looking to the right had a sight distance of about 230 feet down the tracks. Investigators estimated that a driver would have had to position the front of the truck approximately 7–8 feet from the nearest rail to be able to see 1,000 feet or more down the tracks.51 The sharp horizontal curve proximate to the crossing, along with the skewed (83 degree) crossing angle, further reduced the sight distance triangle that was already obstructed by vegetation. Tests indicated that when the exemplar truck was stopped 15 feet from the nearest rail, it would be oriented approximately 66 degrees relative to the rails, and the driver position would be 24–25 feet from the nearest rail. In this orientation, the line of sight for the accident driver would have been less than 230 feet to the right down the tracks. The term “clearing sight distance” refers to the minimum distance at which the driver of a stopped highway vehicle can detect a train that will reach the crossing before the vehicle has time to clear it. Both the American Association of State Highway and Transportation Officials (AASHTO 2011) and the FHWA (2007) recommend that larger design vehicles be used to determine clearing sight distances.52 Design charts from both sources indicate that 1,205 feet of clearing sight distance should be available for a 73.5-foot-long truck-tractor semitrailer at a level 90 degree one-track crossing. The design documents also indicate that the distance should increase if a crossing is not level, has multiple tracks, or has a skewed approach angle. 1.8.6 Review of Nearby CSXT Highway–Railroad Grade Crossings NTSB investigators reviewed four highway–railroad grade crossings located within 2 miles east of the collision site: DOT crossings 140831V, 140828M, 140829U, and 140830N. Three of the crossings were listed as private in the grade crossing inventory, and one (140830N) was listed as public. According to the inventory, crossing 140830N became public in 2010, and the crossing warning devices were upgraded from crossbuck signs to gates and train-activated lights with a constant warning time. MDSHA indicated that Baltimore County took public jurisdiction of crossing 140830N so that the state could obtain federal funding for improvements. A total of 31 crashes occurred at these four crossings and the accident crossing between 1975 and 2012. Nineteen of those crashes involved heavy trucks and 12 involved automobiles, vans, or pickup trucks. An inspection of the four nearby crossings conducted on May 31, 2013, showed that visibility at the three private crossings was restricted by overgrowth of vegetation on the railroad right-of-way. Additionally, one of the private crossings (140829U) had a severe

50 Annotated Code of Maryland, Transportation Article 21-701, “. . . the driver of a vehicle shall stop within 50 but not less than 15 feet from the nearest rail in the crossing.” 51 The prescribed distance for the train’s dynamic envelope (danger zone) is 6 feet from the rail. 52 The AASHTO guide does not apply to private grade crossings. It is used in this report for comparative purposes. Similarly, the FHWA Handbook states that “The maintenance of the sight triangle, beyond highway and railroad right of way, presents a unique problem. Except for the portions on the rights of way, this involves private property. The removal of trees, brush, crops, buildings, signs, storage facilities, and other obstructions to the driver’s view requires access to the property and an agreement with the landholder for the removal of the obstruction.” (FHWA 2007, 186)

NTSB

Highway Accident Report

34 humped profile; the vertical profile was so steep that approaching traffic on the other side of the crossing was not visible. 1.8.7 National Highway–Railroad Grade Crossing Accident Data NTSB staff reviewed national highway–railroad grade crossing accident and fatality data for 2003–2012. Investigators also considered the number and type of grade crossings in use during this period, employing data from the grade crossing inventory and the FRA grade crossing accident database. The FRA (2011) defines a highway–railroad grade crossing accident as any impact between on-track railroad equipment and a highway user at a highway–railroad grade crossing. From 2003 to 2012, the total number of public and private highway–railroad grade crossings decreased by approximately 11 and 8 percent, respectively. During the same 10-year period, the total number of fatal accidents per year decreased by approximately 25 percent at public crossings but showed no change at private crossings. Figure 10 shows the fatal accident rate per 10,000 crossings for both public and private highway–railroad grade crossings during the same period.

Figure 10. Fatal accident rate per 10,000 grade crossings for public and private grade crossings in the United States, 2003–2012.

NTSB

Highway Accident Report

35 In 2012, a total of 210,222 grade crossings were in use in the United States, of which 80,582 (38 percent) were private crossings. In the same year, 232 people died in grade crossing accidents, and 31 (13 percent) of those fatalities occurred at private grade crossings. Large trucks are overrepresented in all highway–railroad grade crossing accidents. Although they account for 4 percent of registered vehicles and 9 percent of vehicle miles traveled, large trucks were involved in about 23 percent of all grade crossing accidents between 2003 and 2012.53 Additionally, grade crossing accidents involving large trucks are about three times more likely to result in a train derailment than those involving all motor vehicles (2.6 percent versus 0.8 percent). 1.8.8 Vegetation at Highway–Railroad Grade Crossings Various federal and state regulations address vegetation clearance at highway–railroad grade crossings. Title 49 CFR 213.37 states that “Vegetation on railroad property which is on or immediately adjacent to roadbed shall be controlled so that it does not—(a) become a fire hazard to track-carrying structures; (b) obstruct visibility of railroad signs and signals (1) along the right-of-way, and (2) at highway–rail crossings.” Seventeen states require the removal of vegetation at or near highway–railroad grade crossings (Jennings 2009).54 Maryland is one of 33 states without such laws. The state laws that do address vegetation removal vary considerably. Certain laws specify a distance around the crossing that must remain clear, and others specify which parties are responsible for maintenance of the area. Examples of several state laws are provided below:  In Illinois, railroads must remove from the right-of-way all vegetation 500 feet in either direction from each grade crossing (625 ILCS 5/18c7401).  In Minnesota, local governing bodies of towns/municipalities may require railroads, road authorities, or private land owners to remove visual obstructions near public or private grade crossings (Minn. Stat. §219-384(l)(2)).  In Missouri, all railroads are responsible for maintenance of their rights-of-way at highway–railroad grade crossings. Crossings must be kept clear of vegetation, undergrowth, or other debris for a distance of 250 feet each way from the near edge of the crossing (Mo. Rev. Stat. §389.665).  In New Hampshire, the state department of transportation may order the railroad to clear visual obstructions from the area surrounding crossings (N.H. Rev. Stat. Ann. §373:18).

53 See www.nrd.nhtsa.dot.gov/Pubs/811868.pdf, accessed April 22, 2014. 54 Arkansas, Colorado, Connecticut, Idaho, Illinois, Indiana, Louisiana, Maine, Massachusetts, Minnesota, Missouri, New Hampshire, Ohio, South Carolina, Virginia, Washington, and Wisconsin.

NTSB

Highway Accident Report

36 CSXT also has a policy concerning vegetation clearance at grade crossings. It includes annually spraying vegetation for weed control at all crossings, including private crossings, 30 feet from each side of the track center, for a distance of 200 feet before and after any crossing and including all four quadrants of the road crossing. CSXT also “brush sprays” all four quadrants of the crossing (that is, covers brush up to a height of 15 feet above the top of the rail), including private crossings, on a 3-year rotation, 30 feet from the center of the track, for a distance of 200 feet before and after the crossing. In conjunction with the brush control schedule, brush is cut along railroad rights-of-way and road crossings when spraying cannot be performed adequately, economically, or safely. The policy also specifies that vegetation control activities be performed in accordance with all applicable local, state, and federal requirements. According to CSXT records, the railroad bed approaching the accident crossing and the railroad crossing itself had been sprayed annually. The vegetation at the railroad bed and at the crossing was sprayed 6 weeks before the crash, on April 16, 2013. 1.8.9 Federal and State Laws on Private Grade Crossing Safety According to 23 CFR 924.11(b), federal highway safety improvement funds distributed to states under the 23 USC 130(f) railway–highway grade crossing program are limited to safety projects on public roads. Traffic control requirements found in the MUTCD and in the AASHTO (2011) geometric and sight distance guidelines apply to the design of public highways and certain private roads.55 Beginning in 2014, as part of RSIA, private highway–railroad grade crossings are required to have blue and white emergency notification signs giving the DOT crossing number and a toll-free emergency number that can be used by pedestrians or vehicle operators to report obstructions. Twenty-three states, including Maryland, have laws addressing private highway–railroad grade crossings.56 Examples of these laws include  Requiring railroads to build or maintain private crossings in a safe condition, generally as stipulated by a state agency (California, New Jersey, Oklahoma, South Carolina, South Dakota).  Requiring or giving state agencies authority to install—or require the installation of— traffic control or warning devices at private grade crossings (California, Florida, Maryland, Missouri, Oregon).  Designating financial responsibility for building or maintaining private grade crossings in a safe condition (Connecticut, Michigan, Missouri, Nebraska).

55 The MUTCD requirements were expanded to include a definition of “private road open to public travel” in 2009; however, the new definition exempts private highway–railroad grade crossings. See mutcd.fhwa.dot.- gov/pdfs/2009/pdf, part 3, Markings, 347, accessed August 15, 2014. 56 California, Connecticut, Florida, Iowa, Kansas, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, New Hampshire, New Jersey, New York, Ohio, Oklahoma, Oregon, Rhode Island, South Carolina, South Dakota, Utah, and Virginia.

NTSB

Highway Accident Report

37  Giving public agencies authority to convert roads and grade crossings from private to public (Maryland, New Hampshire). In Maryland, approximately half of all highway–railroad grade crossings are private.57 Several laws in the Annotated Code of Maryland, Transportation Article, address safety at private highway–railroad grade crossings, including the following:  §21-702: MDSHA and any local authority with the approval of MDSHA may place a STOP sign at any railroad grade crossing of a highway that the local authority or state designates as particularly dangerous. The law further requires that drivers adhere to the stop.  §25-106.1: Owners of private property used by the public in general may erect traffic control devices intended to control traffic only if those devices conform to the state MUTCD.  §8-639(b): The state transportation secretary has authority to approve the construction or modification of a railroad grade crossing or a change of crossing protection equipment and to impose conditions necessary to ensure public safety.  §8-640(a): At each grade crossing of a highway and a railroad, the railroad is obligated to keep its roadbed and the highway in proper repair so as to provide absolutely safe and easy approach to and crossing of the track; or subject to approval by MDSHA, construct a railroad grade separation.  §8-640(b): MDSHA may abandon, relocate, construct, or reconstruct any railroad grade crossing or railroad grade separation that is dangerous or inconvenient for public travel, or construct a railroad grade separation. 1.9 Vehicles 1.9.1 Accident Truck The accident truck was a 2003 Mack CV713 Granite roll-off truck. The truck driver routinely drove the truck and was familiar with its operation. He stated that on the day of the crash, he did not observe any anomalies in the vehicle’s operation. At the time of the crash, the truck had been driven 327,497 miles according to the VECU. Its gross vehicle weight rating was 62,000 pounds. The empty weight of the truck, obtained from a weight ticket issued by the Baltimore Recycling Center on the morning of the crash, was recorded as 34,340 pounds. Individual axle weights could not be obtained because of the postcrash condition of the truck.

57 As of 2012, 644 of 1,276 highway–railroad grade crossings in Maryland were designated as private.

NTSB

Highway Accident Report

38 NTSB investigators examined the mechanical condition of the truck—including the steering and suspension systems, tires, transmission, and air and braking systems—to identify components that could have affected the handling or control of the vehicle. Investigators also reviewed vehicle maintenance records and recall databases for factors that may have contributed to the vehicle’s condition. Because of the severely damaged postcrash condition of the vehicle, no functional check of the steering system was possible; however, a video surveillance recording from a nearby business documented the truck successfully negotiating a curve just prior to entering the grade crossing. Additionally, the damage to the suspension system components was consistent with the overall damage to the vehicle and appeared to be related to the collision. With respect to the truck tires, the observed damage was consistent with damage caused by the collision with the train and the subsequent impact with the earthen embankment. All but one of the truck’s tires was below the maximum pressure of 120 pounds per square inch (psi) specified by the tire manufacturer. The left steer axle tire had an inflation pressure of 143 psi. The primary consequences of operating an overinflated tire include uneven tire wear and the increased risk of a blowout; however, in this case, the overinflated tire remained intact during the collision sequence. Direct functional checks of the air and braking systems were also precluded due to vehicle damage. However, pushrod stroke measurements obtained for all but two of the brakes were found to be at or within the maximum adjustment limits.58 Antilock brake system (ABS) sensors were in place on four of the wheels as designed. The wire leading from the wheel speed sensor on the left side of axle 4 was severed, and the end of the insulating material was worn, indicating that it had been severed for some time prior to the collision. Although the break in the wheel speed sensor wiring from the left side of axle 4 would have disabled the ABS for the left side of both drive axles, the brake system would have reverted to non-ABS for those brakes. The effects of the severed wheel speed sensor wire would have been limited to only the left side of the drive axles and would not have affected the remainder of the ABS. 1.9.2 Train The Q40927 train had two locomotives. The lead locomotive, CSXT 5310 (model number ES44DC), was built by General Electric. The second locomotive, CSXT 8583 (model number SD50-2), was built by Electro-Motive Diesel. The train—which was 2,979 feet long—contained 14 loaded cars and 31 empty cars, with a total weight of 2,890 tons. The lead locomotive air horn was a center-mounted five-tone Nathan K-5HL-R2. The fundamental frequencies of the five tones were 261, 311, 370, 470, and 512 hertz.59 Postcrash tests demonstrated that the sound level of the locomotive horn complied with the requirements of 49 CFR 229.129.60

58 The two brakes not measured had collision-related damage. 59 See www.microprecisiongroup.com, accessed June 25, 2014. 60 Federal regulations require the train horn to be at least 96 decibels but no more than 110 decibels at 100 feet forward of the cab in the direction of travel (49 CFR 229.129).

NTSB

Highway Accident Report

39 Additionally, the lead locomotive was equipped with a headlamp and right and left auxiliary lights (ditch lights). Title 49 CFR 229.125 requires that auxiliary lights and the headlamp be continuously illuminated immediately prior to and during movement of the locomotive, except as provided by railroad operating rules, timetables, or special instructions, unless such exception is disapproved by the FRA. The lead locomotive event recorder indicated that the front headlamp and auxiliary lights were illuminated prior to and at the time of impact. A review of video surveillance footage from the nearby facility showed that the headlamp was visibly illuminated as the train approached the crossing. Investigators reviewed 16 video images (frames) from the time the locomotive headlamp came into view until the time of the crash, representing an elapsed time of approximately 1 second. In several frames, investigators observed spots of visible brightness in the vicinity of the right and left auxiliary lights. Three of the 15 derailed cars contained hazardous materials (cars 7, 8, and 15). The other derailed cars contained non-DOT-regulated commodities or were empty. Figure 11 shows the postcrash locations of the derailed cars; and table 8 describes the car type, load, commodity, and fire damage for each derailed car. Additional details are provided about the cars containing hazardous materials and the non-DOT-regulated material (terephthalic acid) that was involved in the postcrash fire.

Figure 11. Aerial photograph taken May 29, 2013, showing 15 derailed cars labeled by position in train (in parentheses), followed by car reporting marks. (Car 16 is included and labeled, but it did not derail.)

NTSB

Highway Accident Report

40 Table 8. Derailed cars for train Q40927 (hazardous materials highlighted in yellow). Position Reporting Marks Load Commodity Car Type Fire Damage 1 CSXT 135017 Empty Scrap or waste paper A332 box No 2 TTPX 82350 Empty Plate, iron, or steel F253 flat No 3 EEC 1095 Empty Malt liquors A402 box No 4 CSXT 130476 Empty Pulpboard or fiberboard A302 box No 5 CSXT 141318 Empty Pulpboard or fiberboard A302 box Yes 6 TTPX 811227 Empty Beams, iron, or steel F453 flat No 7 UNPX 128076 218,279 pounds Sodium chlorate, class 5.1, UN1495 C712 covered hopper Yes 8 GATX 61416 Residue Fluorosilicic acid, class 8, UN1778 DOT- 111A100W5 Yes 9 ACFX 67747 198,680 pounds Terephthalic acid C414 covered hopper Yes 10 ACFX 66451 199,257 pounds Terephthalic acid C414 covered hopper Yes 11 ACFX 68042 199,099 pounds Terephthalic acid C214 covered hopper Yes 12 ACFX 67966 198,460 pounds Terephthalic acid C414 covered hopper No 13 NOKL 725103 Empty Plate, iron, or steel F343 flat No 14 AEX 12778 Empty Monoammonium phosphate C113 covered hopper No 15 HOKX 111773 199,000 pounds Sodium hydroxide solution, class 8, UN 1824 DOT- 111A100W1 No

NTSB

Highway Accident Report

41 Car 7 (UNPX 128076, shown in figure 12) was an Association of American Railroads type C712 two-bay cylindrical aluminum covered hopper car loaded with 218,279 pounds of sodium chlorate crystal (hazard class 5.1, oxidizer).61 This car was destroyed in a postcrash explosion and released its entire contents.

Figure 12. Precrash photo of cylindrical aluminum covered sodium chlorate hopper car UNPX 128076, September 29, 2012. (Source: Railroad Picture Archives) Sodium chlorate is used commercially for bleaching paper and pulp. Its material safety data sheet describes it as an inorganic white-to-yellow crystalline solid that is a strong oxidizing agent. Its crystals are similar in appearance to table salt. It is odorless and is highly soluble in water. The material has a specific gravity of 2.49 and a melting point of 248°C (478°F). Sodium chlorate, due to its oxidizing nature, accelerates the combustion of organic materials (such as wood, paper, oil, or clothing) and increases the intensity of a fire—in which it melts, decomposes at 265°C (510°F), and releases oxygen. It reacts violently, either as a solid or a liquid, with all organic matter and some metals. Car 8 (GATX 61416, shown in figure 13) was a class DOT-111A100W5 tank car that contained fluorosilicic acid (hazard class 8, corrosive liquids) residue.62 The empty car weight was about 29 tons. No evidence of liquid release was observed from this tank car.

61 Oxidizers are materials that, generally by yielding oxygen, can cause or enhance the combustion of other materials (49 CFR 173.127). 62 Per 49 CFR 173.136 and 49 CFR 173.137, corrosive materials are liquids or solids that cause full thickness destruction of human skin at the site of contact within a specified period, or liquids that have a severe corrosion rate on steel or aluminum based on criteria in 49 CFR 173.137(c)(2). A liquid is considered to have a severe corrosion rate if it corrodes steel (SAE 1020) or aluminum (nonclad 7075-T6) faster than 6.25 millimeters (0.246 inch) a year at a temperature of 55°C (131°F).

NTSB

Highway Accident Report

42

Figure 13. Precrash photo of fluorosilicic acid tank car GATX 61416, July 10, 2011. (Source: Railroad Picture Archives) Fluorosilicic acid, also known as hydrofluorosilicic acid, is mainly used as a fluoridation agent for drinking water. It is extremely corrosive to the skin, eyes, and mucous membranes through direct contact, inhalation, or ingestion. The material is nonflammable; however, during a fire, it can react with many metals to produce flammable and explosive hydrogen gas. Hydrofluorosilicic acid decomposes above 108°C (227°F), producing toxic, irritating, and corrosive fumes, including hydrofluoric acid and silicon tetrafluoride. Car 15 (HOKX 111773) was a loaded class DOT-111A100W5 tank car containing 199,000 pounds of sodium hydroxide solution (hazard class 8, corrosive liquids). The tank shell and fittings were not damaged, and there was no release of material from this car. Sodium hydroxide solution is not combustible. The substance itself does not burn, but it can decompose upon heating to produce corrosive or toxic fumes, and containers can explode when heated. Sodium hydroxide solution can severely irritate skin, eyes, and mucous membranes. It is toxic by ingestion and corrosive to metals and tissues. Cars 9, 10, 11, and 12 were loaded with a combined total of 795,496 pounds of terephthalic acid, a non-DOT-regulated commodity. Cars 9 and 10 were involved in the postcrash fire. Terephthalic acid is a precursor in the production of polyethylene terephthalate, a thermoplastic polymer resin that is used to produce beverage, food, and liquid containers. It is a carboxylic acid that can be oxidized by strong oxidizing agents and generate heat. The material has a specific gravity of 1.51, a flash point of 260°C (500°F), and an autoignition temperature of 496°C (925°F). Terephthalic acid is considered stable to mechanical impact, but it can burn at high temperatures and its dust can form explosive mixtures in the air. During a fire, it can generate irritating and toxic gases and fumes.

NTSB

Highway Accident Report

43 1.9.3 Auditory Study On September 4–5, 2013, investigators returned to the scene of the crash to measure ambient noise inside the cab of an exemplar roll-off truck under a variety of conditions. Measurements and qualitative observations were made inside the truck at various distances from the grade crossing and under various engine operating conditions. Because the testing was conducted at the grade crossing on an active set of tracks, the train speed and direction could not be controlled. The truck windows were closed for all tests. In all but one instance, an observer inside the truck was able to hear the train horn as the train made its approach to the crossing. In the case where the observer did not hear the horn, the truck was positioned 300 feet from the crossing.

NTSB

Highway Accident Report

44 2 Analysis 2.1 Introduction About 1:59 p.m. on May 28, 2013, a roll-off straight truck carrying a load of debris to a recycling center departed the company terminal and traveled northwest on a private road in Rosedale, Baltimore County, Maryland, toward a private highway–railroad grade crossing. Once the truck left the Alban Waste facility and passed through the property gates, it traveled approximately 0.2 mile along the paved road before reaching the grade crossing. About the same time, a CSXT freight train traveling southwest was approaching the crossing at 49 mph. The crossing had no active warning devices such as gates or lights. The only visible signage was a crossbuck sign and an emergency notification sign with an incorrect crossing identifier number. As described in section 1.8, the design of the crossing and vegetation growth obstructed sight lines to the northeast in the direction of the approaching CSXT train. Title 49 CFR 392.11 states that a CMV shall, “upon approaching a railroad grade crossing, be driven at a rate of speed which will permit said commercial motor vehicle to be stopped before reaching the nearest rail of such crossing and shall not be driven upon or over such crossing until due caution has been taken to ascertain that the course is clear.” Security video from a building in the area and data from the truck’s VECU and the train’s locomotive event recorder and forward-facing locomotive video were analyzed to evaluate the relative positions of the truck and the train. When the front of the truck reached the crossbuck sign, the train was about 312 feet from the crossing and traveling 49 mph. At this point, the truck was 25 feet from the nearest rail, traveling 13 mph, and vegetation completely obscured the train from the truck driver’s view. Figures 14 and 15 depict the relative positions of the truck and the train at this location and time. After passing the vegetation, the truck driver did not reduce his speed or stop to ensure that the railroad tracks were clear. About 1.6 seconds later, the front of the truck began to cross the nearest rail. The train struck the truck on the right side near the rear drive axles about 2.8 seconds later. The NTSB concludes that had the truck driver slowed and stopped his truck before traversing the crossing, he could have seen the train and the crash could have been prevented.

NTSB

Highway Accident Report

45

Figure 14. Crash scene diagram.

NTSB

Highway Accident Report

46

Figure 15. View from forward-facing locomotive video showing accident truck (at left of center) emerging from behind foliage. The following analysis discusses possible reasons why the driver did not stop at the crossing and potential countermeasures for improving highway–railroad grade crossing safety, in addition to describing unsafe conditions that were revealed as a result of the investigation. Specifically, the following safety issues are discussed in greater detail:  Distraction due to hands-free cell phone use.  FMCSA oversight of new entrant motor carriers.  Systems to prevent drivers with untreated OSA from being granted unrestricted medical certification.  Systems to address safety at private highway–railroad grade crossings.  Proximity of oxidizing and flammable or combustible materials in a train. NTSB investigators examined both the accident truck and the train and found no preexisting mechanical conditions related to the circumstances of the crash. The locomotive event recorder showed that the train crewmembers had maintained the train below track speed for several miles leading to the crossing and that they sounded the train horn as they approached the crossing, even though they were not required to do so. The security video showed that the

NTSB

Highway Accident Report

47 locomotive head lamp and ditch lights were illuminated. The truck driver held a current CDL, had several years of experience driving roll-off trucks, and was very familiar with his vehicle. Postcrash toxicology test results confirmed the driver’s self-report that he had used no drugs or alcohol prior to the crash. There was no precipitation at or near the time of the crash, and the road surface was dry. Investigators also examined the condition and loading of the rail cars in the train, with particular focus on the sodium chlorate hopper car that was destroyed in the postcrash explosion. The hopper car was not found to have any mechanical defects, and it was loaded within acceptable weight limits. The NTSB therefore concludes that none of the following were factors in the crash: (1) mechanical condition of the roll-off truck, (2) mechanical condition of the train, (3) driver experience or licensing, (4) alcohol or drug use, (5) weather, or (6) operation of the train through the grade crossing. Additionally, the NTSB concludes that neither the mechanical condition of the sodium chlorate hopper car nor its loading contributed to the release of sodium chlorate or to the explosion following the derailment. Emergency responders received timely and effective communications about the identity and location of all hazardous materials, which enabled them to establish an appropriate exclusion zone and to employ proper equipment to measure impacts to the community. The IC coordinated a thorough evaluation of the materials involved in the fire and explosion, and the resulting fire suppression activities were effective. The NTSB concludes that the emergency response and fire suppression activities were timely and effective. 2.2 Distraction 2.2.1 Overview Investigators considered whether the truck driver’s cell phone conversation as he approached the highway–railroad grade crossing contributed to his failure to slow his vehicle or to notice the approaching train. The driver reported that the radio in the truck was off because he was using his phone. Additionally, as evidenced by his statements and the surveillance video, the driver did not typically stop at the crossing. He claimed that it was difficult to see oncoming trains without pulling very close to the tracks and said that he relied on the train horn to alert him to an approaching train. 2.2.2 Audibility of Train Horn and Driver Expectancies For a train horn to be an effective warning device, a driver must be able to detect the sound, recognize it, and respond to it by taking the appropriate action. Audio data from the forward-facing video on the lead locomotive indicated that the train horn sounded three times as the train approached the crossing. Table 9 shows the times when the horn was sounded and the corresponding positions of the front of the locomotive and the truck from impact. The final horn sound commenced approximately 6 seconds prior to the collision, when the truck was approximately 72 feet from the crossing. Postcrash tests showed that the train horn met regulatory standards for loudness. The results of a postcrash study on train horn audibility at the

NTSB

Highway Accident Report

48 grade crossing using exemplar vehicles found that under a variety of conditions, an in-cab observer heard the horn before the train reached the crossing. Table 9. Train horn soundings and relative positions of train locomotive and truck from impact. Time Event Locomotive Distance to Impact (ft) Truck Distance to Impact (ft) 1:59:10.13 First horn sounding begins 1267.6 Not availablea 1:59:13.40 First horn sounding ends 1032.6 287.4 1:59:15.13 Second horn sounding begins 913.0 243.8 1:59:19.13 Second horn sounding ends 628.1 159.9 1:59:21.73 Third horn sounding begins 441.3 99.2 1:59:27.87

Impact

-- a The truck VECU began recording approximately 2 seconds after the first horn sounding; therefore, truck location estimates are not available prior to that time. Despite evidence that the train horn was sounding and should have been audible from within the truck cab as the truck approached the crossing, the driver indicated that he did not hear the horn until just prior to the collision. In addition to considering whether the driver’s cell phone use distracted him from attending to train horn sounds, investigators considered whether his hearing impairment or his expectancies about the presence of trains at the crossing may have influenced his ability to detect the horn sound. The driver told investigators that he had “high tone deafening” in his left ear, which was diagnosed while he was an employee with the BCFD. He did not report any hearing problems with his right ear, nor did medical records or DOT fitness exam reports indicate any level of hearing loss. Furthermore, high frequency hearing loss is unlikely to affect the ability to hear a train horn because the horn chimes are not in the high frequency range. Because the driver reported regularly hearing train horns near the crossing, it is unlikely that any hearing impairment contributed to his not hearing the train horn at the time of the crash. With respect to driver expectancy, research has shown that the probability of train horn detection is influenced by whether a motorist expects to encounter a train. Specifically, drivers who think that there is a high probability of a train at a crossing are more likely to detect the sound of a train horn (Rapoza 1999). In this case, it is unclear whether the truck driver’s experiences at the crossing would have led him to expect a train. Although the driver claimed that he heard trains approaching the crossing on many occasions, he also reported that he typically did not stop at the crossing unless he heard a train horn. Thus, it is not possible to determine whether the driver anticipated a train at the crossing at the time of the crash, or whether expectancies affected his attentiveness to the train horn sound.

NTSB

Highway Accident Report

49 2.2.3 Hands-Free Portable Electronic Devices With respect to distraction, the driver did not report any distractions inside or outside of the vehicle as he approached the crossing, but he did report that he was engaged in a cell phone conversation. He answered a voice call approximately 18 seconds prior to the crash and 1 second before the first train horn sounded, and he said that he used a hands-free headset. The person who initiated the call was interviewed by NTSB investigators and acknowledged being on the phone with the driver for a short time before the call abruptly ended. Studies conducted in simulators and in instrumented vehicles have shown that cell phone conversations, including hands-free conversations, can significantly increase cognitive distraction (Strayer and others 2013) and driver reaction time to auditory warnings (Mohebbi and Gray 2009). Therefore, the NTSB concludes that the truck driver was distracted by his hands-free cell phone conversation. Neither Maryland law nor federal regulations prohibited the truck driver from using a hands-free cell phone while driving. The driver, who was also the owner of the company, stated that there was no written company policy on cell phone use and driving, but that he verbally counseled his employees to use hands-free devices when operating company vehicles. Both the driver’s candor in telling investigators about his cell phone use at the time of the crash and the fact that he counseled his drivers to use hands-free devices while driving suggest that he was not aware of the risks of cognitive distraction posed by hands-free cell phone use. Driver distraction is increasingly recognized as a serious safety issue. Eliminating distraction in transportation is currently an issue area on the NTSB Most Wanted List. The National Highway Traffic Safety Administration (NHTSA 2014) reports that 3,328 people were killed in crashes involving distracted drivers in 2012; of those, 378 died in crashes in which the use of a cell phone was cited as a distraction. Because of the challenges inherent in determining the role of cell phone use in crashes, these numbers likely underestimate the true scope of the problem. The NTSB has used the term portable electronic device (PED) to refer to cell phones and other devices, such as music players or navigational systems, that are not integrated into the vehicle. Research has shown that both the visual–manual distraction of manipulating PEDs (Hickman and others 2010) and the cognitive distraction of using hand-free PEDs (Strayer and others 2013) significantly impair driver performance. Although using a hands-free device to operate a PED may mitigate, to some degree, the visual–motor distractions associated with certain subtasks, such as keying in a phone number, it does not mitigate the cognitive distraction associated with being involved in a conversation while driving.

NTSB

Highway Accident Report

50 2.2.4 Previous Safety Recommendations Following the investigation of a fatal truck-tractor combination vehicle crossover accident in Munfordville, Kentucky, on March 26, 2010—which was caused by a truck driver’s distraction from cell phone use—the NTSB (2011b) recommended that the FMCSA Prohibit the use of both handheld and hands-free cellular telephones by all commercial driver’s license holders while operating a commercial vehicle, except in emergencies. (H-11-26) In December 2011, the FMCSA and the Pipeline and Hazardous Materials Safety Administration (PHMSA) published a final joint rule, at 49 CFR 392.82,63 specifically prohibiting interstate truck and bus drivers from using hand-held cell phones while operating their vehicles; however, the rule did not prohibit hands-free use of PEDs. By contrast, since 2008, all railroad employees engaged in the movement of a train have been banned from using all PEDs.64 In May 2013, because the FMCSA had not satisfied the full intent of Safety Recommendation H-11-26, the NTSB reclassified the recommendation “Closed—Unacceptable Action.” The NTSB has also called on the states to address distraction due to the use of PEDs while driving. Following the investigation of a fatal multivehicle collision in Gray Summit, Missouri, on August 5, 2010, the NTSB (2011a) made recommendations to all 50 states and the District of Columbia to (1) Ban the nonemergency use of portable electronic devices (other than those designed to support the driving task) for all drivers; (2) use the National Highway Traffic Safety Administration model of high visibility enforcement to support these bans; and (3) implement targeted communication campaigns to inform motorists of the new law and enforcement, and to warn them of the dangers associated with the nonemergency use of portable electronic devices while driving. (H-11-39) 2.2.5 Survey Data and Safety Recommendations According to the Insurance Institute for Highway Safety, which tracks state driver safety laws, as of June 2014, 44 states and Washington, DC, ban text messaging for all drivers; 13 states and Washington, DC, ban hand-held cell phone use while driving for all drivers; and 37 states and Washington, DC, ban all cell phone use by novice drivers. To date, no state has banned all PED use by all drivers. A recent national survey found that most drivers believe that talking on cell phones while driving is a somewhat (30.9 percent) or very (57.7 percent) serious threat to their personal safety; however, the same survey found that about two-thirds of all

63 See 76 FR 75470, December 2, 2011. 64 The only exception is for the use of devices provided by the railroad for an authorized business purpose, after a safety briefing, provided that all assigned personnel on the crew agree that it is safe to do so. See 73 FR 58702, October 7, 2008.

NTSB

Highway Accident Report

51 drivers (67.2 percent) report having talked on a cell phone while driving within the past 30 days, and over one-fourth (27.9 percent) report talking on their cell phone while driving fairly often or regularly (AAA Foundation for Traffic Safety 2014). Surveys also show that drivers feel differently about hand-held and hands-free cell phone use. In the AAA Foundation survey, nearly twice as many respondents (61.8 percent) thought that it was acceptable for drivers to use hands-free cell phones while driving compared to using hand-held cell phones (31.0 percent). Additionally, in a NHTSA-sponsored survey of over 6,000 respondents, 41 percent reported that they would feel safe as a passenger in a vehicle in which the driver was talking on a cell phone with a hands-free device, compared to only 10 percent who would feel safe if the driver was talking on a hand-held cell phone (Schroeder and others 2013). The NTSB continues to maintain that distraction from the use of hands-free PEDs while driving poses an unnecessary safety risk. Current laws that ban hand-held but not hands-free PED use can foster an environment in which drivers erroneously believe that the use of hands-free PEDs is as safe as not using PEDs at all. The circumstances of the Rosedale highway–railroad grade crossing collision demonstrate that distractions from hands-free conversations can lead to catastrophic results. Therefore, the NTSB recommends that the FMCSA modify 49 CFR 392.82 to prohibit any use of a hands-free PED by a CDL holder while the driver is operating a commercial vehicle, except in emergencies. Additionally, the NTSB reiterates Safety Recommendation H-11-39 to the states. 2.3 FMCSA Oversight 2.3.1 Alban Waste as New Entrant Alban Waste conducted interstate and intrastate operations. At the time of the crash, the company had been in business for approximately 2 years and was classified as a new entrant. The carrier had not been visited by the FMCSA but had undergone a Maryland State Police safety audit and roadside inspections that revealed numerous safety deficiencies. Additionally, during the 2 months prior to the crash, the carrier had exceeded the alert threshold for the unsafe driving BASIC. In the postcrash CR, the FMCSA found that Alban Waste was noncompliant with several FMCSRs, which resulted in an “unsatisfactory” safety rating. The areas of noncompliance concerned the carrier’s (1) drug and alcohol program, (2) documentation of driver qualifications, (3) HOS, and (4) maintenance program. Based on the CR, it was clear that the carrier had never been in compliance in several of the areas addressed. Therefore, the NTSB concludes that Alban Waste demonstrated a consistent and serious pattern of noncompliance with the FMCSRs from the time that it registered as a carrier until the crash. Several of the violations documented in the CR had previously been documented during the safety audit or during roadside inspections. On multiple occasions, the FMCSA made written contact with the carrier based on its failed safety audit, its high OOS rate, and other issues. Table 10 displays a timeline of events since Alban Waste was established in February 2011. The table shows that the FMCSA repeatedly documented deficiencies, and the carrier repeatedly completed the necessary paperwork to remain in operation. However, in spite of its written

NTSB

Highway Accident Report

52 commitments, the carrier did not make the necessary changes to improve safety and comply with regulations—nor did the FMCSA verify the carrier’s progress in doing such. The NTSB concludes that the FMCSA was aware of problems with Alban Waste since November 2011 but did not take adequate steps to ensure that the carrier complied with the FMCSRs or, failing that, to prevent its operation. Table 10. Alban Waste critical events, February 11, 2011–September 13, 2013. Date Action February 11, 2011 Receives USDOT number April 1 Enters new entrant program November 21 Fails safety audit February 1, 2012 Submits CAP February 3 FMCSA rejects CAP; places carrier out of service February 3 Crash with injuries March 23 FMCSA restores carrier operating authority March 26 FMCSA accepts new CAP, places carrier back in new entrant program June 8 FMCSA issues expedited action letter July 11 FMCSA accepts CAP for expedited action May 28, 2013 Crash occurs May 30 FMCSA issues second expedited action letter June 4 FMCSA begins CR July 11 FMCSA accepts CAP for second expedited action July 15 FMCSA completes CR, deems carrier unsatisfactory September 13 FMCSA declares carrier out of service/unfit Alban Waste was classified as a “new entrant” for over 31 months, which is almost double the normal 18-month probationary period. Ostensibly, carriers are closely monitored and under heightened scrutiny during this period. In the case of Alban Waste, though the new entrant safety audit detected problems, those problems were never remediated—which suggests deficiencies in the new entrant program. 2.3.2 Previous Safety Recommendations In its investigation of the fatal motorcoach/tractor-semitrailer collision near Loraine, Texas, on June 9, 2002, the NTSB (2003) focused on the oversight of new entrants. In this case, a motor carrier had operated for 22 months without following numerous FMCSRs but had experienced no oversight other than roadside inspections. The NTSB concluded that the FMCSA’s new entrant safety assurance process lacked meaningful safeguards to ensure that a carrier is aware of, understands, and has a safety management system in place to comply with the FMCSRs. The NTSB recommended that the FMCSA

NTSB

Highway Accident Report

53 Require all new motor carriers seeking operating authority to demonstrate their safety fitness prior to obtaining new entrant operating authority by, at a minimum: (1) passing an examination demonstrating their knowledge of the Federal Motor Carrier Safety Regulations; (2) submitting a comprehensive plan documenting that the motor carrier has management systems in place to ensure compliance with the Federal Motor Carrier Safety Regulations; and (3) passing a Federal Motor Carrier Safety Administration safety audit, including vehicle inspections. (H-03-2) In June 2003, the FMCSA concurred that it was “reasonable to expect a new motor carrier to plan its operations and record keeping systems to assure compliance with the FMCSRs.” However, the agency argued that meaningful reviews could only be undertaken after a carrier begins operations, and it pointed to the new entrant safety audit as the time when this review would occur. In August 2008, the FMCSA began applying an evasion detection algorithm screening process to identify corporate information associated with passenger carriers with histories of poor safety performance before granting them operating authority. On the basis of these FMCSA actions, and a commitment by the agency to make further progress, Safety Recommendation H-03-2 was classified “Open—Acceptable Response.” The NTSB noted, however, that the FMCSA had not yet fully addressed the recommendation, particularly with respect to element (1). In its investigation of the motorcoach roadway departure and overturn near Doswell, Virginia, on May 31, 2011, the NTSB (2012) found that the motorcoach operator did not undergo a safety audit until it had been in business for nearly 2 years. Although the carrier had no effective safety programs in place and had safety deficiencies in three important areas, it passed the new entrant audit and the FMCSA confirmed its operating authority. As a result of the Doswell investigation, the NTSB reiterated Safety Recommendation H-03-2 and also recommended that the FMCSA As a component of your new entrant safety audits, review with each new entrant motor carrier a structured process, such as the Safety Management Cycle, to (1) identify the root cause of safety risks and (2) maintain an effective safety assurance program. (H-12-31) In response to Safety Recommendation H-12-31, the FMCSA responded that it had integrated the safety management cycle (SMC) into investigations for its CSA enforcement program.65 The FMCSA also reported that it had trained its investigators and Motor Carrier Safety Assistance Program (MCSAP) personnel on the SMC and had placed information about the SMC on its website.66 The NTSB responded that—though those efforts were encouraging—it was reclassifying Safety Recommendation H-12-31 “Open—Unacceptable Response” because the SMC had not yet been incorporated into new entrant safety audits.

65 The FMCSA describes the SMC as “a holistic systems view of the management processes and improvement practices a motor carrier may implement to achieve greater levels of compliance with FMCSA regulations.” 66 MCSAP is a grant system that provides financial assistance to states to enforce the FMCSRs through activities such as roadside inspections.

NTSB

Highway Accident Report

54 2.3.3 Revised New Entrant Safety Assurance Process The Moving Ahead for Progress in the 21st Century Act (MAP-21) was signed into law on July 6, 2012. Section 32101 requires the Secretary of Transportation to Establish through a rulemaking a written proficiency examination for applicant motor carriers pursuant to section 13902(a)(1)(D) of title 49, United States Code. The written proficiency examination shall test a person’s knowledge of applicable safety regulations, standards, and orders of the Federal government. (HR 4348-373) In response to the requirement, in December 2013, the FMCSA published a notice stating that it would conduct a listening session on January 13, 2014, to solicit ideas and information concerning MAP-21 Section 32101.67 The notice asked that session participants consider and be ready to respond to several questions concerning potential written proficiency examinations, including the following:  Should the exam be limited to the applicable FMCSA regulations or include both the regulations and industry best practices?  If the exam covers industry best practices, what specific best practices should be included?  What industry best practices manuals/publications are available for new entrants to study prior to taking a proficiency exam?  Are private-sector training courses available to teach new entrants industry best practices?  Should the FMCSA limit the exam to company officers or employees responsible for safety and compliance, or should the agency allow safety consultants to complete the exam on behalf of the new entrant? The FMCSA held two additional listening sessions, on March 28 and April 7, 2014. Transcripts from the sessions were posted in a public docket in June 2014 (FMCSA-2013-0518). According to the docket summary, the FMCSA is considering whether to implement a proficiency examination as part of its revised new entrant safety assurance process. 2.3.4 Safety Recommendations The NTSB concludes that stronger oversight of new entrants is needed to ensure that carriers address safety deficiencies in a timely fashion and are swiftly placed out of service if they fail to improve. The NTSB, therefore, recommends that the FMCSA require a full CR of new entrants that fail their safety audits, fail their corrective action plans, or are issued expedited action letters. We further recommend that the FMCSA establish criteria for revoking the

67 See 78 FR 248, December 26, 2013, 78474.

NTSB

Highway Accident Report

55 certification of any new entrant that demonstrates a pattern of safety deficiencies. The NTSB also reiterates Safety Recommendations H-03-2 and H-12-31. 2.4 Obstructive Sleep Apnea 2.4.1 Accident Truck Driver In 2007, the truck driver was diagnosed with severe OSA, a sleep disorder that has been associated with a significantly increased motor vehicle crash risk compared to the general driving population (Tregear and others 2009). The driver was prescribed CPAP therapy; however, he did not fill the prescription or begin treatment, nor did he ever note the diagnosis on subsequent DOT commercial driver fitness exam forms. When questioned by NTSB investigators, the driver claimed that he lost weight following his 2007 diagnosis and was no longer experiencing symptoms. However, records of his weight recorded on 11 occasions between 2007 and 2013 showed that his BMI never dropped below 35.68 In addition, his medical records from 2010 and 2012 indicate that he continued to experience fatigue. The driver’s BMI at the time of the crash (38.4) and his self-report of snoring and daytime fatigue are all strong risk factors for OSA (Hartenbaum and others 2006). According to 49 CFR 391.41(b)(5), “A person is physically qualified to drive a commercial motor vehicle if that person—has no established medical history or clinical diagnosis of a respiratory dysfunction likely to interfere with his/her ability to control and drive a commercial motor vehicle safely.” In the case of the accident truck driver, the same personal physician who diagnosed his severe OSA in February 2007 certified him as medically qualified 9 months later, with no mention of OSA on the DOT fitness exam forms. In February 2010, on the same day that the personal physician again certified the driver as qualified, records show that the driver complained of fatigue. Although the physician wrote a referral for another sleep study in May 2010, the driver did not obtain the test. The NTSB concludes that the truck driver had severe, untreated OSA that likely affected his alertness, but he did not disclose this diagnosis on the DOT fitness exam forms and continued to operate as a CMV driver; moreover, though his personal physician was aware of his severe OSA, on two occasions he medically certified the driver. During the postcrash CR, the FMCSA cited the driver for making a false entry on his medical examiner’s certificate; however, no action was taken to disqualify his medical certification or to require that he provide evidence of treatment for OSA.

68 BMIs at or above this level are strongly associated with OSA (Islam and others 2010).

NTSB

Highway Accident Report

56 2.4.2 Previous Safety Recommendations The NTSB has investigated a number of accidents involving operators with sleep disorders in all modes of passenger transportation. In an October 2009 safety recommendation letter to the FMCSA—based on investigation of the July 26, 2000, work zone collision between a tractor-semitrailer and a law enforcement vehicle in Jackson, Tennessee (NTSB 2002), among other investigations—the NTSB (2009) made the following recommendations: Implement a program to identify commercial drivers at high risk for obstructive sleep apnea and require that those drivers provide evidence through the medical certification process of having been appropriately evaluated and, if treatment is needed, effectively treated for that disorder before being granted unrestricted medical certification. (H-09-15) Develop and disseminate guidance for commercial drivers, employers, and physicians regarding the identification and treatment of individuals at high risk of obstructive sleep apnea (OSA), emphasizing that drivers who have OSA that is effectively treated are routinely approved for continued medical certification. (H-09-16) Safety Recommendations H-09-15 and -16 are classified “Open—Acceptable Response.” 2.4.3 FMCSA Initiatives Over the past decade, the FMCSA has examined OSA issues in great detail. The agency convened a medical expert panel (MEP) on the topic of OSA in 2007, and the panel’s recommendation report was made public in January 2008 (FMCSA 2008). The FMCSA also solicited and received guidance from its Medical Review Board (MRB), an advisory body established by Congress in 2005.69 In 2010, the MRB recommended OSA screening for all drivers with BMIs over 30.70 In August 2011, the FMCSA tasked its Motor Carrier Safety Advisory Committee (MCSAC) and the MRB to jointly provide information the agency should consider in developing OSA regulatory guidance for motor carriers, CMV drivers, and medical examiners, and in determining whether drivers with this condition should be medically certified to operate CMVs in interstate commerce. MCSAC and the MRB submitted short-term recommendations to the FMCSA in December 2011 and long-term recommendations for regulatory action in February 2012. The recommendations included specific criteria for unconditional and

69 According to www.mrb.fmcsa.dot.gov/, “The MRB is composed of five of our Nation’s most distinguished and scholarly practicing physicians. These physicians were chosen from a field of many qualified candidates who possess a wide variety of expertise and experience. MRB members specialize in the areas most relevant to the bus and truck driver population. The MRB will provide information, advice, and recommendations to the Secretary of Transportation and the FMCSA Administrator on the development and implementation of science-based physical qualification standards.” 70 Summary of the FMCSA MRB Recommendations, updated June 17, 2010.

NTSB

Highway Accident Report

57 conditional certification of drivers with OSA.71 On April 20, 2012, the FMCSA published the MCSAC–MRB recommendations in a Request for Public Comment; however, the request was withdrawn a week later and was not republished.72 At present, though recommendations from the MEP and MRB reports are available to the public, it is not clear whether the FMCSA has accepted or endorsed those recommendations—or any recommendations from these advisory groups. On October 15, 2013, the president signed Public Law 113-45, which states that the “Secretary of Transportation may implement or enforce a requirement providing for the screening, testing, or treatment (including consideration of all possible treatment alternatives) of individuals operating commercial motor vehicles for sleep disorders only if the requirement is adopted pursuant to a rulemaking proceeding.”73 It further states that this requirement will “not apply to a requirement that was in force before September 1, 2013.” Thus, the FMCSA could clarify existing guidance regarding the certification of commercial drivers with a diagnosis of OSA. In April 2014, the FMCSA published guidance and advisory criteria concerning several disorders in its online Medical Examiner Handbook, including guidance for the certification or recertification of drivers with chronic sleep disorders.74 Although the guidance does not provide any information about screening commercial drivers for OSA, it does provide specific examples of when drivers with sleep disorders should not be certified (if the driver has narcolepsy or untreated symptomatic OSA) and of when a 1-year certification is recommended (if successful nonsurgical therapy with resolution of apneas is confirmed by a repeated sleep study during treatment). In the Rosedale crash, it is not clear whether the truck driver’s personal physician was aware of the risks of OSA or his responsibility to restrict or withhold the driver’s medical certification pending successful resolution of the disease. Although the current Medical Examiner Handbook does not fully address all the elements of NTSB Safety Recommendations H-09-15 and -16, it represents a step forward in providing some guidance on OSA and other sleep disorders. The NTSB encourages the FMCSA to continue its efforts to provide guidance concerning OSA not only to physicians, but also to drivers and their employers. The NTSB also encourages the FMCSA to implement the recommended program to screen and fully evaluate commercial drivers at high risk for OSA, even if such a program must be established through a rulemaking proceeding. Pending completion of these actions, Safety Recommendations H-09-15 and -16 remain classified “Open—Acceptable Response.”

71 See www.mrb.fmcsa.dot.gov/documents/Meetings2012/Task11-05FinalCoverLetterandReport_2-21-12.docx, accessed April 22, 2014. 72 See 77 FR 23794, April 20, 2012; and 77 FR 25226, April 27, 2012. 73 See www.gpo.gov/fdsys/pkg/PLAW-113publ45/html/PLAW-113publ45.htm, accessed March 24, 2014. 74 See nrcme.fmcsa.dot.gov/mehandbook/respiratory4_dis_secondary_sleep_ep.aspx, accessed April 22, 2014.

NTSB

Highway Accident Report

58 2.4.4 Safety Recommendations The circumstances of this crash, in which the driver was not medically disqualified even after the FMCSA cited him for making a false entry on his medical examiner’s certificate, suggest that—in addition to providing guidance to drivers, employers, and physicians concerning OSA—the FMCSA should also create a policy for reporting medically related violations to states or others with the authority to disqualify or restrict medical certification. Therefore, the NTSB recommends that the FMCSA develop a system whereby the authority responsible for issuing commercial driver medical certification will be notified when FMCSA investigators discover violations that could result in a driver’s medical disqualification. 2.5 Safety Systems at Private Grade Crossings 2.5.1 Accident Grade Crossing When NTSB investigators asked the truck driver why he did not stop in advance of the grade crossing, he said that he did not like stopping at the crossing because he “had to stop nearly on the tracks to be able to see.” The results of postcrash measurements with a three-dimensional scanner and tests with an exemplar truck showed that when the front of the truck was positioned facing northwest on the private road 15 feet from the nearest rail, a driver looking to the right could have seen only about 230 feet down the tracks due to the roadway curvature and vegetation. The available sight distance was well below the 1,205 feet of clearing sight distance indicated by AASHTO (2011) and the FHWA (2007) for a 73.5-foot-long truck-tractor semitrailer at a level 90 degree one-track crossing.75 Investigators estimated that the driver would have had to position the front of the truck approximately 7–8 feet from the nearest rail to be able to see 1,000 feet or more down the tracks.76 The analysis also showed that the sharp horizontal roadway curve near the crossing, along with the skewed (83–86 degree) crossing angle, further reduced the sight distance triangle—which was already negatively affected by vegetation growth. The NTSB concludes that the vegetation and sharp horizontal curve near the highway–railroad grade crossing limited the truck driver’s ability to see oncoming trains on the approach to the crossing. In the months following the crash, NTSB investigators also evaluated the safety of four highway–railroad grade crossings nearby—three private and one public. They found that each of the private crossings had visibility obstructions that were equivalent to or worse than those at the accident crossing. On June 12, 2013, NTSB investigators requested that CSXT cut back vegetation at the accident crossing to improve sight lines and also work with MDSHA to perform an engineering analysis to determine if upgraded warning devices were needed. CSXT responded by trimming the vegetation approximately 27.5 feet from the nearest rail and installing a YIELD sign at the

75 The AASHTO guide does not apply to private grade crossings. It is used in this report for comparative purposes. 76 The prescribed distance for the train’s dynamic envelope (danger zone) is 6 feet from the rail.

NTSB

Highway Accident Report

59 northwest approach to the crossing, but stated that it expected MDSHA to take the lead in the diagnostic process to determine if additional improvements were needed. Although it appears that Maryland state laws give MDSHA the authority to evaluate and modify private grade crossings, the agency refused, citing liability concerns and a prohibition in 23 USC Section 130 against using federal funds for improvements at private crossings.77 2.5.2 Public–Private Design and Maintenance Responsibilities The inadequate sight distances at the private highway–railroad grade crossings observed during this investigation, as well as the lack of a comprehensive response from multiple parties to address the safety deficiencies at the accident crossing, reflect a larger problem affecting safety at private grade crossings. The design and maintenance of such crossings are typically governed by agreements between private landowners and the railroads. As noted in section 1.8, neither CSXT nor the state of Maryland accepted responsibility for the clearance of vegetation or the posting of signage at the crossing. Despite the seriousness of this crash, this issue was not resolved, and another collision occurred at the same crossing on August 5, 2014. Examination of the crossing and the surrounding area on that day indicated that visibility was still limited. On August 11, 2014, CSXT stated: Regardless of fault, train accidents endanger the traveling public, CSXT’s employees, neighbors, and the environment. Because CSXT is committed to minimizing such risks, CSXT is actively investigating additional safety measures that it can take at the accident crossing. This week, CSXT is working on removing all of the trees, shrubbery, and fencing on its property near the crossing. This will improve visibility both at the crossing and along the road approaching the crossing, increasing opportunities for drivers to have notice of approaching trains. After the foliage and fencing are gone, CSXT will re-evaluate visibility at the crossing and assess possible additional measures. On August 25, 2014, an NTSB investigator documented the area surrounding the accident grade crossing and observed that substantial clearing of trees and other foliage had taken place at all four quadrants of the crossing. In addition, STOP signs and signs that read “PRIVATE CROSSING—LOOK” had been installed at both approaches to the crossing. The NTSB is encouraged by CSXT actions to improve visibility and safety at the accident grade crossing. However, at present, there are no systematic efforts to identify hazardous grade crossings, and few state laws give state agencies the authority to evaluate

77 The railway–highway crossings program provides for up to $220 million in funds annually from the Highway Safety Improvement Program to be used to fund safety improvements to reduce fatalities, injuries, and crashes at public grade crossings (23 USC Section 130). In accordance with the law, each state must conduct and systematically maintain a survey of all highways to identify those railroad crossings that may require safety improvements and implement a schedule of projects for this purpose. Fifty percent of a state’s apportionment is dedicated to the installation of protective devices at public crossings. The remainder of the funds can be used for any hazard elimination project. If a state satisfactorily demonstrates that it has met all its needs for installation of protective devices at railway–highway crossings, the funds can be used for other highway safety improvement purposes (23 USC 130(e)). See www.fhwa.dot.gov/map21/factsheets/rhc.cfm, accessed June 16, 2014.

NTSB

Highway Accident Report

60 private crossings and to require that they be safe. Although private grade crossings used solely by private landowners may not present a significant hazard, many such crossings are accessible to the public and—because public roads can flow seamlessly into private roads—give the appearance of being public roads. Furthermore, as demonstrated in this crash, the damage caused by collisions at private highway–railroad grade crossings can extend beyond the borders of the private land and threaten the safety of neighboring communities. The NTSB concludes that there was a lack of clear delineation of oversight responsibility for the design, maintenance, vegetation clearance, and implementation of safety systems at the accident grade crossing. 2.5.3 Previous Safety Recommendations The NTSB has a long history of calling for safety improvements at private grade crossings. For example, in its safety study on passive grade crossings, which was based on the investigation of 60 highway–railroad grade crossing crashes, the NTSB (1998) addressed a broad range of safety issues, including the relationship between inadequate sight distances and crashes, and the need to establish clear responsibility for the safety of private crossings.78 As a result of the study, the NTSB recommended that the DOT, in conjunction with the states Determine within 2 years governmental oversight responsibility for safety at private highway–rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. (H-98-32) This recommendation was classified “Open—Acceptable Response” in 2004 based on DOT commitments, including an FRA plan to conduct an inquiry on issues associated with private crossings. In 2003, Safety Recommendation H-98-35, a companion recommendation made to the states, was reclassified “Closed—Unacceptable Action” based on the overall response of the states; however, for seven states the recommendation was classified “Closed—Acceptable Action.”79 Less than a year after completion of the safety study on passive grade crossings, the NTSB (1999) concluded that the probable cause of the June 18, 1998, collision involving a passenger train and a long combination vehicle in Portage, Indiana, was ineffective action by federal, state, and private agencies to eliminate safety problems at the accident grade crossing. As a result of this investigation, the NTSB recommended that the DOT

78 The other issues addressed in the study were (a) the adequacy of warning systems at passive crossings; (b) roadway and track conditions that affect a driver’s ability to detect an oncoming train; (c) behavioral factors that affect a driver’s ability to detect an oncoming train; (d) the adequacy of existing driver education material regarding safety at passive grade crossings; and (e) the need for a systematic and uniform approach to passive grade crossing safety. 79 These seven states were Alaska, Hawaii, Minnesota, New Hampshire, New Jersey, North Dakota, and Rhode Island. The Maryland recommendation was classified “Closed—Reconsidered” in February 1999, based on the state’s claim that it already had jurisdiction over private crossings.

NTSB

Highway Accident Report

61 Eliminate any differentiations between private and public highway–rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements. (I-99-2) 2.5.4 DOT Oversight 2.5.4.1 Private Grade Crossings. In a December 23, 1998, letter to the NTSB, with respect to clarifying oversight responsibility for safety at private crossings, the DOT stated, “The Department recognizes this as a necessary step for improving overall crossing safety.” However, in the following years, the DOT was not successful in addressing private grade crossing safety. For example, in 1999, the FHWA proposed adding language to the MUTCD to define private highway–railroad grade crossings and issuing standards for traffic control devices at those crossings.80 In response to that proposal, the NTSB classified Safety Recommendation I-99-2 “Open—Acceptable Response.” However, the agency ultimately did not make those changes, citing objections from the railroad industry and from states concerning economic impacts and jurisdiction over private roads.81 Also, in 1997, the DOT included in its National Economic Crossroads Transportation Efficiency Act reauthorization package a proposal to allow the use of federal (Section 130) safety funds for improvements to private crossings that serve the public need;82 however, Congress did not include the provision in the 1998 Transportation Equity Act for the 21st Century. In 2006, the FRA (2010) commenced a safety inquiry into private crossings, concluding that, among 34 findings:  The data currently stored in the Grade Crossing Inventory for private crossings are generally not current and not suited for most analyses, and were historically not intended to support effective resource allocation.  Absence of a cohesive policy or regulatory structure has led to the existence of private crossings that are redundant, inadequately designed, and/or poorly maintained.  Motorists represent only a portion of the populations at risk because of incidents at private crossings. The risks of collision and of derailment mean that the train crews, train passengers, and others in the vicinity of the crossing may be exposed to derailing equipment or hazardous materials releases.  Because crossing signage is inconsistent and can vary greatly depending on [the] crossing, it is evident that a minimum standard is necessary.

80 See 64 FR 244, December 21, 1999, or docket FHWA-1999-6298. 81 The FHWA added a definition for “private road open to public travel” to the MUTCD in 2009; however, the new definition exempts private highway–railroad grade crossings. See mutcd.fhwa.dot.gov/pdfs/2009/pdf, part 3, Markings, 347, accessed August 15, 2014. 82 See www.epw.senate.gov/105th/dot_5-07.htm, accessed February 25, 2014.

NTSB

Highway Accident Report

62  Population increases, changes in land use, and both recent and projected growth in rail and highway traffic suggest that exposure to incident risk at private crossings is likely to continue increasing. Accordingly, the number of opportunities for incidents, and therefore for casualties, will also increase unless new initiatives for improving private crossing safety are not [sic] identified and effectively implemented. The NTSB concludes that the DOT’s efforts to improve government oversight of private highway–railroad grade crossings over the past two decades have largely been unsuccessful. Therefore, the NTSB reclassifies Safety Recommendations H-98-32 and I-99-2 “Closed— Unacceptable Action.” The NTSB concludes that because private highway–railroad grade crossings continue to pose a risk to the safety and health of motorists, train crews, and train passengers—as well as to surrounding communities—actions are needed to identify high-risk private highway–railroad grade crossings and to implement safety improvements at the local level. 2.5.4.2 Grade Crossing Inventory. Despite its lack of currency, the grade crossing inventory represents the best available source of information about the nation’s private highway–railroad grade crossings and a potential means of identifying high-risk crossings. The states currently use grade crossing inventory data to identify high-risk public crossings using tools such as the FRA WBAPS, as described in section 1.8.4. Additionally, a new tool—the rail crossing locator smartphone mobile application—can be used to locate crossings and to report safety concerns to the FRA.83 During the early stages of this investigation, there was confusion about the DOT number for the accident crossing and whether the crossing was considered public or private. It was eventually determined that the emergency notification sign at the crossing was incorrect and that there were corresponding errors in the grade crossing inventory database. Although some of the errors were corrected in the weeks after the crash, other errors remained in the database for more than 6 months. Such errors are consistent with the 2010 FRA finding that data in the grade crossing inventory are not current. In response to a RSIA directive to update the grade crossing inventory, the FRA published a notice of proposed rulemaking (NPRM), “National Highway–Rail Crossing Inventory Reporting Requirements,” in October 2012.84,85 According to the NPRM, the crossing inventory is intended to provide a uniform database that can be merged with highway–railroad crossing collision files to analyze information for improvement programs by public and private agencies, as well as the railroad industry and academia. The NPRM proposed to require railroads to submit information about all new public and previously unreported private highway–railroad crossings and pathway crossings and to periodically update the data. A DOT (2013) Office of

83 See www.fra.dot.gov/eLib/details/L04641, accessed April 22, 2014. 84 Through RSIA, Congress called on railroads to ensure that the Secretary of Transportation receives information about each previously unreported crossing and to periodically report “current information, including information about warning devices and signage, as specified by the Secretary, concerning each crossing through which it operates or with respect to the trackage over which it operates.” 85 See 77 FR 64077, October 18, 2012.

NTSB

Highway Accident Report

63 Inspector General report noted that the FRA has missed several statutory deadlines for rules called for in RSIA, including those addressing the grade crossing inventory. 2.5.5 Safety Recommendations 2.5.5.1 Data Collection and Risk Assessment. Because inventory and crash data for private crossings are limited, and the potential exists for those data to improve as a result of the final rule, the NTSB recommends that the FRA require equivalent levels of reporting for both public and private highway–railroad grade crossings. The NTSB also recommends that the FRA develop an algorithm using grade crossing inventory and accident history data to provide annual crash prediction estimates for private highway–railroad grade crossings, similar to its WBAPS tool for public grade crossings, and make the results easily accessible to states, railroads, and the public. Crash prediction estimates based on grade crossing inventory data could serve as one important tool to identify high-risk private highway–railroad grade crossings. However, such systems rely heavily on previous crash data to predict future events. Additionally, WBAPS—the tool used by the FRA to estimate accident prediction values—does not incorporate several critical crossing characteristics, including sight distance, local topography, and hazardous materials traffic. Railroad personnel could supplement grade crossing inventory data by conducting first-hand observations at crossings to identify visual obstructions or other hazards. Similarly, railroads are aware of those routes on which they are most likely to carry hazardous materials. Because railroads regularly inspect the tracks and remove vegetation in their rights-of-way, they are in a unique position to identify and correct certain hazardous conditions. The NTSB, therefore, recommends that the Association of American Railroads and the American Short Line and Regional Railroad Association develop and disseminate to their members a model program for railroads to (1) evaluate the safety of private highway–railroad grade crossings in their territories, including identifying visibility obstructions and other factors that increase the risk of grade crossing collisions; and (2) work with landowners and communities to mitigate that risk. 2.5.5.2 Safety Improvement. Once high-risk private highway–railroad grade crossings are identified, corresponding safety improvement policies must be implemented. As described in section 1.8.8, 17 states require the removal of vegetation at or near highway–railroad grade crossings, and 23 states have laws addressing various aspects of private grade crossings. Vegetation removal laws typically specify a distance around the crossing that must remain clear or specify the parties that are responsible for maintenance of the surrounding area. With respect to laws addressing the safety of private crossings, there is considerable variability from state to state; however, several states require railroads to build or maintain private crossings in a safe condition. The state of Maryland has no laws that specifically address vegetation removal around highway–railroad grade crossings, but it does have laws on the safety of all public and private grade crossings. According to the Annotated Code of Maryland, Transportation Article, MDSHA has the authority to place STOP signs at crossings designated as dangerous (§21-702) and may also impose conditions to improve safety when crossing construction or modifications are

NTSB

Highway Accident Report

64 proposed (§8-639(b)). Maryland law also states that railroads must keep their roadbeds and the highway in proper repair so as to provide absolutely safe and easy approach to and crossing of the track. Further, MDSHA may abandon, relocate, construct, or reconstruct any railroad grade crossing or railroad grade separation that is dangerous or inconvenient for public travel (§8-640). The fact that MDSHA claimed that it does not have the authority to evaluate the accident crossing or to make changes suggests that these laws are not well understood or adhered to. In an audit of the FRA management of grade crossing safety, the DOT Office of Inspector General (2007) found 689 grade crossing collision reports involving documented sight obstructions and concluded that “FRA has no assurance that sight obstructions are addressed at passive grade crossings in most states.” The DOT called on the FRA to work with the FHWA to develop model legislation for states to improve safety by addressing sight obstructions at grade crossings that are equipped solely with signs, pavement markings, and other passive warnings. This recommendation was reflected in the language of Section 203 of RSIA, which required the FRA, as the Secretary of Transportation’s delegate, to work in consultation with the FHWA and the states to Develop and make available to States model legislation providing for improving safety by addressing sight obstructions, including vegetation growth, topographic features and standing railroad equipment, at highway–rail grade crossings that are equipped solely with passive warnings, as recommended by the DOT Inspector General in report no. MH-2007-044. In 2011, the FRA published a model law (the “Adequate Sight Distance at Passive Highway–Rail Grade Crossings Act”) to address sight obstructions at both public and private passive highway–railroad grade crossings. The model law, which is presented in appendix B of this report, includes a requirement for periodic evaluation of sight distance at passive grade crossings; actions to improve sight distance, including removal of obstructions or installation of traffic control devices; and penalties for private property owners who refuse to mitigate visual obstructions. The model law calls on the states to include private grade crossings in their efforts to remove or mitigate sight obstructions at passive highway–railroad grade crossings. However, in spite of the potential safety benefits and the FRA’s outreach, in the 3 years since publication of the model law, no states have adopted it. Therefore, the NTSB recommends that the 50 states, the District of Columbia, and the Commonwealth of Puerto Rico enact legislation adopting all elements of the FRA’s model law known as the “Adequate Sight Distance at Passive Highway-Rail Grade Crossings Act.” We also recommend that the state of Maryland work with CSXT and private landowners to conduct engineering studies of the accident grade crossing (140833J) and the three other private highway–railroad grade crossings (140831V, 140828M, and 140829U) evaluated in this investigation and take actions to improve their safety, such as removing visual obstructions, installing signage, and altering roadway geometry. The NTSB further recommends that CSXT assist the state of Maryland in taking actions identified by the state to improve the safety of the accident grade crossing (140833J) and the three other private highway–railroad grade crossings (140831V, 140828M, and 140829U) evaluated in this investigation. We also recommend that until the improvements cited in the previous recommendation are made, CSXT take action to reduce the risk of grade crossing accidents

NTSB

Highway Accident Report

65 through the corridor comprising highway–railroad grade crossings 140833J, 140831V, 140828M, and 140829U. 2.6 Oxidizing and Flammable or Combustible Materials 2.6.1 Overview Three of the derailed train cars—7, 8, and 15—contained the hazardous materials sodium chlorate, fluorosilicic acid, and sodium hydroxide solution, respectively. The potential risks associated with in-train placement of hazardous materials include the exposure of train crews to the catastrophic effects of a release and the commingling of incompatible chemicals in transport. Because the locomotives became decoupled from the train during the crash sequence and the crew quickly moved away from the derailment location, the crewmembers were not at risk of being injured by the postcrash fire and explosion. Additionally, the six empty flat cars and box cars that separated the hazardous materials from the occupied locomotive provided additional protection to the train crew. 2.6.2 Derailment, Fire, and Explosion 2.6.2.1 Sodium Chlorate and Terephthalic Acid. Photographs and inspection of the scene clearly indicated that the postcrash fire involved both the sodium chlorate hopper car and two of the four terephthalic acid hopper cars. A piece of torn aluminum shell found immediately west of the final resting place of the sodium chlorate hopper car suggested that the car body sustained a large breach that released a significant amount of sodium chlorate during the derailment. Sodium chlorate crystals are a strong oxidizer and require suitable combination with a combustible material to react and sustain a fire.86 The cars containing terephthalic acid also derailed and discharged some of their lading. Dust clouds of terephthalic acid—a combustible organic acid in finely divided granular form— are capable of forming hazardous explosive mixtures. There was a relative lack of other bulk combustible materials, except for the railroad ties that had been consumed in the area of the derailment and possibly the lubricants and dried grease on the trucks of the derailed cars. The NTSB concludes that the force of the derailment likely caused finely divided particles of sodium chlorate and terephthalic acid to combine and react, leading to the observed fire—which likely heated the sodium chlorate within the hopper car, resulting in the explosion. Likely ignition scenarios include an exothermic reaction between the sodium chlorate crystals and organic materials such as the terephthalic acid, rail ties, and lubricants—or sparks caused by the impact and frictional forces generated during the derailment sequence. Within minutes of the collision and fire, the sodium chlorate hopper car exploded. According to the manufacturer’s material safety data sheet, when sodium chlorate is heated above 265°C (510°F), it can violently decompose and cause an explosion.

86 An oxidizer on its own cannot combust.

NTSB

Highway Accident Report

66 2.6.2.2 In-Train Placement of Commodities. The circumstances of this crash did not involve the improper segregation of two incompatible hazardous materials, but rather rail car placement—involving a hazardous material and a nonregulated commodity.87 The sodium chlorate hopper car was separated from the terephthalic acid cars by a residue tank car of nonflammable fluorosilicic acid. However, because some of the cars derailed accordion-style, the sodium chlorate car came to rest near the block of terephthalic acid hopper cars. Based on the chemical hazards identified for sodium chlorate, a class 5.1 oxidizer, had it contacted any other nonregulated, dry bulk combustible commodity—such as wood pulp, paper, or plastic pellets—a similar postcrash fire could have occurred.

In a report to Congress concerning the safe placement of train cars, the FRA (2005) concluded, “Risk analysis regarding product combinations has not indicated any compelling need to alter existing requirements that provide for the separation of certain commodities to limit, insofar as is practical, undesirable interactions should the train derail. Accordingly, existing in-train placement requirements appear to provide for an appropriate level of safety.” Additionally, a review of incident report data contained in the DOT hazmat intelligence portal yielded no evidence to suggest that the placement of sodium chlorate hopper cars near nonregulated combustible materials poses a high risk.88 The review found that over the 23-year history of aluminum hopper cars transporting sodium chlorate, 18 serious accidents have occurred, none of which—apart from the Rosedale, Maryland, crash—involved an explosion. Nonetheless, the circumstances of this crash demonstrate the potential for oxidizers to produce violent explosions when heated by fire, or commingled with combustible or flammable materials. Hazardous materials regulations at 49 CFR 172.602 require supplemental emergency response information, including the risk of fire or explosion, to be provided on a shipping paper or other document. In this case, the sodium chlorate hazardous materials information was appended to the train consist and clearly described the associated risks of fire and explosion.89 However, because the explosion occurred within minutes of the derailment, emergency responders would not have had adequate time to review the train consist had that been their only available source of information.90

87 In accordance with the restrictions of 49 CFR 174.85, rail cars containing class 5 oxidizers may not be placed next to certain other hazardous materials, including division 1.1 and 1.2 explosives, class 2.3 poisonous gases and certain class 6.1 poisonous liquids, and class 7 radioactive materials. The placement of rail cars containing class 5 oxidizers next to class 3 flammable materials or nonregulated combustible materials, such as terephthalic acid, is not prohibited. 88 The hazmat intelligence portal is an information repository designed by PHMSA to facilitate the analysis and identification of hazardous materials safety trends. See hip.phmsa.dot.gov/EntryWeb/abouthip.html, accessed February 26, 2014. 89 Title 49 CFR 174.26 requires that a train crew have a train consist that reflects the current position in the train of each rail car containing a hazardous material. The train consist must be maintained on board the occupied locomotive of every train. 90 CSXT verbally communicated information about the hazardous materials to the emergency responders, with the exception of the MDTA police officer who had been injured earlier by the explosion.

NTSB

Highway Accident Report

67 2.6.3 Safety Recommendations The NTSB concludes that though accident statistics indicate that explosions involving bulk oxidizer shipments are rare events, the potential for death or serious injury is significant, and emergency responders should be reminded that derailments involving rail car fires can occasionally have such catastrophic outcomes. Therefore, the NTSB recommends that the National Fire Protection Association notify its members of the circumstances of the Rosedale, Maryland, crash and advise them of the potential sudden and catastrophic consequences when oxidizing materials are exposed to heat or to combustible or flammable materials.

NTSB

Highway Accident Report

68 3 Conclusions 3.1 Findings

1. None of the following were factors in the crash: (1) mechanical condition of the roll-off

truck, (2) mechanical condition of the train, (3) driver experience or licensing, (4) alcohol or drug use, (5) weather, or (6) operation of the train through the grade crossing.

1. Neither the mechanical condition of the sodium chlorate hopper car nor its loading

contributed to the release of sodium chlorate or to the explosion following the derailment.

1. The emergency response and fire suppression activities were timely and effective.
2. Had the truck driver slowed and stopped his truck before traversing the crossing, he could

have seen the train and the crash could have been prevented.

1. The truck driver was distracted by his hands-free cell phone conversation.
2. Alban Waste, LLC, demonstrated a consistent and serious pattern of noncompliance with

the Federal Motor Carrier Safety Regulations from the time that it registered as a carrier until the crash.

1. The Federal Motor Carrier Safety Administration was aware of problems with

Alban Waste, LLC, since November 2011 but did not take adequate steps to ensure that the carrier complied with the Federal Motor Carrier Safety Regulations or, failing that, to prevent its operation.

1. Stronger oversight of new entrants is needed to ensure that carriers address safety

deficiencies in a timely fashion and are swiftly placed out of service if they fail to improve.

1. The truck driver had severe, untreated obstructive sleep apnea that likely affected his

alertness, but he did not disclose this diagnosis on the US Department of Transportation fitness exam forms and continued to operate as a commercial motor vehicle driver; moreover, though his personal physician was aware of his severe obstructive sleep apnea, on two occasions he medically certified the driver.

1. The vegetation and sharp horizontal curve near the highway–railroad grade crossing

limited the truck driver’s ability to see oncoming trains on the approach to the crossing.

1. There was a lack of clear delineation of oversight responsibility for the design,

maintenance, vegetation clearance, and implementation of safety systems at the accident grade crossing.

NTSB

Highway Accident Report

69

1. The US Department of Transportation’s efforts to improve government oversight of

private highway–railroad grade crossings over the past two decades have largely been unsuccessful.

1. Because private highway–railroad grade crossings continue to pose a risk to the safety

and health of motorists, train crews, and train passengers—as well as to surrounding communities—actions are needed to identify high-risk private highway–railroad grade crossings and to implement safety improvements at the local level.

1. The force of the derailment likely caused finely divided particles of sodium chlorate and

terephthalic acid to combine and react, leading to the observed fire—which likely heated the sodium chlorate within the hopper car, resulting in the explosion.

1. Although accident statistics indicate that explosions involving bulk oxidizer shipments

are rare events, the potential for death or serious injury is significant, and emergency responders should be reminded that derailments involving rail car fires can occasionally have such catastrophic outcomes. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Rosedale, Maryland, crash was the truck driver’s failure to ensure that the tracks were clear before traversing the highway–railroad grade crossing. Contributing to the crash were (1) the truck driver’s distraction due to a hands-free cell phone conversation; (2) the limited sight distance due to vegetation and roadway curvature; and (3) the Federal Motor Carrier Safety Administration’s inadequate oversight of Alban Waste, LLC, which allowed the new entrant motor carrier to continue operations despite a serious and consistent pattern of safety deficiencies. Contributing to the severity of the damage was the postcrash fire and the resulting explosion of a rail car carrying sodium chlorate, an oxidizer.

NTSB

Highway Accident Report

70 4 Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations. 4.1 New Recommendations To the Federal Motor Carrier Safety Administration: Modify Title 49 Code of Federal Regulations 392.82 to prohibit any use of a hands-free portable electronic device by a commercial driver’s license holder while the driver is operating a commercial vehicle, except in emergencies. (H-14-26) Require a full compliance review of new entrants that fail their safety audits, fail their corrective action plans, or are issued expedited action letters. (H-14-27) Establish criteria for revoking the certification of any new entrant that demonstrates a pattern of safety deficiencies. (H-14-28) Develop a system whereby the authority responsible for issuing commercial driver medical certification will be notified when Federal Motor Carrier Safety Administration investigators discover violations that could result in a driver’s medical disqualification. (H-14-29) To the Federal Railroad Administration: Require equivalent levels of reporting for both public and private highwayrailroad grade crossings. (R-14-48) Develop an algorithm using grade crossing inventory and accident history data to provide annual crash prediction estimates for private highway–railroad grade crossings, similar to your WBAPS tool for public grade crossings, and make the results easily accessible to states, railroads, and the public. (R-14-49) To the 50 states, the District of Columbia, and the Commonwealth of Puerto Rico: Enact legislation adopting all elements of the Federal Railroad Administration’s model law known as the “Adequate Sight Distance at Passive Highway–Rail Grade Crossings Act.” (R-14-50)

NTSB

Highway Accident Report

71 To the state of Maryland: Work with CSX Transportation Company and private landowners to conduct engineering studies of the accident grade crossing (140833J) and the three other private highway–railroad grade crossings (140831V, 140828M, and 140829U) evaluated in this investigation, and take actions to improve their safety, such as removing visual obstructions, installing signage, and altering roadway geometry. (R-14-51) To the Association of American Railroads and the American Short Line and Regional Railroad Association:

Develop and disseminate to your members a model program for railroads to (1) evaluate the safety of private highway–railroad grade crossings in their territories, including identifying visibility obstructions and other factors that increase the risk of grade crossing collisions; and (2) work with landowners and communities to mitigate that risk. (R-14-52) To the National Fire Protection Association: Notify your members of the circumstances of the Rosedale, Maryland, crash and advise them of the potential sudden and catastrophic consequences when oxidizing materials are exposed to heat or to combustible or flammable materials. (R-14-53) To CSX Transportation Company: Assist the state of Maryland in taking actions identified by the state to improve the safety of the accident grade crossing (140833J) and the three other private highway–railroad grade crossings (140831V, 140828M, and 140829U) evaluated in this investigation. (R-14-54) Until the improvements cited in Safety Recommendation R-14-54 are made, take action to reduce the risk of grade crossing accidents through the corridor comprising highway–railroad grade crossings 140833J, 140831V, 140828M, and 140829U. (R-14-55)

NTSB

Highway Accident Report

72 4.2 Previous Recommendations Reiterated in This Report The National Transportation Safety Board also reiterates the following safety recommendations: To the Federal Motor Carrier Safety Administration: Require all new motor carriers seeking operating authority to demonstrate their safety fitness prior to obtaining new entrant operating authority by, at a minimum: (1) passing an examination demonstrating their knowledge of the Federal Motor Carrier Safety Regulations; (2) submitting a comprehensive plan documenting that the motor carrier has management systems in place to ensure compliance with the Federal Motor Carrier Safety Regulations; and (3) passing a Federal Motor Carrier Safety Administration safety audit, including vehicle inspections. (H-03-2) As a component of your new entrant safety audits, review with each new entrant motor carrier a structured process, such as the Safety Management Cycle, to (1) identify the root cause of safety risks and (2) maintain an effective safety assurance program. (H-12-31) To the 50 states and the District of Columbia: (1) Ban the nonemergency use of portable electronic devices (other than those designed to support the driving task) for all drivers; (2) use the National Highway Traffic Safety Administration model of high visibility enforcement to support these bans; and (3) implement targeted communication campaigns to inform motorists of the new law and enforcement, and to warn them of the dangers associated with the nonemergency use of portable electronic devices while driving. (H-11-39) 4.3 Previous Recommendations Reclassified in This Report The National Transportation Safety Board reclassifies the following safety recommendations to the US Department of Transportation: Determine within 2 years governmental oversight responsibility for safety at private highway–rail grade crossings and ensure that traffic control on these crossings meets the standards within the Manual on Uniform Traffic Control Devices. (H-98-32) Eliminate any differentiations between private and public highway–rail grade crossings with regard to providing funding for, or requiring the implementation of, safety improvements. (I-99-2) Safety Recommendations H-98-32 and I-99-2 are reclassified “Closed—Unacceptable Action.”

NTSB

Highway Accident Report

73

BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Acting Chairman

Member

MARK R. ROSEKIND

Member

EARL F. WEENER

Member

Adopted: October 8, 2014

NTSB

Highway Accident Report

74 Appendix A: Investigation The National Transportation Safety Board was notified of this crash on May 28, 2013. An investigative team comprising staff from the Office of Board Member Robert L. Sumwalt; the Office of Highway Safety; the Office of Railroad, Pipeline and Hazardous Materials; the Office of Research and Engineering; and the Office of Communications was dispatched to the site. Groups were established to investigate human performance, motor carrier operations, vehicle recorders, highway factors, vehicle factors, survival factors, hazardous materials, and railroad operations. Member Sumwalt was the spokesperson on scene. Parties to the investigation were representatives from the Federal Motor Carrier Safety Administration; Federal Railroad Administration; Federal Highway Administration; Maryland State Police; Baltimore County Police; Baltimore County Fire Department; Maryland State Highway Administration; CSX Transportation Company; Brotherhood of Locomotive Engineers and Trainmen; International Association of Sheet Metal, Air, Rail and Transportation Workers; Mack Trucks, Inc.; and PROCOR Limited. No depositions were taken, and no public hearing was held.

NTSB

Highway Accident Report

75 Appendix B: Model State Law to Address Sight Obstructions at Passive Highway–Rail Grade Crossings ADEQUATE SIGHT DISTANCE AT PASSIVE HIGHWAY–RAIL GRADE CROSSINGS ACT Section 1. Section 1 would provide that the Act may be cited as the “Adequate Sight Distance at Passive Highway-Rail Grade Crossings Act”. Section 2. Section 2 would provide that the purpose of this Act would be to mandate that the highest official of the public authority that has responsibility to inspect highway-rail grade crossings (hereinafter referred to as the “head of the responsible public agency”) establish a Statewide program to improve sight distance at passive highway-rail grade crossings. Sight distance obstructions, such as vegetation, topographic features, structures and standing railroad equipment, have been shown to contribute to grade crossing collisions by reducing the road user’s ability to detect approaching trains and other railroad equipment. In the absence of train-activated warning devices, such as automatic gates and flashing lights, sight distances at highway-rail grade crossings play a critical role in the road user’s determination as to whether it will be safe to enter and travel through the crossing. Section 3. Section 3 consists of two broad proposals. The first would require the head of the responsible public agency to establish a program to improve sight distances at passive highway-rail grade crossings. The second proposal would establish a minimum and maximum stopping distance requirement for road users of passive highway-rail grade crossings. Under the first proposal addressing sight distances, the responsible public agency would conduct periodic evaluations of the clearing sight distance, corner sight distance, and stopping sight distance at passive highway-rail grade crossings and take corrective action where needed. Section 3 would also establish a minimum and maximum stopping distance requirement for road users at passive highway-rail grade crossings. If the Act is enacted, the responsible public agency charged with implementation of this sight-distance evaluation program should employ the sight distance analysis methods outlined in the publication entitled, “Guidance On Traffic Control Devices At Highway-Rail Grade Crossings,” and “Railroad-Highway Grade Crossing Handbook – Revised Second Edition (August 2007)” which have been published by the Federal Highway Administration (FHWA). In addition, personnel qualified in engineering and design should be deployed by the responsible public agency to perform the sight distance evaluations that are required herein. The responsible public agency should also consider including provision, in its sight-distance evaluation program, for unscheduled or “expedited” sight distance evaluations, in response to complaints regarding moveable objects (such as standing rail equipment) that may be obstructing the required clearing sight distance, corner sight distance, or stopping sight distance at individual passive highway-rail grade crossings.

NTSB

Highway Accident Report

76 Subsection (b) would address the requisite inspection authority that the responsible public agency would need to implement the sight-distance evaluation program described in subsection (a). At a minimum, officers, employees, and agents of the responsible public agency would need authority to enter private, as well as public, property for the purposes of determining the adequacy of the clearing sight distance, corner sight distance, and stopping sight distance at passive highway-rail grade crossings and evaluating sight distance obstructions caused, in whole or in part, by structures, topography, standing railroad equipment, trees, and other vegetation located within close proximity to those crossings. Subsection (c) would require the responsible public agency to take action, upon discovery of an obstruction of the clearing sight distance, corner sight distance, or stopping sight distance at a passive highway-rail grade crossing. In light of the economic realities associated with the removal of permanent physical obstructions, subsection (c)(1) would provide a list of alternate options that would be authorized to be available to the responsible public agency in order to mitigate the impact of the obstruction. For example, if removal of the obstruction would be cost-prohibitive or otherwise unfeasible, the responsible public agency may choose to install speed limit signs with a reduced regulatory speed or advisory speed plaques to better accommodate a limited corner sight distance condition. Subsection (c)(2) would contain a penalty provision for use by the responsible public agency, should the responsible public agency choose to order a railroad corporation or other private property owner to remove or otherwise mitigate an obstruction located on private property. This penalty reflects current civil penalty provisions under State law for the failure of railroad companies to comply with vegetation standards at highway-rail grade crossings. See ARK. CODE ANN. § 23-12-201 (Michie 2010)(Arkansas law that imposes a fine of not less than $100 or more than $500 for each violation); IND. CODE § 8-6-7.6-2 (2010); LA. REV. STAT. ANN. § 48:386.1 (West 2010)(Indiana and Louisiana laws that impose a fine of $100 per day subject to a maximum fine of $5,000); MINN. STAT. ANN. § 219.384 (West 2010)(Minnesota law that imposes a fine of $50 per day); S.C. CODE ANN. § 58-17-4 1450 (Law. Co-op. 2009) (South Carolina law that imposes a fine of not less than $100 or more than $500, plus $100 per day after a specified period of time); and VA. CODE ANN. § 56-411 (Michie 2009) (Virginia law that imposes a fine of not more than $500 for each offense). However, the responsible public agency may also choose to exercise independent authority to address sight obstructions through the pursuit of injunctive relief against particularly recalcitrant private property owners. If the responsible public agency does not possess such authority, the State may wish to add a provision to this model state law that would confer such authority to the responsible public agency upon enactment. In recognition of the right of the railroad corporation or other private property owner to appeal an order issued by the responsible public agency in the exercise of its power of eminent domain, subsection (c)(2) would allow the railroad corporation or other private property owner to toll the issuance of civil penalties by filing an appeal of the order. If the obstruction is located on public property maintained by a State or local government, subsection (c)(3) would authorize the responsible public agency itself to remove or otherwise mitigate the obstruction, after providing written notice and adequate opportunity for the State or local government to do so. If the responsible public agency chooses to remove or otherwise mitigate the obstruction, the responsible public agency would be authorized to seek

NTSB

Highway Accident Report

77 reimbursement for any costs incurred from the State or local government with maintenance responsibility for the public property on which the obstruction had been located. A comparable provision can be found in South Carolina law, which specifically authorizes reimbursement of expenses incurred by the State department of transportation to remove sight distance obstructions located on the right-of-way of highways and roads maintained by counties and municipalities. See S.C. CODE ANN. § 58-17-1450 (Law. Co-op. 2009). Subsection (d) would define certain terms, including “clearing sight distance” and “corner sight distance”. With respect to the term “clearing sight distance”, it should be noted that the determination of minimum required clearing sight distance would be dependent upon maximum train speed over the crossing, as well as the length and acceleration characteristics of the various types of motor vehicles that routinely use the crossing. Similarly, the determination of “corner sight distance” would be dependent upon train and vehicular speeds on approach to the crossing. The corner sight distance requirement would, however, also require an unobstructed field of vision along the approach sight triangle. Subsection (d) would also provide a definition of “passive highway-rail grade crossing”, which includes private and public highway-rail grade crossings that are solely equipped with traffic control devices that are not activated by trains (such as one or more signs and pavement markings). While this definition closely follows the definition of “crossing” contained in section 2 of the Rail Safety Improvement Act of 2008 (division A of Public Law No. 110-432), the definition of “passive highway-rail grade crossing” would exclude pedestrian crossings that are equipped with passive warning devices. The second proposed amendment under Section 3 titled, “Vehicles approaching passive highway-rail grade crossings”, would establish a minimum and maximum stopping distance requirement for road users of passive highway-rail grade crossings. This amendment would also require road users to observe conditions along both directions of the railroad track and determine that the crossing will remain clear for a sufficient amount of time before entering and clearing the crossing. Subsection (a) would establish a stopping distance requirement for road users of passive highway-rail grade crossings under certain specified conditions. This subsection would require road users to stop within 15 to 50 feet of the nearest rail of the track at the passive highway-rail grade crossing under the following conditions: 1) upon approach of a train or other railroad equipment that is likely to occupy the crossing before the road user can safety enter and clear the crossing, 2) if a train approaching the crossing is sounding the locomotive horn or other locomotive audible warning device, or 3) if a stop sign is posted at the crossing. By complying with this stopping distance requirement, the road user should be able to determine whether the crossing will remain clear long enough to safety enter and clear the railroad tracks. Subsection (b) would govern the actions that must be taken before the road user enters the passive highway-rail grade crossing. To make a well-informed decision as to whether it will be safe to enter and travel across the crossing, especially in the absence of train-activated warning devices such as automatic gates and flashing lights, the road user must look, as well as listen, in both directions along the railroad track for evidence of an approaching train or other railroad equipment before entering the crossing. The road user may enter the crossing after determining that the crossing will remain clear for a sufficient amount of time within which to

NTSB

Highway Accident Report

78 enter, travel through the crossing, and then reach a location at which the entire length of the road user’s vehicle would be at least 15 feet past the far rail prior to the arrival of a train or other railroad equipment at the crossing. Subsection (c) would define certain terms, including “passive highway-rail grade crossing”, and “road user”. The definition of “passive highway-rail grade crossing” would include private and public highway-rail grade crossings that are solely equipped with traffic control devices that are not activated by trains (such as one or more signs or pavement markings). While this definition closely follows the definition of “crossing” contained in section 2 of the Rail Safety Improvement Act of 2008, the definition of “passive highway-rail grade crossing” would exclude pedestrian crossings that are equipped with passive warning devices. It should also be noted that the definition of “road user” would be somewhat broad in scope and include individuals other than motor vehicle operators, such as bicyclists, pedestrians, and persons with one or more disabilities. A BILL To amend [State or Commonwealth Code], and for other purposes. Be it enacted by [ ] legislature assembled in the [State or Commonwealth] of [ ], SECTION 1. SHORT TITLE. This Act may be cited as the “Adequate Sight Distance at Passive Highway-Rail Grade Crossings Act”. SEC. 2. PURPOSE. The purpose of this Act is to establish a Statewide program to improve sight distance at passive highway-rail grade crossings. SEC. 3. AMENDMENTS TO THE TRANSPORTATION LAWS. Section [ ] of chapter [ ], of title [ ], [State or Commonwealth General Laws], is amended [to read as follows:] [Chapter [ ] of title [ ], [State or Commonwealth General Laws], is amended by adding at the end thereof the following new sections:] “§[ ]. Adequate sight distance at passive highway-rail grade crossings “(a) PERIODIC EVALUATION OF SIGHT DISTANCE AT PASSIVE HIGHWAY–RAIL GRADE CROSSINGS.--The head of the public authority that has the responsibility to inspect highway-rail grade crossings shall establish a program to determine the adequacy of the clearing sight distance, corner sight distance, and stopping sight distance at each passive highway-rail grade crossing on a periodic basis. “(b) INSPECTION AUTHORITY.—To carry out this section, an officer, employee, or agent of the public authority that has the responsibility to inspect highway-rail grade crossings

NTSB

Highway Accident Report

79 (hereinafter referred to as the “responsible public agency”), at reasonable times and in a reasonable way, may enter public or private property for the purposes of determining the adequacy of the clearing sight distance, corner sight distance, and stopping sight distance at passive highway-rail grade crossings and evaluating sight distance obstructions caused, in whole or in part, by structures, topography, standing railroad equipment, trees, or other vegetation located within close proximity to those crossings. “(c) ACTIONS TO IMPROVE SIGHT DISTANCE AT PASSIVE HIGHWAY-RAIL GRADE CROSSINGS.— “(1) If the head of the responsible public agency finds that structures, topography, standing railroad equipment, trees, or other vegetation are obstructing the required clearing sight distance, corner sight distance, or stopping sight distance at a passive highway-rail grade crossing, the head of the responsible public agency shall take action to correct the deficiency. Such action may include, but shall not be limited to the following: “(A) ordering the removal or other mitigation of the obstruction by the owner of any private property on which the obstruction may be located; “(B) providing written notice of the obstruction to the appropriate State or local government with maintenance responsibility for any public property on which the obstruction may be located; “(C) installing additional traffic control devices; or “(D) installing speed limit signs with a reduced regulatory speed or advisory speed plaques for road users. “(2) Any private property owner who receives an order to remove or otherwise mitigate an obstruction, pursuant to subsection (c)(1)(A) of this section, shall either comply with, or file an appeal to, the order within sixty (60) days of receipt. A person that fails to comply with, or properly file an appeal to, an order to remove or otherwise mitigate an obstruction that has been issued pursuant to subsection (c)(1)(A) of this section is liable to the [State or Commonwealth of [ ]] for a civil penalty of not less than one hundred dollars, but not more than five hundred dollars, for each day on which the obstruction continues unabated. The head of the responsible public agency may, however, compromise the amount of a civil penalty citation imposed under this subsection. “(3) If the responsible public agency provides written notice of an obstruction on public property maintained by the State or local government, the State or local government will have sixty (60) days to remove or otherwise mitigate the obstruction. Upon expiration of this sixty (60) day period, the responsible public agency may remove or otherwise mitigate the obstruction and then seek reimbursement for costs incurred from the State or local government with maintenance responsibility for the public property on which the obstruction was located. “(d) DEFINITIONS.--In this section—

NTSB

Highway Accident Report

80 “(1) ‘clearing sight distance’ means the distance required along each direction of track for the road user stopped 15 feet short of the near rail at a highway-rail grade crossing to be able to see far enough down the track, in both directions, to determine if sufficient time exists for moving safely across the tracks to a point 15 feet past the far rail, prior to the arrival of a train; “(2) ‘corner sight distance’ means the length of highway on the approach to a highway-rail grade crossing that would be required by a road user to detect an approaching train from either direction of track in sufficient time to safely stop a vehicle traveling at the posted speed limit at least 15 feet before the near rail; “(3) ‘passive highway-rail grade crossing’ means a location, equipped solely with traffic control devices that are not activated by trains (such as one or more signs or pavement markings), where a public highway, road, or street, or a private roadway, including associated sidewalks and pathways, crosses one or more railroad tracks at grade; “(4) ‘road user’ means a vehicle operator, bicyclist, or pedestrian, including a person with one or more disabilities, within a public highway, road, or street, or a private roadway, including associated sidewalks and pathways; and “(5) ‘stopping sight distance’ means the length of highway on the approach to a highway-rail grade crossing required to safely stop a vehicle traveling at the posted speed limit at least 15 feet before the near rail. “§[ ]. Vehicles approaching passive highway-rail grade crossings “(a) STOPPING DISTANCE.--Upon approach to a passive highway-rail grade crossing, the road user shall come to a full stop within 15 to 50 feet of the nearest rail of the track under any of the following circumstances: “(1) the approach of a train or other railroad equipment that is likely to occupy the crossing before the road user can safely enter and clear the crossing; “(2) the sounding of a locomotive horn or other locomotive audible warning device by a train approaching the crossing; or “(3) if a stop sign is posted at the crossing. “(b) DURATION OF STOP.--While stopped at least 15 feet from the nearest rail of the track at a passive highway-rail grade crossing, the road user shall listen and look in both directions along the railroad track for evidence of the approach of a train or other railroad equipment. The road user shall not enter the crossing until the road user has determined that the crossing will remain clear of approaching trains and other railroad equipment for a sufficient amount of time to allow the road user to enter and clear the crossing. “(c) DEFINITIONS.--In this section— “(1) ‘passive highway-rail grade crossing’ means a location, equipped solely with traffic control devices that are not activated by trains (such as one or more signs or pavement

NTSB

Highway Accident Report

81 markings), where a public highway, road, or street, or a private roadway, including associated sidewalks and pathways, crosses one or more railroad tracks at grade; and “(2) ‘road user’ means a vehicle operator, bicyclist, or pedestrian, including a person with one or more disabilities, within a public highway, road, or street, or a private roadway, including associated sidewalks and pathways.”

NTSB

Highway Accident Report

82 References AAA Foundation for Traffic Safety. 2014. 2013 Traffic Safety Culture Index. Washington, DC: AAA Foundation for Traffic Safety (www.aaafoundation.org/2013-traffic-safety-culture- index). AASHTO (American Association of State Highway and Transportation Officials). 2011. A Policy on the Geometric Design of Highways and Streets, 6th edition. Washington, DC: AASHTO. DOT (US Department of Transportation) Office of Inspector General. 2013. Top Management Challenges for Fiscal Year 2014, PT-2014-009. Washington, DC: DOT (www.oig.dot.gov/sites/dot/files/DOT%20OIG%20Top%20Mngt%20Challeges%20for% 20FY%202014.pdf). _____. 2007. The Federal Railroad Administration Can Improve Highway–Rail Grade Crossing Safety By Ensuring Compliance with Accident Reporting Requirements and Addressing Sight Obstructions, Report MH-2007-044. Washington, DC: DOT (www.oig.dot.- gov/sites/dot/files/pdfdocs/Final_Signed_508_Grade_Crossing_Report_05-03-07.pdf). FHWA (Federal Highway Administration). 2009. Manual on Uniform Traffic Control Devices for Streets and Highways. Washington, DC: FHWA. _____. 2007. Railroad–Highway Grade Crossing Handbook, FHWA-SA-07-010. Washington, DC: FHWA. FMCSA (Federal Motor Carrier Safety Administration). 2014. FMCSA Medical Examiner Handbook. National Registry of Certified Medical Examiners. Washington, DC: FMCSA (www.fmcsa.dot.gov/regulations/medical/fmcsa-medical-examiner-handbook). _____. 2008. Expert Panel Recommendations, Obstructive Sleep Apnea and Commercial Motor Vehicle Driver Safety. Washington, DC: FMCSA (www.fmcsa.dot.gov/sites/- fmcsa.dot.gov/files/docs/Sleep-MEP-Panel-Recom-mendations-508.pdf). FRA (Federal Railroad Administration). 2011. FRA Guide for Preparing Accident/Incident Reports, DOT/FRA/RRS-22. Washington, DC: FRA. _____. 2010. Private Highway–Rail Grade Crossing Safety Research and Inquiry, DOT/FRA/ORD-10/02. Washington, DC: FRA. _____. 2007. National Highway–Rail Crossing Inventory Policy, Procedures, and Instructions for States and Railroads. Washington, DC: FRA. _____. 2005. Safe Placement of Train Cars: A Report, DOT Report to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Transportation and Infrastructure. Washington, DC: FRA.

NTSB

Highway Accident Report

83 Garner, Bryan. ed. 2014. Black’s Law Dictionary, 10th edition. Eagan, Minnesota: Thomson Reuters. Hartenbaum, N., N. Collop, I. Rosen, B. Phillips, C. F. George, J. A. Rowley, N. Freedman, T. E. Weaver, I. Gurubhaqavatula, K. Strohl, H. M. Leaman, and G. L. Moffitt. 2006. “Sleep Apnea and Commercial Motor Vehicle Operators: Statement From the Joint Task Force of the American College of Chest Physicians, American College of Occupational and Environmental Medicine, and the National Sleep Foundation.” Chest 130 (3): 902-905. Hickman, J., R. Hanowski, and J. Bocanegra. 2010. Distraction in Commercial Trucks and Buses: Assessing Prevalence and Risk in Conjunction With Crashes and Near Crashes, FMCSA-RRR-10-049. Washington, DC: FMCSA. Islam, M., M. Albustami, J. Jacqueline, and S. Sharma. 2010. “Clinical Predictors of Obstructive Sleep Apnea in Patients With BMI Greater Than or Equal to 35.” Chest 138 (4 Meeting Abstracts): 610A. Jennings, L. Stephen. 2009. Compilation of State Laws and Regulations Affecting Highway-Rail Grade Crossings, 5th edition. Washington, DC: FRA. Maryland MVA (Motor Vehicle Administration)–American Association of Motor Vehicle Administrators. 2005. Maryland Commercial Driver License Manual. Glen Burnie, Maryland: MVA. Mohebbi, R., and R. Gray. 2009. “Driver Reaction Time to Tactile and Auditory Rear-End Collision Warnings While Talking on a Cell Phone,” Human Factors 51 (1): 102–110. NHTSA (National Traffic Highway Safety Administration). 2014. Distracted Driving 2012, Traffic Safety Facts, Research Note, DOT HS 812 012. Washington, DC: NHTSA (www- nrd.nhtsa.dot.gov/Pubs/812012.pdf). NTSB (National Transportation Safety Board). 2012. Motorcoach Roadway Departure and Overturn on Interstate 95 Near Doswell, Virginia, May 31, 2011, NTSB/HAR-12/02. Washington, DC: NTSB. _____. 2011a. Multivehicle Collision, Interstate 44 Eastbound, Gray Summit, Missouri, August 5, 2010, NTSB/HAR-11/03. Washington, DC: NTSB. _____. 2011b. Truck-Tractor Semitrailer Median Crossover Collision With 15-Passenger Van, Munfordville, Kentucky, March 16, 2010, NTSB/HAR-11/02. Washington, DC: NTSB. _____. 2009. “Safety Recommendation letter to Federal Motor Carrier Safety Administration, Safety Recommendations H-09-15 and -16, October 20, 2009.” Washington, DC: NTSB. _____. 2003. Collision of a Greyhound Lines, Inc., Motorcoach and Delcar Trucking Truck Tractor-Semitrailer, Loraine, Texas, June 9, 2002, NTSB/HAR-03/01. Washington, DC: NTSB.

NTSB

Highway Accident Report

84 _____. 2002. Work Zone Collision Between a Tractor-Semitrailer and a Tennessee Highway Patrol Vehicle, Jackson, Tennessee, July 26, 2000, NTSB/HAR-02/01. Washington, DC: NTSB. _____. 1999. Collision of Northern Indiana Commuter Transportation District Train 102 With a Tractor-Trailer, Portage, Indiana, June 18, 1998, NTSB/RAR-99/03. Washington, DC: NTSB. _____. 1998. Safety at Passive Grade Crossings, Volume 1: Analysis, NTSB/SS-98/02. Washington, DC: NTSB. PHMSA (Pipeline and Hazardous Materials Safety Administration)–Transport Canada– Secretariat of Communications and Transportation (Mexico). 2012. Emergency Response Guidebook: A Guidebook for First Responders During the Initial Phase of a Dangerous Goods/Hazardous Materials Transportation Incident. Washington, DC: PHMSA (www.phmsa.dot.gov/hazmat). Rapoza, A., T. Raslear, and E. Rickley. 1999. Railroad Horn Systems Research, DOT/FRA/ORD-99/10. Washington, DC: FRA. Schroeder, P., M. Meyers, and L. Kostyniuk. 2013. National Survey on Distracted Driving Attitudes and Behaviors, 2012, DOT HS 811 729. Washington, DC: NHTSA. Strayer, D. L., J. M. Cooper, J. Turill, J., Coleman, N. Medeiros-Ward, and F. Biondi. 2013. Measuring Cognitive Distraction in the Automobile, Washington DC: AAA Foundation for Traffic Safety (www.aaafoundation.org/sites/default/files/MeasuringCognitive- Distractions.pdf). Tregear, S., J. Reston, K. Schoelles, and B. Phillips. 2009. “Obstructive Sleep Apnea and Risk of Motor Vehicle Crash: Systemic Review and Meta-Analysis,” Journal of Sleep Medicine 5 (6): 573–581.

FD07421 ｜ 2014_美国_MAB1404.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-14/04

National Transportation Safety Board Marine Accident Brief Engine Room Fire On Board Towing Vessel Marguerite L. Terral

Accident no. DCA-12-LM-020 Vessel name Marguerite L. Terral Accident type Fire Location Lower Mississippi River, mile marker 911, near Hickman, Kentucky Date June 9, 2012 Time 1705 central daylight time (coordinated universal time –5 hours) Injuries None Damage $2.6 million Environmental damage

No discharge of oil reported Weather Clear skies; winds 10–15 knots from the south-southeast; visibility of 5 nautical miles; air temperature 85°F; river current at 3 knots to the south. Waterway information Mississippi River – Major water highway. The US Army Corps of Engineers maintains a 9-foot-deep shipping channel for towboats and barges between Baton Rouge, Louisiana, and Minneapolis, Minnesota. On June 9, 2012, about 1705 central daylight time, the uninspected towing vessel Marguerite L. Terral with six crewmembers on board was pushing 12 empty barges on the Mississippi River near Hickman, Kentucky, when the vessel’s port engine caught fire. The crew tried unsuccessfully to extinguish the fire before evacuating onto one of the barges. No one was injured nor did the accident cause any pollution. The damage to the Marguerite L. Terral was estimated to be $2.6 million.

The Marguerite L. Terral on an unknown waterway in 2007. (Photo by William; Picasa Web Albums)

Engine Room Fire On Board Towing Vessel Marguerite L. Terral

NTSB/MAB-14/04 2 When the fire started, the Marguerite L. Terral was northbound on the Mississippi River, about 13 miles downriver of Hickman. The six crewmembers on board included the captain, the mate (also termed “pilot” on river waterways), and four deckhands.

Aerial view of the Mississippi River in the area near the fire. (Background by Google Earth) At 1705, an alarm sounded in the wheelhouse. The captain, who was making a round of the vessel before taking his watch, saw flames at the aft end of the port engine near the turbocharger. He also saw flames through the open starboard-side door to the engine room. He sounded the general alarm and ordered a deckhand to wake an offduty crewmember who was sleeping. The mate, who was second in command and in the wheelhouse at the time, requested assistance from other vessels in the area on the vessel’s very high frequency (VHF) radio. The Marguerite L. Terral was equipped with a fixed CO2 fire suppression system for the engine room. At 1706, the captain and two deckhands tried to reach one of the stations for releasing the CO2 remotely (the station located on the exterior of the vessel, aft of the portside door to the engine room). However, because the portside door to the engine room was open―like the starboard-side door―smoke and fire extended out from the engine room, preventing the crew from reaching the CO2 pullboxes. The fire suppression system could also have been activated directly from the manual pull at the CO2 bottles located in the steering gear room; however, no evidence indicates that the crew attempted to activate the system from this room. As part of suppressing a fire, the area where the fire is located needs to be closed off―shutting all doors, windows, and ventilation dampers―so that oxygen does not fuel the fire and displace the fire suppression agent. If the crew had activated the vessel’s fixed CO2 system, the ventilation system in the engine room would have automatically shut down. Because the crew did not do that, they would now have to close the ventilation manually. However, the ventilation shutdown levers were located inside the engine room, and the fire and thick smoke Hickman Island 8 Approximate site of fire Mississippi River Kentucky Missouri ~ 10 mi N

Engine Room Fire On Board Towing Vessel Marguerite L. Terral

NTSB/MAB-14/04 3 prevented the crew from accessing them. The ventilation in the engine room was therefore not shut down. At 1708, the crew retrieved portable fire extinguishers from the galley and discharged the CO2 contained in them in the direction of the port engine through the engine room’s starboard-side door. According to crew statements, the crew did not close the doors to the engine room while discharging the CO2. At 1710, after the discharge of the portable fire extinguishers proved unsuccessful in controlling the fire, the captain ordered everyone to abandon the vessel and evacuate onto the nearest of the 12 barges under tow.

Drawing of the main-level layout on board the Marguerite L. Terral. (Original drawing by the Coast Guard’s Towing Vessel National Center. For the purpose of this report, the drawing has been slightly modified.) At 1711, just before abandoning the Marguerite L. Terral, one of the deckhands shut down the fuel supply to the vessel’s engines. The vessel then lost propulsion and drifted with the barges less than 1 mile before grounding near the southern end of Island 8, about 14 miles downriver of Hickman. Local responders arrived on scene and assisted in the firefighting, using portable pumps. The towing vessel Edna T. Gattle arrived at 1900. Its crew used the onboard fire pump to fight the fire, and the vessel pushed the Marguerite L. Terral further against the river bank to ensure that the tow did not refloat and endanger other vessels in the river. The fire was finally extinguished at 2200. Space where the fire originated Bow

Engine Room Fire On Board Towing Vessel Marguerite L. Terral

NTSB/MAB-14/04 4

The scene after the assisting towing vessel Edna T. Gattle arrived. The evacuated crewmembers from the Marguerite L. Terral are standing on the barge adjacent to their vessel. (Photo provided by the Coast Guard; unknown photographer) All spaces and equipment on the Marguerite L. Terral’s main and upper decks were damaged or destroyed, except for the wheelhouse and the portside deck locker. The fire spread from the engine room to the staterooms and laundry room through a window between the engine room and one of the staterooms. This window gave way from the intensity of the fire’s heat. Below the main deck, the damage was limited to the engine room.

Engine Room Fire On Board Towing Vessel Marguerite L. Terral

NTSB/MAB-14/04 5

Fire damage to the vessel. (Photo by the Coast Guard) Because the crew was unable to access the ventilation shutdown levers in the fire, the US Coast Guard Inspection and Compliance Directorate issued Safety Alert 05-12, titled “Pressure Switch Location for Fixed Fire Suppression Systems,” in December 2012. (See the last page of this brief.) The Coast Guard published Safety Alert 05-12 to educate the marine industry about the issues involving the installation and locations of control systems associated with fire suppression systems. The safety alert emphasized that control switches for fire suppression systems should not be located in the space they are designed to protect. The source of the fire on board the Marguerite L. Terral could not be identified. The investigation did reveal that on May 31, 2012, 9 days before the fire, work had been done to repair a reported oil leak on the port engine, near the area where the fire was first sighted by the vessel crew. Probable Cause The NTSB could not determine the origin of the engine room fire on board the Marguerite L. Terral. Contributing to the extent of the fire damage was the crew’s failure to set fire boundaries, shut down the ventilation, and use the onboard fire suppression equipment effectively.

Engine Room Fire On Board Towing Vessel Marguerite L. Terral

NTSB/MAB-14/04 6 Vessel Particulars Vessel Marguerite L. Terral Owner/operator Terral River Service, Inc. Port of registry Lake Providence, Louisiana Flag United States Type Towing vessel Year built 2002 Official number (US) 1129737 Construction Steel Length 99 ft (30 m) Hull depth 10.2 ft (3.1 m) Beam/width 32 ft (9.7 m) Gross and/or ITC tonnage 326 gross tons Engine power; manufacturer 1,500 hp (1,117 kW); 2 main diesel engines, Caterpillar 3512 Persons on board Six

Adopted: March 10, 2014 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

December 31, 2012 Alert 05-12 Washington, DC Pressure Switch Location for Fixed Fire Suppression Systems Where’s yours located?

This safety alert addresses the location of fire suppression system pressure switches aboard vessels. These critical components sense the activation of the system and then electrically secures the venti- lation systems operating in the protected space. Securing the ventilation is essential in extinguishing a fire onboard a vessel. It assists in isolating the fire within the space, minimizes the introduction of additional oxygen to fuel the fire and prevents the loss of fire suppression agents from the space.

Recently, a vessel with an installed fixed CO2 fire suppression system, suf- fered extensive damage due to a fire that started in the engine room. During the firefighting efforts the crew reported that the engine room ventilation could not be secured. A post casualty damage survey of the vessel re- vealed that the pressure switch used to secure the ventilation was located within the engine room. See the photograph of the damaged pressure switch at the right and new switch below.

Fixed CO2 systems on inspected/regulated vessels need to be type ap- proved and installed in accordance with applicable regulations; 46 CFR 25.30-15, 46 CFR Subpart 76.15, 46 CFR Subpart 95.15, 46 CFR 118.410, etc. These regulations require all controls and valves for the operation of the system to be outside the space protected, and notes they cannot be located in any space that might be cut off or made inaccessible in the event of fire in the protected spaces. The Coast Guard considers pressure switches that are used in such systems a “control.”

For Uninspected Towing Vessels, 46 CFR 25.30-15 (b) requires installation in accordance with 46 CFR Subpart 76.15 and reiterates the location re- quirements.

The Coast Guard strongly reminds Owners and Operators of vessels with installed fixed fire suppression systems to ensure that these switches are properly located aboard their vessels. If the pressure switch or switches are located within the space being protected, they should be relocated by a properly trained fire suppression service technician. Doing so will assist in ensuring system functionality and accessibility in the event of an emergen- cy. Failing to do so could have serious consequences to the vessel, its crew and the environment.

This safety alert is for informational purposes only and does not relieve any domestic or international safety, operational or material requirement. Developed by the Office of Commercial Vessel Com- pliance, Washington, DC. Questions may be addressed to CG-CVC-1@uscg.mil. ******* Inspections and Compliance Directorate

FD07422 ｜ 2014_美国_MAB1409.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-14/09

National Transportation Safety Board Marine Accident Brief Engine Room Fire On Board Fishing Vessel Arctic Storm

Accident no. DCA13LM022 Vessel name Arctic Storm Accident type Fire Location North Pacific Ocean, about 46 nautical miles west of Aberdeen, Washington 46° 49′ N, 124° 54′ W Date May 20, 2013 Time 1505 Pacific daylight time (coordinated universal time – 7 hours) Injuries None Damage Est. $5 million Environmental damage None Weather Northwest winds at 10 knots; clear skies; visibility 8 nautical miles; air temperature 55°F; current at 3.1 knots Waterway information North Pacific Ocean fishing grounds off the coast of Washington state On the afternoon of May 20, 2013, a fire broke out in the engine room of the uninspected fishing vessel Arctic Storm as it was under way in the North Pacific Ocean, about 46 nautical miles west of Aberdeen, Washington, conducting fish processing operations. The crew extinguished the fire through the combined use of portable extinguishers, fixed suppression, and fire hoses. No injuries or pollution resulted from the accident. The estimated damage to the Arctic Storm was $5 million.

The Arctic Storm during the fire emergency. (Photo by the United States Coast Guard)

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 2

Satellite image of the accident area in the North Pacific Ocean off the coast of Washington state. The red triangle shows the location of the Arctic Storm when the engine room fire broke out. (Background by Google Earth) About 1505, the chief engineer had just entered the engine room when he noticed a fire in the overhead area above the main propulsion engine. He also noticed that the turbocharger on the engine’s starboard side was engulfed in flames. He radioed the captain on the bridge, and then he and the on-watch oiler exited the engine room, which was quickly filling with smoke. The oiler proceeded to the fish processing space, located directly above the engine room, and alerted the workers there. The captain had already heard the main engine’s fire alarm activate moments earlier. He looked out the bridge window and saw a large amount of smoke pouring out of the engine room’s ventilation outlets. He also saw that some crewmembers on deck were beginning to respond to the emergency. The captain sounded the vessel’s general alarm and radioed vessels in the area for assistance. The Coast Guard heard this callout as well. Because the Arctic Storm was conducting fish processing operations that included smaller fishing vessels working nearby, several of those vessels responded. The Arctic Storm crewmembers reported to their muster stations to begin coordinating the fire response. At the chief engineer’s request, the captain remotely shut down the engine room’s ventilation systems and closed its watertight doors to contain the fire. The chief engineer also instructed the engineering crew to ensure that the engine room’s power panel emergency stops, ventilation emergency stops, and remote quick-closing valves for the fuel oil storage tanks all were activated.

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 3

Layout of the Arctic Storm’s main deck (top image) and hold (bottom image; the hold is located directly below the main deck). (Original drawings by Jensen Maritime Consultants, Inc.) Crewmembers dressed in firefighting gear initially fought the fire using portable extinguishers. At first, this method successfully suppressed the fire, but when the crew stopped applying CO2, the fire quickly reflashed. Shortly after the fire originally started, the crew had shut down the vessel’s main electrical generator, located in the engine room near the main engine, because electrical cabling in the overhead was on fire and arcing. As a result of shutting down the main generator, the Arctic Storm lost electrical power and so did the engine room fire pump. The crew then tried using the forward fire pump, located outside the engine room in a forward space, and staged fire hoses at the engine room entrance. However, no firefighting water was available because the forward fire pump was inoperative (the electrical cables that connected this pump to the standby generator passed through the engine room, and the insulation on the cables had been burned in the fire, rendering the pump inoperative). After several failed attempts to extinguish the fire with portable extinguishers, the chief engineer obtained the captain’s permission to release the Halon fixed fire suppression system into the engine room. Following release of the Halon system, the chief engineer monitored the ventilation outlets for changes in the smoke’s appearance and saw that the amount of smoke decreased and that its color changed from black to white. By this time, responding vessels had arrived on scene and provided support equipment, including two portable diesel-powered fire pumps, which the crew set up to supply water to the vessel’s fire main system. About 30 minutes after the Halon system had been released into the engine room, the captain saw that smoke was still exiting through the engine room ventilation outlets, indicating that the fire was not completely extinguished and had in fact begun regaining strength. At this time, about 1730, the captain decided to evacuate nonessential crewmembers from the Arctic Storm to the assisting vessels. Seventy-six crewmembers and two fisheries observers were evacuated to three nearby fishing vessels. Forty-two crewmembers remained on board the Arctic Storm.

Main deck Hold (below the main deck) Main propulsion engine

Fish meal plant Fish processing space

Engine room

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 4 The firefighting team re-entered the engine room and noted fires in the overhead as well as in the fish meal plant, located forward of the engine room. After making several re-entries, the crew was able to extinguish all remaining fires and cool down the area using fire hoses and portable extinguishers. About 0530 the next morning, a responding tugboat began towing the Arctic Storm to Aberdeen, where the vessels arrived about 2245. As a result of the fire, the upper portions of the Arctic Storm’s engine room near the main propulsion engine were extensively burned. The combustible components located in the overhead area―such as electrical wiring insulation, lighting fixtures, and ventilation motors―were melted or entirely consumed by the fire. The insulation on electrical power cables in a cableway located above the main engine had completely burned away, leaving only bare copper conductors. These cables provided electrical power to equipment located in spaces forward of the engine room. In addition, the area near the starboard forward side of the main engine, both upper and lower, was damaged. The engine components in this area appeared to be the most heavily damaged from the fire, with paint burned off the engine components, rubber expansion joints melted, and fire soot deposited on most surfaces. Damage to the adjacent fish meal plant, located just forward of the engine room, included charred and burned hard-foam insulation on the overhead; however, no equipment was damaged. After the fire was extinguished, the chief engineer found a vent valve lying atop one of the engine’s attached pumps. He determined that the valve was associated with the fuel oil piping system located on the engine’s starboard-side fuel oil header near the starboard-side turbocharger. The valve had become detached from the fuel oil piping system as a result of a fracture at its threaded connection fitting. The quarter-inch, 2,000-psi valve had been installed at an elevated position at the forward end of the fuel oil piping system, and it was used to vent air from the system as needed. After the accident, the crew pressure-tested the fuel oil piping system and found no abnormal leaks or openings other than at the vent valve connection.

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 5

Photo of the area with the most fire damage, near the main propulsion engine’s starboard-side turbocharger. Shown is the location of the fuel oil pipe fitting (covered by a white rag) that was found to be fractured. At the request of the vessel’s insurers, a forensic engineering firm metallurgically examined the fracture surface of the valve fitting. The analysis report indicated that the fracture resulted from “ductile overload with a torsional component.” The analysis report also found that the appearance of the fracture indicated that “the fitting fractured due to a single load, such as an impact, that caused it to separate.”

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 6

Composite image of the quarter-inch fuel oil vent valve and pipe fitting fracture surfaces. The larger photo shows the valve as installed on the main propulsion engine, below the starboard-side turbocharger at the forward end of the fuel oil header. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board fishing vessel Arctic Storm was a fractured fitting on a fuel oil vent valve, located on the main propulsion engine, which resulted in fuel oil spraying onto a hot engine surface and igniting.

Engine Room Fire On Board Fishing Vessel Arctic Storm

NTSB/MAB-14/09 7 Vessel Particulars Vessel Arctic Storm Owner/operator Arctic Storm Management, Inc. Port of registry Seattle, Washington Flag United States Type Fishing – factory stern trawler Year built 1941, rebuilt 1988 Official number (US) 903511 IMO number 8720113 Classification society Det Norske Veritas (DNV) Construction Steel Length 314.3 ft (95.8 m) Draft (mean) 19 ft (5.8 m) Beam/width 48.5 ft (14.8 m) Gross and/or ITC tonnage 3,854 gross tons, 4,068 ITC tons Engine power, manufacturer 5,750 hp (4,288 kW) Stork-Werkspoor model 16 W 280, medium-speed diesel Persons on board 120

Adopted: May 29, 2014

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information provided by the US Coast Guard from its informal investigation of the accident. The NTSB did not conduct its own on-scene investigation.

FD07423 ｜ 2014_美国_MAB1413.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-14/13

National Transportation Safety Board Marine Accident Brief Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

Accident no. DCA13NM019 Vessel names Towing vessel Safety Runner and Kirby barges 28182 and 28194 Accident type Fire and explosions Location Mobile River, mile marker 0; Mobile, Alabama 30°41.14’ N, 88°01.55’ W Date April 24, 2013 Time 2030 central daylight time (coordinated universal time – 5 hours) Injuries Three serious burn injuries Damage $5.7 million Environmental damage 30 gallons of diesel oil from a shore-side tank dislodged by the explosion Weather Calm winds; 10+ miles visibility; air temperature about 70° F; 96% humidity Waterway information The Mobile River, located in southern Alabama, is about 45 miles in length from its mouth at Mobile Bay up to the confluence of the Alabama and Tombigbee rivers On April 24, 2013, at 2030 local time, the towing vessel Safety Runner docked on the Mobile River in Mobile, Alabama, alongside two Kirby barges that were having their tanks cleaned. Shortly thereafter, flammable vapors being vented from the barges’ open tank hatches entered the Safety Runner’s engine room and ignited. The fire spread from the towing vessel to the barges, resulting in explosions. Three persons sustained serious burn injuries. The total damage to the vessel and barges was estimated at $5.7 million.

Left to right: Damaged Kirby barges 28182 and 28194 (red-colored and alongside each other), and towing vessel Safety Runner (white-colored). To the right of the Safety Runner is another barge, DM 975 (gray-colored), which was not damaged in the fire. (Photo by the United States Coast Guard)

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 2 At 0030 on the morning of April 24, 2013, the towing vessel Ricky J Leboeuf delivered Kirby barges 28182 and 28194 to the Oil Recovery Company (ORC) Gas-Freeing Marine Terminal (“ORC Facility”) in Mobile for tank cleaning. The two barges held a total of about 11 barrels (462 gallons) of residual natural gasoline, a liquid, flammable, first-distillation of crude oil. After drop-off, the Ricky J Leboeuf remained at the stern of the two barges.

Aerial image of a section of Mobile, Alabama. The ORC Facility, located on the east side of the Mobile River, is circled in yellow. (Background by Google Earth) At 1200, the ORC person-in-charge (PIC) of the tank-cleaning operation and a second ORC employee boarded the barges to begin the scheduled work. A third ORC employee served as the PIC for the vacuum truck that was to receive the residual gasoline from the barges. Also at 1200, another barge―the DM 976―arrived at the ORC Facility for tank cleaning. Between 1200 and 1300, the two ORC employees opened all cargo tanks and hatches on the Kirby barges and began to strip the tanks of residual gasoline. Flammable vapors vented to the atmosphere from the hatches and deck openings. Several hours later, at 2000, the two ORC employees finished stripping the tanks and installed six portable pneumatic fans on board each barge to help ventilate the tanks. About the time that the portable fans began ventilating the tanks, recorded weather data reported an air temperature of about 70°F, humidity of 96 percent, and calm winds.

ORC Gas Free Facility N ~ 0.25 mi

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 3

Open tank hatches on Kirby 28194, photographed after the accident, through which flammable vapors were being vented. Undamaged barge DM 976 can be seen on the right. (Photo by the Coast Guard) One of the ORC employees later told investigators that, sometime between 2000 and 2030, an air hose disconnected from one of the fans on board Kirby 28182, and the fan malfunctioned. He recalled that the PIC shut down two dockside compressors that powered the fans before they investigated the fan malfunction. He said that while the PIC examined the fan, the captain of the Safety Runner pulled his vessel into the facility between Kirby 28194 and DM 976 to drop off a radio technician. The captain of the Safety Runner later told Coast Guard investigators that he was unaware of the tank-cleaning operation in progress.

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 4

Aerial view of the ORC Facility. Overlaid in the image are icons representing the vessels and barges that were present at the time of the accident, and their approximate positions. (Background by Google Earth) The captain of the Safety Runner told investigators that, shortly after the radio technician departed the vessel, the Safety Runner’s main engines “started to run away.” Tank vapors from the barges had begun entering the air intakes for the Safety Runner’s main diesel engine, and this fueled the engines. The captain tried to shut down the engines from the vessel’s pilothouse, but failed. Two deckhands then activated the engine’s emergency shutdowns on the vessel’s main deck; however, the engines still did not shut down. The concentration of the vapors from the tank barges was high enough that it introduced additional fuel to power the engines, even though the vessel’s normal fuel supply had been shut off. Shortly thereafter, witnesses reported seeing flames shooting along both sides of the Safety Runner and onto the two Kirby barges, resulting in several explosions. The crews of the Safety Runner and the Ricky J Leboeuf sounded their vessels’ general alarms. The Safety Runner’s entire crew then abandoned the vessel ashore and the Ricky J Leboeuf’s crewmembers disconnected their vessel from the Kirby barges and maneuvered away from the facility. ~ 300 ft N Ricky J Leboeuf

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 5

The accident scene. (Photo by the Coast Guard) Three people sustained serious burn injuries: (1) The ORC PIC, who was standing on the deck of the Kirby 28182; (2) a Safety Runner deckhand, who was standing on the starboard side of the Safety Runner’s main deck near the emergency shutdowns; and (3) the radio technician from the Ricky J Leboeuf, who was standing on land immediately in front of the Safety Runner. On shore, ORC personnel and the Safety Runner crew moved away from the burning tug and barges, aided the injured, and contacted emergency response agencies. Between 2030 and 2057, local fire and police departments received notifications and responded to the scene. At 2057, another explosion occurred, damaging nearby structures and first-responder vehicles. Emergency responders then evacuated all persons from neighboring buildings and vessels within a 1-mile radius. Coast Guard Sector Mobile closed the mouth of the Mobile River to vessel traffic and established a safety zone around the accident scene. The two Kirby barges burned for more than 6 hours and sustained several more explosions. Shortly after sunrise on the morning of April 25, 2013, the Mobile Fire Department declared the area safe for responders. Investigators could not determine the source of ignition inside the Safety Runner’s engine room. This space, together with the vessel’s main deck area, was extensively fire-damaged. Kirby declared its two barges total losses. The damage amount for the towing vessel and two barges was estimated to be $5.7 million. The Ricky J Leboeuf and DM 976 were not damaged. Investigators found evidence of inadequate management oversight by ORC, including employing a barge PIC without proper credentials, and not having an operations manual that specifically addressed tank cleaning operations at the ORC Facility. Instead, ORC used an operations manual intended only for mobile facilities, such as vacuum trucks and tankers. Further, in that manual, ORC had attached pages from the Oil Companies International Marine

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 6 Forum (OCIMF) International Safety Guide for Oil Tankers and Terminals (ISGOTT) that described only what procedures ought to be contained in operations manuals, rather than writing its own procedures specific to the risks associated with tank-cleaning operations at the ORC Facility. The manual did not address hazards associated with motor vessels―full of ignition sources―docking alongside barges during tank-cleaning operations. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire and explosions involving towing vessel Safety Runner and Kirby barges 28182 and 28194 was the failure of the ORC Facility to isolate tank-cleaning operations from sources of ignition. Contributing to the accident was ORC’s failure to provide its employees with tank-cleaning training and procedures that followed industry standards and government regulations for reducing the risk of fire during tank-cleaning operations.

Fire and Explosions On Board Towing Vessel Safety Runner and Kirby Barges 28182 and 28194

NTSB/MAB-14/13 7 Vessel Particulars Vessels Safety Runner Kirby 28182 Kirby 28194 Owner/operator J Russell Flowers Inc. Kirby Inland Marine, LP Kirby Inland Marine, LP Port of registry New Orleans, LA Wilmington, DE Wilmington, DE Flag USA USA USA Type Uninspected towing vessel Tank barge; bulk liquid cargo (grade A and lower) Tank barge; bulk liquid cargo (grade A and lower) Year built 2010 2012 2012 Official number (US) 1225248 1238006 1239404 IMO number N/A N/A N/A Construction Steel Steel Steel Length 70 ft (21.4 m) 300 ft (91.44 m) 300 ft (91.44 m) Draft 10 ft (3.0 m) 12 ft (3.7 m) 12 ft (3.7 m) Beam/width 28 ft (8.5 m) 54 ft (16.5 m) 54 ft (16.5 m) Gross and/or ITC tonnage 164 gross tons 1,632 gross tons 1,632 gross tons Engine power; manufacturer Diesel reduction N/A N/A Persons on board 6 0 0

For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13NM019. Adopted: July 14, 2014 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident.

FD07424 ｜ 2014_美国_MAB1414.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-14/14

National Transportation Safety Board Marine Accident Brief Fire On Board Motor Yacht Ocean Alexander 85E06

Accident no. DCA13LM029 Vessel name Ocean Alexander 85E06 Accident type Fire Location Roche Harbor Resort Marina, San Juan Islands, Washington (48°36.5′ N 123°09.2′ W) Date July 10, 2013 Time 1000 Pacific daylight time (coordinated universal time – 7 hours) Injuries None Damage Total loss of vessel, valued at $3,691,660 Environmental damage An estimated 1,600 gallons of marine diesel fuel spilled into the waterway; about 1,200 gallons were recovered during cleanup efforts Weather 70°F; clear skies Waterway information The yacht was moored at Roche Harbor Resort Marina, a protected harbor in the San Juan Islands (northwest corner of Washington state)

On July 10, 2013, about 1000 local time, the newly built motor yacht Ocean Alexander 85E06 was moored, unmanned, and on display for purchase at the Roche Harbor Resort Marina in Washington state when a fire broke out in a forward compartment. Efforts to extinguish the fire were unsuccessful and the flames consumed the vessel. In addition, the vessel partially sank due to flooding from firefighting activities. No one was injured, but about 400 gallons of marine diesel fuel spilled into the waterway. The yacht, valued at $3,691,660, was a total loss.

A sister vessel to the Ocean Alexander 85E06, shown under way on the water. (Photo by Global Diving and Salvage, Inc.)

Fire On Board Motor Yacht Ocean Alexander 85E06

NTSB/MAB-14/14 2 The 85-foot-long Ocean Alexander 85E06 was built in Taiwan and shipped to Tacoma, Washington, where it arrived in early May 2013. Shortly thereafter, it was brought to Roche Harbor Resort Marina to be displayed and offered for sale by Seattle-based Ocean Alexander Marine Yacht Sales, Inc. The name of the yacht reflected the builder’s hull number and was temporary; it would be changed when a new owner bought and registered the vessel.

Satellite image showing a section of Washington state, including the city of Roche Harbor, where the yacht was moored when the fire broke out. Roche Harbor is located about 80 miles northwest of Seattle. (Background by Google Earth) About 1000 on July 10, 2013, the harbor master at the Roche Harbor Resort Marina noticed smoke billowing from the vessel’s bow hatch. He alerted the San Juan County Fire Department and then evacuated resort visitors from the dock. He also charged the marina’s fire hoses and, together with marina employees, began applying water to suppress and contain the fire. The Ocean Alexander’s FM200 fixed fire-suppression system was also activated. At 1018, a local United States Customs and Border Protection officer notified the crew of a local commercial towing assistance vessel about the yacht fire. The assistance boat was under way at 1028, and its crew radioed the United States Coast Guard. At 1045, fire trucks arrived on scene and assumed command of the firefighting efforts. At 1100, the county fire boat Confidence also arrived to assist. At 1231, Coast Guard personnel from Station Bellingham arrived with a 45-foot-long response boat, and, shortly thereafter, investigators from Sector Puget Sound arrived by road. Marina employees deployed a pollution prevention boom around the burning yacht. Pacific Ocean Washington State Seattle Tacoma

Roche Harbor N ~ 50 mi Site of Fire

Fire On Board Motor Yacht Ocean Alexander 85E06

NTSB/MAB-14/14 3

Fire and smoke rising from the forward end of the Ocean Alexander 85E06. (Photo by the Coast Guard) However, the firefighting efforts did not extinguish the fire until it had severely damaged the fiberglass vessel and its interior compartments. At 1510, as a result of the water weight that had accumulated on board during the firefighting effort, the vessel’s bow sank below the surface.

Fire On Board Motor Yacht Ocean Alexander 85E06

NTSB/MAB-14/14 4

The starboard side of the Ocean Alexander 85E06 after the fire was extinguished. The stern is visible and the bow has sunk below the water. The pollution prevention boom can be seen in the foreground. (Photo by the Coast Guard) About 3 hours later, at 1800, the Ocean Alexander 85E06 sank almost completely. A salvage company refloated the wreckage; however, the vessel was a total loss. Local media reported that the yacht had 1,600 gallons of diesel fuel on board. Twelve-hundred gallons were recovered during cleanup efforts. No injuries were reported. The wreckage was moved to a shipyard in Bellingham, Washington, where it was examined by investigators from the vessel’s insurance company, the Coast Guard, and the National Transportation Safety Board (NTSB). The exact source of the fire remains unknown, but postfire inspection and eyewitness accounts of the event support the conclusion that the fire was electrical in nature and originated in the forward accommodation area.

Fire On Board Motor Yacht Ocean Alexander 85E06

NTSB/MAB-14/14 5

Looking aft from the vessel’s forward end at the burned and melted fiberglass hull and interior. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board the Ocean Alexander 85E06 was an electrical fault of an unknown source, located in the vessel’s forward accommodation area.

Fire On Board Motor Yacht Ocean Alexander 85E06

NTSB/MAB-14/14 6 Vessel Particulars Vessel Ocean Alexander 85E06 Owner/operator Ocean Alexander Marine Yacht Sales, Inc. Port of registry Seattle, Washington Flag United States Type Motor yacht Year built 2013 Official number (US) OAX85E06H314 IMO number N/A Construction Fiberglass Length 84.8 ft (25.9 m) Draft 5.5 ft (1.7 m) Beam/width 20.1 ft ( 6.1 m) Gross and/or ITC tonnage 90 gross tons Engine power; manufacturer 3,200 hp (2,400 kW); Twin MTUTM10V2000 1,600 hp Persons on board None

For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13LM029. Adopted: July 15, 2014 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident.

FD07425 ｜ 2014_美国_MAB1422.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-14/22

National Transportation Safety Board Marine Accident Brief Fire on Board Towing Vessel Shanon E. Settoon

Accident no. DCA13NM011 Vessel name Shanon E. Settoon (towing the barge SMI 572) Accident type Fire Location Bayou Perot, Louisiana 29°38.03 N, 90°10.63 W Date March 12, 2013 Time 1745 central daylight time (coordinated universal time – 5 hours) Injuries 1 fatality Damage Total loss of vessel, estimated at more than $500,000 Environmental damage Release of high-pressure liquefied petroleum gas from ruptured pipeline, and release of 1,000 gallons of diesel fuel from the vessel. Clean-up and salvage costs estimated at $166,000. Weather Clear; 10-mile visibility; 66°F; north-northwest winds at 8 knots Waterway information Bayou Perot Canal in the Intracoastal Waterway, mile marker 20

On March 12, 2013, at 1745 local time, the towing vessel Shanon E. Settoon was pushing a loaded tank barge in Bayou Perot (about 20 miles south of New Orleans, Louisiana) when it struck a submerged pipeline. The collision caused a release of liquefied petroleum gas, which entered the air intake for the main propulsion engines and ignited. The Shanon E. Settoon was destroyed by the fire; the tank barge had limited fire damage and did not release any of the 93,000 gallons of crude oil it was carrying. The four crewmembers on board the Shanon E. Settoon escaped from the vessel, but one of them sustained second- and third-degree burns from which he died 1 month later.

The Shanon E. Settoon ablaze after the gas from the ruptured pipeline ignited. Tank barge SMI 572 is positioned forward of the vessel. (Photo by the United States Coast Guard)

Fire On Board Towing Vessel Shanon E. Settoon

NTSB/MAB-14/22 2 On the day of the accident, the Shanon E. Settoon was transiting from the Square Mile Energy facility on Lake Salvador, pushing the tank barge SMI 572 loaded with 93,000 gallons of crude oil. Four crewmembers were on board the vessel. That afternoon, the captain called the Louisiana Delta Oil Company (LDOC) facility on Bayou Perot to determine if the facility had additional crude oil available to load to top off the SMI 572. The tank gauging contractor at LDOC confirmed that the facility had 1,600 barrels available to load, and about 1330, the captain told him that the vessel would arrive later that evening for loading the following morning.

Satellite image of the accident area, located about 20 miles south of New Orleans, Louisiana. (Background by Google Earth) According to the LDOC contractor, a couple of hours later, about 1600, he again heard from the Shanon E. Settoon captain, who this time had the vessel’s regular captain on the phone as well. (The captain who was piloting the vessel that day was a relief captain; the regular captain was not on board the vessel.) The two captains asked the LDOC contractor for directions to the Bayou Perot facility. The LDOC contractor told both captains that, after the vessel had come south from Lake Salvador, it could approach the facility either by turning directly into the North Canal, or go slightly farther to the southeast and then turn toward the facility. About 1.5 hours later, about 1730, the relief captain called again asking about directions to the facility. The LDOC contractor told him that if he felt uncomfortable with the approach, he could wait until the morning. The captain chose to proceed that evening, and he took the more southeast route in his approach to the LDOC facility. As the tow was inbound, the captain saw two obstructions in the water ahead, and he turned to starboard to avoid them. The vessel and barge then passed over a submerged Chevron pipeline that contained petroleum gas at 250 pounds per square inch of pressure. About 1744, the tow struck the pipeline. New Orleans Lake Salvador Bayou Perot Accident Site N

~ 10 mi Florida Louisiana Gulf of Mexico

Fire On Board Towing Vessel Shanon E. Settoon

NTSB/MAB-14/22 3

Close-up satellite image of Bayou Perot. The white line represents the vessel’s approximate trackline and the approach slightly farther to the southeast that the captain chose. The red line represents the approximate location of the submerged pipeline. (Background by Google Earth)

Photo of the area near the LDOC facility to which the tow was headed, looking southeast. Overlaid in solid and dashed white lines are the vessel’s completed and intended transit segments (approximate). Overlaid in yellow circles are the obstructions in the water that the captain tried to avoid just before striking the submerged pipeline. (Photo by the United States Coast Guard) LDOC Facility Bayou Perot LDOC Facility Completed segment Intended segment N

~ 0.5 mi ~ 175 ft

Fire On Board Towing Vessel Shanon E. Settoon

NTSB/MAB-14/22 4 Numerous active or abandoned oil and gas pipelines traverse this Louisiana region. When installed, the pipelines are surveyed to ensure that they are buried at an appropriate depth. However, over time their coverage can decrease due to storms, shoreline changes, etc., which makes voyage planning challenging and particularly reliant on up-to-date, accurate information. Many pipelines in the region do not appear on standard navigation charts and mariners do not know their exact locations.

On realizing that the tow had struck an object, the captain notified the LDOC contractor and tried to maneuver away from the obstruction. A crewmember told investigators that, about that time, he twice heard a noise and saw a disturbance in the water that pushed the stern of the vessel upward. He and another crewmember began to head forward on the vessel toward the barge when he heard the captain say that he needed help shutting down the main engines to prevent a spark. The crewmembers began to walk aft when the main engines exploded and fire engulfed the Shanon E. Settoon. The captain and the three crewmembers abandoned the vessel. Two of the crewmembers retreated to the barge, while the captain―who was badly burned―and another crewmember ended up in the water and made their way to shore. Chevron shut off the pipeline; however, the remaining gas in the pipeline continued to burn for several days.

The ablaze Shanon E. Settoon and the barge SMI 572. An oil sheen can be seen on the water extending out from the tow. (Photo by the Coast Guard)

Fire On Board Towing Vessel Shanon E. Settoon

NTSB/MAB-14/22 5 Left, the Shanon E. Settoon’s damaged propeller blade during postaccident survey; right, the damaged pipeline and its protective casing. (Photos by the Coast Guard) The Shanon E. Settoon was completely burned and declared a total loss. A survey revealed that the vessel’s portside propeller had struck and penetrated the pipeline. When the gas reached the surface of the water, it was drawn into the main engines, where it ignited. The explosion caused an intense fire, which was fed by the escaping gas under pressure. The Shanon E. Settoon had about 1,000 gallons of diesel fuel on board, which was spilled in the accident. About 1 month later, the captain died from the second- and third-degree burns he sustained in the accident. Given the numerous pipelines in the area that present submerged hazards, and given that the locations of oil and gas facilities may be temporary and subject to change, it is essential that vessel companies provide their operators with up-to-date, well-researched information to ensure safe navigation. The Shanon E. Settoon captain attempted to avoid a visible hazard, but inadvertently struck a submerged one. Probable Cause The National Transportation Safety Board determines that the probable cause of the explosion and fire on board the Shanon E. Settoon was the introduction of petroleum gas into the main engines after the vessel struck and ruptured a submerged pipeline due to incomplete navigational information provided to the captain by the vessel company.

Fire On Board Towing Vessel Shanon E. Settoon

NTSB/MAB-14/22 6 Vessel Particulars Vessels Shanon E. Settoon SMI 572 Owner/operator Settoon Towing, LLC Settoon Towing, LLC Port of registry Belle River, Louisiana Belle River, Louisiana Flag United States United States Type Towing vessel Tank barge Year built 1975 2007 Official number (US) 566684 1195182 Construction Steel Steel Length 46.8 ft (14.2 m) 154 ft (46.8 m) Draft 6 ft (1.8 m) 3.5 ft (1.06 m) Beam/width 20 ft (6 m) 42 ft (12.7 m) Gross and/or ITC tonnage 55 gross tons N/A; 5,700 bbl capacity Engine power; manufacturer 700 hp (521 kW); Cummings 855 N/A Persons on board 4 0

For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13NM011. Adopted: December 10, 2014

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code, Section 1154(b).

FD07426 ｜ 2014_美国_MAR1401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Allision of the Passenger Vessel Seastreak Wall Street with Pier 11, Lower Manhattan, New York, New York January 9, 2013

Marine Accident Report

NTSB/MAR-14/01 PB2014-105712

National Transportation Safety Board

NTSB/MAR-14/01

NTIS # PB2014-105712

Notation 8473A

Adopted April 8, 2014

Marine Accident Report Allision of the Passenger Vessel Seastreak Wall Street with Pier 11, Lower Manhattan, New York, New York January 9, 2013

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2014. Allision of the Passenger Vessel Seastreak Wall Street with Pier 11, Lower Manhattan, New York, New York, January 9, 2013. Marine Accident Report NTSB/MAR-14/01. Washington, DC. Abstract: This report discusses the allision of the high-speed passenger ferry Seastreak Wall Street with Pier 11/Wall Street in lower Manhattan, New York City, on January 9, 2013. Four passengers were seriously injured, and 75 passengers and 1 deckhand sustained minor injuries. The estimated cost to repair the ferry was about $166,200. The total cost of repairs to the pier was $333,349. Safety issues identified in this report include oversight of vessel operations, control panel design, management of passenger access to stairwells to mitigate possible injuries, the importance of marine safety management systems, and the need for information captured by voyage data recorders in investigating and analyzing accident causes and identifying remedial actions to help prevent their recurrence. The National Transportation Safety Board (NTSB) issues new recommendations to the United States Coast Guard regarding human factors standards for critical vessel controls, the need for operator control of ferry passenger access to stairwells, and the carriage of marine voyage data recorders. The NTSB also recommends that the owner of the Seastreak Wall Street improve specific control system displays and alerts, complete development and implementation of a safety management system, and revise its vessel operations and training manuals. The NTSB asks the manufacturer of the vessel’s propulsion control system to improve its design and alert its customers to the changes. The report also reclassifies previous recommendations to the Coast Guard regarding safety management systems and voyage data recorders.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2014-105712 from:

National Technical Information Service 5301 Shawnee Road Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 www.ntis.gov

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13MM005.

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB

Marine Accident Report

iii

Contents Figures ........................................................................................................................................... iv Acronyms and Abbreviations ...................................................................................................... v Executive Summary ..................................................................................................................... vi 1 Accident Overview .................................................................................................................. 1 Voyage and Allision ........................................................................................................ 1 1.1 Injuries ............................................................................................................................. 3 1.2 Damage to Vessel and Pier .............................................................................................. 4 1.3 1.3.1 Seastreak Wall Street .......................................................................................... 4 1.3.2 Pier 11, Slip D2―Dock Barge Desiree M ......................................................... 6 Waterway ......................................................................................................................... 7 1.4 Weather Conditions ......................................................................................................... 7 1.5 Vessel Information: Seastreak Wall Street ...................................................................... 7 1.6 1.6.1 Vessel Structure and Design ............................................................................... 7 1.6.2 Engines and Propulsion System ......................................................................... 9 1.6.3 Bridge Controls ................................................................................................ 10 Seastreak Ferry Operations ............................................................................................ 12 1.7 Regulatory Authority ..................................................................................................... 13 1.8 Personnel Information .................................................................................................... 14 1.9 Toxicological Testing .................................................................................................... 15 1.10 2 Investigation and Analysis ................................................................................................... 16 Accident Events and Captain’s Actions ......................................................................... 18 2.1 2.1.1 Approach to Pier and Allision .......................................................................... 18 2.1.2 Examination of Electronic Accident Data ........................................................ 20 Control Panel Design and Mode Indication ................................................................... 24 2.2 Seastreak Managerial Oversight .................................................................................... 25 2.3 2.3.1 Company Procedures at the Time of the Allision ............................................ 26 2.3.2 Safety Management Systems ............................................................................ 28 2.3.3 Previous NTSB Actions Regarding Safety Management Systems .................. 30 Vessel Performance Data and Accident Prevention ...................................................... 32 2.4 2.4.1 Data Recording on the Seastreak Wall Street .................................................. 32 2.4.2 Previous NTSB Action Regarding Voyage Data Recorders ............................ 34 3 Conclusions ............................................................................................................................ 37 Findings.......................................................................................................................... 37 3.1 Probable Cause............................................................................................................... 38 3.2 4 Recommendations ................................................................................................................. 39 New Recommendations ................................................................................................. 39 4.1 Previous Recommendations Reclassified in This Report .............................................. 40 4.2 References .................................................................................................................................... 42 Appendix A―NTSB Investigation Information ...................................................................... 43 Appendix B―NTSB Safety Alert .............................................................................................. 44 Appendix C―NTSB Vessel Power Study ................................................................................. 45

NTSB

Marine Accident Report

iv

Figures Figure 1. Seastreak Wall Street ...................................................................................................... 1 Figure 2. Approximate track of the Seastreak Wall Street from Atlantic Highlands to Manhattan ................................................................................................................... 2 Figure 3. AIS data showing the ferry’s trackline for the last 7 minutes of the accident voyage ... 3 Figure 4. Injuries sustained in the Seastreak Wall Street allision. ................................................. 3 Figure 5. Damage to the Seastreak Wall Street starboard bow. ..................................................... 5 Figure 6. Debris found in ferry propeller ....................................................................................... 6 Figure 7. Damage to the Slip D2 dock barge ................................................................................. 6 Figure 8. Vessel particulars for Seastreak Wall Street. .................................................................. 8 Figure 9. Profile view of the Seastreak Wall Street ....................................................................... 9 Figure 10. Servogear Ecoflow Propulsor system components. ................................................... 10 Figure 11. Simple schematic of Seastreak Wall Street’s bridge .................................................. 10 Figure 12. Photo of bridge control panel. .................................................................................... 11 Figure 13. Closeup of bridge control panel order levers and command buttons. ........................ 19 Figure 14. Comparison of vessel response when operator adjusts order levers in Combinator and Backup modes .............................................................................. 22

NTSB

Marine Accident Report

v

Acronyms and Abbreviations AIS automatic identification system CCTV closed-circuit television CFR Code of Federal Regulations COI certificate of inspection CPP controllable pitch propeller ECS electronic chart system EMS emergency medical services FDNY Fire Department of the City of New York GMATS Global Maritime and Transportation School IMO International Maritime Organization ISM Code International Safety Management Code ITC International Convention on Tonnage Measurement of Ships kW kilowatt LED light emitting diode MSC Marine Safety Center (Coast Guard) NOAA National Oceanic and Atmospheric Administration NTSB National Transportation Safety Board NVIC Navigation and Vessel Inspection Circular (US Coast Guard) NWS National Weather Service NYC DOT New York City Department of Transportation OCMI officer in charge, marine inspection SMS safety management system SOLAS International Convention for the Safety of Life at Sea S-VDR simplified voyage data recorder U.S.C. United States Code VDR voyage data recorder

NTSB

Marine Accident Report

vi

Executive Summary The Seastreak Wall Street, a high-speed passenger ferry serving commuters traveling between New Jersey and New York City, struck a Manhattan pier at about 12 knots on the morning of January 9, 2013. Of the 331 people on board, 79 passengers and 1 crewmember were injured, 4 of them seriously, in the third significant ferry accident to occur in the New York Harbor area in the last 10 years. During the captain’s approach for docking, he intended to reduce speed and transfer control from one bridge station to another less than a minute before reaching Pier 11/Wall Street on the East River. Seastreak captains routinely used this procedure and changed stations for better visibility. In this instance, however, the maneuver proved unsuccessful, and the captain was unable to remain in control of the ferry before impact. National Transportation Safety Board (NTSB) investigators identified the following safety issues pertinent to this accident:  The captain’s control of the vessel as it approached the pier;  Procedures, guidance, crew training, and managerial oversight provided by Seastreak LLC, the managing owner and operator of the Seastreak Wall Street and similar ferries;  Control of passenger access to stairways;  Control panel design;  Development and implementation of an effective safety management system (SMS); and  The value of information captured by a voyage data recorder (VDR) in accident investigation. Captain’s control of the vessel. The captain’s landing approach involved slowing the Seastreak Wall Street and transferring propulsion control from the center bridge control station to the starboard station. However, the vessel did not respond as the captain expected, and he could not determine why he was unable to maintain vessel control in the seconds before the vessel struck the dock. The captain also did not allow enough time to react to the loss of vessel control while approaching the pier. Company procedures and managerial oversight. The NTSB investigation found Seastreak’s management and oversight of vessel operations could have lessened the likelihood of this accident. More effective company policies and procedures would have included documentation of the ferry’s recently retrofitted propulsion system, broader crew training, and risk mitigation and safety enhancement practices. When the accident occurred, the Seastreak Wall Street operations manual had not been updated since the ferry was converted in July 2012 from waterjet to controllable pitch propeller (CPP) propulsion. Further, the transfer of control from one bridge station to another was a critical point in the vessel’s approach, but no formal company guidance was available for

NTSB

Marine Accident Report

vii

executing this procedure. The captain also could have benefited from the mate’s assistance, but company policies did not adequately define crewmember roles. Additional areas of vessel management that were absent from the operations manual and company oversight were passenger control policies, formal training for crewmembers in vessel operations, vessel incident assessment, identification of possible risks and corrective action, and application of a safety management system (discussed below). Severity of passenger injuries. NTSB examination of the evidence revealed that the passenger requiring the most extensive medical treatment had fallen down a stairwell, sustaining severe head injuries. Seastreak ferry crewmembers were not directed to control passenger access to stairwells, even when approaching a landing, nor were they required to make a passenger safety announcement upon arrival. Control panel design and mode indication. Identical sets of control panel pushbuttons were located on either side of the order levers, one set of buttons for each propeller, port and starboard. A small red light in the upper left corner of each button would light when the button was active. In addition to using the order levers to change main propulsion engine rpm, the operator could use these pushbuttons to control vessel actions such as changing propeller pitch. When illuminated, lights on each button also identified, for instance, whether that control station was active and which operating mode was engaged. However, the available visual and audible cues to indicate mode and control transfer status were ambiguous. Safety management systems. A US vessel in domestic service is not required to develop and implement an SMS, and the Seastreak Wall Street operated without the guidance of such a system. Operators can, however, voluntarily meet well-established international SMS standards that are required for many ships, including provisions for safe vessel operation, emergency procedures, and internal audits and management reviews. Several NTSB marine accident investigations highlighted the need for specific safety-related vessel operational procedures. These included two previous accidents involving ferries operating in New York Harbor. The NTSB previously issued recommendations in support of safety management systems and remains committed to the establishment of SMS requirements. Voyage data recorders. Had the Seastreak Wall Street been fitted with a VDR, several aspects of the NTSB investigation would have benefited from considerably more evidence. A broader range of data would have provided substantial insight into the operation of the Seastreak Wall Street and its performance as it approached the pier. A VDR could have captured the vessel’s operating conditions; propulsion commands ordered and system responses; audio recording on the bridge, which could have clarified interactions between officers and any alerts that were activated; the status of the controllable pitch propulsion system; and a precise record of vessel movements, among other information. The NTSB continues to promote requirements for VDRs to enhance the depth and quality of accident investigation, further the identification of marine safety risks, develop recommendations to address those risks, and enhance the safety of passengers on board ferries and other vessels. Moreover, many operators in other modes of transportation have voluntarily

NTSB

Marine Accident Report

viii

equipped their vehicles with data recorders, demonstrating that these devices can benefit operations.

NTSB Marine Accident Report 1 1 Accident Overview Voyage and Allision 1.1 The high-speed passenger ferry Seastreak Wall Street was under way on its second regular commuter trip of the morning when it struck a pier in lower Manhattan, New York City, on Wednesday, January 9, 2013.1 Of the 326 passengers on board, 75 sustained minor injuries, and 4 were seriously injured. Among the 5 crewmembers, 1 deckhand reported a minor injury. The ferry was northbound from Atlantic Highlands, New Jersey, and approaching Manhattan when it allided with Pier 11/Wall Street on the East River at 0841 eastern standard time.2,3 The Seastreak Wall Street is shown in figure 1.

Figure 1. Seastreak Wall Street.

1 According to 46 United States Code (USC) 2101, a ferry is a vessel used on a regular schedule to provide transportation only between places not more than 300 miles apart and to transport passengers or vehicles or railroad cars that are being used or have been used in transporting passengers or goods. 2 The term allision refers to a vessel striking a fixed object; in a collision, one vessel strikes another. 3 Unless otherwise noted, all times in this report are eastern standard time (coordinated universal time – 5 hours) and are based on the 24-hour clock.

NTSB Marine Accident Report 2 Verrazano–Narrows Bridge Verrazano– Narrows Bridge Manhattan Manhattan Staten Island, NY Staten Island, NY Brooklyn Brooklyn Lower Bay Lower Bay Upper Bay Upper Bay Atlantic Highlands, NJ Atlantic Highlands, NJ Pier 11

Pier 11 Sandy Hook Sandy Hook Verrazano–Narrows Bridge Verrazano– Narrows Bridge N The captain told investigators that, as the Seastreak Wall Street approached the pier, he gradually reduced the vessel’s speed and began turning to port to dock at Slip B, starboard side to the pier. He said he discovered he was unable to further slow the vessel before the ferry reached the dock, and he did not have time to warn the passengers or sound the danger signal because the event took place so quickly. The Seastreak Wall Street’s speed was about 12 knots when it struck the pier. After impact, both main propulsion engines continued running for about 68 seconds, consistent with the time the vessel ran aground in shallow water near the pier. The captain said he instructed a crewmember to restart both engines and then maneuvered the vessel to Slip B at Pier 11 about 7 minutes later. Figure 2 depicts the Seastreak Wall Street’s route from New Jersey to Manhattan. Figure 3 plots the last 7 minutes of the ferry’s voyage. Figure 2. Approximate track of the Seastreak Wall Street from Atlantic Highlands to Manhattan is shown in red. (Background by Google Earth)

NTSB Marine Accident Report 3 Figure 3. Automatic information system (AIS) data showing the ferry’s trackline for the last 7 minutes of the accident voyage, including impact with the pier, grounding in shallow water nearby, and finally docking at another pier. Times are shown at locations where this information is available. (Background by Google Earth)

When the ferry was secured alongside Slip B, first responders already on scene boarded the vessel to assess injuries and begin transporting the injured to area hospitals. The first US Coast Guard unit arrived at the pier at 0930 to facilitate emergency response and begin its investigation. Injuries 1.2 Injuries sustained in the Seastreak Wall Street accident are summarized in figure 4. Type of Injury4 Crew Passengers Other Total Fatal 0

0 0

0 Serious 0

4 0

4 Minor 1

75 0

76 None 4

247 0

251 Figure 4. Injuries sustained in the Seastreak Wall Street allision.

4 Title 49 Code of Federal Regulations (CFR) 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns or any burn affecting more than 5 percent of the body surface. The NTSB considers any injury that is not fatal or serious to be minor. Slip D Slip B Pier 11

NTSB Marine Accident Report 4 Of the four seriously injured passengers, one required surgery as well as ongoing treatment and rehabilitation following release from the hospital. The other three were treated and released. One seriously injured passenger fell down a staircase and hit the overhead section of the stairwell structure. His injuries included a broken neck, brain hemorrhage and contusions, lung collapse, facial fractures, lacerations, nerve injuries, and scalp lacerations. The passenger required surgery as well as ongoing treatment and rehabilitation after he was discharge from the hospital more than 5 weeks after the accident. The other three seriously injured passengers included one who was standing halfway down the starboard outboard stairs and sustained three broken ribs, face laceration, and a knee contusion. Another passenger fell down 10 steps and suffered a head laceration, minor concussion, and neck pain and required shoulder joint cartilage surgery. The third was thrown off balance and fractured a shoulder blade. These three passengers were treated and released from the hospital. Damage to Vessel and Pier 1.3 1.3.1 Seastreak Wall Street The Seastreak Wall Street sustained damage to the bow of its starboard hull and minor damage to the passenger cabin, and its port propeller was fouled with debris. The total estimated cost of repairs was about $166,200. One interior window at the bottom of a stairwell was broken, broken glass was found in the main deck forward stairwell and at the second deck starboard aft door, and a passenger seat back rest on the main deck was broken. Damage to the vessel hull was principally to the starboard bow and to the cross-member connecting the two hulls. Impact to the starboard hull at the point where it struck the pier resulted in a 30-inch opening beginning about 30 inches above the waterline and extending 45 inches at the lower side and 76 inches at the upper side. In this area, the side shell was crushed and peeled away from the hull, and internal frames were displaced (see figure 5).

NTSB Marine Accident Report 5 .

Figure 5. Damage to the Seastreak Wall Street starboard bow.

After the accident, a diver found the port propeller was fouled with a 4-foot steel bar and a 3-foot length of stranded wire cable of unknown origin (see figure 6). When the vessel was hauled out of the water for hull repairs, both the port and starboard propellers were found to be damaged, and the port propeller cone was missing (see figure 10 in section 1.6.2) for an illustration of a propeller and cone). Damage to the port propeller consisted of gouges and dents at blade tips, with significant deep scratches on the faces of the blades near their leading edges. The starboard propeller was similarly bent and gouged at the tips of all four blades.

NTSB Marine Accident Report 6

Figure 6. Debris found in ferry propeller, a 3-foot length of wire cable and 4-foot steel bar, both about half an inch in diameter.

1. 3.2 Pier 11, Slip D2―Dock Barge Desiree M

The dock barge Desiree M served as Slip D2 of Pier 11. The barge, 108.5 feet long and 35 feet wide, sustained an 8-inch-wide puncture of its hull and deck distortion in the area of the point of impact as well as damage to the fender, sideloader screw jack, platform, and gangway from the barge to the pier. A portion of the damage is shown in figure 7. The total cost of repairs was $333,349.

Figure 7. Damage to the Slip D2 dock barge, gangway, and upright supports.

NTSB Marine Accident Report 7 Waterway 1.4 The New York–New Jersey port district includes 650 miles of navigable waterways along New York City and northeastern New Jersey, encompassing about 240 miles of shipping channels, anchorages, and port facilities. Several public and private commuter ferry operations serve the area. The East River, where the accident occurred, is a 14-mile-long tidal strait that connects Long Island Sound with New York’s Upper Bay and runs between the western end of Long Island and the eastern side of lower Manhattan. The southern end of Manhattan is noted for its strong tidal currents. According to the National Oceanic and Atmospheric Administration (NOAA) predicted tidal currents for the Brooklyn Bridge, which is about 0.3 miles from Pier 11, slack water on the day of the accident was at 0712, and a maximum ebb current at 1007 was 222 degrees true at 4 knots.5 Water temperature was 43°F. At 0841 at Pier 11, the Seastreak Wall Street would have experienced an ebbing current of about 2 knots, which was confirmed by the ferry’s captain. Weather Conditions 1.5 Official meteorological observations closest to the accident location were recorded by automated stations at LaGuardia Airport, about 8.5 miles northeast of the accident site, and Newark Liberty International Airport, about 8 miles west of the accident location.6 At the time of the allision, the wind was reported calm, and visibility was unrestricted up to 6 miles. The Coast Guard Sector New York Command Center/Vessel Traffic Service reported clear weather, good visibility at 10 miles or more, northwest winds at 4 knots, and air temperature of 42°F. Vessel Information: Seastreak Wall Street 1.6 1.6.1 Vessel Structure and Design The Seastreak Wall Street was a twin-hulled catamaran classified by the Coast Guard as a domestic high-speed vessel and certificated as a small passenger vessel. Originally constructed with waterjet propulsion, the vessel underwent major refitting from February through July 2012. The four main engines were replaced with two diesel engines, the waterjets were replaced with controllable pitch propellers, and new propulsion and steering control systems and rudders were installed.

5 Slack water occurs when no current is present. Data on tidal currents are from NOAA (see References). 6 The National Weather Service (NWS) and Federal Aviation Administration designate official weather reporting stations. The LaGuardia and Newark airport stations are part of the NWS Automated Surface Observing System, one of the primary weather data collection and measurement networks in the United States.

NTSB Marine Accident Report 8 The Coast Guard deemed the work a major conversion under 46 United States Code (U.S.C.) 2101(14a), inspected the refitted vessel during this overhaul, and issued a certificate of inspection on July 24, 2012. The vessel’s particulars are detailed in figure 8. Vessel name Seastreak Wall Street Vessel type Small passenger vessel (ferry), inspected Flag United States Managing owner/operator Seastreak LLC Port of registry Atlantic Highlands, NJ Official number (US) 1145690 International Maritime Organization (IMO) number 8982010 Builder, date Gladding-Hearn Shipbuilding, Somerset, MA Delivered September 30, 2003 Classification society n/aa Construction Welded marine-grade aluminum, twin hull Length 130.6 ft (39.8 m) Breadth 34.2 ft (10.4 m) Draft 6.6 ft (2.0 m) Gross registered tons 98 (417 ITCb) Engine type, power Two 2,467-hp (1,840 kW) MTU Friedrichshafen diesel engines, geared drive, twin controllable pitch propellers, twin rudders Persons on board 326 passengers 5 crewmembers a According to section 1.1 of the original version of the Seastreak Wall Street Vessel Operating Manual, the ferry was built to (but not classed to) Det Norske Veritas (DNV) High Speed Vessel Rules. See the docket for this accident investigation (DCA13MM005) at http://www.ntsb.gov. b Measured according to the IMO International Convention on Tonnage Measurement of Ships (ITC), in force 1982. Figure 8. Vessel particulars for Seastreak Wall Street. The ferry provided passenger seating on three decks. The first and second deck seating areas were fully enclosed and air conditioned, while the third deck was open and uncovered for seasonal passenger seating. At the time of the allision, the third deck was closed to passengers. The navigation bridge was at the forward end of the second deck. Figure 9 depicts the layout of the Seastreak Wall Street.

NTSB Marine Accident Report 9

Figure 9. Profile view of the Seastreak Wall Street indicating deck levels and location of the bridge. The vessel’s controllable pitch propulsion system is highlighted in red from the engine to the propeller. (Vessel drawing provided by Seastreak)

Passenger access between the three deck levels was by use of inclined ladders, or stairs. Three stairwells were fitted between the first and second deck passenger compartments: a double-width stairwell was at the forward section of the deckhouse, and just aft of midships was a single-width stairwell at each side of the passenger cabin. Fitted between the second deck (aft of the deckhouse) and open third deck was a double-width stairwell. These four stairwells were aligned longitudinally along the vessel. A fifth single-width stairwell was fitted aft of the deckhouse and aligned transversely to the vessel. The two 9-foot-wide catamaran hulls were connected by a bridging structure on which the deckhouse was mounted. Each catamaran hull had five watertight compartments with spaces for fuel, water, and sewage holding tanks as well as compartments for machinery and steering gear. Contained at the aft end of each hull was a machinery space and lazarette. Within the machinery space were a main propulsion engine, propulsion system electronic controls, main reduction gear (gearset), 110 kW diesel-electric generator, and associated auxiliary equipment. An independent steering gear system was fitted in a lazarette. 1.6.2 Engines and Propulsion System An independent diesel propulsion system, manufactured by Servogear AS of Norway, was fitted in the aft section of each of the two hulls, port and starboard, and each diesel engine drove a controllable pitch propeller (CPP). Except for the main engines, Servogear designed, built, and supplied the propulsion system as the Servogear Ecoflow Propulsor™ package, promoted as providing higher efficiency, lower fuel consumption, more economical operation, and less pollution. Figure 10 depicts the components of the Ecoflow Propulsor. Control systems for the vessel’s propulsion and steering were manufactured by Scana Mar-El AS, a subcontractor to Servogear. Bridge 3rd deck (exterior seating) 2nd deck 1st deck Waterline Controllable pitch propeller and drive shaft

NTSB Marine Accident Report 10

Figure 10. Servogear Ecoflow Propulsor system components. (Schematic drawing by Servogear)

1. 6.3 Bridge Controls

The Seastreak Wall Street could be controlled from any of three stations on the bridge, located center, port, and starboard. The layout of the bridge and the control stations is shown in figure 11.

Figure 11. Simple schematic of Seastreak Wall Street’s bridge indicating center, port, and starboard control stations (details not identical to those of the ferry as constructed). The bridge is 34 feet wide. (Drawing excerpted from Seastreak vessel plan) The three bridge control stations were the primary operator interfaces with the propulsion and steering control systems. They were identical in design and layout, and each had all the necessary components to monitor and control the engine rpm and propeller pitch for both starboard and port propulsion systems. Each station included controls for both propulsion systems, port and starboard: two order levers, two button and alarm indicator panels located on Forward Center control station Starboard control station Port control station Windows Passenger seating Operator seating

NTSB Marine Accident Report 11 either side of the order levers, two analog rudder angle indicators, two digital propeller pitch indicators, and two main propulsion engine and propeller shaft rpm indicators (see figure 12). An operator could quickly shut down the port or starboard main engine with an electronic emergency stop function. This could be ordered from the engine room or from the center bridge control station using two red pushbuttons, one for each engine. Figure 12. Photo of bridge control panel showing order levers, pushbutton controls and alarm displays, and engine and propulsion controls and indicators.

Two operating modes and a Backup system were available to control the main engine rpm and propeller pitch when maneuvering the vessel:  Combinator mode. This was the Seastreak Wall Street’s normal operating mode. The order lever simultaneously controlled both engine rpm and propeller pitch according to a fixed relationship, with a linear scale at the control station indicating the percentage of power ordered ahead or astern.  Constant rpm mode. In this mode, the engine rpm was preset to a fixed value and did not vary as the propeller pitch changed. The order levers could control only pitch. This mode was not normally used on the ferry.

NTSB Marine Accident Report 12  Backup system, or mode.7 If a control system failure occurred, the propulsion mechanism automatically switched to Backup mode, and a steady audible alarm sounded until reset by the operator. This system allowed the operator to control engine rpm and pitch functions separately, if necessary. The order levers controlled engine rpm, and pushbuttons controlled propeller pitch. Only one of the three bridge propulsion control stations could be active at one time, indicated by illumination of a red light emitting diode (LED) in the In Command button at that control station.8 To transfer control from one station to another, an operator performed two basic actions from the station where control was wanted:

1. Move order levers to the same position as order levers at the station currently in

control and

1. Push the In Command button.

A successful control transfer resulted in a steady light in the In Command pushbutton. Once a command change request was initiated, if the position of the requesting control station’s order levers were not matched within plus or minus 10 percent of the In Command station’s order levers, an audible alert and a flashing LED lamp in the pushbutton indicated incomplete transfer of control. If the command transfer did not take place within about 15 seconds, the light would stop flashing and turn off. NTSB investigators demonstrated activation of the audible alert while testing the system on scene.9 Each control station was fitted with a monitoring system that would activate other visual and audible alarms to indicate, for instance, loss of control voltage or failure of the propulsion system. In the event of a system failure, the propulsion system would automatically shift to Backup mode for pitch control and sound a steady audible alarm to indicate Backup control was active until reset by the operator. Backup mode could also be manually selected by the operator. The control system was unable to save a history log of system faults, however, so no record of control system alarms occurring around the time of the accident was available for analysis by investigators. Seastreak Ferry Operations 1.7 Seastreak LLC operated seven vessels, four of which were high-speed catamarans―the Seastreak Wall Street and three other ferries equipped with the original waterjet propulsion. The

7 The Scana propulsion control system user manual also identified the Backup system as “individual mode.” Also, The Seastreak Wall Street system was not fitted with a separate lever for pitch control as described in the user manual; pitch was controlled using pushbuttons. See “User manual: Neptune Compact CPP, Propulsion Control System,” section 7.1.2, initially released by Scana in 2003 (also see References). 8 These and other pushbuttons on the propulsion control panel were membrane switches rather than mechanical pushbutton switches. The membrane switches had integral red LED lamps to indicate system status. 9 Investigators measured the duration of the alarm while testing the vessel’s propulsion controls. This alert is not documented in the propulsion system operating manual.

NTSB Marine Accident Report 13 vessels offered daily passenger ferry service between Manhattan and central New Jersey as well as seasonal ferry service between New Bedford, Massachusetts, and the ports of Oak Bluffs and Vineyard Haven in Martha’s Vineyard, Massachusetts. The owners of Seastreak LLC also owned and independently operated Moran Towing Co. and the Interlake Steamship Company. Together, the companies operated 9 Great Lakes freighters, 105 tugs, 25 barges, and 7 passenger ferries. Regulatory Authority 1.8 The Seastreak Wall Street was a small passenger vessel, inspected and certificated by the Coast Guard under regulations at 46 CFR Parts 114–124 (Subchapter K). After the Coast Guard issued a 5-year certificate of inspection (COI), the vessel was subject to annual Coast Guard inspections of its machinery and safety equipment, the number of crewmembers, and their performance of emergency drills as required by these regulations. The vessel received an initial COI following construction in September 2003, and the COI was renewed in 2008 and on July 24,

1. The Coast Guard conducted the required hull inspections at 2-year intervals.

Because Seastreak LLC wanted to operate its high-speed ferries at speeds of 30 knots or more, the vessels were also subject to Coast Guard Navigation and Vessel Inspection Circular (NVIC) 05-01, “Guidance for Enhancing the Operational Safety of Domestic High-Speed Vessels”10 (Coast Guard 2001). The NVIC included a description of the regulatory authority each Coast Guard officer in charge, marine inspection (OCMI), might use to set additional operational parameters when a vessel operates at 30 knots or faster.11 Seastreak and the Coast Guard identified the particular hazards of operating at 30 knots or more and agreed upon measures to mitigate those hazards, as outlined in NVIC 05-01. Accordingly, the Coast Guard required that Seastreak create and comply with a training manual and an operations manual that addressed the identified risks posed by high-speed operations in that sector.12 Following approval of the manuals, the Coast Guard endorsed the vessel’s COI on November 8, 2010, for operations at 30 knots or more. The Coast Guard inspector who was the primary author of the NVIC told investigators that the NVIC was intended to address issues that might develop when a vessel was actually operating at 30 knots or more. According to this inspector, when a vessel slowed down to less

10 In NVIC 5-01, the Coast Guard defines a high-speed vessel as having a loaded service speed greater than 30 knots. (See References, United States Coast Guard, Navigation and Vessel Inspection Circular No. 5-01, “Guidance for Enhancing the Operational Safety of Domestic High-Speed Vessels.”) 11 The OCMI is the Coast Guard official responsible for the inspection of vessels in order to determine that they comply with applicable laws, rules, and regulations (33 CFR 1.01–20). 12 NTSB investigators found that Seastreak’s high-speed operations manual required by the COI, in addition to containing requirements for operating at 30 knots or more, included procedures for departure and arrival and information on best industry practices as identified by a joint Passenger Vessel Association/Coast Guard high-speed craft working group.

NTSB Marine Accident Report 14 than 30 knots, the NVIC no longer applied, and the vessel operated as any other small passenger vessel in accordance with applicable regulations in Subchapters T or K of CFR Title 46.13 The Coast Guard’s vessel inspection and review procedures and certification requirements are discussed in more detail in section 2.3, Seastreak Management Oversight. Personnel Information 1.9 Captain. The captain of the Seastreak Wall Street, 36 years old at the time of the accident, started working as a deckhand on charter fishing boats at age 15. In 1996, he began working for a ferry company and then was hired by Seastreak’s predecessor company in 1998, first as a deckhand and then as an engineer, from 1996 to 2000. In 2000, he obtained his 100 ton master’s credential (near-coastal) and began working part-time as a captain, becoming a full-time captain in 2001. His credential carried no medical restrictions, and he was taking no medications. Mate. The mate, age 31, began working part-time on weekends as a deckhand on charter fishing boats at age 15 and worked full-time on charter boats since he was 21. In 2010, he was credentialed as a 100 ton master (near coastal), and in April 2012, he came to work as a deckhand with Seastreak. He also completed training as a radar observer 2 months before the accident. The mate was the Seastreak Wall Street’s second in command. In addition, he reported the passenger ticket count and handled the ferry’s lines when mooring. He was on the bridge at the time of the accident. Deckhands. The vessel crew also included three deckhands whose positions on the ferry did not require merchant mariner credentials. One deckhand served in the US Navy and then worked as a civilian ordinary seaman and able seaman on a Military Sealift Command tanker. At the time of the accident, he had been working for Seastreak for 1.5 years and had served 1 year in the US Coast Guard Auxiliary. The second deckhand previously worked on charter boats, held a New Jersey Boater’s Safety Certificate for Recreational Craft, and was qualified as a New Jersey Fire Fighter I. He was serving as a volunteer fire fighter in his department’s marine unit as well as working as a deckhand for Seastreak, where his duty under way was tending the bar. The third deckhand had been working as an engineer for Seastreak for 3 months at the time of the allision. He previously served 8 years at sea in the Myanmar merchant marine. He was licensed in Myanmar as a chief engineer and held a bachelor’s degree in mechanical engineering. He monitored maintenance of the main propulsion engines and generators, checked fluids, and recorded pressures and temperatures.

13 Regulations, including equipment and operating requirements for small passenger vessels, are found in 46 CFR Subchapter K, Small Passenger Vessels Carrying More than 150 Passengers or with Overnight Accommodations for More than 49 Passengers (Parts 114–124), or Subchapter T, Small Passenger Vessels (Under 100 Gross Tons) (Parts 175–187).

NTSB Marine Accident Report 15 Toxicological Testing 1.10 The Seastreak Wall Street crew submitted specimens within the required time frame for toxicological testing, 2 hours after the accident for alcohol and 32 hours for drugs.14 All results were negative for alcohol and the five classes of illicit drugs for which the Coast Guard, in accordance with US Department of Transportation regulations, requires postaccident screening: marijuana, cocaine, opiates, amphetamines, and phencyclidine.

14 Time frames for toxicological testing are specified in 46 CFR 4.06-3 and apply to time elapsed following a serious marine accident, unless precluded by safety concerns directly related to the accident.

NTSB Marine Accident Report 16 2 Investigation and Analysis In analyzing the circumstances of this accident, NTSB investigators collected and examined information and data from many sources, including:  Interviews with Seastreak Wall Street crewmembers, Seastreak management personnel, representatives of the vessel’s mechanical component manufacturers, Coast Guard personnel, passengers, and other witnesses;  The vessel’s AIS data provided by the Coast Guard;  The engine monitoring system and closed-circuit television (CCTV) captured on board the vessel;  Testing and examination of propulsion, steering, and control systems;  Usage records obtained from cell phone service providers, medical records provided by local hospitals, and information from the FDNY regarding the first response efforts; and  Documentation related to Seastreak company policies and governmental regulations, Seastreak Wall Street operating procedures, manufacturers’ manuals for vessel maneuvering and control systems, Coast Guard inspections, an underwater survey of the accident area, among other documents and records. Examination of the evidence indicated several conditions were not factors in the accident. Mechanical operation. The captain said he was unable to control the ferry’s propulsion system at the starboard control station as the ferry approached Pier 11. To determine whether a failure of the propulsion system caused or contributed to the accident, both the port and starboard propulsion systems were extensively examined and tested. Over several days following the accident, investigators functionally tested the port and starboard propulsion control systems in a variety of configurations and modes, including with and without the main propulsion engines operating, both pierside and under way. Both port and starboard system responses to control inputs were satisfactory, and system operation indicated no anomalies in the tests performed. All propulsion and steering system components were found to be fully operational. Investigators tested transfer of control between the three propulsion control stations on the bridge, also without operational anomalies. In addition to functional testing of the propulsion control system, investigators thoroughly examined the system’s hardware—its electrical and mechanical components—for indications of damaged components or loose electrical connections. No abnormal conditions were found with any of these systems’ components.

NTSB Marine Accident Report 17 The port and starboard propulsion control systems were fully independent and redundant, with battery-backup supplies to power propeller pitch control in the event of main power loss. The propulsion control system was designed to be failsafe, as required by Coast Guard regulations at 46 CFR 62.30-1, and Coast Guard Marine Safety Center personnel verified that design.15 Local Coast Guard marine inspectors checked that the system installation complied with these regulations before the vessel was certified to carry passengers.16 NTSB investigators found no operational anomalies in the propulsion system during postaccident examination and testing, and the system had a history of reliable operation. Cell phone use. Records were retrieved from cellular service providers in response to NTSB subpoenas for cell phones carried by the captain and the mate on the bridge at the time of the accident as well as the company phone kept on the bridge. Review of the timing of incoming and outgoing calls revealed no evidence that the captain or the mate had been using cell phones at the time of the accident. Fatigue and medical factors. NTSB investigators examined the sleep schedule of the captain, the sole operator of the ferry, to determine whether fatigue played a role in the accident. The captain was not diagnosed with a sleep disorder and was not taking prescribed or over-the- counter medications in the days leading up to the accident. His schedule preceding the accident was consistent; he slept about 7 hours a night, sleeping and arising about the same time each day. The accident occurred in the morning, after he had operated one round-trip from New Jersey to New York City, at a time when he ordinarily was awake. The day before the accident, the captain napped for more than 2 hours between his morning and afternoon shifts, and that night he slept just over 7 hours, for a total of more than 9 hours in the preceding 24 hours. This amount of sleep was sufficient to preclude an acute sleep loss at the time of the accident. He suffered neither a chronic nor an acute sleep deprivation and sustained no disruption to his circadian sleep cycles before the accident. In addition, no evidence indicated that the captain had a sleep-inhibiting medical disorder or used sleep-impairing medication. Therefore, investigators believe the captain had sufficient rest at the time of the accident to avoid being fatigued. Based on toxicological analysis, Coast Guard records, and the captain’s statements, he was not subject to any impairing medical condition, was not taking prescribed or illicit medications that could have adversely affected his performance, and maintained a regular sleep schedule in the days preceding the accident.

15 The Coast Guard Marine Safety Center (MSC) is responsible for “verification of compliance with technical standards for the design, construction, alteration, and repair of commercial vessels” through examination of plans for conformance with US laws and regulations as well as international standards. For further information, see http://www.uscg.mil/hq/msc. 16 According to Coast Guard regulations at 46 CFR 62.35-5(e)(3), remote propulsion control systems “must be failsafe by maintaining the preset (as is) speed and direction of thrust until local manual or alternate manual control is in operation, or the manual safety trip control operates. Failure must activate alarms on the navigating bridge and in the machinery spaces.” The failsafe state is defined in 46 CFR 62.10-1(a) as “a pre-determined design state of least critical consequence.”

NTSB Marine Accident Report 18 Weather. Meteorological surface and visibility conditions did not affect the operator’s ability to maneuver the vessel. The NTSB therefore concludes that mechanical failure, distraction due to cell phone use, fatigue, use of alcohol or illicit drugs, the captain’s health, and weather were not factors in this accident. Emergency response. FDNY began dispatching units, including FDNY emergency medical services (EMS) responders, at 0843―about 2 minutes after the vessel allided with the pier. The first units arrived on scene at 0847, and personnel located injured passengers and crew and provided first aid. Other FDNY units also offered first aid, checked on the injured, and searched for anyone possibly in the river. Responders verified the vessel was secure to the dock and not taking on water and set up a casualty treatment site on the pier adjacent to the vessel. Fifty-three FDNY units were dispatched to the scene, including fire trucks, EMS units, a marine unit, a rescue unit, and hazardous materials and tactical support. The Seastreak vice president for operations said he received a call about 0845 from the mate on board the Seastreak Wall Street reporting the allision. The captain then took the phone, said the vessel had hit the pier and injured passengers needed ambulances, and asked him to call 911 for assistance. From Seastreak headquarters in New Jersey, however, the vice president was unable to reach New York emergency services, so he called the Coast Guard Vessel Traffic Service. The most seriously injured passenger was transferred to New York–Presbyterian Hospital. The ambulance left Pier 11 at 0940 and arrived at the hospital at 0947. Ambulances transported others needing additional treatment to several area hospitals. Given the quick response of emergency services and the rapid attendance to injured passengers, corroborated by witness accounts, the NTSB concludes that the emergency response by the Fire Department of the City of New York was timely and appropriate. Accident Events and Captain’s Actions 2.1 2.1.1 Approach to Pier and Allision Following installation of the vessel’s new propulsion system in July 2012, personnel from the manufacturer of the new controls trained the captain in operating the system. The captain then delivered the vessel from the shipyard in Louisiana, where the vessel had been refitted, back to its home port in New Jersey. The captain instructed other Seastreak captains in the new propulsion system and controls and was the primary operator of the ferry for more than 6 months. Therefore, investigators considered the captain to be trained and knowledgeable about the new system and its use in controlling the vessel. On the accident voyage, the captain followed the usual course through Sandy Hook Bay and Chapel Hill Channel in the Lower Bay, beneath the Verrazano–Narrows Bridge, and north along Anchorage Channel in the Upper Bay and Buttermilk Channel between Governors Island and Brooklyn to the East River. The 20-mile trip usually took 40–45 minutes.

NTSB Marine Accident Report 19 The first round-trip that day was uneventful, with all systems performing normally. On the second trip, the vessel’s AIS showed the speed of the vessel was 30.0 to 32.1 knots for most of the transit. When approaching the Verrazano–Narrows Bridge in the vicinity of Swinburne Island, the captain reduced speed to below 30 knots. During the captain’s second interview,17 he told investigators that just north of the bridge he felt a slight vibration. Suspecting that a propeller might be fouled, he switched from Combinator mode to Backup mode on both port and starboard systems and adjusted the starboard propeller pitch, but the vibration did not change. He stated he then changed the pitch slightly on the port propeller, and the vibration increased, which indicated to him the port propeller may have been fouled. He told investigators he did not believe the vibration would adversely affect the vessel so he returned the propulsion control to Combinator mode. AIS data show the vessel returned to a speed above 30 knots about 1.5 miles north of the bridge. Figure 13 depicts controls and indicators at a Seastreak Wall Street bridge control station panel.

Figure 13. Closeup of bridge control panel order levers and command buttons.

In the captain’s statements to investigators, he recounted his approach to Pier 11 as follows: When the vessel was about 500 yards from the dock, he began the ferry’s approach by gradually moving the order levers from 100 percent to 0 to slow the vessel. He moved to the

17 During the captain’s first interview with investigators, he did not mention changing to Backup mode during the voyage but did describe Backup mode and its purpose and function.

NTSB Marine Accident Report 20 starboard control station and began turning the vessel toward Slip B at Pier 11. He pressed the In Command button to transfer propulsion control from the center control station to the starboard station. When he moved the port order lever at the starboard station in the reverse direction to further slow the vessel, he realized the propulsion system was not responding. He pressed the In Command button a second time but found the system still did not respond as he expected. The captain said he then applied full astern on both port and starboard order levers. He said he recalled hearing an alert but could not identify the time it sounded or its source. The mate said he was about to leave the bridge at this time for his mooring station when he heard the captain say he “had a problem,” so the mate stayed on the bridge. The captain told investigators he believed control must have remained at the center station, so he returned to that station and put both order levers in reverse, but the vessel still did not respond as he expected. He then returned to the starboard station to try the controls there, but the ferry struck the pier before he was able to regain control. As recorded by AIS, the Seastreak Wall Street was traveling about 12 knots when it allided with the corner of Slip D2 of Pier 11 about 0841. The captain did not broadcast a warning to passengers and crew or activate the emergency alarm before impact, nor did he direct the mate on the bridge to do so before impact. 2.1.2 Examination of Electronic Accident Data NTSB investigators recovered four sets of electronic data to be correlated during the analysis of this allision:  AIS data, including chronologically time-stamped information related to the vessel’s position, course, and speed;  Two independent sets of main propulsion engine data from the monitoring systems, with data items identified by operating time for each engine; and  Video from six CCTV channels—four views of the engine spaces, one view astern, and a view of the second passenger deck. The videos were time-related by an independent recorder clock. Based on AIS data, the time of allision was established as 0840:58. AIS information also indicated that speed decreased suddenly, in about 2 seconds, from nearly 12 knots to less than 1 knot, and this was used as a reference point to help time-synchronize the other data sets. The engine space video showed the effects of rapid deceleration, with unsecured objects moving suddenly. Video from the passenger deck showed passengers thrown forward at the same time. The engine space video also revealed camera vibration consistent with the engines still running for about 1 minute after the allision. The AIS and video footage helped investigators determine the time reference to analyze the engine data sets, which suggested that the engines continued to operate for about 68 seconds after the vessel struck the pier. Correlation of the four sets of recorded data indicated to investigators that the captain began to reduce engine power and slow the vessel about 700 yards from Pier 11 approximately 90 seconds before the allision. Vessel speed fell to 9 knots at 0840:10 before increasing to about

NTSB Marine Accident Report 21 14 knots at 0840:18. One limitation of the available data was the frequency at which information was recorded. The engine monitoring systems sampled data once per minute during normal operation. Each engine’s control unit also included a “crash recorder,” which activated after an engine shutdown. An engine shutdown resulted in data capture at three concurrent sampling rates: Time before engine shutdown Recording frequency 20 seconds 10 times per second 60 seconds Once per second 60 minutes Once per minute As engine monitoring data were recorded only once per minute during most of the voyage, the engine rpm is unknown during the 1-minute intervals between data points. After the ferry allided with the pier, AIS data show the vessel moved away from the pier and then moved south and west. Higher-frequency engine rpm data available for this period—up to 60 seconds after the allision—showed changes in rpm order and actual rpm. The vessel moved into a charted shallow area and likely struck submerged obstructions, damaging both propellers and causing both main propulsion engines to shut down. A crewmember was able to restart both engines, and the captain maneuvered the vessel to Slip B at 0848:30. With no indication of mechanical failure before the accident, the investigation focused on the captain’s operation of the vessel. Based on the vessel’s speed as it approached Manhattan, its propulsion system performance, and the captain’s and mate’s statements, the captain did not maintain propulsion control as the vessel approached the docks, and because he did not understand why this happened, he was unable take appropriate action to avert the allision. Investigators considered the possibility that the captain did not return propulsion control from Backup to Combinator mode after passing under the Verrazano–Narrows Bridge. Propulsion controls functioned differently depending on the system’s active operating mode. Figure 14 compares the significant difference between the ferry’s response to order lever movement when in Combinator mode and in Backup mode.

NTSB Marine Accident Report 22 Order lever movement Combinator mode Backup mode Forward

Engine rpm: Increases Propeller pitch: Automatically changes pitch ahead Unchanged from current position (adjusted manually using pushbuttons) Set to 0

Engine rpm Idle speed Propeller pitch: Moves to 0 Unchanged from current position (adjusted manually using pushbuttons) Astern

Engine rpm: Increases Propeller pitch: Changes pitch to astern Unchanged from current position (adjusted manually using pushbuttons) Figure 14. Comparison of vessel response when operator adjusts order levers in Combinator and Backup modes. The dark shaded area describes the vessel’s differing responses to setting order levers astern in Backup mode and Combinator mode. In Backup mode, order levers controlled only engine rpm at the station in command, and ahead and astern pitch were controlled by pushbuttons at any control station. If the propulsion system were in Backup mode, rather than Combinator mode, while approaching the pier and the captain moved the order levers astern, the propellers would still be in the forward pitch position. Thus, any increase in rpm—even if commanded by moving order levers astern—would cause the vessel to increase forward speed rather than slow down. This scenario is consistent with AIS speed data, which showed an increase of nearly 2 knots in the seconds prior to the allision. Because the vessel lacked a VDR, sounds from the bridge, such as a propulsion system alarm, were not recorded. Therefore, investigators could not verify whether the alarm sounded and, if so, why it activated, at what point in the voyage, and what caused it to stop, among other alarm characteristics. To transfer propulsion control to another control station, the order lever settings must be matched within plus or minus 10 percent. Otherwise, an audible alert and flashing light would activate to indicate the mismatch. The alert would continue until control transfer was completed or until the 15-second period allowed for transfer ended with transfer incomplete. While the captain stated he heard an alert that could have indicated an order lever mismatch, he could not identify the time or source of the alarm, so investigators were unable to determine how the alarm related to his operation of the vessel’s propulsion system. According to his statement, the captain’s practice when approaching Pier 11 was to transfer steering and propulsion control from the center to the starboard control station and then use CPP reverse thrust to smoothly reduce speed sufficiently to dock the vessel. Normally, Seastreak vessels were on a busy schedule, necessitating swift arrivals and departures. The

NTSB Marine Accident Report 23 Seastreak Wall Street captain was accustomed to these approaches and told investigators that he had no previous problems operating or transferring propulsion control. The available electronic evidence did not include pitch and mode information and the engine data were recorded at a low sampling rate. To collect additional information for further analysis, investigators conducted sea trials with the Seastreak Wall Street after the accident in both Combinator and Backup modes. NTSB investigators compared the sea trial data with the accident data and calculated the necessary shaft horsepower at various engine rpm settings. The vessel’s torque and rpm after passing the Verrazano–Narrows Bridge did not follow a relationship (curve) consistent with operation in the Combinator mode. The increase in torque observed in the last pre-allision data point is consistent with the behavior expected of a fixed-pitch propeller at a slower vessel speed (Backup mode) and is inconsistent with the behavior expected in Combinator mode. In Combinator mode, rpm and propeller pitch―and thus power―are a fixed function of command lever position. By about 0827, near the Verrazano–Narrows Bridge, this relationship changed: more torque was recorded for the same engine rpm. This correlation is consistent with propulsion behavior in Backup mode with the propellers at a less efficient pitch setting than would be provided while in Combinator mode. (See Appendix C for a more detailed explanation of these data relationships.) The NTSB believes the captain did not change the system back to Combinator mode after the bridge. The NTSB further believes that, approaching the dock in Backup mode, the captain successfully transferred rpm control to the starboard station and then moved the order levers astern expecting the vessel to slow. Because the vessel was still in Backup mode—and the pitch was still in the forward position—the order levers increased the rpm, causing an unexpected acceleration ahead. The NTSB concludes that the captain did not return the propulsion control system to Combinator mode after switching to Backup mode earlier in the voyage. The NTSB further concludes that the captain successfully transferred rpm control to the starboard station, and he attempted to slow the vessel by moving the order levers astern; however, this input resulted in forward acceleration because the system was in Backup mode. Although the Seastreak captain was experienced in operating the ferry, some circumstances of the accident trip were unusual. He was aware of the vessel’s slight vibration just after passing under the Verrazano–Narrows Bridge, in response to which he changed the propulsion mode from Combinator to Backup. He indicated in an interview that he had rarely used Backup mode with passengers on board. Operating in Backup mode presented a very different set of vessel responses to his commands. Given he was mistaken about which propulsion mode was active, he was unable to recover vessel control before impact. The captain’s inability to recognize this error was likely the result of two factors:  He was focused on attempting to avoid an accident when he returned to the center control station and the vessel was seconds from impact, and  The stress of the impending allision limited his ability to understand why he was unable to regain propulsion control at either station.

NTSB Marine Accident Report 24 The captain was required to attempt to avoid impact with the pier while diagnosing and addressing what was wrong. Despite his experience commanding the Seastreak Wall Street with the new propulsion system and instructing other crewmembers, the captain was not immune to making errors in controlling the system. If an operator made any errors at this point in the voyage that were not immediately identified and addressed, too little time and few options remained to resolve the situation. The NTSB therefore concludes that the point in the voyage at which the captain initiated transfer of the Seastreak Wall Street’s propulsion control did not allow sufficient time and distance to react to the loss of vessel control. Control Panel Design and Mode Indication 2.2 The propulsion control system provided mirror-image displays for the port and starboard propulsion systems, as shown in figure 13 above. Each control station panel included two identical arrays, one for controlling each of the two propellers. On either side of the order levers were 15 pushbuttons, 11 of which were assigned functions. The pushbuttons were identical in shape, color, and lettering, and each included a red LED in the upper left corner that would illuminate according to its functional status. In a stressful situation, looking at the control panel would require diverting attention from other critical tasks such as handling controls for an approach to the pier. Multiple LEDs would likely be illuminated. For example, in Combinator mode, the LEDs for 3 of the 11 pushbuttons would have been illuminated on each side. LEDs of identical color, luminosity, and size associated with identical buttons could confuse the operator. The design of these control panels could be improved to more readily display operating mode, applied pitch, and whether the control station was in command. Audible alerts and alarms also could be improved. As currently designed, engaging Backup mode triggers a constant audible alert that could only be reset by the operator. After the reset silenced the alert, no further alarm would sound to remind the operator that Backup mode was still active. If the operator approached a dock without realizing the propulsion system was in Backup mode, the vessel would not respond as expected, thus posing a safety hazard. A different, intermittent alarm would sound, regardless of propulsion mode, if an operator attempted to transfer propulsion control from one station to another without matching the control lever settings at both stations. This alert would terminate once the control lever settings matched or after about 15 seconds, regardless of whether the transfer had been completed. The system provided no indication of the reason for the alarm’s activation or silencing, whether it was due to the control transfer, and if so, whether the alarm had timed out or if the transfer was complete. Given these shortcomings in the identification, clarity, and helpfulness of the control panel display—particularly in indicating operating mode and status of control transfer—the NTSB concludes that the propulsion control system on the Seastreak Wall Street used poorly designed visual and audible cues to communicate critical information about mode and control transfer status. Such design shortcomings can lead to mistakes in operator performance, often referred to as “design-induced error.” The circumstances of this accident point to the need for equipment providers to create systems that meet human factors and ergonomic standards. The NTSB

NTSB Marine Accident Report 25 addressed design-induced error in three previous marine accident investigations in which operators were unaware of the features of the components they used, the particular control they were about to engage, or the active operating mode of a critical system (NTSB 1997, 2008, 2010). The NTSB issued a safety recommendation to the Coast Guard to work with the IMO to encourage the incorporation of human factors principles in system design and manufacturing.18 In this accident, however, critical vessel components were subject to Coast Guard oversight, but the Coast Guard does not apply human factors standards to the domestic vessels it regulates. The operator’s loss of vessel control highlighted by this investigation demonstrates the need for the Coast Guard to develop and implement design standards for domestically operated vessels that minimize the likelihood of design-induced error. Therefore, the NTSB recommends that the Coast Guard develop and implement human factors standards for the design of critical vessel controls for US-flag ships to include clearly identifiable and understandable audible alerts and displays indicating which mode is engaged. In addition, the NTSB recommends that Scana Mar-El AS modify its design for new Neptune Compact propulsion control systems to include clearly identifiable audible alerts and easily visible and understandable displays that will remind the operator when Backup mode is engaged and revise its owner’s manual accordingly. The NTSB also recommends that Scana Mar-El AS design a solution for existing Neptune Compact propulsion control systems to include clearly identifiable audible alerts and easily visible and understandable displays to indicate to operators when Backup mode is engaged, revise its owner’s manual accordingly, and alert its customers to the circumstances of this accident and to the availability of the retrofit solution. The NTSB further recommends that Seastreak LLC work with Scana Mar-El AS to implement a modification to the Neptune Compact propulsion control system that includes clearly identifiable audible alerts and easily visible and understandable displays to remind the operator when Backup mode is engaged. Seastreak Managerial Oversight 2.3 While shipowners are responsible for the safe management and operation of their vessels, Coast Guard inspection includes a review of vessel documentation, including training and operations manuals, if the vessel is required to provide them. Accordingly, the NTSB investigation considered the Coast Guard’s role in inspecting the Seastreak Wall Street and verifying that the vessel carried operations and training manuals required by NVIC 05/01. This guidance specified that the manuals outline certain instructions and procedures. In 2010, the Coast Guard approved the manuals on board the Seastreak Wall Street. In 2012, Seastreak asked the Coast Guard to evaluate its plans to modify the vessel’s propulsion system and submitted its failure modes and effects analysis (FMEA) for the Scana Mar-El control system. The Coast Guard issued a temporary COI to allow the Seastreak Wall Street to resume

18 Safety Recommendation M-11-14, currently classified as “Open—Acceptable Response.”

NTSB Marine Accident Report 26 service in July 2012 after the shipyard modifications. Despite the major conversion, Seastreak had not revised its training and operations manuals to address operation of the new propulsion control system. After the accident and subsequent repairs, the Coast Guard reinspected the vessel, and Seastreak submitted new manuals for review before the permanent COI was issued in 2013. Vessel owners and operators are responsible for updating these documents to reflect such changes to equipment. If Seastreak had had in place proper managerial oversight, document control, and auditing functions at that time, these measures would have identified and corrected any erroneous reference to the old propulsion system. 2.3.1 Company Procedures at the Time of the Allision The Seastreak Wall Street operations manual addressed such aspects of vessel operations as functional procedures, company and regulatory expectations, and minimum requirements for the safe operation of Seastreak’s four twin-hull craft (Seastreak LLC 2003). At the time of the accident, the vessel arrival procedures had not been updated since its modification to the new propulsion control system. The operating manual also did not require an arrival announcement to warn passengers to remain seated and stay away from stairwells while docking and undocking. According to the captain, he began his approach within 500 yards of Pier 11. He slowed the vessel down from about 30 knots, turned toward the pier, and attempted to transfer propulsion control. Company procedures did not require the captain to confirm the transfer of control with the mate, nor did they define a geographic range where this transfer should be completed prior to docking. Transferring steering and propulsion control from the center to the starboard control station upon approach improved the captain’s visibility when landing the vessel starboard side to the pier and was a normal, prudent operation which the captain had performed for several months. Company procedures also did not encourage use of the mate in the routine transfer of navigational control. The captain’s attempt to regain control without the mate’s assistance indicated that such assistance was not routine. To ease the workload the captain encountered as he approached the dock without propulsion control, he could have asked the mate to move to the center control station. From that position, the mate could have told the captain the order lever setting at the center control station, applied astern propulsion, or depressed the engines’ emergency stop buttons. The NTSB therefore concludes that Seastreak LLC bridge control transfer procedures at the time of the accident were inadequate as they did not reflect the new propulsion system nor did they define crewmember roles, which contributed to the loss of vessel control. Seastreak had no crowd control policy regarding passenger access to stairwells while docking and undocking. A Seastreak company official said, “Passengers are free to move about the vessel. . . . On a calm day, they are free to roam.” However, the number and severity of passenger injuries indicates a need for improved passenger protection measures. Medical records and passenger interviews indicate three passengers who sustained serious injuries were standing in stairwells during the docking attempt. The most seriously injured passenger, who had been standing in the starboard aft stairwell, suffered severe injuries when his head struck the stairwell overhead.

NTSB Marine Accident Report 27 Seastreak procedures could have outlined circumstances in which the captain or mate should sound audible emergency signals, make an announcement alerting the passengers and crew to impending danger, or both. The NTSB concludes that the number and severity of injuries resulting from this accident could have been mitigated by alerting passengers and controlling their access to stairwells during docking and undocking. After the accident, Seastreak amended procedures for all four of its high-speed ferries to include an arrival safety announcement directing passengers to remain clear of stairwells and crew to move to disembarkation stations. The revised arrival procedure also required a second qualified person on the bridge whenever paying passengers were on board except in three cases:  in an emergency,  when the vessel was at displacement speed (8–12 knots) with no other hazards present, or  when the vessel was within 200 yards of the dock and the captain had already confirmed the ship’s propulsion control had been successfully transferred. Due to the serious injuries to people who were in and near stairwells the NTSB issued a safety alert stressing the need for more awareness among ferry operators and passengers of this risk of injury.19 As safety alerts raise awareness about such important safety issues throughout the maritime community, the NTSB recommends that the Coast Guard distribute the National Transportation Safety Board safety alert outlining the circumstances of this accident to warn passenger vessel operators of the need to control passenger access to stairwells while performing maneuvers such as docking and undocking. As mentioned above, after the ferry was substantially modified in 2012, the vessel operating manual was not updated to reflect the new steering and propulsion equipment. An outdated manual reflects upon document relevance and management oversight at Seastreak LLC. In addition, neither management nor crewmembers noticed the specified procedures were incorrect. Seastreak also did not institute a formal training program for the vessel’s newly installed propulsion control system. The captain, who was informally trained by the manufacturer after the refitting, trained other captains on the system. Using this approach, the captain could have inadvertently passed along to those operators erroneous information regarding propulsion control. Training curricula on critical equipment should be established, tracked, and continually reassessed by company officials to ensure safe, optimal operation. The captain told investigators that he had learned of another captain who experienced difficulty transferring propulsion control to another station with the new equipment on the Seastreak Wall Street about 1 month after the modifications. The other captain had unsuccessfully

19 Safety Alert SA-034, titled “Passenger Vessels: Stairway Hazards during Docking and Undocking,” is provided in Appendix B and is also available at http://www.ntsb.gov/safety/safety_alerts.html.

NTSB Marine Accident Report 28 attempted to transfer control at 40 percent and had to discontinue a docking maneuver. Seastreak management’s assessment of the incident concluded that the transfer of control was rushed. This earlier incident was not well documented by the management team, which missed the opportunity to reduce the risk of a recurrence. This suggests a process is needed to capture critical incidents or occurrences and address risks with identified corrective actions. In addition, Seastreak management did not have a formal audit program in place to ensure its procedures were implemented, updated, and followed correctly. Due to inadequacies in its operational procedures and training, its failure to communicate circumstances regarding the earlier control transfer failure or take measures to prevent a recurrence, and the absence of a formal audit process, the NTSB concludes that Seastreak LLC provided ineffective oversight of the operation of the Seastreak Wall Street, including maintaining procedures that did not apply to the new propulsion configuration, providing inadequate crew training, and poorly identifying and mitigating risks. 2.3.2 Safety Management Systems One method for improving operational oversight is the implementation of a safety management system. An SMS provides a company with methods for identifying and mitigating risks to operational safety. The IMO developed international safety management standards in the 1980s following serious marine casualties caused by human error or management failure. This led to the development of the International Safety Management (ISM) Code, the purpose of which is “to provide an international standard for the safe management and operation of ships and for pollution prevention” (IMO 2010). The IMO adopted the ISM Code in 1993. In 1994, IMO members, including the United States, adopted the ISM Code as Chapter IX of the International Convention for the Safety of Life at Sea (SOLAS). In 1998, the ISM Code was made mandatory for vessels on international voyages, such as passenger ships, high-speed craft, tankers, and cargo carrier ships. For other cargo ships on international voyage, the ISM Code took effect in July 2002. Vessels in US domestic service, however, are not required to have safety management systems. The Coast Guard publishes US maritime rules for safe ship operation at 33 CFR Part 96, which also addresses safety management system certification of compliance with SOLAS Chapter IX. According to 33 CFR 96.230, a safety management system should meet several objectives:  Provide for safe practices in vessel operation and a safe working environment on board the type of vessel for which the system is developed;  Establish and implement safeguards against identified risks;  Establish and implement actions to continuously improve safety management skills of personnel ashore and aboard vessels, including preparation for emergencies related to both safety and environmental protection; and  Ensure compliance with rules and regulations.

NTSB Marine Accident Report 29 The CFR also provides several functional requirements that companies should incorporate in effective safety management systems:  Instructions and procedures to ensure safe operations of ships and protection of the environment, in compliance with relevant international and flag state legislation,  Defined levels of authority and lines of communication between and among shore and shipboard personnel,  Procedures for reporting accidents and nonconformities within the provisions of the ISM Code,  Procedures to prepare for and respond to emergency situations, and  Procedures for internal audits and management reviews. This accident identified several issues which would be resolved by a properly implemented SMS incorporating the objectives and functional requirements listed above. For instance, the outdated manuals described earlier demonstrated the need for document control procedures. An SMS requires a company to maintain documentation, define the lines of authority, and conduct periodic management reviews. On the Seastreak Wall Street, the mate’s role was not well defined, which left the captain unassisted as he tried to regain vessel control. An SMS also would require the company to maintain emergency procedures and define the mate’s and captain’s responsibilities during various situations. Further, the company had no auditing functions in place to verify the crew’s adherence to procedures. After a previous incident involving the Seastreak Wall Street’s new propulsion control system, no formal procedures were in place to identify corrective action. Finally, once an SMS is in place, management must provide employee training to integrate safe practices into routine vessel operations and prepare for emergencies. After the accident, Seastreak management told NTSB investigators that the company would begin developing a formal safety management system, even though an SMS is not required for domestic passenger ferry vessels. In its own assessment of the accident, Seastreak stated that an SMS will help to address risks such as those demonstrated by this allision. The process can be lengthy, however, to complete the review of documentation and other requirements to qualify for SMS certification. In February 2014, Seastreak reported substantial progress in updating and enhancing its safety program, including revising manuals, expanding passenger safety information, broadening crew training and performance requirements, and installing new equipment, among other improvements. Comprehensive SMS implementation can continue for years depending on the complexity of the company’s operations. Seastreak reported the company is working with a third- party contractor to include software for a preventive maintenance and deficiency tracking system. The company expects to complete its SMS documentation by mid-spring 2014 and to qualify for interim certification later this year (Bevins 2014). The NTSB continues to highlight the need for unambiguous, detailed operating procedures and believes they are prerequisite to managing a safe transportation system. A formal SMS is considered essential to enhancing the safety of Seastreak operations, and the NTSB therefore

NTSB Marine Accident Report 30 believes the company’s SMS should be implemented as quickly as possible with companywide support. The NTSB recommends that Seastreak LLC expedite the complete implementation of a safety management system for its fleet that is appropriate for the characteristics, methods of operation, and nature of service of its vessels and the size of its operations. In the months following the accident, Seastreak informed the NTSB that it changed its operations to include additional crew training to improve arrival and disembarkation procedures and crowd control, contracted for development of a continuous onboard passenger safety video and audio broadcast, and took other measures to improve vessel management and passenger safety. The company’s training of its crews can, if properly designed, help captains better utilize available bridge equipment and personnel. Given the shortcomings in Seastreak’s operations and training at the time of the accident, and until a fully functional SMS has been implemented, the NTSB recommends that Seastreak revise its operations and training manuals to include better utilization of crew and procedures for standard bridge operations, vessel emergencies, and control of passenger access to stairwells during docking and undocking. 2.3.3 Previous NTSB Actions Regarding Safety Management Systems The NTSB has investigated several accidents that highlighted the need for improved vessel procedures. The Staten Island ferry Andrew J. Barberi, operated by the New York City Department of Transportation (NYC DOT), allided with a maintenance pier on October 15, 2003. That vessel had very few instructions or operating procedures in place, as indicated in the NTSB accident report: Explicit procedures provide the guidance operators need to operate the systems as intended and ensure that regardless of the individual, the system will be controlled as appropriate for each phase of operation. In any ferry system, each crewmember should have duties delineated in the procedures for all operational phases, for both routine and emergency conditions. (NTSB 2005) After the accident, NYC DOT commissioned the Global Maritime and Transportation School (GMATS) to audit the management of the ferry system, and the GMATS report recommended the NYC DOT implement an SMS. Ferry Division staff planned to complete the SMS by October 2005, and in Safety Recommendation M-05-2, the NTSB asked the NYC DOT to adhere to this target date. The resulting SMS included emergency procedures for collision and allision response, postaccident crowd control, and crisis management, with specific step-by-step procedures. In the same accident report, the NTSB also issued Safety Recommendation M-05-6 to the Coast Guard: Seek legislative authority to require all US-flag ferry operators to implement safety management systems, and once obtained, require all US-flag ferry operators to do so. (NTSB 2005) On July 2, 2008, a collision between the Coast Guard cutter Morro Bay and the passenger ferry Block Island again stressed the need for detailed procedures on board passenger ferries. In particular, passengers generally thought a collision warning should have been made. Investigators

NTSB Marine Accident Report 31 found the company’s safety philosophy was informal, and evidence indicated management oversight had been insufficient. The NTSB report concluded that a safety management system at the company owning the Block Island ferry “could have contributed to more thorough operational procedures on the Block Island and greater oversight by management” (NTSB 2010). In October 2010, Congress passed the Coast Guard Authorization Act of 2010 (Public Law 111–281). Section 610 of the statute required the Coast Guard, in mandating SMS for passenger vessels, to consider the characteristics, methods of operation, and nature of the service of these vessels and, for ferries, the size of the ferry systems within which the vessels operate.” After a May 8, 2010, hard landing again involving the Andrew J. Barberi, the NTSB noted that implementation of detailed procedures had improved vessel operations and the emergency response by both the shipboard and shoreside employees “improved operational safety, including implementing a safety management system” (NTSB 2012). The NTSB concluded that the Ferry Division’s SMS provided more specific emergency procedures, which the crew and shoreside personnel performed in a timely and effective manner, thus increasing passenger safety. In that accident report, the NTSB closed Safety Recommendation M-05-6 and superseded it with Safety Recommendation M-12-3: Require all operators of US flag passenger vessels to implement safety management systems, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. (NTSB 2012) The 2012 allision of the cargo vessel Delta Mariner with Eggner’s Ferry Bridge near Aurora, Kentucky, involved a vessel operated by Foss Maritime Company, which had a fully operational safety management system. In that accident, the NTSB found, “After years of safe operations without adverse regulatory or safety reports, company attention to operational safety can decrease” (NTSB 2013). Investigators identified missed opportunities to address shortcomings in vessel operations and thus enhance safety. Even with a safety management system, the NTSB concluded that Foss Maritime Company provided ineffective oversight of the safety of Delta Mariner operations. This case illustrated that SMS is a tool for promoting risk mitigation behaviors and safety-oriented attitudes, but an effective SMS, even when regularly audited and found compliant with the ISM Code, depends greatly upon the commitment and motivation of all involved with the system to maintain its viability and effectiveness. The incorporation of an SMS into operations of the Andrew J. Barberi, particularly in emergency response and management, clearly demonstrates the benefits of these safety measures as well as a commitment to the intent of SMS principles. On May 23, 2013, the Coast Guard wrote to the NTSB, stating that it agreed with Safety Recommendation M-12-3 and was developing appropriate regulations for all US-flag passenger vessels. This response is a positive step. Nonetheless, more than 3 years have passed since Congress authorized the Coast Guard to mandate SMS, and nearly 1 year has passed since the Coast Guard indicated its intent to initiate rulemaking—without result. Until safety management systems are mandated for all US passenger vessels, an unacceptable variation in the standards of passenger and crew safety will persist between ferry operators. The NTSB is committed to the implementation of safety management systems on board all US-flag passenger vessels and therefore reclassifies Safety Recommendation M-12-3 “Open—Unacceptable Response.”

NTSB Marine Accident Report 32 Vessel Performance Data and Accident Prevention 2.4 2.4.1 Data Recording on the Seastreak Wall Street The ferry was not fitted with a voyage data recorder, nor was such carriage required for domestically operated passenger ferries. A VDR is a fire- and crash-protected recorder that captures critical vessel information as well as audio from the bridge environment. This information can be accessed by investigators following accidents and reviewed by vessel operators as part of their SMS programs. The NTSB previously recommended requiring VDR installation on newly built ferries and, for existing ferries, retrofitting a simplified VDR (S-VDR). An S-VDR, suitable for retrofitting on existing vessels, is required to record fewer parameters related to command and control of a vessel in addition to basic ship data, if the information was not available on the bridge in digital format.20 As the Coast Guard deemed the Seastreak Wall Street repowering project a “major conversion,” Seastreak likely would have been required to include a fully capable VDR in the refitting of the vessel had domestic passenger ferries been subject to VDR carriage requirements.21 The history of NTSB recommendations regarding VDRs is discussed further in section 2.4.2. Although some operating data were recorded by the engine monitoring units, VDR data would have provided more complete evidence regarding several significant aspects of the allision. For instance, a VDR could have recorded comprehensive engine, propeller, and steering orders and responses as well as audio recordings and main alarm activity. These data sets would have been central to determining the causes of the allision, and even an S-VDR on board the ferry, where data were available in digital form, would have captured this information. System information. Because the propulsion control system did not record any system information, investigators could not independently determine which control station was active when transfer between stations was initiated, which engine and propeller pitch commands were received by the propulsion system, and whether the propulsion system responded correctly. A VDR would have recorded this information. In addition, standard data recordings would have identified the time and magnitude of steering commands and system responses, which, along with evidence from other sources, would have helped to establish a more precise record of the captain’s actions as he approached the pier. Audio recording. The captain stated he recalled hearing an alarm at the starboard station at some time during his attempt to transfer control. He said he did not know which alarm sounded

20 IMO performance standards for S-VDRs (Resolution MSC.163(78)) require that any additional items not specified in the S-VDR standard but listed by IMO with the requirements set out in full VDR standard (Resolution A.861(20)) “should be recorded when the data is available in accordance with the international digital interface standards using approved sentence formatters (IEC 61162).” 21 In most cases, Coast Guard laws and regulations treated a vessel that had undergone “major conversion” as a new vessel as defined in 46 U.S.C. 2101(14a). In such cases, the owner was required to bring the entire vessel into compliance with the latest safety standards when reasonable and practicable.

NTSB Marine Accident Report 33 or at what point, and available data were insufficient to identify its cause or what it indicated. A VDR can record the time and identity of all major system alarms as well as a time-stamped audio record of all audible alerts that had activated. In addition, an audio recording from the bridge would have captured any comments by the captain or mate during the minutes before the allision, such as the captain’s observations regarding the difficulties he was experiencing and the nature of interactions between the two officers. Propeller pitch. A VDR would have captured how much pitch was ordered and delivered on each shaft, in what direction, and at what point in the voyage as well as activation of any pitch failure alarms. These data would have enabled investigators to determine when operational mode changes occurred. Commands and system responses during voyage. Data recorded by the engines’ electronic monitoring units were useful in understanding engine speed orders received, actual engine speeds, and engine load (torque) conditions. However, these data provided a limited record of engine parameters because most were recorded less frequently than a VDR requires. VDRs currently record 12 hours of data at a consistent frequency of one sample every second; therefore, a more detailed and longer account of the captain’s engine control inputs and engine responses would have been available for analysis. Actual propulsion commands. According to statements made by the captain, he slowed the vessel from 30 knots (100 percent thrust) to 0 thrust before attempting to transfer propulsion control. AIS speed data indicate a somewhat different record of engine thrust, such as an increase in throttle position and a possible attempt to transfer control at an order lever position other than 0 percent. While some engine data were recorded, in this critical portion of the voyage, data were recorded only once per minute. Had a VDR been fitted to the Seastreak Wall Street, an unambiguous, higher resolution record of propulsion and steering control inputs and system responses would have been available for analysis, and the vessel control actions made by the captain would have been better understood by investigators. Common time reference. All four electronic data sets recovered by investigators were recorded on an independent time reference. A VDR records data using a common time reference for all parameters. Had the ferry been fitted with a VDR, an unambiguous time reference for the data would have been available, which would have removed the uncertainty in correlating four sets of independently timed information. The benefits of recording operational data have led operators in other transportation modes to voluntarily equip their vehicles with recording devices. For example, many railroads have outfitted their locomotives with forward-facing video cameras, and many helicopter models now come equipped with cockpit area video, voice, and data recorders. Many motorcoach operators have equipped their coaches with inward- and forward-facing video cameras as well as engine data monitors. In addition to providing accident investigation benefits, VDRs can be valuable tools in a company’s SMS. Operators can review crew and vessel performance through data obtained

NTSB Marine Accident Report 34 during actual operations. The data can be used to study incidents, analyze vessel performance, and train operators. Although investigators gathered vital information from AIS reports, engine monitors, interviews, testing, documentation, and many other sources, the absence of a VDR on board the Seastreak Wall Street precluded access to additional critical data. Further, VDR records would have yielded information that could have enhanced the range and depth of evidence subject to analysis, closed gaps in information, and allowed resolution of conflicting information. The NTSB therefore concludes that information that could have been captured by a voyage data recorder would have enhanced the NTSB’s analysis of the loss of vessel control that caused the allision. 2.4.2 Previous NTSB Action Regarding Voyage Data Recorders Since 1976, the NTSB has consistently supported the fitting of recording devices such as VDRs in ferries and other vessels.22 Initially, the Coast Guard rejected the recommendations, citing excessive equipment cost and suggesting that VDRs were of limited value to investigations. The Coast Guard later concurred with the intent of subsequent new recommendations but took little positive action for reasons including funding limitations for studying the VDR issue. Since the development of international regulations for VDRs in 2000, the NTSB has investigated several other passenger vessel accidents in which the lack of information that would have been provided by a VDR created challenges for the investigation. For example, in its report on the 2008 collision of the US passenger ferry Block Island and Coast Guard cutter Morro Bay, the NTSB cited the reliance on limited information from crew and passenger interviews, electronic chart information, and security camera video (NTSB 2010). Data such as recorded conversations of crewmembers on the bridge, radar screen images, and vessel propulsion and steering control information were not available to investigators because neither vessel was fitted with a VDR. As a result of this investigation, the NTSB issued two recommendations to the Coast Guard: Require installation of voyage data recorders that meet the international performance standard on new ferry vessels. (M-10-5) Require installation of voyage data recorders on ferry vessels built before the enactment of voyage data recorder carriage requirements that will record, at a minimum, the same video, audio, and parametric data specified in the International Maritime Organization’s performance standard for simplified voyage data recorders. (M-10-6)

The Coast Guard did not concur with the recommendations, citing findings from its own 2008 congressionally mandated study to support its position (USCG 2008). The Coast Guard

22 The NTSB initially called for the fitting of “automatic recording devices,” and later “voyage event recorders,” before the development of international performance standards and the adoption of the term voyage data recorder.

NTSB Marine Accident Report 35 study recommended against requiring VDRs or S-VDRs on ferries but acknowledged the value of recorded vessel information and recommended instead that ferries be required to capture the same type of information a VDR recorded. The study found that VDRs would have provided relevant information in a small percentage of a set of historical accidents, that VDRs were a costly means to gain meager benefits, and that electronic chart systems (for which carriage requirements currently are still pending) would have recording capabilities similar to those of a VDR.23 As a result of the Coast Guard’s position, the NTSB considered this response unacceptable. The 2008 Coast Guard VDR study analyzed accident data for only the 75 largest US ferries, which was not a representative sample. In early 2014, 549 passenger ferries were operating in the United States. The Coast Guard conclusion regarding VDR benefits likely would have been different if the study had analyzed accident data for all ferries that would be subject to carriage requirements proposed by NTSB. The NTSB disagrees with the Coast Guard’s assessment because passenger safety is the most important aspect of vessel operations. The benefits to the traveling public warrant the installation of VDRs on passenger ferries, even if the costs of such installation are considered to be a burden. The NTSB has repeatedly found that when VDR data are available, investigations are more likely to result in well-developed findings and recommendations to enhance safety. The NTSB’s investigation of the 2010 allision of the passenger ferry Andrew J. Barberi also was hampered by a lack of VDR information. Although investigators obtained CCTV video recordings from the bridge, the system could not capture, record, and safeguard important detailed data from vessel navigation and control systems. As a result, investigators relied on witness statements, AIS data, and limited recorded engine data, and did not have the benefit of the rich data set that a VDR could have provided. The NTSB report of this accident reiterated VDR recommendations M-10-5 and M-10-6 from the Block Island–Morro Bay accident investigation. The Coast Guard responded to the NTSB’s reiteration of these recommendations by restating that it “feels that its original response remains appropriate” and the overall benefits of VDRs do not justify the cost. The NTSB strongly disagrees with this position. The cost of data recording devices has fallen dramatically in recent years. Although the NTSB realizes installation costs remain a barrier for older vessels, the S-VDR standard recognizes the challenges of interfacing with older vessels and makes allowances based on the equipment installed and the availability of the data in electronic format on the bridge. Installation of VDRs on new vessels during initial construction or vessels undergoing major refit, such as the Seastreak Wall Street’s 2011 modification, present a much lower cost hurdle. The Coast Guard did not restate its previously expressed view that an electronic chart system (ECS) would have recording capabilities similar to those of a VDR, perhaps because the

23 The US Marine Transportation and Security Act of 2004 mandated electronic navigation charts for all vessels required to be fitted with an AIS. According to a recent meeting summary report of the Coast Guard-sponsored National GMDSS Implementation Task Force, the Coast Guard work on this rulemaking is proceeding, and “the greatest challenges are determining its economic impact and which non-SOLAS vessels should be outfitted.” (See References, USCG 2013, “Newsletter and Summary Record of 26 September 2013 Meeting.”)

NTSB Marine Accident Report 36 Coast Guard’s rulemaking project for ECS carriage requirements has been pending for nearly 10 years with little indication of when it might be finalized. In addition, although the ferry was fitted with an ECS capable of recording navigation track history, it was not configured to do so. Coast Guard regulations at 46 CFR categorized passenger vessels into three distinct classes. The largest passenger vessels were classified as Subchapter H and Subchapter K vessels, and the smallest passenger vessels were classified as Subchapter T vessels.24 The NTSB believes that the greatest risk to passenger safety exists on vessels carrying the highest numbers of passengers, and therefore believes that these vessels should carry VDRs meeting the IMO performance standards. The IMO VDR standards were developed and revised over a number of years with input from accident investigators from many IMO member countries. These VDR performance standards represent the best thinking regarding which data are most important to accident investigation and how that data should be recorded in terms of security, integrity, format, and resolution. Equipment meeting IMO VDR performance standards has been successfully installed on thousands of vessels around the world, is competitively priced, and is available in the marketplace now. This investigation again demonstrated the high value of VDR data to accident investigation, and the NTSB therefore recommends that the Coast Guard require installation of voyage data recorders that meet the International Maritime Organization’s performance standard on new ferry vessels subject to 46 Code of Federal Regulations Subchapters H and K. Further, recognizing the technical and financial challenges facing the installation of VDRs on existing (and usually older) vessels, the NTSB recommends that the Coast Guard require installation of voyage data recorders that meet the International Maritime Organization’s performance standard for simplified voyage data recorders on existing ferry vessels subject to 46 Code of Federal Regulations Subchapters H and K. In light of these new recommendations, the NTSB reclassifies Safety Recommendations M-10-5 and M-10-6 “Closed―Unacceptable Action/Superseded.” Moreover, the NTSB recognizes that for many smaller ferries subject to Subchapter T regulations, installation of a VDR or S-VDR meeting international IMO performance standards is usually not technically or financially feasible, and a lower cost solution could be developed and applied to these vessels. The NTSB therefore recommends that the Coast Guard develop a US voyage data recorder standard for ferry vessels subject to 46 Code of Federal Regulations Subchapter T and require the installation of such equipment where technically feasible.

24 Subchapter H applies to passenger vessels of greater than 100 gross tons. Subchapter K applies to vessels of less than 100 tons that carry more than 150 passengers or have overnight accommodations for more than 49 passengers. Subchapter T applies to vessels of less than 100 tons that carry 150 or fewer passengers or have overnight accommodations for 49 or fewer passengers.

NTSB Marine Accident Report 37 3 Conclusions Findings 3.1

1. Mechanical failure, distraction due to cell phone use, fatigue, use of alcohol or illicit

drugs, the captain’s health, and weather were not factors in this accident.

The emergency response by the Fire Department of the City of New York was timely and appropriate.

The captain did not return the propulsion control system to Combinator mode after switching to Backup mode earlier in the voyage.

The captain successfully transferred rpm control to the starboard station, and he attempted to slow the vessel by moving the order levers astern; however, this input resulted in forward acceleration because the system was in Backup mode.

The point in the voyage at which the captain initiated transfer of the Seastreak Wall Street’s propulsion control did not allow sufficient time and distance to react to the loss of vessel control.

The propulsion control system on the Seastreak Wall Street used poorly designed visual and audible cues to communicate critical information about mode and control transfer status.

Seastreak LLC bridge control transfer procedures at the time of the accident were inadequate as they did not reflect the new propulsion system nor did they define crewmember roles, which contributed to the loss of vessel control.

The number and severity of injuries resulting from this accident could have been mitigated by alerting passengers and controlling their access to stairwells during docking and undocking.

Seastreak LLC provided ineffective oversight of the operation of the Seastreak Wall Street, including maintaining procedures that did not apply to the new propulsion configuration, providing inadequate crew training, and poorly identifying and mitigating risks.

Information that could have been captured by a voyage data recorder would have enhanced the National Transportation Safety Board’s analysis of the loss of vessel control that caused the allision.

NTSB Marine Accident Report 38 Probable Cause 3.2 The National Transportation Safety Board determines that the probable cause of the Seastreak Wall Street’s allision with the pier was the captain’s loss of vessel control because he was unaware the propulsion system was in Backup mode. In addition, his usual method of transferring control from one bridge station to another during the approach to the pier did not allow sufficient time and distance to react to the loss of vessel control. Contributing to the accident was Seastreak LLC’s ineffective oversight of vessel operations. Contributing to the severity of injuries was Seastreak LLC’s lack of procedures to limit passenger access to stairwells on the Seastreak Wall Street during potentially high-risk situations such as vessel docking and undocking.

NTSB Marine Accident Report 39 4 Recommendations New Recommendations 4.1 To the United States Coast Guard: Develop and implement human factors standards for the design of critical vessel controls for US-flag ships to include clearly identifiable and understandable audible alerts and displays indicating which mode is engaged. (M-14-1)

Distribute the National Transportation Safety Board safety alert outlining the circumstances of this accident to warn passenger vessel operators of the need to control passenger access to stairwells while performing maneuvers such as docking and undocking. (M-14-2)

Require installation of voyage data recorders that meet the International Maritime Organization’s performance standard for voyage data recorders on new ferry vessels subject to 46 Code of Federal Regulations Subchapters H and K. (M-14-3) Require installation of voyage data recorders that meet the International Maritime Organization’s performance standard for simplified voyage data recorders on existing ferry vessels subject to 46 Code of Federal Regulations Subchapters H and K. (M-14-4) Develop a US voyage data recorder standard for ferry vessels subject to 46 Code of Federal Regulations Subchapter T and require the installation of such equipment where technically feasible. (M-14-5) To Seastreak LLC: Work with Scana Mar-El AS to implement a modification to the Neptune Compact propulsion control system that includes clearly identifiable audible alerts and easily visible and understandable displays to remind the operator when Backup mode is engaged. (M-14-6) Expedite the complete implementation of a safety management system for your fleet that is appropriate for the characteristics, methods of operation, and nature of service of your vessels and the size of your operations. (M-14-7) Revise your operations and training manuals to include better utilization of crew and procedures for standard bridge operations, vessel emergencies, and control of passenger access to stairwells during docking and undocking. (M-14-8)

NTSB Marine Accident Report 40 To Scana Mar-El AS: Modify your design for new Neptune Compact propulsion control systems to include clearly identifiable audible alerts and easily visible and understandable displays that will remind the operator when Backup mode is engaged and revise your owner’s manual accordingly. (M-14-9) Design a solution for existing Neptune Compact propulsion control systems to include clearly identifiable audible alerts and easily visible and understandable displays to indicate to operators when Backup mode is engaged, revise your owner’s manual accordingly, and alert your customers to the circumstances of this accident and to the availability of the retrofit solution. (M-14-10) Previous Recommendations Reclassified in This Report 4.2 Two previous recommendations to the United States Coast Guard are reclassified “Closed—Unacceptable Action/Superseded”: To the United States Coast Guard: Require installation of voyage data recorders that meet the international performance standard on new ferry vessels. (M-10-5) Require installation of voyage data recorders on all ferry vessels that will record, at a minimum, the video, audio, and parametric data specified in the International Maritime Organization’s performance standard for simplified voyage data recorders. (M-10-6) Safety Recommendations M-10-5 and M-10-6, previously classified “Open―Unacceptable Response,” are superseded by Safety Recommendations M-14-3 through M-14-5 in section 2.4.2. One previous recommendation to the United States Coast Guard is reclassified “Open―Unacceptable Response”: To the United States Coast Guard: Require all operators of US flag passenger vessels to implement safety management systems, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. (M-12-3) This recommendation, previously classified “Open—Acceptable Response,” is reclassified in section 2.3.3.

NTSB Marine Accident Report 41 BY THE NATIONAL TRANSPORTATION SAFETY BOARD

DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER Member

Adopted: April 8, 2014

NTSB Marine Accident Report 42 References International Maritime Organization, “ISM Code and Guidelines on Implementation of the ISM Code 2010,” Preamble, clause 1, http://www.imo.org/OurWork/HumanElement/ SafetyManagement/Pages/ISMCode.aspx, accessed January 17, 2014. K-T Marine, Inc., letter to Seastreak LLC, February 7, 2013. National Oceanic and Atmospheric Administration, “NOAA Tide Predictions” for Brooklyn Bridge, National Oceanic and Atmospheric Administration, http://tidesandcurrents.noaa.gov/ tide_predictions .html?gid=62, accessed December 18, 2013. National Transportation Safety Board, Grounding of the Panamanian passenger ship Royal Majesty on Rose and Crown Shoal near Nantucket, Massachusetts, June 10, 1995. Marine Accident Report NTSB/MAR-97-01 (Washington: National Transportation Safety Board, 1997). ―――Collision Between U.S. Passenger Ferry M/V Block Island and U.S. Coast Guard Cutter Morro Bay, Block Island Sound, Rhode Island, July 2, 2008, Marine Accident Report NTSB/MAR-11/01 (Washington: National Transportation Safety Board, 2010). ―――Heeling Accident on M/V Crown Princess, Atlantic Ocean, July 18, 2006, Marine Accident Report NTSB/MAR-08/01 (Washington: National Transportation Safety Board, 2008). ―――Collision of Tankship Eagle Otome with Cargo Vessel Gull Arrow and Subsequent Collision with the Dixie Vengeance Tow, Sabine-Neches Canal, Marine Accident Report NTSB/MAR-11/04 (Washington: National Transportation Safety Board, 2011). Scana Mar-El AS, “User manual: Neptune Compact CPP, Propulsion Control System,” section 7.1.2, initial release 2003. Seastreak LLC, e-mail message to NTSB, January 16, 2014. Estimated cost of repairs to Seastreak Wall Street as of January 15, 2014. ――― “Vessel Operating Manual: Seastreak Wall Street,” Seastreak LLC, 2003. Servogear AS, “Servogear Ecoflow Propulsor,” http://www.servogear.no/index.php?pageID=42, accessed July 1, 2013. United States Coast Guard, Navigation and Vessel Inspection Circular No. 5-01, “Guidance for Enhancing the Operational Safety of Domestic High-Speed Vessels,” http://www.uscg.mil/ hq/cg5/nvic/ pdf/2001/n5-01.pdf, April 23, 2001. ―――Report to Congress on Use of Voyage Data Recorders on Ferries (Washington: US Department of Homeland Security, March 26, 2008). ―――“Newsletter and Summary Record of 26 September 2013 Meeting,” http://www.navcen. uscg.gov/pdf/TFSR_75.pdf, accessed December 20, 2013.

NTSB Marine Accident Report 43 Appendix A―NTSB Investigation Information The National Transportation Safety Board launched a team of investigators and a Board Member to the accident scene the afternoon of January 9, 2013, the day of the allision. The Coast Guard classified the accident as a major marine casualty, and the NTSB was designated the lead federal investigative agency. The NTSB team collected initial information from the accident scene, conducted extensive propulsion testing on the Seastreak Wall Street, and later visited the vessel to perform a damage assessment, witness installation of a pitch deviation alarm, and review operation of the propulsion control system. NTSB investigators also visited the propulsion equipment manufacturers headquartered in Norway. Parties to the NTSB investigation were the Coast Guard; Seastreak LLC; the New York City Department of Transportation, owner of the pier; Servogear AS, manufacturer of the controllable pitch propulsion system; and Tognum America, the engine manufacturer.

NTSB Marine Accident Report 44 Appendix B―NTSB Safety Alert

Passenger Vessels: Stairway Hazards during Docking and Undocking

Falls in stairways caused serious injury in recent passenger vessel allision while docking The problem The NTSB recently investigated a vessel accident in which people were seriously injured when the vessel allided with the dock. Five stairways provided passenger access between three deck levels. As the vessel approached the pier, some passengers stood in stairways as they anticipated arrival. When the vessel unexpectedly struck the dock, passengers lost their balance and fell, causing head injuries, fractured ribs, and cuts and bruises. The most severely injured passenger fell down a stairway and suffered a broken neck, brain hemorrhage, lung collapse, facial fractures and lacerations, and nerve injuries. He spent more than 5 weeks in a hospital. The NTSB encourages vessel operators to control passenger access to stairways while docking and undocking. What can be done?  Vessel passengers: Even if you see unrestricted stairways on board your vessel, please avoid them during docking and undocking. A momentary loss of balance can cause you to fall and be seriously injured. Reduce the risk of injuries by remaining seated or holding on to a handrail or seat back during docking. Always be prepared for unexpected vessel movement.  Vessel operators: To reduce the risk of serious injuries, develop procedures to control passenger access to stairways during docking and undocking. For more information about this accident, see Allision of Passenger Vessel Seastreak Wall Street with Pier 11, Lower Manhattan, New York, New York, January 9, 2013. The report is available at www.ntsb.gov under report number NTSB/MAR-14/01.

NTSB Marine Accident Report 45 Appendix C―NTSB Vessel Power Study The following excerpts are from an NTSB Seastreak Wall Street power study analyzing data from AIS and the vessel’s engine monitoring systems related to propeller pitch, engine rpm, and power. This power study was conducted to determine if the accident data were consistent with operation in Combinator mode or Backup mode. The ferry’s propulsion was normally controlled in Combinator mode, in which order lever position controlled propeller pitch and engine rpm, according to a predetermined schedule, as shown in figure C-1. In Backup mode, propeller pitch was controlled independently of the order lever, which controlled only the engine speed.

Figure C-1. Combinator mode schedule.

RPM -100 -80 -60 -40 -20 0 20 40 60 80 100 700 800 900 1000 1100 1200 1300 1400 1500 1600 1700 1800 Order Lever Position - % RPM Combinator Schedule -100 -80 -60 -40 -20 0 20 40 60 80 100 Propeller Pitch Propeller (Pitch %)

NTSB Marine Accident Report 46 Figure C-2 shows torque as a function of shaft horsepower for two decelerations from 30 knots in Combinator mode. 0 500 1000 1500 2000 2500 3000 0 1000 2000 3000 4000 5000 6000 7000 8000 9000 10000 11000 12000 Combinator Mode Test Torque (N-M) Shaft horsepower deceleration 1, engine 1 deceleration 1, engine 2 deceleration 2, engine 1 deceleration 2, engine 2 accident deceleration, engine 1 accident deceleration, engine 2 comparison with accident

Figure C-2. Torque versus shaft horsepower in Combinator mode.

NTSB Marine Accident Report 47 Engine data were recorded once per minute before the allision. Acceleration is plotted with shaft horsepower in figure C-3 to indicate the power change trends required for the recorded speed. The acceleration curve indicates that the power reduction occurred about 0839:30, approximately 40 seconds after the last recorded 2500-horsepower engine data point. The acceleration curve also shows that forward power was increased about a minute before the allision. This would require an increase in rpm and, thus, rpm control. 08:36 08:37 08:38 08:39 08:40 08:41 08:42 0 500 1000 1500 2000 2500 Shaft Horsepower Eastern Standard Time (hr:min) SHP eng 1 SHP eng 2 08:36 08:37 08:38 08:39 08:40 08:41 08:42 -2 -1 0 1 2 Accident Voyage Power and Acceleration Acceleration Acceleration (ft/sec 2) Allision -10 0 10 20 30 40 Speed(kts)

Figure C-3. Power, speed, and acceleration.

NTSB Marine Accident Report 48 The data were also examined to check whether the power parameter relationships earlier in the voyage could provide insight into the propulsion control mode (Combinator or Backup). Calculated power, recorded rpm, torque, and speed are plotted in figure C-4 for the accident voyage. Note that AIS speed data were not available before about 0805. The engine traces indicate acceleration to cruise beginning about 2 minutes earlier and accompanied by a power spike to about 2335 shaft horsepower. 08:00 08:05 08:10 08:15 08:20 08:25 08:30 08:35 08:40 08:45 500 600 700 800 900 1000 1100 1200 1300 1400 1500 1600 1700 1800 1900 2000 2100 2200 2300 2400 2500 Power & RPM Eastern Standard Time (hr:min) SHP eng 1 SHP eng 2 RPMactual eng 1 RPMactual eng 2 8000 8200 8400 8600 8800 9000 9200 9400 9600 9800 10000 10200 10400 10600 10800 11000 11200 11400 11600 11800 12000 Torque, eng 1 Torque, eng 2 Torque (N-M) Accident Voyage Power 25 26 27 28 29 30 31 32 33 34 35 Speed(kts)

Figure C-4. Engine rpm, power, torque, and speed for the accident voyage.

In Combinator mode, the order levers controlled engine rpm and propeller pitch, and thus power. Until about 0820, a fixed relationship existed between the three parameters. About 0820, the port and starboard torque and power separated while engine rpm remained constant at 1800 rpm. The steady rpm indicates that the command lever position must have been constant through this period. At 0827, torque and power increased while rpm decreased. This was not possible in Combinator mode, indicating that the vessel was in Backup mode by this time. After 0827, the engines returned to 1800 rpm while torque decreased briefly below the earlier cruise value before increasing to a value significantly above the earlier cruise value at 0831. These torque changes

NTSB Marine Accident Report 49 were thus independent of the command lever and necessitated manual pitch changes continuing in Backup mode. The higher torque and power after 0831 were consistent with lower propeller efficiency than would have occurred with the pitch optimized in Combinator mode. The higher power during this period equaled the power required for the rapid acceleration to cruise speed at the beginning of the voyage. Note this lasts until the deceleration for approaching the dock just before the allision, showing that the vessel was in Backup mode at least until this period. Torque and rpm for the accident did not follow the relationship required for Combinator mode after 0827. The increase in torque seen in the last pre-allision engine data point is consistent with the behavior expected of a fixed-pitch propeller at a slower vessel speed but is inconsistent with the behavior expected in Combinator mode. The data show a change in power control during the deceleration about a minute before the allision.

FD07427 ｜ 2014_美国_PAR1401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

i Columbia Gas Transmission Corporation Pipeline Rupture Sissonville, West Virginia December 11, 2012

Accident Report NTSB/PAR-14/01 PB2014-103977

National Transportation Safety Board

i NTSB/PAR-14/01 PB2014-103977 Notation 8545 Adopted February 19, 2014

Pipeline Accident Report Columbia Gas Transmission Corporation Pipeline Rupture Sissonville, West Virginia December 11, 2012

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

ii National Transportation Safety Board. 2014. Columbia Gas Transmission Corporation Pipeline Rupture, Sissonville, West Virginia, December 11, 2012. Pipeline Accident Report. NTSB/PAR-14/01. Washington, DC.

Abstract: On December 11, 2012, at 12:41 p.m. eastern standard time, a buried 20-inch-diameter interstate natural gas transmission pipeline, owned and operated by Columbia Gas Transmission Corporation, ruptured in a sparsely populated area, about 106 feet west of Interstate 77 near Route 21 and Derricks Creek Road, in Sissonville, West Virginia. About 20 feet of pipe was separated and ejected from the underground pipeline and landed more than 40 feet from its original location. The escaping high-pressure natural gas ignited immediately. An area of fire damage about 820 feet wide extended nearly 1,100 feet along the pipeline right-of-way. Three houses were destroyed by the fire, and several other houses were damaged. There were no fatalities or serious injuries. About 76 million standard cubic feet of natural gas was released and burned. Columbia Gas Transmission Corporation reported the cost of pipeline repair was $2.9 million, the cost of system upgrades to accommodate in-line inspection was $5.5 million, and the cost of gas loss was $285,000. Major safety issues identified in this investigation were external corrosion mitigation of the ruptured pipeline, supervisory control and data acquisition alert setpoint configuration, use of automatic shutoff valves and remote control valves to improve isolation of high-pressure pipelines, and exclusion of pipelines in the vicinity of highways from integrity management regulation. The National Transportation Safety Board makes safety recommendations to Columbia Gas Transmission Corporation and the Pipeline and Hazardous Materials Safety Administration. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Recent publications are available in their entirety at www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased, by individual copy or by subscription, from the National Technical Information Service. To purchase this publication, order report number PB2014-103977 from:

National Technical Information Service 5301 Shawnee Road Alexandria, Virginia 22312 (800) 553-6847 or (703) 605-6000 www.ntis.gov

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of NTSB reports related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report. NOTE: This report was reissued on March 11, 2014, with a correction to page 14.

NTSB Pipeline Accident Report

i Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary ..................................................................................................................... vi

1. Investigation and Analysis ........................................................................................................1
2. 1 Accident Narrative .....................................................................................................................1
3. 2 Columbia Gas Transmission Corporation ..................................................................................4
4. 2.1 Line SM-80 ......................................................................................................................4
5. 2.2 Line SM-86 Loop ............................................................................................................5
6. 2.3 Line SM-86 ......................................................................................................................5
7. 2.4 Automatic Shutoff Valves and Remote Control Valves ..................................................7
8. 2.5 Control Center .................................................................................................................8
9. 3 Preaccident Events ...................................................................................................................10
10. 3.1 Line SM-80 ....................................................................................................................10
11. 3.2 Columbia Gas Controller ...............................................................................................10
12. 4 Response to Pipeline Rupture ..................................................................................................10
13. 4.1 Local Emergency Response ...........................................................................................10
14. 4.2 Response of Cabot and Columbia Gas Control Centers ................................................11
15. 4.3 Columbia Gas Emergency Response .............................................................................14
16. 4.4 Surrounding Area Damage ............................................................................................15
17. 5 SCADA System Leak Detection ..............................................................................................15
18. 5.1 NTSB Accident Investigations ......................................................................................15
19. 5.2 NTSB SCADA Study ....................................................................................................17
20. 5.3 PHMSA and Control System Alarm Standards .............................................................18
21. 6 Pipeline Corrosion ...................................................................................................................20
22. 7 Columbia Gas Corrosion Mitigation Program .........................................................................25
23. 7.1 In-Line Inspections ........................................................................................................26
24. 7.2 Close Interval Surveys ...................................................................................................27
25. 8 Integrity Management ..............................................................................................................28
26. 8.1 Pipelines Close to Highways .........................................................................................28
27. 8.2 Columbia Gas Integrity Management Program .............................................................29
28. 9 Postaccident Corrective Actions ..............................................................................................31
29. Conclusions ...............................................................................................................................33
30. 1 Findings....................................................................................................................................33
31. 2. Probable Cause........................................................................................................................34
32. Recommendations ....................................................................................................................35

NTSB Pipeline Accident Report

ii

1. Appendixes................................................................................................................................37
2. 1 Appendix A: Investigation .......................................................................................................37
3. 2 Appendix B: Timeline..............................................................................................................38

References .....................................................................................................................................40

NTSB Pipeline Accident Report

iii Figures Figure 1. Accident scene facing east. ............................................................................................. 1 Figure 2. Aerial view of the routes of the three SM-80 system pipelines and the rupture location. ........................................................................................................................................... 2 Figure 3. Line SM-80 schematic showing pipeline rupture detail. ................................................ 3 Figure 4. Line SM 80 system schematic showing isolation valve locations and positions at time of rupture. ........................................................................................................................................ 6 Figure 5. Line SM-80 discharge pressure at Lanham compressor station just before and after the rupture. .......................................................................................................................................... 12 Figure 6. Ends of ruptured 20-inch SM-80 pipeline in rocky backfill. ........................................ 20 Figure 7. Ejected ruptured pipe. ................................................................................................... 22 Figure 8. Underside of pipe upstream of rupture exhibiting primarily uncoated pipe. Boundaries of uncoated portion of pipe are indicated by yellow arrows. ........................................................ 22 Figure 9. External corrosion along longitudinal fracture, with boundary of visible corrosion indicated with arrows. ................................................................................................................... 23 Figure 10. Longitudinal fracture surface on upstream side of lateral tear. .................................. 24 Figure 11. Potential impact radius circles for each pipeline in SM-80 system at rupture location. ....................................................................................................................................................... 32

Tables Table 1. Calculated burst pressure values following ASME B31G-2009 and using the measured yield strength of 68,000 psi. .......................................................................................................... 24 Table 2. Calculated burst pressure values following ASME B31G-2009 and using the specified minimum yield strength of API Standard 5L grade X60 pipe of 60,000 psi. ............................... 25

NTSB Pipeline Accident Report

iv Abbreviations and Acronyms ANSI American National Standards Institute API American Petroleum Institute ASME American Society of Mechanical Engineers ASV automatic shutoff valve Cabot Cabot Oil & Gas Corporation CAO corrective action order CFR Code of Federal Regulations CIS close interval survey Clendenin Clendenin compressor station Columbia Gas Columbia Gas Transmission Corporation ERW electric resistance weld HCA high consequence area I-77 Interstate 77 ILI in-line inspection IM integrity management ISA International Society of Automation Lanham Lanham compressor station MAOP maximum allowable operating pressure Metro 911 Metro Emergency Operations Center PG&E Pacific Gas and Electric Company PHMSA Pipeline and Hazardous Materials Safety Administration PIR potential impact radius PSC Public Service Commission of West Virginia

NTSB Pipeline Accident Report

v psi pounds per square inch psig pounds per square inch, gauge RCV remote control valve SCADA supervisory control and data acquisition

NTSB Pipeline Accident Report

vi Executive Summary On December 11, 2012, at 12:41 p.m. eastern standard time, a buried 20-inch-diameter interstate natural gas transmission pipeline (Line SM-80), owned and operated by Columbia Gas Transmission Corporation, ruptured in a sparsely populated area, about 106 feet west of Interstate 77 near Route 21 and Derricks Creek Road, in Sissonville, West Virginia. About 20 feet of pipe was separated and ejected from the underground pipeline and landed more than 40 feet from its original location. According to Columbia Gas Transmission Corporation, the maximum allowable operating pressure of the pipeline was 1,000 pounds per square inch, gauge, and the operating pressure at the time of the rupture was about 929 pounds per square inch, gauge. The ruptured pipe was part of a pipeline segment that was installed in 1967 and was in a Class 2 location, indicating that an area 220 yards (200 meters) on either side of the centerline of the pipeline had between 10 and 46 buildings intended for human occupancy. According to Columbia Gas Transmission Corporation records, the 20-inch-diameter pipeline segment had a nominal wall thickness of 0.281 inch and a longitudinal electric resistance weld seam. Corrosion protection was provided by a factory-applied polymer coating and impressed current cathodic protection. The ruptured pipe was oriented with the longitudinal seam weld near the top of the pipe. The fracture was located in the base metal at the bottom of the pipe along the longitudinal direction. The outside pipe surface was heavily corroded near the midpoint of the rupture and along the longitudinal fracture. The corroded area was about 6 feet long in the longitudinal direction and 2 feet wide in the circumferential direction. The smallest measured wall thickness was 0.078 inch (more than 70 percent wall loss). The escaping high-pressure natural gas ignited. Fire damage extended nearly 1,100 feet along the pipeline right-of-way and covered an area about 820 feet wide. Three houses were destroyed by the fire, and several other houses were damaged. There were no fatalities or serious injuries; however, Interstate 77 was closed for 19 hours until about 800 feet of thermally damaged road surface was replaced. The National Transportation Safety Board determines that the probable cause of the pipeline rupture was (1) external corrosion of the pipe wall due to deteriorated coating and ineffective cathodic protection and (2) the failure to detect the corrosion because the pipeline was not inspected or tested after 1988. Contributing to the poor condition of the corrosion protection systems was the rocky backfill used around the buried pipe. Contributing to the delay in the controller’s recognition of the rupture was Columbia Gas Transmission Corporation management’s inadequate configuration of the alerts in the supervisory control and data acquisition system. Contributing to the delay in isolating the rupture was the lack of automatic shutoff or remote control valves.

NTSB Pipeline Accident Report

vii This report discusses the following safety issues:  External corrosion mitigation of pipeline SM-80  Supervisory control and data acquisition alert setpoint configuration  Use of automatic shutoff valves and remote control valves to improve isolation of high-pressure pipelines  Exclusion of pipelines in the vicinity of highways from integrity management regulation

NTSB Pipeline Accident Report

1

1. Investigation and Analysis
2. 1 Accident Narrative

On December 11, 2012, at 12:41 p.m. eastern standard time,1 a buried 20-inch-diameter interstate natural gas transmission pipeline (Line SM-80), owned and operated by Columbia Gas Transmission Corporation (Columbia Gas), ruptured in a sparsely populated area, about 106 feet west of Interstate 77 (I-77) near Route 21 and Derricks Creek Road in Sissonville in Kanawha County, West Virginia. The pipeline was operating at about 929 pounds per square inch, gauge (psig), just before the rupture. About 20 feet of pipe was ejected from the underground pipeline and landed more than 40 feet away. (See figure 1.)

Figure 1. Accident scene facing east. Two other Columbia Gas transmission lines—a 26-inch-diameter pipeline (Line SM-86) and a 30-inch-diameter pipeline (Line SM-86 Loop)—located within the same right-of-way as Line SM-80 were not damaged. (See figure 2.)

1 Unless otherwise specified, all times in this report are eastern standard time.

NTSB Pipeline Accident Report

2

Figure 2. Aerial view of the routes of the three SM-80 system pipelines and the rupture location. The ruptured pipe was part of a pipeline segment that was installed and pressure-tested in 1967 and was in a Class 2 location.2 The failed pipe joint was 37 feet 8 1/2 inches long.3 (See figure 3.) It had a nominal wall thickness of 0.281 inch and a longitudinal electric resistance weld (ERW) seam oriented at the top of the pipe. It was manufactured by American Steel according to the American Petroleum Institute (API) Standard 5L grade X60. Corrosion protection was provided by a factory-applied polymer coating, a field-applied coal tar, and impressed current cathodic protection.4

2 Regulations for gas transmission pipelines establish pipe strength requirements based on population density near the pipeline. Locations along gas pipelines are divided into classes from 1 (rural) to 4 (densely populated) and are based upon the number of buildings or dwellings for human occupancy. The safety margin of the pipeline, or ratio of the design pressure to the maximum allowable operating pressure, is greatest in a Class 4 location. 3 A pipe joint is defined as the length of pipe between two adjacent girth (circumferential) welds. 4 Cathodic protection is a corrosion mitigation method used by the pipeline industry to protect underground steel structures. The system uses direct current power supplies at selected locations along the pipeline to supply protective electrical current. The impressed current is supplied to the pipeline through a ground bed that typically contains a string of anodes, with soil as the electrolyte. A wire connected to the pipeline provides the return path for the current to complete the circuit.

NTSB Pipeline Accident Report

3

Figure 3. Line SM-80 schematic showing pipeline rupture detail. The 20-foot-long ejected pipe contained no girth welds. The rupture initiated in an area of heavy external corrosion along the bottom of the pipe that measured about 6 feet in the longitudinal direction and 2 feet in the circumferential direction. The smallest measured wall thickness near the initiation site was 0.078 inch (more than 70 percent wall loss). The pipe fractured in the longitudinal direction along the entire 20-foot length. The escaping high-pressure natural gas ignited immediately. An area of fire damage about 820 feet wide extended nearly 1,100 feet along the pipeline right-of-way. Three houses were destroyed by the fire, and several other houses were damaged. There were no fatalities or serious injuries. The asphalt pavement of the northbound and southbound lanes of I-77 was heavily damaged by the intense fire. Work crews repaired and reopened all four lanes of the highway about 18 hours later. About 76 million standard cubic feet of natural gas was released and burned. Columbia Gas reported the cost of pipeline repair was $2.9 million, the cost of system upgrades to accommodate in-line inspection (ILI) was $5.5 million, and the cost of gas loss was $285,000. The first call to 911 was made by a person at a nearby retirement home at 12:41 p.m. The Columbia Gas control center received a verbal notification of the rupture about 12:53 p.m. from a Cabot Oil & Gas Corporation (Cabot) controller who had received a report of a rupture and fire

NTSB Pipeline Accident Report

4 from a field technician near the accident location. Cabot operates other pipelines in the region and supplies natural gas to Columbia Gas. 1.2 Columbia Gas Transmission Corporation Columbia Gas is owned by Columbia Pipeline Group, a NiSource company.5 Columbia Gas transports an average of 3 billion cubic feet of natural gas per day through a nearly 12,000-mile pipeline network with 92 compressor stations in 10 states. The SM-80 pipeline system consists of three interconnected pipelines transporting unodorized natural gas: Line SM-80, a 20-inch-diameter line; Line SM-86, a 26-inch-diameter line; and Line SM-86 Loop, a 30-inch-diameter line. The SM-80 system is part of a larger pipeline network operated by Columbia Gas called the Charleston system. Corrosion of these three pipelines is mitigated by external coating and impressed current cathodic protection. All three lines shared the same right-of-way near the accident site, had the same 1,000 psig maximum allowable operating pressure (MAOP), and were cross-connected upstream and downstream of the rupture location. Line SM-86 was about 165 feet away from the rupture location on Line SM-80, and Line SM-86 Loop was about 40 feet away from the rupture location. 1.2.1 Line SM-80 Line SM-80 originates at Lanham compressor station (Lanham) near Sissonville, West Virginia. It is 29.6 miles long and terminates upstream of the Broad Run valve station near Clendenin, West Virginia. The SM-80 pipeline was installed in the early 1950s as an uncoated steel pipeline. Pipeline records indicate that during the construction of I-77 in 1967, a 717-foot segment of the original pipeline was replaced with a 20-inch-diameter, 0.281-inch-thick API Standard 5L grade X60 pipe segment with fusion-bonded epoxy coating and a field-applied coal tar enamel. After the rupture, the excavated pipe was found to be coated with a green material, which laboratory testing identified as a polymer. Line SM-80 was pressure-tested twice in 1967, once at the time of the replacement project and again during a hydrostatic test of the entire 29.6-mile span. Both tests were performed for 8 hours, and the highest test pressure was 1,800 psig. In 1992, Columbia Gas replaced segments of Line SM-80 upstream and downstream of the 1967 replacement pipe with new, 20-inch-diameter API Standard 5L grade X60 ERW pipe manufactured by American Steel. The wall thickness of the upstream segment was 0.281 inch, and of the downstream segment, 0.25 inch. Both new segments had a mill-applied coal tar enamel coating. Following the 1992 replacement project, 654 feet of the 1967 pipe remained in Line SM-80 at the crossing near I-77, where the rupture occurred. According to Columbia Gas, no corrosion-related leaks had occurred in the SM-80 system before the December 11, 2012, rupture.

5 At the time of the accident, Columbia Gas was owned by NiSource Gas Transmission and Storage.

NTSB Pipeline Accident Report

5 The area where Line SM-80 ruptured is rural and sparsely populated, and Line SM-80 in that area was designated as being in a Class 2 location. The ruptured pipe was not within a high consequence area (HCA).6 Therefore, Line SM-80 was not covered by the requirements in Title 49 Code of Federal Regulations (CFR) Part 192, Subpart O, Gas Transmission Pipeline Integrity Management. Accordingly, Line SM-80 was not part of the Columbia Gas integrity management (IM) program. In addition to discharge isolation valves at Lanham, Line SM-80 was outfitted with mainline isolation valves at the Rocky Hollow and Patterson Fork valve stations. The Rocky Hollow valves were 7.9 miles downstream from Lanham, and the Patterson Fork valves were 15.6 miles downstream from Lanham. (See figure 4.) 1.2.2 Line SM-86 Loop Line SM-86 Loop is primarily a 30-inch-diameter API Standard 5L grade X65 0.321-inch-thick natural gas pipeline with coal tar coating. It runs from the Lanham compressor station to the Panther Mountain valve station near Clendenin, West Virginia. The pipeline is about 26.6 miles long. According to Columbia Gas, and based on the 1,000 psig MAOP and the pipe diameter, a 353-foot-long segment of this pipeline adjacent to the rupture location was designated to be in an HCA Class 2 location. 1.2.3 Line SM-86 Line SM-86 is a 26-inch-diameter natural gas pipeline that runs from Lanham Compressor Station to the Panther Mountain valve station. The pipeline is 26.5 miles long and shares the right-of-way with Line SM-86 Loop for nearly its entire length. According to Columbia Gas, and based on the 1,000 psig MAOP and pipe diameter, a 303-foot-long segment of this pipeline adjacent to the rupture location was designated to be in an HCA Class 1 location.

6 An HCA is determined along each pipeline based on the population density within the potential impact radius (PIR), which is a function of the pipe diameter and the MAOP. (See 49 CFR 192.5 and 192.903.) The population density in the Line SM-80 PIR was below the threshold value for an HCA. Each pipeline HCA is independent of any pipeline that passes through it and any overlapping HCA from an adjacent pipeline. The HCA determination is also independent of the pipeline class determination.

NTSB Pipeline Accident Report

6

Figure 4. Line SM-80 system schematic showing isolation valve locations and positions at time of rupture. Figure 4. Line SM 80 system schematic showing isolation valve locations and positions at time of rupture.

NTSB Pipeline Accident Report

7 1.2.4 Automatic Shutoff Valves and Remote Control Valves When a high-pressure gas transmission pipeline ruptures, structures near the epicenter typically sustain sudden catastrophic damage. The extent of the damage to structures farther away from the epicenter and the intense gas-fueled fire is proportional to the time required to isolate the gas supply and extinguish the fires on both sides of the rupture. Automatic shutoff valves (ASVs) and remote control valves (RCVs) can significantly shorten the rupture isolation time because they quickly and automatically close when the pipeline pressure drops to a preset value. The valve closing response time is not dependent on the controllers’ recognizing a rupture or on the time it takes for pipeline mechanics to be notified, travel to the valve sites, and close the valves. Pipeline operators are required by 49 CFR 192.935 to use a risk analysis method to determine if and where ASVs and RCVs are needed on pipelines containing HCAs. Columbia Gas uses a three-step process to determine if ASVs or RCVs are needed in a pipeline HCA and if so, the type of valves to use and where they are installed.7 Although Line SM-86 and Line SM-86 Loop contained HCAs, the risk analysis did not identify the need to install ASVs or RCVs on either pipeline. Because Line SM-80 was not in an HCA, it was not evaluated, so it did not contain either ASVs or RCVs. All the isolation valves on the three pipeline systems were locally operated; some were fitted with motor operators, and the other valves were operated manually. When the pipeline ruptured, more than 1 hour passed before field personnel completed closing all the SM-80 system valves, which isolated the rupture location from the gas supply. Automatic shutoff valves would most likely have shortened that time. The National Transportation Safety Board (NTSB) first examined how ASVs and RCVs can shorten the duration of the intense gas-fueled fire at a pipeline rupture site in a pipeline accident in Edison, New Jersey, in 1994 (NTSB 1995). Currently, the regulations do not specify a length of time to isolate a ruptured gas line, other than for pipelines with an alternative MAOP.8 Furthermore, the regulations give the pipeline operator discretion to decide whether ASVs or RCVs are needed in HCAs as long as the pipeline operator considers the factors listed under 49 CFR 192.935(c).9 The NTSB revisited the ASV/RCV issue in the investigation of the September 9, 2010, Pacific Gas and Electric Company (PG&E) natural gas transmission pipeline rupture in San Bruno, California, in which eight people died, 38 houses were destroyed, and 70 houses were damaged (NTSB 2011). As a result of the accident, the NTSB issued the following recommendation to the Pipeline and Hazardous Materials Safety Administration (PHMSA):

7 An ASV closes automatically based on predetermined pressure and flow setpoints. An RCV is operated by a controller in the control center. Both types of valves eliminate the need for a technician to travel to the valve location to open or close the valve, which can significantly shorten the time required to isolate a pipe segment. 8 Title 49 CFR 192.620, Alternative Maximum Allowable Operating Pressure for Certain Steel Pipelines, allows a pipeline operator to operate a pipeline at up to 80 percent specified minimum yield strength in Class 2 locations as long as the pipeline operator meets a very specific and stringent set of criteria listed in the regulation. 9 The decision factors for using an ASV or an RCV in a pipeline are (1) the swiftness of leak detection and pipe shutoff capabilities, (2) the type of gas being transported, (3) the operating pressure, (4) the gas flow rate of potential release, (5) the pipeline profile, (6) the potential for ignition, and (7) the location of the nearest response personnel.

NTSB Pipeline Accident Report

8 P-11-11 Amend Title 49 Code of Federal Regulations 192.935(c) to directly require that automatic shutoff valves or remote control valves in high consequence areas and in class 3 and 4 locations be installed and spaced at intervals that consider the factors listed in that regulation. (Classified “Open—Acceptable Response” on April 24, 2012) 1.2.5 Control Center The Columbia Gas pipeline system is monitored and controlled from a single supervisory control and data acquisition (SCADA) system in the Columbia Gas control center in Charleston, West Virginia. The control center is staffed with three to five gas controllers who operate specific pipeline systems from five consoles. The day shift works from 6:00 a.m. to 6:00 p.m., and the night shift works from 6:00 p.m. to 6:00 a.m. Each controller is assigned not more than two pipelines. Each pipeline can be controlled using the SCADA system at any of the consoles. The controller is responsible for monitoring the SCADA system, using various SCADA indications, alerts, and alarms to identify pipeline leaks.10 On the day of the accident, the Charleston and Commonwealth pipeline systems were monitored by one controller.11 The SM-80 system is part of the Charleston system. Other controllers and supervisors (the manager and the director of gas control) also were present and monitoring control room operations at the time of the accident. Columbia Gas upgraded its SCADA system in 2011 and reconfigured and consolidated the display screens using the guidance referenced in the PHMSA control room management rule issued November 20, 2009, and codified at 49 CFR 192.631. To reduce the frequency of nuisance alarms, Columbia Gas configured the SCADA system with two event categories: alarms and alerts. Each controller has one dedicated display monitor at the console that lists alarms and alerts. The listing is divided into three areas, or grids. The alarms and alerts are displayed on different grids. The most recent alarm or alert is displayed on the top line of its grid and flashes until it is acknowledged. The limiting value, or setpoint, for each process parameter can be designated as an alarm or alert. For example, a regulator discharge pressure may have a high alarm limit. The same discharge pressure may have an alert value set for a specified pressure change. The controller must acknowledge every alarm and alert individually.12 Columbia Gas defines the term alarm as “an audible or visible means of indicating to the controller that equipment or processes are outside of [pipeline] operator-defined, safety-related

10 The SM-80 system does not have an automated leak-detection system. 11 Columbia Gas assigns names to the pipeline systems for convenience: Charleston, for example. Each system contains multiple smaller systems: for example, SM-80. 12 A controller acknowledges alarms and alerts by a keyboard entry or clicking with a mouse on the SCADA system display screen.

NTSB Pipeline Accident Report

9 parameters,” which is consistent with the federal regulation (NiSource 2012). Columbia Gas defines the term safety related as “any operational factor that is necessary to maintain pipeline integrity or that could lead to the recognition of a condition that could impact the integrity of the pipeline, or a developing abnormal emergency situation” (NiSource 2012). Alarms display in red and require the controller to take immediate action to correct the situation, including shutting down the affected pipeline segment. Columbia Gas defines the term alert as follows: an audible or visible means of indicating to the controller or monitoring center analyst that conditions have changed, equipment or other monitoring variables are outside of operator defined controlling parameters or which indicate that equipment, devices or processes are not functioning as intended but which are not integral to a safety-related parameter. (NiSource 2012) A control system alert has no regulatory definition. The process variable and setpoint for each alert can be assigned by the controller, and different controllers can select different alerts for the same pipeline segment. The SCADA system default value for alert setpoints is 5 percent or 5 units of the process variable. Columbia Gas provides no guidance for alert parameter selection. Furthermore, Columbia Gas did not provide guidance on how and when alerts can provide useful information to the controller. Alerts are displayed in green or yellow based on the controller-assigned level of importance; yellow is the more important indicator. Alerts are intended to assist the controller in monitoring and controlling the pipeline system during normal demand changes. Columbia Gas relies on the controller to recognize an abnormal condition from the SCADA system alerts or other indications. However, management did not provide any guidance or instructions to the controllers related to alert parameter settings or appropriate action for alerts. At the time of the accident, pressure deviation alerts for the SM-80 system were set to activate if a pressure value at the Lanham discharge valves on any of the three lines increased or decreased by at least 10 psig (1 percent of the MAOP). The low-low pressure alarm setpoint for the compressor discharge pressure for the SM-80 system was 500 psig. According to Columbia Gas operating records for the 19-month period ending February 28, 2013, the Charleston and Commonwealth pipeline systems had a combined average of 1.9 alarms per hour. This alarm frequency was within the industry guideline for control room design. SCADA guidelines do not provide any recommendations for maximum displayed alert frequency. Although Columbia Gas SCADA records indicated that an average of 83 alerts per hour occurred on the two pipeline systems, the controller told NTSB investigators that typical alert notifications during his duty time “did not overwhelm” him.

NTSB Pipeline Accident Report

10 1.3 Preaccident Events 1.3.1 Line SM-80 No requests to locate buried utilities in the vicinity of the rupture were made to Columbia Gas in the 3 months preceding the rupture. No excavation activity was evident at or near the rupture location during the NTSB field investigation. Therefore, the NTSB concludes that third-party direct pipeline impact damage was not a factor in this accident. Line SM-80 was operating at 929 psig (discharge pressure at Lanham) when the rupture occurred. The SCADA system records confirm that there were no significant valve position changes, pressure transients, or other abnormal conditions before the rupture. 1.3.2 Columbia Gas Controller On the day of the accident a Columbia Gas controller with 20 years of experience was operating the SCADA system for the Charleston and the Commonwealth pipeline systems, a function he routinely performed. He was qualified to operate pipelines on multiple territories. He was responsible for all operations of the pipelines, including monitoring each SCADA system alarm and alert screen. He described his work on the morning of December 11, 2012, as routine and his workload as normal; he also described his work and workload on the days before the accident as being the same. The controller told investigators that before reporting to work at 6:00 a.m., he had slept for about 8 hours the night before. His commute time to work was 10 minutes. He also stated that his overall health was good and that he had not taken any prescription or nonprescription medications before reporting to work. His postaccident toxicological test results were negative for illicit drugs and alcohol. Therefore, the NTSB concludes that the controller was experienced and qualified, fit for duty, not physically fatigued, and not under the influence of illicit drugs or alcohol on the day of the accident. 1.4 Response to Pipeline Rupture 1.4.1 Local Emergency Response At 12:41 p.m., the Metro Emergency Operations Center (Metro 911) received the first 911 call.13 The caller reported that a “gas main blew up” and there was a huge fire near Archibald Drive in Sissonville. At 12:43 p.m., firefighters from Sissonville Volunteer Fire Department Station 26 and Malden Fire Department Station 3 were paged to respond. Between 12:42 p.m. and 12:50 p.m., additional fire companies, emergency medical services, and Kanawha County sheriff deputies were dispatched to respond to the accident. An emergency medical services medic was the first to arrive on scene about 12:49 p.m.

13 The Metro Emergency Operations Center is the emergency services dispatch center for Kanawha County, West Virginia.

NTSB Pipeline Accident Report

11 A Sissonville fire department lieutenant and a firefighter responded to the accident scene with a fire engine, and upon arrival at the scene, the lieutenant assumed incident command. The Sissonville fire chief responded to the accident scene with a tanker, and while en route, he began communicating with the other responders to ensure that enough fire department and law enforcement resources were dispatched. On his arrival at the scene, he assumed incident command and requested that the dispatch center notify the gas companies operating in the accident area. The incident command post was established on Route 21. Police closed Route 21 and I-77 and set up a security perimeter around the accident site. Additional fire engines and tankers were requested and obtained from surrounding fire departments. As responders continued arriving on scene, they reported to Metro 911 that there was heavy smoke and fire in the area and it appeared to be a natural gas fire. Metro 911 began notifying gas companies operating in the area at 1:01 p.m. At 1:06 p.m., Metro 911 notified Appalachian Power of the incident to ensure power was shut down at the accident location. At 1:15 p.m., Metro 911 spoke with personnel at the Columbia Gas Lanham compressor station and asked them to shut down “the main line that was on fire.” Metro 911 notified the incident commander that a woman was trapped in her house on Route 21, so a fire engine company entered the house and rescued her. After the flow of gas was stopped, firefighters worked to suppress the house fires near the rupture. However, three houses and some vehicles parked nearby were destroyed. The incident commander concluded fire operations about 10:00 p.m. 1.4.2 Response of Cabot and Columbia Gas Control Centers The NTSB investigators examined the SCADA operating records for the day of the accident. Pressure recordings for the Lanham pump station discharge pressures show that at 12:41 p.m. the Line SM-80 discharge pressure began to drop. (See figure 5.) About 12:42 p.m., a Cabot compressor operator who was driving near the accident site called the Cabot control center to report that he had just heard a huge “boom” that “sounded like a bomb going off” and asked whether the control center had received reports of or observed any SCADA system indications that might indicate a problem on the Cabot pipeline system. The Cabot controller told him that the system parameters were normal. Four minutes later, the Cabot compressor operator called the Cabot controller again and reported that he now was observing “big flames shooting over the interstate.” The controller told investigators that during his phone conversation with the compressor operator, “I was just looking at my screen and I’m not seeing anything happening.” The Cabot controller and his manager decided to call the Columbia Gas control center and tell them about the fire, because both companies have pipelines in the vicinity of the reported fire.14

14 Cabot is a customer of Columbia Gas and has a bidirectional 8-inch-diameter interconnect (storage line) at the Columbia Gas Lanham compressor station.

NTSB Pipeline Accident Report

12

Figure 5. Line SM-80 discharge pressure at Lanham compressor station just before and after the rupture. About 12:53 p.m., the Cabot controller called the Columbia Gas control center and talked to the on-duty controller responsible for the SM-80 system. The Cabot controller explained that he had a report of fire at Derricks Creek and Route 21, and he asked the Columbia Gas controller whether he was having any problems on the Columbia Gas pipeline or seeing any pressure drops. The Cabot controller told investigators that “at the time I don’t think [the Columbia Gas controller] really knew [whether there was a problem] just by the way he acted. He kind of acted like he was searching to see [whether there was a problem].” The Columbia Gas controller examined the system displays and responded that he was seeing some pressure drops on the Charleston system. At that point, they agreed that the problem was on the Columbia Gas pipeline. As a precaution, the Cabot controller closed the remote control isolation valves between the Cabot system and the Lanham compressor station to isolate the Cabot pipeline system from the Columbia Gas system. At 12:55 p.m., as the Columbia Gas controller ended the call with Cabot, the sixth alert displayed on the SCADA system console. The controller told investigators he then walked to the office of the director of gas control and informed him of a possible leak in the SM-80 system. Although the Columbia Gas operations staff at that point recognized the problem most likely was in their system, the operating data displayed on the SCADA system were insufficient for the

NTSB Pipeline Accident Report

13 Columbia Gas controller to identify which of the three interconnected pipelines in the SM-80 system had ruptured. The NTSB reviewed the SCADA data records for the accident date. The first indication of a problem on the Charleston pipeline system was at 12:43 p.m. when three discharge pressure deviation alerts at the Lanham compressor station were simultaneously presented on the SCADA system alert screen. The alerts were set to trigger when the pressure changed by more than 10 psig (1 percent of the MAOP). The SCADA logs showed two more sets of three compressor discharge pressure deviation alerts at 12:45 p.m. and 12:48 p.m. These three-alert groupings occurred because the isolation valves on the interconnects between the three SM-80 system pipelines were open and the pressure transducers on each pipeline were in the same relative position downstream of the compressor. The next SCADA pressure deviation alert occurred on Line SM-80 at 12:49 p.m., 25 miles downstream of the rupture at the Broad Run valve station, indicating a 50-psig pressure change. The controller next received and acknowledged two more groups of three Lanham pump station discharge pressure deviation alerts, at 12:50 p.m. and 12:52 p.m. Based on the SCADA system information for the Lanham compressor station discharge pressure trends and pressure creep alerts, the NTSB concludes that Line SM-80 ruptured at 12:41 p.m. The SCADA alert screen displayed the parameter and its indicated value, but it did not indicate whether the new value was an increase or decrease or display the amount of the change. To understand the significance of the alert, the controller had to know the value of the previous parameter, either from the prior displayed alert value or from observing the parameter on a system display screen. Recognizing the significance of alerts was further complicated by the fact that the controller was reviewing and responding to other SCADA parameters on the two pipeline systems he was overseeing during the 1- to 2-minute spans between the pressure deviation alerts. Although the controller acknowledged each deviation alert at the compressor discharge 5 miles upstream of the rupture, he did not examine the system parameters to clearly understand that the pressure on all three lines was continuing to drop. Furthermore, even though before receiving the call from the Cabot control center the controller had received the 50-psig deviation alert at Broad Run, he still did not recognize the significance of the alerts. The NTSB concludes that despite the many pressure deviation alerts occurring on the system over more than 12 minutes, the Columbia Gas controller did not recognize the significance of the situation or begin to shut down the system until after the Cabot controller called him. The NTSB recommends that Columbia Gas implement a process for selecting alert setpoints, and provide guidance to pipeline controllers on the expected alert response time, ways to evaluate the significance of alerts, and actions the controller must take in response to those alerts. The NTSB concludes that the Columbia Gas SCADA system alerts did not provide useful, meaningful information to the controller to assist him in determining the operating condition of the pipeline. Therefore, the NTSB recommends that Columbia Gas modify its SCADA system to (1) provide the controller with operating parameter trend data that can be used to evaluate the significance of a system change and (2) assign an alarm function to trends that are likely significant system malfunctions and therefore require immediate action by the controller.

NTSB Pipeline Accident Report

14

CORRECTED COPY When the Columbia Gas controller and the Columbia director of gas control realized the SM-80 system was likely involved in the fire, the controller called the Lanham compressor station. The controller instructed the station operator to shut down the compressor immediately.15 The SCADA system logs confirm that the compressor was stopped at 1:02 p.m. Although the rupture severed Line SM-80, venting the large volume of natural gas contained in the three interconnected pipelines took 45 minutes before the system pressure decayed below the 500-psig low-low pressure alarm setpoint. This slow, prolonged pressure decay is typical in interconnected high-pressure natural gas pipelines and contributed to the damage caused by the burning gas. According to Columbia Gas, by 3:30 p.m., nearly 3 hours after the pipe ruptured, the gas-fueled fire had subsided, and the firefighters were able to enter and extinguish the structure fires. The NTSB concludes that strategically placed ASVs or RCVs would have isolated the three pipelines and shortened the duration of the intense fire. 1.4.3 Columbia Gas Emergency Response About the same time the Columbia Gas controller was talking to the Cabot controller, a Columbia Gas corrosion specialist heard a radio news report of a 200-foot fireball in Sissonville while he was driving to a Columbia Gas field office in Ripley, West Virginia. He called a corrosion technician at 12:53 p.m. and asked the technician to send an emergency text message to the Columbia Gas East Operations manager, alerting him of the reported fire. The East Operations manager was in transit about 21 miles from the accident site. The East Operations manager told investigators that as he was reading the emergency text, he received a phone call from the corrosion specialist, who told him, “I think we’ve got a failure at I-77 crossing.” The East Operations manager began driving toward the accident site. The time was about 12:56 p.m. The technician also told him that several personnel at the Lanham compressor station were en route to close all the compressor station discharge valves to the SM-80 system.16 At 1:09 p.m., the East Operations manager called the Lanham mechanic and told him to close everything on the discharge side of the station and to notify him once all the valves were closed. He said to close all the valves because they did not yet know which of the three lines had ruptured. The Lanham isolation valves included four power-operated valves and two manual valves. The mechanics told NTSB investigators that it took about 15 minutes to close all six valves.17

15 Compressor station personnel could shut down the compressor faster than the controller could remotely shut it down using the SCADA system in the control center. 16 The discharge valves were located about 100 yards outside of the compressor facility, east of the main office of the Lanham compressor station. 17 Because the three pipelines had multiple cross-connections at the valve stations, the controllers could not determine from the SCADA information screens exactly which of the three lines had ruptured. Therefore, they decided to close all the isolation valves at the Lanham and Patterson Fork valve stations to ensure that the rupture would be isolated from the gas supply as quickly as possible.

NTSB Pipeline Accident Report

15

The East Operations manager then called the Clendenin Operations team leader and instructed him to send a crew to the Rocky Hollow and Patterson valve stations to close all of the SM-80 system isolation valves downstream of the rupture. When the pipeline ruptured, two Columbia Gas operations personnel were repairing a leak on a production pipeline about 4.75 miles from the accident location and about 1.75 miles from the nearest downstream valves at the Rocky Hollow valve station. One of the operations personnel stated that they could hear the roar from the releasing gas. The men went to their truck and drove to a location where they could get cell phone connectivity.18 One called the Columbia Gas control center and was told of the accident. They were familiar with the Lanham station and the pipelines in that area, so they drove to the nearest valve station at Rocky Hollow to close the valves and shut off the gas flow to Line SM-80. Columbia Gas estimated that the Rocky Hollow valves were shut by 1:32 p.m., which was confirmed by the SCADA system trends for Line SM-80 and Line SM-86. After closing the discharge valves at the Lanham compressor station, the mechanics installed pressure gauges on the three lines to determine which pipeline had ruptured. Once all the isolation valves were closed at Rocky Hollow and Patterson Fork, the rupture was isolated from the gas supply. Gas pressure on Line SM-86 Loop stabilized at 575 psig and Line SM-86 stabilized between 475 psig and 500 psig. The pressure on Line SM-80 dropped to about zero psig, finally confirming that the rupture occurred on Line SM-80. 1.4.4 Surrounding Area Damage Interstate 77 was closed in both directions because of the fire and road surface damage. The northbound lanes were closed for about 14 hours, and southbound lanes were closed for about 19 hours, while the road was resurfaced. The resurfaced area was about 800 feet long. Thermal damage extended from the rupture point 490 feet to the north, 330 feet to the south, 470 feet to the east, and 610 feet to the west. Radiant heat and direct fire impingement destroyed three nearby houses and vehicles parked near the epicenter. 1.5 SCADA System Leak Detection 1.5.1 NTSB Accident Investigations The NTSB has investigated other pipeline accidents involving pipeline controllers who did not detect, misinterpreted, or failed to appropriately respond to SCADA system alarms indicating an abnormal situation on the pipeline system. In many of these accidents, the NTSB identified shortcomings in the human-system interface.

18 As a safety measure to minimize natural gas ignition sources, the workers had left their cellphones in the truck.

NTSB Pipeline Accident Report

16

In the April 17, 1992, highly volatile liquid release from an underground storage cavern and explosion in Brenham, Texas, the NTSB noted that had the SCADA system provided a graphic display of historical operating data (which would have allowed the controller to see pressure and flow trends), the pipeline controller could have more easily recognized that the flow rate of highly volatile liquid into a storage cavern was abnormal. The NTSB concluded that the SCADA system did not display data from the storage station in a format that was easy for controllers to interpret, and issued the following safety recommendation to the American Gas Association and the API: P-93-22 Develop standards and guidelines for the design and use of graphic information display systems used by dispatchers to control pipeline systems. (Classified Closed—Acceptable Action on June 5, 2007) In the May 23, 1996, gasoline release near Gramercy, Louisiana, the pipeline controller misread an initial alarm for high pump-case pressure at a refinery that supplied product to the pipeline and attributed that alarm to normal activity at the refinery. He consequently attributed additional SCADA system alarms to similar activities without attending to the nature of each. Moreover, while reading the text of the line balance alarm, he did not notice that the line balance was negative, which indicated a potential leak. The NTSB determined that the controller’s delay in recognizing the rupture delayed shutting down the pipeline and isolating the rupture and contributed to the severity of the accident (NTSB 1998). Damage exceeded $7.8 million. The NTSB made the following two safety recommendations to the pipeline operator, Marathon Ashland Pipe Line LLC: P-98-21 Use recurrent pipeline controller training to (1) emphasize the importance of carefully and completely reading the text of and evaluating all alarm messages, and (2) increase controller proficiency in interpreting and responding to control system data that may indicate a system leak. (Classified Closed—Acceptable Action on April 28, 1999) P-98-22 Evaluate the effectiveness of alternative display formats and frequencies of alarming critical information for your supervisory control and data acquisition system and modify the system as necessary to ensure that controllers are specifically prompted to consider the possibility of leaks during system deviations that are consistent with a loss of product from a pipeline. (Classified Closed―Acceptable Action on April 28, 1999)

NTSB Pipeline Accident Report

17

In the November 5, 1996, diesel overpressure pipeline rupture in Murfreesboro, Tennessee, although the SCADA system registered a sudden 416-psig pressure drop when the line ruptured, no SCADA system alarms were generated. The NTSB determined that the probable cause of the accident, which caused $5.7 million in property damage, was (1) the failure of the pipeline [controller] to follow company procedures for operating the pipeline and (2) the failure of the [SCADA] system to inform the [controller] of unsafe conditions prior to the rupture. (NTSB 1999) In the October 27, 2004, Kingman, Kansas, accident, the controller received numerous alarms within 5 minutes of the rupture. The controller erroneously determined that these alarms were caused by excessive delivery of ammonia from the pipeline and waited for the pressures to return to normal. The NTSB found that the controller did not use the available SCADA system trend screens to review and evaluate the alarms and abnormal conditions (NTSB 2007). In its investigation of the September 9, 2010, rupture of the PG&E 30-inch-diameter intrastate natural gas transmission pipeline in San Bruno, California, the NTSB found that the PG&E SCADA system limitations contributed to the delay in recognizing that there had been a transmission line break and in quickly pinpointing its location (NTSB 2011). The NTSB consequently issued the following safety recommendation to PHMSA: P-11-10 Require that all operators of natural gas transmission and distribution pipelines equip their supervisory control and data acquisition systems with tools to assist in recognizing and pinpointing the location of leaks, including line breaks; such tools could include a real-time leak detection system and appropriately spaced flow and pressure transmitters along covered transmission lines. (Classified Open—Acceptable Response on April 24, 2012) 1.5.2 NTSB SCADA Study In 2005, the NTSB conducted a study examining how pipeline companies use SCADA systems to monitor and record operating data and evaluating the role of SCADA systems in leak detection in the hazardous liquid pipeline industry. Based on information from previous accidents investigated by the NTSB, survey results, and site visits, the NTSB identified five areas for potential improvement: display graphics, alarm management, controller training, controller fatigue, and leak detection systems. As a result, the NTSB issued five safety recommendations to PHMSA:

NTSB Pipeline Accident Report

18

P-05-1 Require operators of hazardous liquid pipelines to follow the American Petroleum Institute’s Recommended Practice 1165 for the use of graphics on Supervisory Control and Data Acquisition Screens. (Classified Closed—Acceptable Action on April 28, 2010) P-05-2 Require pipeline companies to have a policy for the review/audit of alarms. (Classified Closed—Acceptable Action on April 28, 2010) P-05-3 Require controller training to include simulator or non-computerized simulations for controller recognition of abnormal operating conditions, in particular, leak events. (Classified Closed—Acceptable Action on April 28, 2010) P-05-4 Change the liquid accident reporting form (PHMSA F 700-1) and require operators to provide data related to controller fatigue. (Classified Closed―Acceptable Action on April 6, 2010) P-05-5 Require operators to install computer-based leak detection systems on all lines unless engineering analysis determines that such a system is not necessary. (Classified Closed—Acceptable Alternate Action on May 6, 2010) Recognizing the applicability of the liquid pipeline findings to the gas pipeline industry, PHMSA expanded the action taken for the liquid pipeline recommendations to the gas pipeline industry. 1.5.3 PHMSA and Control System Alarm Standards The pipeline and process industries that rely on SCADA-type systems are challenged to design an alarm system that most effectively helps controllers detect leaks or other potential problems. The Columbia Gas strategy for determining how alarms and alerts were structured on the SCADA system was influenced by a new PHMSA regulation on control room management.19 In 2009, PHMSA issued the control room management (CRM) regulations codified in 49 CFR 192.631 (gas) and 195.446 (liquid) to address human factors and other aspects of control room management for pipelines operated by SCADA systems. One intent of these rules was to ensure that pipeline controllers have sufficient time to analyze and react to alarms.

19 The PHMSA regulations were developed as a result of NTSB recommendations from the SCADA study.

NTSB Pipeline Accident Report

19

During the development of the CRM regulation, the International Society of Automation (ISA) was developing ANSI/ISA Standard 18.2, Management of Alarm Systems for the Process Industries.20 The ANSI/ISA standard includes alarm management standards that are applicable to SCADA systems.21 An alarm is defined as “an audible and/or visual means of indicating to the operator [controller] an equipment malfunction, process deviation, or abnormal condition requiring a response.” The standard also discusses the number of alarms that can be safely managed by controllers over a range of time. Based on metrics that have been defined in the standard, between 150 and 300 alarms per day should be manageable by a single controller. In response to the CRM regulations, Columbia Gas revised its SCADA system alarm management plan, including the safety-related alarms. Columbia Gas organized the SCADA system alarm screen display into three distinct sections: alarms, alerts, and communication outages. Conditions designated as alarms indicate that equipment or processes are outside of pipeline operator-defined, safety-related parameters. Conversely, alerts are indications that are not integral to safety-related parameters. For example, alerts indicate that conditions have changed, equipment or other monitoring variables are outside of the defined controlling parameters, or equipment, devices, or processes are not functioning as intended. The Columbia Gas revisions to the SCADA system successfully reduced the number of alarms presented on the SCADA system alarm screen. The new configuration on the combined Charleston and Commonwealth alarm systems averaged 45 per day, or 2 alarms per hour, which is within the parameters identified in the ANSI/ISA 18.2-2009 standard. Although Columbia Gas was successful in limiting the number of alarms on the SCADA system alarm screen, a significant number of indicators (or status information) were displayed as alerts. In a 12-hour shift, a gas controller monitoring both the Columbia and Charleston pipeline systems received an average of 1,145 alerts, or about one every 30 seconds. The gas controllers were responsible for acknowledging each of these alerts. Columbia Gas relies on the controller to recognize an abnormal condition from the SCADA system alarms, alerts, or other system information. The Sissonville accident demonstrates the need to configure alerts to provide actionable information about the state of the pipeline system and the need for a timely and appropriate response. Without such information, the controller might not recognize that a safety-significant situation is developing or has occurred. Although he had acknowledged the initial group of pressure-deviation alerts and several ensuing pressure alerts, the Columbia Gas controller did not recognize that a pressure decay trend had begun to develop. For multiple consecutive repeating alerts, the SCADA system should be capable of monitoring a series of alert conditions and present the data if a trend has developed. This would be a simple yet effective way to reduce the burden on the controller to remember or analyze a series of data outputs. A trend that is indicating an abnormal or unsafe

20 ANSI is the American National Standards Institute. ISA is the International Society of Automation. 21 Because the ISA-18.2 was being updated the same time PHMSA was developing its regulation, PHMSA chose not to adopt the ANSI/ISA standard while it was being revised. The applicable version was issued in 2009.

NTSB Pipeline Accident Report

20

condition could be programmed to trigger an alarm condition that would notify the controller to examine the condition and take corrective action to resolve it. If the system had such provisions, it likely would have helped the controller to recognize the rupture before the Cabot controller called him. The NTSB concludes that providing automatic SCADA system trend data alerts will improve controller recognition of abnormal conditions. 1.6 Pipeline Corrosion The soil surrounding and in contact with the buried pipe segment in the immediate area of the rupture was very rocky.22 (See figure 6.) The rules for backfilling the trench when the pipe was installed cautioned only against damaging the pipe coating if the backfill material contained large rocks. For submerged or buried pipelines, when the current from a cathodic protection system enters the exposed pipe surface, the pipe surface is protected from corrosion. If the exposed pipe surface is shielded (blocked) from the current flow, it is not protected and likely will corrode. A current shield is typically any barrier that prevents the protective current from reaching the exposed pipe surface. Various materials, such as tree roots, rocks, and disbonded dielectric coatings, can provide shielding. The NTSB concludes that the coarse rock backfill most likely damaged the external coating on the pipe and shielded the pipe from the cathodic protection current in the vicinity of the rupture.

Figure 6. Ends of ruptured 20-inch SM-80 pipeline in rocky backfill. The pipeline failure investigation began by excavating the ground past the upstream and downstream ends of the ruptured pipe joint. The ends were cut with a torch about 1 foot past the upstream and downstream girth welds. The two pipe pieces and the ejected pipe were shipped to

22 The rules for design, fabrication, and construction of the 1967 vintage Line SM-80 pipe are contained in the American Standard Code for Pressure Piping, ASA B31.8, Gas Transmission and Distribution Piping Systems, 1963.

NTSB Pipeline Accident Report

21

the NTSB Materials Laboratory in Washington, DC. Examination of the sections indicated that the longitudinal seam in the ruptured pipe was at about the 1 o’clock position, looking east (downstream). The NTSB Materials Laboratory examined three pieces of steel pipe from Line SM-80:  The ejected piece of pipe that ruptured, about 20 feet long  One piece of pipe about 11 feet long, which was immediately downstream (east) of the ruptured piece  One piece of pipe about 8 feet long, which was immediately upstream (west) of the ruptured piece Laboratory measurements indicated that the ruptured pipe joint was 37 feet 8 1/2 inches long and 20 1/2 inches in diameter. The longitudinal fracture was 20 feet 3 inches long. (See figure 7.) Comparing the fracture features of the upstream and downstream ends of the pipe in the crater and the position of the longitudinal seam in the ruptured segment, investigators determined that the longitudinal fracture was near the bottom of the pipe. The pipe wall thickness was measured along the longitudinal fracture using calipers and on a two-dimensional grid on the inner wall surface using an ultrasonic thickness gauge. The lowest caliper reading was 0.078 inch taken on the upstream side of the lateral tear. The caliper readings indicated that the corroded area extended about 6 feet along the longitudinal fracture. The ultrasonic thickness measurements showed a similar extent of wall thinning in the longitudinal direction. The extent of wall thinning along the longitudinal direction was greatest near the tear and extended about 26 inches. The lowest ultrasonic thickness reading was 0.103 inch (37 percent of the original thickness), taken 1 inch upstream of the tear.

NTSB Pipeline Accident Report

22

Figure 7. Ejected ruptured pipe. The ruptured pipe joint was covered with a green polymer coating about 0.010 inch thick. A coal tar enamel coating was applied on top of the green coating along parts of the top and sides of the pipe. Coal tar coverage was not uniform, and the green coating was disbonded in some areas. (See figure 8.) The uniform thickness and relatively smooth surface of the green coating was consistent with application at a factory. The rough appearance of the coal tar was consistent with application in the field.

Figure 8. Underside of pipe upstream of rupture exhibiting primarily uncoated pipe. Boundaries of uncoated portion of pipe are indicated by yellow arrows. The coating coverage varied over the surface of the pipe. Many regions, primarily along the bottom of the pipe, had no protective coating. In other regions, primarily along the sides, the pipe was covered by the green coating but not the coal tar. Along the top of the pipe, the green coating was generally covered by coal tar.

NTSB Pipeline Accident Report

23

Wall thickness measurements were also taken in areas where the green coating adhered to the pipe and the pipe had not corroded. On the upstream pipe piece, the average wall thickness was 0.278 inch. On the downstream pipe piece, the average wall thickness was 0.283 inch. The wall thickness of the uncoated pipe regions along the 6:00 position on the upstream and downstream pipe pieces was measured using the ultrasonic thickness gauge at 6-inch intervals. On the upstream pipe piece, the wall thickness readings varied from 0.271 inch to 0.279 inch. On the downstream pipe piece, the wall thickness readings varied from 0.276 inch to 0.284 inch. Visual examination of the longitudinal fracture after cleaning showed an area of significant external corrosion damage that was 6 feet 3 inches long and 29 inches wide. (See figure 9.)

Figure 9. External corrosion along longitudinal fracture, with boundary of visible corrosion indicated with arrows. Visual examination of the fracture surfaces determined that the rupture initiated immediately upstream of the lateral tear. The fracture surface had a rough and irregular appearance, features that are consistent with a ductile overstress fracture. The initiation site is shown in figure 10.

NTSB Pipeline Accident Report

24

Figure 10. Longitudinal fracture surface on upstream side of lateral tear. Test specimens were cut and prepared for tensile testing and chemical analysis. The average yield strength (0.5 percent elongation method) was 68,000 pounds per square inch (psi). The average tensile strength was 88,000 psi. The average elongation was 27 percent. Test results show that the mechanical properties and chemical composition of the pipe were in accordance with the API Standard 5L grade X60 specification. The burst pressure of the pipe was estimated using the corroded pipe wall thickness data, nominal wall thickness, and measured yield strength (table 1) and nominal yield strength (table 2) following the procedure outlined in ASME B31G-2009 (ASME 2009). Table 1. Calculated burst pressure values following ASME B31G-2009 and using the measured yield strength of 68,000 psi. Evaluation Method Estimated Burst Pressure, psig B31G 770 Modified B31G 1039 Effective Area Method 1117

NTSB Pipeline Accident Report

25

Table 2. Calculated burst pressure values following ASME B31G-2009 and using the specified minimum yield strength of API Standard 5L grade X60 pipe of 60,000 psi. Evaluation Method Estimated Burst Pressure, psig B31G 680 Modified B31G 932 Effective Area Method 1002

The calculated rupture pressures are consistent with a ductile overstress failure caused by external corrosion. The pipe ruptured at 929 psig, compared to the rupture pressure calculated using measured mechanical property values that ranges from 770 psig to 1,117 psig. The pipeline coating provided the primary means of corrosion protection. The cathodic protection was intended to protect the exposed pipe in the areas of coating damage, such as cracked or chipped coating. However, when the cathodic protection current is prevented from reaching an area of exposed metal because of shielding by rocks or disbonded coating, the current cannot protect the pipe, and the unprotected area will corrode. The ruptured pipe segment contained areas of uncoated metal where the coating had disbonded and cracked. There was no external corrosion in those areas, because the cathodic protection likely worked as it was intended. However, more than 30 square feet of the pipe was heavily corroded on the outside surface, as shown in figures 9 and 10. This indicates that the cathodic protection system did not work in the area, likely because of localized shielding caused by the rock backfill. Based on the laboratory findings and field observation of the rupture area, the NTSB concludes that Line SM-80 failed because of severe wall thinning caused by external corrosion. The corrosion occurred because the external protective coating allowed moisture to come in contact with the pipe and the large, coarse rock backfill adjacent to the pipeline blocked the cathodic protection current from the exposed pipe. 1.7 Columbia Gas Corrosion Mitigation Program The external corrosion protection plan is described in Columbia Pipeline Group Plan 70.01.01. For Columbia Gas steel pipelines, external corrosion protection is achieved by use of external coating supplemented with cathodic protection. All three pipelines in the SM-80 system were coated and were protected by an impressed current cathodic protection system. For Line SM-80, the cathodic protection readings taken from the closest test station in the vicinity of the rupture (about 100 feet) over the past 10 years (2003–2012) were satisfactory. Similar readings for Line SM-86 and Line SM-86 Loop from 2005 to 2012 were also satisfactory.

NTSB Pipeline Accident Report

26

1. 7.1 In-Line Inspections

Line SM-80 was not in an HCA at the rupture location, so it was not required to be assessed by in-line inspection (ILI) or any other integrity assessment method.23 The two adjacent, larger-diameter lines were designated to be in an HCA, and they were inspected using ILI. Both had a history of corrosion damage and resulting repairs. Line SM-86 Loop had an ILI on February 10, 2009, using a geometry (caliper/deformation) tool and on March 10, 2009, using a high-resolution magnetic flux leakage tool. Anomalies were detected on Line SM-86 within about 500 feet of the Line SM-80 rupture.24 The data show that there were 161 external metal loss features with 10 percent or more wall thickness loss (nominal wall thickness of 0.385 inch). Of those features, 15 indicated 20 to 30 percent wall loss. The remainder were between 10 and 20 percent wall loss. None required repair. Line SM-86 was inspected on June 25, 2009, using a geometry tool and on June 26, 2009, using a high-resolution magnetic flux leakage tool. The data contained 63 anomalies on Line SM-86 within about 500 feet of the Line SM-80 rupture that had depths up to 40 percent of the wall thickness. Forty-eight anomalies were between 10 and 20 percent of the wall thickness depth. However, none required repair. After the June 26, 2009, ILI inspection, an indication 8.9 inches long and 28.8 inches wide with 47 percent wall loss was excavated and repaired.25 Another indication, 7.9 inches long and 11.4 inches wide with 41 percent wall loss, was also repaired. Documentation provided by Columbia Gas did not show whether any of this ILI information was provided to personnel responsible for Line SM-80 corrosion protection and, if so, how it was used. All three pipelines in the SM-80 system are of comparable age. The data obtained during the 2009 ILIs clearly show that both Line SM-86 and Line SM-86 Loop suffered from various degrees of external corrosion damage even though they were coated and had cathodic protection. This information should have been considered in evaluating the condition of Line SM-80. The NTSB concludes that the corrosion damage discovered in 2009 during the ILIs of the other two pipelines in the SM-80 system was not adequately considered by Columbia Gas when it evaluated corrosion mitigation approaches for Line SM-80. The NTSB further concludes that had Line SM-80 been inspected using ILI or pressure tested after ILI data for Line SM-86 and Line SM-86 Loop were evaluated, the inspection results likely would have revealed the

23 In 1988, Columbia Gas performed an ILI on Line SM-80 to determine whether to replace the uncoated pipe. The ILI tool reported only anomalies with a depth that exceeded 50 percent of the wall thickness in the segment involved in the December 2012 accident. 24 An anomaly is metal loss, including general corrosion or pinholes, linear (crack) indications, gouges, dents, or other physical damage either on the surface of a pipe or in the pipe wall. The decision to repair a pipeline to remove an anomaly is based on a written procedure that rates anomalies based on depth, length, and width and proximity to other anomalies. 25 A indication is a signal from an ILI that is used to identify an anomaly (abnormality, variation, defect) in a pipeline, which may be further evaluated to classify the anomaly as a certain feature (weight loss, crack, girth weld) and classified or characterized as an anomaly, an imperfection, or a component.

NTSB Pipeline Accident Report

27

severe wall loss at the rupture location, and the in-service rupture of Line SM-80 could have been prevented. The NTSB recommends that Columbia Gas establish a procedure to ensure that all integrity-related information gathered for pipelines located in HCAs is considered in the risk assessments and IM of other pipelines not located in HCAs. 1.7.2 Close Interval Surveys A close interval survey (CIS) to assess the condition of the pipe coating and the level of cathodic protection is typically conducted by walking along a pipeline and measuring pipe-to-soil voltage (potentials) every few feet. The readings are compared with the expected cathodic protection level, and locations that fail to meet the expected level are identified and evaluated for mitigation. A CIS was performed on the SM-80 system in 1995. According to Columbia Gas, 6 areas on Line SM-80, 5 areas on Line SM-86, and 16 areas on Line SM-86 Loop did not meet the expected level. A CIS was performed on portions of Line SM-86 in 2004 and 2005 while a new CIS data logger was being tested. Data revealed that 17 areas required corrective action. The remedial measures included installation of additional cathodic protection systems, investigation and elimination of potential interference sources, and pipe recoating. None of the mitigated areas were near the Line SM-80 rupture location. A Columbia Gas corrosion technician noted that a CIS provides useful information about the condition of pipeline coating. However, the Columbia Gas director of IM stated that “coating holidays and areas of potentially inadequate cathodic protection may not be detected if the area is electrically shielded from cathodic protection current.”26 Although Columbia Gas was aware of this limitation of cathodic protection and CIS and was aware in 2009 that the adjacent pipelines in the SM-80 system experienced external corrosion at many locations, the company did not use any other tools or techniques to ensure the integrity of Line SM-80. A variety of tools, such as ILI, CIS, and pressure testing, are available to pipeline operators for evaluating pipeline integrity, each with advantages and limitations. For example, pressure testing requires taking the pipeline out of service, filling it with water, and draining and drying the pipe. Close interval surveys measure the cathodic protection voltage every few feet along a specific length of the pipe, so it does not cover 100 percent of the pipe and does not detect shielding caused by rocks or other material. Digging to expose the pipe provides access to the pipe surface to conduct visual and other examinations, but it is costly and may damage the pipe coating. The advantages and limitations of the evaluation methods need to be considered by pipeline operators when evaluating pipeline integrity to ensure safe operation.

26 A holiday is a hole in the protective coating material that can allow moisture to come in contact with the pipe surface.

NTSB Pipeline Accident Report

28

1. 8 Integrity Management
2. 8.1 Pipelines Close to Highways

PHMSA promulgated the IM rule for natural gas transmission pipelines on January 14, 2004, following the enactment of the Pipeline Safety Improvement Act of 2002.27 The IM rule, at 49 CFR 192.903(1)(iii), requires pipeline operators to identify HCAs along a pipeline based on a potential impact radius (PIR), which is a function of pipe diameter and pressure. The buildings within the PIR circle that are intended for human occupancy are counted. If the number is 20 or more, the area is classified as an HCA. During the comment period for the IM rule, several commenters argued that additional infrastructure facilities, such as interstate interchanges, bridges, certain railway facilities, electric transmission substations, and drinking water plants, should be included in the HCA definition. However, in deciding to exclude these additional areas from the HCAs, PHMSA stated the following: When we issued the final rule defining these areas, we agreed that impacts to critical infrastructure could have detrimental impact but that such impacts would not likely include death or serious injury. A major purpose of the integrity management rule is to focus the highest level of [pipeline] operator attention on those portions of its pipeline that can have the most severe safety consequences, i.e., can cause death and injury. (Federal Register 2003, 69785) According to the Public Service Commission of West Virginia (PSC) no highway fatality or injury resulted from a pipeline accident in West Virginia from January 1, 2000, to April 12, 2013; the PSC added that in that time, only two pipeline incidents involving motor vehicles occurred, and they were on distribution systems.28 The PSC further stated that West Virginia has only 7 locations where pipelines cross interstate highways (including the Line SM-80 I-77 crossing), 2 locations where pipelines cross limited access highways, and 87 locations where interstate pipelines cross roads. According to PHMSA, there are 7,105 locations nationwide where natural gas transmission pipelines cross divided and/or interstate highways. Of these 4,282 are in HCAs. PHMSA also reported that within the United States, 5,804 miles of gas transmission pipelines lie within 660 feet of major highways. Of these, 3,427 miles of pipelines are within HCAs, and PHMSA stated that it is possible that some of the remaining 2,377 miles of pipelines might already be covered by IM plans. The NTSB reviewed the history of pipeline accidents near interstate highways that occurred between January 2000 and April 2013. On December 14, 2007, a pipeline ruptured near

27 The Pipeline Safety Improvement Act of 2002, Pub. L. 107-355, was signed into law on December 17, 2002, and codified at 49 U.S.C. 60109. 28 PSC April 12, 2013, e-mail to NTSB staff.

NTSB Pipeline Accident Report

29

Interstate 20 in Delhi, Louisiana, killing a man who was driving on the highway and injuring his passenger.29 On May 4, 2009, an 18-inch-diameter natural gas transmission pipeline owned and operated by Florida Gas Transmission Company ruptured in Palm City, Florida (NTSB 2013). The rupture was located in the right-of-way between Interstate 95 and the Florida Turnpike. There was no ignition, but two injuries occurred when the driver of a car on the interstate lost control of the car. The Sissonville pipeline rupture caused major damage to I-77. An intense fire raged directly across the interstate for nearly an hour. Had the accident occurred during commuting hours, when traffic would have been significant, severe or fatal injuries could have occurred. Both the Sissonville and the Palm City accidents show the vulnerability of highways, or principal arterial roadways, that are close to high-pressure pipelines and the threat that proximity poses to the safety of people and property.30 The NTSB is concerned that gas transmission pipelines in proximity to arterial roadways are exempted from HCA consideration by PHMSA. Both the Sissonville and the Palm City, Florida (NTSB 2013), accidents show the consequences of pipeline ruptures to the nation’s arterial roadways. Sudden closure of arterial roadways for several hours can significantly affect commuters, first responders, and US commerce. Therefore, the NTSB concludes that if pipelines in proximity to highways had been included in the HCA classification, the ruptured area of Line SM-80 would have been covered by the IM regulation and would have been evaluated. Furthermore, the NTSB concludes that the consequences of a pipeline rupture in proximity to an arterial roadway are similar to the consequences of a pipeline rupture near structures for human occupancy, as currently addressed in an HCA. The NTSB recommends that PHMSA revise 49 CFR Section 903, Subpart O, Gas Transmission Pipeline Integrity Management, to add principal arterial roadways including interstates, other freeways and expressways, and other principal arterial roadways as defined in the Federal Highway Administration’s Highway Functional Classification Concepts, Criteria and Procedures to the list of “identified sites” that establish an HCA. 1.8.2 Columbia Gas Integrity Management Program The Columbia Gas IM program is integrated into other functional groups within Columbia Gas including the project, operations, and maintenance teams. In 2009, Columbia Gas established an integrity steering team that is a cross-functional team responsible and accountable for the IM program and that reports to the president of operations and engineering and the senior vice president of operations. The integrity steering team is responsible for developing and coordinating a comprehensive IM program. The team is responsible for defining and leading the

29 PHMSA staff, e-mail message to NTSB staff, April 19, 2013. 30 Principal arterial roadways, or arterial roadways, as defined in the Federal Highway Administration’s Highway Functional Classification Concepts, Criteria and Procedures, are designed and constructed to maximize their mobility function. They include interstates, other freeways and expressways, and other principal arterials. Other freeways and expressways “have directional travel lanes that are usually separated by some type of physical barrier, and their access and egress points are limited to on- and off-ramp locations or a very limited number of at- grade intersections” Other principal arterial roadways “serve major centers of metropolitan areas, provide a high degree of mobility, and can also provide mobility through rural areas.” They are not access-controlled and may be accessed by driveways to specific areas and intersections with other roadways.

NTSB Pipeline Accident Report

30

companywide system integrity efforts to mitigate identified risk, assure regulatory compliance, and effectively execute the IM program. The Columbia Gas IM program involves identifying HCAs along its pipeline system, identifying threats and ranking risks, conducting assessments, and taking appropriate action to ensure the integrity of pipelines in the HCA. Additionally, in 2010, Columbia Gas conducted risk assessments for the entire gas transmission pipeline system. Pipeline regulations addressing internal and external corrosion monitoring and mitigation are risk based. Class 3 and Class 4 locations and Class 1 and Class 2 HCA locations have a higher population density, resulting in greater risk to the public, and therefore the regulations addressing corrosion are more stringent. The population densities in Class 1 and Class 2 areas not containing any HCAs are lower, and the pipeline regulations for evaluating pipeline integrity in those areas are less stringent. Threat identification along with risk assessment and management is part of the overall IM program. The risk management team reviews the risk management results to identify those segments that require additional preventive and mitigative measures to manage the threats on the particular pipeline segment. The team also reviews the risk drivers and threats from the risk management reports and identifies additional potential preventive and mitigative measures. For preventive and mitigative measures that are identified as operational activities, the risk management team coordinates activities with the operations team leaders to ensure proper actions are taken and the actions are recorded and updated in the Columbia Gas work management system records. The risk management team develops the actions that need to be taken as a part of the Columbia Gas IM program, and the IM or the operations team carries out the activities. Coordination is essential to ensure the proper action is taken and the action is part of the Columbia Gas work management system records that are audited by the PSC. Columbia Gas conducts risk assessments annually, or more frequently if significant events, such as an accident or poor inspection readings, trigger an interim assessment. The interim assessment identifies risk level changes in the model. Events such as the installation of new facilities, changes to HCAs, changes to the risk model, or class changes can trigger an interim risk assessment. Relative risk scores are calculated through a series of algorithms developed by Columbia Gas, and higher scores indicate higher relative risk. The relative risk score of 13.45 near the rupture location was one of the top two scores for Line SM-80. According to Columbia Gas, the segments in its system with the highest risk typically have scores above 20. Columbia Gas uses risk management to identify and quantify threats to pipeline safety and evaluates pipelines in HCAs and those not in HCAs by using various risk-based metrics. The information is used to prioritize pipeline segments based on the risk and the threats they are exposed to and to identify mitigation strategies to lower pipeline safety risk. As discussed in section 1.7.1, Columbia Gas had no records to show whether ILI information from Lines SM-86 and SM-86 Loop was considered to identify the external corrosion threats to Line SM-80. The PIR circles for each pipeline in the SM-80 system at the rupture location are shown in figure 11. Each pipeline is evaluated individually to determine its HCA location. Pipeline

NTSB Pipeline Accident Report

31

interconnectivity, proximity to other pipelines, and any overlapping PIR circles do not impact HCA determinations. Based on regulatory criteria, only Lines SM-86 and SM-86 Loop were in HCAs and covered by the IM regulation. Maintaining the integrity of Line SM-80 was the responsibility of the Corrosion Control department until 2010. In 2010, Columbia Gas implemented a new risk tool that allowed risk to be calculated throughout the pipeline system. The other two lines were in HCAs, so they were under the more stringent risk management plan. 1.9 Postaccident Corrective Actions As a result this accident, PHMSA issued corrective action order (CAO) CPF No.1-2012-1025H to Columbia Gas on December 20, 2012. The CAO required Columbia Gas to develop written plans for specific actions, and the plans were required to be approved by PHMSA before any work could start. Some of the actions the CAO required Columbia Gas to perform were the following:  Conduct an ILI of Line SM-80 using a high-resolution deformation and metal loss tool and excavate, investigate, and repair anomalies as if the line were in an HCA.  Perform CIS, investigate, and correct deficiencies.  Assess the integrity of the coating using direct current voltage gradient or alternating current voltage gradient surveys and correct any identified deficiencies. In response to the CAO, Columbia Gas replaced several pipe segments in Line SM-80 with new 20-inch-diameter, 0.375-inch-thick wall, API Standard 5L grade X65 fusion-bonded epoxy mill-coated steel pipe and pressure tested the new segments to between 2,024 psig and 2,438 psig (83 to 100 percent of specified minimum yield strength). For a 1,000 psig MAOP pipeline, this test pressure translates to 202 to 243 percent of MAOP. Columbia Gas hydrostatically tested the pipe at a minimum test pressure of 2,438 psig.

NTSB Pipeline Accident Report

32

Figure 11. Potential impact radius circles for each pipeline in SM-80 system at rupture location. The Columbia Gas plan included an ILI inspection and a CIS of Line SM-80. The 2013 ILI data identified eight external and two internal metal loss anomalies in the line. The smallest external metal loss anomaly was 9.0 inches long and 49.5 inches wide with 24 percent wall loss, and the largest external metal loss anomaly was 23.2 inches long and 62.6 inches wide with 29 percent wall loss (nominal wall 0.25 inch). Some dent anomalies were also reported. All work orders issued to correct the unacceptable anomalies on Line SM-80 were completed by October 2013.

NTSB Pipeline Accident Report

33

• Conclusions

1. 1 Findings

• Third-party direct pipeline impact damage was not a factor in this accident.
• The controller was experienced and qualified, fit for duty, not physically fatigued, and not

under the influence of illicit drugs or alcohol on the day of the accident.

• Line SM-80 ruptured at 12:41 p.m.
• Despite the many pressure deviation alerts occurring on the system over more than

12 minutes, the Columbia Gas Transmission Corporation controller did not recognize the significance of the situation or begin to shut down the system until after the Cabot controller called him.

• The Columbia Gas Transmission Corporation supervisory control and data acquisition

system alerts did not provide useful, meaningful information to the controller to assist him in determining the operating condition of the pipeline.

• Providing automatic supervisory control and data acquisition system trend data alerts will

improve controller recognition of abnormal conditions.

• Strategically placed automatic shutoff values or remote controlled valves would have isolated

the three pipelines and shortened the duration of the intense fire.

• The coarse rock backfill most likely damaged the external coating on the pipe and shielded

the pipe from the cathodic protection current in the vicinity of the rupture.

• Line SM-80 failed because of severe wall thinning caused by external corrosion.
• The corrosion damage discovered in 2009 during the in-line inspections of the other two

pipelines in the SM-80 system was not adequately considered by Columbia Gas Transmission Corporation when it evaluated corrosion mitigation approaches for Line SM-80.

• Had Line SM-80 been inspected using in-line inspection or pressure tested after in-line

inspection data for Line SM-86 and Line SM-86 Loop were evaluated, the inspection results likely would have revealed the severe wall loss at the rupture location, and the in-service rupture of Line SM-80 could have been prevented.

• If pipelines in proximity to highways had been included in the high consequence area

classification, the ruptured area of Line SM-80 would have been covered by the integrity management regulation and would have been evaluated. NTSB Pipeline Accident Report

34

• The consequences of a pipeline rupture in proximity to an arterial roadway are similar to the

consequences of a pipeline rupture near structures for human occupancy, as currently addressed in a high consequence area. 2.2. Probable Cause The National Transportation Safety Board determines that the probable cause of the pipeline rupture was (1) external corrosion of the pipe wall due to deteriorated coating and ineffective cathodic protection and (2) the failure to detect the corrosion because the pipeline was not inspected or tested after 1988. Contributing to the poor condition of the corrosion protection systems was the rocky backfill used around the buried pipe. Contributing to the delay in the controller’s recognition of the rupture was Columbia Gas Transmission Corporation management’s inadequate configuration of the alerts in the supervisory control and data acquisition system. Contributing to the delay in isolating the rupture was the lack of automatic shutoff or remote control valves. NTSB Pipeline Accident Report

35

• Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration: Revise Title 49 Code of Federal Regulations Section 903, Subpart O, Gas Transmission Pipeline Integrity Management, to add principal arterial roadways including interstates, other freeways and expressways, and other principal arterial roadways as defined in the Federal Highway Administration’s Highway Functional Classification Concepts, Criteria and Procedures to the list of “identified sites” that establish a high consequence area. (P-14-1) To Columbia Gas Transmission Corporation: Implement a process for selecting alert setpoints, and provide guidance to pipeline controllers on the expected alert response time, ways to evaluate the significance of alerts, and actions the controller must take in response to those alerts. (P-14-2) Modify your supervisory control and data acquisition system to (1) provide the controller with operating parameter trend data that can be used to evaluate the significance of a system change and (2) assign an alarm function to trends that are likely significant system malfunctions and therefore require immediate action by the controller. (P-14-3) Establish a procedure to ensure that all integrity-related information gathered for pipelines located in high consequence areas is considered in the risk assessments and integrity management of other pipelines not located in high consequence areas. (P-14-4) NTSB Pipeline Accident Report

36

BY THE NATIONAL TRANSPORTATION SAFETY BOARD DEBORAH A.P. HERSMAN ROBERT L. SUMWALT Chairman Member

CHRISTOPHER A. HART MARK R. ROSEKIND Vice Chairman Member

EARL F. WEENER

Member Adopted: February 19, 2014

NTSB Pipeline Accident Report

37

• Appendixes

1. 1 Appendix A: Investigation

The National Response Center was notified of the rupture of Columbia Gas Transmission Corporation’s natural gas transmission pipeline at 1:24 p.m. on December 11, 2012. NTSB Member Robert Sumwalt and six investigators launched to the accident scene. On January 20, 2013, NTSB Chairman Deborah Hersman testified before a field hearing of the Senate Committee on Commerce, Science, and Transportation in Charleston, West Virginia, regarding the NTSB’s ongoing investigation of the pipeline rupture and fire in Sissonville and the safety risks posed by the transportation of oil and natural gas by pipeline. Her statement described to the Committee the pipeline that ruptured in Sissonville, the impact of the rupture and subsequent fire, and actions taken immediately afterward. She also briefed the Committee on key NTSB findings and recommendations as the result of its past investigations of major pipeline accidents. Parties to the investigation were Pipeline and Hazardous Materials Safety Administration; Public Service Commission of West Virginia; Columbia Gas Transmission Corporation; Kanawha County Sheriff’s Office; and West Virginia State Police, South Charleston Detachment. NTSB Pipeline Accident Report

38

1. 2 Appendix B: Timeline

NTSB Pipeline Accident Report

39

NTSB Pipeline Accident Report

40

References ASME (American Society of Mechanical Engineers). 2009. Manual for Determining the Remaining Strength of Corroded Pipelines: Supplement to ASME B31 Code for Pressure Piping, B31G–2009. New York: ASME. Federal Register. 2009. Vol. 60, no. 97 (December 3). ----. 2003. Vol. 68, no. 240 (December 15). Federal Highway Administration. 2013. Highway Functional Classification: Concepts, Criteria and Procedures, FHWA-PL-13-026. Washington, DC: Federal Highway Administration, US Department of Transportation. NTSB (National Transportation Safety Board). 2013. Pipeline Rupture and Gas Release, Palm City, Florida, May 4, 2009, PAB-13/01. Washington, DC: NTSB. ----. 2011. Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire, San Bruno, California, September 9, 2010, PAR-11/01. Washington, DC: NTSB. ----. 2007. Anhydrous Ammonia Pipeline Rupture, Kingman, Kansas, October 27, 2004, PAB-07/02. Washington, DC: NTSB. ----. 1999. Hazardous Liquid Petroleum Products Overpressure Rupture, Murfreesboro, Tennessee, November 5, 1996, PAB-99/03. Washington, DC: NTSB. ----. 1998. Release of Hazardous Liquid, Grammercy, Louisiana, May 23, 1996, PAB-98/01. Washington, DC: NTSB. ----. 1995. Texas Eastern Transmission Corporation Natural Gas Pipeline Explosion and Fire, Edison, New Jersey March 23, 1994, PAR-95/01. Washington, DC: NTSB. ----. 1993. Highly Volatile Release from Underground Storage Cavern and Explosion, Mapco Natural Gas Liquids, Inc., Brenham, Texas, April 7, 1992, PAR-93/01. Washington, DC: NTSB. NiSource (NiSource Gas Transmission & Storage). 2012. Control Room Management Plan, August 1, 2011, revised October 8, 2012. Merrillville, Indiana: NiSource.

FD07428 ｜ 2014_美国_RAB1407.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

CSX Transportation Coal Train Derailment Killed Two Individuals 1 NTSB/RAB/14-07

National Transportation Safety Board Railroad Accident Brief CSX Transportation Coal Train Derailment Killed Two Individuals

Accident No.: DCA12MR009 Location: Ellicott City, Maryland Date: August 20, 2012 Time: 11:54 p.m. eastern daylight time Train: CSX Transportation coal train U81318 Railroad: CSX Transportation Property Damage: $1.9 million Injuries: 0 Fatalities: 2 Type of Accident: Derailment

The Accident On August 20, 2012, about 11:54 p.m. eastern daylight time, an eastbound CSX Transportation (CSXT) coal train, U81318, derailed the first 21 cars at milepost (MP) 12.9 while crossing the railroad bridge over Main Street on the Old Main Line (OML) Subdivision in Ellicott City, Maryland.1,2 The train consisted of two locomotives and 80 loaded coal cars; the train length was 4,227 feet and the weight was 9,873 trailing tons. Seven of the derailed cars fell into a public parking area that was below and north of the tracks. The remainder of the derailed cars overturned and spilled coal along the north side of the tracks. (See figure 1.) Prior to the train crossing the bridge, two individuals entered the railroad right-of-way on the north side of the railroad bridge that crossed Main Street. They climbed over a short wooden fence and entered CSXT property without authorization to access the railroad bridge. They were sitting on the bridge during the derailment. Both individuals were killed by the spilled coal. The CSXT train crew consisted of an engineer, a conductor, and an engineer trainee. No crewmembers were injured. At the time of the accident, the sky was cloudy and dark, the wind was calm, and the temperature was 65°F. The damage was estimated to be $1.9 million.

The CSXT train crew reported for duty at 4:00 p.m. on August 20, 2012, in Cumberland, Maryland. The train departed Cumberland eastbound toward Baltimore, Maryland.

1 All times in this brief are eastern daylight time. 2 In this report, all train movements and track references will refer to timetable direction.

CSX Transportation Coal Train Derailment Killed Two Individuals 2 NTSB/RAB/14-07

Figure 1. Derailed train on the railroad bridge. (Photo by the Howard County Police Department) Emergency Response At 11:55 p.m., the first 911 call was received by the Howard County Police Department. The caller reported that a train had derailed on a bridge over Main Street in Ellicott City. Three additional 911 calls followed. About three minutes later, the initial police department units were dispatched; one minute later, fire companies from the Howard County Department of Fire and Rescue Services were dispatched, and Howard County dispatchers notified Baltimore County about the accident.3 Police and fire personnel began arriving on scene at 12:02 a.m. on August 21. A unified command system was established with the fire and the police department officials. Police dispatchers established direct contact with CSXT. Police officers began closing streets in the area to secure the scene. At 12:07 a.m., a fire department engine company located the train crew. Fire dispatchers contacted Baltimore Gas & Electric Company and requested that personnel respond to the scene. At 12:15 a.m., a fire department engine company located the two fatally injured individuals on the bridge. Coal spilled from the overturned cars onto the railroad right-of-way, the street, a parking lot, and along the Patapsco River. An environmental response contractor for CSXT conducted

3 At the accident location, the border between Howard County and Baltimore County parallels the railroad right-of-way.

CSX Transportation Coal Train Derailment Killed Two Individuals 3 NTSB/RAB/14-07

water sampling and verified that no environmental impact had occurred. The Maryland Department of the Environment monitored the environmental sampling. The Investigation National Transportation Safety Board (NTSB) investigators interviewed the crewmembers who stated that, until the derailment, the trip was uneventful with no unusual occurrences. At the time of the accident, the three crewmembers were in the lead locomotive; the engineer trainee was operating the train. No temporary speed restrictions were in effect on the approach to Ellicott City. None of the crewmembers reported seeing any unauthorized people on the railroad right-of-way. The crewmembers stated that the train was travelling at 24 mph when the train went into emergency braking at MP 12.8. The train had stopped in about three car lengths (or about 150 feet). The crew notified the CSXT dispatcher of the emergency braking. After the conductor exited the locomotive to inspect the train, he discovered that it had derailed. The crew stated that emergency personnel began arriving at this time. The crew provided the fire department with the train paperwork that described the train consist and advised that the train consisted of loaded coal cars. NTSB investigators reviewed the event recorder data that indicated the train was operating at 23 mph at the time of the derailment. The authorized speed in the area of the derailment was 25 mph. According to the Maryland Office of the Chief Medical Examiner, the cause of death for both 19-year-old individuals was compressional asphyxia. The record notes that both had been seen consuming alcoholic beverages prior to the accident. Toxicology testing was performed by the Office of the Chief Medical Examiner. In one individual, ethanol was identified in vitreous at 0.05 gm/dL. In the second individual, ethanol was 0.03 gm/dL in vitreous. Signal and Train Control The OML runs in a timetable east to west direction between control point (CP) St. Denis at MP 6.5 and CP Point of Rocks at MP 64.7. Train movements are governed by operating rules, timetable instructions, and signal indications from a traffic control system. A dispatcher coordinates the train movements with the signal system from the Baltimore Division operations center in Halethorpe, Maryland. An examination of recorded signal data indicated that the crew was operating on permissive signals. No track anomalies existed that would have either disrupted the track circuit or resulted in an alert being sent to the operations center. Wreckage Description The two locomotives did not derail. The first car behind the locomotive pitched and rolled (that is, all wheels were off the track) about 45 degrees to the north. The next nine cars overturned to the north of the track. Car 11 decoupled from car 10. Cars 11 through 17 derailed and fell into the public parking lot that was below the tracks. Cars 18 through 20 overturned. The

CSX Transportation Coal Train Derailment Killed Two Individuals 4 NTSB/RAB/14-07

leading two axles on car 21 derailed, while the trailing two axles were still on the rail. The leading end of car 21 was buried 3 to 4 feet into the ballast. The rail under the derailed cars was destroyed. Some sections of the broken rail had indications of overstress fractures that are characterized by a shiny, granular appearance with sharp edges around the freshly exposed metal. In addition, a section of broken rail that was found under car 21, had the appearance of recent longitudinal loading at the exposed edge of the rail head that is consistent with wheel tread impacts.4,5 Equipment Locomotives NTSB investigators mechanically inspected the two locomotives; no anomalies were identified. The review of the maintenance and the inspection records for both locomotives indicated that all required Federal Railroad Administration (FRA) and CSXT mechanical inspections were current, and no defect was recorded. Non-Derailed Cars The 59 non-derailed cars were uncoupled from the train at the derailment site on August 21, 2012. The NTSB investigators observed an airbrake test and mechanically inspected the cars. The brakes on the 59 cars applied and released as designed. No anomalies were identified with this equipment. Derailed Cars At the accident scene, NTSB investigators examined the first 10 derailed cars. No anomalies were identified with the conditions of either the brake rigging or the side bearing plates on the cars; all appeared to have normal contact wear patterns. The side frames, bolsters, and wheels were examined; no abnormal conditions were observed. Wheels from the cars that traveled over the north rail were observed to have witness marks in the tread that was perpendicular to the running surface. Progressing from car 1 to car 10, the witness marks increased in size and depth. Wheel and axle assemblies were recovered from cars 11 through 20 for examination. Investigators identified and documented all wheels by serial number, using information from CSXT that allowed loose wheel sets to be matched up with the car on which they were installed. No wheel defects were noted.

Investigators noted that many of the examined wheels had witness marks that were similar to those found on cars 1 through 10. Investigators positioned the wheels from the 12th car (CSXT 302724) as the wheels would have been while traveling through the derailment area. (See figure 2.)

4 The rail head is the top portion of the rail, which provides a running surface for the wheel tread and a side surface against which the wheel flange contacts. 5 The tread is the slightly tapered exterior running surface of the wheel that comes in contact with the top surface of the rail.

CSX Transportation Coal Train Derailment Killed Two Individuals 5 NTSB/RAB/14-07

Figure 2. Wheel sets from car CSXT 302724. On close examination, investigators observed several perpendicular strike marks in the wheel tread of the third set of wheels that indicates a track-related defect. These marks were the first to have a pattern of successive impacts that were about 3 inches apart. (Marks were not found on the wheels of first and second set of axles.) In addition, a corresponding mark, or a mark on the adjacent wheel in the same horizontal plane of reference, was observed on the L3 wheel (the second wheel on the right side of the car in the direction of travel), located on the outside rim of the wheel. Track and Engineering The track between MP 9.7 and MP 20.0 is single main track. This line is the oldest common carrier railroad in the United States; it was formerly known as the Baltimore and Ohio Railroad. CSXT inspects and maintains the track in the vicinity of Ellicott City between MP 18.0 and MP 12.7 in accordance with FRA track safety standards for class 2 and 3 track, which has a maximum operating speed of 40 mph.6 The accident occurred in a curve that has a restricted speed of 25 mph; the authorized operating speed on either side of the curve was permanently restricted to 30 mph. During an average day, 10 trains operate on the OML Subdivision. This

6 Track safety standards are defined in 49 Code of Federal Regulations, Part 213, §213.9 Classes of Track Operating Speeds.

CSX Transportation Coal Train Derailment Killed Two Individuals 6 NTSB/RAB/14-07

amounts to about 33.70 million gross ton-miles (MGT) annually for the area of the derailment site.7 In the rail preceding the damaged track (west end), NTSB investigators found field welds and recently installed sections of rail.8 The CSXT roadmaster stated during an interview with NTSB investigators that routine maintenance was completed in May 2012 on the track in the Ellicott City area.

At the derailment site, investigators noted no rail movement and no exceptions to the anchoring pattern or rail restraint effectiveness. Investigators did observe mud at some track locations; this indicates that water drainage was not optimal. Rail Examination

Over 2 days, investigators recovered rail pieces from the derailment area and reassembled them along the north side of the right-of-way to the west of the point of derailment. Investigators inventoried, measured, and documented each piece that was recovered. The south rail was not broken and remained upright on the crossties for most of the derailment area. The only piece used in the rail rebuild was a section that showed a loss of normal wheel/rail relationship that was directly opposite of the north rail rebuild location. This section of the south rail was under the last derailed car (that is, the 21st car). Investigators pieced together and examined the recovered rail. The entire south rail was reconstructed. While reconstructing the west portion of the north rail, investigators found that about 5 inches of rail were missing (and could not be located in the derailment debris). Based on the inspection data for July and August 2012, investigators estimated that the length of rail from the west end of piece N1 to the location of the repaired defect in N19 was about 17 feet 1 inch (205 inches).

At the accident scene on August 23, 2012, investigators examined the reconstructed rail and the fracture faces. Six rail sections and several other smaller rail pieces were sent to the NTSB materials laboratory for further examination. The laboratory examinations verified that 5 inches of rail were missing. (See figures 3 and 4.) The 17 feet 1 inch of rail exhibited several detail fractures; the largest was about 24 percent of the existing rail head cross section.

7 Gross ton-miles are a measure of transportation, being the movement of the combined weight of cars and lading a distance of 1 mile. 8 A field weld is a weld joining two rails together after rails are installed in track.

CSX Transportation Coal Train Derailment Killed Two Individuals 7 NTSB/RAB/14-07

Figure 3. View of rail rebuild.

Figure 4. Cross-sectional view of a severe wheel flange strike mark on the head of a broken rail.

CSX Transportation Coal Train Derailment Killed Two Individuals 8 NTSB/RAB/14-07

Table 1 lists the measurements conducted in the NTSB Materials Laboratory. Rail Piece Length (inches) N1 88.75 Missing length* 5.0 N5 20.25 N15B 6.625 N16B 9.25 N17B 11.125 N18 40.75** N19B (west end to break within joint bars) 25.0 Total 206.75 Table 1. *The missing length between N1 and N5 was determined based on the missing length within the identification stencil on pieces N1 and N5. **The length of N18 includes missing material due to end batter at the west end as determined using the mating fracture on piece N17B.

NTSB investigators reviewed the track inspection data and examined rail pieces. Investigators measured transverse defects in the fracture faces.9 Table 2 shows a comparison of the defect size of the remaining rail head to (1) the remaining head area (percentage), and (2) the original head area (percentage).

Fracture Surface Defect Size Relative to Remaining Head Area (percent) Defect Size Relative to Original Head Area (percent) N1 east end 9 5 N5 west end 24a 14 N5 east end 10 6 N15 east end/N16 west end 2 1 N16 east end/N17 west end

N18 east end/N19 west end 1

N19 east end/N20 west end 15 9 Table 2. Summary of defect size measurements.

9 A transverse defect is a type of fatigue that has developed in a plane transverse to the cross-sectional area of the rail head. Development can be normal or in multiple stages before failure. The transverse defect is identified only by the nondestructive inspection process, unless the defect has progressed to the rail running surface and has cracked out.

CSX Transportation Coal Train Derailment Killed Two Individuals 9 NTSB/RAB/14-07

aCSXT engineering personnel met with the NTSB in Washington, DC, in July 2013 to review the data and the images associated with the 24-percent transverse defect. CSXT did not agree to the 24-percent number; CSXT stated that because of the rail end batter and the rubbing that had occurred in the accident, a size could not be determined. CSXT Inspection and Maintenance of the OML Subdivision

The frequency and applicable classes of track for which internal rail flaw detection is conducted is described in 49 Code of Federal Regulations, Part 213:

§ 213.237 Inspection of rail (a) In addition to the track inspections required by §213.233, a continuous search for internal defects shall be made of all rail in Classes 4 through 5 track, and Class 3 track over which passenger trains operate, at least once every 40 million gross tons (MGT) or once a year, whichever interval is shorter. On Class 3 track over which passenger trains do not operate such a search shall be made at least once every 30 MGT or once a year, whichever interval is longer. ** [This paragraph (a) is effective January 1, 1999.]

Based on the annual tonnage figures for the OML Subdivision, CSXT was required to test the rail for internal defects once per year. Although regulations require a search for internal rail flaws once per year for Class 3 track, which has a maximum authorized speed of 40 mph, the regulations do not require the testing of a permanent speed-restricted 25-mph curve.

CSXT was aware of the history of rail defects on the OML Subdivision and of the increase in tonnage due to a rise in coal traffic over the previous years. CSXT retained a consulting firm to recommend the ultrasonic rail detection intervals. The consultants recommended that CSXT test the OML Subdivision every 30 days. CSXT adopted this recommendation in 2009. The records provided by CSXT documented that ultrasonic testing of the OML Subdivision occurred 11 to 12 times per year, beginning in August 2010―a frequency that is 12 times greater than required by regulations. Investigators reviewed the CSXT geometry test data, ultrasonic records, and test frequency. No anomalies were noted. CSXT Geometry Test Vehicle Data

On August 6, 2012, CSXT operated a geometry vehicle to measure the track. This test began at CP Point of Rocks and continued eastward to CP St. Denis. The data recorded the location of defects from each MP in a descending manner. Below are the track or geometry conditions recorded by the test vehicle near the point of derailment: • A warp condition in a curve at MP 12.92 that measured 1.28 inches; • A wide gage condition in a curve at MP 12.92 that measured 1.18 inches; and • A wide gage condition in a curve at MP 12.76 that measured 1.17 inches.

CSX Transportation Coal Train Derailment Killed Two Individuals 10 NTSB/RAB/14-07

FRA Geometry Test Vehicle Data

The FRA operated the Automated Track Inspection Program geometry vehicle, T-217, over the OML Subdivision on July 17, 2012. The FRA data showed no recorded defects for that test, including in the vicinity of the derailment. Sperry Reports Review Investigators reviewed the ultrasonic internal rail test data conducted on the OML Subdivision for the three most recent tests. The last test before the derailment, which was conducted on August 3, 2012, included 15.20 miles from MP 21.7 to MP 6.5. During this internal rail flaw inspection, no defective rails were marked near the derailment area. However, the nearest rail defect east of the derailment was located at MP 9.908 and was coded as a 40-percent transverse detail fracture. The nearest rail defect or condition recorded west of the derailment was located at MP 14.749; it was coded as a spall, shell, or corrugation defect. On August 3, 2012, ultrasonic testing was conducted from MP 21.7 to MP 6.5. In the area of the derailment, no defects were recorded. The closest defect was a 40-percent transverse detail fracture at MP 9.908.

On July 6, 2012, ultrasonic testing was conducted from MP 20.1 to MP 10.9. Two defects were recorded in the area of the derailment. These defects included a 100-percent transverse detail fracture at MP 12.903 and a 40-percent transverse detail fracture at MMP 12.395. A spall, shell, or corrugation defect at MP 12.303 also was recorded. On June 5, 2012, ultrasonic testing was conducted from MP 21.8 to MP 6.60. One defect was recorded in the area of the derailment. A spall, shell, or corrugation defect was recorded at MP 12.299; the next closest defect was a 9-percent transverse detail fracture at MP 11.034. Postaccident Rail Defect Data

Investigators requested and received the rail defect data and the service rail failure report data from CSXT. Tables 3 and 4 show the annual inspection details (from 2008 to the test just before the derailment). A test cycle is representative of multiple test dates to cover the OML Subdivision. In table 3, the transverse detail fracture type defects for the OML are listed in the fourth column; the fifth column shows the number of transverse detail fractures that were located in curves. The last sixth and seventh columns show the number of service rail failures that occurred and were reported on the OML Subdivision and the Baltimore Division, respectively.

CSX Transportation Coal Train Derailment Killed Two Individuals 11 NTSB/RAB/14-07

Year Test Cycles Total Defects OML Transverse Detail Defects OML Transverse Detail Defects in Curves Service Rail Failures OML Service Rail Failures Baltimore Division MGT Annual Tonnage 2007

1. 34

2008 6 106 57 28 18 137 51.91 2009 7 124 86 48 12 87 58.36 2010 6 95 67 44 3 77 47.00 2011 11 145 86 51 14 55 36.23 2012 8 91 44 21 6 32 31.02 Table 3. Sperry rail flaw detection data and annual tonnage.

Table 4. Annual tonnage data, internal rail flaw detection tests, defect numbers, and service rail failures for Old Main Line Subdivision and Baltimore Division. At the point of derailment, the rail fractured due to a detail fracture that initiated from head checks in the gage corner of the rail head. The leaving- and receiving-rail end deformation and batter patterns indicate that the primary fracture occurred at one of the ends of rail piece N5.10,11 The relatively rough fracture features near the boundary of the detail fracture at the west end of piece N5, the larger size of the defect at that end, indicate that the defect at the west end of piece N5 was approaching critical size and was likely the first defect to cause a rail fracture. Material properties did not appear to be a significant factor in the failure. NTSB investigators determined that the defect extended across just 24 percent of the remaining head area, compared to other cases where it extended from 70 to 80 percent of the remaining head area, which indicates the stresses on the rail were relatively high at the time of failure. The high

10 A head check is a rail defect consisting of shallow surface or hairline cracks that appear in the gage corner of the rail head. 11 The gage corner is the smaller upper rail head radius region that makes contact with the flange of a wheel. 0 20 40 60 80 100 120 140 160 2008 2009 2010 2011 2012 Tests/yr. OML Total defects/OML Tonnage/yr. SRF/OML SRF/Balt. Div.

CSX Transportation Coal Train Derailment Killed Two Individuals 12A CORRECTED COPY

stresses mainly resulted from a worn rail head that was approaching levels for scheduled replacement. There was also an increase in tonnage over this CSX subdivision in previous years, resulting in high axle loads. These conditions produce defects that can grow relatively quickly and can fail at a relatively small size. Previous NTSB Investigations

On October 20, 2006, a Norfolk Southern Railway Company train en route from Illinois to New Jersey derailed because of a broken rail while crossing a railroad bridge in New Brighton, Pennsylvania.12 The NTSB issued three safety recommendations, R-08-9, R-08-10, and R-08-11, to the FRA to address ultrasonic rail inspection and rail defect management, and to oversee internal rail inspection process and requirements. The recommendations were meant to address underlying rail conditions brought on by rolling contact fatigue. Review all railroads’ internal rail defect detection procedures and require changes to those procedures as necessary to eliminate exceptions to the requirements for an uninterrupted, continuous search for rail defects. (R-08-9) Require railroads to develop rail inspection and maintenance programs based on damage-tolerance principles, and approve those programs. Include in the requirements that railroads demonstrate how their programs will identify and remove internal defects before they reach critical size and result in catastrophic rail failures. Each program should take into account, at a minimum, accumulated tonnage, track geometry, rail surface conditions, rail head wear, rail steel specifications, track support, residual stresses in the rail, rail defect growth rates, and temperature differentials. (R-08-10) Require that railroads use methods that accurately measure rail head wear to ensure that deformation of the head does not affect the accuracy of the measurements. (R-08-11) The NTSB investigated the July 11, 2012, derailment in Columbus, Ohio, involving release of hazardous materials. Although this investigation is still ongoing as of the date of this report, preliminary findings indicate a broken rail with evidence of rolling contact fatigue in the curve at the accident site. The rail failure discovered in the Ellicott City investigation has many similarities to the New Brighton, Pennsylvania, and the Columbus, Ohio, accidents, where rail with similar wear conditions failed due to detail fractures from shelling, resulting from rolling contact fatigue. The New Brighton investigation revealed that the defect grew to 78 percent of the remaining head area, and the Columbus investigation revealed that the defect grew to 70 percent. These percentages indicate that rail stress was likely lower in those accidents than in the Ellicott City derailment.

12 For more information, see Derailment of Norfolk Southern Railway Company Train 68QB119 with Release of Hazardous Materials and Fire, New Brighton, Pennsylvania, October 20, 2006. Railroad/Hazardous Materials Report NTSB/RAR-08/02 (Washington, DC: NTSB 2008).

CSX Transportation Coal Train Derailment Killed Two Individuals 13 NTSB/RAB/14-07

Rail Safety Advisory Committee (RSAC) Rail Failure Working Group Recommendations As a result of the NTSB safety recommendations from the New Brighton investigation (and following the NTSB investigations into the Columbus and Ellicott City derailments), the FRA determined that each of the accidents resulted from rail failures. In September 2012, the FRA established a Rail Safety Advisory Committee (RSAC) Rail Failure Working Group to study the effects of rail head wear and resulting rail surface conditions (better known as rolling contact fatigue), and how such rail conditions can adversely affect the results of ultrasonic rail testing. (See Appendix A.) The Rail Failure Working Group met four times between January and July 2013. The group proposed new performance-based recommendations for determining rail wear and internal rail inspection criteria. These criteria solidified the FRA ability to effectively monitor rail integrity programs that will likely ensure that track owners quickly identify and promptly and effectively remediate areas that could lead to a derailment in populated areas and in track transporting passengers or hazardous materials. The FRA efforts and industry acceptance of these best practices should significantly reduce broken rail accidents due to rolling contact fatigue and provide improvements for better management of the industry’s rail risk management programs. On April 16, 2014, the RSAC adopted the recommendations from the Rail Failure Working Group. The final recommendations, which were developed with industry consensus, are in Appendix B. Postaccident Actions After the accident, CSXT installed a chain-link fence along the right-of-way in an attempt to deter future trespassing. (See figure 5).

CSX Transportation Coal Train Derailment Killed Two Individuals 14A CORRECTED COPY

Figure 5. The chain-link fence installed along the railroad right-of-way to deter trespassing. Probable Cause The National Transportation Safety Board determines that the probable cause of the Ellicott City derailment was a broken rail stemming from an undetected internal defect which grew to a catastrophic failure due to the combination of a worn rail head that was approaching levels for scheduled replacement and high axle loads.

For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12MR009.

Adopted: July 31, 2014

CSX Transportation Coal Train Derailment Killed Two Individuals 15A CORRECTED COPY

On July 1, 2016, Mr. Mark J. Mayr submitted a petition for reconsideration of the accident report, the issuance of safety recommendations, and modification of the NTSB’s probable cause. The NTSB reviewed the petitioner’s request and revised the report and probable cause. REVISED BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

EARL F. WEENER Acting Chairman

Member

CHRISTOPHER A. HART

T. BELLA DINH-ZARR Member

Member

Adopted: August 9, 2017

CSX Transportation Coal Train Derailment Killed Two Individuals 16

Appendix A US Department of Transportation Federal Railroad Administration Task No.: 12-01 Railroad Safety Advisory Committee Task Statement: Rail Failure Working Group

Date initially presented to the RSAC: September 27, 2012

Purpose: To consider specific improvements to the Track Safety Standards (TSS) or other responsive actions designed to monitor rail life and reduce the adverse risks of rail failures.

Background: Under Task No. 08-03, the Track Standards Working Group recently addressed the effect of rail head wear, surface conditions and other relevant factors on the acquisition and interpretation of internal rail flaw test results.

Description: Review and understand: • Railroad engineering instructions concerning rail performance management. • The factors that influence rail life. • The impact of train dynamics on rail. • The effects of head wear on rail strength and structural integrity. • The effects of rolling contact fatigue on rail and how it can impact rail defect development.

Issues requiring specific report: • Determine whether current industry rail head wear management systems are adequate or should be standardized. • Identify an approach to establish the state of understanding of issues related to rail performance utilizing known experts in the field of rail research. Determine methods to improve the effectiveness and efficiency of rail performance management and rail life extension, and provide recommendations as necessary. • Specifically, determine whether, and if so how, rail life and performance management can be improved to reduce the rate of worn-rail failures and related derailments. • Determine whether new approaches to rail head wear limits should be developed and/or formally standardized. • Evaluate whether methods for non-destructive rail inspections can be improved in terms of inspection effectiveness and efficiency.

Establish following working group: Rail Failure Working Group

Target Dates: Report recommendations to the Committee by March 2014.

Disposition: Accepted Accepted Date: September 27, 2012

CSX Transportation Coal Train Derailment Killed Two Individuals 17

Appendix B RSAC, Rail Failure Working Group Recommendation and FRA Guidance Document NTSB investigators coordinated with the Federal Railroad Administration in tasking the Railroad Safety Advisory Committee Rail Failure Working Group, and contributed to the final recommendations to enhance track maintenance and reduce rolling contact fatigue. The Rail Failure Working Group was tasked on September 27, 2012, to consider improvements to the Track Safety Standards or other responsive actions designed to monitor rail life and reduce the adverse risks of rail failures. The Rail Failure Working Group reached consensus on July 31, 2013. On April 16, 2014, the full Rail Safety Advisory Committee adopted consensus recommendations made by the Rail Failure Working Group. On July 25, 2014, the FRA distributed the final Rail Failure Prevention Program guidance document to the RSAC and the Rail Failure Working Group, with a request to distribute throughout the railroad industry. The FRA also stated that the guidance document would be formally issued to railroads by FRA Administrator Szabo. These efforts along with industry acceptance (concurrence) are a substantial effort to significantly reduce broken rail accidents due to rolling contact fatigue, and provide improvements for better management of the industry risk management programs.

CSX Transportation Coal Train Derailment Killed Two Individuals 18

RSAC Language for Industry Guidance from FRA

FRA recommends that track owners consider developing and maintaining a Rail Failure Prevention Program for rail in the following main track: • Class 2 track with annual tonnage of at least 25 million gross tons (MGT), or is a HAZMAT route.

• Class 3 track with annual tonnage of at least 25 MGT, is a HAZMAT route, or has regularly scheduled passenger service; and

• Class 4 and 5 track.

The Rail Failure Prevention Program should contain the following:

1. Rail head wear guidelines.

Guidelines that address the identification and management of visible rolling contact fatigue damage and improve rail performance.

An inspection plan that includes rail head wear measurements for comparison with established guidelines and means for identification of visible rolling contact fatigue damage.

Corrective actions to be taken when rail head wear guidelines are exceeded or visible rolling contact fatigue damage is identified.

Training for the implementation of the procedures listed above.

Specific Rail Failure Prevention Program Content FRA recommends that the Rail Failure Prevention Program contain the following elements: A. Rail head wear guidelines that include:

Consideration of rail section, class of track, alignment, and other criteria as determined by the track owner.

Specification of the measurement methods to be used and definition of reference points for these measurements.

CSX Transportation Coal Train Derailment Killed Two Individuals 19

B. An inspection plan to measure rail head wear that considers alignment, class of track, and other criteria as determined by the track owner.

C. Guidelines for the management of visible rolling contact fatigue damage and improved rail performance. Procedures may include lubrication, friction modification, or grinding.

Lubrication or friction modification practices should consider train traffic, alignment, curvature length, and grade.

Rail grinding or other techniques that address maintenance of rail head profile to improve rail surface conditions and reduce visible rolling contact fatigue damage. D. Guidelines that address the monitoring of visible rolling contact fatigue damage, including the following:

Inspection procedures to identify areas of visible rolling contact fatigue damage. The inspection procedures should include prioritization methods for assessing the severity of these conditions.

Establishment of inspection frequencies to monitor development of visible rolling contact fatigue damage that consider alignment, track class, and other factors as determined by the track owner. E. Guidelines for applying rail grinding or other techniques that improve rail head profile and visible rolling contact fatigue damage. The guidelines should identify:

The techniques used.

Application of the techniques considered, taking into account alignment, tonnage, class of track, or other factors as determined by the track owner.

Prioritized corrective action for areas of significant visible rolling contact fatigue damage to reduce defect development. F. Recordkeeping procedures for each inspection performed under the Rail Failure Prevention Program. The record should include the following items:

The limits of the territory inspected.

Head wear measurements.

Areas identified as having significant visible rolling contact fatigue damage and type of rail surface degradation. G. Guidelines for rail service life monitoring that consider class of track, tonnage, rail section, rail wear, visible rolling contact fatigue damage, defect development, rail failure history, and other factors as determined by the track owner.

CSX Transportation Coal Train Derailment Killed Two Individuals 20

H. Recommended corrective action to be taken when rail head wear or visible rolling contact fatigue damage guidelines are exceeded.

I. A system or process designed for the recording and tracking of rail defects and rail failure incidents with the capability to identify locations with sudden or accelerated failure rates.

J. Training for employees involved in the implementation of the written Rail Failure Prevention Program, with provisions for periodic retraining for those individuals.

FD07429 ｜ 2014_美国_RAB1408.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

201301080

NTSB/RAB-14/08

National Transportation Safety Board Railroad Accident Brief Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

Accident No.: DCA12MR006 Location: Columbus, Ohio Date: July 11, 2012 Time: 2:03 a.m. eastern daylight time Railroad: Norfolk Southern Railway Company Property Damage: $1.2 million Injuries: 1 Fatalities: 0 Type of Accident: Train derailment (hazardous materials release) The Accident On July 11, 2012, at 2:03 a.m. eastern daylight time, eastbound Norfolk Southern Railway Company (NS) freight train 186L809 derailed 17 cars on the NS Sandusky District at milepost (MP) S2.2 on main track 1.1 The derailment occurred on the NS Lake Division and within the city limits of Columbus, Ohio. The train consisted of 2 leading locomotives, 97 loaded freight cars, and 1 empty freight car. The train crew consisted of an engineer, a locomotive engineer trainee, and a conductor. After reporting to work on July 10, 2012, at 7:55 p.m. at the NS yard in Bellevue, Ohio, the crew received a list of the rail cars in the train, the contents of each, and the hazardous materials (hazmat) classifications, where applicable. The train departed Bellevue at 8:45 p.m., en route to Portsmouth, Ohio, a distance of about 192 miles. During postaccident interviews conducted by National Transportation Safety Board (NTSB) investigators, the train crew said they had a green (proceed) signal aspect as the train approached MP S4.4 on main track 1.2 The locomotive engineer trainee, who was operating the train, said that as the train entered the curve, he released the train air brakes, but he continued to apply full dynamic brakes. The engineer told NTSB investigators that as the train moved through the curve, the crew felt a “nudge” in the train movement, and the emergency brake system was activated. The locomotives and first 2 cars stopped on the tracks and the next 17 cars derailed. The derailment destroyed both main tracks (1 and 2). The 3rd through the 19th cars derailed.3 Cars 12 through 14 contained denatured ethanol (a hazardous material).4 One of these tank cars was punctured during the derailment. The denatured ethanol from this punctured tank

1 All times in this brief are eastern daylight time; Main track 2 ran alongside main track 1. 2 The dragging equipment detector at MP S4.4, which is a wayside automatic inspection system, indicated that the train had no defects. 3 Car numbers are referenced by their position behind the leading locomotives (that is, car 1 is the first car behind the locomotives). 4 The substance consisted of 98 percent ethanol and 2 percent denaturant.

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

car fueled a large pool fire. The two other tank cars that were carrying denatured ethanol were engulfed in the pool fire and split open. Witnesses observed multiple energetic fire eruptions when these two tank cars ruptured. (See figure 1 for an overview of the accident scene.)

Figure 1. Aerial photograph of the derailment. (Photo by Columbus Police Department) The train crew was not injured; however, one person near the derailment site sustained minor burns.5 About 100 people in a 1-mile radius of the derailment were evacuated. The damages were estimated to total $1.2 million. At the time of the accident, the sky was clear, and the temperature was 70°F. Emergency Response On July 11, 2012, about 2:04 a.m., the Columbus Fire Department received several 911 calls reporting a large fire with flames that reached 60 to 70 feet. About 2:07 a.m., Columbus emergency responders arrived at the main entrance of the Central Ohio Transit Authority (COTA) bus terminal to the south of the derailment site. After assessing the scene, the firefighters realized that the fire involved a train derailment on the tracks adjacent to the COTA facility. At 2:18 a.m., the Columbus Fire Department Hazardous Materials Unit was notified to respond.

5 The individual was at 8th Avenue when he heard screeching from the train tracks followed by a loud crash. This individual, along with a friend, ran to the accident to investigate if anyone was hurt or injured. N Central Ohio Transit Authority (COTA) bus terminal Central Ohio Transit Authority (COTA) bus terminal

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

About 2:30 a.m., NS faxed a copy of the train consist to the Columbus Fire Dispatch; at the same time, the train conductor gave the on-scene emergency responders a copy of the train consist. Soon after, firefighters established an initial command post south of the derailed train. At 2:51 a.m., the incident commander established a 1-mile evacuation radius as a precaution against a possible catastrophic tank car rupture. Eight minutes later, the Columbus Fire Department contacted NS to request hazmat response assistance and determine when hazmat responders would arrive. Because the emergency response was expected to take several days, the incident command post was relocated to the nearby state fairgrounds, to the north of the derailment site. (See figure 2.)

Figure 2. Satellite view of the accident site. (Image courtesy of Google Earth.) By about 7:00 a.m., firefighters had extinguished the fire; clean-up operations started shortly thereafter. Overall, the NTSB found that the measures taken during the emergency response were adequate and appropriate. The Investigation NTSB investigators found that the train’s event recorder data indicated the train was moving at 25 mph immediately prior to the derailment, which was the authorized speed for the area. After reviewing the crew work histories, NTSB investigators determined that the crew had sufficient off-duty time before they reported for work.

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Signal System NS train operations on the Sandusky District are governed and authorized by signal indications of a traffic control system. Trains in the accident area operate on two main tracks signaled for bidirectional movement. NTSB investigators reviewed the maintenance and inspection records and downloaded data from the signal system. The signal system detected no abnormal track conditions, such as a broken rail, prior to the accident train’s arrival. Postaccident investigation indicated no problems with the signal system. Wreckage Description The locomotives and the first two cars in the train did not derail. The third car derailed one axle. The 4th through the 19th cars derailed and overturned. Tank cars 12 through 14, which were general service specification (DOT-111A-100W1 [DOT-111]) tank cars, contained denatured ethanol. These three tank cars were identified as NATX 364017, NATX 364083, and NATX 364118. Tank car NATX 364083 was breached during the derailment, and its cargo caught on fire. The other two tank cars, NATX 364017 and NATX 364118, eventually experienced thermal tears resulting from exposure to the pool fire that resulted from the breach of tank car NATX 364083. (See figure 3.)

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Figure 3. Derailed tank cars exhibiting breach and thermal tears. (Photo by Columbus Police Department) In all, these three tank cars contained about 87,000 gallons of denatured ethanol. The total volume of product consumed by fire or otherwise released to the sewer (sanitary/storm drain), soil, or air was estimated to be 54,748 gallons. Environmental contamination from the denatured ethanol was negligible. All the other derailed cars contained non-hazardous materials, such as corn syrup and grain, which were collected and shipped to a waste disposal facility. Inspection of tank car NATX 364083 indicated that it was punctured by a coupler or an object on an adjacent tank car. Tank car NATX 364118 exhibited a tear in the top longitudinal weld metal of a shell ring, and tank car NATX 364017 exhibited a longitudinal tear through three shell rings. The NTSB Materials Laboratory found that the tank wall thickness of NATX 364118 in the area of the longitudinal fracture was reduced and contained an outward bulge deformation consistent with release of internal pressure. Investigators found no evidence of a preexisting crack on the fracture faces of the tank car, and the welds showed no evidence of anomalies (such as weld defects). Equipment Investigators inspected the two locomotives from the accident train with no discrepancies noted. Inspection of a rear wheel of the second car behind the locomotive (a car that did not derail) showed a distinctive lateral impact mark on the wheel tread that was consistent with a facing rail fracture found near the identified point of derailment. The marks were located on the tread of the wheels perpendicular to the running surface, which is consistent with the train encountering a broken rail. Track and Engineering The derailment occurred on main track 1, in the body of a 9.5 degree right-hand curve (for a westbound train movement) with an average of 2 inches of super-elevation.6 The NS designated main track 1 as FRA Class 2 track, with a maximum authorized timetable speed of 25 mph. The NS operates an average of 24 freight trains daily on main track 1, constituting an annual gross tonnage of 37.7 million gross tons (mgt); it operates an average of 19 freight trains daily on main track 2, with an annual gross tonnage of 39.0 mgt. These tracks are not passenger routes. The rail in the area of the accident on main track 1 was a section that had been installed on September 2, 2011, as a replacement made necessary by a September 1, 2011, inspection that found 14 defects in the rail at this location. NS had moved this replacement rail from another location. NS records show that Sperry Rail Services had tested the replacement rail for internal defects on September 1, 2010, prior to its installation on main track 1. No defects were found at that time.

6 Super-elevation is the outer rail’s vertical distance above the inner rail in a curve.

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

FRA regulations in Title 49 Code of Federal Regulations (CFR) 213.237 require a continuous inspection for internal rail defects for Class 4 track and Class 3 track over which passenger trains operate once every 40 mgt or once a year, whichever interval is shorter. According to federal regulations, NS was not required to inspect this track for internal rail flaws because it was designated as Class 2 and was not a passenger route. However, NS contracted with Sperry Rail Service to inspect this track segment ultrasonically for rail defects twice in 2011; on March 16 and September 1. The NS also contracted with Sperry Rail Service to conduct an ultrasonic test to detect rail flaws on NS main track 1 on April 5, 2012, which was 97 days prior to the accident. Documents supplied by NS indicate three rail defects were found on main track 1 at MP S2.146, S2.177, and S2.178 during the April 5 rail inspection. The defects were corrected the same day. An NS track inspector had last inspected main track 1 on July 9, 2012, 2 days before the accident. The NS inspector did not document any defects in the area of the derailment on the inspection report. The FRA had last inspected main track 1 on April 20, 2011. The FRA inspection found no track defects in the area of the derailment. A review of service failure records indicated that five rail failures occurred in this curve on NS main track 1 since Sperry Rail Service had last conducted a rail flaw detection test on April 5, 2012. (See table 1.) Table 1. Recent service failures on main track 1 in derailment curve. Failure Date Milepost Rail Manufactured Defect May 14, 2012 S2.3 September 1981 40% transverse defect June 4, 2012 S2.2 January 1981 40% transverse defect June 12, 2012 S2.2 September 1981 30% transverse defect June 19, 2012 S2.3 September 1981 20% transverse defect July 1, 2012 S2.2 January 1996 30% transverse defecta The NS examined the rail specimens from the accident location during the on-scene phase of the investigation. They identified 19 transverse defects with size ranges from about 5 percent to about 60–70 percent with relationship to gage corner fatigue.7 Rail Recovery and Analysis During the NTSB’s reconstruction of the rail recovered after the derailment, investigators identified 24 oxidized internal cracks that fractured during the derailment. The NTSB Materials Laboratory conducted metallurgical analyses and rail head wear measurements on several rail samples. The running surface of the rail pieces showed evidence of flaking and severe rolling contact fatigue cracks, also referred to as head checks.8 Other pieces showed no evidence of

7 Gage corner refers to the side radius portion of the rail’s running surface closest to the centerline of the track. 8 Flaking refers to small shallow flakes of surface metal generally no more than 1/4 inch in length or width that break out of the gage corner of the rail head; Head check refers to hairline cracks that appear in the gage corner of

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

flaking damage on the head portions of the rail. The exposed fracture faces of some rail sections showed evidence of transverse detail fractures that extended from the gage side of the rail head in areas that coincided with head check and flaking damage.9 The metallurgical evidence indicated that the rail was stressed by rolling contact fatigue, which caused the rail to break under the train, leading to the derailment. Previous NTSB Investigations On October 20, 2006, an NS train en route from Illinois to New Jersey derailed due to a broken rail while crossing a railroad bridge in New Brighton, Pennsylvania.10 The NTSB issued three safety recommendations, R-08-09 through -11, to the FRA to address ultrasonic rail inspection and rail defect management, as well as the oversight of internal rail inspection processes and requirements, which concern underlying rail conditions brought on by rolling contact fatigue. R-08-9 Review all railroads’ internal rail defect detection procedures and require changes to those procedures as necessary to eliminate exceptions to the requirements for an uninterrupted, continuous search for rail defects. R-08-10 Require railroads to develop rail inspection and maintenance programs based on damage-tolerance principles, and approve those programs. Include in the requirement that railroads demonstrate how their programs will identify and remove internal defects before they reach critical size and result in catastrophic rail failures. Each program should take into account, at a minimum, accumulated tonnage, track geometry, rail surface conditions, rail head wear, rail steel specifications, track support, residual stresses in the rail, rail defect growth rates, and temperature differentials. R-08-11 Require that railroads use methods that accurately measure rail head wear to ensure that deformation of the head does not affect the accuracy of the measurements. The NTSB has classified Safety Recommendations R-08-9 and -10 “Closed—Acceptable Action.” Safety Recommendation R-08-11 is classified “Open—Acceptable Response.” Another accident previously investigated by the NTSB that involved rolling contact fatigue occurred in Ellicott City, Maryland, on August 20, 2012, when a CSX Transportation coal

the rail head, at any angle with the length of the rail. When not readily visible, the presence of such checks may often be detected by feeling for sharp edges. 9 A detail fracture is a progressive fracture originating at or near the surface of the rail head. 10 See National Transportation Safety Board, Derailment of Norfolk Southern Railway Company Train 68QB119 with Release of Hazardous Materials and Fire, New Brighton, Pennsylvania, October 20, 2006, NTSB/RAR-08/02 (Washington, DC: National Transportation Safety Board, 2008).

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

train derailed.11 The NTSB determined that the probable cause of the accident was a broken rail that showed evidence of rolling contact fatigue. The rail failure discovered in the Columbus, Ohio, investigation had many similarities to the New Brighton, Pennsylvania, and Ellicott City, Maryland, accidents in that rails with similar wear conditions failed because of detail fractures from shelling caused by rolling contact fatigue. In the case of the New Brighton derailment, postaccident testing revealed that the defect had grown to 78 percent of the remaining rail head area; in the Columbus accident, the defect had grown to 70 percent. By contrast, in the case of the Ellicott City accident, the defect extended across just 24 percent of the remaining rail head area. These percentages indicate that rail stress was most likely lower when the New Brighton and Columbus derailments occurred than during the Ellicott City derailment. Rail Safety Advisory Committee Rail Failure Working Group Recommendations As a result of the NTSB safety recommendations from the New Brighton investigation and the NTSB investigations into the Columbus and Ellicott City derailments, the FRA determined that each of the accidents resulted from rail failures. In September 2012, the FRA established a Rail Safety Advisory Committee (RSAC) Rail Failure Working Group to study the effects of rail head wear and the resulting rail surface conditions (known as rolling contact fatigue), and how such rail conditions can adversely affect the results of ultrasonic rail testing. (See appendix A.) The R SAC Rail Failure Working Group met four times between January and July

1. The group proposed new performance-based recommendations for determining rail wear

and internal rail inspection criteria. The new criteria, which establish best practices, have improved the FRA’s ability to monitor rail integrity programs and should help to ensure that track owners can quickly identify, as well as promptly and effectively remediate, problems with rails that could lead to a derailment in populated areas or to track-related accidents involving trains transporting passengers or hazmat. The FRA efforts and the industry’s acceptance of these best practices should reduce the number of accidents caused by rail breaks due to rolling contact fatigue and improve the operation of industry rail risk management programs. On April 16, 2014, the RSAC adopted the recommendations from the Rail Failure Working Group. The final recommendations, which were developed with industry consensus, are provided in appendix B. On July 25, 2014, the FRA distributed the final Rail Failure Prevention Program guidance document to the RSAC and the Rail Failure Working Group, and requested that they distribute it throughout the railroad industry. The FRA also stated that the FRA Administrator would formally issue the guidance document to railroads.

11 See National Transportation Safety Board, CSX Transportation Coal Train Derailment Killed Two Individuals, Ellicott City, Maryland, August 20, 2012, NTSB/RAB-14/07 (Washington, DC: National Transportation Safety Board, 2014).

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was a broken rail that exhibited evidence of rolling contact fatigue. Adopted: September 18, 2014 For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA12MR006.

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a railroad accident in which there is a fatality or substantial property damage, or that involves a passenger train. (49 U.S. Code § 1131 - General authority)

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Appendix A US Department of Transportation Federal Railroad Administration Task No.: 12-01 Railroad Safety Advisory Committee Task Statement Rail Failure Working Group Date initially presented to the RSAC: September 27, 2012

Purpose: To consider specific improvements to the Track Safety Standards (TSS) or other responsive actions designed to monitor rail life and reduce the adverse risks of rail failures.

Background: Under Task No. 08-03, the Track Standards Working Group recently addressed the effect of rail head wear, surface conditions, and other relevant factors on the acquisition and interpretation of internal rail flaw test results.

Description: Review and understand:  Railroad engineering instructions concerning rail performance management.  The factors that influence rail life.  The impact of train dynamics on rail.  The effects of head wear on rail strength and structural integrity.  The effects of rolling contact fatigue on rail and how it can impact rail defect development.

Issues requiring specific report:  Determine whether current industry rail head wear management systems are adequate or should be standardized.  Identify an approach to establish the state of understanding of issues related to rail performance utilizing known experts in the field of rail research. Determine methods to improve the effectiveness and efficiency of rail performance management and rail life extension, and provide recommendations as necessary.  Specifically, determine whether, and if so how, rail life and performance management can be improved to reduce the rate of worn-rail failures and related derailments.  Determine whether new approaches to rail head wear limits should be developed and/or formally standardized.  Evaluate whether methods for non-destructive rail inspections can be improved in terms of inspection effectiveness and efficiency.

Establish following working group: Rail Failure Working Group

Target Dates: Report recommendations to the Committee by March 2014.

Disposition: Accepted Accepted Date: September 27, 2012

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Appendix B Railroad Safety Advisory Committee Rail Failure Working Group Recommendations and Federal Railroad Administration Guidance Document National Transportation Safety Board (NTSB) investigators coordinated with the Federal Railroad Administration (FRA) in tasking the Railroad Safety Advisory Committee (RSAC) and contributed to the final recommendations designed to enhance track maintenance and reduce rolling contact fatigue. The Rail Failure Working Group was tasked on September 27, 2012, to consider improvements to the Track Safety Standards or other responsive actions designed to monitor rail life and reduce the risk of rail failures. The Rail Failure Working Group reached consensus on its recommendations on July 31, 2013. On April 16, 2014, the full RSAC adopted the consensus recommendations made by the Rail Failure Working Group. On July 25, 2014, the FRA distributed the final guidance document for the Rail Failure Prevention Program to the RSAC and the Rail Failure Working Group, with a request that they distribute these guidelines throughout the railroad industry. The FRA also stated that the FRA Administrator would formally issue the guidance document to railroads. These efforts, coupled with the industry’s acceptance of the guidance, represent progress in the effort to reduce broken rail accidents caused by rolling contact fatigue and are enabling better management of industry risk management programs. RSAC Language for Industry Guidance from the FRA Rail Failure Prevention Program The FRA recommends that track owners consider developing and maintaining a Rail Failure Prevention Program for rail in the following main track:  Class 2 track with annual tonnage of at least 25 million gross tons (mgt), or is a HAZMAT route;  Class 3 track with annual tonnage of at least 25 mgt, is a HAZMAT route, or has regularly scheduled passenger service; and  Class 4 and 5 track. The Rail Failure Prevention Program should contain the following:

1. Rail head wear guidelines.
2. Guidelines that address the identification and management of visible rolling contact

fatigue damage and improve rail performance.

1. An inspection plan that includes rail head wear measurements for comparison with

established guidelines and means for identification of visible rolling contact fatigue damage.

1. Corrective actions to be taken when rail head wear guidelines are exceeded or visible

rolling contact fatigue damage is identified.

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

Training for the implementation of the procedures listed above. Specific Rail Failure Prevention Program Content The FRA recommends that the Rail Failure Prevention Program contain the following elements: A. Rail head wear guidelines that include:

Consideration of rail section, class of track, alignment, and other criteria as determined by the track owner.

Specification of the measurement methods to be used and definition of reference points for these measurements.

B. An inspection plan to measure rail head wear that considers alignment, class of track, and other criteria as determined by the track owner. C. Guidelines for the management of visible rolling contact fatigue damage and improved rail performance. Procedures may include lubrication, friction modification, or grinding.

1. Lubrication or friction modification practices should consider train traffic, alignment,

curvature length, and grade.

1. Rail grinding or other techniques that address maintenance of rail head profile to improve

rail surface conditions and reduce visible rolling contact fatigue damage. D. Guidelines that address the monitoring of visible rolling contact fatigue damage, including the following:

1. Inspection procedures to identify areas of visible rolling contact fatigue damage. The

inspection procedures should include prioritization methods for assessing the severity of these conditions.

1. Establishment of inspection frequencies to monitor development of visible rolling

contact fatigue damage that consider alignment, track class, and other factors as determined by the track owner. E. Guidelines for applying rail grinding or other techniques that improve rail head profile and visible rolling contact fatigue damage. The guidelines should identify:

1. The techniques used.
2. Application of the techniques considered, taking into account alignment, tonnage,

class of track, or other factors as determined by the track owner.

1. Prioritized corrective action for areas of significant visible rolling contact fatigue

damage to reduce defect development.

Norfolk Southern Railway Company Train Derailment and Hazardous Materials Release

NTSB/RAB-14/08

F. Recordkeeping procedures for each inspection performed under the Rail Failure Prevention Program. The record should include the following items:

1. The limits of the territory inspected.
2. Head wear measurements.
3. Areas identified as having significant visible rolling contact fatigue damage and type of

rail surface degradation. G. Guidelines for rail service life monitoring that consider class of track, tonnage, rail section, rail wear, visible rolling contact fatigue damage, defect development, rail failure history, and other factors as determined by the track owner. H. Recommended corrective action to be taken when rail head wear or visible rolling contact fatigue damage guidelines are exceeded. I. A system or process designed for the recording and tracking of rail defects and rail failure incidents with the capability to identify locations with sudden or accelerated failure rates. J. Training for employees involved in the implementation of the written Rail Failure Prevention Program, with provisions for periodic retraining for those individuals.

FD07430 ｜ 2014_美国_RAR1401.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2014 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Conrail Freight Train Derailment with Vinyl Chloride Release Paulsboro, New Jersey November 30, 2012

Accident Report NTSB/RAR-14/01 PB2014-108828

National Transportation Safety Board

NTSB/RAR-14/01 PB2014-108820 Notation 8475A Adopted July 29, 2014

Railroad Accident Report Conrail Freight Train Derailment with Vinyl Chloride Release Paulsboro, New Jersey November 30, 2012

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2014. Conrail Freight Train Derailment with Vinyl Chloride Release, Paulsboro, New Jersey, November 30, 2012. Publication Type NTSB/RAR-14/01. Washington, DC.

Abstract: This report discusses the 2012 accident in which a Consolidated Rail Corporation (Conrail) train derailed while traveling over a moveable bridge in Paulsboro, New Jersey. Three tank cars containing vinyl chloride came to rest in Mantua Creek, of which one was breached and released about 20,000 gallons of vinyl chloride. On that day, 28 residents sought medical attention for possible exposure, and the train crew and many emergency responders were also exposed. Damage estimates were $451,000 for equipment and about $30 million for emergency response and remediation.

This report addresses safety issues: training and qualification of train crews for moveable bridge inspection; Conrail safety management; timeliness of hazardous materials communications to first responders; failure of the incident commanders to follow established hazardous materials response protocols; firefighter training and qualifications; inadequacies of emergency planning, emergency preparedness, and public awareness for hazardous materials transported by train; and rail corridor risk management analysis. Safety recommendations to: Conrail, US Department of Transportation, Federal Railroad Administration, Pipeline and Hazardous Materials Safety Administration, Association of American Railroads, American Short Line and Regional Railroad Association, International Association of Fire Chiefs, National Volunteer Fire Council, four New Jersey state agencies, with three reiterated. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA13MR002. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2014-108828 from:

National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

The Independent Safety Board Act, as codified at 49 U.S.C. Section 1154(b), precludes the admission into evidence or use of any part of an NTSB report related to an incident or accident in a civil action for damages resulting from a matter mentioned in the report.

NTSB Railroad Accident Report i Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iv Abbreviations and Acronyms .......................................................................................................v Executive Summary ................................................................................................................... viii 1 Investigation and Analysis ......................................................................................................1 1.1 Accident Narrative ...................................................................................................................1 1.2 Events Preceding the Accident .................................................................................................3 1.3 Conrail Accident Train FC4230 ...............................................................................................4 1.4 Paulsboro Moveable Bridge .....................................................................................................5 1.4.1 Bridge Structure .............................................................................................................5 1.4.2 Bridge Signal Control ....................................................................................................7 1.4.3 Moveable Bridge Operation ...........................................................................................7 1.5 Factors Not Contributing to the Accident ................................................................................9 1.5.1 Weather ..........................................................................................................................9 1.5.2 Toxicology Reports ........................................................................................................9 1.5.3 Locomotives and Train Cars ........................................................................................10 1.5.4 Track Inspections .........................................................................................................10 1.5.5 Bridge Structural Integrity ...........................................................................................11 1.5.6 Bridge Control System .................................................................................................11 1.5.7 Bridge Signal System ...................................................................................................12 1.6 Conditions Leading to the Train Derailment ..........................................................................13 1.6.1 Examination of Derailed Cars ......................................................................................14 1.6.2 Previous Moveable Bridge Operability Problems .......................................................15 1.7 Conrail Procedures and Training ............................................................................................15 1.7.1 Train Crew Actions ......................................................................................................16 1.7.2 Bridge Inspection Procedures ......................................................................................17 1.8 Personnel Information ............................................................................................................20 1.8.1 Engineer .......................................................................................................................20 1.8.2 Conductor .....................................................................................................................20 1.8.3 Train Dispatcher...........................................................................................................20 1.9 Conrail Safety Management ...................................................................................................21 1.9.1 Crew Training ..............................................................................................................21 1.9.2 Conrail’s Decision to Keep the Paulsboro Moveable Bridge Operational ..................21 1.9.3 Safety Management Systems .......................................................................................22 1.10 Breached Vinyl Chloride Tank Car ........................................................................................24 1.10.1 Tank Car Damage ........................................................................................................24 1.10.2 Tank Material Properties and Failure ..........................................................................25 1.11 Hazardous Materials Response ..............................................................................................26 1.11.1 Vinyl Chloride Information .........................................................................................26

NTSB Railroad Accident Report ii 1.11.2 Effects of Exposure to Vinyl Chloride.........................................................................26 1.11.3 Vinyl Chloride Environmental Information.................................................................26 1.11.4 Community Exposure Guidance ..................................................................................27 1.11.5 Reported Community and Emergency Responder Health Effects ...............................27 1.11.6 Fire/Rescue Response Operations................................................................................28 1.12 Hazardous Materials Communications ..................................................................................31 1.12.1 Hazardous Materials Communications ........................................................................31 1.12.2 Emergency Response Information Content .................................................................34 1.13 Hazardous Waste Operations and Emergency Response .......................................................36 1.14 Community Evacuation and Shelter-in-Place ........................................................................41 1.15 Firefighter Hazardous Materials Response Training ..............................................................43 1.15.1 Firefighter Training Requirements ..............................................................................43 1.15.2 Paulsboro Fire Department Hazardous Materials Training .........................................45 1.16 Community Awareness Programs and Emergency Planning .................................................46 1.16.1 Community Awareness Programs................................................................................46 1.16.2 Emergency Planning and Preparedness .......................................................................49 1.16.3 State Oversight of Emergency Operations Plans .........................................................51 1.17 Rail Corridor Risk Management System ................................................................................53 2 Conclusions .............................................................................................................................56 2.1 Findings ..................................................................................................................................56 2.2 Probable Cause .......................................................................................................................58 3 Recommendations ..................................................................................................................59 3.1 New Recommendations ..........................................................................................................59 3.2 Previously Issued Recommendations Reiterated in this Report .............................................62 Board Member Statements .........................................................................................................63 4 Appendixes..............................................................................................................................68 4.1 Appendix A–Investigation and Hearing .................................................................................68 4.2 Appendix B–Timeline of Selected Emergency Response Events ..........................................69 References .....................................................................................................................................76

NTSB Railroad Accident Report iii Figures Figure 1. Accident Location, Paulsboro, New Jersey. ....................................................................1 Figure 2. Five derailed tank cars, their commodities, and their condition after the derailment. ....3 Figure 3. Paulsboro moveable bridge diagram. ..............................................................................6 Figure 4. Preaccident photograph of the Paulsboro moveable bridge. ...........................................7 Figure 5. Slide lock operation. ........................................................................................................8 Figure 6. East slide lock details. .....................................................................................................8 Figure 7. The point of derailment on the east end of the moveable bridge. .................................14 Figure 8. Puncture and tears on the shell of the breached vinyl chloride tank car. ......................25 Figure 9. View of a dense, low lying vapor cloud over Mantua Creek. .......................................29 Figure 10. The breached tank car leaning off the bridge and the vinyl chloride vapor cloud. .....30 Figure 11. Emergency responders and a resident in the vapor cloud near the breached tank car. .............................................................................................................38 Figure 12. Personnel inspecting the breached tank car containing vinyl chloride liquid and vapor. .....................................................................................................40

NTSB Railroad Accident Report iv Tables Table 1. Derailed Cars. ..................................................................................................................14 Table 2. Vinyl Chloride AEGL Concentration Levels. .................................................................27 Table 3. Inconsistencies between the ERG and Conrail Shipping Papers Emergency Response Information. ................................................................................................36 Table 4. Summary of Fire Department Hazardous Materials or Safety Officer Training ............46 Table 5. New Jersey Regions and Compliance Rate of Emergency Operations Plans. ................52

NTSB Railroad Accident Report v Abbreviations and Acronyms AAR

Association of American Railroads AEGL

acute exposure guideline levels ALOHA

Areal Locations of Hazardous Atmospheres API

American Petroleum Institute ASLRRA

American Short Line and Regional Railroad Association BCS

bridge control system Bureau of Explosives Association of American Railroads, Hazardous Materials Committee CAD

computer assisted dispatch CASE

Countermeasures Assessments and Security Experts CBRNE

Chemical, Biological, Radiological, Nuclear, and Explosives CFR

Code of Federal Regulations Conrail

Consolidated Rail Corporation CSXT

CSX Transportation CTEH

Center for Toxicology and Environmental Health DHS

US Department of Homeland Security DOT

US Department of Transportation EMS

emergency medical services EOP

emergency operations plan EPA

Environmental Protection Agency EPCRA

Emergency Planning and Community Right-to-Know Act ERG

Emergency Response Guidebook FRA

Federal Railroad Administration GC

Gloucester County Emergency Response Center

NTSB Railroad Accident Report vi GPS

global positioning system HAZMAT database Hazardous Materials Shipping Descriptions and Emergency

Response database HAZWOPER

Hazardous Waste Operations and Emergency Response HMR

US Department of Transportation Hazardous Materials

Regulations ICAO

International Civil Aviation Organization ICP

incident command post IMDG

International Maritime Dangerous Goods Code LEPC

local emergency planning committee LPG

liquefied petroleum gas MP

milepost MSDS

material safety data sheets NFPA

National Fire Protection Association NIMS

National Incident Management System NJAC

New Jersey Administrative Code NJDEP

New Jersey Department of Environmental Protection NJDLWD

New Jersey Department of Labor and Workforce Development NJDOH

New Jersey Department of Health NJOHSP

New Jersey Office of Homeland Security and Preparedness NJROIC

New Jersey Regional Operations Intelligence Center NJSP

New Jersey State Police NJSP-OEM

New Jersey State Police Office of Emergency Management NORAC

Northeast Operating Rules Advisory Committee NPRM

Notice of Proposed Rulemaking NTSB

National Transportation Safety Board

NTSB Railroad Accident Report vii OEM

Office of Emergency Management OMB

Office of Management and Budget OSC

on-scene coordinator OSHA

Occupational Safety and Health Administration PEOSH New Jersey Public Employee Occupational Safety and Health Program PHMSA

Pipeline and Hazardous Materials Safety Administration PLC

programmable logic controller PPE

personal protective equipment ppm