06_境外及港澳台调查报告_part14.md

06_境外及港澳台调查报告 · 整合分片 part14

本片含 80 份报告。

FD07481 ｜ 2017_美国_MAR1701.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Sinking of US Cargo Vessel SS El Faro Atlantic Ocean, Northeast of Acklins and Crooked Island, Bahamas October 1, 2015

Accident Report NTSB/MAR-17/01 PB2018-100342

National Transportation Safety Board

NTSB/MAR-17/01 PB2018-100342 Notation 57238 Adopted December 12, 2017

Marine Accident Report Sinking of US Cargo Vessel SS El Faro Atlantic Ocean, Northeast of Acklins and Crooked Island, Bahamas October 1, 2015

National Transportation Safety Board

490 L’Enfant Plaza SW Washington, DC 20594

National Transportation Safety Board. 2017. Sinking of US Cargo Vessel SS El Faro, Atlantic Ocean, Northeast of Acklins and Crooked Island, Bahamas, October 1, 2015. Marine Accident Report NTSB/MAR-17/01. Washington, DC. Abstract: On Thursday, October 1, 2015, the SS El Faro, a 40-year-old cargo ship owned by TOTE Maritime Puerto Rico and operated by TOTE Services, Inc., was on a regular route from Jacksonville, Florida, to San Juan, Puerto Rico, when it foundered and sank in the Atlantic Ocean about 40 nautical miles northeast of Acklins and Crooked Island, Bahamas. The ship had sailed directly into the path of Hurricane Joaquin, carrying a crew of 33, including 5 Polish contract repair workers. All those aboard perished in the sinking. As part of its accident investigation, the National Transportation Safety Board (NTSB) led a joint effort with the US Navy, Woods Hole Oceanographic Institution, and the National Science Foundation to locate the ship’s wreckage and retrieve its voyage data recorder (VDR). The VDR was pulled from 15,250 feet below the ocean surface in August 2016 during the third undersea mission and yielded more than 26 hours of parametric data and audio files. The NTSB’s accident investigation identified the following safety issues: captain’s actions, use of noncurrent weather information, late decision to muster the crew, ineffective bridge resource management, inadequate company oversight, company’s safety management system, flooding in cargo holds, loss of propulsion, downflooding through ventilation closures, need for damage control plan, and lack of appropriate survival craft. The NTSB made safety recommendations to the US Coast Guard; the Federal Communications Commission; the National Oceanic and Atmospheric Administration; the International Association of Classification Societies; the American Bureau of Shipping; Furuno Electric Company, Ltd.; and TOTE Services, Inc. NOTE: This report was reissued on September 7, 2018, with corrections to pages 6 and 23. The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations section 831.4. Assignment of fault or legal liability is not relevant to the NTSB statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code section 1154(b). For more detailed background information on this report, visit the NTSB investigations web page and search for NTSB accident number DCA16MM001. Recent publications are available in their entirety at the NTSB website. Other information about publications may be obtained from the website or by contacting: National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551. Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page (this product number is PB2018-100342). For additional assistance, contact: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see the NTIS website).

NTSB

Marine Accident Report

ERRATA SHEET Page 6, top line: “1,10-nm” was corrected to “1,100-nm” Page 23, footnote 51: “northwest” was corrected to “northeast”

NTSB

Marine Accident Report

i Contents Figures .............................................................................................................................................v Tables .......................................................................................................................................... viii Acronyms and Abbreviations ..................................................................................................... ix Executive Summary ................................................................................................................... xiii 1 Factual Information ...........................................................................................................1 1.1 Introduction ..........................................................................................................................1 1.2 Accident Narrative ...............................................................................................................3 1.3 Vessel Information .............................................................................................................30 1.3.1 History....................................................................................................................30 1.3.2 Classification and Inspection .................................................................................31 1.3.3 Construction and Arrangement ..............................................................................31 1.3.4 Propulsion System .................................................................................................35 1.3.5 Electrical Generation and Distribution System......................................................36 1.3.6 Fuel and Lubricating Oil ........................................................................................37 1.3.7 Steering System .....................................................................................................43 1.3.8 Bilge and Fire Systems ..........................................................................................43 1.3.9 Maintenance ...........................................................................................................46 1.3.10 Electronic Equipment.............................................................................................47 1.3.11 Navigation Equipment ...........................................................................................52 1.3.12 Wind Sensors and Barometers ...............................................................................53 1.3.13 Internal Communication ........................................................................................54 1.4 Cargo Information ..............................................................................................................55 1.4.1 Loading ..................................................................................................................55 1.4.2 Types ......................................................................................................................57 1.4.3 Securing .................................................................................................................58 1.4.4 National Cargo Bureau Review .............................................................................61 1.4.5 Modeling ................................................................................................................62 1.5 Safety Management System ...............................................................................................63 1.6 Injuries ...............................................................................................................................64 1.7 Wreckage ...........................................................................................................................64 1.8 Personnel Information ........................................................................................................74 1.8.1 Deck Officers .........................................................................................................75 1.8.2 Engineering Officers ..............................................................................................79 1.8.3 Supernumeraries ....................................................................................................82 1.8.4 Port Engineer .........................................................................................................84 1.8.5 Work and Rest........................................................................................................84 1.8.6 Bridge Resource Management ...............................................................................85 1.9 Waterway Information .......................................................................................................87

NTSB

Marine Accident Report

ii 1.10 Meteorological Information ...............................................................................................90 1.10.1 Atlantic Hurricane Season 2015 ............................................................................90 1.10.2 Publicly Issued Hurricane Information ..................................................................92 1.10.3 Weather Information Accessible to El Faro ..........................................................95 1.10.4 Weather Data from Other Sources .......................................................................102 1.10.5 Tracking Errors ....................................................................................................104 1.10.6 Simulations ..........................................................................................................107 1.10.7 Astronomical Data ...............................................................................................107 1.11 Survival Factors ...............................................................................................................108 1.11.1 Emergency Response ...........................................................................................108 1.11.2 Lifesaving Equipment ..........................................................................................114 1.11.3 Emergency Procedures.........................................................................................125 1.11.4 Lifeboat Standards and Regulations ....................................................................128 1.11.5 Conventional vs. Freefall Lifeboats .....................................................................130 1.11.6 Personal Locator Beacons ....................................................................................131 1.11.7 Position Format ....................................................................................................131 1.12 Stability Information ........................................................................................................132 1.12.1 Concepts ...............................................................................................................132 1.12.2 Changes in Vessel’s Configuration ......................................................................133 1.12.3 Assessment of Vessel’s Stability .........................................................................137 1.12.4 Methods of Assessing Stability ............................................................................137 1.12.5 Loading Condition at Departure ..........................................................................141 1.12.6 Load Line .............................................................................................................142 1.12.7 Watertight Integrity ..............................................................................................143 1.12.8 Damage Control Plan for Flooding ......................................................................147 1.12.9 Rapid Response Damage Assessment Program ...................................................149 1.12.10 Postaccident Analysis of Stability, Structures, and Sinking ............................150 1.12.11 Dynamic and Forensic Sinking Analysis .........................................................158 1.13 Operational and Management Information ......................................................................159 1.13.1 Company History .................................................................................................159 1.13.2 Corporate Organization ........................................................................................160 1.13.3 Company Operations ...........................................................................................162 1.13.4 Other Information ................................................................................................166 1.14 Coast Guard Alternate Compliance Program ..................................................................167 1.14.1 General Provisions ...............................................................................................167 1.14.2 Targeted Vessel List ............................................................................................168 1.14.3 ABS Surveys ........................................................................................................169 1.14.4 Coast Guard Examinations ..................................................................................170 1.15 Tests and Research ...........................................................................................................171 1.15.1 Fuel Oil Analysis .................................................................................................171 1.15.2 Rogue Wave Analysis ..........................................................................................172 1.15.3 Inmarsat-C Mobile Earth Station Operation ........................................................173 1.16 Previous NTSB Recommendations..................................................................................173 1.16.1 Broadcasting of Position Data by EPIRBs...........................................................173 1.16.2 Hurricane Forecasting ..........................................................................................174 1.17 Other Information ............................................................................................................176

NTSB

Marine Accident Report

iii 1.17.1 Actions Since Accident ........................................................................................176 1.17.2 Previous NTSB Investigations Aided by VDRs ..................................................177 2 Analysis ...........................................................................................................................178 2.1 General .............................................................................................................................178 2.2 Inconclusive Factors ........................................................................................................178 2.2.1 Fatigue..................................................................................................................178 2.2.2 Drugs/Alcohol ......................................................................................................179 2.3 Exclusions ........................................................................................................................179 2.3.1 Boilers/Machinery................................................................................................179 2.3.2 Riding Gang .........................................................................................................179 2.3.3 Failure of Container and Ro/Ro Trailer Lashings ................................................180 2.3.4 Cargo Shift ...........................................................................................................180 2.3.5 Medical Issues ......................................................................................................180 2.3.6 Captain’s Decision to Depart Jacksonville ..........................................................180 2.3.7 Structural Failure .................................................................................................181 2.3.8 Rogue Wave .........................................................................................................181 2.4 The Sinking ......................................................................................................................181 2.4.1 Loss of Propulsion ...............................................................................................183 2.4.2 Flooding ...............................................................................................................188 2.5 Weather Information ........................................................................................................198 2.6 Captain’s Decision-Making .............................................................................................202 2.7 Bridge Resource Management .........................................................................................207 2.8 Oversight ..........................................................................................................................212 2.8.1 Company ..............................................................................................................212 2.8.2 Regulatory ............................................................................................................220 2.9 Contributing to Loss of Life ............................................................................................227 2.10 Other Issues ......................................................................................................................232 2.10.1 VDRs....................................................................................................................232 2.10.2 GMDSS Position Safety Alert—FELCOM .........................................................235 2.10.3 Ship Reporting of Weather Information Using AIS ............................................236 3 Conclusions .....................................................................................................................242 3.1 Findings............................................................................................................................242 3.2 Probable Cause.................................................................................................................247 4 Recommendations ..........................................................................................................248 Board Member Statements .......................................................................................................256 Appendix A Investigation ..........................................................................................................260 Appendix B Note on the Drawing .............................................................................................261

NTSB

Marine Accident Report

iv Appendix C Search for El Faro Wreckage and Voyage Data Recorder ..............................262 Appendix D Vessel Particulars .................................................................................................267 Appendix E Hurricane Avoidance ...........................................................................................268 Appendix F Detailed Information about Vessel’s Lifesaving Equipment ............................273 References ...................................................................................................................................278

NTSB

Marine Accident Report

v Figures Figure 1. Accident location in Atlantic Ocean near Acklins and Crooked Island, Bahamas. ....... 1 Figure 2. Artist’s rendering of El Faro hull lying on seabed 15,400 feet below surface .............. 2 Figure 3. El Faro at sea loaded with containers ............................................................................ 4 Figure 4. Layout of El Faro’s bridge deck .................................................................................... 7 Figure 5. Alternate route via Old Bahama Channel ..................................................................... 10 Figure 6. Actual trackline of El Faro during accident voyage .................................................... 15 Figure 7. Vessel’s speed over ground .......................................................................................... 19 Figure 8. Radar image from 0644 on October 1 .......................................................................... 26 Figure 9. Profile drawing of El Faro. .......................................................................................... 32 Figure 10. Starboard side of El Faro showing supply and exhaust ventilation openings ............ 34 Figure 11. Schematic of El Faro’s lubricating oil system ........................................................... 38 Figure 12. Bull’s-eye for monitoring lube oil flow from gravity tank ......................................... 40 Figure 13. Emergency fire pump. ................................................................................................ 45 Figure 14. Emergency fire pump and inlet piping in hold 3 of El Yunque .................................. 45 Figure 15. VDR capsule ............................................................................................................... 48 Figure 16. Inner VDR capsule assembly after removal from outer capsule ................................ 49 Figure 17. Circuit board assembly from inner VDR capsule ....................................................... 49 Figure 18. Raw VDR wind speed data, from 2000 September 30 to data loss ............................ 54 Figure 19. Cargo stowage arrangement and capacity plan. ......................................................... 57 Figure 20. Roloc box diagram showing kingpin of trailer fitted into receiver ............................ 59 Figure 21. Automobile-lashing arrangement specified for El Faro. ............................................ 59 Figure 22. Two automobiles lashed to one length of chain. ........................................................ 60 Figure 23. Map of El Faro debris field showing large objects. ................................................... 65 Figure 24. Photomosaic of El Faro’s port lifeboat ...................................................................... 67 Figure 25. Intact gravity davits for starboard lifeboat ................................................................. 67 Figure 26. Gravity davits for port lifeboat ................................................................................... 68 Figure 27. Bridge and bridge deck ............................................................................................... 68 Figure 28. Exhaust stack lying on seafloor .................................................................................. 69 Figure 29. Mast and VDR capsule on seafloor ............................................................................ 69 Figure 30. Hull fracture in starboard sideshell and across main deck ......................................... 70

NTSB

Marine Accident Report

vi Figure 31. Tear in ship’s transom. ............................................................................................... 71 Figure 32. Foremast toppled on port side of bow ........................................................................ 72 Figure 33. Container protruding through vehicle opening in bay 15, starboard side. ................. 72 Figure 34. Crushed tank container in bay 2, starboard side ......................................................... 73 Figure 35. Fiberglass deck grating missing from container support beams, port side ................. 73 Figure 36. PFD entangled on boat deck walkway. ...................................................................... 74 Figure 37. Nautical chart with passages through Bahama Islands and Old Bahama Channel .... 89 Figure 38. Tropical cyclone track forecast cone and watches/warnings graphic ......................... 93 Figure 39. Tropical cyclone danger graphic for Joaquin valid for 2300 on September 29. ........ 94 Figure 40. Screenshot of BVS weather file sent to El Faro about 2300 on September 30 ......... 99 Figure 41. Depiction of wind fields forecast for 0800 on October 1 ......................................... 100 Figure 42. Positions of Joaquin obtained by El Faro ................................................................ 102 Figure 43. Surface winds from SFMR observations .................................................................. 103 Figure 44. Visible image of Joaquin captured about 0800 on October 1................................... 104 Figure 45. Best-track positions for Hurricane Joaquin. ............................................................. 105 Figure 46. Official 5-day forecast tracks and best track ............................................................ 106 Figure 47. Two debris fields located during search-and-rescue operations and ........................ 112 Figure 48. Gravity davit with lifeboat in stowed and launch positions. .................................... 116 Figure 49. Location of liferaft stowed below El Faro’s starboard lifeboat ............................... 118 Figure 50. Type of containerized 25-person liferaft carried on El Faro .................................... 119 Figure 51. Inflated 25-person liferaft ......................................................................................... 120 Figure 52. Probability of death from hypothermia .................................................................... 122 Figure 53. El Faro’s starboard lifeboat on arrival at Coast Guard Air Station Miami .............. 123 Figure 54. Immersion suit recovered on October 7, 2015. ........................................................ 124 Figure 55. Stern-launched freefall lifeboat on large container ship ........................................... 130 Figure 56. Second deck plan showing scuttles .......................................................................... 144 Figure 57. Second deck scuttle to hold 3. .................................................................................. 145 Figure 58. Second deck scuttle to hold 2A, similar to hold 3 scuttle ......................................... 145 Figure 59. Ventilation supply trunk (right) and aft exhaust trunk (left) in hold 3 ..................... 155 Figure 60. Righting arm curves for El Faro, with annotated downflooding angles .................. 156 Figure 61. El Faro rolling about a 15° to 18° static heel ........................................................... 159 Figure 62. Ship’s speed over ground from 0200 to 0730 on October 1 ..................................... 182

NTSB

Marine Accident Report

vii Figure 63. Ship’s speed over ground relative to wind direction ................................................ 183 Figure 64. Effect of 18° port list on lube oil system with oil level at 26 inches ........................ 185 Figure 65. Effect of 18° port list on lube oil system for main engine ........................................ 186 Figure 66. Significant opportunities for decision-making. ........................................................ 203 Figure C-1. Sentry deployed on second search mission ............................................................ 264 Figure C-2. CURV-21 freeing VDR capsule from seafloor ...................................................... 265 Figure C-3. CURV-21 placing VDR capsule in basket for transport to surface ....................... 265 Figure C-4. CURV-21 landing on Apache deck after retrieving VDR ...................................... 266 Figure E. Diagram of 1-2-3 rule ................................................................................................ 272

NTSB

Marine Accident Report

viii Tables Table 1. Injuries sustained in El Faro accident ............................................................................ 64 Table 2. Saffir–Simpson wind scale ............................................................................................. 90 Table 3. Nominal and actual issuance times for topical cyclone forecast/advisories. ................. 96 Table 4. Delivery times of BVS weather files and dissemination times of text products ............ 97 Table 5. Times BVS emails sent to El Faro and downloaded during final voyage ................... 101 Table 6. Errors in Joaquin’s center position and intensity predicted for 0800 October 1 .......... 107 Table 7. Lifesaving appliances required by El Faro’s COI ....................................................... 114 Table 8. Duties for emergencies and abandon ship, as specified on station bill ........................ 126 Table 9. Lifeboat design criteria before and after SOLAS amendments took effect ................. 129 Table 10. Comparison of parameters for builder’s hull No. 670. .............................................. 134 Table 11. Analysis of El Faro fuel oil samples from bunkering operations before accident. ... 171 Table 12. VDR conversation between captain and chief mate about Joaquin ........................... 200 Table 13. Audio quality and channel description ....................................................................... 233 Table F-1. Details of survival equipment carried by El Faro .................................................... 273 Table F-2. El Faro survival debris discovered or recovered. .................................................... 276

NTSB

Marine Accident Report

ix Acronyms and Abbreviations AB

able seaman ABS

American Bureau of Shipping ACP

Alternate Compliance Program ACS

authorized classification society AIS

automatic identification system AMO

American Maritime Officers (union) AMOS

Asset Management Operational System ASM

application-specific message AUV

autonomous underwater vehicle bbl

barrels BRM

bridge resource management BVS

Bon Voyage System CDT

central daylight time CEO

chief executive officer CFR

Code of Federal Regulations COI

certificate of inspection CRM

crew resource management CSS

(Code of Safe Practice for) Cargo Stowage and Securing CURV

cable-controlled undersea recovery vehicle D7CC

Seventh District Command Center (Coast Guard) DMSP

Defense Meteorological Satellite Program DP

designated person DSC

digital selective calling ECDIS

electronic chart display and information system EDT

eastern daylight time EPIRB

emergency position-indicating radio beacon EPMV

emergency preparedness manual–vessel

NTSB

Marine Accident Report

x FCC

Federal Communications Commission GAO

Government Accountability Office GHS

General HydroStatics GM

metacentric height GMDSS

Global Maritime Distress and Safety System gpm

gallons per minute GPS

global positioning system GSM

global system for mobile communications GUDE

general utility deck or engine (crewmember) HF

high frequency hp

horsepower IACS

International Association of Classification Societies ICLL

International Convention on Load Lines IEC

International Electrotechnical Commission IMO

International Maritime Organization ISM

International Safety Management (code) ITU

International Telecommunications Union JSTARS

Joint Surveillance Target Attack Radar System kHz

kilohertz LANTAREA Atlantic Area (Coast Guard) LNG

liquefied natural gas LORACS

liaison officer to recognized and authorized classification societies MARAD

US Maritime Administration MASECO

Marine Safety Equipment Corporation MHz

megahertz MISLE

Marine Information for Safety and Law Enforcement NASA

National Aeronautics and Space Administration NAVTEX

navigational telex NCB

National Cargo Bureau

NTSB

Marine Accident Report

xi nm

nautical mile NOAA

National Oceanic and Atmospheric Administration NTSB

National Transportation Safety Board NVIC

navigation and vessel inspection circular OCMI

Officer in Charge, Marine Inspection OMV

operations manual–vessel PFD

personal flotation device PSDA

probability of survival decision aid psi

pounds per square inch psig

pounds per square inch gauge Ro/Con

roll-on/roll-off container Ro/Ro

roll-on/roll-off ROV

remotely operated vehicle rpm

revolutions per minute RRDA

Rapid Response Damage Assessment SAROPS

search-and-rescue optimal planning system SARSAT

search-and-rescue satellite-aided tracking SART

search-and-rescue transponder Sat-C

Inmarsat-C SafetyNet SFMR

stepped-frequency microwave radiometer SIU

Seafarers International Union SLDMB

self-locating datum marker buoy SMS

safety management system

SOLAS

International Convention for the Safety of Life at Sea SSAS

ship security alert system STCW International Convention on Standards of Training, Certification and Watchkeeping for Seafarers SUPSALV (US Navy) Superintendent of Salvage and Diving S-VDR simplified voyage data recorder TEU twenty-foot-equivalent unit

NTSB

Marine Accident Report

xii UHF ultrahigh frequency USC United States Code UTC coordinated universal time VDES VHF data exchange system VDR voyage data recorder VHF very high frequency WAM wireless asset management

NTSB

Marine Accident Report

xiii Executive Summary On October 1, 2015, during Hurricane Joaquin, the US-flagged cargo ship SS El Faro sank in the Atlantic Ocean about 40 nautical miles northeast of Acklins and Crooked Island, Bahamas. All 33 people on board perished. El Faro was owned by TOTE Maritime Puerto Rico and operated by TOTE Services, Inc. Damages from the sinking were estimated at $36 million. Before the loss of El Faro, the last comparable US maritime disaster was the sinking of the US bulk carrier Marine Electric off the coast of Virginia in February 1983, in which all but three of the 34 persons aboard lost their lives. The National Transportation Safety Board (NTSB) determines that the probable cause of the sinking of El Faro and the subsequent loss of life was the captain’s insufficient action to avoid Hurricane Joaquin, his failure to use the most current weather information, and his late decision to muster the crew. Contributing to the sinking was ineffective bridge resource management on board El Faro, which included the captain’s failure to adequately consider officers’ suggestions. Also contributing to the sinking was the inadequacy of both TOTE’s oversight and its safety management system. Further contributing factors to the loss of El Faro were flooding in a cargo hold from an undetected open watertight scuttle and damaged seawater piping; loss of propulsion due to low lube oil pressure to the main engine resulting from a sustained list; and subsequent downflooding through unsecured ventilation closures to the cargo holds. Also contributing to the loss of the vessel was the lack of an approved damage control plan that would have assisted the crew in recognizing the severity of the vessel’s condition and in responding to the emergency. Contributing to the loss of life was the lack of appropriate survival craft for the conditions. The NTSB’s investigation of the sinking identified the following safety issues: • Captain’s actions • Use of noncurrent weather information • Late decision to muster the crew • Ineffective bridge resource management • Inadequate company oversight • Company’s safety management system • Flooding in cargo holds • Loss of propulsion • Downflooding through ventilation closures • Need for damage control plan • Lack of appropriate survival craft The report also discusses other issues, such as the automatic identification system, voyage data recorders, and the US Coast Guard’s Alternate Compliance Program.

NOTE: The person who occupied the position of master of El Faro is referred to as “captain” throughout this report. The NTSB uses the more common title to maintain consistency with other information the agency has produced concerning the accident and to avoid confusion among readers unfamiliar with marine practice.

NTSB

Marine Accident Report

xiv As a result of its investigation, the NTSB makes recommendations to the Coast Guard; the Federal Communications Commission; the National Oceanic and Atmospheric Administration; the International Association of Classification Societies; the American Bureau of Shipping; Furuno Electric Company, Ltd.; and TOTE Services, Inc.

NTSB

Marine Accident Report

1

1 Factual Information 1.1 Introduction On Thursday, October 1, 2015, the SS El Faro, a 40-year-old cargo ship owned by TOTE Maritime Puerto Rico and operated by TOTE Services, Inc., was on a regular route from Jacksonville, Florida, to San Juan, Puerto Rico, when it foundered and sank off the Bahamas (figure 1). The vessel carried a crew of 33, including a “riding gang” of five contract repair workers, all Polish nationals, and their supervisor, an off-duty chief engineer. El Faro had sailed directly into the path of Hurricane Joaquin. The hurricane was a Category 3 storm that reached Category 4 strength 20 minutes after the sinking, according to a National Weather Service poststorm analysis (Berg 2016).1

Figure 1. Accident location in Atlantic Ocean near Acklins and Crooked Island, Bahamas.

1 Category 4 hurricanes carry winds of 130 to 156 mph (113–136 knots). See section 1.10 for detailed information about the storm.

NTSB

Marine Accident Report

2

Four days after the sinking, the National Transportation Safety Board (NTSB) contacted the US Navy and began planning an effort to locate the El Faro wreckage and retrieve its voyage data recorder (VDR). On October 31, the Navy ship Apache located El Faro’s hull at a charted depth of 15,410 feet (figure 2), latitude 23.38125N, longitude 073.9111W.2 A remotely operated vehicle (ROV), CURV-21, confirmed the finding the next day.3 The search ended on November 15 without locating El Faro’s VDR.

Figure 2. Artist’s rendering of El Faro hull lying on seabed 15,400 feet below surface of Atlantic Ocean.4 In April 2016, the National Science Foundation and the Woods Hole Oceanographic Institution jointly sent the research vessel Atlantis to the wreckage area to search for El Faro’s VDR. An underwater vehicle located the VDR capsule on April 26, but investigators determined that it could not be recovered at that time. Ten months after the accident, in August 2016, the Navy ship Apache, again carrying CURV-21, returned to the accident site on a mission to recover the VDR. On the evening of August 8, CURV-21 retrieved the capsule from a depth of 15,250 feet. After the Apache returned to port on August 12, investigators transported the VDR capsule to NTSB headquarters in Washington, DC, where the data were downloaded by recorder specialists in the presence of the

2 This report gives latitude and longitude as decimal degrees, with degree signs omitted. Geographic positions originally reported in another format (degrees and decimal minutes; or degrees, minutes, and seconds) have been converted, except where necessary to document actual transmissions or describe misinterpretations related to format. 3 CURV stands for cable-controlled undersea recovery vehicle. 4 See appendix B for details about the drawing’s development.

NTSB

Marine Accident Report

3

manufacturer’s representatives. Over 26 hours of parametric data and audio files were accessed from the VDR’s memory module (see section 1.3.10, “Electronic Equipment”).5 For further details about the three missions to locate the El Faro wreckage and recover its VDR, see appendix C. The sinking of El Faro was investigated jointly by the US Coast Guard and the NTSB, with the NTSB as the lead investigative agency. The factual information gathered during the NTSB investigation can be found in the online public docket for the accident.6 In October 2015, the Commandant of the Coast Guard convened a Marine Board of Investigation into the sinking. The board of investigation held three public hearings, all of which took place in Jacksonville. The first hearing was held in February 2016, the second in May 2016, and the third in February 2017.7 The NTSB participated fully in the proceedings. Approximately 75 witnesses testified before the marine board, including former and off-duty El Faro crewmembers, company officials, and industry experts. Transcripts of the marine board testimony are found in the docket. Because the sunken El Faro could not be physically investigated (although many thousands of images were gathered during the underwater searches), NTSB investigators visited El Faro’s sister ship, El Yunque, to observe and document its structure and equipment. The visits took place on four occasions (October 9 and December 1, 2015, in Jacksonville; September 20, 2016, in Tacoma, Washington; and January 10, 2017, in Brownsville, Texas). Representatives of the Coast Guard, the American Bureau of Shipping (ABS), and TOTE were present at each visit. El Yunque was also operated by TOTE and traveled on the same run as El Faro, on an opposite schedule. El Yunque, which was built in 1976, one year after El Faro, was considered a sister ship because it was constructed by the same maker to the same hull specifications, though certain arrangements and fittings were not identical on the two vessels. After El Faro sank, the Coast Guard reinspected El Yunque and discovered many deficiencies, including corrosion in its ventilation system, according to a Coast Guard chief inspector who testified at the marine board hearings in February 2017. El Yunque was sold for scrap on December 31, 2016. In addition to reviewing the testimony of witnesses at the marine boards, NTSB investigators gathered information by interviewing former and off-duty crewmembers, the crew’s family members and friends, TOTE officials, industry representatives, Coast Guard officers, and others. Additional first-hand information about El Faro came from photographs and written records collected by Maine Maritime Academy cadets who had sailed on the vessel during the summer of 2015, as part of the school’s cadet shipping program. 1.2 Accident Narrative September 28. At 1230 on Monday, September 28, 2015, El Faro docked at pier 32 on Blount Island Terminal in Jacksonville and began preparations for its return to San Juan the next

5 In December 2016, the NTSB released a transcript of the audio recordings made on the vessel’s bridge during the last 10 hours before the sinking. The transcript is more than 500 pages long. 6 See http://dms.ntsb.gov/pubdms/search/hitlist.cfm?docketID=58116. The NTSB identification number for the El Faro accident is DCA16MM001. 7 The dates of the marine board hearings were February 16–26, 2016; May 16–27, 2016; and February 6–17, 2017.

NTSB

Marine Accident Report

4

evening.8 El Faro made one scheduled round trip a week between Jacksonville and San Juan, leaving Jacksonville on Tuesday, docking in San Juan on Friday, and arriving back in Jacksonville on Monday (figure 3).

Figure 3. El Faro at sea loaded with containers, viewed from stern. (Photo taken March 12, 2012, at Port Everglades, Florida, by Captain William Hoey) At 1300 on September 28, cargo operations began. First, cranes began lifting off the containers that had arrived from San Juan (most of them empty). Then workers began driving the wheeled, roll-on/roll-off (Ro/Ro) cargo (such as automobiles and trailers) off the ship. A new lot of containers began loading at the same time. All the Ro/Ro cargo would be on board before the last containers were stowed. El Faro’s chief mate was on duty to oversee cargo operations, assisted by the second mate or third mate, depending on their schedules. Cargo handling was the work of stevedores (who planned and oversaw cargo discharge, loading, and securing) and longshoremen (who operated cranes, drove trucks and automobiles, and lashed or unlashed cargo). Cargo operations ended for the night at 2100 on September 28. About an hour and a half later (at 2236), the National Hurricane Center, a division of the National Weather Service based in Miami, Florida, advised the public that

8 Times in the report are eastern daylight time (EDT) according to the 24-hour clock. Occasional references are also made to coordinated universal time (UTC), which is 4 hours ahead of EDT.

NTSB

Marine Accident Report

5

a tropical depression about 400 nautical miles (nm) northeast of the central Bahamas had become a tropical storm, named Joaquin. September 29. Cargo loading and unloading resumed at 0800 the morning of September 29. At 1003, an off-duty El Faro second mate texted the captain, “Storm forming north of bahamas.” At 1651, about 3 hours before El Faro would set sail, the National Hurricane Center announced to the public that Joaquin could become a hurricane the next day. At the time, the storm was centered about 600 nm east-southeast of Jacksonville (at 26.0N, 71.0W). Maximum sustained winds were 55 knots, with gusts to 65 knots.9 About 25 minutes later, the hurricane center issued the first marine hurricane warning for Joaquin, for a large area (nearly 73,000 square nm) of the Atlantic east of the Bahamas. The captain and the TOTE port engineer had dinner together the evening of September 29. The port engineer testified at the first marine board that they “discussed the tropical storm that was brewing, but that was all it was, a tropical storm, so there was no concern about major weather.” At 1831, the off-duty second mate sent another text message to the captain: “What’s your plan?” The captain replied that he would “steam our normal direct route” to San Juan and that according to the forecasts, Joaquin would “remain north of us.” At 1909, the off-duty second mate responded in another text that if necessary, “we have routes” through Mayaguana, Crooked Island, and Northeast Providence Channel, referring to passages through the Bahamas that are described as alternate routes for avoiding storms (see section 1.9, “Waterway Information”).10 By 1930 the evening of September 29, El Faro’s cargo was loaded. At 2007, the ship cast off its last line and was away from the pier, carrying a crew of 33 and 11,046 long tons of cargo.11 The weather was warm (78°F), humid, and cloudy, with a light wind blowing from the southeast. Rain had fallen during the day, and showers and fog were forecast for the next day. The Coast Guard had put the port of Jacksonville in Hurricane Condition 4, the base state of alert during hurricane season (June to November), and no storm watches were posted. A harbor pilot was on board to guide El Faro down the main ship channel to a sea buoy off the mouth of the St. Johns River, a distance of about 9 nm.12 The pilot told the second marine board that when he mentioned the storm building in the Atlantic, the captain said, “We’re just gonna go out and shoot under it.” The pilot said no one on the ship’s bridge reacted. At 2144, the pilot left the vessel near the sea buoy, and El Faro embarked on its 1,100-nm voyage to San Juan, intending to follow the usual straight-line track that passed east of the

9 A knot is a unit of speed equal to one nautical mile per hour (about 1.15 statute miles per hour). One nautical mile is 1 minute of arc on any meridian. 10 The second mate misspelled Mayaguana as “Mauagiez” in his text. Mayagüez is a municipality in Puerto Rico. 11 One long ton = 2,240 pounds. 12 Jacksonville is situated on the banks of the St. Johns River, which empties into the Atlantic Ocean east of the city. See section 1.9 for a description of the port of Jacksonville.

NTSB

Marine Accident Report

6 CORRECTED COPY Bahamas. In the departure report he sent to the TOTE offices, the captain estimated his time of arrival at the San Juan sea buoy as 0500 on October 2. At 2254, an hour after the pilot left the ship, the National Hurricane Center announced that the Bahamian government had issued a hurricane watch for the central Bahamas.13 The watch meant that the area could see hurricane conditions in 36 to 48 hours. The storm was moving west-southwest. September 30. At 0443 on Wednesday morning, the National Hurricane Center announced that the Bahamian government had upgraded its hurricane watch for the central Bahamas to a warning and had now issued a hurricane watch for the northwest Bahamas, excluding Andros Island.14 A warning means that hurricane conditions are expected within 36 hours. Hurricane hunter aircraft were “on their way to investigate Joaquin,” according to the hurricane center’s announcement. Audio data from El Faro’s VDR were recovered as far back as 0536 on September 30 (earlier data had been recorded over). The VDR recorded conversations and ambient sounds using six microphones on El Faro’s bridge. Figure 4 illustrates the layout of El Faro’s bridge deck, showing the location of the helm, navigation and emergency equipment, stairs to the deck below (which included the captain’s office), bridge wings, and other items mentioned in the recording. The VDR also captured radar images and parametric data, such as ship’s heading, wind speed, and wind direction. Officers on the bridge commented that their anemometer was not working, and the wind direction readings stayed between 180° and 193° (relative to the vessel) for nearly all the recording. Investigators determined that the wind data recorded on the VDR were inaccurate. At 0601, the captain and chief mate were discussing the storm’s route, referring to the ship’s onboard weather program, the Bon Voyage System (BVS). BVS files, which contained graphic depictions of weather information, were sent every 6 hours to the captain’s email address. At 0608, an emailed BVS weather file was downloaded on the captain’s computer.15 (It had been available at 0504.) The data in the BVS file—storm’s current position and forecast track—were consistent with those in the National Hurricane Center advisory (No. 8) issued at 1651 the day before (when the hurricane center also announced that Joaquin could become a hurricane the next day [September 30]).16 At 0612, the captain emailed the file to the computer on the bridge.17 Two

13 The central Bahamas include Cat Island, the Exumas, Long Island, Rum Cay, and San Salvador. 14 The northwest Bahamas include Grand Bahama, Bimini, Abaco, the Berry Islands, Andros, Eleuthera, and New Providence. 15 Two previous BVS weather emails had been downloaded on the ship, before the VDR recording began. See section 1.10.3 for more information about BVS. 16 Because of an updating problem with the BVS system, the weather file received at 0504 duplicated the file emailed to the ship 6 hours earlier. 17 BVS weather files were sent only to the captain’s email address and had to be forwarded from his email account (accessed only in his office) to a bridge email account, where they would be downloaded on the bridge computer.

NTSB

Marine Accident Report

7 minutes later, he was recorded as saying: “It’s tracking as the written weather has it. . . . It’s gone a little south.”

Figure 4. Layout of El Faro’s bridge deck. Bridge interior measured about 40 feet (port to starboard) by 32 feet (forward to aft). Investigators attributed some VDR noise to curtains on metal rods being drawn aside to access chart table. Bulkheads are dividing walls. Note location of EPIRB (emergency position-indicating radio beacon) on bridge exterior, starboard aft. The captain and chief mate then discussed their course, referring to the BVS information, and cleared the chart table of everything except the navigation charts. At 0624, they shifted the vessel’s course slightly southward (from 133° to 140°).18 At 0625, El Faro’s Sat-C terminal received an urgent (pan-pan) high seas forecast predicting that in 24 hours, Joaquin would be near 24.7N, 73.8W, about 50 nm northeast of San Salvador Island.19 Maximum sustained winds were predicted to be 75 knots, with gusts to

18 Headings, or bearings, in this report are true. True heading is the direction, relative to true north, in which a ship points. The usual measurement is in degrees and is measured clockwise through 360°. If a vessel heads true north, it heads 000°; east, 090°; south, 180°; west, 270°. 19 Sat-C is short for Inmarsat-C SafetyNet. Inmarsat (International Maritime Satellite Organization) operates geostationary satellites that transmit safety communications for ships at sea. The National Weather Service delivers weather forecasts and warnings to Inmarsat for satellite broadcast.

NTSB

Marine Accident Report

8 90 knots, and seas to 27 feet, in an area that included the accident location. The Ocean Prediction Center, one of the National Centers for Environmental Prediction operated by the National Weather Service, had issued the forecast at 0547. At 0635, the captain and chief mate were still plotting their course. At 0638, El Faro’s Sat-C terminal received National Hurricane Center advisory No. 10 (corrected), which stated that the government of the Bahamas had issued a hurricane watch, rather than a warning, for the northwestern Bahamas excluding Andros Island.20 The location of the storm center had not changed (east-northeast of the central Bahamas). Maximum sustained winds were 60 knots, with gusts to 75 knots. The captain and chief mate continued plotting the course and updating their trackline. At 0641, the captain yawned and said, “Oh, look at that red sky over there. Red in the morning, sailors take warning.”21 He and the chief mate continued working on the vessel’s route. At 0655, the captain told the chief mate that he “spoke to the steward about the prevailing weather and the importance of securing the galley for the evening.” He then asked the chief mate whether he was comfortable with the recent course change (“a good little diversion”). The chief mate said he was and that the other option was “drastic.” The captain said, “Yeah, it doesn’t warrant it . . . you can’t run every single weather pattern.” The chief mate said, “Not for a forty-knot wind,” to which the captain replied, “Now that would be the action for some guy that’s never been anywhere else . . . we’ll just sit on the bank and fish for trout.” At 0711, the captain said, “Needless to say, we’ll be watching the weather deteriorate today.” A few minutes later he said, “If our anemometer worked.” The chief mate said, “Obviously, the direction’s not good. Is that number [wind speed] any good?” The captain said, “I wouldn’t trust it.” The chief mate said, “they’re (not gonna) buy a new one for it.”22 The captain told the chief mate that when he addressed the crew that day, he should “let ‘em know we got some weather.” At 0719, the captain told the chief mate to “take a hard look at some of that cargo down there” and asked if he had enough lashings. The chief mate replied that he had not looked at any lashing inventory and that the longshoremen in Jacksonville were “doing it [the lashing] wrong.” At 0725, the captain left the bridge to “go down and check up on everybody.” At 0732, the chief mate told the second assistant engineer over the electric telephone to secure his personal belongings: “heavy weather tonight.”

20 The advisory this one was correcting had released the wind information (sustained at 60 knots, gusts to 75 knots) at 0437, about 2 hours earlier. While the VDR did not capture receipt of the earlier advisory, investigators believe the Sat-C terminal received it within minutes. 21 The captain was quoting an age-old saying used to informally forecast the weather: “Red sky at night, sailor’s delight/Red sky in the morning, sailors take warning.” The adage has scientific validity in that a rising or setting sun can create a red sky by illuminating clouds on the horizon associated with an approaching or exiting weather system. 22 On the VDR transcript, uncertain words or phrases are placed inside parentheses.

NTSB

Marine Accident Report

9 At 0739, the National Hurricane Center issued an intermediate advisory announcing that Joaquin had officially become a hurricane (winds of at least 64 knots).23 The storm had intensified and was now centered about 213 nm east-northeast of the central Bahamas (at 24.9N, 72.2W) and about 400 nm southeast of El Faro’s position. Maximum sustained winds were 65 knots. El Faro did not receive the advisory via Sat-C because intermediate advisories were not scheduled for Sat-C broadcast.24 The chief mate and the able seaman (AB) on watch were recorded discussing the ship’s speed and estimated time of arrival in San Juan.25 At 0741, the chief mate said, “We lost some speed . . . we were making twenty knots and now we’re not.” The ship’s speed over ground was 19.4 knots.26 The AB said, “Might slow it down even more.” The chief mate said, “It is what it is. Get there when we get there . . .” At 0744, the third mate said he had heard on the Weather Channel that the storm was going to be a hurricane the next day or “later today.” The chief mate noted that the storm was moving farther south and west than predicted and while discussing the recent diversion (to course 140°) with the third mate, stated, “Now worse comes to worse we can duck in.” He went on to say that Northwest Providence Channel “isn’t gonna do much because you have to come back out right at the wrong time . . . I mean if you’re good (at diverting/I’d rather be) in Old Bahama Channel.”27 In August, El Faro had diverted to Old Bahama Channel to avoid Tropical Storm Erika (figure 5). Around 0815, the chief mate and the AB discussed the weather. The chief mate said, “We’re gonna get slammed tonight.” The AB said, “Yeah, I was thinkin’ that all through August— like it’s been too quiet this season” and that “out in the Pacific it’s one after the other, a daisy chain of ’em.” At 0831, the captain arrived back on the bridge. He said the storm had “morphed its ugly head” between the time they left and when they woke up that morning, then told the AB on watch: Tough to plan when you don’t know, but we made a little diversion here. We’re gonna— we’re gonna be further south of the eye.[28] We’ll be about sixty miles south of the eye. It should be fine. We are gonna be fine—not should be—we are gonna be fine.

23 The poststorm analysis issued by the National Hurricane Center (Berg 2016) states that Joaquin actually reached hurricane strength at 0200 the morning of September 30. 24 Intermediate advisories could have been obtained from the National Weather Service via FTPmail (see section 1.10.2), but there is no evidence that the crew attempted to do so. 25 The AB was the helmsman. 26 Speed in this report refers to speed over the ground, not speed through the water. Speed over the ground was measured by the global positioning system (GPS). Investigators determined that El Faro did not have a device to measure its speed through the water. 27 Northeast Providence Channel connects with Northwest Providence Channel west of Great Abaco Island. 28 The eye is the mostly calm region at the center of a hurricane that winds rotate around. The eyewall is a ring of cumulonimbus that encircles the eye of a tropical cyclone. It is where the most damaging winds and most intense rainfall occur.

NTSB

Marine Accident Report

10

Figure 5. Alternate route via Old Bahama Channel (green) from Jacksonville to San Juan, compared with normal route (orange) and El Faro’s route on accident voyage (purple). (Coast Guard diagram) At 0923, the captain said that Erika was the first real storm he had ever been in with El Faro and that the ship was “solid.”29 The third mate agreed: “This ship is solid it’s just all . . . the associated bits and pieces . . . the hull itself is fine—the plant no problem.” Either he or the captain said, “We’re gonna make it, we’re gonna make it.” The captain then described crossing the Atlantic in “the roughest storm [he] had ever been in.” He said that cars had broken loose, sediment had blocked the fuel strainers, a wind gust had registered 102 knots, and every seventh or eighth wave in a period had been a rogue wave.30

29 It is not clear, but the captain was probably referring to Tropical Storm Erika, which had hit the Caribbean about a month earlier (see section 1.10, “Meteorological Information”). 30 Investigators could not identify which storm the captain was referring to or when it happened. Between 2005 and 2012, he had served on Ro/Ro car and truck carriers crossing the Atlantic (see section 1.8, “Personnel Information”). A rogue wave is an unusually tall wave that appears without warning (see section 1.15.2, “Rogue Wave Analysis”).

NTSB

Marine Accident Report

11 At 0932, the third mate told the captain about problems receiving messages on the ship’s navigational telex (NAVTEX) receiver.31 He then told the AB on watch that he was worried that the Polish workers (“team Poland”) were not prepared for the weather and that they were leaving their equipment unsecured. At 0952, the captain of El Yunque, then about 330 nm southeast of El Faro, sent an email to the El Faro captain: “Just wondering how you were doing with the Hurricane out there. We sped up yesterday morning to get in front of it. We’re to the NW of it now, but it appears to be steadily intensifying and tracking to the SW.” The captain received the message at 1002. Fifteen minutes later, the El Faro second mate emailed her mother: “We are heading straight into a hurricane.” About 0954, the second mate arrived on the bridge and briefly discussed the hurricane with the third mate. The third mate said, “This is good warm-up for Alaska.”32 At 1053, National Hurricane Center advisory No. 11 reported that Joaquin was strengthening as it moved southwest. The storm center was about 187 nm east-northeast of the central Bahamas (at 24.7N, 72.6W) and about 330 nm southeast of El Faro’s position. Maximum sustained wind speeds were 70 knots, gusting to 85 knots. El Faro’s Sat-C terminal received the advisory at 1056. The chief mate told the captain that the latest advisory was “pretty much in line with what BVS is saying as far as direction.” At 1108, the El Faro captain emailed the captain of El Yunque: I have been watching this system for the better part of a week. We did alter our direct route slightly more to the south, which will put Joaquin 65 nm to the north of us at its cpa [closest point of approach]. Fortunately we departed the dock in JAX [Jacksonville] on time last evening and making 20k [knots] doesn’t hurt either. All departments have been duly notified and we should be on the back side by 10/01/0800. At 1112, the captain told the third mate, “I think we’re gonna duck underneath it.” At 1121, the El Yunque captain replied to the El Faro captain’s email: That’s good to hear. Hopefully, it will turn to the North soon. As we passed to the west of it, we recorded a 100 knot relative wind gust. Luckily, it was coming from directly ahead. At 1124, the captain downloaded a BVS weather file that had been available at 1103. At 1147, the second mate said, “He’s tellin’ everybody down there—ohhh, it’s not a bad storm, it’s not so bad . . . it’s not even that windy out . . . seen worse.” A few minutes later, the second mate said, “I think he’s just trying to play it down because he realizes we shouldn’t have come this way . . . saving face.” At 1153, captain said, “We’re getting killed with this speed.” At the time, the ship was making 18.9 knots, according to parametric data. The second mate replied, “I think it’s not a matter

31 NAVTEX is an element of the Global Maritime Distress and Safety System (GMDSS). Cargo ships of 300 gross tons or more are required to carry GMDSS equipment when traversing the open ocean. 32 El Faro was being retrofitted to return to the Alaska trade.

NTSB

Marine Accident Report

12 of speed. It[’s] when we get there, when we get there as long as we arrive in one piece.” The captain said, “We’ll pick up a little bit . . . gotta get through this storm.” At 1209, the second mate told the AB on watch, “Who cares what time we get there as long as we get there.” At 1211, the AB said that the Polish crew was “all excited” about the hurricane: “Ahh if they only knew.” At 1219, he said, “Sun’s out—blue sky. Don’t look like there’s many clouds.” At 1222, as required by the company, the captain sent a daily noon report to TOTE.33 He reported that the ship had traveled 274 nm since departing Jacksonville, that its speed had averaged 19.3 knots, that winds were from the north at force 3 (7 to 10 knots on the Beaufort wind scale), and that 7-foot ocean swells were coming from the east-northeast.34 The report noted: “Precautions observed regarding Hurricane Joaquin.” The report gave no details about the precautions. At 1224, the second mate announced, “There’s our weather.” The vessel’s Sat-C terminal had just received an urgent high seas forecast from the Ocean Prediction Center, warning that Joaquin was producing maximum seas of up to 25 feet. The forecast reiterated the National Hurricane Center’s 1053 advisory that the storm’s maximum sustained winds were 70 knots, with gusts to 85 knots, and that its position was near 24.7N, 72.6W, about 300 nm southeast of El Faro. At 1312, the captain emailed the TOTE designated person (DP), copying other onshore company personnel.35 He listed data for the hurricane from the latest BVS weather file and the National Hurricane Center: “Center of Hurricane Joaquin: 24.7N, 72.6W. Direction and Speed: SouthWesterly at 5 k. barometric Pressure: 971 mb [millibars].” Those figures agree with the National Hurricane Center’s advisory No. 11. The captain’s email also stated that winds were “50k with gusts up to 70k” and that seas were “12′ – 14′ throughout tonight and into tomorrow morning.” Those figures do not agree with any particular National Hurricane Center advisory as far as investigators could determine. The captain’s message continued as follows: I have monitored Hurricane Joaquin tracking erratically for the better part of a week. Sometime after 9/30/0200 she began her SW’ly track. Early this morning I adjusted our direct normal route in a more SSE’ly direction towards San Juan, Puerto Rico, which will put us 65+/nm south of the eye. Joaquin appears to be tracking now as forecasted and I anticipate us being on the back side of her by 10/01/0800. The captain’s message concluded with a question to the DP about transiting “the Ol’ Bahama Channel on our return northbound leg to Jacksonville, FL.” He noted that the route would add 160 nm to the trip. He said, “This precaution will take the uncertainty of Joaquin’s forecasted track and as you can see, she really develops into formidable weather pattern on 10/03-05/15. I am confident that Joaquin will track in a northerly direction once reaching the gulf stream current.”

33 The message went into a queue and was not sent from the ship until 1322. 34The Beaufort wind scale, developed in 1805, is a method for estimating wind strength without using instruments. The scale ranges from force 0 (winds less than 1 knot) to force 12 (hurricane: winds 64 knots or more). It is still used for its original purpose as well as for tying various components of weather (wind strength, sea state, and observable effects) into a unified picture. 35 The DP is a designated person or persons ashore with direct access to senior management.

NTSB

Marine Accident Report

13 At 1320, the captain told the second mate they might use Old Bahama Channel on the northbound trip from Puerto Rico. He said he was awaiting confirmation from the office. At 1344, the National Hurricane Center issued an intermediate advisory stating that Joaquin was “continuing to strengthen.” The storm was centered about 165 nm east-northeast of the central Bahamas (at 24.4N, 72.9W) and 275 nm southeast of El Faro’s position. The storm was moving southwest, with maximum sustained winds of 74 knots. El Faro did not receive the advisory.36 At 1402, the captain told the second mate the weather pattern was “crazy erratic” but that “these ships can take it.” The second mate said, “Yeah, they’re built for Alaska.” The captain then talked about taking Old Bahama Channel on the return voyage. He said he informed the company as a “professional courtesy” because it increased the length of the trip. Beginning at 1414, the VDR recorded a sécurité (meaning important safety information) message broadcast by a Coast Guard aircraft over channel 16 (the maritime distress channel). The message stated that a hurricane warning had been issued for the central Bahamas and listed the islands (it also announced a hurricane watch for the northwestern Bahamas). The message requested that “mariners use extreme caution.” The second mate and captain both said, “Wow.” The second mate said, “So hurricane warnings for—ohhh exactly.” At 1416, the second mate told the captain that she had sent a weather report, which she had never done before. The captain told her that by 2 o’clock “on your watch—you should be south of this monster.” The second mate asked whether she should steer a course for the “most comfortable” ride or if she should stay on the track. The captain said he would be “up the entire night for the most part” and they might steer a course to get them through the storm: a “weather ride.” At 1438, the VDR recorded another Coast Guard aircraft sécurité message on channel 16. The message repeated that a hurricane warning had been issued for the central Bahamas and requested “extreme caution” from all mariners. The VDR recorded no conversation related to the message afterward. Around 1520, the second mate and the AB on watch began discussing El Yunque, which was on its way back to Jacksonville. The second mate said, “They’re tryin’ to get away from the storm too.” The AB said, “Nobody in their right mind would be drivin’ into it.” The second mate said, “We are [laughter]. Yaay!” At 1532, the AB told the captain, “We’re gonna go right into it.” The captain said, “Seventy miles south of it.” During the watch turnover at 1545, the second mate told the chief mate that the ocean swell was about the same: “six to eight feet from the east.” At 1546, the captain received a reply from a TOTE official authorizing him to take Old Bahama Channel northbound on the return trip to Jacksonville. At 1547, the second mate told the chief mate that the boatswain and his crew had tightened the lashings on the second deck.

36 As noted earlier, the intermediate advisory could have been obtained through FTPmail, but there is no evidence that the crew attempted to do so.

NTSB

Marine Accident Report

14 At 1550, as the two vessels came within radio range, the chief mate called the El Yunque chief mate on the very-high-frequency (VHF) radio. After a discussion about light bulbs and a tarp, the El Faro chief mate asked whether El Yunque was “in the clear” and said “we’re tryin’ to give it an extra thirty to fifty miles from the predicted center as we uh scoot around here.” He also said they were “really lovin’” the BVS program. At 1558, the chief mate told the AB they were diverting south to stay out of the deeper swells. After stepping out the forecast, the chief mate said the winds should be 30 knots on the port quarter at 2000, 40 knots at 0000 (midnight), and 50 knots on the starboard beam at 0200. At 1608, the captain told the chief mate, “That’s a pretty healthy swell buildin’ there.” The chief mate said the swell was on the port quarter, and the captain said, “As expected.” The chief mate said, “We are really comfortable, actually.” At 1609, the captain told the chief mate he had sent the company an estimated arrival time of 8 o’clock. He reiterated that he wanted to “come home” via Old Bahama Channel. The chief mate said, “I would expect that anyone in the office would say ‘absolutely, you’re the only one, you’re the one here . . . making the decision.’” The captain said he had been extending “a professional courtesy” by informing the company of his plans for the return trip. The AB asked the captain if there was a chance they could turn around. The captain said, “No, no, no. We’re not gonna turn around . . . the storm is very unpredictable—very unpredictable.” At 1649, the National Hurricane Center issued advisory No. 12, stating that Joaquin, centered near 24.3N, 73.1W, was moving southwest at 7 knots. The eye diameter was estimated at 45 nm. Maximum sustained winds were 75 knots, with gusts to 90 knots. El Faro’s Sat-C terminal received the advisory at 1654. The ship was about 212 nm northwest of the center of Joaquin. At 1658, the second mate observed, “Looks like the hurricane is right over our trackline. Our old trackline right now.” She then said, “So two o’clock in the morning. . . . three o’clock. Looks like this storm’s coming right for us.” Then at 1704, she stated, “We are going to go right through the [expletive] eye.” The AB said another company with a “ship like this . . . went through one too and lost a bunch of containers.” The second mate said, “The only good thing is it’s not gonna last long. By tomorrow afternoon we should be out of it . . . it’s just getting through it in the wee hours.” At 1747, the captain downloaded the BVS weather file that had been available at 1703. The current position, forecast track, and intensity for Joaquin were consistent with the National Hurricane Center advisory the ship had received via Sat-C at 1056 that morning. At 1808, the Ocean Prediction Center issued an urgent high seas forecast, based on advisory No. 12, that identified seas of between 12 and 27 feet within 90 nm of the storm center. The forecast predicted maximum seas of 30 feet for noon on October 1. El Faro received the forecast by Sat-C at 1824. According to the vessel track, El Faro passed east of Great Abaco Island in the northern Bahamas during the afternoon of September 30. At 1830, the vessel was about 60 nm from the entrance to Northeast Providence Channel (figure 6). The center of the hurricane was 180 nm southeast of El Faro’s position, based on the recent high seas forecast.

NTSB

Marine Accident Report

15

Figure 6. Actual trackline of El Faro during accident voyage, from departure to sinking, showing times every 2 hours. (Base map by Google Earth) At 1847, after discussing the disaster film The Perfect Storm, which he remembered as featuring a “container ship rockin’ and rollin’,” the chief mate said he had to send some crewmembers to the second deck.37 He stated, “You know those scuttles need to be dogged—not just flipped down . . . they need to be spun and sealed.” 38 At 1858, the sun went down.

37 The Perfect Storm (2000) concerned the commercial fishing vessel Andrea Gail, which in 1991 sank with no survivors after encountering three merging weather fronts. 38 Scuttles are man-size hatches. El Faro had two scuttles in each cargo hold that provided access between decks. Dogs are fasteners. “Dogging a scuttle” means to fasten it securely.

NTSB

Marine Accident Report

16 About 1900, the captain adjusted the vessel’s trackline again. He and the chief mate decided to change course farther south, from 140° to 150°, which the chief mate said would keep them in “lots and lots of deep water.” The chief mate plotted new waypoints past San Salvador Island and northeast of Samana Cay, Bahamas. The captain said, “Puttin’ more distance between us and the center of the low.” The chief mate said that at 0600 the next morning, they would be “on the upside.” The captain told the chief mate, “You don’t necessarily have to go down the Old Bahama Channel. There’s lots of places to duck in to.” The chief mate said, “Maybe if we had to we (should/could) go to Crooked Island (passage/passed it).” The captain said, “If (this/it) doesn’t work out we can use San Salvador as . . . a lee.” 39 At 1943, the third mate arrived on the bridge for the watch change. The chief mate explained that they were navigating using the chart. The captain said, “Safety of the ship comes first.” The chief mate said, “Winds are on your port quarter . . . out of the north” and that they were steering 150° “for south of San Salvador.” The captain said, “San Salvador’s gonna afford a lot of lee.” The third mate said, “I just hope it’s not worse than what this [BVS] is saying because . . . Weather Underground . . . they’re saying’ it’s more like eighty-five—not fifty wind . . . “ 40 At 1949, the captain said, “ . . . we’ll be passing clear on the backside of it . . . the faster we’re going the better. This will put the wind on the stern a little bit more—it’s givin’ us a push.” At 1950, the third mate said he had put car straps on the liferafts “just in case.”41 At 1954, the captain told the third mate, “I will definitely be up for the better part of your watch. So if you see anything you don’t like . . . give me a shout.” Between 1957 and 2020, the captain and chief mate had a brief unintelligible conversation, after which the captain’s voice was not detected on the bridge until 0409 the next morning. At 1957, the National Hurricane Center announced (intermediate advisory No. 12A) that hurricane hunter aircraft had found Joaquin stronger, with maximum sustained winds of 91 knots and higher gusts. The storm was centered at 24.0N, 73.0W, about 80 nm east of San Salvador Island, and was moving southwest at 6 knots. Hurricane-force winds extended up to 30 nm from the center. The storm center was now about 170 nm southeast of El Faro’s position. El Faro did not receive the advisory.42 At 2022, after looking at the storm’s trackline as forecast on the BVS program, the third mate said to the AB, “I listened to the Weather Channel and they were talking about it being more powerful than that.” The third mate said, “I don’t like being so close to something here . . . we

39 A lee is a protecting shelter from the wind and seas. The lee side of an island such as San Salvador is thus the downwind side. 40 “Weather Underground” probably refers to a television program on the Weather Channel that aired from 1800 to 2000 that evening. 41 The third mate apparently placed straps (nylon-web lashing and steel binders), ordinarily used to lash automobile cargo to the Ro/Ro decks, around the liferafts to hold them in place during the storm. 42 As noted, the intermediate advisory could have been obtained through FTPmail, but there is no evidence that the crew attempted to do so.

NTSB

Marine Accident Report

17 can’t outrun it.” The AB said, “What if we get close—we get jammed in those islands there and it starts comin’ at us. . . .” The third mate said, “That’s what I’m thinking. Maybe I’m just being a Chicken Little. I don’t know.” At 2120, the VDR recorded a discussion between the third mate and the AB on watch. The AB said he thought they were going to divert through Old Bahama Channel, as “some captain” would have done, “not takin’ any chances.” The third mate responded that he would not second-guess the captain: “The guy’s been through a lot worse than this . . . he did it up in Alaska.” The third mate and AB discussed the results of traveling through a storm on another ship where the AB said he was thrown from the deck. Later during the watch, the third mate discussed the latest report that he had watched on the Weather Channel regarding the storm, saying that the weather would affect the Bahamas for the next couple of days and that a prediction called for about 20 inches of rain. At 2249, the National Hurricane Center announced that Joaquin had become a Category 3 hurricane, with maximum sustained winds of 100 knots, and was moving toward the central Bahamas. Hurricane-force winds extended outward as far as 30 nm, and additional strengthening was forecast during the next day or two. Announcements of this sort (National Hurricane Center public advisories) were not scheduled for Sat-C broadcast. As noted below, El Faro’s bridge team learned that the hurricane had been upgraded to Category 3 from a radio broadcast 2 1/2 hours later. The National Hurricane Center also issued an advisory (No. 13) at 2249 saying the storm was centered near 23.8N, 73.1W (about 120 nm southeast of El Faro’s position) and was moving southwest (220°) at 5 knots. Maximum sustained winds were 100 knots, with gusts to 120 knots. El Faro received the advisory on its Sat-C terminal at 2253. At 2305, the third mate called the captain from the bridge telephone to suggest that he might want to look at the latest forecast. He told the captain that maximum winds were 100 mph (87 knots) at the storm center and that the hurricane was moving toward 230° at 5 knots: “It’s advancing toward our trackline and . . . puts us real close to it . . . we’re lookin’ [to] meet it at say like four o’clock in the morning.” He said he would call the captain back with better numbers. A BVS weather package was sent to the captain’s email address about this time but was not downloaded. At 2313, the third mate called the captain again and suggested diverting to the south: “At 0400 we’ll be twenty-two miles from the center. With max one hundred with gusts to one twenty and strengthening . . . from what I can see . . . at 0200 we could head south and that would open it up some. “ At 2326, the third mate told the AB on watch, “He seems to think that we’ll be south of it by then—so the winds won’t be an issue. . . . what he’s saying is ‘well, we’ll be in the southwest quadrant. Wind will be comin’ from the north.’ . . . I trust what he’s saying—it’s just being twenty miles away from hundred knot winds—this doesn’t even sound right.” The AB said he had his survival suit and lifejacket laid out.

NTSB

Marine Accident Report

18 The second mate arrived on the bridge for the watch change at 2345. The AB announced the course: “One-five-zero.” At 2351, the third mate told the second mate, “(captain’s) saying it’s better to be on the south side . . . you’re not in the dangerous semicircle.” At 2357, the third mate said he was concerned that “the information we’re getting from other sources is so much different from this.” The second mate and third mate discussed the weather and alternate courses, including Old Bahama Channel. October 1. At 0017 on October 1, the Ocean Prediction Center issued an urgent high seas forecast reproducing the storm particulars issued by the National Hurricane Center an hour and a half earlier. Maximum sustained winds were 100 knots, with gusts to 120 knots. El Faro’s Sat-C terminal received the forecast at 0026. At 0019, the second mate told the AB on watch, “. . . if we go south . . . we can try to connect with the Old Bahama Channel . . . go due south. That’s where we get into kinda shallow and there is not wiggle room.” At 0041, the second mate went over the vessel’s trackline with the AB after receiving the latest Sat-C weather forecast. She said, “Now we’re gonna hit it at four o’clock in the morning.” The AB said, “What’s he thinking?” The second mate said, “Every time we come further south the storm keeps trying to follow us.” Ten minutes later (0053), the second mate said, “It doesn’t really feel like we’re going in— near a hurricane . . . when you go outside and there’s hardly any wind. . . . we’re going twenty knots . . . not rolling.” The AB asked, “Sure we gonna change course at two o’clock?” The second mate said, “I don’t know, gosh, I might call the captain here shortly if he doesn’t come up . . . I don’t know how he can sleep knowing all of this.” The second mate said she slept well until 9 o’clock, when her ZzzQuil (a sleep aid) wore off, so she put in her earplugs. She said the ZzzQuil “knocks me out” but the rolling or pitching shook her awake. At 0107, the second mate and AB discussed the storm. The second mate asked if it was a Category 2 and the AB said yes. At 0115, the radio in the background announced that Hurricane Joaquin had become a Category 3 storm. The second mate said, “Oh my God.” At 0118, the AB reacted to a roll: “Biggest one since I’ve been up here.” The second mate wondered why the ship was rolling: “We’re right between the islands.” According to a VDR radar image, the vessel was west-southwest of the southern tip of San Salvador island and coming out of the lee of the island. At 0120, the second mate told the AB she was going to “give the captain a call and see if he wants to come up and (look at it).” She called the captain and said, “we’ll be meeting the storm” and “it isn’t lookin’ good right now.” She said, “Right now my . . . trackline I have 0200—alter course straight south and then . . . go through all these . . . shallow areas.” After the call, the second mate told the AB the captain said to run the course the third mate had plotted (116°), which she said would get them “into the storm at four o’clock in the morning.”

NTSB

Marine Accident Report

19 At 0124, the second mate directed the AB to change course to 116°, and the ship experienced a windheel.43 The AB commented, “. . . wind heel. Yeaaah.” The second mate ordered a course adjustment to 114°, then said, “Startin’ to hear the wind now.” She indicated that the course would stay at 114° the rest of the midnight-to-0400 watch. The vessel’s speed was still about 20 knots, which it had maintained throughout the voyage thus far. Figure 7 plots the ship’s speed over ground, which is the ship’s motion relative to the earth’s surface, as measured by GPS. The VDR recorded this information from the morning of September 30 to the time of the sinking. On October 1, as shown in the figure, the ship’s speed over ground slowly decreased after 0100, then dropped precipitously about 0400.

Figure 7. Vessel’s speed over ground from 0530 on September 30 until sinking. (Based on VDR parametric data) At 0131, the National Hurricane Center issued an intermediate advisory that placed the center of Hurricane Joaquin about 30 nm northeast of Samana Cay, with maximum sustained winds of 104 knots. The advisory indicated that Joaquin had moved southwest over the past 3 hours. That was about when El Faro completed a course change from 150° to 116°. At 0135, with El Faro heading 113°, Joaquin’s center position, according to the intermediate public advisory, was 71 nm from El Faro, at 7° to port. El Faro did not receive this advisory.44 At 0132, the AB said, “Lost a little speed.” A few minutes later, the second mate went out on one of the bridge wings to test the wind. The second mate said it was “not too bad. I can stand up straight.” The AB said, “Pitchin’ a little bit,” and the second mate noted, “One good swell— every so often.” At 0140, the second mate laughed and said,

43 Windheel is the heeling (leaning to one side) of a vessel caused by the wind acting on the part of the vessel above the waterline. Windheel increases with wind velocity and is greatest when the wind blows directly on the beam (from a direction at a right angle to the side of the ship). 44 Again, intermediate advisories could have been obtained through FTPmail, but there is no evidence that the crew attempted to do so.

NTSB

Marine Accident Report

20 Usually people don’t take the whole . . . survival suit—safety meeting thing very seriously . . . Nobody actually sees to see if their survival suit fits . . . I think today would be a good day [laughter] for . . . the fire and boat drill . . . people are gonna (go/be like) . . . “I really need to see if my survival suit fits—for reaaal” [laughter throughout]. At 0141, the second mate said, referring to her recent phone call to the captain, “Captain was sound asleep. It took a few rings for him to answer.” At 0143, the AB reported two flashes on the main deck: “. . . right there up on the bow.” He and the second mate discussed possible sources, such as a light bulb blowing out, a crewmember turning lights on in a room, “reefers” (refrigerated containers), or lightning. The AB said it was not lightning. At 0146, the second mate said to the AB, “We don’t have any lifejackets up here on the bridge, do we, like the El Morro?”45 She went on to say, “I was thinking about that safety stuff that was (on) the El Morro we don’t have over here . . .” At 0156, the second mate said, “Wooo. That was a good one” and that they had “definitely lost some speed.” The AB said, “Damn sure don’t wanna lose the plant [main engine].” From parametric data, the ship’s speed was 17.7 knots. At 0211, the second mate reported “green water on the bow.”46 The AB said, “There’s some clanking going on.”47 The second mate said, “We could hear a lot of clanking.” The AB said the vessel’s speed was down to 16 knots. The second mate said, “We’re definitely getting set” and that the wind was picking up.48 At 0246, the AB said, “Well, we ain’t got long, ’bout an hour.” The second mate said they would be “getting in to the brunt of it at the end of our watch.” The AB said, “Figured the captain would be up here.” The second mate said, “I thought so too. I’m surprised . . . he said he would probably be up here.” The AB said, “He’ll play hero tomorrow.” At 0248, the AB and second mate reacted to large waves. The second mate said, “That was a doozy. [laughter] That was not a good one.” The AB said, “Yeah, that was a big wave.” The second mate said, “(We/she) won’t be able to take more of those,” and then, “Would help if I knew which direction the swell was coming from. I could alter course a little more. Can’t see.” A few minutes later, they both heard a “thump” and the second mate said it must be something inside. “Like my TV,” said the AB. It became difficult to stand on the bridge. The AB said both his feet were “locked in,” and the second mate said, “I had to sit down for that one.” At 0253, the off-course alarm sounded for the first time. (The vessel was operating on autopilot.) The second mate asked, “She off course?” At 0300, the AB and second mate heard something loose on the deck above them, and the second mate said, “You don’t wanna get out

45 El Morro was a TOTE ship, sister vessel to El Faro, that was scrapped in 2014. The second mate served on El Morro from 2005 to 2014. 46 Green water is water not broken into spray as it comes over the deck in foul weather. 47 “Clanking going on” probably refers to the noise created by loose metallic or hard items as they struck the vessel’s steel superstructure as a result of the wind or the ship’s motion. 48 A vessel is set when the current or wind moves it from its intended course line.

NTSB

Marine Accident Report

21 there in that wind . . . I can hear it gusting.” The second mate told the AB, “. . . the only comforting thing is that this ship has much better steel than El Morro.” At 0320, the off-course alarm sounded again. The second mate said, “She’s goin’ left— she’s got right rudder.” She indicated that the wind was increasing on the bow: “Got some wind in our face. . . we’re getting into it now.” At 0324, the second mate said she thought the wind was shifting west and that they were going to “start getting it on the starboard side.” Then she said, “It’s just getting bigger. Our path is going right through it.” At 0331, despite the crew’s remarks about a broken anemometer, the VDR recorded a wind gust of 58 knots. The second mate said the wind and rain were “kinda like pressure-washing the decks.” At 0340, the second mate changed course to 110° to counteract the vessel’s set.49 A few minutes later, she said the ship was “riding nice on that course.” The vessel’s speed was 16.8 knots. At 0345, the watch changed. The chief mate arrived on the bridge and said, “So you can’t see a thing, huh?” The second mate advised him that the second engineer was blowing tubes (using high-pressure steam to remove soot from the boiler tubes deposited during combustion). The chief mate changed the ship’s heading farther east, from 110° to 100°. He had trouble determining the wind direction: “I assume that we’re heelin’ to starboard.” Two minutes later, the off-course alarm sounded again, and the chief mate altered course to 095° (nearly due east). The vessel’s speed was 13.8 knots at that point. At 0352, the second mate emailed a friend: “So we are heading into the hurricane right now full force. Tried to alter our course to avoid it but he’s on the war path. Bad seas and really bad winds. Hope to talk to you Friday.” At 0353, the second mate emailed her mother: “Not sure if you have been following the weather at all but there is a hurrican[e] out here and we are heading straight into it. Catagory [sic] 3 last we checked. Winds are super bad and seas are not great. Love to everyone.” At 0355, one of the engineers arrived on the bridge and said that some of the electrical power cords to the reefer containers on the second deck had been “cut.” The off-course alarm sounded again. At 0404, the chief mate estimated that they were steering 30° into the wind. The vessel’s speed had dropped to 10 knots. At 0405, the AB asked about the wind speed. The chief mate responded, “I don’t have any idea. (We don’t have any) instrument that can measure (it).” At 0409, the captain arrived on the bridge. He said he had slept well (“like a baby”) and that “this is every day in Alaska . . . a typical winter day in Alaska,” He noted that the ship was not pitching. At 0412, the chief mate said he had turned off the course alarm: “It was going off every five seconds.” The vessel was still steering on autopilot. The captain mentioned filling the ramp tanks to correct the heel: “The only way to do a counter on this is to fill the port side ramp tank

49 To counteract being set, a vessel steers somewhat toward the wind and seas that are pushing it off course.

NTSB

Marine Accident Report

22 up.”50 The chief mate said, “Heel is not bad,” and that the forecast had the wind coming around to starboard. He said they were not doing anything about the severed power cords to the reefer containers. At 0415, the captain asked the chief mate whether they were “startin’ to slow down” and called the engine room. He asked the second assistant engineer, “Everything good as far as rpm [revolutions per minute] goes?” He then said, “Perfect.” He reported that the second assistant engineer had said the engineers were “blowin’ tubes.” At 0421, the captain told the chief mate, “It’s probably better off we can’t see anything.” The vessel’s speed had dropped to 8.5 knots. At 0427, the captain said he wanted more speed and asked if the ship’s speed should be “comin’ up a little bit faster.” The chief mate reported the engine speed as 100 rpm and said, “This might be as high as it’s gonna go.” The ship’s speed increased slightly, probably after the engineers finished blowing tubes. At 0434, the captain said he was going to go check the galley. The chief mate called the engine room to remind the crew to secure the weather decks (open decks exposed to the weather). At 0437, the chief mate said a trailer was “leaning over” on the second deck forward of the bridge. The chief mate talked to the caller and said, “Yeah, we’re heelin’ over.” At 0440, the chief mate might have tried to gauge the list with a clinometer (“can’t even see the [level/bubble]”). He then told the captain over the electric telephone, “The chief engineer just called . . . something about the list and oil levels.” At 0443, the captain said he was going to steer into the wind because the chief engineer “wants to take the list off” and said to put the vessel into hand steering. The chief mate ordered hand steering and turned the vessel northward to 065°. The captain explained to the chief mate that the “[oil] sumps were actin’ up.” At 0446, the captain took the conn (control of the helm) and ordered a course change to 060° (farther into the wind). The vessel’s speed dropped to 7.5 knots. At 0445, the BVS weather file was downloaded that had been available at 2304 the night before. (The captain left the bridge at 0434 to check the galley and returned to the bridge at 0442 after the chief mate called him on the phone. A few minutes later, at 0457, he went below again to check his messages. It is likely that the messages were downloaded from the server while the captain was on the bridge.) Joaquin’s current position, forecast track, and intensity given in the file were consistent with the data in the National Hurricane Center advisory that had been delivered to the ship via Sat-C at 1654 the previous afternoon (almost 12 hours before). Just before 0447, El Faro’s Sat-C terminal received an advisory the National Hurricane Center had issued a few minutes earlier. The advisory located the storm center at 23.4N, 73.7W (about 17 nm north of Samana Cay), with maximum sustained winds of 105 knots and gusts to

50 The ramp tanks, also called the aft deep tanks, were located on the aft bottom of the ship, one on the port side and one starboard. They were originally installed to counterbalance the weight of the loading ramps so as to maintain an even keel during loading and unloading.

NTSB

Marine Accident Report

23 CORRECTED COPY 130 knots. The storm was moving west-southwest at 4 knots. As calculated from the position reported in the advisory, El Faro was 11 nm northwest of the storm center.51 At 0453, the captain said, “Did we lose a container or something? A trailer down on two deck?” A few minutes later, the captain ordered a heading of 050° and went below to check for messages. At 0500, the chief mate said things were starting to look better and that he expected the wind to come around, first to the bow and then to starboard. He said, “We’re still heelin’.” At 0503, the chief mate said the barometer was rising, and the captain discussed his different sources of weather information. He said he used BVS but that he was getting “conflicting reports as to where the center of the storm is.” The captain did not download the BVS weather file that was made available at 0503 until an hour later (0609). At 0510, the off-duty TOTE engineer assigned to supervise the riding crew arrived on the bridge. He said things were “slappin’ around” on the second deck and asked the chief mate what the wind speed was. The chief mate said, “We don’t know. We don’t have (any) anemometer.” The riding crew supervisor explained the effects of the low-pressure alarm for lube oil in the main engine. He said, “I’ve never seen it list like this—you gotta be takin’ more than a container stack. I’ve never seen it hang like this.” The captain said their speed was maintaining at 11 knots and that rpm were over 100. At 0514, the captain ordered a heading more to the north, into the wind. (The heading seemed to have deviated from the 050° previously ordered.) At 0518, the captain said, “Only gonna get better from here. . . . we’re on the back side of it.” The chief mate said, “(eighteen) degree list on . . .”52 The vessel’s speed was now 5.8 knots. At 0521, the VDR recorded a wind speed of 108 knots (the highest wind speed in the parametric data). At 0522, the riding crew supervisor asked how fast the storm was moving. The captain said it had stalled at 5 knots. The chief mate said the last he had seen was 4 knots: “Just sitting there.” At 0530, a canopy on the bridge wing blew away. The chief mate said that the relative wind direction had changed (“The spray is hittin’ us instead of goin’ cross the beam”) and that they were taking water on the stern. At 0535, the National Hurricane Center issued its only tropical cyclone update for Hurricane Joaquin, advising that the government of the Bahamas had issued a hurricane warning for Acklins, Crooked Island, and Mayaguana in the southeastern Bahamas. El Faro did not receive tropical cyclone updates via Sat-C, and investigators found no evidence that the ship procured the information from another source.

51 The center was more likely about 28 nm northeast of El Faro, according to the storm’s position about that time from the National Hurricane Center’s poststorm analysis (Berg 2016). 52 In the VDR transcription, (eighteen) degrees was placed in parentheses as a questionable insertion. The VDR transcription group either could not agree on or was uncertain about what had been said.

NTSB

Marine Accident Report

24 At 0540, the captain said “(goin’/slowin’) down.” The vessel’s speed had dropped to 4.3 knots. At 0543, the captain received a call that there was a problem in hold 3 and said that he would send the chief mate down. He told the chief mate to go to the hold and start pumping. The chief mate mentioned a “suspected leak” and “the scuttle.” At 0544, the captain said, “We got cars loose.” Beginning at 0545, the chief mate spoke on the electric telephone to a crewmember in the engine room and said, “So that’s where the water’s from?” and “Are we able to pump the bilges?” The captain took over the call and confirmed that the bilge pump was running and the water was rising. He asked about pumping water from the starboard ramp tank to the port tank and said, “Let’s do that.” By now the ship was leaning to starboard, possibly about 18°, and its speed had dropped to 2.8 knots. At 0547, the chief mate left the bridge with a radio to check the flooding in hold 3. The captain talked to the chief mate and told him the chief engineer was transferring ballast water from the starboard ramp tank to the port tank. At 0552, a crewmember called the bridge and spoke to the captain. The captain said he was going to “turn the ship and get the wind (on the north side)” to generate a port list so that the crew could have a better look at hold 3. The captain said, “So it is the scuttle?” At 0554, the captain began giving orders to turn El Faro from 060° to 350°. The chief mate, who was alone in hold 3, reported “a hold that’s flooded on the starboard side” and that water was “knee deep” and going over the edge of the scuttle. He said he did not smell anything after he was asked about “a lot of diesel.” At 0556, the captain said to the chief mate, “We got it listing over to port now . . . can you see it down there? The water level?” The chief mate, who had been joined by the riding gang supervisor (they were near the scuttle), may have answered that the worst of the water had dried out on the starboard side, though the recording is not clear. The captain called the engine room and said to stop transferring water from the starboard to the port ramp tanks: “We got a nice port list.” The chief mate and riding gang supervisor prepared to close the scuttle. The captain asked, “You got a lifeline on him or anything?” At 0559, the captain told the second mate, “A scuttle popped open and there’s a little bit of water in three hold, they’re pumping it out right now.” At 0600, the captain talked to the chief engineer and mentioned the ventilation. The captain began orders to bring the list back to starboard by transferring water back to the starboard ramp tanks. The chief mate and the riding crew supervisor reported that they had secured the scuttle on the starboard side of the second deck. At 0600, the Ocean Prediction Center issued an urgent high seas forecast, warning that Joaquin was near 23.4N, 73.7W, with maximum sustained winds of 105 knots, gusting to 130 knots, and seas reaching 36 feet within 220 nm northeast and 100 nm southwest of the center. El Faro received the forecast on its Sat-C terminal at 0623. The forecast reissued the storm’s location, movement, and winds published in the National Hurricane Center advisory El Faro had received about 0447, with the addition of sea height.

NTSB

Marine Accident Report

25 At 0601, the radar stopped functioning, and the captain said, “See if you can get that radar to come back up.” At 0602, the captain said to “give them a shout down below . . . the scuttle has been shut— the scuttle is shut.” The second mate repeated the information on the electric telephone. The second mate then said she heard alarms going off in the engine room. She then asked, “Did we come down on the rpm or did they [engineers] do that?” The captain said, “They did.” The vessel’s speed was 5.3 knots. At 0604, the chief mate was back on the bridge. He told the captain that the scuttle on the second deck had been half open but that the scuttles had been closed and checked earlier. He said, “I saw the water pouring down through the scuttle from third deck—I couldn’t (get/climb) the ladder so I went up to the second deck.” The chief mate returned to hold 3 to monitor the water level. At 0609, the captain downloaded the BVS weather file that had been available at 0503. The information about the hurricane (current position, forecast track, and intensity) was consistent with the National Hurricane Center advisory the ship had received at 2253 the night before. At 0610, the chief mate called the bridge on the ultrahigh frequency (UHF) radio. The captain told him to “transfer over to the starboard ramp tank . . . port to starboard ramp tank.” After the call, the captain said, “I’m not liking this list.” At 0613, the captain said, “I think we just lost the plant.” The vessel’s speed was 0.5 knots. From that point on, the captain stayed in contact with the engine room by electric telephone and with the chief mate by radio. At 0616, after discussing the loss of propulsion with one of the engineers, the captain told the second mate, “(they’ll) bring everything back online.” After another brief discussion with the engine room, the captain told the second mate that water was “sloshing” in the engine room, coming in through the ventilation ducts. When a crewmember from the engine room called again, the captain asked if they were still pumping ballast water from the port to the starboard ramp tanks. The engineers were also pumping out one of the flooded holds (most likely hold 3). At 0617, nautical twilight began. The general outlines of objects would have been discernible under good atmospheric conditions. At 0623, the captain told the second mate to go below and wake the third mate. Beginning at 0628, the captain and one of the mates on the bridge discussed water pouring from the second deck. The mate said the vessel was listing to port. The captain wanted to know the amount of water and whether it was from the open scuttle on the second deck. At 0631, the captain said he wanted “everybody up.” The third mate arrived on the bridge and asked whether he was relieving the watch. The second mate consulted the captain about the format and addressees of the emergency message he wanted her to send, but not until, as she said, they were “ready to go.” The alerts would report flooding, cargo adrift, time, and vessel position.

NTSB

Marine Accident Report

26 At 0633, after speaking to a crewmember in the engine room, the captain said, “They’re gonna get that boiler back up online . . . any second.” At 0634, the chief mate asked whether the radar had been secured, and the captain said no. The second mate said, “It went out on its own.” At 0640, the captain told the chief mate he wanted “eyes on three hold . . . let me know what’s going on down there.” At 0644, the captain told the AB on watch, “You got some turns right now,” meaning that propulsion seemed to have returned. The radar image in figure 8, obtained from the VDR, shows that El Faro’s bow was headed northwest but that the ship was actually traveling southwest, at a speed (in relation to the ground) of 6.7 knots—that is, it was being pushed sideways by the wind and waves, nearly perpendicular to its original course before losing propulsion.

Figure 8. Radar image from 0644 on October 1 showing El Faro heading (bow direction) northwest (325.2°) but moving southwest (228°). At 0645, the indicator light on the bridge for the stern navigation light went out, and a loose handrail was heard banging. At 0647, the sun rose. At 0648, the second mate asked, “Coffee? Cream and sugar?” The AB said he wanted “Splenda, not the regular sugar.” While that exchange was going on, the captain said they had no rpm (no propulsion). At 0652, the captain went below to his office. While he was gone, the second mate told the AB that she had been on the same run on El Morro during a hurricane and that they “took a

NTSB

Marine Accident Report

27 thirty-eight degree roll.” At 0654, the captain was back on the bridge and said to someone that they had “all the wind on the starboard side,” that “a scuttle was left open or popped open or whatever” and there was “significant” flooding in hold 3, but that he did not intend to abandon ship, though they were “in dire straits.” He said he was going to call the office and there was “no need to ring the general alarm yet”; the engineers were trying to “get the plant back.” After the call, the AB asked how long they would be in the storm. The captain said, “Should get better all the time. Right now we’re on the back side of it.” A minute later, low-frequency thuds and crashes were heard, like metal crashing. At 0657, the captain talked to the engine room again and confirmed that the engineers were still pumping hold 3. The second mate asked, “They havin’ trouble gettin’ it [the main engine] back online?” The captain said, “Yeah, because of the list.” At 0659, the captain called the DP and left a message: We have a navigational incident . . . A scuttle popped open on two-deck and we were having some free communication of water go down the three-hold. Had a pretty good list . . . Everybody’s safe . . . but I want to talk to you. At 0701, the captain called TOTE’s contracted emergency call center and requested a connection to a qualified individual to notify him/her of a marine emergency. The captain told the operator, “We have a hull breach, a scuttle blew open during a storm, we have water down in three-hold with a heavy list. We’ve lost the main propulsion unit, the engineers cannot get it going.” At 0706, the captain was connected to the DP and informed him that the ship was listing to port and had lost propulsion because “the engineers cannot get lube oil pressure.” He said the crew was safe, that they had secured the source of the water flooding the vessel, and that engineers were pumping out the flooded hold. He said they had a “very, very healthy port list” and that the crew was “taking every measure to get the list off.” He told the DP that no one was panicking and that “our safest bet is to stay with the ship . . . the weather is ferocious out here.” He reported 10 to 12 feet of spray, high winds, and poor visibility. He said the list was 10° to 15° “but a lot of that’s with the wind heel.” The call ended at 0712. While the captain was talking to the DP, the chief engineer called the bridge. The second mate told him, “The wind is pushing us over, there’s nothing we can do from up here,” and suggested moving ballast. At 0712, the captain told the second mate to send the distress messages she had prepared earlier. At 0713, the second mate reported that she had pressed the distress buttons (Inmarsat-C and ship security alert system [SSAS]) and that the distress alerts were complete.53 She then received an alert that one of the messages she had typed failed to send. Nevertheless, at 0715, Inmarsat’s land earth station in Eik, Norway, forwarded an Inmarsat-C and an SSAS alert to the

53 SSAS units are not part of GMDSS but are required for vessels of 500 gross tons or more constructed before July 2004. An SSAS alert is a covert distress signal normally used when a ship is attacked by pirates. It will not alert attackers that the ship has sent an alert. The alert transmits time, position, course, speed, and a predetermined message at a specified rate until deactivated.

NTSB

Marine Accident Report

28 Coast Guard’s rescue coordination center in Portsmouth, Virginia.54 At 0717, the Inmarsat station in Norway forwarded a second SSAS alert to TOTE. After the second mate had sent the alerts, the captain told her, “We’re gonna be good. We’re gonna make it right here.” At 0714, the chief mate told the captain, “I think the water level’s rising.” The captain asked whether he knew where it was coming from. The chief mate told him the chief engineer had said “something hit the fire main, got it ruptured, hard.” The chief mate said, “I came in here and dogged that door tight,” possibly referring to a door on the fourth deck. The captain said, “Don’t open it.” At 0716, the bilge alarm for cargo hold 2A (on the fourth deck) sounded, indicating that floodwater had entered the hold. The captain and chief mate talked to the chief engineer on the electric phone. The chief mate said that no one had checked hold 2A. At 0717, the captain and chief mate agreed that the vessel’s list was getting worse. The captain mentioned “cars that are floating in three hold” and a crewmember reported that he “saw cars bobbing around.” The chief mate said the fire main in the aft end was “right below the water, dark black water.” The captain told the engine room to isolate the fire main (“that may be the root cause of the water comin’ in”) by securing the valve in the engine room that controlled the suction (seawater intake) for the fire pump. At 0720, the chief mate said he did not know how much water was in the cargo holds, and the captain voiced a concern for the vessel’s stability and for “how much water . . . sitting down there.” Between 0722 and 0725, the captain talked on the electric phone to the riding crew supervisor. The supervisor had looked into hold 3 through the scuttle and asked the captain what the vessel’s downflooding angle was. The captain said, “I don’t have an answer.” Then he said, “I mean we still got reserve buoyancy and stability.” The captain told the riding crew supervisor that he was going to ring the general alarm and wake everyone up: “We’re definitely not in good shape right now” and “just tryin’ to control that list, see where the water’s comin’ from.” After the call ended, the captain sent the chief mate to investigate the situation on the second deck. The mate reported that the water was “chest deep.” At 0724, the DP notified the Coast Guard rescue coordination center of the emergency. At 0731, the DP sent an email to other TOTE officials: El Faro emergency 49 miles east San Salvador. Took on water. 15 degree list. Ingress stopped and pumping water. NO main engines. Heavy winds And 15 ft sea. CG [Coast Guard] notified. At 0726, the captain asked the second mate where the emergency contact numbers were. She said they were “hangin’ up on the . . . by the chair.” The captain told the chief mate on the

54 A land earth station is a facility on land that routes calls via satellite to and from terrestrial telephone networks.

NTSB

Marine Accident Report

29 UHF radio that he was going to ring the general alarm but would not immediately abandon ship. He gave the same message over the electric telephone to the engine room. At 0727, the general alarm bell rang for 12 seconds. At 0728, the chief mate gave a radio command for the crew to muster on the starboard side. At 0729, the captain ordered abandon ship. The VDR recorded a bell ringing in seven pulse tones. The second mate yelled, “I got containers in the water.” The captain said loudly, “Tell ‘em we’re goin’ in.” The second mate asked to fetch her vest (life preserver). The captain said to bring his up, too, and to bring one for the AB on watch. At 0730, the captain said, “Bow is down, bow is down.” At 0731, he ordered the liferafts thrown overboard and the crew to enter them. At 0737, the captain shouted: “Where are the life preservers . . . here? . . . Where are the life preservers on the bridge?” At 0738, the AB yelled, “Goin’ down.” The captain said, “You’re not goin’ down. Come on.” The AB said he needed a ladder, then a line. The captain told him they did not have either. At 0739:07, the AB said loudly, “I’m gone” or “I’m a goner.” The captain yelled, “No you’re not.” Beginning at 0739:32, a low-frequency rumble was heard that continued until the end of the recording. At 0739:38, the captain called the AB’s name, then yelled, “It’s time to come this way.” At 0739:41.8, the audio recording ended.

At 0739, a transmission from El Faro’s registered EPIRB, which had been detected at 0735 by a geostationary satellite, was emailed to the Coast Guard.55 The transmission was forwarded as an “unlocated first alert” because El Faro’s EPIRB was not equipped with a GPS beacon. No further El Faro communications were received by either the Coast Guard or TOTE. At 0759, the National Hurricane Center issued an intermediate advisory reporting that the eye of Joaquin was near Samana Cay (at 23.2N, 73.7W). Maximum sustained winds were 104 knots, with hurricane-force winds extending as far as 30 nm from the storm center. A hurricane warning was in effect for the central Bahamas; the northwestern Bahamas (except Andros Island); and Acklins, Crooked Island, and Mayaguana in the southeastern Bahamas.

55 The last transmission from El Faro’s EPIRB was detected at 0759.

NTSB

Marine Accident Report

30 El Faro’s last known position, according to VDR data, was 20 nm north of Samana Cay, at 23.3925N, 73.9029W. The vessel was about 17 nm from the position of the hurricane’s center reported 20 minutes after the sinking. 1.3 Vessel Information 1.3.1 History El Faro was built in 1975 as the SS Puerto Rico (builder’s hull No. 670) at Sun Shipbuilding and Drydock Company in Chester, Pennsylvania, a subsidiary of Sun Oil Company. It was one of Sun’s Ponce-class vessels designed specifically for the Puerto Rican trade. Operated by the Navieras de Puerto Rico Steamship Company, the Puerto Rico hauled cargo to and from the US East Coast for 15 years. In 1991, the ship was purchased by Totem Ocean Trailer Express in Seattle and renamed Northern Lights. In 1993, the vessel was lengthened by 90 feet at Atlantic Marine, Inc., during a major conversion.56 It then sailed frequently between Tacoma, Washington, and Anchorage, Alaska. After servicing the Alaska trade, the vessel was chartered by the US government from 2000 to 2003 to carry military cargo for Operation Iraqi Freedom. In 2005–2006, the ship was converted from a Ro/Ro cargo ship to a roll-on/roll-off container (Ro/Con) vessel and renamed El Faro. The Coast Guard did not consider the modification a major conversion. A Ro/Ro vessel is an oceangoing cargo ship that uses ramps to roll on or roll off wheeled cargo such as containers, trailers, trucks, cars, and heavy construction equipment. A Ro/Con vessel is a hybrid that has ramps serving vehicle decks as well as cargo decks accessible to cranes for loading containers. Until 2 weeks before the accident, the company that owned El Faro was named Sea Star Line.57 From 2006 to 2008, the vessel ran from the US East Coast to the Middle East under charter. Between 2008 and 2011, El Faro was laid up except for brief periods of activity, including a run between Philadelphia, Jacksonville, and San Juan. Beginning in 2011, the vessel was laid up in Baltimore and out of service for about 2 years (until December 6, 2013) while waiting for work. In May 2014, El Faro was placed into service in the Caribbean trade between Jacksonville and San Juan (see section 1.9, Waterway Information”), replacing the TOTE vessel El Morro when it was scrapped. TOTE planned to convert El Faro back to Ro/Ro service for the Alaska trade in

56 According to Title 46 United States Code (USC) 2101(14a), a “major conversion” means a vessel conversion that (1) substantially changes the dimensions or carrying capacity of the vessel; (2) changes the type of the vessel; (3) substantially prolongs the life of the vessel; or (4) otherwise so changes the vessel that it is essentially a new vessel. 57 On September 17, 2015, TOTE’s parent company announced that Sea Star Line had been renamed TOTE Maritime Puerto Rico.

NTSB

Marine Accident Report

31 early 2016. Two new vessels powered by liquefied natural gas (LNG) would take over the Puerto Rico run.58 1.3.2 Classification and Inspection El Faro was registered as a US-flagged ship, with San Juan, Puerto Rico, as its port of registry. The vessel was classed by ABS, one of several nongovernmental classification societies that establish and maintain standards for the construction and operation of ships and offshore structures. For the inspections required by federal regulations (Title 46 Code of Federal Regulations [CFR] Part 91), El Faro was enrolled in the Coast Guard Alternate Compliance Program (ACP), which allows US vessels to obtain a Coast Guard certificate of inspection (COI) if they pass examination by an authorized classification society.59 COIs are issued to cargo vessels for 5 years, with requirements for annual and periodic vessel inspections. El Faro’s COI was issued on February 22, 2011. The ship had completed an annual examination by an ABS surveyor on February 16, 2015, in Jacksonville. The Coast Guard last endorsed the COI on March 6, 2015, in San Juan, after its annual ACP oversight examination of El Faro. In his examination report, the lead Coast Guard inspector described the vessel as “fit for route and service.” 1.3.3 Construction and Arrangement El Faro was constructed entirely of welded steel. As converted, the vessel was 790 feet 9 inches long, with a beam of 105 feet at the main deck. The vessel was equipped with a single fixed-pitch propeller and had a maximum sea speed of 22 knots. See appendix D for further vessel particulars. Decks and Holds. El Faro had an aft deckhouse with six upper decks (navigation or bridge deck, lower bridge deck, boat deck, cabin deck, upper deck, and CO2 flat—a room where carbon dioxide was stored as a fixed fire-suppression system), a main deck for load-on/load-off container cargo, and three lower decks for Ro/Ro cargo (see profile drawing, figure 9). The navigation bridge, offices, galley, and living quarters were in the deckhouse. The lower decks were the second deck; the third or tween deck; and the fourth deck, or tanktop (ship’s lowest deck, above the fuel, water, and ballast tanks).

58 Ships fueled by LNG emit almost no sulfur oxide and much less carbon dioxide and nitrous oxide than those powered by traditional fuel oil. The Emission Control Areas that are being established worldwide mandate reduced emissions by ships of sulfur oxide, nitrous oxide, and other pollutants (EPA 2011). In 2011, an Emission Control Area was established within 50 nm of the coasts of Puerto Rico and the US Virgin Islands in the Caribbean. In 2010, a similar area was established within 200 nm of the North American coast. Requirements for Emission Control Areas are laid down in Annex VI to the Marine Pollution Convention (International Convention for the Prevention of Pollution from Ships, 1973, as modified by the protocol of 1978). 59 See section 1.14 for more information about the ACP.

NTSB

Marine Accident Report

32

Figure 9. Profile drawing of El Faro. Stern left, bow right. Frame numbers shown along bottom, numbers for container bays at top. Deckhouse contained navigation bridge and crew quarters. Lifeboats and 25-person liferafts were stowed on boat deck. Small (6-person) liferaft was stowed at bow.

NTSB

Marine Accident Report

33 The second deck was partially enclosed and was the highest watertight deck, or freeboard (bulkhead) deck.60 The third and fourth decks were divided into compartments, or holds, designated A through F, forward to aft.61 As shown in the profile drawing, the main and second decks sloped or sheered toward the deckhouse from the bow and stern. El Faro carried containers on the main deck and trailers and automobiles on the second deck and in holds on the third deck and tanktop. Two working internal ramps and an elevator distributed Ro/Ro cargo throughout the vessel. Two other internal ramps from the second to the main deck were blocked off. The ship loaded Ro/Ro cargo through a trailer access between frames 224 and 233 on the starboard side. Another vehicle access between frames 147 and 155, which was not typically used, was fitted with a removable bulwark that partly covered the opening. Deck three (the tween deck) was not watertight but was perforated to allow for ventilation between the holds. Six boundaries gave watertight integrity to the vertical hold areas on the third and fourth decks. The boundaries were the port and starboard sides (hull) of the ship, the second deck, the bottom or tanktop, and the forward and aft watertight bulkheads of the hold. Ramp Tanks. The engine crew pumped ballast water between the vessel’s two ramp tanks during the final hours of the voyage. The ramp tanks, which each had a capacity of 313.5 long tons, were located outboard of the enclosure housing the propeller shaft (shaft alley), from frames 200 to 230. Formally known as ramp-compensating tanks, the tanks were originally installed to allow for minor list corrections during the loading/discharging of cargo on either side of the vessel. Loading ramps at the shoreside facility were winched to reach cargo-loading openings through which cars and trailers were loaded and unloaded. By filling or emptying the tanks to compensate for the weight of the ramps hanging from the vessel, the crew could maintain an even keel during loading and unloading. According to a previous El Faro chief engineer, the ramp tanks were ballasted using a separate freshwater system, with a pump located in the shaft alley that ran off the 450-volt electrical bus. A chief engineer who served on the Caribbean run stated that to correct a list, only the ramp tanks could be used because the fuel tanks were on the bottom of the vessel, on the centerline, and “really didn’t affect [a list] too much.” A chief engineer who departed El Faro in August 2015 wrote in his turnover notes that the tank level indicators for both ramp tanks were not functioning because of wasted (deteriorated) sensing lines. He also wrote that the ballast system had been operating “without any issues.” Cargo Hold Ventilation System. Fresh air was drawn into the cargo holds through a system of louvers, fans, and large ventilation shafts, known as trunks. Fresh air entering through louvers in

60 The terms freeboard and bulkhead deck are used interchangeably. The bulkhead deck is the highest deck to which the transverse watertight (meaning impenetrable to water except under sufficient pressure to create a structural discontinuity) bulkheads and shell are carried. The freeboard deck is normally the uppermost continuous deck exposed to the weather and the sea. It has permanent means of closing all openings weathertight (meaning that in any sea conditions, water will not penetrate). Below the freeboard deck, all openings in the sides of the ship are fitted with permanent watertight closings. 61 This report uses an alphanumeric system consistent with that used by shipboard and terminal personnel. For example, the location of cargo loaded on the third deck of A-hold would be 3A.

NTSB

Marine Accident Report

34 the hull was blown through supply trunks to the cargo holds on the fourth deck. Air naturally flowed up through perforations in the third (tween) deck. The air was then drawn by natural forces (without the use of fans) into exhaust trunks and finally vented to the outside through another set of louvers. Each supply and exhaust trunk was fitted with fire dampers (designated as watertight closures in drawings) that could be closed to cut off the air supply in case of fire. All cargo holds had two supply trunks (port and starboard) and at least two exhaust trunks. The supply trunks were fitted with electrically driven fans mounted port and starboard (directly opposed) on the enclosed part of the second deck. The supply fans were in “blisters” that bulged out from the hull below the overhanging main deck (figure 10). The fans pulled air through four sets of rectangular louvers mounted on the forward and aft sides of the three-sided blister shell plate, then drew it into the fan bellmouth. The fans pushed supply air through the fire dampers into a single trunk that passed through the tween holds and into the lower holds at the tanktop. There the trunk split into horizontal runs mounted longitudinally against the sides of the hold. The lower horizontal supply ventilation trunks in the cargo holds were fitted with downward-facing registers, measured as 12 inches above the tanktop.

Figure 10. Starboard side of El Faro showing supply and exhaust ventilation openings to cargo hold 3. (Photo by Herbert Engineering) The ventilation air was distributed into the holds through louvered registers in the horizontal trunks. Positive pressure from the supply fan would exhaust the air back up through the perforations in the tween deck, where it would enter a set of three rectangular screened openings to exhaust trunks mounted on both the port and starboard sides (directly opposed) of each hold on the third deck. The air would exhaust up the trunk through the second deck and pass through a manually activated (weathertight, not watertight) closure into a trunk containing baffles on the

NTSB

Marine Accident Report

35 second deck.62 The air would pass over the baffles and then out through louvered rectangular openings in the vessel’s sideshell. Aside from historical and underwater images of ventilation louvers on the exterior of the El Faro wreckage, the ship’s internal cargo hold ventilation system could not be examined. Investigators visited the sister vessel El Yunque to examine the cargo hold supply and exhaust systems, which were very similar to El Faro’s, though not exactly the same. Drawings for hull 674 (El Yunque) were also reviewed. As noted earlier, the Coast Guard found extensive corrosion in El Yunque’s ventilation system after El Faro sank. A former port captain stated that corrosion had been found in the past on the ventilation trunks of three Ponce-class vessels because they “ingest” salt air. He stated that the trunks were difficult to get at but “were looked at periodically as part of preventative maintenance and they were always on the shipyard list to be opened, cleaned, inspected and repaired as necessary. Always, always a maintenance issue.” Investigators visited El Yunque in September 2016 and found that most sideshell louvers were severely corroded and holed. Engine Room Arrangement. The main engine room spaces were below the deckhouse, extending down from the stack. The machinery in the engine room was installed on various decks. The propeller shaft, reduction gear, main condenser, boiler foundations, and most pumps were located on the tanktop. The operating platform, main turbines, turbogenerators, boiler controls, and switchboards were on the third deck. Fans, storage tanks, and heaters were situated above these decks in the engine room uptake (refer to figure 9). Outside the engine room was an emergency fire pump in cargo hold 3 on the starboard side of the tanktop, a steering gear system at the stern, and an emergency generator on the cabin deck. Watertight doors led from the engine room to cargo holds 3 and 5. 1.3.4 Propulsion System Main Engine. El Faro was propelled by a pair of General Electric cross-compound, geared steam turbines that produced a total of 30,000 horsepower (hp). The turbines, one high-pressure (maximum speed 6,700 rpm) and one low-pressure (maximum speed 3,418 rpm), were installed side by side and connected by General Electric (type MD-92-1) reduction gears to a fixed-pitch, five-bladed propeller. The reduction gears lowered the turbine speed to the much slower speed of the propeller (maximum 132 rpm). The turbines were equipped with speed-limiting devices (governor pump and relay) that would restrict steam flow, and thereby engine speed, if maximum rpm were exceeded (overspeed condition). In remarks recorded on El Faro’s VDR at 0613 the morning of the sinking, the captain said, after a call from the engine room, that the main engine had failed. Propulsion was never restored.

62 Baffles are plates installed to check or regulate the flow of air.

NTSB

Marine Accident Report

36 Boilers. El Faro’s turbines were powered by two Babcock and Wilcox D-type water-tube boilers.63 The turbines converted the thermal energy of the steam produced by the boilers into mechanical energy that drove the ship’s propeller and electrical generators. Steam at lower pressures and temperatures also heated the boiler’s fuel oil, produced distilled water, and operated auxiliary machinery. The boilers had a design steam pressure of 1,070 pounds per square inch (psi), but testimony and logbook evidence indicate that they were operated at about 860 psi at 900˚F in the months before the accident. According to the manufacturer, the boilers were designed so that all components to be supplied for shipboard use . . . permit satisfactory operation under the following conditions unless stated in customer’s specifications: momentary roll—30˚; permanent list—15˚; permanent trim—5˚.[64] Data from El Faro’s VDR show that while the vessel was sinking, the boilers continued to produce steam pressure, which allowed the turbogenerators to keep generating electrical power (as described below). Burner management, steam pressure, and water level in the boilers were monitored and controlled by a system designed and installed by a company called Nortech. Off-duty engineering officers told investigators that the crew tested boiler automation annually, in accordance with a periodic safety test procedure. Investigators requested the vessel-specific document from the operating company, but it had been kept aboard El Faro. The periodic test procedure from El Faro’s sister ship El Yunque listed 16 test items.65 According to interviews with off-duty El Faro engineers, a safety test was completed during the off-duty second assistant engineer’s last trip, which ended about 9 weeks before the accident.66 1.3.5 Electrical Generation and Distribution System El Faro had two steam turbogenerator sets manufactured by Terry Steam Turbine Company. According to data recorded by El Faro’s VDR, the generators continued to produce electrical power until 0734 on October 1, just before the vessel sank. Each turbogenerator consisted of a steam turbine, powered by 900 psi of superheated steam, that was coupled by a set of reduction gears to a General Electric marine alternating-current generator operating at 1,800 rpm. Each generator had a capacity of 2,000 kilowatts of three-phase power at 450 volts and 60 hertz. The main 450-volt switchboard was energized by the two

63 D-type boilers are so called because the drums and waterwall header appear to form the letter D. 64 Trim is the difference between a ship’s forward and aft drafts. The draft of a ship is the vertical distance between the waterline and the bottom of the hull. 65 The 16 test items included a lamp test, manual boiler trip, drum level high/low alarms, low-low drum level alarm and trip, forced draft fan fail alarm and trip, low-air-flow alarm, last-flame-out alarm and trip, boiler control power, burner safety trip control, trial for ignition, purge cycle, boiler in bypass indication, power failure alarms, atomizing steam low-pressure alarm, fuel oil low-pressure alarm, and process controller operation. 66 He signed off the vessel on August 10, 2015.

NTSB

Marine Accident Report

37 turbogenerators. The emergency switchboard, in the emergency generator room, was fed from the main switchboard through an electrical tie. The vessel was constructed according to the 1973 ABS rules for building and classing steel vessels. The rules required the generators to be located with their shafts in a fore-and-aft direction on the vessel and . . . lubricate and operate satisfactorily when permanently inclined to an angle of 15 degrees athwartship and 5 degrees fore and aft; the bearings are to be so arranged that they will not spill oil under a momentary roll of 22 1/2 degrees.[67] A Detroit model 7163-7005-16V71 diesel engine driving an electrical generator served as the vessel’s emergency generator. It could automatically start using batteries if power to the main switchboard was lost. According to the 1973 ABS rules for building and classing steel vessels, the emergency generator was required to function when the ship was inclined at 22.5˚ and when the trim of the ship was 10˚. According to entries in the preventive maintenance system, the autostart function of the emergency generator was tested monthly. The monthly tests also included operating the emergency generator under an electrical load for 2 hours. VDR data contained no evidence that the emergency generator was used to supply electrical power or was even started during the accident. 1.3.6 Fuel and Lubricating Oil Fuel Oil. El Faro had a capacity of 11,552 barrels (bbl) of fuel oil. Fuel consumption was approximately 2.0 bbl per nautical mile. The double-bottom storage tanks on El Faro were located as follows:68 • No. 2A double-bottom inboard port and starboard (approximately 2,202 bbl each). • No. 3 double-bottom inboard port and starboard (approximately 2,673 bbl each). At the time of the accident, the vessel burned heavy fuel oil RMK500. Samples of fuel from each bunkering (fueling) operation were kept on board as well as with the supplier for testing if necessary. The fuel was usually burned at sea from the No. 3 double-bottom inboard storage tanks. Twice a day, a second engineer transferred fuel from the tanks to a single fuel oil settler (capacity 1,800 bbl, or 273 tons).69 The fuel was heated by steam coils inside the settler to about 130˚F and pumped through two sets of strainers before being heated again by another set of heaters to 230˚F, atomized by 150-psi steam, and burned in the boilers. While it was in liner service between Jacksonville and Puerto Rico, the vessel filled its fuel tanks weekly. It burned about 800 to 900 bbl a day at full sea speed. Postaccident tests on fuel oil from the vessel’s last three bunkering

67 Athwartship means from side to side or across the ship. 68 The tanks are described as double-bottom because they were located on the bottom of the ship, below the tanktop deck. The bottom consisted of two complete layers of watertight hull surface, known as double-bottom construction. 69 A settler, or settling tank, allows oil to stand while water and other impurities settle out.

NTSB

Marine Accident Report

38 operations before the accident found it to be within ASTM specifications (see section 1.15.1, “Fuel Oil Analysis”).70 Lubricating Oil. According to the 1973 ABS rules for building and classing steel vessels, the lubricating oil system of the main engine was “to be so arranged that it will function satisfactorily when the vessel is permanently inclined to an angle of 15 degrees athwartship and 5 degrees fore and aft.” The Coast Guard had no rules for main engine or lube oil operation angles when the vessel was built (or when it was lengthened in 1993). El Faro’s lubricating oil system is diagrammed in figure 11. Because the suction for the lubricating oil service pump was located in the starboard, aft section of the sump, a port list with a forward trim would be the worst-case scenario for exposing the suction bellmouth, which could result in a loss of lubricating oil to the main engine.

Figure 11. Schematic of El Faro’s lubricating oil system, showing component parts and direction of oil flow.

70 ASTM, formerly American Society for Testing and Materials, is an international organization that develops and publishes technical standards on a variety of products, materials, systems, and services.

NTSB

Marine Accident Report

39 The lubricating oil system consisted of two DeLaval-Imo Pump series TKC422BS-337 positive-displacement, vertical rotary screw-type service pumps, rated at 450 gallons per minute (gpm), manufactured by DeLaval Turbine, Inc. (now Imo Industries). The pumps were driven by 40-hp electric motors. According to an original construction diagram, lube oil service pump No. 1 was powered by the main 450-volt switchboard and protected by a 100-amp breaker. Lube oil service pump No. 2 was powered by the emergency 450-volt switchboard and also protected by a 100-amp breaker. The manual for the lube oil pump stated that “running the pump without oil will cause rapid wear of housings, rotors, and other internal parts.” Mechanical seals kept the pressurized fluid inside the pump housings. The lube oil system normally operated with one service pump running and the second service pump in standby mode. The standby pump would automatically start if a pressure switch sensed a 10-psi pressure drop in the line that supplied lube oil to the bearings. Discharge oil pressure could be low for several reasons, including loss of pump prime, leaks in suction piping, obstructions (such as debris) in suction piping, clogged strainers, air in system, leaking seals, or low oil level. According to another construction drawing, El Faro had communication points to advise watchstanders about lube oil issues. While aboard El Yunque, investigators noted the following alarms for the lube oil system on the main control panel: lube oil gravity tank level low, lube oil pump power failure, standby lube oil pump running, lube oil sump level high, lube oil sump level low, lube oil service pump discharge pressure low, lube oil cooler temperature low, and lube oil cooler temperature high. The pumps discharged lube oil to the main engine bearings through an orifice in the supply line, as well as to a 3,200-gallon gravity tank in the upper engine room. The orifice provided a pressure of 12 pounds per square inch gauge (psig) at the lube oil inlet header to the unit.71 The oil had a Saybolt viscosity of 520 (Saybolt universal seconds) at a temperature of 100˚F.72 The 9-foot-high gravity tank was located on the main deck level, about 35 feet above the operating platform (refer to the vessel profile in figure 9). During normal operations, the level in the tank would be maintained above an internal overflow line 10 inches below the top of the tank (refer to figure 11). From the engine room, overflowing oil, indicating proper operation of the lube oil service pumps, could be monitored through an illuminated port (“bull’s-eye”) in the supply line that returned oil to the sump (figure 12). An engineer who had served aboard TOTE’s Ponce-class vessels (last in 2012) told the third marine board that in rough weather, flow in the bull’s-eye might be interrupted by sloshing oil in the gravity tank. In the event of a pressure loss, about 8 minutes

71 Psig measures pressure relative to ambient atmospheric pressure. 72 Viscosity is a fluid’s internal resistance to flow. Instruments used to measure viscosity are called viscometers. Saybolt viscosity is the time in seconds required for 60 cubic centimeters of oil to flow through a standard Saybolt Universal viscometer at a given temperature, depending on the heaviness of the oil. Saybolt refers to George M. Saybolt, an American chemist (Bureau Veritas 2017; Merriam-Webster online).

NTSB

Marine Accident Report

40 of reserve oil for the main engine bearings would gravitate directly into the main engine bearings through a 5-inch drop line located 10 inches from the bottom of the gravity tank.

Figure 12. Bull’s-eye for monitoring lube oil flow from gravity tank. (Photo from El Yunque) The vessel’s two lube oil service pumps drew oil from the main engine reduction gear sump through an 8-inch pipe, a check valve, and duplex magnetic suction strainers. According to the turnover notes of the previous chief engineer from August 2015, both pumps would have required maintenance during the upcoming shipyard repairs (scheduled for November 2015). The forward pump required replacement of the mechanical seal, and the aft pump required rebuilding or replacing because it was “running 3 psi lower than the forward pump.” Those items were noted on a worklist for the shipyard. TOTE’s director of safety and services, who had worked as a port engineer and was also authorized to service the main engine, told investigators that he did not believe a pressure drop of 3 psi was significant enough to affect the system. A chief engineer with Ponce-class experience testified that he had never experienced a failure of the lube oil pumps because the mechanical seals failed. He explained that a line from the discharge side of the pumps to the suctions would keep the offline pump primed. If oil was lost to the pumps, the head pressure of the storage tank could be used to prime them. If air became trapped in the suction side of a pump, the cooling line for the mechanical seal could be cracked open to bleed out the air. The lube oil sump was at the bottom of the reduction gear and extended below the tanktop. According to a construction diagram of the lubricating system, the suction pipe was 10 inches above the bottom of the sump, about 22 inches to starboard of centerline and about 24 inches from the aft bulkhead of the sump. Measurements taken aboard El Yunque in October 2016 placed the pump suction 73 inches above the tanktop. The suction pipe extended 42 inches into the lube oil sump. The distance from the suction pipe bellmouth to the pump suction inlet was 115 inches. TOTE’s director of safety and services told investigators that if air entered the bellmouth of the suction pipe when the vessel rolled, suction would be lost unless the ship rolled back again and oil was replenished. He said the pumps would not pump if the suction side contained much air. He

NTSB

Marine Accident Report

41 further stated that if the mechanical seal failed, air entering the pump casing could cause the pump to completely lose its prime. He also stated that having a higher level of lube oil in the sump would have helped the system maintain pressure during the accident. He stated that the lube oil pumps could run for about 30 minutes without lubrication before being destroyed internally. According to logbook entries from runs in September 2015 before the accident, when El Faro’s main engine was operating at about 120 rpm, the normal operating suction pressure of the lube oil was about 8 psig, and the discharge pressure was about 58 psig. The pressure relief valve on the discharge side of the lube oil pumps was set at 85 psig. The discharge side of the pumps was equipped with a set of duplex magnetic strainers and an orifice installed to maintain 55 psi of pressure to the turbine governor system. Also part of the lube oil system were two coolers—heat exchangers that used seawater to remove heat, generated by the main engine, from the oil. Two Alfa-Laval purifiers were piped into the system to remove water and contaminants from the lubricating oil used in the propulsion turbine/reduction gear and the turbogenerators. The main engine lube oil sump had a maximum capacity of 2,870 gallons, with a high-level operating capacity of 2,020 gallons, a normal operating level of 1,426 gallons, and a low level of 724 gallons. The alteration section of the construction diagram for the lubricating system of the Ponce-class vessels shows that in 1972, before El Faro’s keel was laid, the original design specifications for the operating levels of the lube oil sump were changed. The operating capacity was increased from 900 gallons to 1,426 gallons, the low-level capacity was decreased from 750 gallons to 724 gallons, and the sump design capacity was decreased from 4,250 gallons to 2,870 gallons. According to engine logbooks for the year preceding the accident, the level of lube oil in the main engine sump was ordinarily maintained at between 23 and 28 inches, and at 25 or 26 inches in the months before the accident. The last recorded level of lube oil in the sump was 26 inches, from the engine log of September 1. No levels of more than 29 inches were found in any records during the period investigated. The former El Faro chief engineer, who last sailed aboard El Faro in 2012, testified that when he sailed on TOTE’s Ponce-class vessels before 2012, standard operating procedure required the level of oil in the sump to be kept at 28 to 32 inches. He said he would operate with the oil at the “upper level just for safety factor to make sure there was plenty of lube oil in the system.” He said that sometimes, depending on the weather and other conditions, the sump level was raised to 30 or 32 inches. An off-duty chief engineer with recent experience on El Faro told the first marine board that the lube oil in the main engine was normally maintained at about 27 inches in the sump. He said it would take about 30 minutes to raise the level in the sump by 1 inch using the purifiers, but that during heavy weather, the purifiers were shut down. With the purifiers shut down, he recalled that the sump could be filled quickly, being gravitated from the tank. He stated that he had never had any issues with the lube oil system during heavy weather, aside from slight variances in pressure due to rolling. The level of oil in a tank can be manually checked by sounding, that is, measuring the depth from the surface of the oil to the bottom of the tank with a tape or sounding tube. The volume of oil is calculated by comparing the measured depth with a “sounding table” whose values account

NTSB

Marine Accident Report

42 for the tank’s shape. The sounding table for the lube oil in the main engine sump of El Yunque indicated that a sounding of 26 inches corresponded to a quantity of 1,346 gallons in the sump. A sump level of 27 inches equated to 1,436 gallons (10 gallons more than the operating level of 1,426 gallons stated in the company’s operating manual). El Yunque’s sump was equipped with a manual sounding tube as well as a transmitter that displayed the sump level at the operating console. El Faro had two tanks for storing additional lube oil. A 4,465-gallon storage tank was located on the operating level aft of the main engine, with a 4,608-gallon settling tank next to it. Both tanks had 1-inch pipes connecting the bottoms of the tanks to a 2-inch common line for adding lube oil to the main engine sump. According to a report from the vessel’s cargo-loading software, CargoMax, when El Faro departed on the accident voyage, the lube oil storage tank contained 10 tons of reserve oil (2,850 gallons) and the settling tank was empty. TOTE provided investigators with a copy of the machine operating manual from El Yunque. The manual stated: “When necessary, add lube oil from the storage/settling tank to the sump via purifier to maintain the normal level at 27 inches. Record the amount added in the logbook.” The manual provided information about the levels and capacities of the main engine sump and alarms. The sump design capacity was listed as 2,870 gallons, high-level capacity was 2,020 gallons, operating level capacity was 1,426 gallons, and low-level capacity was 724 gallons. High- and low-level alarms were installed to warn the operator of either a high or a low oil level in the sump. The levels were also identified on the vessel’s original drawings. The low-level alarm was set at 18 inches (724 gallons), and the high-level alarm was set at 33 inches (2,020 gallons). A low-bearing-oil-pressure switch was installed in the oil feed line to the main engine bearings. The switch was electrically connected to a solenoid dump valve (a large emergency valve that allows oil to drain very fast) that was normally deenergized. The pressure switch was designed so that if it sensed a pressure drop at the most remote bearing to a level at which the bearings could be damaged, it would energize and release lube oil pressure from the ahead operating cylinder, thereby closing the ahead steam control valves. If the lubricating system pressure fell below 4 psig at the pressure switch, the throttles would close and stop the flow of steam to the turbines. The ahead and astern steam control valves could be operated manually if a failure occurred in the throttle control mechanism, including a loss of control oil pressure.73 Either a long-handled emergency bar or hydraulic hand pumps attached to cables in the overhead could be used to raise the lifting beams and admit steam to the turbines. According to the manufacturer’s manual, lube oil could be lost for several reasons: plugged strainer, pump failure, stuck pressure-reducing valve in oil header (distribution pipe), improper valve lineup, defective pressure sensor, low oil level, or broken oil line. If lube oil was lost, the appropriate action was to stop rotation of the shaft and try to restore oil pressure. The lube oil system also contained overspeed governor pumps, one in each forward bearing bracket of each turbine. If a condition developed that would cause the turbines to overspeed, the output of the governor pumps would increase and actuate an overspeed relay. The relay would

73 The control oil system provided metered or reduced system pressure to governors, valve actuators, trips, and shutdown devices on the main engine.

NTSB

Marine Accident Report

43 cause the steam control valves to move in the closing direction and decrease the speed of the turbines by limiting the amount of steam admitted. The overspeed system was designed to be self-restoring. After an overspeed condition was corrected and normal turbine speed had resumed, the lube oil output pressure would drop and the steam control valves would return to the open position. 1.3.7 Steering System El Faro’s electrohydraulic ram-type steering system, type FR-280, was built by Kawasaki Heavy Industries, Ltd., of Kobe, Japan. Two Kawasaki-Bruninghaus type BV-732 hydraulic pumps were powered by a pair of 60-hp, 1,150-rpm induction motors with an output of 45 kilowatts. One of the electric motors that powered the system was fed by the main 450-volt switchboard and one by the 450-volt emergency switchboard. The system was designed to have a maximum torque (twisting force) of 140 ton-meters and to turn 65° in 28 seconds. The steering system was located in the steering gear room and remotely controlled from the bridge by a C. Plath Navipilot V marine autopilot system or a C. Plath Navipilot AD II. According to the operating manuals, the control processes of both systems allowed the vessel to be steered manually (hand-steered) or in autopilot mode. In autopilot mode, the vessel received input from one of the vessel’s gyrocompasses and steered a gyrocompass heading. Settings to the autopilot could be selected at the master unit on the bridge. The settings allowed navigation personnel to change the response time or sensitivity of rudder movement. Both systems were equipped with visible and audible alarms to warn bridge personnel when the vessel was off course by an operator-defined amount. 1.3.8 Bilge and Fire Systems Bilge and Ballast. The bilge and ballast piping regulations at 40 CFR 56.50-50 require the bilge system for a dry cargo ship such as El Faro to pump from and drain any watertight compartment, except for ballast, with two independently powered bilge pumps.74 El Faro was equipped in that manner. The ship’s cargo bilge-pumping system was powered by the 450-volt main switchboard. Two vertical centrifugal bilge/ballast pumps, manufactured by Worthington, were on the lower level of the engine room. Each pump was driven by a 20-hp electric motor. The pumps were rated for 850 gpm at 30 psi. The lower level of the engine room also contained an emergency submersible bilge pump, manufactured by Prosser, that could dewater the machinery space. The pump was powered by the emergency generator and rated at 50 gpm at 30 feet of total dynamic head (discharge pressure). According to the ship’s preventive maintenance system, bilge alarms in the engine room and cargo spaces were required to be tested monthly. A bilge alarm panel was located in the engine room. Engine department crewmembers typically notified the bridge when they received a bilge alarm because there was no alarm panel on the bridge.

74 Dry cargo ships, which include bulk carriers and container ships, are distinct from ships that carry liquids such as oil or chemicals.

NTSB

Marine Accident Report

44 Water collected in bilge drainwells (roseboxes), recessed pockets in the aft corners (one port and one starboard) of the machinery spaces and of each cargo hold on the fourth deck. The bilge pipes for dewatering the holds took suction from the roseboxes, which each held about 10 gallons of water. A stainless-steel float was installed at the top of the roseboxes, below a screen at the tanktop level. There are no requirements for bilge alarm systems in cargo holds. TOTE had installed the alarms to alert shoreside personnel of excess water in the holds while the vessel was in layup. When the water in a rosebox rose high enough to raise the float for 5 seconds, a signal went to an alarm panel in the engine room and activated audible and visible alarms. An engineer who had sailed aboard El Faro estimated that about 50 gallons of water would activate the alarm in hold 3. The sound of the alarm could be turned off, but a red light would remain lit on the alarm panel until the float returned to its normal position. The bilge float was routinely tested by lifting it and verifying that the alarm sounded. No deficiencies had been reported with the bilge system. One of the past chief engineers on El Faro told investigators that cars and trailers generated “a lot of debris” that would need to be cleaned out of the roseboxes. Investigators observed debris on the screens over the roseboxes when they visited El Yunque. Fire Main. The fire main system consisted of a combination pump, called a bilge, fire, and general service pump, located on the starboard side of the lower engine room. The pump was a Worthington vertical, centrifugal model rated for 575 gpm at 125 psig. An emergency fire pump, rated for 635 gpm at 125 psig, was located on the starboard side of cargo hold 3, on the tanktop. The pump had its own sea suction (seawater inlet pipe) directly outboard of the pump. As seen in figure 13, the fire pump (shown in the photo) was protected by at least one vertical steel stanchion, and a platform (shown in the drawing) was located above the pump, with a vertical ladder installed nearby. While on board El Yunque, investigators photographed the emergency fire pump in hold 3 on the tanktop, in a similar location to that of El Faro’s emergency fire pump (figure 14). The pump aboard El Yunque had vertical pipes welded to the deck and framing as protection, but the suction pipe and valve had no surrounding protection. The arrangement of the piping for the emergency fire pump was not identical between El Faro and El Yunque.

NTSB

Marine Accident Report

45

Figure 13. Emergency fire pump. Photo shows emergency fire pump (center rear) in El Faro’s hold 3 (photo by Maine Maritime Academy cadet). Diagram, from general arrangement drawing, shows emergency fire pump location in hold 3, fourth deck (VL = vertical ladder).

Figure 14. Emergency fire pump and inlet piping in hold 3 of El Yunque.

NTSB

Marine Accident Report

46 1.3.9 Maintenance General. The El Faro crew used a computerized preventive maintenance, spare parts, and purchase-tracking system called AMOS (Asset Management Operational System). Investigators reviewed maintenance records and purchase orders for the 2 years before the accident, downloaded from the operating company’s file server, and conducted interviews. The off-duty chief and first and second assistant engineers reported no overdue or deferred maintenance at the time of the accident. The El Faro port engineer stated that he did not check work orders for their completion status and was unaware if there were any outstanding work orders. TOTE’s director of ship management–commercial said that he did not monitor the activity in AMOS on a daily, weekly, or monthly schedule but did so when an issue was communicated to him. The director further stated that completion of planned maintenance was verified through internal audits. The chief engineer and first assistant engineer were the only engine department officers with access to AMOS. They would manually enter maintenance histories and order spare parts. In 2014, El Faro’s deck and engine departments entered 308 records for various maintenance tasks. Routine maintenance, such as inspections, oil changes, lubrication, and manufacturer’s recommended maintenance, were recorded as part of the planned maintenance program. Equipment tests and surveys were also recorded. In 2015, 435 maintenance records had been entered into the system up to the time of the accident. Boilers. According to AMOS entries and an email from the chief engineer, the crew inspected and cleaned both boilers in July 2015. (The crew usually performed routine maintenance on the boilers on the northbound voyage, when the ship occasionally ran on only one boiler, compared with two on the southbound leg.) As a result, the chief engineer recommended that Walashek boiler repair company in Jacksonville survey the boilers to determine the scope of work for the November shipyard repairs. Walashek inspected the fireside (combustion chamber and related parts) of the starboard boiler on September 11, 2015, and recommended renewing the front wall tubes, brickwork, and burner throats on both boilers.75 The Walashek representative did not recommend a time frame for the repairs. Walashek did not inspect the port boiler, but it was assumed to be in the same condition as the starboard boiler. The last waterside (part of boiler containing water and steam) survey of the El Faro propulsion boilers was conducted by ABS in December 2013. The checklist stated that both boilers had been surveyed and that the vessel’s maintenance history had been reviewed. The documentation did not include pressures. Lubricating Oil. The lubricating oil in critical machinery systems was periodically sampled and sent to a Chevron LubeWatch laboratory for analysis. Investigators examined the last 2 years of results. All critical systems had consistently acceptable results, except for the oil in the stern tube and strut bearing systems, which received intermittent warnings.

75 Burner throats shape the burner flame, mix fuel and air, and direct stabilizing heat back to the flame.

NTSB

Marine Accident Report

47 1.3.10 Electronic Equipment Automatic Identification System. El Faro was equipped with an automatic identification system (AIS) model JHS-182, serial No. BB44685, manufactured by JRC (Japan Radio Company, Ltd.). AIS is a shipboard broadcast system, operating in the VHF maritime band, that sends and receives ship information such as identity, position, course, and speed. The primary purpose of AIS is collision avoidance, but its use has broadened to fishing fleet control, vessel traffic services, and maritime security. AIS transmissions can be received and retransmitted by other vessels and by land-based systems using VHF radio. Satellites can receive the transmissions but do not transmit them.76 The International Convention for the Safety of Life at Sea (SOLAS), as amended, requires all ships of 300 gross tons or more engaged on international voyages to be equipped with an AIS.77 The Coast Guard records national AIS data from a network of AIS base stations along coastlines in the continental United States, Alaska, Hawaii, and Guam, in addition to recording AIS data from a satellite network for waters beyond the range of the terrestrial network. The last national AIS position recorded for El Faro was for October 1 at 0356. Voyage Data Recorder. As required, El Faro was equipped with a simplified VDR (S-VDR) that was installed in January and February 2009.78 The device was a Northrop Grumman Sperry Marine Voyage Master II, manufactured by Danelec Marine (Birkeroed, Denmark). The VDR capsule was attached to a steel channel at the base of the antenna mast on the deck above the bridge (figure 15). Chapter V, regulation 20, of SOLAS 1974, as amended, specifies VDR carriage requirements for ships engaged on international voyages. Cargo ships larger than 3,000 gross tons constructed after June 2002, and all passenger ships regardless of tonnage or year of construction, must be equipped with a VDR. Cargo ships larger than 3,000 gross tons constructed before July 2002 must be equipped with a VDR or S-VDR. Either system requires storing a minimum of 12 hours of all required information including data, audio, and radar information. In the event of an incident or accident, investigation authorities must be able to download and replay the VDR data without delay. Software, instructions, and special parts necessary for data extraction and replay are required to be in the main unit of a VDR.79

76 Third-party businesses offer services to customers (at a subscription cost) to monitor AIS signals that are received by satellites but may be out of reach of land- or ship-based antennas. AIS was not anticipated to be detectable from space when it was developed in the 1990s. 77 SOLAS is an international treaty concerning the safety of merchant ships. The first version of SOLAS was adopted in 1914 after the Titanic sank. A new convention was adopted in 1974 and is sometimes referred to as SOLAS, 1974, as amended, because of its numerous updates and amendments. 78 Standards for S-VDRs are set out in International Maritime Organization (IMO) resolution MSC.163(78), May 2004. 79 IMO resolution MSC.214(81), annex 1 to resolution A.861(20), establishes performance standards for “download and playback equipment for investigation authorities.”

NTSB

Marine Accident Report

48

Figure 15. VDR capsule on deck above El Faro’s navigation bridge. (Radio Holland photo80) Data items required to be recorded on an S-VDR are date and time, ship’s position, speed (through water or over ground), heading (from ship’s compass), bridge audio, VHF audio communications, radar data, and AIS data, if radar data cannot be obtained. El Faro’s S-VDR also recorded wind angle and speed and rate of turn.81 The recording duration of El Faro’s S-VDR depended on the size of the data files and was a function of the quantity of information recorded. The VDR data were stored on a flash memory chip inside a protective capsule. On August 8, 2016, after the capsule was recovered from El Faro’s wreckage, it was submerged in a bath of distilled water aboard the Navy vessel Apache, then disassembled and inspected for possible damage to the internal recording medium. Inside the capsule, layers of protective materials housed an inner capsule containing the circuit board assembly that stored the nonvolatile memory (figure 16).82 The circuit board assembly was inspected for visible signs of damage or corrosion (figure 17) before being transported to the NTSB laboratory in Washington, DC, on August 12.

80 Radio Holland, now Imtech Marine, did a safety survey of El Faro’s EPIRB on January 27, 2015. 81 Other parameters (depth, main alarms, rudder order and response, engine and thruster order and response, hull openings status, watertight and fire door status) were not recorded. SOLAS requires them on S-VDRs only if an International Electrotechnical Commission (IEC) 61162 digital interface is available. 82 Nonvolatile memory is semiconductor memory that does not require external power for data retention.

NTSB

Marine Accident Report

49

Figure 16. Inner VDR capsule assembly after removal from outer capsule.

Figure 17. Circuit board assembly from inner VDR capsule.

NTSB

Marine Accident Report

50 On August 15, 2016, at the NTSB laboratory, the circuit board assembly from the inner VDR capsule was connected to a functioning surrogate assembly, provided by Danelec. The manufacturer provided technical support and witnessed downloading of the VDR data. A forensic write-blocking bridge was used to copy data from the circuit board assembly.83 Using manufacturer-provided VDR playback software, the data were exported to a common data file structure for further analysis.84 Audio data from the VDR capsule were saved as multiple WAV audio files for each audio channel. The radar video image was recorded once every 15 seconds. Other parameters were recorded as industry-standard text files.85 Specialized software was used to parse the data files and output the desired data in tabular format. Audio data were recorded by six microphones on the ship’s bridge. Four microphones were installed inside the bridge (center, starboard, port, and chart table) and one on each bridge wing (port and starboard). A separate channel wired to record VHF communications was inactive. Instead, VHF communications were captured by the bridge microphones from an open speaker system. The six microphones in the VDR system were wired into three audio channels, with two microphones on each channel mixed into a single monaural track. Investigators characterized the quality of the audio recording on two channels as “poor” and on the third as “unusable.”86 The unusable data were from the microphones on the bridge wings. Regulation 18.8 of SOLAS chapter V states: “The voyage data recorder system, including all sensors, shall be subjected to an annual performance test.” The last annual performance test for El Faro’s VDR was on December 2, 2014. The performance test noted that the battery for the acoustic locater beacon had an expiration date of May 2015 (before the next annual performance test) and should have been replaced. A certificate of compliance was issued without the battery being replaced. No signals from the beacon were detected during the first underwater search. Attempts to locate the VDR switched to sonar after 3 days. Container-Tracking System. Tracking equipment, consisting of wireless transmitters, was installed on most of the refrigerated containers El Faro carried on its final voyage. The tracking equipment was operated by WAM Technologies, Inc., which uses GSM (global system

83 A forensic write-blocker allows read-only access to a drive, minimizing the risk of accidentally overwriting the data. 84 IMO resolution MSC.214(81) requires VDR manufacturers to provide a way to export VDR data to open industry standard formats. 85 Parametric data were saved in a format compatible with IEC standard 61162-1. 86 The NTSB’s report on the VDR audio data defines “poor” quality as follows: “Extraordinary means had to be used to make some of the crew conversations intelligible. The transcript that was developed may indicate fragmented phrases and conversations and may indicate extensive passages where conversations were missing or unintelligible. This type of recording is usually caused by a combination of a high bridge noise level with a low voice signal (poor signal-to-noise ratio) or by a mechanical or electrical failure of the VDR system that severely distorts or obscures the audio information.” The VDR report defines “unusable” quality as follows: “Crew conversations may be discerned, but neither ordinary nor extraordinary means made it possible to develop a meaningful transcript of the conversations. This type of recording is usually caused by an almost total mechanical or electrical failure of the VDR system or extremely high bridge noise.”

NTSB

Marine Accident Report

51 for mobile communications) and GPS technology to remotely monitor, control, and track refrigerated containers anywhere in the world.87 WAM can monitor the location of refrigerated containers and remotely control the temperature inside the containers to keep chilled or frozen goods from spoiling. The last WAM data for El Faro were transmitted at 0228 on October 1. Satellite Communication System. Inmarsat Globe Wireless supplied El Faro with satellite email and voice communications transmitted through the Globe i250 FleetBroadband system. The Globe i250 installation had both an above-deck and a below-deck unit. The above-deck unit included the antenna, which was installed on the outside of the ship, where there was a clear exposure to the sky. The below-deck unit contained a rack-mounted electronic controller and an uninterruptible power supply.88 The below-deck unit was installed on the bridge and included a handset for phone calls. Other handsets were installed in the captain’s and chief engineer’s staterooms. Email transmissions to or from the vessel were controlled by software installed on a computer in the captain’s stateroom, which was connected to the Globe i250 system. Global Maritime Distress and Safety System. Chapter IV of SOLAS 1974, as amended, and 47 CFR Part 80, subpart W, require GMDSS equipment to be carried by cargo ships of 300 gross tons or more when on international voyages or traveling in the open sea. GMDSS is a worldwide network of automated emergency communications for ships at sea that was established by the IMO, a specialized agency of the United Nations. The system uses satellite and terrestrial radio services to rapidly transmit alerts from vessels in distress and support global search and rescue. The Federal Communications Commission (FCC) adopted the GMDSS regulations for US compulsory vessels on January 16, 1992. The international regulations became mandatory for vessels subject to SOLAS on February 1, 1999. GMDSS has changed distress communication from a ship-to-ship system relying on Morse code and radiotelephones to an automated ship-to-shore system using satellites and digital calling technology. Before GMDSS, ships carried communication equipment based on tonnage. GMDSS requires ships to carry communications equipment based on where they operate. El Faro’s COI stated that the vessel was approved for “oceans” as its permitted route. Four sea areas define where GMDSS services are available and the radio equipment GMDSS ships must carry. Sea area A3 (approximately between latitudes 70N and 70S) is the “oceans” waters of the GMDSS. According to FCC regulations at 47 CFR 80.1081, 80.1091, and 80.1095, El Faro was required to carry the following GMDSS equipment: • VHF radios capable of operating by voice and transmitting on digital selective calling (DSC). • Two search-and-rescue (radar) transponders (SARTs). • Three GMDSS VHF-FM handheld radios.

87 WAM stands for wireless asset management. 88 An uninterruptible power supply protects electrical equipment from unexpected power disruptions. Energy is stored in batteries or supercapacitors so that equipment can run a short time if the normal power supply is interrupted.

NTSB

Marine Accident Report

52 • Maritime safety information receiver capable of receiving NAVTEX urgent marine safety information (navigational and meteorological warnings and forecasts, search-and-rescue notices). • Category 1 406-megahertz (MHz) EPIRB. • Medium frequency radio installation with 2187.5-kilohertz (kHz) DSC capability. • Inmarsat ship earth station. On January 27, 2015, Imtech Marine performed an annual survey and testing of the GMDSS equipment on El Faro. A cargo ship safety radio certificate was issued the same day. The certificate affirms that El Faro carried the required GMDSS equipment, in accordance with SOLAS, and that it was in working order. EPIRB. The ship was equipped with a Tron 40S MkII EPIRB, without GPS encoding, manufactured by Jotron and installed on February 16, 2007. The automatically activated, category I device was designed to float free from a bracket equipped with a hydrostatic release.89 It transmitted on a frequency of 406 MHz by means of a 5-watt omnidirectional antenna and had a minimum operating life of 48 hours, powered by a battery due to expire on February 1, 2019. The EPIRB was registered with the FCC on February 1, 2012; the registration was last updated on December 2, 2013. Inmarsat Ship Earth Station. The ship carried a FELCOM 15 mobile earth station manufactured by Furuno Electric Company, Ltd. The mobile earth station was equipped with an optional internal GPS module, according to the installation invoice. The SSAS was connected to, and incorporated into, the FELCOM 15 installation. SSAS units are not part of the GMDSS but are required (for vessels of 500 gross tons or more constructed before July 1, 2004) by SOLAS resolution XI-2/6 and incorporated by reference in Coast Guard regulations at 33 CFR Part 101 (subchapter H, “Maritime Security”). El Faro’s SSAS was tested quarterly, in March, June, and September 2015. 1.3.11 Navigation Equipment Required navigation equipment for El Faro was listed on the ABS Record of Approved Cargo Ship Safety Certificate. According to the certificate, El Faro carried the following navigation equipment: • Two radars (3-centimeter Raytheon radar and 10-centimeter Furuno radar). • Automatic radar plotting aid. • Two gyrocompasses. • Magnetic compass. • Rudder-angle indicator. • Rate-of-turn indicator. • Rpm indicator.

89(a) Category I is the highest category of EPIRB. The EPIRB automatically activates and is detectable by satellite anywhere in the world. Category II EPIRBs are similar but must be manually activated. (b) A hydrostatic release automatically activates as a result of water pressure when submerged up to 4 meters (13 feet).

NTSB

Marine Accident Report

53 • Autopilot for steering system. • Echo (depth) sounder. According to a former second mate, the vessel had two GPS receivers aboard, used for navigation and entering waypoints. The receivers could obtain differential GPS signals, which improve location accuracy. El Faro used paper charts for navigation to meet SOLAS carriage requirements. 1.3.12 Wind Sensors and Barometers According to Imtec Marine records, El Faro carried two R. M. Young model 05106 (marine model) wind monitors and two Young model 06206 Wind Tracker display units, both installed before 2009. No records for maintenance or replacement of the wind observation equipment were found. The wind monitors, with individual sensors for both wind speed and direction, were attached to separate steel poles installed on the deck above the bridge about 100 feet above the waterline. The display units were mounted on a bulkhead inside the bridge, beside and above the port side of the chart table (refer to figure 4, section 1.2). According to records, the sensors transmitted wind speed and direction data to the VDR when it was tested in 2014.90 The vessel’s anemometer displayed wind data on the bridge. Wind speed and direction were recorded by the VDR.91 Figure 18 shows raw wind speed data captured by the VDR from 2000 on September 30 until the sinking. Throughout the VDR recording, however, over 99 percent of the anemometer data samples indicated a relative wind direction of between 180° and 193°. On the VDR recording, El Faro’s captain, chief mate, and second mate questioned the reliability of the wind speed and stated that the wind direction was “not good” and that “we don’t have (any) anemometer.” According to National Weather Service records, El Faro carried a Belfort aneroid barometer and a DBX1 digital barometer/barograph. The aneroid barometer was installed on April 8, 2011, and was last adjusted on March 24, 2015, to reflect mean sea level pressure. The National Weather Service estimated that it would have been calibrated when it was installed. The digital barometer/barograph was installed and adjusted on October 7, 2014, and, according to internal records, was calibrated on January 1, 2014. The instrument could display up to 5 days of information (tendency, high/low pressure, and 6- and 12-hour pressure change), but the information could not be printed or otherwise recorded.

90 Sperry Marine annual performance test, December 2, 2014. 91 El Faro was not required to carry an anemometer under SOLAS 74. However, the company’s operations manual required vessel personnel to follow the safety guidelines of the ICS [International Chamber of Shipping] Guide to Helicopter/Ship Operations. Section 3.7.1 to the guide states that “vessels should be fitted with equipment that can measure and record all wind conditions.”

NTSB

Marine Accident Report

54

Figure 18. Raw VDR wind speed data, from 2000 September 30 to data loss. 1.3.13 Internal Communication El Faro had four primary means of internal communication that could carry two-way conversations: dial (electric) telephone, sound-powered telephone, public address or talk-back system, and portable walkie-talkies.92 None of these devices were connected to the VDR. Electric telephones, also called house phones, were located at fixed locations on the ship, including the bridge and the engine room. The sound-powered telephone was the only system that worked without an external power source or battery. Walkie-talkies were the primary means of communicating with personnel while they moved about the ship. The main control for the vessel’s talk-back system was on the bridge. Satellite or remote units were located at the bridge wings, engine room, lifeboat stations, forward and aft mooring stations, crew dining room, crew lounge, officers’ lounge, and officers’ dining room. The system was similar to an intercom and could be operated hands-free. As required by SOLAS, the vessel also had a class-approved general alarm system, whistle, and watch call system, used to wake bridge watchstanders. The systems could be used to send one-way signals to the crew during emergencies. Several computers on the ship had access to the ship’s email system. Crewmembers could use the computers to send emails both internally and externally.

92 A sound-powered telephone is a shipboard telephone system in which the power comes from the sound pressure of the speaker’s voice and requires no external power source.

NTSB

Marine Accident Report

55 1.4 Cargo Information El Faro’s container capacity was 1,414 twenty-foot-equivalent units (TEUs).93 Its maximum capacity for automobiles was 733 and for Ro/Ro trailers, 216. As required by SOLAS 1974, as amended, and the Code of Safe Practice for Cargo Stowage and Securing (CSS code), the cargo on El Faro was loaded, stowed, and secured in accordance with an approved cargo-securing manual.94 The international requirements for cargo-securing manuals are incorporated in Coast Guard regulations at 33 CFR 97.120. El Faro’s manual was developed by Herbert Engineering Corporation and approved by ABS on January 20, 2006. 1.4.1 Loading Portus Stevedoring was contracted to plan the stowage, loading and unloading, and securing of El Faro’s cargo. Portus developed a prestow plan showing where projected cargo would be placed and discussed the plan with TOTE managers, making adjustments as necessary. When the vessel arrived alongside and cargo work began, incoming container (load-on/load-off) and Ro/Ro cargo was driven onto a certified scale and weighed. A computerized cargo-loading and stowage program called Spinnaker accounted for which part of the weighed load would remain stowed on the ship. For containers, that was only the container and cargo weight, while for Ro/Ro cargo trailers, that would also include the weight of the chassis. Spinnaker detailed individual locations and weights for each container, while a Portus superintendent or planner would develop a handwritten stow plan for Ro/Ro cargo items, broken into “trailers,” “autos,” and “other.” The final combined Spinnaker and Ro/Ro stow plans constituted the actual or final stow plan. As loading of the cargo areas progressed, Portus gave stow plans to the TOTE marine operations manager, or in his absence, the terminal manager (as for the accident voyage). They reviewed the plan for discrepancies (including hazardous segregation, stack weights, lashing margins, the availability of power plugs for the reefers, or mismatched bays and container sizes) and would enter the cargo weights and positions into the CargoMax computer program throughout the loading process. CargoMax is a software application developed by Herbert–ABS Software Solutions, LLC. According to the developer, the program “quickly and precisely calculates ship stability and stress characteristics based on any loading condition specified by the user.”

93 The TEU is a standard unit for describing a containership’s cargo-carrying capacity or a shipping terminal’s cargo-handling capacity. A standard 40-foot (40 x 8 x 8 feet) container equals two TEUs (each 20 x 8 x 8 feet). 94 SOLAS 1974, chapter VI, part A, regulation 5.6, and CSS code, section 1.6. The original code was adopted by the IMO in 1991. IMO’s Maritime Safety Committee issued subsequent guidelines (termed circulars) that amended the CSS code. The 2003 edition of the CSS code incorporated earlier circulars and was in effect when El Faro’s cargo-securing manual was submitted for review in 2005. The stated purpose of the CSS code was to “provide an international standard to promote the safe stowage and securing of cargoes by: drawing the attention of shipowners and ship operators to the need to ensure that the ship is suitable for its intended purpose; providing advice to ensure that the ship is equipped with proper cargo securing means; providing general advice concerning the proper stowage and securing of cargoes to minimize the risks to the ship and personnel; providing specific advice on those cargoes which are known to create difficulties and hazards with regard to their stowage and securing; advising on actions which may be taken in heavy sea conditions; and advising on actions which may be taken to remedy the effects of cargo shifting.”

NTSB

Marine Accident Report

56 CargoMax stability and load management software would calculate the vessel’s list, trim, drafts, and stability.95 The container buildout section of the CargoMax software also determined whether container lashing arrangements and stack weights complied with the cargo-securing manual.96 The program was not designed to calculate the sufficiency of lashing arrangements for any of the Ro/Ro cargo. To determine the density of the seawater, the vessel crew would measure the specific gravity of the water at the dock with a hydrometer and report the value to the bridge.97 They would also read and record the vessel drafts.98 CargoMax stability calculations would be checked by the chief mate about an hour before sailing when he met with the operations manager, who delivered to him a thumb drive containing the completed CargoMax file on the vessel’s departure loading condition. The review would incorporate the measured specific gravity of the water to calculate the vessel’s draft. The chief mate would compare the CargoMax trim and stability summary with the recorded drafts. Final loading and deadweight (amount of mass carried, including cargo, fuel, ballast, crew, provisions, and water) would then be determined. Portus longshoremen would work with the vessel’s deck officers (mainly the chief mate) to ensure that there were no stowage or securing problems. Cargo containers were stacked in tiers in 20 bays on the main deck, numbered forward to aft. The vessel carried containers in 20-, 40-, 45-, 48-, and 53-foot lengths, as shown in figure 19. No tier was stacked more than three containers high on southbound trips to San Juan.

95 Under SOLAS, the International Code on Intact Stability, ABS, and Coast Guard regulations, CargoMax software and the computer in which it resided were considered a shipboard “stability instrument” or an “onboard electronic stability computer.” According to the intact stability code, a stability instrument should have flag approval. The CargoMax software was approved by ABS, for stability portions of the program, on behalf of the Coast Guard. The software version being used on El Faro during the accident voyage had not been submitted to ABS for review after minor updates to interface features that did not affect stability calculations. Computations in CargoMax were predicated on calculations used in the vessel’s class-approved trim and stability booklet (see section 1.12.4) The CargoMax program used ashore did not require approval by a classification society. 96 The container buildout section of CargoMax was not required to have class approval. 97 The density of the water affects the volume of water a ship displaces (displacement). Because seawater is denser than freshwater, a ship rides higher in seawater. 98 “Reading the drafts” entailed looking at the side of the vessel and observing the water level as measured by markings on the hull.

NTSB

Marine Accident Report

57

Figure 19. Cargo stowage arrangement and capacity plan. (Illustration from El Faro cargo-securing manual) 1.4.2 Types Containers were considered standardized cargo. Forty-foot Ro/Ro trailers (whether commercial, over-the-road trailers equipped with wheels or containers secured to wheeled, 40-foot frames called flatracks) and automobiles were considered semistandardized cargo. All other cargo units were considered nonstandarized. The containers and trailers carried goods commonly found in stores, homes, and factories. Some containers and trailers were refrigerated and generally carried food that needed to be chilled or frozen. Most of the refrigerated containers and trailers were monitored by the WAM system, which sent operational information about the containers and trailers to the shippers on shore (by means of cell phone towers and signals). El Faro’s cargo manifest listed all the cargo in the containers and trailers and all other cargoes stowed aboard the vessel such as (but not limited to) automobiles, backhoes, and boats on trailers.99 Besides containers and Ro/Ro cargo, El Faro also carried liquid fructose, kept in six fixed, railroad-car-size storage tanks in the two forward lower holds. Any cargo considered

99 The cargo manifest is a document that lists information about a ship’s cargo such as bills of lading, quantities, package units, consignees, consignors, shippers, and weights.

NTSB

Marine Accident Report

58 dangerous (as defined by US regulations) was listed on the vessel’s dangerous cargo manifest.100 In his departure report, the captain detailed the cargo as follows: 238 electric reefers, 118 trailers, 149 autos, 15 not-in-container cargo, 391 containers, and 4 fructose tanks. He listed the total tonnage as 11,045.9 long tons. The captain also recorded 345 long tons of (potable) water aboard. 1.4.3 Securing El Faro had two cargo-securing systems, one for containerized cargo and one for Ro/Ro cargo. Each system had cargo-securing devices that were either fixed or portable. The fixed securing devices were permanently welded to the decks or bulkheads. The portable devices could be shifted from one cargo unit to another and were used for lashing, securing, or supporting the cargo units. Fixed deck sockets were used to secure the bottom tier of containers to the ship. Portable securing devices (twistlocks) attached the bottom tier to the deck sockets at each corner of a container. The container on the second tier was secured to the top of the bottom container using another set of twistlocks attached to the four corners of the container on the second tier. The third container tier was then secured to the top of the second container tier with another set of four twistlocks installed at the corners of the two containers. Each stack could be further secured using lashing rods and turnbuckles attached to pad eyes, which were welded to the deck or to securing beams on the deck. Semistandardized Ro/Ro cargo such as 40-foot trailers and autos was secured to the vessel using two types of securing arrangements. The first was a portable securing device called a Roloc box. The kingpin at the front end of a trailer fit into a locking receiver on top of the Roloc box (figure 20). According to the cargo-securing manual, the Roloc box would then be attached to a fixed securing device on the deck of the ship called a Roloc deck socket or button. The second method of securing a trailer to the deck of the ship was by using portable securing devices (chains and tensioners) leading from a securing point on the trailer to fixed securing devices on the deck. The chain and tensioner unit was called a lashing, and the combined lashing and fixed securing device was called a lashing arrangement. Fixed securing devices on the deck of the ship were either D-rings or cloverleafs cut through the deck.

100 Regulations for the carriage of bulk materials that require special handling are found at 46 CFR Part 148 and 49 CFR subtitle B, chapter I, subchapter C, Part 172, subpart B (which includes a table of hazardous materials).

NTSB

Marine Accident Report

59

Figure 20. Roloc box diagram showing kingpin of trailer fitted into receiver of Roloc and kingpin of Roloc fitted into receiver of tractor. (Illustration from El Faro cargo-securing manual) Automobiles, considered semistandardized cargo, were to be lashed using portable securing devices consisting of fiber rope or nylon strapping attached to steel tensioners that were fitted with hooks at both ends. Four lashings were to be run, one from each corner of a vehicle, to the fixed D-rings or cloverleafs on the deck (figure 21). A variation of that securing arrangement, not included in the cargo-securing manual, was to run lashings from the four corners of the automobile to a long chain. The long chain ran across the width of the ship and was secured to D-rings at either end. Some of the chains passed through a D-ring before being secured to additional D-rings at each end. A lashing variation observed on El Yunque in October 2015 is shown in figure 22. One of the longshoremen who had lashed the automobiles on El Faro before the accident voyage testified when shown a photo of the lashings on El Yunque that they had used that arrangement on El Faro.

Figure 21. Automobile-lashing arrangement specified for El Faro. (Illustration from El Faro cargo-securing manual)

NTSB

Marine Accident Report

60

Figure 22. Two automobiles lashed to one length of chain. (Photo from hold 5 of El Yunque) TOTE personnel testified during the first marine board hearing that longshoremen placed extra lashings they referred to as “hurricane” lashings or “bad weather” lashings on El Faro’s Ro/Ro cargo during the port call before the accident. The vessel supervisor for that voyage stated that this hurricane-lashing profile was used year-round for Ponce-class vessels beginning in 2006. The profile called for (1) Ro/Ro trailers with Roloc boxes not secured on a button to receive six chain lashings instead of the two chains used for an “on-button” stow; (2) the two rows of Ro/Ro cargo along the perimeter, if on Roloc boxes and the boxes on-button, to be lashed with four lashings instead of two; and (3) all Ro/Ro trailers on Roloc boxes, forward of hold B and aft of hold D and regardless of deck, to receive four chains instead of two. Four past captains on the Ponce-class vessels stated that they were unaware of or did not recall whether the vessels were lashed according to a storm or hurricane profile year-round. They said that if ship personnel requested it, longshoremen would add more lashings. The VDR recorded the chief mate saying to the captain that lashings were not done correctly on the Roloc boxes and that “they don’t do it [the lashing] the way it oughta be done.” The third mate on El Faro stated, and the AB on the 0800–1200 watch agreed, that they “didn’t ask the longshoremen for storm lashes, which we should have.” Shoreside personnel who normally interfaced with the deck officers on the accident voyage stated that no cargo stowage or lashing concerns were brought to their attention by the crew. The crew (ratings) in the deck department did not ordinarily check to see if cargo lashings were secure at sea. According to a previous El Faro boatswain, the second mate would check the lashings and if “we rocked a little more than normal” and lashings were loose, he and the crew would help the mate tighten them.

NTSB

Marine Accident Report

61 Appendixes to the vessel’s cargo-securing manual listed the quantities of securing devices carried aboard. The manual required the securing devices to be inventoried every 2 months. The last El Faro lashing gear inventory provided to investigators was for April 24, 2015. 1.4.4 National Cargo Bureau Review Investigators noted no VDR conversations alluding to a significant failure of container or Ro/Ro securing arrangements, with the exception of the automobiles in hold 3. After the accident, the NTSB asked the National Cargo Bureau (NCB) to review the sufficiency of El Faro’s cargo-securing manual and the sufficiency of cargo securement against the IMO’s CSS code for certain cargo carried on the accident voyage. According to the NCB, parts of the manual generally complied with the CSS code. The NCB went on to say that other sections contained errors and omissions or were lacking information but that those issues should not have contributed to the accident. The cargo in question included all containers on the main deck, all high or heavy Ro/Ro cargo, all cargo on the second deck, all cargo stowed athwartship, and all automobiles stowed in the lower hold 3 (cargo area 4D). The NCB issued a report, TOTE responded, and the NCB replied with a supplemental report.101 The NCB was also asked to compute the failure point for the lashings of the suspect cargo but stated that it could not. The NCB stated in its first report, regarding the Ro/Ro cargo on the second deck, “In the event of any lashing failure in the presence of continued significant vessel movement, primarily rolling, progressive lashing failure with potentially catastrophic shift of cargo could be expected.” Appendix 3 of the report showed that at a vessel speed through the water of 24 knots and 60° lashing angles, off-button trailers stowed in the “worst positions” of holds 2A, 2B, and 2C, “will not be effectively secured in this hold.” The NCB’s supplemental report listed the maximum off-button trailer weights in hold 2A that would meet requirements at a vessel speed through the water of between 19 and 24.5 knots and at lashing angles of 45° and 60° and the angles prescribed in El Faro’s heavy-weather lashing requirements (58°, 52°, and 46°). VDR data for El Faro’s last 24 hours show a maximum speed over ground of 20.7 knots. TOTE stated that the vessel’s service speed was typically 19.5 knots. Investigators noted that in appendix 4 of the first NCB report, the coefficient of friction had a large effect on the results of the engineering calculations for the weights of off-button trailers.102 Appendix 3 of the report identified off-button trailers that were “not OK” with regard to transverse sliding moments and forces. The NCB’s supplemental report noted that for an off-button Roloc box, the coefficient of friction between two dry steel surfaces was 0.1. A wet deck would lower the steel-to-steel friction coefficient to 0.0. The friction coefficient for rubber to steel was 0.3.

101 The NCB reports and TOTE’s response are found in the accident docket. 102 The coefficient of friction is the ratio between the force necessary to move one surface horizontally over another and the pressure between the two surfaces. Loss or reduction of friction generally occurs when decks are wet. Investigators noted that the VDR recorded conversations consistent with the second deck taking on water shortly after 0200 on October 1 and that water was in hold 3 around 0543.

NTSB

Marine Accident Report

62 To increase the friction component of system lashing strength, the current version of the CSS code notes in annex 4, section 2.4, “Wheel-based cargoes, which are not provided with rubber wheels or tracks with friction-increasing lower surface, should always be stowed on wooden dunnage or other friction-increasing material such as soft boards, rubber mats, etc.” Investigators asked the NCB to calculate the off-button maximum trailer weights (for avoiding cargo shift) for a hypothetical arrangement in which a rubber mat or other friction-increasing material was placed between a Roloc box and the steel deck, keeping other parameters and lashing angles the same. The NCB determined the maximum allowable trailer weight for hold 2A at a vessel speed of 19.5 knots. The calculations showed a much higher allowable maximum trailer weight using the higher friction coefficient for steel to rubber, compared with the results for dry steel to steel and wet steel to steel. The results varied by lashing angle, but the maximum weights were always higher assuming that friction-increasing material was placed between a Roloc box and the steel deck. For a lashing angle of 45°, the maximum off-button trailer weight with a rubber mat placed between the Roloc box and the steel deck was 122,295 pounds, compared with a maximum of 74,031 pounds for a Roloc box placed directly on a dry deck and 60,836 pounds for one placed directly on a wet deck. 1.4.5 Modeling Later, using finite element modeling, the NTSB examined El Faro’s cargo-securing arrangements (and possible failure points) on the accident voyage.103 The study used as inputs accelerations corresponding to times along the vessel’s route derived from simulated ship motions obtained through a dynamic study carried out by the company CSRA Inc. under NTSB contract (see section 1.12.11). The ship motions at 0345 on October 1, with the vessel moving about a fixed 9° heel, were chosen because they showed the highest peak accelerations before the vessel lost propulsion. Ro/Ro and container cargo that the NCB stated could have exceeded weight limitations of the securing arrangement were studied using finite element models. A Nissan Rogue automobile model was used to evaluate automobile securement because of its relatively high weight and because the ship’s stowage plan showed that a row of five such vehicles was aboard El Faro. The NTSB used a conservative approach in modeling securing arrangements for the Ro/Ro and container cargo. Optimum securing angles were used for the lashings, and minimum breaking strengths of the securing devices were assumed to be as listed in the cargo-securing manual.104 A conservative approach to the securement of automobiles was also used, assessing a two-car unit rather than the five-car unit investigators observed on El Yunque. Under the conditions assumed for the calculations, the finite element modeling study found the following:

103 Finite element modeling is a method of solving engineering problems by dividing a complex structure into an assembly of simplified structural elements. The behavior of the complex structure is then solved by combining in a computer the actions of all the interconnected simpler elements. 104 Investigators noted that TOTE did not record the results of inspections of fixed securing devices or which ones were inspected. There was no regulatory requirement to test any of the fixed securing devices, and there were no records of what fixed securing devices were actually replaced from new-build or when the vessel was lengthened. Investigators also noted that the buttons were tested for wear before 2014, but that practice was discontinued.

NTSB

Marine Accident Report

63 (1) No containerized cargo would have broken free if twistlocks had operated properly. (2) Ro/Ro trailers on the second deck would have broken free if they were stowed off-button, lashed with six chains, and tire friction was lost. (3) Automobile lashings in hold 3 would have failed if the coefficient of friction between the automobile tires and the steel deck was between 0.1 and 0.2 (or less than accepted marine values for a tire on a dry steel deck of 0.3).105 Because of the conservative approach used, the lashings were probably at risk for failing even at higher coefficients of friction between the tires and the deck. The study also found that lashing individual automobiles to fixed securing devices on the deck, such as D-rings, rather than lashing several cars to chains laid athwartships as on the accident voyage, would have substantially lowered their risk of failing. 1.5 Safety Management System Chapter IX of SOLAS incorporates the International Safety Management Code (ISM code), which went into force in July 1998. Under Coast Guard regulations at 33 CFR 96.210, US vessels on international voyages, including cargo ships, are required to operate under a safety management system (SMS). El Faro was required to meet the requirements because it was enrolled in the Coast Guard’s ACP. An SMS defines the roles and responsibilities of all personnel, outlines safe practices in ship operation and navigation, and establishes safeguards against certain identified risks. The captain of El Faro was responsible for implementing the SMS on board, for motivating the crew in the observation of that policy, and for verifying that applicable procedures and requirements were adhered to. In accordance with the ISM code, the captain was also responsible for periodically reviewing the SMS for areas of improvement and for reporting deficiencies to shore-based management. A copy of the SMS documents was to be provided in a working language or a language understood by ship’s personnel. The primary documents comprising TOTE’s SMS, called the safety, quality, and environmental management system, were the operations manual–vessel (OMV) and the emergency preparedness manual–vessel (EPMV). Both documents were kept in electronic form on El Faro. Investigators reviewed TOTE’s SMS and found no risk assessments for voyage planning or heavy-weather operations. According to section 1.2.2.2 of the ISM code, a safety management objective of a company should be to assess all identified risks to its ships, personnel, and the environment and establish appropriate safeguards. The OMV defined the duties of the ship’s personnel (see section 1.8, “Personnel Information”) and also laid out shipboard policies and procedures. Internal SMS audits were required at least every 12 months, to be completed by the DP. Aboard El Faro, external audits

105 The model considered friction coefficient values ranging from 0.0 to 0.3. The 0.3 value is specified in annex 13 of the CSS code as the friction between steel and rubber (deck and tires) and is used in the code’s assessment of lashings against the criteria. The CSS code specifies 0.1 for steel-to-steel on a dry surface and a lower value of 0.0 for steel-to-steel on a wet surface. However, the code does not have a value for steel-to-rubber with a wet surface. The NTSB could not find the value specified for tires on wet steel and estimated the value as between 0.0 and 0.1.

NTSB

Marine Accident Report

64 were conducted by ABS. The captain of El Faro was required to report to management biannually regarding SMS/ISM compliance. He submitted his latest review on June 30, 2015. The DP stated that it usually took 5 to 6 hours to complete an internal audit. He completed the most recent El Faro audit on March 3, 2015. He stated that the SMS appeared to be well implemented on the ship and that records and logbooks, as well as required manuals, met company inspection criteria. No requests for corrective action or nonconformities were reported. The company’s SMS required regular monthly safety/security meetings to be held on the ship and meeting minutes to be submitted monthly by the captain. His latest submission was dated September 24, 2015. 1.6 Injuries All 33 persons on board El Faro perished in the sinking (table 1). The body of one crewmember, inside a protective immersion suit, was discovered during the search-and-rescue operation after the accident but was not recovered. See section 1.11.1, “Emergency Response,” for details. Table 1. Injuries sustained in El Faro accident. Type of Injury Crew Supernumeraries Total Fatal 27 6 33 Serious 0 0 0 Minor 0 0 0 None 0 0 0 Total 27 6 33 1.7 Wreckage The wreckage of El Faro lies at a depth of between 15,318 and 15,482 feet (4,719 to 4,669 meters) in the Atlantic Ocean, about 20 nm northeast of Samana Cay. The primary underwater debris field, which includes the main hull and ship structure, covers an area of about 0.7 square mile (1.8 square kilometers) between latitudes 23.3786N and 23.3936N and longitudes 73.9061W and 73.9172W. Cargo containers, other cargo items, and some ship’s equipment and rails were found outside the primary debris field. Inside the primary field were the remains of El Faro’s port lifeboat; some of its cargo (about 40 containers and 7 vehicles); the main hull and the structures that separated from it, including the mast (with attached VDR), the exhaust stack, the bridge and the deck below it; and a few unidentified items. Figure 23 is a bathymetric (topographic) map of the seafloor showing the location of the main objects discovered.

NTSB

Marine Accident Report

65

Figure 23. Map of El Faro debris field showing large objects. Bathymetry from multibeam-sonar site survey, April 2016. The wreckage was investigated solely from photographs and video gathered during the three missions that searched for El Faro and recovered its VDR. The makeup of the seafloor where the wreckage lay appeared to be generally level and to consist of soft sand and mud. The ship’s hull, bridge, exhaust stack, mast, and lifeboat were examined. Photos of the vessel’s draft marks

NTSB

Marine Accident Report

66 taken during the third mission showed that the hull was embedded about 14.5 feet (port) to 12.5 feet (starboard) into the seafloor at the bow and between 24 feet (port) and 22.5 feet (starboard) at midships. Both the port and starboard aft draft marks were below the mudline and not visible. The mudline was roughly 3 feet below the second deck on the starboard stern quarter, equivalent to about 47 feet in the mud from the vessel’s keel (baseline). Video taken by the CURV-21 ROV during the first underwater search (October 19 to November 24, 2015) documented that the top two decks of the deckhouse, the navigation bridge and the deck below it, had separated from the hull and were lying more than half a mile (3,166 feet) north of it. The top of the engine room casing was open to the sea, all but two containers had fallen off the main deck, and the ship’s mast and VDR were missing. Data from the second mission (April 18 to May 5, 2016), launched to locate the VDR, were used to map and categorize debris in the wreckage field. Individual photos of some parts of the wreckage, taken by an underwater vehicle, were combined into photomosaics to create complete pictures. Images taken by CURV-21 during the third mission (August 5 to 12, 2016) documented structural damage to the hull and damaged or missing components. During the second mission, El Faro’s port lifeboat was discovered north of the bridge, at a depth of 15,364 feet (figure 24). The lifeboat was 754 feet (0.12 nm) north-northeast of the bridge wreckage and about 4,101 feet (0.68 nm) north-northeast of the center of El Faro’s hull. The stern of the lifeboat was missing and was not discovered elsewhere. The gravity davits (cranelike devices for lowering boats into the water) for the starboard lifeboat were discovered intact during the second mission (figure 25). The arm for the forward davit was displaced and resting on the deck, but the arm’s cable was still attached to the track. The gravity davits for the port lifeboat showed greater damage, with the aft track and davit broken and hanging (figure 26). The navigation bridge and bridge deck that had been discovered during the first mission were further explored during mission 2. The photomosaic image in figure 27 shows that all windows on the forward side of the bridge were missing; that the windscreen bulwark was bent forward; and that the top railings were missing, severely bent, or broken. The starboard forward corner of the wreckage had settled deeper into the seabed than the other corners. El Faro’s exhaust stack was discovered during the second mission about 2,625 feet (0.43 nm) north of the main hull (figure 28). It was largely intact, though the forward face was missing its steel plating and the stack was scratched, dented, and deflected inward. The boiler uptake funnel was missing from the top of the stack. The tripod mast and VDR capsule were discovered on the seafloor about 1,640 feet (0.28 nm) north of the main hull (figure 29). The large structural members were intact, but the overall structure was bent aft. The VDR was attached to the port leg and buried in mud.

NTSB

Marine Accident Report

67

Figure 24. Photomosaic of El Faro’s port lifeboat from images taken during second search mission. Bench seats and other internals are missing. Reflective tape on top of gunwales is illuminated.

Figure 25. Intact gravity davits for starboard lifeboat, with forward davit in foreground. (Photomosaic image from mission 2)

NTSB

Marine Accident Report

68

Figure 26. Gravity davits for port lifeboat, showing forward davit in place but damaged and aft davit broken and dangling. (Photomosaic image from mission 2)

Figure 27. Bridge and bridge deck, looking aft. (Photomosaic image from mission 2)

NTSB

Marine Accident Report

69

Figure 28. Exhaust stack lying on seafloor, Sea Star (company) symbol clearly visible. (Photomosaic image from mission 2)

Figure 29. Mast and VDR capsule on seafloor. (Photomosaic image from mission 2)

NTSB

Marine Accident Report

70 As documented during mission 3, the port side of the ship was intact, though dents on the forward side of the supply vent blisters were observed. The starboard side was intact forward of bay 16. At bay 16, major hull damage included a large vertical fracture on the starboard side extending from the mudline up to the main deck, estimated to be 3 feet wide at the main deck and extending across the deck to the ramp opening on the port side (figure 30). Major damage and fractures were also observed at the stern, extending about 20 feet forward of the transom, which was torn open down to the second deck (figure 31). The main deck on the starboard side was severely buckled and inset (pushed in) about 8 feet from the deck edge at frame 234. A gunwale plate on the main deck wing near bay 17 was also deformed.

Figure 30. Hull fracture in starboard sideshell and across main deck at container bay 16, forward of frame 200. (Image from mission 3)

NTSB

Marine Accident Report

71

Figure 31. Tear in ship’s transom. (Image from mission 3) The main deck on the starboard side was severely buckled and inset about 8 feet from the deck edge at frame 234. A gunwale plate on the main deck wing near bay 17 was also deformed. In the bow region, the foremast was toppled toward the port side (figure 32) and the bow plating inset. Hawsers (mooring lines) were observed streaming upward from the debris. The state of the cargo remaining on the ship was observed. A refrigerated container exhibiting hydrostatic crush damage (damage caused by water pressure) protruded from a vehicle opening near bay 15 on the starboard side (figure 33). In bay 2, a 20-foot tank container was crushed but still mounted to its stowage location, with a trailer chassis inboard of it (figure 34). Metal flashing hanging over the deck on the port side (not shown) was determined to be part of the cargo. The cargo mountings and transfer (support) beams were examined. The fiberglass deck grating was generally missing from the container support beams (figure 35). Undamaged container support beams were found forward of the deckhouse, however. Both twisted and intact transfer beams were found. Missing or bent deck rails were observed all around the ship. Damaged or missing louvers on the air intakes to the cargo holds were also observed. Some fire stations were found intact; others were missing from their mounts. Fire hose and broken railings hung over parts of the starboard side. Two lifebuoys along the deck rails were missing from their mounts; one was found intact at the port bow (refer to figure 32). The vessel’s 6-person liferaft and its container were missing from their position at the bow. A personal flotation device (PFD) was observed entangled on the boat deck walkway (figure 36).

NTSB

Marine Accident Report

72

Figure 32. Foremast toppled on port side of bow; reflection is from lifebuoy on railing next to hawsers. (Image from mission 3)

Figure 33. Container protruding through vehicle opening in bay 15, starboard side. (Image from mission 3)

NTSB

Marine Accident Report

73

Figure 34. Crushed tank container in bay 2, starboard side. (Image from mission 3)

Figure 35. Fiberglass deck grating missing from container support beams, port side, with intact transfer beams. (Image from mission 3)

NTSB

Marine Accident Report

74

Figure 36. PFD entangled on boat deck walkway. (Image from mission 3) 1.8 Personnel Information According to the vessel’s COI, El Faro was required to be manned by a master, a chief mate, a second mate, a third mate, a chief engineer, a first assistant engineer/second engineer, a second assistant engineer/third engineer, a third assistant engineer, six ABs, and three oilers. An additional requirement was that the crew include five certified lifeboatmen and three GMDSS radio operators. The COI allowed 16 other crewmembers and 9 persons to be on board in addition to the crew, for a total of 42 persons. No passengers were permitted. Along with the required crew, the following were on board during the accident voyage: two additional third assistant engineers, one boatswain (“bosun”), three general utility deck or engine crewmembers (GUDEs), one qualified member of the engine department, one reefer engineer, one steward/baker, one steward assistant, and one chief cook, in addition to the riding crew and their supervisor.106 The credentials of all El Faro crewmembers were issued under the provisions of the International Convention on Standards of Training, Certification and Watchkeeping for Seafarers, 1978 (STCW Convention), as amended in 1995 and 2010.107 The ship’s officers were members of

106 The boatswain, or bosun, is the highest ranking nonofficer in the deck department. He was counted as one of the required ABs on the accident voyage. 107 Officers and other crewmembers are now issued merchant mariner credentials that take the place of licenses, certificates, and other documents. Mariners formerly referred to as licensed officers carry “officer endorsements” on their credentials. Mariners formerly referred to as unlicensed crewmembers (but who held merchant mariner documents) carry “rating endorsements” on their credentials. PFD

NTSB

Marine Accident Report

75 the American Maritime Officers (AMO) union, and the rated crewmembers were members of the Seafarers International Union (SIU). 1.8.1 Deck Officers Captain. The captain, age 53, graduated from Maine Maritime Academy in 1988. His latest merchant mariner credential was issued by the Coast Guard National Maritime Center on January 28, 2011, and was due to expire on January 28, 2016. The credential stated that under international capacities, the captain was endorsed as master with no limitations. Under national (US) capacities, he was endorsed as master of self-propelled vessels, not including auxiliary sail, of unlimited tonnage upon oceans; as radar observer (unlimited); and as first-class pilot of vessels of unlimited tonnage upon the inland waters of Prince William Sound, Alaska. He was an STCW-certified GMDSS radio operator and vessel security officer and was also endorsed for advanced oil tanker and chemical tanker operation. Experience. The captain joined TOTE (then known as Interocean American Shipping) in

1. According to his application letter to TOTE, after graduating from Maine Maritime

Academy he worked on the West Coast (Alaska, Washington, and Oregon) for Atlantic Richfield from 1989 to 2000 and then for Polar Tankers until 2003. Among his duties was person-in-charge of oil transfers between ship and shore facilities. During 2004, he served as captain on the research vessel Atlantic Explorer, operated by the Bermuda Biological Station for Research (now the Bermuda Institute of Ocean Sciences), and then as chief mate for Sabine Shipping. At TOTE, the captain served first as second mate, then as chief mate on the Ro/Ro car and truck carrier M/V Patriot, sailing between northern Europe and the US East Coast. From 2008 to 2013, he served as captain on the Ro/Ro car and truck carrier M/V Courage, operated by Interocean American Shipping until 2010. In 2013, the captain served one tour as third mate on the TOTE vessel SS Pacific Tracker, a tracking and telemetry ship, before joining El Morro as captain in July 2013. In May 2014, he became captain of El Faro. He began his last tour with El Faro on August 11, 2015. Duties. The captain, also known as the ship’s master, had overall command of the vessel and was ultimately responsible for its safe operation and navigation.108 He was the company’s shipboard representative, charged with ensuring that the vessel operated in accordance with the company’s policies and objectives and with applicable law. All persons on board were under his authority. He was responsible for the oversight of the welfare and safety of the crew and maintained communication between personnel on shore and the vessel. He was responsible for ensuring that a proper voyage plan and deck logbook were kept, for monitoring the weather along the vessel’s intended track, for maintaining the ship’s stability, for seeing that required maintenance and requisitioning were done, and for making sure crewmembers performed their duties. He also had charge of the vessel’s budget and payroll.

108 As stated in Minding the Helm, “By tradition, admiralty law, and legal precedent, the master always remains in command and is ultimately responsible for the safe navigation of the vessel” (NRC 1994).

NTSB

Marine Accident Report

76 Performance. The captain’s most recent performance evaluation was partially completed (“draft”) on October 2, 2014. The port engineer scored the captain’s performance as excellent in all categories except one (cooperation with technical manager), which he left blank. He commented that the captain “handles all aspects of the master’s position with professionalism” and “handles a diversified and unpredictable crew quite well.” The evaluation had not been signed, as required, by the technical manager, or by the captain. The form was not stamped by TOTE’s crewing department for formal receipt, nor was it in the captain’s personnel file originally provided to investigators. It was provided by TOTE management on request and was said to have been left out of the file inadvertently. The captain’s personnel file contained no documented issues and no evidence indicating that he lacked a set of skills or abilities that would bring his competency as a captain into question. However, the director of ship management and the crewing manager both expressed concern about his performance. In a May 2015 email, the crewing manager expressed “dwindling confidence” in the captain.109 She told the marine board she felt there were “better candidates available for the Marlins” (the company’s new ships, the Isla Bella and the Perla del Caribe).110 She added that her dealings with the captain were “regarding crewing, and so I would not have judged his suitability as a master.” The director of ship management, in a July 2015 email to the company’s vice president of marine operations, stated, “He’s stateroom Captain, I’m not sure he knows what a deck looks like period. Least engaged of all four Captains in the deck operation.” The director explained to the marine board that the captain “had a different style than I prefer as a Ship Manager. But he was a very effective captain.” No letters of warning or reprimand were found in the captain’s personnel file. The captain had received two letters of warning from a previous employer and had met with management to discuss issues such as a perception of disassociating himself from daily activities and a perception of disharmony between him and senior officers. One warning letter listed two violations regarding an accident report. The letter stated that any further infractions could cause a loss of confidence in the captain and result in disciplinary action, up to and including termination. After a second letter of warning, concerning a failure to report actual or suspected cargo damage, the captain resigned. About 2 months later, in May 2013, the captain was rehired by TOTE. In early 2015, TOTE assigned captains to the Isla Bella and the Perla del Caribe. None of the company’s current captains was initially selected to crew the vessels. In June, the captain expressed his displeasure at not being placed on one of the new ships in an email to a union (AMO) official. According to the company’s director of labor relations, senior management reconsidered and after interviewing the captain on August 4, decided to offer him a position on one of the LNG ships. Before the company could notify the captain, however, management learned of an “alleged” incident in which he had not enforced the company’s zero-tolerance alcohol policy. The director of labor relations said the incident “was not documented, it was all verbal second-hand

109 Investigators reviewed company email records for the 10 months before the accident voyage. 110 Marlin-class vessels were the world’s first container ships powered by LNG.

NTSB

Marine Accident Report

77 information.” Management delayed notifying the captain about the job. On September 24, the captain emailed a family member that he still did not know if he was going to have a position on one of the new ships: It’s looking like I won't be home until 03 Dec. They have no one to relieve me and now I am actually on my scheduled rotation, which has me home for Xmas. Again, I feel taken advantage of . . . But, they pay really good. Who knows how long this good fortune will last. I have no idea if I am even going on the Marlin Class vessels yet. The VDR recorded a conversation between the captain and the chief mate regarding their future employment with the company: Chief Mate: When they lay this up they’re not gonna (take us back) . . .I hear what you're saying captain. I’m in line for the choppin’ block . . . yeah. Same here . . . I’m waitin’ to get screwed. Captain: Same here. Chief Mate: I don't know what’s gonna happen to me. The director of labor relations told investigators that the company planned to have the captain sail on El Faro in the Alaska trade. However, the vice president of marine operations stated, “I do not believe [he would remain] in the master role [aboard El Faro], but . . . he could sail on the vessel, say, possibly as chief mate or second mate.” Medical. According to his latest Coast Guard medical examination, completed in March 2015, the captain was not taking any prescription medications and was deemed physically competent to hold a credential.111 Chief Mate. The chief mate, age 54, graduated in 1984 from the US Merchant Marine Academy at King’s Point, New York. His latest merchant mariner credential was issued on January 8, 2013, and was due to expire on January 8, 2018. The credential stated that under international capacities, the chief mate was endorsed as master, with a limitation that the endorsement was not valid for service on vessels equipped with the electronic chart display and information system (ECDIS) after December 31, 2016. He was credentialed as officer in charge of a navigational watch and GMDSS radio operator. He was also endorsed under domestic capacities as master of steam or motor vessels of any gross tons upon oceans and as radar observer (unlimited). Experience. The chief mate was employed by Crowley American Transport from 1989 to 1997, when he sailed as both second mate and chief mate. He then spent 2 years sailing for Osprey Ship Management, Inc., again as both second mate and chief mate. From 2001 to 2003, he sailed as chief mate for Sealift, Inc. He began sailing with TOTE (then Interocean American Shipping) in 2004, when he joined the SS Great Land, a Ro/Ro vessel in the Alaska trade. He sailed as second mate and then chief mate (beginning in 2005) on the Great Land until it was taken out of

111 The Coast Guard requires completion of form CG-719K, in accordance with NVIC 04-08 (USCG 2008). If the Coast Guard approves the form, it serves as “documentary evidence that regulatory physical requirements have been satisfied and that the applicant is physically competent to hold a credential.”

NTSB

Marine Accident Report

78 service in 2011. He joined El Yunque as third mate in 2011 and was promoted to second mate in

1. In May 2015, he was assigned to El Faro as chief mate. The accident voyage was his second

tour on El Faro. He joined the ship 2 weeks before the sinking, on September 18. Duties. The chief mate was head of the deck department and reported directly to the captain. He was responsible for seeing that the cargo was properly loaded, cared for on the vessel, and discharged. One of his duties was to calculate the vessel’s stability. As officer in charge of the navigational watch, he was responsible for updating the deck logbook while on watch. Required logbook entries included change of watch, course changes, weather, and inspection of weathertight doors at departure. The chief mate also made entries, outside his normal watch hours, when the large watertight doors were secured for sea and when cargo was secured or checked. He managed deck-related preventive maintenance as well. Performance. The chief mate’s performance evaluations were consistently positive. His evaluation from June 2015 stated that he was “passionate” about his work and “an excellent instructor for the inexperienced.” Medical. According to his Coast Guard records, the chief mate had a condition requiring a medical waiver, but he was no longer taking medication for the condition and no limitations were placed on his credential. Second Mate. The second mate, age 34, graduated from Maine Maritime Academy in

1. Her latest merchant mariner credential was issued on March 30, 2015, and was due to expire

on March 30, 2020. The credential stated that under international capacities, the second mate was endorsed as officer in charge of a navigational watch, with a limitation that the endorsement was not valid after December 31, 2016. The international endorsements also included GMDSS radio operator and vessel security officer. The second mate held domestic endorsements as second mate of self-propelled vessels, not including auxiliary sail, of unlimited tonnage upon oceans, and as radar observer (unlimited). Experience. The second mate began working for TOTE (then Interocean American Shipping) in 2005. She sailed as third mate on El Morro from 2005 until 2013, when she was promoted to second mate. In July 2014, she transferred to El Faro as second mate. She joined the ship for the accident voyage on September 22. The second mate was the navigation officer. She was responsible for preparing voyage plans, keeping the vessel’s charts, and updating the deck logbook while on watch. She was also responsible for bridge navigational equipment. When the ship was in port, the second mate assisted the chief mate in securing the vessel and overseeing cargo operations. The second mate would also take offshore draft readings. Performance. The second mate received scores of very good or excellent on the most recent performance evaluation in her personnel file, dated November 2011, when she was a third mate. Though she began sailing as second mate in 2013, her file contained no evaluations in that position.

NTSB

Marine Accident Report

79 Medical. According to Coast Guard records, the second mate had no medical conditions and was taking no prescription medication. She wore corrective lenses and was required to keep a spare pair on board. Third Mate. The third mate, age 46, graduated from the Seafarers Harry Lundeberg School of Seamanship (affiliated with the SIU) at Piney Point, Maryland, in 1993. His latest merchant mariner credential was issued on December 5, 2013, and was due to expire on December 5, 2018. The credential stated that under international capacities, the third mate was endorsed as officer in charge of a navigational watch, with a limitation that the endorsement was not valid for service on ECDIS-equipped vessels after December 31, 2016. His international endorsements also included GMDSS radio operator. He was endorsed under domestic capacities as deck officer/third mate of steam or motor vessels of any gross tons upon oceans and as radar observer (unlimited). Experience. The El Faro third mate began sailing with TOTE (then Interocean Ugland Management Corporation) as third mate in 1999. He served as third mate on El Morro from 2010 to 2013 and took the third mate position on El Faro in May 2014. He began his last tour on the ship on July 28, 2015. Duties. The third mate stood watches at sea. He generally reported to the chief mate, except when in charge of the navigational watch, when he reported to the captain for navigation and route planning. When in port, the third mate rotated with the second mate in securing the vessel and overseeing cargo operations. Performance. The most current performance evaluation in the third mate’s personnel file was dated February 2014. He received scores of excellent in all deck-related areas. Medical. According to Coast Guard records, the third mate was not taking any prescription medications and was deemed physically competent to hold a credential. 1.8.2 Engineering Officers Chief Engineer. The chief engineer, age 34, graduated from the State University of New York Maritime College in 2003. His merchant mariner credential was issued on November 4, 2014, and was due to expire on November 4, 2019. The credential stated that under international capacities, the chief engineer was endorsed as chief engineer, with a limitation that the endorsement was not valid after December 31, 2016. Under domestic capacities, he was endorsed as chief engineer of steam, motor, and gas-turbine vessels with no limitations. Experience. The chief engineer began his career in 2003, sailing as third and second assistant engineer on a variety of steam-propelled cargo ships. He joined TOTE (then Interocean American Shipping) in 2008 as first assistant engineer on the SS Petersburg. He sailed on El Morro as first assistant engineer in 2011–2012. In 2013, he served briefly as first assistant engineer on El Yunque before rejoining El Morro as chief engineer. He joined El Faro as chief engineer in 2014, signing on for the ship’s last voyage on August 18, 2015. Performance. The chief engineer had undergone official evaluations throughout his career with TOTE. On July 22, 2013, while aboard El Yunque as first assistant engineer, he received

NTSB

Marine Accident Report

80 ratings of very good or excellent in all categories. He was reported to be “intelligent, hard-working” and had a “good attitude” and no areas that required improvement. An evaluation conducted on January 5, 2012, while he was aboard El Morro, stated that he was a “hard working and knowledgeable first working his way to becoming a chief, and that he is able to work through difficult times.” TOTE provided one draft evaluation for the chief engineer, dated October 2, 2014, in which all evaluation criteria were rated exceptional. Another performance evaluation from 2014 was partially completed but was not stamped by the crewing department for formal receipt and was not found in the personnel file provided to investigators. Medical. According to Coast Guard records, the chief engineer was not taking any prescription medications and was deemed physically competent to hold a credential. He held a Coast Guard medical certificate valid until February 2019 that required him to wear corrective lenses. First Assistant Engineer. The first assistant engineer, age 33, graduated from Massachusetts Maritime Academy in 2005. He had trained on the academy’s steamship Enterprise. According to Coast Guard records, his merchant mariner credential was issued on May 8, 2015, due to expire on May 8, 2020. The company’s personnel files had not been updated to reflect the new issue date. The credential stated that under international capacities, the first engineer was endorsed as a chief engineer, with a limitation that the endorsement was not valid on steam vessels or after December 31, 2016. He was also endorsed under international capacities as a second engineering officer, with a limitation that the endorsement was not valid after December 31, 2016. Under domestic capacities, he was endorsed as first assistant engineer of steam, motor, and gas-turbine vessels and as chief engineer (limited) of motor and gas-turbine vessels of less than 1,600 gross register tons upon oceans, near coastal waters, and the Great Lakes. Experience. The first assistant engineer’s first TOTE vessel was El Morro, which he joined as third assistant engineer in June 2009. He joined El Faro on August 4, 2015. Performance. The first assistant engineer’s first performance evaluation in that capacity contained mostly good ratings, as well as constructive criticism regarding his work performance and leadership in his new position. The same evaluating chief engineer had given him excellent ratings on his previous trip as second engineer. Medical. According to Coast Guard records, the first assistant engineer was not taking any prescription medications and was deemed physically competent to hold a credential. Second Assistant Engineer. The second assistant engineer, age 50, began his sailing career in 1990 as an unlicensed mariner, working his way up to third assistant engineer in 1996 and second in 1998. His merchant mariner credential was issued on March 30, 2012, and was due to expire on March 30, 2017. The credential stated that under international capacities, the second assistant engineer was endorsed as officer in charge of an engineering watch (second assistant engineer). Under domestic capacities, he was endorsed as second engineer on steam, motor, or

NTSB

Marine Accident Report

81 gas-turbine vessels of any horsepower and had served on a variety of steam- and motor-powered tankships and freighters. Experience. The second assistant engineer joined TOTE (then Interocean Ugland Management Corporation) in 2003 as third assistant engineer on the SS Westward Adventure. He served on El Faro as third assistant engineer in 2010–2011. He rejoined TOTE in 2013 as second assistant engineer on El Morro, then transferred to El Faro in 2014. He joined El Faro before the accident voyage on August 11, 2015. Performance. The second engineer received positive evaluations, the most recent (May 2015) stating that he was “one of the most dependable” and “hardest working men” the chief engineer had ever worked with. Medical. According to Coast Guard records, the second assistant engineer was not taking any prescription medications and was deemed physically competent to hold a credential. Third Assistant Engineer No. 1. Of the vessel’s three third assistant engineers, the one who had served longest on El Faro was 26 years old and graduated from Maine Maritime Academy in 2012. His merchant mariner credential was issued on September 11, 2013, and was due to expire on September 11, 2018. The credential stated that under international capacities, he was endorsed as officer in charge of an engineering watch, with a limitation that the endorsement was not valid for ships in which gas turbines formed part of the propulsion system. Under domestic capacities, he was endorsed as third assistant engineer of steam and motor vessels of any horsepower. Experience. The third assistant engineer spent 120 days aboard the training ship State of Maine (diesel electric) and 72 days aboard the Navy ship Rappahannock (diesel) as a cadet before obtaining his third engineer’s credentials.112 He had made five 70-day trips on El Faro before the accident. He joined the ship before the accident voyage on September 22. Performance. An evaluation in January 2015 stated that he was “a valuable asset to the vessel.” Medical. According to Coast Guard records, the third assistant engineer was not taking any prescription medications and was deemed physically competent to hold a credential. He wore corrective lenses and was required to keep a spare pair on board. Third Assistant Engineer No. 2. The 25-year-old third assistant engineer on board at the time of the accident also graduated from Maine Maritime Academy in 2012 and had trained on the diesel-electric State of Maine. His merchant mariner credential was issued on July 9, 2012, and was due to expire on July 9, 2017. The credential stated that under international capacities, he was endorsed as officer in charge of an engineering watch (third assistant engineer). Under domestic capacities, he was endorsed as third assistant engineer of steam, motor, or gas-turbine vessels of any horsepower.

112 In 1997, Maine Maritime Academy replaced its steam training ship State of Maine with a diesel electric ship of the same name built in 1990.

NTSB

Marine Accident Report

82 Experience. The third assistant engineer had made two trips aboard El Yunque before the accident and one on the SS Bellatrix, a cargo vessel owned by the US Maritime Administration and operated by TOTE. He began work as a third assistant engineer on El Faro in April 2015. He started his last rotation on the ship 2 weeks before the accident, on September 15. Performance. The third assistant engineer received generally positive evaluations, though his last evaluation, dated November 2014, noted that he needed to pay more attention to detail. Medical. According to Coast Guard records, the third assistant engineer was not taking any prescription medications and was deemed physically competent to hold a credential. He wore corrective lenses and was required to keep a spare pair on board. Third Assistant Engineer No. 3. The newest third assistant engineer on board, age 23, graduated from Maine Maritime Academy in 2014. He, too, had trained on the diesel-electric State of Maine. His merchant mariner credential was issued on May 3, 2014, and was due to expire on May 3, 2019. The credential stated that under international capacities, he was endorsed as officer in charge of an engineering watch, with a limitation that the endorsement was not valid on gas-turbine vessels. Under domestic capacities, he was endorsed as third assistant engineer of steam, motor, or gas-turbine vessels of any horsepower. He was endorsed under STCW regulations as officer in charge of an engineering watch and vessel security officer. Under national regulations, he was endorsed as third assistant engineer of steam and motor vessels and as a qualified member of the engine department on vessels of any horsepower. Experience. The third assistant engineer’s first ship was El Faro. He signed on in Jacksonville on September 29, the evening El Faro departed on the accident voyage. Performance. Because he was new to the company, no performance evaluations were completed for this third assistant engineer. Medical. According to Coast Guard records, the third assistant engineer was not taking any prescription medications and was deemed physically competent to hold a credential. He wore corrective lenses and was required to keep a spare pair on board. 1.8.3 Supernumeraries Riding Gang. Section 312 of the Coast Guard and Maritime Transportation Act of 2006 allows a member of a foreign riding gang to work on board a freight vessel for 60 days at a time.113

113 Public Law 109-241, July 11, 2006.

NTSB

Marine Accident Report

83 Each member of a foreign riding gang must possess a US nonimmigrant visa and must receive basic safety training approved by the Coast Guard.114 The El Faro riding gang was an onboard repair crew contracted through Intec Maritime Offshore Service Corporation, an international company originally established to serve the North Sea oil rigs and now specializing in repair and maintenance of oceangoing vessels. The Intec vice president told investigators that the crew assigned to El Faro was hired through the company’s office in Gdansk, Poland. The first group of workers joined El Faro on August 18. Two electricians in that group left the ship before the accident voyage because, according to the TOTE port engineer, they had run “as much wiring as they could at the time.” Five members of the riding gang, all pipefitters, were on board El Faro at the time of the accident. They were 27, 34, 42, 43, and 52 years old. According to the Intec vice president, all the pipefitters had certificates that were renewed every 2 years and stamped “every 6 months that they were approved.” The riding gang was working to restore El Faro to its former configuration before the ship returned to the Alaska trade. The work included scraping the deck flush so that trucks could drive over it, removing covers over the deck ramps to allow vehicle access, reinstalling a Butterworth heater (which heats seawater to pump into a ship’s deicing system during cold weather) and associated saltwater piping, reinstalling deicing equipment on the ramps, installing a constant-tension winch, verifying that the freshwater cooling system was functional, installing a saltwater recirculation system, and refitting connections for steaming-out (cleaning) the ship’s sea chest (an intake reservoir for seawater). Work to install aft, midship, and forward shore ramps was scheduled to be done after the ship reached the West Coast. Several spouses of the Polish workers stated in written interviews that their husbands were generally happy working on El Faro and spoke highly of their supervisor (the off-duty chief engineer).115 One, for example, reported of her husband: “He was very happy, especially about his relations with the chief who was assigning and supervising the work of the Polish crewmembers.” Another said: “My husband liked his work and his relations with his crewmates. He often praised the chief who was supervising his work.” When asked about their husband’s safety concerns and working conditions on the ship, one spouse reported: “He didn’t go through any training about boat safety, such as an evacuation drill.” Another quoted her husband as saying, “. . .you can’t even imagine this old rust bucket I have to board.” She also reported that in general, her husband was happy with his job. Still another spouse reported: “Early during his contract, my husband told me that the boat was old and rusted throughout.” She also said that her husband liked his job.

114 A riding gang member is defined at 46 USC 2101(26a) as an individual who has not been issued a merchant mariner document, who does not perform watchstanding duties or handle cargo, is not part of the crew complement, is not a member of the steward’s department, and is not a citizen or resident of a country designated by the United States as a security threat. Laws governing riding gangs are codified at 46 USC 8106. 115 The spouses’ interviews were translated from the original Polish.

NTSB

Marine Accident Report

84 Riding Gang Supervisor. The riding gang supervisor was an off-duty TOTE chief engineer, age 42, who had graduated from Massachusetts Maritime Academy in 1996. His most recent merchant mariner credential was issued on October 28, 2011, and was due to expire on October 28, 2016. He was endorsed as chief engineer on steam vessels of any horsepower, as first assistant engineer, and as officer in charge of an engineering watch. He started working on the Ponce-class ships in December 2003 and spent several years on the Great Land before sailing aboard El Morro, El Yunque, and El Faro. He had received positive remarks about his work ethic and safety consciousness. He joined the ship on August 4, 2015. 1.8.4 Port Engineer TOTE assigned a port engineer to El Faro to assist with maintenance, order spare parts and supplies, monitor inspections and surveys, keep track of vessel certificates, arrange repair work with vendors, and provide general shore support. According to TOTE, a backup port engineer was assigned in case the primary port engineer was unavailable. The port engineers were the first point of contact ashore for the captains and the crews of the vessels, although according to TOTE management, they had direct access to the DP or any other company personnel, as required. TOTE did not employ port captains (who generally oversee port operations and day-to-day ship operations) for its vessels. The El Faro port engineer described himself as a combination port engineer and port captain. He said that he did not assess the vessel’s voyage plans or review its position reports. El Faro’s port engineer graduated from California Maritime Academy in 1976 and had sailed for 28 years on both steam and diesel ships in several capacities, including that of chief engineer. He started with TOTE as a port engineer in November 2013. He told investigators that he boarded El Faro every Monday and Tuesday when the ship was in Jacksonville and occasionally in San Juan. 1.8.5 Work and Rest According to company records, officers on El Faro had the following watch schedules, which were validated by the VDR transcript: • Captain: dayworker, did not stand a watch • Chief mate: 0400–0800; 1600–2000 at sea • Second mate: 0000–0400; 1200–1600 at sea • Third mate: 0800–1200; 2000–0000 at sea • Chief engineer: dayworker • First assistant engineer: dayworker • Second assistant engineer: 0400–0800; 1600–2000 • Third assistant engineers: could not be determined The STCW Convention states that for crewmembers on vessels subject to US manning requirements, officers in charge of a navigational watch and any rated person forming part of the watch must receive a minimum of 10 hours of rest in any 24-hour period. The 10-hour rest can be

NTSB

Marine Accident Report

85 divided into no more than two periods, of which one must be at least 6 hours long (46 CFR 15.1111). The captain was required to track the crew’s work and rest hours to ensure that they did not violate STCW requirements. According to a relief chief mate, designated department heads (captain, chief engineer, and boatswain [for the ABs]) always reviewed and signed the records. The DP said managers reviewed the timesheets if an issue was reported to them. However, it was unclear who at TOTE (on shore) was in charge of STCW compliance. The DP stated that it was the captain’s responsibility to monitor compliance on the vessel and the responsibility of crewmembers to monitor their hours. At sea, the deck officers stood 4-hour watches. The second and third mates shifted to a 6-hours-on, 6-hours-off watch schedule in port, and the chief mate became a dayworker. Occasionally, a port mate would come on El Faro to assist the mates in the loading and unloading operations. The last port mate scheduled to work in Jacksonville was on September 1, 2015. Port mates were used in San Juan for the 1-day port call on September 25. Email evidence shows that the captain, via the chief mate, had requested a port mate before the final cargo-loading operation. The chief engineer told his wife that he was exhausted from all the maintenance and issues he had in the weeks before the accident. Two friends of the second mate told investigators that she complained about fatigue as a result of her watch schedule, coupled with relieving other officers during mealtimes when she was not on watch and the additional work required at sea under company procedures and the union contract (12-hour days). Evidence of the second mate’s use of ZzzQuil (a non-habit-forming sleep aid whose active ingredient is the antihistamine diphenhydramine HCl) was found on the VDR transcript.116 The captain, similarly to the other officers, normally worked a 10-week rotation (10 weeks off after 10 weeks on the ship). He started a work rotation on May 5, 2015, and left the ship on July 14. When his relief resigned 3 weeks later, the captain was asked to return early to El Faro. Four weeks into his vacation, on August 11, he returned to work on El Faro. According to TOTE management, the captain was scheduled to work until December. 1.8.6 Bridge Resource Management Bridge resource management (BRM), also known as bridge team management, is a process by which bridge crews use all available resources and act efficiently and as a team to safely operate the ship. ABS defines BRM as “a method of performing bridge watchkeeping tasks in which crews behave in an efficient and team oriented manner to maintain overall situation awareness and use all available resources including information, equipment, communication, procedures, and people to achieve safe operation” (ABS 2005). As stated in the company’s SMS policy, BRM requires “cooperation and sharing of responsibility . . . between Master, deck watch officers, helmsman and

116 Several factors influence how long the effects of the medication last if a full recommended dose is taken, according to the manufacturer’s website. The manufacturer recommends that ZzzQuil be taken only when the consumer has time to get a full night’s sleep (about 8 hours).

NTSB

Marine Accident Report

86 lookout.” The SMS policy further states, “Teams do not just happen. They have to be formed and trained to work as teams.” As described in a publication for marine navigational officers, when implemented properly, a bridge team has the following characteristics (Nautical Institute 2014): • Maintains its situation awareness, avoiding becoming preoccupied with minor issues, which might cause them to lose sight of the big picture. • Continuously monitors the progress of the vessel, making adjustments and corrections as necessary to maintain a safe voyage. • Acquires relevant information early. • Appropriately delegates workload and authority. • Anticipates dangerous situations. • Undertakes appropriate contingency plans when necessary. Teamwork is a critical element of BRM. Training in BRM encourages junior officers to put forth their opinions and, when safety is of concern, to challenge their superior officers. Senior officers are, in turn, trained to be open to gathering feedback from the bridge team. Another important element for a properly functioning bridge team is maintaining situation awareness, which can be defined as “comprehension or understanding of a dynamic environment.” During the accident voyage, the mates and ABs discussed their concerns about the weather and the ship’s route on the bridge, where they were recorded by the VDR. The conversations were not repeated in the captain’s presence. After the captain went to his stateroom about 2000 on September 30, not to reappear on the VDR recording until 0409 the next morning, the third mate called him twice about the forecast and suggested making a course change to the south, which the captain did not agree to. While the second mate was on watch, she plotted a new route, based on weather information from Sat-C. She called the captain about 0120 and in a conversation that was not clear on the VDR recording, suggested a course change to the south that was not accepted by the captain. The day before, the second mate had sent a message to her mother saying that the ship was heading “straight into” the hurricane. Shortly before 0400 on October 1, she sent emails to her mother and a friend with essentially the same message. At 0503, the captain stated that he had conflicting reports about the location of the center of the storm. The captain was comparing two reports of different types containing forecasts from different times. The first was the 0500 Sat-C report from the National Hurricane Center, which was a text copy of the current forecast. The second was the BVS report issued at 2300 the previous evening. That report was a graphic depiction of the National Hurricane Center forecast from 1700 on September 30 (6 hours earlier). By the time the report was downloaded at 0503, the information was about 12 hours old. The captain repeatedly stated, however, that they were “on the back side” of the storm or would be soon. All members of the bridge team, except the captain, completed BRM training in 2013. The company was not required to send crewmembers to BRM training, and the Coast Guard does not require any BRM recurrent training. With recurrent training, all officers would have a unified understanding of expectations with regard to effective communication, assertiveness, and working as a well-organized and competent team.

NTSB

Marine Accident Report

87 1.9 Waterway Information The sinking occurred along the sea trade route between Jacksonville, on the Atlantic coast of Florida, and San Juan, capital of the Caribbean island of Puerto Rico. Puerto Rico is an unincorporated US territory. As such, it is subject to laws regulating shipping between the US mainland and its states, territories, or possessions.117 Section 27 of the Merchant Marine Act of 1920, Public Law 66-261, as amended, commonly referred to as the Jones Act, requires that maritime transport of cargo between points in the United States (“cabotage” or “coastwise shipping”) be carried by vessels that are (1) owned by US citizens and registered in the United States, (2) built in the United States, and (3) operated by crews who are predominantly US citizens.118 The Jones Act was intended to strengthen the US merchant marine and support the nation’s shipyards. In addition to regulating the construction and ownership of vessels engaged in coastwise shipping, the Jones Act also codified the rights of injured maritime workers. Between October 2011 and February 2013, the US Government Accountability Office (GAO) conducted a performance audit of Puerto Rico’s maritime trade and the possible effects of modifying the Jones Act. At the time of the audit, most of the maritime trade between the United States and Puerto Rico was shipped in containers by four Jones Act carriers: Crowley Puerto Rico Services, Inc.; Horizon Lines; Sea Star Line (now TOTE Maritime Puerto Rico); and Trailer Bridge, Inc. According to the audit report, in June 2011, Crowley accounted for 31 percent of the US–Puerto Rico market, Horizon for 30 percent, Sea Star Line for 27 percent, and Trailer Bridge for 12 percent (GAO 2013). As of the date of the GAO’s report, Sea Star and Horizon operated five self-propelled containerships between them, Crowley operated eight Ro/Ro barges, and Trailer Bridge operated four Ro/Ro barges. The containerships ranged from 38 to 44 years old. Horizon Lines (with its three containerships) ceased operations to Puerto Rico in December 2014. The port of Jacksonville handles most of the cargo moving between the US mainland and Puerto Rico. According to the Jacksonville port authority’s 2015 annual report (JAXPORT 2016), Jacksonville is the nation’s eleventh largest container port and is the leading port for vehicle exports. The annual report states that the port of Jacksonville moved 8.2 million tons of cargo during the fiscal year ending September 30, 2015, including over 900,000 TEUs and more than 650,000 Ro/Ro units, primarily passenger cars. A total of 1,826 vessels reportedly called at the port in fiscal 2015, with revenues for the year totaling $55.2 million. The Jacksonville port authority owns three cargo facilities on the St. Johns River, including the Blount Island marine terminal where El Faro docked. The river empties into the Atlantic about

117 The US Virgin Islands, American Samoa, and parts of the Northern Mariana Islands are not subject to those laws, as stipulated at 46 USC 5501(b)(3). 118 Under the US cabotage laws, only a citizen can serve as master, chief engineer, radio officer, or officer in charge of a deck or engineering watch on a documented vessel, and no more than 25 percent of the unlicensed crew can be noncitizens (46 USC 8103). The Jones Act was recodified in 2006 as 46 USC 8103, 12103, 12112, 12131, and 55102 (Baatz 2014).

NTSB

Marine Accident Report

88 9 nm east of Blount Island. Harbor pilots guide vessels through the main ship channel, which is dredged, to a point near the St. Johns lighted sea buoy, 3 nm from the river entrance.119 The usual, rhumb-line sea route between Jacksonville and San Juan stretches about 1,100 nm, heading southeast and bypassing a number of islands, including the Bahamas.120 An alternate route to San Juan involves traveling south along the Florida coast about 500 nm, then turning southeast into Old Bahama Channel, a deep, narrow passage that runs between the Great Bahama Bank (one of the large underwater platforms in the Bahamas archipelago) and Cuba. Old Bahama Channel is one of several deepwater passages through and around the Bahamas (see figure 37).121 Farther north is Northeast Providence Channel, a branch of the Great Bahama Canyon, one of the largest submarine canyons in the world. The eastern entrance to Northeast Providence Channel lies off the south tip of Great Abaco Island, near the “Hole in the Wall” lighthouse. The channel runs through the Bahamas and connects with the Northwest Providence Channel, a wide, deepwater pass between Little Bahama Bank and Great Bahama Bank that leads to the Straits of Florida and the Florida coast. Farther south is Crooked Island Passage, which lies between Long Island and Crooked Island and provides a route south through the Bahamas toward Cuba. The seaway, which is about 30 nm long and 27 nm wide, ranges from 1,000 to 1,500 fathoms (6,000 to 9,000 feet) deep. Diana Shoal at the southern terminus is at least 42 feet deep, with 18 nm of deep water to either side. East of the passage lie several low islands that form a triangle enclosing the Bight of Acklins, a shoal-water bay. The northernmost of the group is Crooked Island, covering about 76 square miles and having a population of about 330. Acklins (120 square miles), in the southeast part of the island group, has a population of about 550. The southern continuation of Crooked Island Passage is Mira Por Vos Passage, a deepwater seaway between Castle Island and several low-lying islets and shoals. South of Crooked Island Passage and east of Acklins lies Mayaguana Passage, a deepwater seaway, about 30 nm long and 15 nm wide, lying between two reef-fringed cays and Mayaguana Island. The seaway ranges from 800 to 1,100 fathoms (4,800 to 6,600 feet) deep and like Crooked Island Passage, leads south toward Cuba. Mayaguana Island covers about 108 square miles and is sparsely populated.

119 Pilotage is required for US coastwise vessels on the St. Johns River unless a US-licensed pilot is on board (NOAA 2017b). 120 A rhumb line is a straight line on a Mercator projection chart, the type of chart commonly used in marine navigation. 121 The passages and island groups discussed in this section are described in sailing directions published by the National Geospatial-Intelligence Agency (NGA 2016).

NTSB

Marine Accident Report

89

Figure 37. Nautical chart with passages through Bahama Islands and Old Bahama Channel highlighted. El Faro traveled southeast from Jacksonville in international waters of the North Atlantic Ocean until it entered Bahamas territorial waters on a path between Cat Island and San Salvador Island. The vessel sank about 40 nm northeast of Crooked Island, inside the Bahamas territorial boundary. The ocean in the region is deep, ranging around 2,500 fathoms, or 15,000 feet (NOAA 2012). The average depth of the world’s oceans is about 12,100 feet (NOAA 2015a). The nearest land to the accident site was Samana Cay, a low-lying, uninhabited islet about 20 nm to the southeast.

NTSB

Marine Accident Report

90 1.10 Meteorological Information 1.10.1 Atlantic Hurricane Season 2015 Joaquin was the second major hurricane of the 2015 Atlantic hurricane season. In the United States, Joaquin was identified, tracked, and analyzed by the National Hurricane Center in Miami.122 The hurricane center, which is responsible for monitoring tropical and subtropical storms in both the northeast Pacific and northern Atlantic oceans, issues forecasts in text as well as graphic form. When hurricane-force winds are possible or imminent on land, the hurricane center issues hurricane watches and warnings. The National Hurricane Center tracked twelve tropical cyclones, including four hurricanes, during the 2015 Atlantic hurricane season (Stewart 2016b). (Cyclone is the general term for a wind system, or circulation, that rotates around a center of low atmospheric pressure. Tropical cyclones with sustained wind speeds above 64 knots are known as hurricanes in the North Atlantic and northeastern Pacific and as typhoons in the northwestern Pacific.) The Atlantic hurricane season runs annually from the beginning of June until the end of November. Tropical cyclones form in the Atlantic primarily between latitudes 8N and 20N (Husick 2009). August, September, and October are the months of greatest hurricane frequency in the Atlantic. Hurricane Danny, which developed in mid-August 2015, was the first major hurricane of the year. It developed off the west coast of Africa on August 14 and by August 21 had reached an intensity of Category 3 on the Saffir-Simpson wind scale (table 2), with maximum sustained winds of nearly 127 mph. By August 24, Hurricane Danny had weakened to a tropical depression (maximum sustained winds of 38 mph or less). The storm brought rain to the Caribbean islands but caused little damage and no casualties (Stewart 2016a). Table 2. Saffir–Simpson wind scale. Category Sustained Winds Types of Damage Due to Hurricane Winds 1 74-95 mph 64-82 knots 119-153 km/hr Very dangerous winds will produce some damage: Well-constructed frame homes could have damage to roof, shingles, vinyl siding, and gutters. Large branches of trees will snap and shallowly rooted trees may be toppled. Extensive damage to power lines and poles likely will result in power outages that could last a few to several days. 2 96-110 mph 83-95 knots 154-177 km/hr Extremely dangerous winds will cause extensive damage: Well-constructed frame homes could sustain major roof and siding damage. Many shallowly rooted trees will be snapped or uprooted and block numerous roads. Near-total power loss is expected with outages that could last from several days to weeks.

122 The National Hurricane Center is a division of the National Weather Service, which is part of the National Oceanic and Atmospheric Administration (NOAA), a branch of the US Department of Commerce.

NTSB

Marine Accident Report

91 Category Sustained Winds Types of Damage Due to Hurricane Winds 3 (major) 111-129 mph 96-112 knots 178-208 km/hr Devastating damage will occur: Well-built framed homes may incur major damage or removal of roof decking and gable ends. Many trees will be snapped or uprooted, blocking numerous roads. Electricity and water will be unavailable for several days to weeks after the storm passes. 4 (major) 130-156 mph 113-136 knots 209-251 km/hr Catastrophic damage will occur: Well-built framed homes can sustain severe damage with loss of most of the roof structure and/or some exterior walls. Most trees will be snapped or uprooted and power poles downed. Fallen trees and power poles will isolate residential areas. Power outages will last weeks to possibly months. Most of the area will be uninhabitable for weeks or months. 5 (major) 157 mph or higher 137 knots or higher 252 km/hr or higher Catastrophic damage will occur: A high percentage of framed homes will be destroyed, with total roof failure and wall collapse. Fallen trees and power poles will isolate residential areas. Power outages will last for weeks to possibly months. Most of the area will be uninhabitable for weeks or months. As Danny was fading on August 24, another weather system over the Atlantic was developing into a tropical storm, defined as a tropical cyclone in which maximum sustained winds range from 39 to 73 mph (34–63 knots). The tropical storm, named Erika, took a westerly course from the Lesser Antilles across the Caribbean. Torrential rains caused mudslides and major flooding in Dominica and also affected Haiti, Guadeloupe, the US Virgin Islands, and Puerto Rico before the storm moved into the Gulf of Mexico and finally dissipated over Georgia on September 3 (Pasch and Penny 2016). The weather system that became Hurricane Joaquin originated in a low that developed on September 8 over the eastern Atlantic, west of the Canary Islands, according to a report issued by the National Hurricane Center after the storm (Berg 2016). At 2000 on the evening of September 27, the hurricane center classified the developing system as a tropical depression (No. 11 of the season). The depression was centered about 360 nm northeast of San Salvador Island, Bahamas. At 2237 on September 27, the National Hurricane Center issued its first public advisory about the storm, identifying it as a tropical depression at 27.5N, 68.7W and stating that a “west-northwestward or northwestward drift is expected during the next couple of days,” with maximum sustained winds of 30 knots. From then until 1104 on October 1, the National Hurricane Center and the Ocean Prediction Center issued a total of 137 public advisories, discussions, and forecasts related to Joaquin, including high seas and offshore waters forecasts.123 The hurricane

123 The Ocean Prediction Center coordinates with the National Hurricane Center on forecasts for Atlantic tropical cyclones. See attachment 4 to the NTSB’s meteorology group factual report, available in the public docket, for a complete collection of all tropical cyclone public advisories, tropical cyclone forecasts/advisories, aviation tropical cyclone advisories, tropical cyclone discussions, tropical cyclone updates, tropical weather discussions, special advisory packages, high seas forecasts, offshore waters forecasts, and marine weather discussions related to Hurricane Joaquin issued by the National Weather Service and Ocean Prediction Center between 2300 on September 27 and 1100 on October 1.

NTSB

Marine Accident Report

92 center’s tropical cyclone forecast/advisories are numbered; 15 were issued during the period in question.124 1.10.2 Publicly Issued Hurricane Information Once a tropical depression is identified, the National Hurricane Center generally issues information at least every 6 hours. The primary message for conveying forecast position and intensity information is the tropical cyclone forecast/advisory, scheduled for dissemination at 0500, 1100, 1700, and 2300. Actual issuance times can vary from the scheduled (“nominal”) time. Linked to the forecast/advisory and issued about the same time are the tropical cyclone public advisory and the tropical cyclone discussion.125 Intermediate public advisories are issued between regularly scheduled ones when watches or warnings are in effect for land areas. Special forecast/advisories and additional updates can be issued any time. Also issued every 6 hours by the National Hurricane Center but on a different schedule from that of the tropical cyclone forecast/advisories is the high seas forecast. The high seas forecast can be completed early; it was issued 1 1/2 hours ahead of schedule the night before and the morning of the El Faro sinking (at 2255 on September 30 and 0501 on October 1). The Ocean Prediction Center also issues a high seas forecast, which includes the most recent National Hurricane Center’s high seas forecast, after it receives the hurricane center’s product. In addition, the hurricane center produces NAVTEX messages, disseminated by the Coast Guard, that automatically print out on a ship’s dedicated receiver. Messages sent by NAVTEX, a major element of the GMDSS, summarize major weather systems and forecast tropical cyclone positions and wind and sea states (including swells) out to 120 hours (5 days). NAVTEX messages applicable to El Faro’s route, which were transmitted from Miami, repeated Hurricane Joaquin’s current position and its forecast track and intensity from the tropical cyclone forecast/advisory issued about 45 minutes earlier. Investigators found no evidence that El Faro received weather information by NAVTEX (although NAVTEX is mentioned on the VDR recording).126 Radiofax, also known as HF FAX, radiofacsimile, or weatherfax, broadcasts weather charts and other data from the National Weather Service over high frequency (HF) radio. Charts are received by a dedicated radiofax receiver or a single sideband shortwave receiver connected to an external facsimile recorder or to a personal computer equipped with a radiofax interface and application software. El Faro had radiofax (weatherfax) on board, but investigators found no evidence that the crew used it to access weather information. The National Weather Service offers access to its text and graphic products in real time through its FTPmail system. Ideal users are mariners who can send/receive emails (for example, via satellite) but who cannot access the internet for web browsing. The OMV document of the

124 The National Hurricane Center issued its last tropical cyclone forecast/advisory (No. 42) for Joaquin at 2300 (nominal time) on Wednesday, October 7. By that time, the storm was moving east at 30 knots from 42N, 37W. 125 A third text product, the aviation tropical cyclone advisory, is also issued. 126 NAVTEX text products are found in attachment 7 of the meteorology group factual report in the accident docket.

NTSB

Marine Accident Report

93 company’s SMS advised that many weather charts that had been previously available through weatherfax were available by email from the FTPmail email address. A review of emails sent to and from El Faro, whose crew did not have access to the internet, between September 1 and the accident time did not discover any email traffic between the vessel and FTPmail. The National Hurricane Center issues tropical cyclone graphics on the same 6-hour schedule as the tropical cyclone forecast/advisory. Tropical cyclone track forecast cone and watches/warnings show a storm’s current position, present movement, forecast track and intensity, forecast track uncertainty, and an approximation of coastal areas under watches or warnings. Forecast uncertainty is displayed as a “cone” indicating uncertainty for the 3 or 5 days of the forecast.127 The position where El Faro sank was first shown inside the forecast uncertainty cone issued nominally at 1700 on September 29. From 1100 on September 30, the accident location was always inside Joaquin’s forecast uncertainty cone. Figure 38 is the forecast uncertainty cone issued at 2300 on September 29.

Figure 38. Tropical cyclone track forecast cone and watches/warnings graphic issued for Joaquin at 2300 on September 29. Orange circle shows Joaquin’s current position. H inside small black circles indicates forecast intensity of 74-110 mph (64-95 knots).

127 At the time of the accident, the uncertainty cone was intended to enclose 67 percent of the previous 5 years of official forecast errors.

NTSB

Marine Accident Report

94 El Faro is unlikely to have had access to National Hurricane Center tropical cyclone graphics such as the forecast uncertainty cone through any available means.128 As a result of the El Faro accident, the NTSB issued a recommendation that the National Weather Service make such graphics available through FTPmail (see section 1.16.2). The National Hurricane Center’s tropical cyclone danger graphic is intended to help mariners avoid tropical cyclones. The version of the product at the time of the accident depicted avoidance areas based on the mariner’s 1-2-3 rule.129 The shaded “danger” area in the graphic is determined by taking the forecast area of tropical-storm-force winds and extending it outward to reflect the 34-knot wind radii forecast at 24, 48, and 72 hours. The danger area is plotted by adding 100 nm to the maximum radius of the 34-knot winds in the 24-hour forecast, 200 nm to the maximum radius of the 34-knot winds in the 48-hour forecasts, and 300 nm to the maximum radius of the 34-knot winds forecast for 72 hours. A circle is then drawn around each forecast position (moving across the chart with the storm), and a line is drawn connecting the circles. The area enclosed by the line is the danger area or area of avoidance. Figure 39 shows the danger graphic for Joaquin, then a tropical storm, that was valid for the time El Faro departed Jacksonville on September 29. There is no evidence that El Faro received the danger graphic by email or fax.

Figure 39. Tropical cyclone danger graphic for Joaquin valid for 2300 on September 29.

128 It is possible that the crew could have seen the forecast uncertainty cone on the Weather Channel, but no evidence of any such viewing was captured on the VDR bridge recording. 129 A different methodology, based on wind speed probabilities, replaced the mariner’s 1-2-3 rule in 2016.

NTSB

Marine Accident Report

95 The National Hurricane Center normally issues a significant wave height analysis (“sea state analysis”) every 12 hours (at 0800 and 2000). In its forecasts, the hurricane center defines “significant wave height” as the average height of the highest one-third of the waves. On October 1, the 0800 analysis identified significant wave heights of 36 feet in the area where El Faro sank. The hurricane center’s offshore waters and high seas forecasts all state, “Individual waves may be more than twice the significant wave height.” 1.10.3 Weather Information Accessible to El Faro Radio and Satellite. As a participant in the GMDSS, El Faro was required by federal regulations (47 CFR 80.1123) to maintain a radio watch on specified channels for maritime safety information (including weather reports) broadcast by the National Weather Service and other government agencies. The ship was also required to maintain a radio watch on safety and distress frequencies. In addition, as a GMDSS vessel that traveled more than 100 nm from shore, El Faro was required to be equipped with an onboard Inmarsat ship earth station and to monitor the station for shore-to-ship distress alerts, including weather-related alerts.130 Inmarsat is a British company that operates global satellite telephone and data communication services.131 The company relays weather forecasts and warnings, marine navigational warnings, and other safety-related information to ships and aircraft at no charge through Inmarsat-C SafetyNET, part of the GMDSS. At the time of the El Faro accident, the National Weather Service delivered weather information via Inmarsat-C under contract to Airbus DS Satcom Government, Inc., which forwarded the information to Inmarsat via a land earth station in Eik, Norway, for satellite broadcast. National Weather Service products that applied geographically to the El Faro accident voyage and that were received by the vessel via Inmarsat-C SafetyNET were the tropical cyclone forecast/advisories issued by the National Hurricane Center and the high seas forecasts issued by the Ocean Prediction Center. The NTSB determined that a total of about 50 forecasts and advisories (including repeated messages) from the two centers was transmitted to Inmarsat for broadcast between 2000 on September 27 and 1000 on October 1. All high seas forecasts issued by the Ocean Prediction Center from 1803 on September 29 through the accident time carried an urgent priority (pan-pan). Bon Voyage System. Applied Weather Technology, Inc., a maritime weather-routing software company, made its product BVS available to El Faro during the accident voyage. BVS is a desktop application that can be installed on ship or shore computers. Version 7 of BVS, which appears to be the version installed on El Faro, is described in the product brochure as

130 A ship earth station is an Inmarsat communication device carried on board a ship. 131 Inmarsat was originally a nonprofit intergovernmental organization established in 1979 by the IMO but was privatized in 1999.

NTSB

Marine Accident Report

96 a graphical marine voyage optimization system that provides on-board and around-the-clock weather-routing information. . . . Using [an] on-board computer, BVS 7 provides the most recent weather and ocean data to the ship by broadband or email communications in a highly compressed format. . . . This data is then used to generate color-enhanced maps and graphics that allow the ship’s captain to easily view and interpret potential problem areas in advance. BVS is believed to have been installed on at least two computers on El Faro, one in the captain’s office and one on the vessel’s bridge, although the provider was not certain how many installations of BVS were on El Faro or where they might have been. Subscribers can receive BVS weather files by email (as did El Faro) or by broadband internet. According to Applied Weather Technology, BVS weather files were delivered to only one email address on El Faro (the captain’s), but single recipients usually distributed the files internally by email. The computer models that produce forecast data for the BVS weather files start every 6 hours, and the weather files are emailed to users about 9 hours after a model run begins. In the days leading to and including the sinking, BVS files were emailed to El Faro 2 minutes after the nominal availability times (0500, 1100, 1700, and 2300). Tropical cyclone information from the National Hurricane Center is included for graphic depiction in the BVS weather files. However, only data available until 20 or 25 minutes before the nominal delivery time of the BVS weather file are included. Thus, if the National Hurricane Center issues tropical cyclone information within 20 to 25 minutes of the BVS delivery time, the information will not be included in the BVS file. As shown in table 3, the National Hurricane Center generally issued its public tropical cyclone forecast/advisories for Joaquin from a few minutes to about a half hour early on the days before the sinking. Table 3. Nominal and actual issuance times for topical cyclone forecast/advisories. Date Issuance Time Nominal Actual September 28 1700 1643 September 28 2300 2236 September 29 0500 0432 September 29 1100 1035 September 29 1700 1651 September 29 2300 2253 September 30 0500 0437 September 30 0500* 0634* September 30 1100 1053 September 30 1700 1649 September 30 2300 2249 October 1 0500 0443

• Corrected version of forecast/advisory.

NTSB

Marine Accident Report

97 Separately emailed tropical update files are also available for BVS but only if a user specifically requests them, according to the “Delivery Schedule” section of the BVS user manual.132 (BVS files delivered on broadband are automatically updated.) Other information in the BVS manual suggests, however, that even without special requests, the most recent data will be delivered by requesting BVS emails at the four times listed on the software’s scheduling dialogue box. According to Applied Weather Technology, El Faro did not request any separate tropical update files. Seven BVS files were emailed to El Faro during the accident voyage. Each file included six text products from the National Hurricane Center and Ocean Prediction Center that applied to the accident area. Table 4 compares the nominal delivery times of the BVS files with the actual times the text products were publicly disseminated, from the evening of September 29 until the morning of October 1. Table 4. Delivery times of BVS weather files and dissemination times of text products. Delivery Time (nominal) of BVS Weather File Public Dissemination Time (actual) of Included Weather Forecasts and Advisories 1700 September 29 1035 September 29 .... Tropical cyclone forecast/advisory 1250 September 29 .... Tropical cyclone discussion 1403 September 29 .... Tropical weather discussion 1147 September 29 .... Offshore waters forecast 0311 September 29 .... Marine weather discussion 1205 September 29 .... High seas forecast 2300 September 29 1651 September 29 .... Tropical cyclone forecast/advisory 1652 September 29 .... Tropical cyclone discussion 1951 September 29 .... Tropical weather discussion 1718 September 29 .... Offshore waters forecast 1447 September 29 .... Marine weather discussion 1803 September 29 .... High seas forecast 0500 September 30 2253 September 29 .... Tropical cyclone forecast/advisory 2254 September 29 .... Tropical cyclone discussion 0203 September 30 .... Tropical weather discussion 2312 September 29 .... Offshore waters forecast 1447 September 29 .... Marine weather discussion 0002 September 30 .... High seas forecast 1100 September 30 0634 September 30 .... Tropical cyclone forecast/advisory 0449 September 30 .... Tropical cyclone discussion 0812 September 30 .... Tropical weather discussion 0514 September 30 .... Offshore waters forecast 0317 September 30 .... Marine weather discussion 0547 September 30 .... High seas forecast

132 Tropical update files are sent about 30 minutes after the regular BVS weather files and include any updated National Hurricane Center tropical cyclone information.

NTSB

Marine Accident Report

98 Delivery Time (nominal) of BVS Weather File Public Dissemination Time (actual) of Included Weather Forecasts and Advisories 1700 September 30 1053 September 30 .... Tropical cyclone forecast/advisory 1058 September 30 .... Tropical cyclone discussion 1327 September 30 .... Tropical weather discussion 1155 September 30 .... Offshore waters forecast 1439 September 30 .... Marine weather discussion 1211 September 30 .... High seas forecast 2300 September 30 1649 September 30 .... Tropical cyclone forecast/advisory 1655 September 30 .... Tropical cyclone discussion 1953 September 30 .... Tropical weather discussion 1730 September 30 .... Offshore waters forecast 1501 September 30 .... Marine weather discussion 1808 September 30 .... High seas forecast 0500 October 1 2249 September 30 .... Tropical cyclone forecast/advisory 2250 September 30 .... Tropical cyclone discussion 0154 October 1 ........... Tropical weather discussion 2314 September 30 .... Offshore waters forecast 0225 October 1 ........... Marine weather discussion 0017 October 1 ........... High seas forecast NOTE: High seas forecasts were issued by the Ocean Prediction Center; others by the National Hurricane Center. At the times the BVS weather files were emailed to El Faro, the storm location and forecast track in the BVS weather files were not current with the information then available from the National Hurricane Center or through Inmarsat-C SafetyNET. Rather, they were consistent with the data issued in the tropical cyclone forecast/advisory about 6 hours earlier (6-hour latency). Information current with the latest tropical cyclone forecast/advisory was, however, available in the tropical update files (which El Faro did not elect to receive) that were sent 30 minutes after the BVS weather files. The tropical cyclone forecast/advisories were delivered to El Faro via Inmarsat-C SafetyNET and were also available through other onboard options. Data on Joaquin’s current and forecast intensities (maximum sustained wind and wind gust magnitude) in the BVS files also reflected information delivered about 6 hours earlier (through Inmarsat-C SafetyNET). The intensities in the emailed tropical update BVS weather files, if that option had been selected, would have agreed with those in the current tropical cyclone forecast/advisory. A problem with the BVS system caused the weather file emailed to El Faro at 0500 on September 30 to duplicate the file emailed 6 hours earlier (at 2300 on September 29). Intensities in the 0500 file would have been consistent with the tropical cyclone forecast/advisory that was delivered via Inmarsat-C SafetyNet about 12 hours earlier (advisory No. 8). Hence, the information in the file emailed at 0500 on September 30 was at least 12 hours old (12-hour latency). Applied Weather Technology reported that its data update system had “updated ‘tropical storm track file’ for all products except BVS 7 [the version on El Faro] in the specific timeframe.”

NTSB

Marine Accident Report

99 The VDR transcript captures discussions on El Faro’s bridge about images from the BVS weather files. Figure 40 illustrates what the El Faro captain and other crewmembers could have seen when using the BVS files. The image is a screenshot from the BVS weather file emailed to El Faro about 2300 on September 30 but not downloaded by the captain until 0445 the next morning. The image shows Joaquin’s center position and wind fields forecast as valid for 0800 on October 1 (shortly after the sinking). (For reference, the ship’s position at 2300 on September 30 is shown by a small blue triangle, which would not have appeared on the actual image.) The image also shows the sea-level pressure (red contour lines), surface wind (barbs), and significant wave height (colored contours) forecast for the same time. (Users could project forecasts into the future at 3-hour intervals when viewing data from any one BVS weather file. In this case, the storm position for 0800 is shown according to the forecast track that was issued about 1700 the day before.) The storm center is denoted by a solid red symbol composed of an overlapping 6 and 9.

Figure 40. Screenshot of BVS weather file sent to El Faro about 2300 on September 30, showing forecast valid for 0800 on October 1. Image was part of BVS file not downloaded until 0445 on October 1. Ship’s position at 2300 on September 30 is shown as blue triangle for reference. Figure 41 is a display developed by NTSB investigators of the wind fields around Joaquin forecast for 0800 on October 1, based on the tropical cyclone forecast/advisory text issued (nominally) at 2300 on September 30 (advisory No. 13). The display shows the maximum extent of the 34-knot (tropical-storm-force), 50-knot, and 64-knot (hurricane-force) wind fields for each quadrant (northwest, northeast, southeast, southwest) around Joaquin’s center that were forecast for the same time.

NTSB

Marine Accident Report

100

Figure 41. Depiction of wind fields forecast for 0800 on October 1 using data from tropical cyclone forecast/advisory No. 13, issued about 2300 on September 30 and received on El Faro’s Sat-C terminal at 2253. Figure also shows ship’s position at approximate time forecast was received. In describing a hurricane, the circle around the eye at the center of the storm is divided into quadrants. The extent of each quadrant is defined by the radius of the maximum wind speed—the distance between the center of the cyclone and its band of strongest winds. Thus, the outlines of each wind field can be different, as in figure 41. Winds are defined as being of tropical storm force beginning at 34 knots. As explained in a mariner’s guide to hurricanes published by the National Weather Service’s Tropical Prediction Center (Holweg 2000), 34 knots is a critical value because when winds reach that speed, the sea state begins to severely limit a ship’s ability to maneuver away from a storm, putting the vessel and its crew in peril. In the northern hemisphere, conditions are more dangerous on the right side of a tropical cyclone, known as the dangerous semicircle, than on the left side, called the navigable semicircle.133 The forward motion of the storm increases the speed of the wind in the dangerous semicircle, which creates higher seas. When wind speed doubles, the force it generates increases by about a factor of four. (See appendix E for specific information on hurricane avoidance.) The BVS weather files went directly to the captain’s email address, which he accessed from his office. The computer on the bridge did not receive the BVS emails directly. Rather, the captain would download the data and send them to the bridge email address himself. Once an email was opened, the BVS data could be downloaded and reviewed. According to a chief mate who had

133 Right and left are relative to the direction in which the storm is traveling.

NTSB

Marine Accident Report

101 recently sailed aboard both El Faro and El Yunque, the process was different on El Yunque, where BVS data were sent to the email addresses of both the captain and the bridge. Investigators used GlobeArchive email records to determine when BVS emails were transmitted to El Faro and downloaded (table 5). Records indicate that the captain routinely downloaded the weather package within about 1 hour of receiving it. The BVS email sent at 2302 on September 30, the evening before the sinking, was not, however, downloaded until 0445 on October 1, a gap of 5 hours and 41 minutes. The final BVS weather package downloaded on El Faro was the data sent at 0502 on October 1 and downloaded an hour later. Table 5. Times BVS emails sent to El Faro and downloaded during final voyage. Date Time Email Sent Time Email Available for Download Time Email Downloaded September 29 1702 1704 1837 September 29 2302 2304 2329 September 30 0502 0504 0608 September 30 1102 1103 1124 September 30 1702 1703 1747 September 30 2302 2304 0445 (October 1) October 1 0502 0503 0609 Figure 42 plots the information available to the bridge team around 0500 the morning of the accident, after the captain downloaded the previous evening’s BVS file that had been available to him at 2304 and just after the new weather information delivered by Sat-C was available on the bridge (at 0446). At that point, the BVS information (blue) was almost 12 hours old (6-hour latency, as described above, plus additional time between receiving the email and downloading the data). The Inmarsat-C information was current as of 0446. The captain stated on the VDR at 0503, “We’re getting conflicting reports as to where the center of the storm is.”

NTSB

Marine Accident Report

102

Figure 42. Positions of Joaquin obtained by El Faro and available on the bridge around 0500 on October 1. (Plotted by NTSB) 1.10.4 Weather Data from Other Sources No weather buoys were known to be deployed within 250 nm of the accident site, according to the National Hurricane Center and the National Data Buoy Center website. The National Hurricane Center received four ship reports from vessels that observed winds of 34 knots or greater within 400 nm of the hurricane between 2000 on September 28 and 1400 on October 1. The captain of El Yunque emailed the El Faro captain on September 30 that he had recorded a wind gust of 100 knots. Investigators could not identify any public ship report that delivered a wind observation of that magnitude. El Faro sent a public ship report for conditions at 1000 on September 30, the only report the National Weather Service received from El Faro during the accident voyage. The report gave wind speed as 3 knots, visibility as 11 to 27 nm, air temperature as 30.6°C (87°F), sea surface temperature as 27.6°C (81.6°F), height of waves as 3 or 4 feet, and period of waves as 4 seconds. The vessel’s location was reported as 21N, 77.1W, which would have placed it in Cuba. Aircraft operated by the US Air Force Reserve 53rd Weather Reconnaissance Squadron and NOAA’s Aircraft Observation Center flew missions to collect data on Joaquin. The missions included flight-level observations, retrieval of surface wind magnitude from the stepped-frequency

NTSB

Marine Accident Report

103 microwave radiometer (SFMR), and dropsonde observations.134 NOAA’s two P3 aircraft were unavailable for missions because both were grounded for maintenance during Joaquin. Figure 43 illustrates distances from the storm where 34-, 50-, 64-knot, and peak winds might have occurred near the accident time. Distances are based on SFMR surface wind data retrieved during a reconnaissance flight close to the time of the sinking, as well as the National Hurricane Center’s poststorm best-track analysis. The best track is a poststorm, smoothed representation of a tropical cyclone’s location and intensity over its lifetime (see section 1.10.5). The SFMR data are peak 10-second average observations of surface wind within a 30-second reporting interval. The red and tan areas depict the best-track estimates of the farthest extent that 50- and 64-knot winds occurred in each storm quadrant about 0800 on October 1. In the storm’s northwest quadrant, the best-track analysis was that 50-knot winds extended outward as far as 50 nm from the center.

Figure 43. Surface winds from SFMR observations overlaid on best-track wind fields for 0800 on October 1. SFMR observations are labeled with midpoint of each 30-second reporting interval and average wind magnitude.

134A dropsonde is a miniature radio transmitter dropped by parachute from aloft to obtain pressure, temperature, and moisture measurements of the air below.

NTSB

Marine Accident Report

104 Figure 44 is an image from one of the US weather satellites that passed over the accident site around the time El Faro sank. The image is from visible (~0.7 micron) data captured about 0800 the morning of October 1 by the Operational Linescan System instrument on the Defense Meteorological Satellite Program (DMSP) F19 polar-orbiting weather satellite. The satellite was operated jointly by NOAA and the Air Force.

Figure 44. Visible image of Joaquin captured about 0800 on October 1 by DMSP F19 polar-orbiting weather satellite, with El Faro’s track superimposed in green. 1.10.5 Tracking Errors On January 12, 2016, the National Hurricane Center released a poststorm report on Hurricane Joaquin (Berg 2016). According to the report, at the time of the sinking, Joaquin was a Category 3 hurricane with an intensity of 110 knots. The poststorm analysis determined that Joaquin officially became a Category 4 hurricane (intensity of 115 knots) about 20 minutes after the accident. The storm remained near the Bahamas through October 2. On October 3, the hurricane accelerated northeastward away from the Bahamas and reintensified, reaching a peak intensity of around 135 knots, just below Category 5 (winds 137 knots and higher) strength.

NTSB

Marine Accident Report

105 The National Hurricane Center told investigators that its best estimate of Joaquin’s eye diameter in the hours immediately before and after El Faro sank (between 0500 and 0900 on October 1) was 25 to 30 miles. Sea surface temperatures in the accident area were the warmest on record for the period between September 18 and 27, according to the poststorm report. Research has shown a link between warmer oceans and more intense hurricanes (NOAA 2015b). The report surveyed the meteorological environment before and during the hurricane and plotted its best-track positions, reproduced here as figure 45. The best track plots the cyclone’s latitude, longitude, maximum sustained surface winds, and minimum sea-level pressure at 6-hour intervals, ignoring short-term variations in position or intensity that cannot be resolved.

Figure 45. Best-track positions for Hurricane Joaquin. (Image from Berg 2016) The National Hurricane Center’s report critiques its forecasting for Joaquin. Errors in the forecast track “between 72 and 120 h[ours] were double the mean official errors for the previous 5-y[ea]r period.” The report attributes the errors largely to “Joaquin’s atypical southwestward motion toward the Bahamas” between September 28 and October 1. According to the report, most of the prediction models, as well as the official forecast, indicated that Joaquin would move toward the northwest or west. The model run by the European Centre for Medium-Range Weather Forecasting, however, accurately depicted the hurricane’s southwestward motion after the first two

NTSB

Marine Accident Report

106 model runs, “partly due to the model’s deepening of the cyclone more than the other models, with a deeper-layer flow subsequently pushing Joaquin southwestward,” according to the report. Figure 46 illustrates the hurricane center’s 5-day forecast tracks and best track for Joaquin through the morning of October 1. With regard to intensity, the National Hurricane Center’s report states, “Official forecast intensity errors were greater than the mean official errors for the previous 5-y[ea]r period at all forecast times.”

Figure 46. Official 5-day forecast tracks and best track for Hurricane Joaquin through October 1. Joaquin’s actual overall movement was south-southwest through October 1, as shown by best track (blue line). Forecast tracks (black lines) show Joaquin moving first northwest, then later west and southwest before beginning to track northward. (Lines track right to left.) National Hurricane Center employees told investigators that Joaquin was one of its most challenging storms when it came to forecasting the storm track. In particular, the computer models had difficulty defining the cyclone’s vertical structure (system depth). According to the hurricane center, early model solutions agreed that Joaquin would remain a relatively weak system because of a strong northerly wind shear and would move northwest.135 Contrary to the forecasts, Joaquin strengthened, became a deep system, and moved southwest. Investigators calculated the errors in track and intensity for Joaquin in the tropical cyclone forecast/advisories issued in the 48 hours before the sinking. The calculations compared Joaquin’s forecast positions and intensities valid for 0800 on October 1 with the actual, best-track position and intensity on October 1 at 0800 (table 6). Because a forecast is not released (nominally) until 3 hours after the forecast is initiated, the time difference between the product’s scheduled

135 Wind shear is a radical shift in wind speed and direction that occurs over a very short distance. Best track

NTSB

Marine Accident Report

107 dissemination time and 0800 on October 1 was always 3 hours less than the applicable forecast period.136 Table 6. Errors in Joaquin’s center position and intensity predicted for 0800 October 1. Scheduled Forecast/Advisory Dissemination Time Forecast Center Position and Intensity Forecast Period Errors 1100 September 29 26.1N, 073.7W / 55 knots 48 hours 180 nm / 60 knots 2300 September 29 24.8N, 74.1W / 80 knots 36 hours 104 nm / 35 knots 1100 September 30 24.1N, 74.0W / 85 knots 24 hours 62 nm / 30 knots 2300 September 30 23.5N, 73.8W / 110 knots 12 hours 25 nm / 5 knots NOTE: Errors rounded to nearest whole number. Mean 5-year errors (between 2010 and 2014) in the National Hurricane Center’s forecast track and intensity were 77.1 nm/13.3 knots for the 48-hour forecast period, 60.4 nm/11.5 knots for the 36-hour forecast period, 45.0 nm/9.4 knots for the 24-hour forecast period, and 28.4 nm/6.2 knots for the 12-hour forecast period (Berg 2016). 1.10.6 Simulations At the NTSB’s request, the Environmental Modeling Center at NOAA’s National Centers for Environmental Prediction simulated wind and sea-state conditions for Joaquin during the accident time using global atmospheric models, high-resolution hurricane models, and underlying ocean wave and circulation models. The results indicated, in part, that “maximum wind speeds in the area around the time of the accident exceeded 100 knots with waves reaching heights of between 7-10 m[eters] and peak periods of 9-12 s[econds]. Spectral results showed complex crossing sea patterns with swell and multiple wind sea components” (Chawla 2016). Results of the study were used as input values to the NTSB-directed dynamic analysis that simulated motions of El Faro during the storm. 1.10.7 Astronomical Data According to US Naval Observatory data, on the morning of September 30 at 28.65N, 78.66W (El Faro’s approximate position at sunrise), nautical twilight began at 0616, civil twilight began at 0643, and sunrise was at 0707. On the evening of September 30 at 25.65N, 75.81W (El Faro’s approximate position at sunset), sunset was at 1851, civil twilight ended at 1914, and nautical twilight ended at 1941.137 Near the accident site on October 1, nautical twilight began at 0617, civil twilight began at 0624, sunrise was at 0647, sunset was at 1843, civil twilight ended at 1905, and nautical twilight

136 A forecast initiated at 2000 that is valid for 0800 the next day would have a forecast period of 12 hours. 137 The moon rose at 2025 on September 29.

NTSB

Marine Accident Report

108 ended at 1952. The Naval Observatory website defines nautical twilight as the time when “under good atmospheric conditions and in the absence of other illumination, general outlines of ground objects may be distinguishable.” Civil twilight is defined as the time when “illumination is sufficient, under good weather conditions, for terrestrial objects to be clearly distinguished.”138 1.11 Survival Factors 1.11.1 Emergency Response Day 1. At 0706 on Thursday, October 1, the El Faro captain called the company’s DP to inform him that the ship was listing to port and had lost propulsion. At 0724, as required by company procedures, the DP called the Coast Guard Atlantic Area (LANTAREA) command center in Portsmouth, Virginia, which is the Coast Guard Atlantic Area search-and-rescue coordinator, to notify it of the vessel’s distress. The DP set up TOTE’s incident command center in Jacksonville and at 0745 put T&T Marine Salvage company of Galveston, Texas, on notice. At 1130 central daylight time (CDT), ABS headquarters in Houston, Texas, assembled a Rapid Response Damage Assessment (RRDA) group. The RRDA group is a team of naval architects, marine engineers, master mariners, and support staff that conducts structural and stability calculations for shipowners. TOTE kept close contact with the Coast Guard’s Seventh District Command Center (D7CC) in Miami, holding conference calls in the morning, evening, and during search-and-rescue operations. TOTE provided senior liaison employees to D7CC, and the Coast Guard provided liaison officers from Sector Jacksonville. At 0713, El Faro sent an Inmarsat-C distress alert showing a position about 35 nm northeast of Crooked Island. An Inmarsat-C distress alert can be sent by the crew when a ship is in danger. The GMDSS operator on board, typically a ship’s officer, can manually input information, or the GMDSS operator can press and hold down a dedicated distress button for about 5 seconds to transmit an alert. When the button is pressed, a short, preformatted message is transmitted, with priority, from the ship’s terminal to a land earth station, which automatically routes it to a maritime rescue coordination center. The distress alert transmits date and time; the ship’s position, course, and speed; time of last position update; and nature of distress. If the operator formats a customized message without immediately sending it, the vessel’s position is locked in at the time the message was written and is not updated unless the terminal is powered off and restarted. At 0715, the land earth station in Eik, Norway, automatically forwarded El Faro’s alert to the LANTAREA command center. The land earth station also forwarded a supplemental alert that included vessel-specific information. The LANTAREA command duty officer called D7CC and asked it to assume the role of search-and-rescue mission coordinator, work with the Bahamas rescue coordination center to respond, and keep LANTAREA informed. He then forwarded to D7CC the Inmarsat-C alert position as well as the position received from the phone call with the

138 See http://aa.usno.navy.mil/faq/docs/RST_defs.php.

NTSB

Marine Accident Report

109 DP. The Inmarsat-C position was used as El Faro’s last known position for the search-and-rescue operation. Two alerts from El Faro’s SSAS were sent at 0713:49 and 0715:57, respectively, and automatically forwarded by the land earth station in Norway on October 1. The first was sent to the Coast Guard at 0715, with position 23:25.39N, 073:52.51W, course 214°, speed 4 knots. The second SSAS alert was sent to TOTE at 0717, with position 23:25.22N, 073:52.68W, course 227°, speed 10 knots. As noted earlier, the SSAS is a covert distress signal intended for use in case a vessel is attacked. It alerts the company’s security officer and flag state about an attack but generates no audible or visible alarm onboard the vessel and is not broadcast to other ships. The SSAS is activated by pressing a dedicated button at the ship’s emergency communications station, which then transmits the ship’s identity, position, course, and speed. At 0735, a transmission from El Faro’s registered EPIRB was detected by geostationary satellite GOES-East. An EPIRB is a float-free, automatically activated device detectable by satellite anywhere in the world. The device emits a 406-MHz distress signal containing a unique identification code that can be used to reference information about the carrying vessel, including its name, type of survival gear, and emergency points of contact ashore. A geostationary satellite, positioned about 22,000 miles above the earth, provides continuous coverage and receives all information transmitted by an EPIRB for a given region. El Faro’s EPIRB was identified by a unique hexadecimal beacon identifier that was transmitted to the US Mission Control Center through the local user terminal at the NOAA search-and-rescue satellite-aided tracking (SARSAT) facility in Suitland, Maryland.139 The beacon identifier corresponds to registration data held by NOAA.140 If an EPIRB is not equipped with an embedded GPS receiver, alerts received by geostationary satellites will not contain position information.141 El Faro’s EPIRB model did not have a built-in GPS, so the alert was received and forwarded as a “406 beacon unlocated first alert” message. The message was automatically processed at 0739 and sent as an email to D7CC. The position of a non-GPS-enabled EPIRB can, however, be determined to within about 2 miles by low earth orbit satellites, which travel about 1,200 miles above the earth. According to SARSAT, no low earth orbit satellites were in view of El Faro’s position during the 24 minutes the EPIRB was transmitting. The EPIRB stopped transmitting 6 minutes before a low earth orbit satellite passed in view of where the EPIRB had been transmitting.142 Therefore, no position could be derived from the low earth orbit satellite system (NOAA 2016). At 1035, D7CC requested that an Air Force hurricane hunter, which was on a weather reconnaissance mission, fly over El Faro’s last known position, make radio callouts on VHF

139 Distress alerts passed to the US Mission Control Center in Suitland, Maryland, are automatically forwarded by position—in the water to the Coast Guard and on the land to the Air Force. 140 SARSAT 406-MHz emergency beacons are required to be registered with NOAA. Vessel owners must send their identifying information to NOAA when they purchase a new or used EPIRB. 141 The position transmitted by a GPS-encoded EPIRB, available since 1998, is accurate to under 100 yards (NOAA 2017a). 142 The low earth orbit satellites traveled over El Faro’s position between 0622 and 0647 and between 0804 and 0824 on the morning of October 1.

NTSB

Marine Accident Report

110 channel 16, and conduct a radar search.143 The aircraft did so, with negative results. The hurricane hunter was unable to descend below 10,000 feet because of the storm, and radar detection was ineffective due to feedback from heavy precipitation. At 1106, D7CC requested the inter-island freighter Emerald Express, the nearest vessel to El Faro, to proceed to El Faro’s last known position and assist. The captain of the Emerald Express declined, stating that he was in the lee of Acklins and Crooked Island attempting to ride out the storm and could not risk exposing his vessel, a modified landing craft, to higher seas. The Emerald Express made callouts to El Faro on VHF channel 16, heard by the hurricane hunter, with negative results. The Emerald Express did not inform D7CC when it stopped making radio callouts to El Faro. Day 2. On Friday, October 2, the day after the accident, an HC-130 aircraft (CG1503) from Coast Guard Air Station Clearwater, Florida, took off at first light to conduct parallel search patterns to locate El Faro.144 The aircraft could not get within 100 nm of the hurricane because of severe winds at 3,000 feet altitude. The aircraft crew reported a visibility of 2 nm, heavy rain and spray, and heavy seas with whitecaps and foam. When the aircraft returned to base, a fuel leak was discovered that was determined to have been caused by the severe weather, so the next sortie was canceled. At 0905, the search-and-rescue mission coordinator canceled all additional sorties that day because of rough weather. The coordinator explained that an MH-60 helicopter flying at 140 knots into 100-knot headwinds would be flying at a speed over the ground of only 40 knots. Two Coast Guard HC-130s from Air Station Elizabeth City, New Jersey, were temporarily stationed at Coast Guard Air Station Clearwater for the El Faro search-and-rescue operations. D7CC also tasked the Coast Guard medium endurance cutter Northland, on patrol south of Cuba, to assist. The Northland was ordered to proceed to the US Naval Base at Guantanamo Bay, Cuba, for a brief stop for fuel and provisions and then to El Faro’s last known position, as weather permitted. Flying above the hurricane on a storm-surveillance mission, an Air Force hurricane hunter attempted to call El Faro on VHF channel 16 and did a radar search, with negative results. The only air sorties on the first 2 days of the search were the high-altitude weather surveillance missions by the hurricane hunters and the single Coast Guard HC-130 sortie that could not get within 100 nm of the storm. D7CC put into position for the search three Coast Guard MH-60 helicopters that were participating in Operation Bahamas Turks and Caicos.145 Two helicopters from Air Station Clearwater were deployed on Great Inagua Island, Bahamas, and a third was deployed at the

143 The hurricane hunter, a WC-130J Hercules, is a medium-range aircraft flown on weather reconnaissance missions by the Air Force Reserve Command’s 53rd Weather Reconnaissance Squadron at Keesler Air Force Base, Mississippi. The aircraft penetrates tropical disturbances to obtain data on a storm’s movement, size, and intensity. 144 First light means roughly dawn, twilight to sunrise. When the Coast Guard specifies first light, aircraft are expected to be on scene at dawn to maximize the crew’s ability to see objects or people. 145 Operation Bahamas Turks and Caicos was a combined operation of the US Drug Enforcement Administration, the Coast Guard, and the government of the Bahamas to combat drug smuggling to and from the Bahamas.

NTSB

Marine Accident Report

111 Atlantic Undersea Test and Evaluation Center, on the east side of Andros Island, to support search efforts once the storm moved northwest. Day 3. At 0504 on Saturday, October 3, the same Coast Guard HC-130 that had searched the day before took off from Air Station Clearwater and was on station at 0654 (sunrise was at 0703 in Nassau, Bahamas) to begin searching. The HC-130 completed a 4-hour parallel search pattern assigned by D7CC, with negative results. The aircraft made numerous unsuccessful attempts to break through the wind bands to search the drift area that had been computed based on El Faro’s last known position. The aircrew reported challenging search conditions, with visibility as low as 1 nm. Hurricane-force winds caused significant sea spray, white caps, and swells of 20 to 40 feet. The aircraft reported numerous smaller targets on radar but nothing as large as El Faro. Also on October 3, a Coast Guard HC-130 aircraft located a debris field 120 nm northeast of Crooked Island. A Coast Guard MH-60 helicopter relocated the debris field and found three liferings, one of which was stenciled “El Faro.” The helicopter located a second debris field 90 nm northeast of Crooked Island, consisting of small unidentified objects believed to be packing material. Three cutters, the Northland, the Resolute, and the Charles Sexton, were en route to the search area as weather and seas permitted. Day 4. At 0100 on Sunday, October 4, the Northland arrived on scene and assumed duty as on-scene commander of search-and-rescue operations. Three HC-130 aircraft (two Coast Guard and one Air Force), a Navy P-8 aircraft, and a Coast Guard MH-60 helicopter completed first-light and morning searches. The Coast Guard HC-130 and MH-60 located the two separate debris fields spotted earlier. Weather conditions in the search area on October 4 were reported as visibility 10 nm, winds 15 to 20 knots, and seas 2 to 3 feet. Three tugs chartered by TOTE—Sentinel, Sentry, and Hawk—and the cutter Resolute, carrying an MH-65 helicopter, arrived on scene about 1130 and began assisting with search-and- rescue and salvage duties. The TOTE vessel El Yunque searched as it transited the area while sailing from Jacksonville to San Juan. At 1500, an MH-60 helicopter located El Faro’s swamped starboard lifeboat about 7 nm west-southwest of El Faro’s position reported in the Inmarsat-C alert. The helicopter’s rescue swimmer found the lifeboat heavily damaged, with no one aboard. The tug Hawk was directed to investigate and recover the lifeboat. The Navy P-8 reported two liferafts in separate locations. At 1806, the cutter Northland found one of the liferafts at 23.4866N, 073.5883W, about 18 nm northeast of El Faro’s last known position. The ship’s rescue swimmer searched the partially inflated liferaft for any sign of survivors.146 Finding no one on board, the Northland sank the liferaft, to prevent its rediscovery and an ensuing duplicate search for survivors or remains, and proceeded to the position of the second liferaft. The Coast Guard later determined that the second reported liferaft was actually the starboard lifeboat. At 1657 on October 4, the Navy P-8 reported an orange immersion suit about 40 nm west-northwest of El Faro’s last known position. At 1823, a Coast Guard MH-60 helicopter

146 The liferaft’s size (25-person or 6-person) and markings were not recorded in the Coast Guard’s MISLE (Marine Information for Safety and Law Enforcement) database.

NTSB

Marine Accident Report

112 located an immersion suit in that area. The helicopter’s rescue swimmer found that the immersion suit contained human remains, which he described as being in an advanced stage of decomposition. The body’s gender and race could not be determined. About the same time, the Navy P-8 reported another immersion suit 30 nm away, with a possible person in it waving his or her arms. Given the report of a potential surviving crewmember, the Coast Guard helicopter crew decided not to recover the remains at that time but to move toward the position reported by the Navy aircraft. The helicopter recovered its rescue swimmer and dropped a self-locating datum marker buoy (SLDMB) by the remains. The helicopter could not find the second reported immersion suit and, at sunset, returned to attempt to recover the remains. The crew was unable to relocate them. It was discovered later that the marker buoy had failed to transmit its position.147 The helicopter aborted the search when darkness fell, and the Northland went to the scene to search throughout the night. Coast Guard cutters and salvage tugs continued to search on Sunday evening. The immersion suit with human remains was never recovered. As described below, two empty immersion suits were found later in the search. Figure 47 shows the location of the El Faro debris fields and objects discovered during search-and-rescue operations.

Figure 47. Two debris fields located during search-and-rescue operations and El Faro’s last known position from VDR data. Distance between debris fields was about 77 nm. Degrees of latitude are 60 nm apart. Distance between degrees of longitude varies with distance from equator, where it is about 60 nm. (Adapted from Coast Guard graphic)

147 According to the Coast Guard, an SLDMB transmits real-time GPS position and water temperature to a satellite. The data are updated every 30 minutes for 10 days. The SLDMB used during the search, version 2, had a 62-percent success rate, a 16-percent partial success rate, and a 22-percent failure rate. After the accident, the Coast Guard transitioned to a new Iridium SLDMB.

NTSB

Marine Accident Report

113 Day 5. On Monday, October 5, a fixed-wing Navy P-8 and two Coast Guard HC-130s completed first-light and morning searches of the large debris fields and passed information about targets for investigating to the cutters, tugs, and helicopters. The fixed-wing aircraft were relieved in the afternoon by an Air Force and a Coast Guard HC-130. Searchers reported that visibility was unlimited, winds were 14 knots, and seas 2 to 3 feet. In the early morning, an Air Force Joint Surveillance Target Attack Radar System (JSTARS) reconnaissance aircraft assisted the search effort while transiting the search area. The JSTARS aircraft conducted high-altitude sweeps of 19,305 square miles at a time. It confirmed the debris fields and that there was no large vessel in the search area. The JSTARS information helped establish that El Faro had sunk, which led the Coast Guard to change the accident’s classification to a major marine casualty. At 1000 on October 5, the Coast Guard announced at a morning press conference that the search would continue for survivors, but that from the debris that had been found, it was likely that El Faro had sunk. A Navy P-8 aircraft continued to support search efforts using a highly sensitive radar. The P-8 was initially used to search for the vessel at a very high altitude, which significantly increased the area searched. As weather conditions improved, the P-8 began to fly at lower altitudes (2,500 feet) to search for smaller objects. Searchers began recovering El Faro survival equipment during the day. Three lifebuoys, stenciled “El Faro” or “El Morro,” were recovered and secured on board the cutter Resolute and the tug Sentry.148 The three cutters continued to search throughout the night of October 5–6, with the three tugs remaining on scene in support. Day 6. On Tuesday, October 6, a fixed-wing Navy P-8 and a Coast Guard HC-130 completed morning searches, with negative results. An MH-60 helicopter searched for washed-up debris along the Bahamas island chain near Long Island, Great Exuma, and Cat Island. The three cutters continued to follow search patterns, and the three tugs remained on scene in support. Three HC-130 aircraft (one Coast Guard and two Air Force) searched in the afternoon. Searchers reported visibility of 10 nm, winds from 190° at 5 knots, and seas 1 to 2 feet. At 1808, the cutter Charles Sexton recovered an empty immersion suit, stenciled “El Faro.” The three cutters continued to search throughout the night, and the three tugs remained on scene supporting the search. Day 7. On Wednesday, October 7, a Navy P-8 and three HC-130 aircraft (two Coast Guard and one Air Force) searched from 0800 to sunset, with no significant sightings. The three Coast Guard cutters (Northland, Resolute, and Charles Sexton) searched throughout the day. At 1433, the Charles Sexton located and recovered a second empty El Faro immersion suit. The three tugs chartered by TOTE were on scene supporting search efforts. Searchers reported that visibility was 10 nm, winds were from 227° at 3 knots, and seas were 1 foot. At 1900 (sundown) on October 7, after informing the crew’s family members, the commander of Coast Guard D7CC suspended active search for the 33 persons on El Faro, pending further developments, and released all Coast Guard, Air Force, and Navy search-and-rescue assets. The survivability time of 120 hours predicted by the probability of survival decision aid (PSDA)

148 This was the first El Faro survival debris to be recovered. The partially inflated liferaft was not recovered.

NTSB

Marine Accident Report

114 had been exceeded (154 hours actual time in the water) without any survivors being found.149 From October 3 to October 7, 15 different Coast Guard, Air Force, and Navy assets conducted 50 air and surface sorties, totaling about 275 hours and covering 195,601 square miles. 1.11.2 Lifesaving Equipment Coast Guard regulations for lifesaving equipment (“lifesaving appliances and arrangements”) are found at 46 CFR subchapter W (Part 199). The regulations reflect the requirements of SOLAS chapter III. El Faro was required to carry specific survival gear by its Coast Guard COI. Table 7 summarizes the type and quantity of survival equipment carried on the vessel, as listed in El Faro’s June 2015 monthly safety inspection records and by ABS in its Record of Approved Cargo Ship Safety Equipment dated February 23, 2006 (with updates on February 23, 2007; February 2, 2009; and April 2, 2010). The table indicates whether the equipment was detected or recovered after the accident. The manufacturer, dates of manufacture and approval (if known), and other details of the survival gear carried on El Faro are given in appendix F. Table 7. Lifesaving appliances required by El Faro’s COI. Appliance Number Required by COI Persons to Accommodate Number on Board Found or Detected After Accident Recovered Lifeboat (starboard) 1 43 1 1 1 Lifeboat (port) 1 43 1 1 0 Inflatable rafts (liferafts) 3 46 5a 1 0 Life preservers (lifejackets) 45 1 each 65 1 0 Ring buoys (lifebuoys): 14 1 each 31 8 8b With lights (8) (c)

15d

-- With line attached (2) (c)

2

-- Other (4) (c)

14e

-- Immersion suits 45 1 each 51 3 2

149 Since June 22, 2010, the Coast Guard has used the PSDA model for all cases involving persons in the water and where people are at risk of hypothermia or dehydration when not immersed. The PSDA model is a physiologically based model of both heat and water loss for survivors immersed in water or in open air. Modeling for El Faro used the following input: air temperature 81°F; water temperature 84°F; relative humidity 76 percent; wind speed 13.6 knots; gender–female; height 5 feet 4 inches; weight 154.8 pounds.; fat 34 percent; immersed in water to the neck; turbulent heat loss; and wearing a survival suit.

NTSB

Marine Accident Report

115 Appliance Number Required by COI Persons to Accommodate Number on Board Found or Detected After Accident Recovered Portable lifeboat radios 2 n/a 3 0 0 EPIRB 1 n/a 1 0 0 NOTE: n/a = not applicable. a Two extra liferafts were on board. According to TOTE, when two liferafts (25 persons each) were added to El Yunque as a precaution after corrosion was found on the lifeboat davits, the same addition was made to El Faro. b None of the recovered ring buoys had attachments. c Included in total. d Two were equipped with smoke floats. One smoke float was recovered after the accident, and one was detected on the ocean floor. Smoke floats are floating markers that produce dense orange smoke for at least 15 minutes. e includes 1 spare. Lifeboats. El Faro was equipped with two 43-person open lifeboats, both manufactured by Marine Safety Equipment Corporation (MASECO), which later came under the ownership of Harding Safety.150 The port lifeboat was powered by a diesel engine. The starboard lifeboat was mechanically propelled by Fleming gear, a means of manually driving a boat forward without using oars. Hand-operated levers on each side of the boat are moved backward and forward, transmitting power by means of rods and gears to the propeller shaft, which gets the boat under way. Open lifeboats and mechanically propelled lifeboats are allowed only on ships constructed before July 1, 1986.151 A record search by Harding Safety found that El Faro’s survival systems— lifeboats, davits, winches to recover the lifeboats, and hooks to release the lifeboats—were original equipment. Both lifeboats were designed to be launched from gravity davits, with wire ropes (called fall wires) used to lower them into the water. The davits rolled on tracks. Stopper bars on the tracks kept the boats from traveling too far when being hoisted. The fall wires, which were wound on winches controlled by brakes, traveled across the davits to the boats through grooved pulleys, or sheaves. Wire ropes called gripes held the lifeboats in place in their cradles while the ship was under way. If a lifeboat was launched, frapping (“tightening”) lines would be passed around the fall wires on the bow and stern to keep the boat from excessively swaying. Suspended wires for hauling and lashing, known as tricing pendants, would be used to keep the lifeboat close to the ship during loading. A mechanical apparatus (Rottmer gear) equipped with a releasing handle would be used to disengage the lifeboat from its falls as the final stage in launching. Figure 48 shows a gravity

150 MASECO was founded in 1945 in Point Pleasant, New Jersey, and merged into Schat-Watercraft, Inc., in

1. Harding Safety, based in Norway, was formed in 2013 by the merger of Schat Harding and another Norwegian

company, Noreq. In June 2016, Harding Safety was acquired by the Palfinger Group. Harding Safety is now Palfinger Marine. 151 Lifeboat standards and regulations are discussed in section 1.11.4.

NTSB

Marine Accident Report

116 davit with a lifeboat such as those carried on El Faro in both stowed and launch positions, as well as various parts of the launching apparatus.

Figure 48. Gravity davit with lifeboat in stowed and launch positions. The procedure for launching El Faro’s lifeboats, based on the builder’s instructions, was as follows: • Remove lifeboat cover and place cap in drain plug. • Release gripes and stopper bars. Clear them away. Important to swing stopper bars clear of trackways. Be sure they are secured in open position by toggle pins. Otherwise bars are liable to swing back on trackways. • Raise brake handle. Check speed with hand brake and ease davit over side. Tricing pendant will bring lifeboat to ship’s side.

NTSB

Marine Accident Report

117 • Hold lifeboat with frapping lines and unhook tricing pendant. • Load boat. • Ease off frapping lines. • Lower to water. Control operation with hand brake. • As boat reaches water level, allow winch to run out sufficient fall wire to permit easing of Rottmer release hooks. This is accomplished by throwing release handle in boat. A Harding Safety technician was aboard El Faro on August 4, 2015, to conduct the annual inspection of the lifeboats and associated launching appliances. The technician found the davits, winches, lifeboats, and hooks to be in operational condition and observed no major faults. The limit switches on the winch motors were inspected, tested, and found to be working properly.152 The brakes were opened and inspected, then tested by lowering an empty boat and abruptly applying the brake. The engine and hook release were tested in the water on the port lifeboat. Because the vessel was moored to starboard, the starboard lifeboat could not be lowered to the water for the hook-release test. The technician noted that the winches and davits showed some scale or corrosion on hardware and foundations and that El Faro’s crew was to clean the corrosion before the technician’s scheduled follow-up visit on November 4, 2015 (to repair fiberglass damage to the lifeboats caused by their lashings). The technician recommended replacing both freewheel clutches, which were leaking oil, and the starboard winch clutch, which was making a “strange noise.” Another Harding Safety technician was on board the day before and the day of El Faro’s departure on the accident voyage (September 28 and 29) to install and test two new freewheel clutches in the lifeboat winches. The technician reported that both lifeboat brakes and winches were in proper working order. A TOTE port engineer testified to the marine board that the company did not notify ABS or the Coast Guard to give them an opportunity to attend the work on the lifeboat winches, as required. Liferafts. El Faro carried five liferafts, although only three were required. Coast Guard requirements for the carriage of liferafts are found at 46 CFR 199.261. The aggregate capacity of the liferafts must accommodate 150 percent of the total number of persons on board. Four 25-person liferafts were stowed on the boat deck, two on each side aft of the lifeboats (see figure 49). Two liferafts were manufactured in October 2005 by Viking Life-Saving Equipment and last visually inspected on September 4, 2015. The inspecting technician noted that the necessary additional pressure test (required for liferafts more than 10 years old), gas inflation test, and floor seam test were all within periodicity and that the liferafts were not due for servicing until

152 A limit switch stops the winch motor before the davit that is being hoisted reaches its stowed position. Failure to stop hoisting could overload the lifeboat fall wires.

NTSB

Marine Accident Report

118 September 2016.153 The other two 25-person liferafts were manufactured by Survitec Group, Inc., in July 2015 and were not due for service for 2 years.

Figure 49. Location of liferaft stowed below El Faro’s starboard lifeboat. (Photo by Maine Maritime Academy cadet, summer 2015) The 25-person liferafts were packed in fiberglass containers for storage on deck (see figure 50). Each container weighed between 380 pounds (Viking model) and 406 pounds (Survitec model) and required two people to launch. The containers were designed to be thrown overboard while attached to a painter (short line) secured on the ship. The other end of the painter was attached inside the container to a cylinder of compressed gas (CO2). When the painter was pulled, the liferaft inside the container would inflate and the container would pop open. Crewmembers would ordinarily climb down a Jacob’s ladder into the liferafts, but the liferafts could also be entered from the water.154

153 The necessary additional pressure test is required at yearly intervals for liferafts older than 10 years by SOLAS resolution A.761(18), “Recommendation on Conditions for the Approval of Servicing Stations for Inflatable Liferafts” (appendix 1, “Necessary additional pressure (NAP) test,” and appendix 2, “Frequency of NAP tests”), November 1993. 154 A Jacob’s ladder is a rope ladder, usually with wooden rungs, used to board vessels at sea.

NTSB

Marine Accident Report

119

Figure 50. Type of containerized 25-person liferaft carried on El Faro. (Photo courtesy Survitec) The procedure for launching the 25-person liferafts was as follows: • Release manual slip hook. • Check that painter is made fast. • Throw liferaft into sea. • Pull on painter until liferaft inflates, then pull liferaft to ship’s side. • Vital actions after launching: − Right liferaft if it is upturned. − Board quickly. − Move clear of ship. − Stream sea anchor.155 − Close entrances. The 25-person liferafts had an automatic underwater release in case the ship should sink before the appliances could be launched. A liferaft would be released and float upward, then inflate, break free of the ship, and float to the surface. Figure 51 shows an inflated 25-person liferaft manufactured by Viking.

155 A sea anchor is a parachute-like drag made of canvas or sailcloth that can be thrown overboard to retard drifting.

NTSB

Marine Accident Report

120

Figure 51. Inflated 25-person liferaft. (Photo courtesy VIKING Life-Saving Equipment A/S) As the extra liferaft required by the Coast Guard for vessels over 100 meters (328 feet) long, El Faro carried a 155-pound, 6-person liferaft. It was stowed forward on the main deck near the centerline, where it could be picked up by two crewmembers and launched from either side. It was a Viking model manufactured in November 2010. It had been inspected on May 18, 2015, and was due for a 12-month inspection in May 2016. Lifejackets. All inspected vessels in the United States are required by 46 CFR 199.70(b) to carry lifejackets for each person on board. A sufficient number of lifejackets must be carried for watchstanders and for use at remote survival craft stations. Stowed lifejackets must be readily available. The additional lifejackets for persons on watch must be stowed on the bridge, in the engine control room, and at other manned watch stations. According to ship records, El Faro carried 65 adult lifejackets equipped with whistle and light. The Coast Guard approved the lifejackets as “Former—May Use,” indicating that the manufacturer no longer made the equipment.156 The lifejackets were stowed in crew accommodations and work spaces. No lifejackets were recovered after the accident. The minimum standard lifejacket required on El Faro would have been a Coast Guard-approved, inherently buoyant type I PFD. The lifejacket is designed to turn an unconscious adult’s head face up and hold it above the water. It is used for all waters, including the open ocean, rough seas, or remote waters where rescue may be slow in coming. Immersion Suits. Immersion suits, also called survival suits, are designed to protect against the loss of body heat. They are required to be both insulated and buoyant.157 Approved

156 Safegard Corporation, Covington, Kentucky, manufactured or distributed the lifejackets. The company is no longer in business, according to an internet search and a Coast Guard marine safety alert published in July 2016 (safety alert 07-16). 157 Coast Guard requirements for the construction and performance of immersion suits are found at 46 CFR 160.171-9 and 160.171-11. Requirements for carriage of immersion suits by cargo vessels are found at 46 CFR 199.273.

NTSB

Marine Accident Report

121 immersion suits must provide the wearer with sufficient thermal insulation to ensure that his or her body core temperature does not fall more than 3.6°F after 6 hours of immersion in calm, circulating water of between 32°F and 35.6°F. A person must be able to don an immersion suit in 2 minutes after reading the instructions. Immersion suits are required to turn an unconscious person face up in the water and be fitted with retroreflective material and a light. They must prevent “undue ingress of water . . . following a period of flotation in calm water of one hour” (46 CFR 160.171-11[f]) but are not required to be watertight. They must have a means of preventing water spray from directly entering the wearer’s mouth, must not undergo prolonged burning or melting when enveloped in fire for 2 seconds, and must be oil-resistant and usable after a 24-hour exposure to diesel oil. According to the regulations, an adult-size immersion suit must fit both males and females weighing from 110 to 330 pounds and standing between 59 and 75 inches tall. A small-adult or child-size suit must fit both male and females who weigh from 44 to 110 pounds and measure between 39 and 59 inches in height. An oversize adult suit is intended for a person too large for a standard adult suit. Survival time for persons in the water is affected by several factors, including proper use of survival equipment, weather conditions, time in water, body type, health, and knowledge of survival techniques. The main danger is hypothermia, which occurs when the body loses heat faster than it can produce it, causing the body’s core temperature to drop below 95°F. As core body temperature drops, the organs stop functioning, which can lead to heart failure, respiratory system failure, and death. Water does not have to be extremely cold to cause hypothermia; it need only be cooler than normal body temperature (98.6°F) to bring about heat loss. Without immersion suits, the expected survival time for a person in the water ranges from 30 to 90 minutes in cold, 32.5°F water to an indefinitely long time in warm water (above 80°F). With immersion suits, the expected survival time in cold water ranges from 2 1/2 to 5 1/2 hours, depending on whether the suit leaks or stays dry, to indefinitely long in water above 50°F. Figure 52 shows expected survival time as a function of water temperature. According to logs kept by the Coast Guard cutter Northland, on October 4, the water temperature in the El Faro search area was 85°F to 87°F.

NTSB

Marine Accident Report

122

Figure 52. Probability of death from hypothermia as a function of water temperature and time immersed in water. (Graph from IMO/ICAO 2007; reprinted by permission158) El Faro was outfitted with 51 immersion suits. The AMOS maintenance system shows a purchase order for required 2-year inspection and pressure-testing of 52 immersion suits on August 6, 2015, by Liferafts Inc., of Puerto Rico. On August 8, El Faro’s captain reported to the TOTE port engineer that 52 immersion suits had been inspected and tested (47 satisfactory and 5 condemned). AMOS recorded a purchase order, dated August 19, for 4 oversize adult immersion suits. A former chief mate told investigators that the new immersion suits were received, but he was not sure if they had been stenciled “S.S. El Faro” before the accident. Maintenance records indicate that 11 spare immersion suits were stored in the spares locker on the cabin deck, near fire station 7. The Coast Guard was asked during the marine board to conduct an experiment on whether immersion suits such as those carried by El Faro would remain afloat after an extended time in the water. In June 2016, the Coast Guard Research and Development Center tested two weighted mannequins wearing Coleman-Stearns I590 immersion suits (Lewandowski and Clark 2016). The mannequins floated in waters of the Mobile River in Alabama for 2 weeks, under benign conditions. After recovering the mannequins, researchers concluded that the immersion suits had

158 NOTICE: Material from the IMO publication “IAMSAR Manual, vol. II. (IF961E)” is reproduced with the permission of the IMO, which does not accept responsibility for the correctness of the material as reproduced: in case of doubt, IMO’s authentic text shall prevail. Readers should check with their national maritime administration for any further amendments or latest advice. International Maritime Organization, 4 Albert Embankment, London, SE1 7SR, United Kingdom.

NTSB

Marine Accident Report

123 retained their buoyancy. Less than a liter (1 quart) of water had intruded into each suit. However, about 10 pounds of seaweed had grown at the waterlines of the suits. Lifebuoys. The vessel was equipped with 31 orange lifebuoys, 30 inches in diameter, stowed in various locations. Two with attached lights and smoke floats, which create a distress signal of dense orange smoke that lasts at least 15 minutes, were stored on the bridge wings. The rest were on the weather decks: 13 with attached lights, 2 with throwing line, 13 with no attachments, and 1 spare. Recovered Lifesaving Equipment. El Faro’s starboard lifeboat was discovered during the search-and-rescue operation at 1500 on October 4, swamped and floating bow up. The lifeboat was too big for the tug Hawk to recover, so TOTE chartered the offshore support vessel Megan Beyel to salvage the boat and deliver it to the Port of Miami. The lifeboat was brought to Coast Guard Air Station Miami and inspected (figure 53).

Figure 53. El Faro’s starboard lifeboat on arrival at Coast Guard Air Station Miami. Note fouled propeller, bent propeller blade, and damage to port and starboard sides of hull. The operations director of Harding Safety told investigators, on being shown a photograph, that the damage to the starboard lifeboat was “indicative of a fall and not [of] a lifeboat actually being released.” The damage to the starboard lifeboat is described in appendix F, which gives details of all survival debris from El Faro that was discovered during the search-and-rescue operation or in the days or months afterward. The gravity davits of the starboard lifeboat were found intact during the search for the vessel’s VDR. The port lifeboat was not found during the 7 days of search-and-rescue operations. On the first VDR search mission, during which the wreckage of El Faro was examined, investigators noted that the lifeboat was not in its davits. The davits were broken and hanging on the hull below

NTSB

Marine Accident Report

124 the ship’s boat deck. On the second VDR search mission, searchers discovered the port lifeboat on the seafloor, at a depth of 15,364 feet. The major damage noted was that the lifeboat’s stern was missing (it was not found). The Harding Safety director told investigators that from the photographs, the port davits appeared to have been damaged by the impact force of wave action, such as heavy seas at the height of the boat deck. He said the port lifeboat looked to have been damaged by heavy seas while it was hanging in the fall wires and that the stern would have been torn off when the boat fell stern first from a significant height. In his opinion, the lifeboat had not been launched. A partially inflated liferaft of unrecorded size was discovered during the search-and-rescue operation on October 4. The liferaft was searched by a Coast Guard rescue swimmer for survivors or remains. None were found. The liferaft was confirmed to be from El Faro and was sunk to prevent its rediscovery by the Northland and an ensuing duplicate search for survivors or remains. None of the five El Faro liferafts were recovered, and none were observed in a stowed position on the wreckage. The cutter Charles Sexton recovered two of El Faro’s immersion suits after the accident. The first suit was recovered on October 6. The back was marked “S.S. El Faro San Juan, P.R.” in white but appeared to have been previously marked “El Morro” in black. The second immersion suit (figure 54) was recovered on October 7. It was found with whistle and strobe light (turned off but operational); unzipped, left arm inside out, torn almost in half at right hip seam; and back marked “S.S. El Faro San Juan, P.R.” in white but appeared to have been previously marked “El Morro” in black. As noted earlier, an immersion suit containing human remains was located but could not be recovered.

Figure 54. Immersion suit recovered on October 7, 2015.

NTSB

Marine Accident Report

125 According to maintenance records for June 2015, the recovered immersion suits were spare immersion suits Nos. 48 and 50. Both were last inspected and pressure-tested in July 2013 by Liferafts Inc., of Puerto Rico, and each had a light with an expiration date of April 2016. Eight of the vessel’s lifebuoys were recovered. One smoke float was found on the ocean floor during the second VDR search. Three new Coast Guard type II PFDs (near-shore buoyant vest for recreational use) were recovered but were determined to be part of El Faro’s cargo. Maintenance of Lifesaving Gear. Maintenance was tracked by a spreadsheet maintained on El Faro. According to 2015 AMOS records, El Faro’s crew tested the engine in the port lifeboat and the Fleming gear in the starboard lifeboat weekly through September 27. The lifeboats were inspected monthly, through June, though no inspection of the port lifeboat was listed for March. The davit-releasing gear was scheduled to be greased monthly; records show three months missed for the starboard lifeboat and one month missed for the port lifeboat during 2015. The diesel engine on the port lifeboat, which was scheduled for yearly servicing, was last serviced on July 30. Crewmembers had to manually enter the records on the spreadsheet. During 2015, according to purchase orders, contractors completed numerous surveys, inspections, and maintenance of El Faro’s lifesaving equipment. The purchase orders included the annual inspection of the vessel’s two 25-person liferafts on September 1, the purchase of 4 oversize immersion suits on August 19, and the purchase of 12 batteries for the water lights on the vessel’s lifebuoys on July 27. The last required tests and inspections of El Faro’s lifeboats were performed by ABS on January 1, 2011 (5-year renewal of fall wires); on January 29, 2011 (5-year full-weight test of davit and brake); and on January 9, 2015 (light-weight test and annual examination per SOLAS regulation III/20.11.2.2 of lifeboat and Rottmer-type releasing gear). 1.11.3 Emergency Procedures Emergency Signals. The fire and emergency command station was the bridge. The signal for fire and emergency was one continuous blast of the ship’s whistle and continuous ringing of the general alarm bells, both sounded for not less than 10 seconds, coupled with an announcement on the public-address system. The signal to abandon ship was more than six (seven or more) short blasts followed by one long blast of the ship’s whistle and the same on the general alarm bells (seven or more short rings, then a long ring). Muster Stations. The vessel’s station bill, also known as the muster list, assigned various duties associated with emergencies to each person on board and also assigned individuals to muster stations and survival craft. Title 46 CFR 199.80 states, “The muster list must be posted before the vessel begins its voyage. After the muster list has been prepared, if any change takes place that necessitates an alteration in the muster list, the master must either revise the existing muster list or prepare a new one.” Station bills are typically posted in living quarters and work spaces throughout a vessel. Part of El Faro’s station bill consisted of crew assignments in case of emergency or abandon ship (table 8). The captain was in command of all emergency operations and commanded lifeboat 1. The chief mate was in charge at the scene of an emergency and in command of

NTSB

Marine Accident Report

126 lifeboat 2. The second mate had charge of the muster and was second in command of lifeboat 1, responsible for emergency communication equipment. According to the station bill, El Faro had two emergency squads, with the third mate and bosun in charge. Emergency squad 1 would muster at emergency gear locker 1, which was on the upper deck just aft of the crew’s mess. Emergency squad 2 would muster at emergency gear locker 2 on the main deck in the vicinity of the fire control room and the cargo office. The extra crew and supernumeraries were to muster in the crew’s mess on the upper deck to assist as directed. Table 8. Duties for emergencies and abandon ship, as specified on station bill. Billet (Position) Emergency Duties Abandon-Ship Station and Duties Deck Department Master (captain) In command all operations, GMDSS Lifeboat 1, in command Chief mate In charge at the scene Lifeboat 2, in command Second mate In charge of muster, then report to bridge Lifeboat 1, second in command, lifeboat radio/SART/EPIRB Third mate Leader, emergency squad 2 Lifeboat 2, second in command Bosun Leader, emergency squad 1 Lifeboat 2, brake/winch operator AB maint. 1 Emergency squad 2 Lifeboat 1, assist as directed AB maint. 2 Emergency squad 1 Lifeboat 2, assist as directed AB, 12–4 watch Relieve helm Lifeboat 1, assist as directed AB, 4–8 watch Emergency squad 2 Lifeboat 1, assist as directed AB, 8–12 watch Emergency squad 1 Lifeboat 2, assist as directed Deck GUDE Emergency squad 2 Lifeboat 1, assist as directed Deck cadet 1 Report to crew mess and assist as directed Lifeboat 1, assist as directed Deck cadet 2

Report to crew mess and assist as directed Lifeboat 2, assist as directed Engine Department Chief engineer Engine room, in charge Lifeboat 1, assist as directed First engineer Assist as directed in engine room Lifeboat 2, assist as directed Second engineer Assist as directed in engine room Lifeboat 1, assist as directed Third engineer, 12–4 watch Remain on watch or in fire control room Lifeboat 2, run motor Third engineer, 8–12 watch Remain on watch or in fire control room Lifeboat 2 assist with motor Electrician Run emergency diesel generator and/or assist chief mate at scene Lifeboat 1, brake/winch operator OMU, 12–4 watch Remain on watch or report to crew mess and assist Lifeboat 2, assist as directed OMU, 4–8 watch Remain on watch or report to crew mess and assist Lifeboat 2, assist as directed

NTSB

Marine Accident Report

127 Billet (Position) Emergency Duties Abandon-Ship Station and Duties OMU, 8–12 watch Remain on watch or report to crew mess and assist Lifeboat 1, assist as directed Engine GUDE Emergency squad 1 Lifeboat 1, assist as directed Engine cadet 1 Report to crew mess and assist as directed Lifeboat 1, assist as directed Engine cadet 2 Report to crew mess and assist as directed Lifeboat 2, assist as directed Steward Department Steward Assist with muster and report results to bridge via radio Lifeboat 2, assist as directed Chief cook Secure galley, muster, and assist as directed Lifeboat 1, assist as directed Steward assistant Bridge messenger, secure all doors up to bridge Lifeboat 2, provide lifeboat radio and SART Supernumeraries Rider 1 Report to crew mess and assist as directed Lifeboat 1, bring lifejacket and warm clothing Rider 2 Report to crew mess and assist as directed Lifeboat 2, bring lifejacket and warm clothing Rider 3 Report to crew mess and assist as directed Lifeboat 1, bring lifejacket and warm clothing NOTE: This table is based on an electronic station bill copied from an off-duty chief mate’s computer from September 2015. The date of the station bill is unknown, and entries do not represent the exact crew complement carried on the accident voyage. For example, the station bill includes four blank slots for cadets (such as those carried in 2015) and lists only three supernumeraries. OMU = oiler maintenance utility. The station bill shows that supernumeraries were to report to the crew mess for emergencies and that each was assigned to a lifeboat for abandon ship (about half to lifeboat 1 and half to lifeboat 2). A former supervisor of the riding gang testified that the Polish workers were briefed on liferafts through a translator and could launch a liferaft on their own. Safety Drills and Meetings. Vessels registered in the United States are required by 46 CFR 199.180(c)(2) to conduct monthly fire and boat drills. TOTE required weekly fire/emergency and abandon-ship drills, weather permitting. At the end of each month, the El Faro captain would review the deck logs and submit them to TOTE. Deck logs for September 2015 were not submitted. However, according to an unsigned electronic training logsheet that was obtained from a chief mate who had departed the vessel before the accident voyage, fire, emergency, and abandon-ship drills were held on September 10. According to the September 10 logsheet, the drill involved a fire in the officers’ spare room. The crew mustered and fire teams suited up. Both teams fought the fire and conducted fire nozzle training. They then sounded the abandon-ship signal and the crew mustered at lifeboat stations. Both lifeboats were lowered to the embarkation deck, where the crew discussed their duties. After the drill, the crew discussed lessons learned.

NTSB

Marine Accident Report

128 Title 46 CFR 199.180(d)(4) requires: “Each lifeboat must be launched with its assigned operating crew aboard and maneuvered in the water at least once every 3 months during an abandon-ship drill.” The last verifiable date the ship’s port lifeboat was lowered into the water during a drill was March 6, in San Juan harbor, as part of a Coast Guard annual examination and fire and abandon-ship drill. The Coast Guard inspector stated that the lifeboat was lowered to the embarkation deck and that the sheaves and brakes were checked. The boat was stopped while being lowered to verify that the brakes held. The inspector stated that the crew was competent in the drills, that they knew their jobs, and that radio communication was good. The inspector checked the manual Fleming gear on the starboard lifeboat, that the liferafts were properly stowed, and that the service tabs matched the Coast Guard’s records. The inspector stated that the crew mustered in lifejackets and that he spot-checked their survival suits. The last verifiable date that El Faro’s starboard lifeboat was lowered was June 5, in San Juan. The signed muster sheet shows that nine crewmembers, led by the chief mate, participated. The lifeboat was lowered to the dock and placed in its cradle. The brakes were tested during lowering, the releasing gear and Fleming gear were exercised, and the limit switches were tested. All were found to be in “good order.” El Faro conducted its last monthly safety meeting on September 24, while in San Juan. It lasted 22 minutes. The meeting reviewed the previous safety meeting’s minutes, which included using personal protective equipment during docking and cargo operations. The chief mate emphasized wearing a safety harness while deploying the ship’s gangway, and the second mate discussed the watchstanding AB’s gangway duties and responsibilities. The ship’s safety committee noted that the company’s SMS manuals were available in the captain’s office and on the ship’s network computer for crewmembers to review. Abandon-Ship Requirements. SOLAS section III, regulation 31 (“Survival craft and rescue boats”), paragraph1.5, states, all survival craft required to provide for abandonment by the total number of persons on board shall be capable of being launched with their full complement of person and equipment within a period of 10 min from the time the abandon ship signal is given. 1.11.4 Lifeboat Standards and Regulations International requirements for lifeboats and other lifesaving appliances are codified in SOLAS 1974, as amended. Design differences between old and current lifeboats are separated by the 1983 amendments to SOLAS 1974, which modernized many lifesaving requirements. The amendments came into effect for cargo ships constructed on or after July 1, 1986. Open lifeboats such as those El Faro carried were not allowed on newly built vessels, although a relaxation of that prohibition for cargo ships (except oil or gas tankers and gas carriers) was in effect until July 1, 1998. Table 9 summarizes the differences between the design requirements for lifeboats before and after the 1983 amendments came into force.

NTSB

Marine Accident Report

129 Table 9. Lifeboat design criteria before and after SOLAS amendments took effect. Design Criterion Former (Before July 1,1986) Open Lifeboats Current (Since July 1, 1986) Fully Enclosed Lifeboats Maximum wind speed for launching lifeboat No requirement for maximum wind No requirement for maximum wind Maximum sea state for launching lifeboat No requirement for maximum seas No requirement for maximum seas Maximum list Capable of being safely launched under all conditions of list of up to 15° either way (inboard or outboard) Capable of being safely launched under all conditions of list of up to 20° either way (inboard or outboard) Maximum trim Capable of being safely launched under all conditions of trim of up to 10° either way (forward or aft) Capable of being safely launched under all conditions of trim of up to 10° either way (forward or aft) Chapter III of the SOLAS regulations is devoted to lifesaving appliances and arrangements. In addition to the prohibition against open lifeboats, manually propelled lifeboats such as the one carried on El Faro that used Fleming gear were no longer allowed under the 1983 amendments to SOLAS: “Every lifeboat shall be powered by a compression ignition engine” (regulation 41, paragraph 6.1). The regulation is now found in the International Lifesaving Appliance Code, section 4.4.6.1. Both open and enclosed lifeboats are launched by gravity davits, with generally similar launching methods. Lifeboats can be launched with gravity davits as long as the davits meet the latest lifesaving appliance and SOLAS requirements for the installed lifeboat. Enclosed lifeboats have reserve buoyancy when the doors and ports are closed (watertight), protect the occupants from exposure to the elements, and can be fitted with a water-spray system and air supply.159 In addition to reserve buoyancy, design requirements for enclosed lifeboats include self-righting, damage testing, and engine propulsion. El Faro was inspected and surveyed in accordance with the SOLAS regulations applicable to its delivery date of January 1975 (SOLAS 1974 or SOLAS 1974, as amended).160 A vessel is surveyed under the same regulations as long as it is in service or until it undergoes a major modification. If the vessel undergoes a major modification, it must comply with the SOLAS requirements current at that time as far as is reasonable and practicable, as determined by the local Coast Guard Officer in Charge, Marine Inspection (OCMI). In 1993, while El Faro was named Northern Lights, the vessel began what the Coast Guard determined to be a major modification. The OCMI in Mobile, Alabama, advised, “All modifications to the vessel must comply with the most recent SOLAS amendments.” However, he stated further, “As a practical matter, all aspects of the vessel not being modified may remain as

159 The water-spray system is for fire protection. Fire-protected lifeboats are required to have an air supply lasting at least 10 minutes with the engine operating normally. 160 The convention in effect when El Faro’s keel was laid was SOLAS 60.

NTSB

Marine Accident Report

130 is, but whenever equipment, such as lifeboats, need replacement they must meet the most recent standards.” The lifeboats were not required to be upgraded at that time. 1.11.5 Conventional vs. Freefall Lifeboats As of October 2, 2017, according to the Coast Guard, 311 inspected vessels in the United States were equipped with lifeboats. Half (152, or 49 percent) of vessels that held valid COIs were equipped with side-launched open lifeboats (grandfathered to pre-1983 amendment standards). A total of 110 vessels (35 percent) were equipped with side-launched fully enclosed lifeboats, and 49 (16 percent) were equipped with stern-launched freefall lifeboats (figure 55).

Figure 55. Stern-launched freefall lifeboat on large container ship. Orange lifeboat is shown in launch position amid stacks of containers. (Photo by Sascha Heuer; used by permission) Stern-launched freefall lifeboats are stowed in the ready-to-launch position and require fewer steps to launch than side-launched lifeboats (Nelson et al. 1994). Only one stern-launched freefall lifeboat is required, as opposed to two conventional side-launched lifeboats. A freefall lifeboat can be launched in high seas under storm conditions because launching does not depend on the hooks and fall wires used to lower side-launched lifeboats. A freefall lifeboat can be launched by one person in about 3 minutes. Crewmembers enter the lifeboat and strap themselves in before the lifeboat is released and falls into the water. Freefall lifeboats are self-righting and,

NTSB

Marine Accident Report

131 after being dropped into the sea, can be 330 feet away from a ship or platform in 6 seconds (PBS 2000). Both davit-launched and freefall lifeboats are required to safely launch under conditions of 20° of list and 10° of trim. In addition, freefall lifeboats must have a secondary means of launch that can safely launch under 5° of list and 2° of trim.161 Retrofitting vessels for stern-launched freefall lifeboats would require reinforcement to accommodate an above-deck launching structure, new stability calculations, and other measures. The estimated cost to upgrade El Faro’s open lifeboats to the modern enclosed design would be about $1 million, according to the representative of a lifeboat manufacturer. Traditional side-launched lifeboats are estimated to account for 90 percent of lifeboat accidents and incidents that are investigated, as compared with about 10 percent for freefall lifeboats. In an emergency, the probability of successfully launching a stern-launched lifeboat is greater than for a traditional side-launched lifeboat. There is no known successful launching of a lifeboat with survivors under hurricane conditions in winds of 96 to 112 knots, according to the lifeboat manufacturer’s representative. 1.11.6 Personal Locator Beacons A personal locator beacon is a portable unit that operates like an EPIRB. It was originally developed for use in Alaska but was authorized for nationwide use on July 1, 2003. Personal locator beacons are designed to be carried by a person and are registered through the FCC to a person, not a vessel or an aircraft. Investigators could not determine whether any of the El Faro crew carried a personal locator beacon. A personal locator beacon is activated manually and operates on 406 MHz to achieve an accuracy of within 3 miles using the 406-MHz satellite system. It has a low-power homing beacon that transmits on 121.5 MHz. Newer models allow GPS input to the distress signal to achieve an accuracy of about 100 meters (328 feet). Personal locator beacons are not required at sea, but several manufacturers offer models costing between $300 and $400. 1.11.7 Position Format The various organizations that broadcast or relay maritime emergency alerts use different format styles to render a ship’s geographic position (latitude and longitude). The different format styles led to confusion about the last known position of El Faro. In his phone call to the DP at 0706 on October 1, the El Faro captain gave his position as a navigator plots positions on a chart: “latitude twenty-three degrees twenty-six point three minutes north, longitude zero-seven-three degrees fifty-one decimal six west” (23°26.3′N, 073°51.6′W). The Coast Guard uses a dash rather than a degree sign (°) to indicate degrees, so when the DP passed El Faro’s position to LANTWATCH, it was entered into the Coast Guard’s MISLE

161 See 46 CFR 199.150(c), SOLAS III/16, and 46 CFR 160.132, which incorporates the requirements of the IMO’s Life-Saving Appliance code, chapter IV.

NTSB

Marine Accident Report

132 database as 23-26.3N, 73-51.6W. Inmarsat-C uses a decimal instead of a degree sign between degrees and minutes, so the supplemental alert sent to the Coast Guard at 0715 read 23.28N, 73.48W. SSAS uses a colon to separate degrees from minutes, so the SSAS message sent to the Coast Guard, also at 0715, read 23:25.39N, 073:52.51W. El Faro’s position from the Inmarsat-C distress alert was entered into the Coast Guard’s search-and-rescue optimal planning system (SAROPS) to determine a search area. The Coast Guard later determined that SAROPS had interpreted the position 23.28N, 73.48W (in degrees and minutes) as decimal degrees (23.28°N, 073.48°W) and converted it to degrees and decimal minutes using the Coast Guard’s format (23-16.8N, 073-28.8W). The SAROPS position was off by 23 nm compared with the last known position entered into MISLE. As a result, the Coast Guard launched its search for survivors 23 nm from the accident site. 1.12 Stability Information 1.12.1 Concepts A vessel that is floating upright in still water will list, or heel over to an angle, when an off-center force, or heeling moment, is applied. A moment is the product of a force tending to produce a rotation about an axis times its distance from the axis. Stability is the tendency of the vessel to return to its original upright position when the force is removed. The properties of stability are usually expressed as the magnitude of a heeling moment necessary to heel the vessel to a certain angle, the angle a vessel may heel to before capsizing, and other parameters that can be calculated. The principles of ship stability derive from the laws of physics and trigonometry and reflect the relationship between buoyancy (the force pushing on a ship allowing it to float) and gravity (the force pushing the ship into the water). Gravity acts on all parts of the ship’s structure, equipment, cargo, and personnel. The force of gravity acts downward through the ship’s center of gravity (G), while the buoyant force acts upward through the ship’s center of buoyancy. When a vessel is floating at an even keel or upright, the force of gravity and buoyancy are vertically aligned. A ship’s metacenter (M) is the virtual intersection of two successive lines of action of the force of buoyancy when the ship heels through a very small angle. The initial position of the metacenter is used as a reference in stability calculations. The distance from a ship’s center of gravity (G) to its metacenter is known as the metacentric height (GM). GM is a measure of the vessel’s ability to right itself when experiencing an overturning moment. For the same vessel, a higher GM value indicates a greater initial static stability. When a disturbing force such as wave action or wind pressure exerts an inclining moment on a ship, the ship’s underwater volume shifts in the direction of the heel, which causes the center of buoyancy to shift in the same direction. The shift does not affect the position of the ship’s center of gravity, unless cargo, equipment, or water (weights) are free to move. As a result, the lines of action of the forces of buoyancy and gravity separate and exert a moment on the ship that tends to restore the ship to an even keel. That is known as a righting moment.

NTSB

Marine Accident Report

133 The righting moment is the product of the force of buoyancy times the distance that separates the forces of buoyancy and gravity. That distance is known as the ship’s righting arm. The righting arm can be expressed as a curve plotted at successive angles of heel. The length of the righting arm generally increases with the angle of heel to a maximum point, after which it decreases, reaching zero at a very large angle of heel. The area under the righting arm curve represents the energy available to the ship to right itself. A reduction in the size of the righting arm usually means a decrease in stability. The mathematical relationship between the righting arm and the metacentric height makes GM a measure of the initial slope of the righting arm curve and an indication of whether the ship is stable or unstable at small angles of heel. Intact stability refers to how an intact, or undamaged, vessel will respond when heeled over in calm conditions. Damage stability is an assessment of the effects of opening various combinations of watertight compartments to the sea. The method of assessing damage stability for cargo ships is known as probabilistic, meaning that if a vessel “passes” enough individual hypothetical damage scenarios, it meets the damage stability criteria because it probably will not capsize or sink. The specific stability characteristics of a vessel are calculated based on the design drawings of its hull form and an inclining experiment in which precise measurements are taken on board the vessel to determine its displacement and center of gravity. Stability analysis generally requires the services of a naval architect. Stability criteria, established by regulators, are generally recognized as providing an adequate level of safety for vessels that are operated prudently, which means not overloaded and not operating in dangerous conditions such as violent storms. The IMO intact stability criteria were developed to guarantee safety against capsizing for a ship with no propulsion or steering (dead in the water), in severe wind and waves. The intact CFR criteria that applied to El Faro also assume dead ship, with the attitude of the vessel relative to wind and waves the worst possible for stability or heeling. A margin of safety is built into the stability criteria that is intended to accommodate events that can happen to a vessel, such as rolling in waves, heeling due to wind, or listing as people or cargo move from side to side. The only way to tell if a vessel meets the stability criteria is through calculations. If something changes about the vessel, such as a structural modification that might affect its stability, new stability calculations should be done. 1.12.2 Changes in Vessel’s Configuration History. El Faro’s original general arrangement drawings could not be found. Investigators obtained drawings, however, indicating that the design of hull No. 647, the Ponce, was used in constructing the Puerto Rico in 1975 and in later modifying it as the Northern Lights and then El Faro. The original Puerto Rico was 700 feet long, with cargo holds below, a semi-enclosed second deck, and an exposed main deck. Lengthening in 1993 added a new 90-foot-9-inch-long hold (2A) at the midbody and an upper (spar) deck extending from the house forward to hold 2. The added deck area allowed the carriage of a third more trailers and automobiles. The deck and the additional cargo raised the vessel’s center of gravity, which required 1,830 long tons of fixed

NTSB

Marine Accident Report

134 ballast in the No. 2 outboard port and starboard double-bottom tanks.162 The 1993 full-load draft was nearly the same as the original 1975 draft. When the Northern Lights was converted in 2005–2006 to carry lift-on/lift-off containers in addition to Ro/Ro cargo, the spar deck was removed, both ramps to the main deck were blocked, and the main deck was modified to carry containers rather than Ro/Ro cargo. The alteration added up to 12 containers transversely, stacked as many as five high above the main deck. To support the additional weight of the containers, the main deck was structurally reinforced. Transverse deck beams with container fittings were also added. The altered vessel lost over 40 percent of its Ro/Ro trailer and auto capacity but gained the capacity to carry 1,414 TEUs of container cargo. The carriage of containers above the main deck again raised the vessel’s center of gravity, requiring 4,875 long tons of additional fixed ballast to be fitted in the No. 2A and No. 3 port and starboard outboard double-bottom tanks. The vessel was renamed El Faro on January 18, 2006. Table 10 compares selected vessel parameters of El Faro with its previous two hull configurations. The ship’s main dimensions were unchanged from its configuration after it was lengthened. Its draft increased by 2 feet 1 5/16 inches, however, and its full-load displacement increased from 31,502 to 34,677 long tons, or by just over 10 percent. Table 10. Comparison of parameters for builder’s hull No. 670 in its three historical configurations. Parameter Hull 647, Ponce (similar to hull 670, Puerto Rico) Northern Lights El Faro Years in service 1975-1992 1993-2005 2006-2015 Draft, full load (extreme) 28’-1 1/8” (8.6 m) 28’-1 1/16” (8.6 m) 30’-2 3/8” (9.2 m) Freeboard, type B 14’-2 3/4” 14’-2 1/4” 12’-0 15/16” Displacement, full load (saltwater) 25,350 long tons 31,502 long tons 34,677 long tons Displacement, lightship 10,721 long tons 15,743 long tons 19,943 long tons Length, overall 700’-0” (213.4 m) 790’-9” (241.0 m) 790’-9” (241.0 m) Length, between perpendiculars 643’-0” (196.0 m) 733’-9” (223.7 m) 733’-9” (223.7 m) Beam, hull (molded) 92’-0” (28.0 m) 92’-0” (28.0 m) 92’-0” (28.0 m) Beam, at main deck 105’-0” (32.0 m) 105’-0” (32.0 m) 105’-0” (32.0 m) Depth, to spar deck (molded) No spar deck 78’-6 3/8” (23.9 m) No spar deck Depth, to main deck (molded) 60’-1 5/8” (18.3 m) 60’-1 5/8” (18.3 m) 60’-1 5/8” (18.3 m) Depth, to 2nd deck (molded) 42’-1 5/8” (12.8 m) 42’-1 5/8” (12.8 m) 42’-1 5/8” (12.8 m) Depth, to 3rd deck (molded) Unavailable 24’-1 5/8” (7.4 m) 24’-1 5/8” (7.4 m)

Fixed ballast

1,830 long tons 6,705 long tons Number of automobiles 102 139 74 Number of 20-foot trailers 0 28 24 Number of 40-foot trailers 294 369 190

Number of containers (TEUs)

-- 1,414

162Fixed ballast is solid material placed on a ship to improve stability. On El Faro, the fixed ballast consisted of a finely crushed granular iron ore–type material called QCM (density = 190 pounds per square foot).

NTSB

Marine Accident Report

135 Major Conversion. When a vessel undergoes a substantial modification or conversion, the Coast Guard Marine Safety Center determines whether the change meets the definition of a “major conversion” as defined by 46 USC 2101(14a). If a vessel is deemed to have undergone a major conversion, it may be subject to several regulatory standards current at the time of conversion, not the standards in place at the time of its original construction. Guidelines for determining the extent to which current Coast Guard regulations should be applied to inspected cargo vessels that have undergone major conversions are found in Coast Guard navigation and vessel inspection circular (NVIC) 10-81, change 1 (USCG 1981). The enclosure to the NVIC states the following: These guidelines are based on the premise that with the passage of time, existing vessels will be retired and only those built to newer standards will continue in service. For this reason, it is costly and impractical to require existing vessels to be modified each time a safety standard is updated. However, when a major conversion or modification of an existing vessel is planned, there is a definite intent to extend the service life of the vessel. When this is the case, it is appropriate to bring the entire vessel into compliance with the latest safety standards where reasonable and practicable. It is also appropriate to review the entire vessel to current standards when bringing existing US or foreign vessels under certification for the first time, or when a vessel has been wrecked or otherwise taken out of service for an extended period of time. The NVIC states that for a major conversion or modification, “the entire vessel must meet all current standards, as far as is reasonable and practicable, in effect at the contract date of the major conversion.” Regarding stability standards, NVIC 10-81 notes the following for a major modification of a US-flagged vessel: Requirements: If in the opinion of the cognizant mmt [merchant marine technical] office, the alterations: (1) substantially alter the stability characteristics, dimensions, or carrying capacity of the vessel, (2) change the type of vessel, or (3) substantially prolong the vessel’s service life, the vessel will have to comply with the stability standards in force at the time of the conversion. Acceptance Criteria: If, in the opinion of the cognizant mmt office, the alterations, modifications or repairs do not result in any of these three criteria being met, the vessel may be permitted to comply with the stability standards to which it had to comply prior to the conversions. There have been almost 400 major conversion determination requests since the early 1990s, and about 50 percent are determined by the Marine Safety Center to be so. The current commanding officer noted that congressional intent in the area of a major conversion is broad, and that major conversion or modification determinations must balance two factors at opposite ends of the spectrum. On the one hand, if every change to a vessel is a major conversion or modification determination, then the incentive for vessel owners or operators to effect significant repairs to their vessels is reduced or eliminated. On the other hand, if changes are never determined to be a major conversion or modification, then the opportunity is missed for a vessel to meet newer standards. “So the Marine Safety Center balances that spectrum in accordance with the law,” in the commanding officer’s words. The commanding officer stated that if El Faro’s conversion to a Ro/Con in 2005–2006 had been determined to be a major modification, the next question for the OCMI would have been what action was reasonable and practicable for the ship’s owners: replace equipment in-kind, or

NTSB

Marine Accident Report

136 update to new equipment and standards. He stated that the Coast Guard uses “reasonable and practicable as a condition for making that determination on a system-by-system basis.” SOLAS also addresses modifications to vessels and states that ships that undergo “repairs, alterations and modifications of a major character and outfitting related thereto shall meet the requirements for ships constructed on or after the date on which any relevant amendments enter into force, in so far as the Administration deems reasonable and practicable.”163 The Marine Safety Center determined that the lengthening and spar deck addition completed in 1993 was a major conversion. That designation required the vessel and its systems be brought up to the applicable 1992 federal regulations (as opposed to those from 1975). Modifications to the vessel were also required to comply with applicable SOLAS regulations at the time of modification because the vessel was certificated for international voyages. However, even with the major modification designation, new class rules and regulations were applied as reasonable and practicable, by both ABS and the Coast Guard. Correspondence from the Marine Safety Center at the time showed that the determination was the basis for the vessel to meet the new probabilistic damage stability requirements at the time of conversion (rather than the owner’s initial intent to meet deterministic damage stability found in a design letter issued by the US Maritime Administration [MARAD] in 1965).164 The Coast Guard Marine Safety Center did not designate the 2005–2006 conversion from Ro/Ro to Ro/Con a major conversion. In February 2002, TOTE representatives first asked the Marine Safety Center to determine whether the proposed changes would be considered a “major conversion,” and the commanding officer replied they would as defined by 46 USC 2101(14a), and specifically that the additional containers increased the vessel’s carrying capacity. In October 2003, TOTE requested a reconsideration and provided clarifying information that the two sister vessels, El Morro and El Yunque, had been similarly converted in the past without being considered a major conversion. TOTE also reasoned that the modified vessel would carry less cargo by weight, but the Marine Safety Center affirmed its previous decision in March 2004. Shortly afterward, to support its request for reconsideration, TOTE provided alteration histories for all its Ponce-class vessels and noted that none had been considered a major conversion. The Coast Guard responded that insufficient information had been provided to reverse its position. In August 2004, TOTE provided documentation (drawings) of similar alterations to El Morro and El Yunque and data that the previous conversions substantially increased the number of cargo units that could be carried. In November 2004, the Marine Safety Center reversed its February 2002 decision and determined that the Ro/Con modifications would not constitute a major conversion.

163 See SOLAS, chapter II-1 (“Construction Structure: subdivision and stability, machinery and electrical installations”), part A, regulation 1 (“Application”). The international regulations are similar to those of the Coast Guard. 164 Large US cargo vessels such as El Faro built under federal subsidies or mortgage guarantee programs were required to meet the criteria in MARAD design letter No. 3, issued April 28, 1965. El Faro was built under a mortgage guarantee program. MARAD’s design letter No. 3 was not a regulatory requirement.

NTSB

Marine Accident Report

137 The decision allowed the vessel to continue to meet its existing applicable standards and not be considered against 2006 regulations tied to the contract date of the conversion. Even if the 2005–2006 conversion had been designated a major conversion, Coast Guard policy left the decision to require that modifications to the vessel and its systems meet current standards to the cognizant (local) OCMI, who determined what would have been reasonable and practicable for the ship’s owner to update. The same intact stability (46 CFR 170.170) and damage stability (1990 SOLAS) standards were applicable in 2006 as in 1993. 1.12.3 Assessment of Vessel’s Stability When El Faro was lengthened in 1993, its stability underwent three independent analyses: by a naval architecture firm, which prepared a stability calculation package; by ABS, which reviewed the package and independently reviewed the vessel’s stability; and by the Coast Guard Marine Safety Center, which reviewed the stability calculations and issued a stability letter in October 1993. For the vessel’s Ro/Con conversion in 2005–2006, ABS reviewed a naval architecture firm’s stability calculations on behalf of the Coast Guard (under NVIC 03-97 [USCG 1997]) and issued a stability approval letter to the vessel. The Coast Guard, through its oversight process, could decide to review the stability assessments at any point. No evidence was found that the Coast Guard reviewed the vessel’s intact or damage stability for the 2005–2006 conversion. Damage Stability Standards. No damage stability standards existed for US or international cargo vessels until 1992. As originally launched, El Faro met the requirements for single-compartment stability (capable of surviving flooding of any one compartment) in accordance with MARAD design letter No. 3. When El Faro was lengthened in 1993, it was required to meet SOLAS probabilistic damage stability requirements that came into force in 1992. El Faro was the first US-flagged vessel to be held to the new standard. No records indicate that El Faro had its damage stability reassessed by a naval architect, or reviewed and approved by ABS or the Coast Guard, when it was modified for Ro/Con service in 2005–2006. The naval architecture firm that produced the stability booklet for the conversion did not reassess the vessel’s damage stability. The ABS load line and stability manager told investigators that because the vessel’s draft increased by about 2 feet, it should have been required to have a damage stability assessment. Intact Stability Standards. The only intact stability standard applicable to El Faro was the weather criteria at 46 CFR 170.170. The criteria include a formula for calculating a vessel’s required GM for particular loading conditions, including angle of heel. The Coast Guard weather criteria do not incorporate downflooding points, though they are considered in an assessment under the criteria of the International Code on Intact Stability. Downflooding is an ingress of water through external openings that are normally above the waterline. 1.12.4 Methods of Assessing Stability Stability Booklet. For unrestricted ocean service, US-flagged vessels must meet the applicable stability requirements of 46 CFR subchapter S, subdivision and stability (Parts 170– 174). Subchapter S requires Ro/Con cargo vessels such as El Faro to carry a trim and stability

NTSB

Marine Accident Report

138 booklet, commonly called a stability booklet. The stability booklet must contain sufficient information for the captain to operate the vessel in compliance with applicable intact and damage criteria. A stability booklet describes a vessel’s stability characteristics and contains operating instructions and worksheets for use in calculating the vessel’s weight (displacement) and centers of gravity (longitudinal and vertical) under various loading conditions. The booklet is thus a tool for the captain to use in determining a vessel’s maximum safe load and in controlling the vessel under different conditions. The stability booklet carried on El Faro at the time of the accident was dated February 14, 2007, and was approved by ABS on behalf of the Coast Guard on May 31, 2007. The booklet was based on a stability test, or inclining experiment, performed on February 12, 2006, after the vessel was converted to a Ro/Con. The stability test was carried out at the Atlantic Marine Shipyard in Mobile, Alabama. ABS approved the test report on March 22, 2006. US-flagged vessels in unrestricted ocean service are required to have stability booklets or a simplified stability letter. According to Coast Guard NVIC 3-89 (Guidelines for the Presentation of Stability Information for Operating Personnel [USCG 1989]), The intent of the regulatory requirements is to provide information to the operator of a vessel that will enable the operator to readily ascertain the stability of the vessel under varying loading conditions and to operate the vessel in compliance with applicable stability criteria. Title 46 CFR 170.110 directs that in the development of stability booklets, “consideration must be given to including the following information” (among other things): • General arrangement plans showing watertight compartments, closures, vents, downflooding angles, and allowable deck loadings. • General precautions for preventing unintentional flooding. • Any other necessary guidance for the safe operation of the vessel under normal and emergency conditions. ABS representatives stated that they reviewed and approved the stability booklet based on guidance in the Coast Guard regulations and NVIC 3-89, but that the items listed in 46 CFR 170.110 were considerations only and not required to be included in the booklet. When El Faro was lengthened in 1993, a new stability booklet was prepared. It was updated in December 2005 when the vessel was converted from a Ro/Ro to a Ro/Con configuration. As in the previous booklets, no listing or depiction of downflooding points or angles, areas of unintentional flooding, closures to be made, or windheel information was included. The “Revisions” section of the booklet included information on the addition of deck containers, removal of the spar deck, and increasing the permanent ballast. However, it did not note that the vessel’s load line draft had been raised by over 2 feet. The El Faro stability booklet did not identify the cargo hold ventilation trunk openings as potential downflooding points, nor did it indicate that they should be closed to prevent downflooding. None of the former officers or crew of El Faro remembered the dampers being

NTSB

Marine Accident Report

139 closed at sea (even for expected heavy weather), except when they were periodically tested. When asked what a captain should have done if faced with the risk of fire or flooding, an ABS representative stated that the captain would have to “trade off one risk against another risk and maintain certain weathertight integrity while not compromising or not reintroducing some other risk.” The stability booklet also did not mention the wind velocity used to compute the required stability of the vessel according to the Coast Guard weather criteria in 46 CFR 170.170. ABS representatives said that the wind velocity had never been included in a booklet the class society had approved. However, investigators found the value for wind velocity used to compute the same weather criteria in an ABS-approved booklet voluntarily provided by another operator. Wind acting on a vessel produces a heel, or a sustained list based on the side profile of the vessel above the waterline, the wind speed, and GM. Investigators also found windheel information in stability booklets provided by other operators. The Coast Guard has guidance for information in stability books regarding shifting weights or counterflooding during emergency situations (NVIC 4-77 [USCG 1977). The guidance states the following, which was not part of El Faro’s stability booklet: the stability information for all vessels should contain an appropriate section emphasizing the importance of the Master making every effort to determine the cause of a vessel’s list before taking corrective action. In instances where the master can ascertain that off-center flooding has occurred and that a cargo shift has not occurred, counterflooding or shifting weights to bring the vessel to the upright position may be the correct action. In other instances, such measures may be detrimental to the survival of the vessel. Onboard CargoMax. El Faro had a stability instrument, CargoMax, on board, in addition to the CargoMax software used on shore to load the vessel.165 CargoMax can calculate loading conditions and evaluate them for compliance with applicable intact and damage stability criteria. On February 8, 2008, ABS completed a “satisfactory” review on El Faro of the “stability aspect only” of CargoMax version 1.21.164 (August 31, 2007). The CargoMax software installed on El Faro was, however, version 1.21.203, dated June 1, 2010, and was not specifically reviewed or reapproved by ABS. CargoMax’s product manager stated that the differences between the versions were minor, would produce the same calculated values, and because of their minor nature, would not warrant, he felt, being submitted to ABS for reapproval. El Faro’s onboard CargoMax program included an optional damage stability module. The option was not required to be class-approved, nor was it. A section in the CargoMax user’s manual discussed the calculation steps and theory of damage stability and remedial action. Investigators entered El Faro’s departure condition from the shoreside CargoMax file into CargoMax version 1.21.203 and ran the damage stability module with damage to hold 3, then for flooding of holds 3 and 2A. For each case, the program’s “emergency response calc” immediately provided

165The IMO defines a stability instrument as “an instrument on board a particular ship by means of which it can be ascertained that stability requirements for the ship in Stability Booklet are met in any operational loading condition” (MSC.1/Circ. 1229). A stability instrument can be hardware or software.

NTSB

Marine Accident Report

140 information including, but not limited to, the vessel’s drafts, range of positive stability, and maximum righting arm angle. For each case the screen outputs showed a dashed line for downflooding angle in the legend of the “righting arm” quarter-screen; however, no line was shown on the graph. Investigators printed the results for both damage cases. No value for downflooding angle or indication for downflooding was shown on the printed graph, and the CargoMax damage module did not provide general information about a vessel’s downflooding angle to users. Investigators asked former El Faro senior deck officers if they were aware of or had ever used the damage stability module of CargoMax. A few stated that they were aware of the module, and all stated that they had not used it. Comparison of Stability Instruments. ABS class rules state that the printed stability booklet is the main approved document and that the stability program (loading instrument, or CargoMax) is a supplement to the printed stability booklet. Paragraph (f) of 46 CFR 170.110 refers to onboard electronic stability computers and their use as an adjunct to the required booklet. Previous deck officers told investigators that CargoMax, not the stability booklet, was the primary tool officers on El Faro and its sister vessels used to meet stability criteria. Using a stability instrument instead of the written stability book was common practice in the maritime industry according to deck officers, regulators, and naval architects interviewed during the investigation, because of the flexibility and ease of use the instrument offered. El Faro’s onboard CargoMax software included a function that calculated both the wind profile of the vessel, based on container loading, and the required GM. The vessel’s stability booklet, which did not have such an “auto windheel” function, calculated limited GM curves for one, two, three, four, or five tiers of containers, using the full wind profile (maximum container load per tier). Compared with the stability booklet, CargoMax with the auto windheel function would more accurately compute windheel for various container-loading arrangements and their associated wind profiles. For a loading case with less than a full-tier container load, the required GM output from CargoMax would be less than the GM calculated according to the stability booklet with a full container loading for the same tier. While the CargoMax calculation might be less conservative, it would meet the requirements for calculating minimum required GM specified at 46 CFR 170.170. ABS reviews the CargoMax program against the same stability criteria as a stability booklet. Onshore CargoMax. The loading conditions (drafts, trim, stability, and longitudinal strength) of El Faro and its sister vessels were assessed by TOTE terminal operators using CargoMax software. The shoreside software used for El Faro was the same as that used on board the vessel. The shoreside program was not required to be, and was never, subjected to an ABS survey; was not required to receive and never received annual checks similar to classification society requirements for the onboard program; and was not required to be, and was not, approved by ABS. ABS noted that it was not within a classification society’s scope to approve or verify shoreside loading instruments. According to the terminal manager who loaded the vessel, the loading condition was built in the shoreside CargoMax program. Hard copies (program printouts) and the electronic CargoMax

NTSB

Marine Accident Report

141 file were hand-delivered to the chief mate shortly before the vessel departed. The file was input into the vessel’s onboard CargoMax program, as was normally done. The former ABS stability and load line manager told investigators that the installation and annual verification required of onboard loading programs should also apply to the same loading programs used on shore. Training in CargoMax. Neither of the two shoreside loading managers who used CargoMax software to load TOTE vessels, including El Faro on the accident voyage, had formal, classroom CargoMax training, direct instruction from the CargoMax software developer, or formal training in ship stability. Rather, they learned the program through peers and on-the-job experience. They had extensive shoreside experience in vessel prestow and loading operations but had no professional sailing experience on vessels. They also used an informal “CargoMax Program” procedural document as guidance for loading the vessel using CargoMax. TOTE did not provide formal CargoMax training to the deck officers aboard El Faro. No Coast Guard regulations or ABS rules require onboard crew or shoreside personnel loading a vessel such as El Faro to be certified or formally trained in software programs that calculate shipboard stability. 1.12.5 Loading Condition at Departure Investigators reviewed terminal documentation for the loading of El Faro on its final voyage. Terminal managers used the onshore CargoMax software to load the vessel, as well as stowage-planning software called Spinnaker for containers and a handwritten stow plan for Ro/Ro cargo. The CargoMax totals matched the Spinnaker totals for containers and the stow plan for trailers, autos, and other Ro/Ro cargo and their associated weights. A total weight of 6,862.1 long tons of containers and 4,183.8 long tons of Ro/Ro cargo was carried. According to program printouts, the tanktop of hold 3 (hold 4D) contained 50 cars, no trailers, and no other Ro/Ro cargo on the accident voyage. Shoreside loading personnel and deck officers with experience on El Faro told investigators that a 0.5-foot GM margin was added to the vessel’s required GM at sailing (3.655 feet).166 GM margin is not a statutory requirement. The CargoMax printout from September 29 gave a sailing GM of 4.854 feet, corrected for free surface effect to 4.455 feet for departure. (Free surface effect is a reduction in a vessel’s stability caused by liquids moving about freely in a tank or hold.) The corrected GM was thus 0.8 foot above the required GM and 0.3 foot more than the owner-applied GM margin of 0.5 foot. The terminal manager who loaded El Faro stated that immediately before sailing, both he and the chief mate understood that the fuel quantity had been incorrectly entered into CargoMax for a pair of double-bottom fuel tanks, resulting in 200 long tons less fuel aboard (originally showed 346 long tons each and corrected to 246 long tons each). After reviewing the effect on GM and deadweight, the vessel sailed and the terminal manager corrected the shoreside CargoMax values the next day. The amended printout showed GM reduced to 4.685 feet, corrected GM to 4.284 feet, and GM margin to 0.64 foot.

166 Regulations dictate the minimum amount of GM required for a vessel at any time. Adding 0.5 foot of GM margin meant that the vessel had 0.5 foot in excess of what was required when it sailed from Jacksonville.

NTSB

Marine Accident Report

142 TOTE Maritime Puerto Rico’s terminal manager stated that he typically wanted 100 long tons of available deadweight to remain before sailing and the ship to have 3 to 4 feet of aft trim.167 The evidence indicates that the vessel sailed with the stipulated available deadweight. With the corrected value for fuel aboard after departure, deadweight was 14,682 long tons. The CargoMax departure printout gave the following drafts: aft mark 32 feet 6.49 inches; midship mark 29 feet 10.54 inches; and forward mark 26 feet 10.66 inches (with about 5 feet 8 inches of trim between the forward and aft marks). After the CargoMax values were corrected, the vessel’s departure drafts decreased at the aft mark to 32 feet 4.5 inches, at the midship mark to 29 feet 9.1 inches, and at the forward mark to 26 feet 9.9 inches. The calculated midship draft was 29 feet 8.3 inches. The operations manager stated that typically departing with a 0.5-foot GM margin, and with a normal fuel burn from Jacksonville to San Juan, the GM margin for arrival in San Juan would be about 0.27 to 0.3 foot. A previous operations manager and port captain familiar with both the vessel and the accident route stated, “There were times when the GM was close [to minimum GM at arrival], but it was acceptable. That’s why you have a margin.” 1.12.6 Load Line Load lines, also known as Plimsoll marks, are marks at the midpoint along each side of a vessel’s hull that establish the maximum draft to which the vessel can be lawfully submerged. The purpose of a load line is to ensure the seaworthiness of an intact (undamaged) vessel. As a vessel is loaded, the distance from the hull bottom to the waterline (draft) increases. To prevent overloading or vessel instability, the load line mark should not be allowed to go below the waterline. The Coast Guard considers US-flagged vessels that travel between the continental United States and US territories such as Puerto Rico to be on international voyages and requires them to have an international load line certificate. Load line certificates are issued in accordance with the International Convention on Load Lines (ICLL), administered by the IMO. Load line regulations and policies that apply to US vessels are found at 46 CFR Parts 42–47 and at 46 USC chapter 51. Load line certificates are issued on behalf of the Coast Guard by ABS or one of several other Coast Guard–approved classification societies. The owner or operator chooses the issuing authority. A load line certificate, valid for 5 years, is subject under 46 CFR 42.09 to annual verification surveys, in which the issuing authority visits the vessel to verify that its watertight integrity is maintained and that the vessel’s hull openings, valves, fittings, and freeing ports (openings close to the deck that allow water to drain overboard), as well as the access to crew

167 Deadweight refers to the carrying capacity of a vessel (weight of cargo, fuel, water, food, parts, and other consumables but excluding the weight of the ship itself). Regulations dictate the maximum amount a vessel can carry while at sea. Having an extra 100 long tons of deadweight meant the vessel could load 100 long tons more of cargo, fuel, water, or other consumables.

NTSB

Marine Accident Report

143 quarters, are kept in good general condition and that the vessel has not been altered in ways that might affect the position of the load line marks. El Faro’s last load line certificate was issued by ABS on January 29, 2011, and was valid until February 26, 2016. The certificate was based on a survey completed on February 27, 2006. El Faro’s freeboard was measured from the upper edge of the second deck at the side, with a summer load line freeboard of 12 feet 15/16 inch (12.08 feet).168 1.12.7 Watertight Integrity A vessel’s form, construction, and subdivision provide stability and resistance to flooding. The vessel has “watertight integrity” when openings in the hull and bulkheads are sealed or fitted so that they do not allow the passage of water through the structure in any direction under a head (quantity) of water for which the surrounding structure is designed. One of the purposes of load line assignment is to ensure the watertight integrity of a vessel below its freeboard deck (in El Faro’s case, the second deck). Doors and Hatches. The deck logbook kept by the ship’s officers consistently showed entries stating “W/T [watertight] doors and hatches secured for sea” when El Faro departed the dock. (However, the company had no written procedures for monitoring or logging the opening and closing of watertight doors and hatches while the vessel was at sea.) The logbooks also showed that the large watertight doors, which subdivided the cargo areas and that trailers could pass through, were opened in port and secured before departure. The doors provided watertight integrity below the second deck and between cargo holds. Smaller man-size watertight access doors were built into the large watertight cargo doors. Man-size watertight doors also led to the deckhouse, deck lockers, and some engine spaces. SOLAS chapter II-1, part B-4 (“Stability Management”), regulation 22 (“Prevention and control of water ingress, etc.”), permits a watertight door to be “opened during navigation to permit the passage of passengers or crew, or when work in the immediate vicinity of the door necessitates it being opened.” The regulation continues, “The door must be immediately closed when transit through the door is complete or when the task which necessitated it being open is finished.” SOLAS also requires authorization by the officer of the watch for the “use of access doors and hatch covers intended to ensure the watertight integrity of internal openings.” SOLAS chapter II-1, part B-4, regulation 22, paragraph 13 states the following: Hinged doors, portable plates, sidescuttles, gangway, cargo and bunkering ports and other openings, which are required by these regulations to be kept closed during navigation, shall be closed before the ship leaves port. Each watertight cargo hold in El Faro had two man-size watertight hatches called scuttles. The lids to the scuttles were hinged at one side and opened upward onto the second deck.

168 The ICLL determines the permitted draft/freeboard for a vessel in different climate zones and seasons. The applicable zone for El Faro on the accident voyage was the summer zone, and the maximum permitted draft was the summer load line draft.

NTSB

Marine Accident Report

144 Immediately below each scuttle opening was a vertical steel ladder that allowed crewmembers to climb into the hold or climb out of (escape from) the hold. According to testimony from past officers and crew, the scuttles were regularly opened at sea so that crewmembers could enter the holds to inspect cargo or make repairs. A review of El Faro’s deck logbooks for August 2015 showed no log entries for opening or closing scuttles, hatches, or watertight doors while the vessel was at sea. To achieve watertight integrity, a scuttle was secured by closing the steel cover (which had a gasket) and turning a wheel. Through a linkage system, the wheel moved four steel pegs (dogs) to seal the scuttle tight and prevent water from entering the hold. A former El Faro boatswain testified that a person could not tell by looking at a closed scuttle whether the wheel had been turned to engage the dogs and seal the hatch. A past chief mate and captain of El Faro stated, “You would have to grab the handle of it and see if it was locked or unlocked.” The VDR recording indicates that the vertical-access scuttle on the starboard side of the second deck that led to hold 3 was open during the accident. General arrangement drawings (such as figure 56) show that the second deck had two scuttles (called RWTHs [raised watertight hatches] on the drawings), through the second deck to hold 3, at frame 163 on the starboard side and at frame 138.5 on the port side. Hold 2A also had two such accesses. Figures 57 and 58 show the scuttle on the starboard side of the second deck to hold 3 and the scuttle on the port side to hold 2A.

Figure 56. Second deck plan showing scuttles. (Starboard scuttle to hold 3 outlined in red)

NTSB

Marine Accident Report

145

Figure 57. Second deck scuttle to hold 3. (Photo by former El Faro second mate)

Figure 58. Second deck scuttle to hold 2A, similar to hold 3 scuttle. (Photo by Herbert Engineering)

NTSB

Marine Accident Report

146 The steel plates or covers to the scuttles were characterized by crew and officers as being heavy and hard to open. A former El Faro chief mate and captain stated that he had “never seen one pop open on its own.” Another former captain of El Faro, who had nearly 27 years’ experience as captain or chief mate on that ship and other vessels of the Ponce class, stated, “I don’t see a wave getting in there and lifting [a scuttle]. Even if it was not dogged.” All nine hydraulically operated cargo hold doors required power to activate, were operated locally, and had both a local status (open/close) indicator at the door control and a remote status indicator panel in the fire control room on the main deck, six decks below the navigation bridge. There was no watertight door alarm panel on the bridge or at the engine operation platform. The man-sized watertight doors, watertight raised access hatches (scuttles), and other watertight access doors were not equipped with either a local or a remote status indicator. SOLAS contains regulations regarding openings in watertight bulkheads and watertight doors that apply to cargo ships constructed after February 1, 1992.169 The regulations state that access doors and access hatch covers normally closed at sea, intended to ensure the watertight integrity of internal openings, shall be provided with means of indication locally and on the bridge showing whether these doors or hatch covers are open or closed. A notice is to be affixed to each such door or hatch cover to the effect that it is not to be left open. The use of such doors and hatch covers shall be authorized by the officer of the watch. Cargo Hold Ventilation Trunks. El Faro’s COI required as a condition of carriage that for each cargo hold, at least one air supply fan was to be operated and natural exhaust ventilation openings were to remain open under way at sea when transporting vehicles with fuel tanks (relevant regulations are found at 46 CFR chapter I, subchapter I, “Cargo and Miscellaneous Vessels”). Because El Faro transported vehicles on the accident voyage that had fuel tanks (automobiles and some other Ro/Ro vehicles), the ventilation ducts were required to remain open. The ABS technical manual states, “All ventilator openings are to be provided with a weathertight closing appliance.” Regulation 19 of the ICLL notes that, generally, “weathertight closures are required on all ventilator openings adjacent to the side shell plating . . . to protect the ventilator opening from ‘run up’ of water due to waves on the vessel’s sides or green water on deck so that water will not penetrate into the vessel under any sea condition.” The Coast Guard’s load line technical manual states that closing appliances must be “deemed weathertight to the satisfaction of the assigning authority.” Outboard-facing louvered ventilation openings in El Faro’s sideshell between the main and second decks allowed fresh air into the vessel. The air flowed past baffle plates to supply fans that pushed it through the hull of the second deck down to the fourth deck through supply ventilation trunks on both sides of the vessel (directly opposed). Just above the second deck, the supply trunks were fitted with watertight closing appliances that also served as fire dampers. The exhaust trunks mounted on both sides (directly opposed) of each hold were fitted just above the second deck with weathertight closing appliances that also served as fire dampers.

169 See SOLAS 2004, part B-1: “Subdivision and Stability,” chapter II-1: “Construction- structure, stability, installations,” regulation 25-9-1, “Openings in watertight bulkheads and internal decks in cargo ships.”

NTSB

Marine Accident Report

147 Past crewmembers on El Faro and other Ponce-class vessels told investigators that the fire dampers on both the supply and exhaust ventilation trunks always remained open while under way. A previous chief mate stated that they were not closed for heavy weather or for any other reason and that the only reason they would have used the dampers was for a fire. Several former crewmembers stated that the functionality of the dampers was tested by closing and opening (exercising) them monthly as part of drills. On the VDR recording, the crew is heard discussing water coming through the ventilation system in the engine room. A former El Faro chief engineer told investigators he had seen the intakes for the ventilation fans in the engine room ingest rain when the direction of wind and rain allowed it. The water would leak through the ventilation ductwork into the engine room. According to the former ABS load line and stability manager, the arrangement of El Faro’s supply and exhaust ventilation trunks met the ICLL requirements when the ship was constructed in 1974, met the requirements in place during its conversions in 1993 and 2005–2006, and would meet the current (2005 ICLL) requirements. He also stated, “If the same arrangement were proposed today, ABS would accept it, under the current regulations.” The downflooding angle related to intact stability is the minimum heel angle at which an external opening without a weathertight closing appliance is submerged. Under the SOLAS criteria for assessing damage stability, weathertight openings are considered downflooding points, but openings that can be made watertight are not.170 If fitted with gaskets as shown in the ship’s construction drawings, the supply vents would have been watertight, but the exhaust vents were weathertight only. Under the SOLAS damage stability criteria, El Faro’s exhaust openings would have been considered downflooding points but not the supply openings, according to correspondence with the Coast Guard Marine Safety Center. Investigators found the gaskets on the sister vessel El Yunque to be in poor condition or partially missing. 1.12.8 Damage Control Plan for Flooding The company’s emergency preparedness manual contained the following guidance for flooding: In all cases of flooding, reference should be made to the ship’s stability information to determine what action is necessary to improve buoyancy. Intact spaces have to be evacuated and securely battened down. This includes any void spaces below the water line and other spaces which could contribute to the ship’s buoyancy if the ship settled in the water. Use should be made of any means, such as pressurization, to reduce or minimize the ingress of water and progressive flooding. El Faro also had on board a fire control and safety plan, a two-page drawing posted near the bridge, as required of all TOTE-managed ships under TOTE’s SMS. The drawing showed, in part, the location of egress routes, scuttles, hatches, cargo hold watertight doors, fire dampers,

170 See SOLAS, chapter II-1, part B-1, “Stability,” regulation 7.2, paragraph 5.2.

NTSB

Marine Accident Report

148 ventilation closures, bilge/ballast pumps, emergency generator, remote shutdowns and controls (ventilation systems, emergency fire pumps, general alarm, etc.), and other firefighting equipment. It noted the cargo hold supply ventilation closures for holds 1 through 3 as fire dampers and indicated that they were watertight. It noted the exhaust closures for cargo holds 1 through 3 as fire dampers that were nonwatertight. The plan designated the scuttles to cargo holds as escape trunks and did not indicate that they were watertight. The drawing outlined no procedures. Under SOLAS, all passenger ships built after 1980 are required to have damage control plans and booklets. Dry cargo ships built after 1993 are required to have a damage control plan, and those built after 2005 are required to also have a damage control booklet. In 2007, the IMO’s Maritime Safety Committee published advice on the preparation of damage control plans (MSC.1/Circ. 919). That advice was superseded in 2009 by MSC.1/Circ. 1245, which stated that a damage control plan was intended to provide ships’ officers with clear information on the ship’s watertight subdivision and equipment related to maintaining the boundaries and effectiveness of the subdivision so that, in the event of damage to the ship causing flooding, proper precautions can be taken to prevent progressive flooding through openings therein and effective action can be taken quickly to mitigate and, where possible, recover the ship’s loss of stability. A SOLAS regulation adopted in 2004 requires a plan to be posted on the bridge showing the boundaries of watertight compartments for each deck and hold, as well as a list of openings and means of closure, arrangements for correcting flooding, indicators of watertight and hinged doors in watertight bulkheads, and other information or procedures necessary to maintain watertight integrity. In 2007, the Maritime Safety Committee adopted mandatory guidelines for providing information about damage stability to masters that was to be included on damage control plans for ships built after January 1, 2009. El Faro was substantially modified (classified as a major modification by the Coast Guard) in 1993. However, the vessel was not operating internationally and was therefore not required to comply with SOLAS regulations. The vessel was again substantially modified in 2005–2006 (which the Coast Guard did not classify as a major modification). The vessel was enrolled in the ACP program in December 2010, with a retroactive date of entry of February 27, 2006.171 The ACP included an ongoing review of the equivalency between federal regulations and the SOLAS rules used by classification societies. There is no evidence that the Coast Guard required a damage control plan or damage control booklet for El Faro, and there is no evidence that the vessel had one. The information to the master mandated by SOLAS would have been required only for ships built after 2009, that is, after El Faro’s last conversion. According to ABS, SOLAS requires a damage control plan to be placed on board a vessel, but the plan does not require approval, even for vessels built today. It would have been up to the Coast Guard OCMI to require El Faro to carry a damage control plan after it was modified, since the modifications were done before El Faro joined the ACP.

171 The letter from the Coast Guard to Sea Star Line documenting El Faro’s enrollment in the ACP did not explain the retroactive enrollment date.

NTSB

Marine Accident Report

149 1.12.9 Rapid Response Damage Assessment Program According to the user manual, ABS’s RRDA program provided “rapid response damage assessment support during an emergency incident affecting the enrolled vessel’s stability and hull strength.” When properly implemented, the intention was to quickly provide information to the captain, particularly in acute emergencies involving stability. When RRDA receives a call for assistance, the attending engineers mobilize and establish communications. Engineers then access the program’s database to get the computer model of the endangered vessel up and running in the RRDA center’s HECSALV program.172 They will then load the departure condition or the current condition (emailed) to the model. At least two engineers will run the model and then validate that their outputs match each other and also match the ship’s stability data (primarily vessel drafts), which indicates that the model is working correctly. From there, the engineers develop event trees or input incoming damage information from the vessel. Although not required to do so by regulation, TOTE subscribed to the RRDA program for El Faro. The El Faro crew did not use the resource during the accident, however, and an RRDA group was not set up until 4 hours after all contact with the vessel had been lost. ABS’s RRDA director said that the team provided one free emergency exercise per year for each fleet of vessels enrolled and that feedback from vessel managers had been positive. He said that increasing the captain’s and crew’s “knowledge of what RRDA does and can do for those on board would be helpful.” No drill had been held for El Faro or other TOTE vessels, as the RRDA manager recalled. A port engineer from TOTE made the first call to the RRDA at 1200 on October 1 (1100 CDT). The RRDA team was activated and in place by 1230. The RRDA logged the vessel as being in a severe storm, with cargo hold 3 flooded to the tween deck level, and noted the loading condition as “will be sent.” By 1243, the Coast Guard Marine Safety Center’s salvage engineering response team was working with the RRDA and remained so throughout the event. At 1351, the RRDA team received El Faro’s departure loading condition from TOTE via email and was working on loading the HECSALV model. At 1414, the RRDA requested a clarification from TOTE about the fuel oil in the double-bottom 3 port and starboard tanks. By 1547, TOTE had emailed the corrected fuel tank loads (246 long tons each). By 2005, the RRDA had emailed three load cases (condition analyses) for the vessel: undamaged loading condition at time of sinking, same load condition with hold 3 flooded to 10 percent of its volume, and same load condition with hold 3 flooded to where the vessel reached hydrostatic balance (equilibrium). The RRDA noted in the email that the vessel “tends to heel most with flooding between 10% and 20% volume resulting in 7 degree heel and approx. 4 ft. freeboard.” Thereafter, the RRDA stood down because there was no further contact with the vessel. The following day, RRDA emailed a fourth case: same load condition, with hold 3 flooded to 10-percent volume and 75-knot beam wind (which accounted for windheel). The RRDA director stated that response times to emergencies varied greatly. He indicated that it was important to have accurate ship models for their program and that the ship’s stability

172 The HECSALV software was developed specifically for emergency response and salvage by Herbert-ABS Software Solutions, LLC.

NTSB

Marine Accident Report

150 conditions for the current voyage were critical to shortening response times. He also stated that El Faro’s ship model was in the RRDA’s stability program but that the vessel did not send its loadout at departure. TOTE sent loadout and fuel information after the accident. The RRDA director said that dynamic conditions, such as wind and waves, could be built into a ship’s model. He stated that they could estimate windheel and that container ships and Ro/Con vessels such as El Faro presented difficulties because their deck cargo loads changed, which affected a vessel’s wind profile. The director said, however, that the RRDA could build a wind profile of a vessel when it first enrolled in the program, which could then be “tuned” on the day of an incident. RRDA representatives said that while it was important to have actual ship conditions, some assessment and advice could be provided without that information. 1.12.10 Postaccident Analysis of Stability, Structures, and Sinking After the accident, as requested by the marine board, the Coast Guard Marine Safety Center reviewed and analyzed the stability (intact and damage) and structures of El Faro and also conducted a hydrostatic sinking analysis that assessed contributing factors to the sinking (MSC 2017). NTSB investigators worked with the marine board to gather evidence and support the assumptions that went into the technical review and sinking analysis. Computer Model. The Marine Safety Center developed a three-dimensional computer model of El Faro to use in General HydroStatics (GHS), a program that computes a vessel’s hydrostatic properties and stability. Analysts compared the GHS outputs with the values in El Faro’s most recent stability booklet and in the CargoMax stability software (noting that CargoMax used the same hydrostatic tables as the stability booklet). They found that the “hydrostatic properties compared closely, with approximately 0.1% difference in calculated displacement at the full load draft.” The report noted discrepancies in tank volumes, centers, and free surface inertia values for the stability booklet and CargoMax (in excess of 2 percent tolerance in IMO MSC.1/Circ. 1229), which appeared to derive from errors in the original tank geometries and most likely applied to all Ponce-class vessels. Stability Tests and Instruments. Analysts reviewed the last stability test (inclining experiment) for El Faro and subjected the test to an uncertainty analysis. The analysis found “95% confidence that the true value of the accident voyage GM was within +/-0.7 feet of the calculated value.” Hydrostatic and stability analyses use a ship’s lightship weight (displacement) and center of gravity. Regarding the vessel’s stability booklet, analysts noted that it was not intended to assess vessel loading and hull strength (bending moments and hull stresses), which would be addressed in a vessel loading manual and that El Faro was not required to have a loading manual by virtue of its construction date. Therefore, the vessel’s lightship weight distribution did not require approval, nor was it ABS-approved. Analysts found that the transverse center of gravity was incorrectly calculated for the vessel’s most recent stability test report. The loading and securing of cargo is not addressed in a stability booklet but rather in a vessel-specific manual for cargo loading and securing. The report noted that ABS approved El Faro’s manual and that the ship’s CargoMax software contained features for assessing cargo

NTSB

Marine Accident Report

151 securing, on which the vessel operators relied for container loading. It also noted that the CargoMax software was neither reviewed nor approved for use in assessing cargo loading and securing. The Marine Safety Center’s report discussed the CargoMax stability software carried on El Faro and used by shoreside personnel to load the vessel, which included an application for calculating the ship’s longitudinal bending moments and shear forces to the ABS allowable values. Vessel operators relied on those features to assess the hull girder bending moment in load planning. However, since the vessel did not require a loading manual, the calculation application was not required to be, nor was it, approved by ABS for assessing vessel loading and hull strength. Analysts reviewed the onboard stability software carried by El Faro, referred to by ABS as a stability instrument. The stability instrument (CargoMax) was used by vessel officers to determine that the operational loading condition of the ship met the stability requirements specified in the stability booklet. Typically for stability instruments, CargoMax had been reviewed and approved by ABS for use on El Faro only as a supplement to facilitate stability calculations, not as a substitute for the approved stability booklet. Therefore, “the vessel operator was obligated to follow all operating instructions delineated in the [stability booklet].” Analysts found two instructions in the stability booklet that operating personnel had not followed in loading the vessel for the accident voyage using CargoMax. The instructions regarded slack (not completely full) tanks for consumable liquids and saltwater ballast tanks being pressed-up (full). CargoMax had checks and warnings for the load line limit and the intact stability criteria but no warnings for slack tank limitations in the stability booklet. However, analysts noted that CargoMax “does properly include all tank free surface corrections in calculating GM so while this slack loading is not in accordance with the [stability booklet] and it does introduce some additional risk to the vessel, it is not an unassessed risk.” The Marine Safety Center analysis found that the accuracy of the CargoMax calculations could be considered as good (or better) than calculations performed by hand using the stability booklet. Sample load cases from CargoMax compared with the stability booklet were nearly identical, as expected. The safety center observed that there are no requirements for the use of onboard software for vessel stability, strength, or cargo loading and securing for dry cargo ships such as El Faro (although several recent IMO amendments for stability software apply to oil, chemical, and gas carriers). The safety center further observed that “under Coast Guard policy, the master must be provided with the capability to manually calculate stability” but that he or she may use other tools, such as stability software, to assure stability. The safety center stated, however, that “it remains incumbent upon the master to ensure the vessel is compliant with all aspects of the stability booklet.” Intact and Damage Stability. An intact stability assessment was performed by using the Marine Safety Center’s computer model of El Faro to assess eight benchmark loading conditions against intact stability criteria. The safety center–defined benchmark conditions included the accident voyage departure and the estimated loss of propulsion conditions. The analysis found that all eight benchmark loading conditions met the applicable intact stability requirements of 46 CFR 170.170 (the GM weather criteria), which applied to El Faro. However, analysts noted that “the

NTSB

Marine Accident Report

152 vessel was often operated very close to the maximum load line drafts, with minimal stability margin compared to the required GM, and little available freeboard and ballast capacity, leaving little flexibility for improving stability at sea if necessary due to heavy weather or flooding.” The report notes that the minimum GM curves in the stability booklet were generated based on the minimum GM required to meet intact stability criteria in 46 CFR 170.170. However, for vessels required to meet both damage and intact stability requirements, such as El Faro, the higher of intact or damage stability minimum GM must be reflected in the minimum GM curves. Although the conversion to carry containers in 2005–2006 resulted in an increase of over 2 feet in the vessel’s load line draft, no damage stability assessment was done after the 1993 lengthening to verify that El Faro would remain limited by intact stability criteria in all loading conditions. Assessing El Faro with the draft increase to applicable 1990 SOLAS probabilistic damage criteria in effect at the time of conversion showed that for “load conditions with two or fewer tiers of containers, the limiting stability criteria could be the damage stability instead of the intact stability criteria,” and for those load conditions limited by damage stability criteria, this was not reflected on the minimum required GM curves. However, for El Faro’s departure condition on the accident voyage, the report concluded that “the limiting stability criteria was the intact stability criteria, which was properly reflected in the [stability booklet] and incorporated in the CargoMax stability software.” Analysts theoretically evaluated El Faro against the stability standards that would have applied had the vessel been newly constructed in 2016. El Faro would have been required to meet part A of the International Code on Intact Stability (2008). For departure loading conditions on the accident voyage, the vessel would not have entirely met the intact stability criteria because of the limited area under the righting arm curve above 30°. Analysts evaluated El Faro against the 2009 SOLAS probabilistic damage stability standards, the 1990 criteria having been superseded after the vessel’s conversion in 2005–2006. For the departure loading condition, a minimum GM at full load draft of about 4 1/2 feet was calculated. That was less than the minimum required GM for intact stability. Therefore, as loaded for the accident voyage, El Faro would have met both 1990 and 2009 SOLAS damage stability standards. Regarding stability criteria and their relationship to ship survivability, the report noted: . . . since GM is only the initial slope of the righting arm curve (and is only applicable for small angles), the magnitude of GM does not give an indication of the magnitude of the maximum righting arm, the angle at which the maximum occurs, the angle of vanishing stability (range of stability), or the area under the righting arm curve (righting energy). Therefore, the use of GM as a stability indicator may be misleading if used by itself. However, since calculation of GM is relatively simple compared to calculation of righting arms, GM has been used extensively as a basis for evaluating stability of many types of ships, including general cargo vessels. Later in the report, analysts noted that GM is a good indicator of the initial stability for small angles of heel in response to small heeling forces and moments; however, it is in general a poor indicator of overall stability, especially in response to large heeling forces and moments as might be experienced by a vessel in heavy weather where high winds and seas can be expected. The range of stability,

NTSB

Marine Accident Report

153 maximum righting arm and angle, and area under the righting arm curve are the more important stability characteristics for heavy seas, and GM provides little or no insight into these characteristics. The report found that in comparison with other conventional cargo vessels, the righting arm curves for El Faro had a relatively small area (righting energy) and range of stability. The report noted that those characteristics were significant in consideration of both “limited residual righting arms and righting energy with the vessel subjected to heeling forces and moments as might be experienced in heavy weather where high winds and seas are expected” and “of limited residual righting arms and righting energy when subjected to flooding.” Ship Structures. The report concluded that El Faro’s “ship structures met all regulatory and class structural requirements for strength.” After viewing underwater video of the sunken vessel, analysts noted that although the bottom of the hull was under sediment and not visible, they saw “no visual evidence of structural damage in the amidships region of the hull.” The report concluded that because the vessel was loaded in a “hogging” condition (center or keel bent upward), “any significant hull girder structural failure would likely have resulted in compressive buckling of the bottom plating and/or tensile fracture of the upper decks.” If the hull had significant bottom plate buckling, there would have been “buckling creasing of the lower side shell above the sediment.” The analysis concluded that there was no evidence of buckling creasing or tensile fracture of the upper decks. Hydrostatic Sinking Analysis. The hydrostatic sinking analysis considered windheel and flooding effects, potential downflooding through multiple paths, and the combined effects of wind, seas, and flooding on hydrostatics. Analytic focus was on righting arms and the effects of windheel and free surface due to floodwater in cargo hold 3 and later in hold 2A. Results were highly sensitive to the estimated permeability of the cargo hold and to variation in wind speed. Permeability is the fraction of a compartment or tank that can be filled with liquid after accounting for piping, machinery, cargo, etc., and is widely variable in holds that carry trailered containers and automobiles. The vessel was analyzed in a “dead-ship” condition (after loss of propulsion). Loading condition was based on estimates that about 240 long tons of fuel had been burned since departure from Jacksonville and that 110 long tons would have been transferred from the No. 3 double-bottom port and starboard storage tanks, leaving 130 long tons net burn-off from the fuel oil settling tank. Environmental conditions at the time of loss of propulsion and sinking (between 0600 and 0740) were estimated from hindcasts and numerical simulations. The captain’s statement about a 15° list was interpreted to mean that El Faro experienced a mean heel angle of about 15° but that wave action also caused the vessel to roll about the heel angle. The wind off the starboard beam was estimated at 70 to 90 knots (sustained). The study found that under those conditions, with the ship dead in the water, a windheel angle of 7° to 11° could be attributed solely to the steady beam wind.

NTSB

Marine Accident Report

154 Analysts’ review of underwater video and photographs of the hull found no evidence of an exterior or shell plating hull breach that could have contributed to the flooding of hold 3. However, they noted that with even a small opening (1 square foot) just below the waterline, the pumping system on El Faro, which had a capacity of less than 1,000 gpm, could not have kept up with the resultant flooding (calculated flow rate = 2,160 gpm). Holds 1, 2, 2A, and 3 were adjacent and separated by watertight bulkheads. The tween (third) deck of the cargo holds was considered nonwatertight because of small deck plate openings that allowed exhaust-laden ventilation air to circulate from the lower hold up to the exhaust vent trunk openings. As the holds flooded with water up to the tween deck, they would limit the flow of water as the vessel rolled (“pocketing”). Therefore, once flooded above about 20 percent (the approximate percentage needed to reach the tween deck at a 15° heel angle), free surface effects from floodwater would be reduced in the lower cargo holds. In addition, the free communication effect (which reduces stability when a partially flooded, off-centerline compartment has a hull breach allowing free communication with the sea) would not have existed for flooding of the cargo holds because they were symmetric about the ship’s centerline. Flooding of Hold 3. For a condition of no wind, flooding of hold 3 was calculated in 10-percent increments, from intact condition to level of equilibrium (flooded to external waterline), using permeability factors of 0.7 and 0.9.173 Results showed reduced righting arm and GM (slope of the righting arm curve) for flooding percentages from 10 and 20 percent of hold volume due to an initial free surface effect. The flooding of hold 3 would have resulted in an increase in draft and a corresponding decrease in freeboard. The analysis found that after loss of propulsion, with hold 3 flooded 20 percent and a chosen heel angle of 15° (as may have been possible in the early stages of hold 3 flooding), the cargo hold ventilation openings (tops of baffle plates) would have been close to a still waterline, and intermittently rising water due to waves and vessel roll would have submerged the ventilation openings (see figure 59). For a condition of wind, heeling arms for 70-, 80-, and 90-knot winds and residual righting arms were calculated for hold 3 flooded 10 percent, 20 percent, and 30 percent (permeability 0.7). Righting arms were also calculated for the same flooding conditions in hold 3, with and without an 80-knot wind. Results were that residual righting energy was reduced significantly even for lower levels of flooding up to 30 percent in combination with an 80-knot beam wind. Further, a combination of windheel and initial flooding of hold 3 could have yielded the 15° heel angle mentioned on the VDR. The report stated, “It is apparent that the vessel would have been in a vulnerable state and susceptible to capsizing even with flooding only of hold 3, when considering the combined effects of partial flooding, wind heel and roll motion.”

173 This type of flooding analysis differs from damage stability analyses performed in accordance with SOLAS requirements, where permeability factors are based on vessel and cargo type.

NTSB

Marine Accident Report

155

Figure 59. Ventilation supply trunk (right) and aft exhaust trunk (left) in hold 3, with flooding of hold to 20 percent (0.7 permeability) and heel angle of 15°. (Adapted from figure 6-18 in MSC 2017) Downflooding Through Ventilation Openings. The cargo hold ventilation openings were identified as potential downflooding points (points that would allow seawater to enter the cargo holds as they moved closer to the waterline). Analysts noted that the supply and exhaust ventilation openings in hold 3 were only slightly lower and closer to the waterline than those for holds 2 and 2A due to the sheer of the second deck and the vessel’s trim aft. The tops of the baffle plates installed to limit water from entering holds 3 and 2A through the fire dampers, which were about 25 to 26 feet above the accident voyage still waterline, were found after loss of propulsion to submerge at heeling angles of 26° to 29°, with only hold 3 flooded to 20 percent at 0.7 permeability. No damage control plan or emergency plan was found that might recommend securing the fire dampers in extremely high seas to prevent potential downflooding through ventilation openings into cargo holds. The analysis found that as hold 3 continued to flood, eventually the ventilation openings for hold 2A would have intermittently submerged due to flooding in hold 3 plus windheel, waves, and roll motion. Hold 2A and perhaps hold 2 probably took on water, at least intermittently, as the vessel rolled about a windheel angle of 15° and while hold 3 was flooding. It was noted that progressive flooding into hold 2A could potentially have occurred through leaks in the watertight cargo door seal between hold 3 or in bilge pumping system check-valves. Regardless of the flooding source, the bilge alarm for hold 2A sounded at 0716. Downflooding angles for 13 downflooding points were calculated and plotted for two conditions—intact condition at loss of propulsion (no flooding) and 20 percent flooding of hold 3 (0.7 permeability). The downflooding angles for the various downflooding points were as follows:

NTSB

Marine Accident Report

156 • Hold 3, starboard access scuttle:16.2° (intact condition), 14.9° (hold 3 flooded to 20 percent). • Hold 2, vent supply baffle: 29.°6 (intact), 28.9° (hold 3 flooded). • Hold 2, aft and forward exhaust vent baffles: at least 30° in either condition. • Hold 2A, vent supply baffle: 27.7° (intact), 26.9° (hold 3 flooded). • Hold 2A, aft vent exhaust baffle: 29.8° (intact), 28.9° (hold 3 flooded). • Hold 2A, forward vent exhaust baffle: 30.3° (intact), 29.4° (hold 3 flooded). • Hold 3, vent supply baffle: 27.2° (intact), 26.3° (hold 3 flooded). • Hold 3, aft vent exhaust baffle: 29.1° (intact), 28.1° (hold 3 flooded). • Hold 3, forward vent exhaust baffle: 29.5°(intact), 28.6° (hold 3 flooded). • The other three downflooding points, all in hold 1, required a heel angle of at least 42° to downflood in either condition. Figure 60 shows the downflooding angles for the downflooding points described above, plus the angle at which the edge of the freeboard deck would have been immersed (about 15°). The downflooding angles are superimposed on two righting arm curves. The upper curve is the righting arm for El Faro in the intact condition on the morning of the sinking, before flooding began and with no wind. The lower curve is the righting arm for the vessel with hold 3 flooded to 20 percent and a sustained 80-knot beam wind. The smaller area under the lower righting arm curve, compared with the area under the upper curve, illustrates the severely reduced energy the vessel had available to right itself after hold 3 flooded and the ship lost power, with hurricane winds on its beam (blowing at a 90° angle to its starboard side).

Figure 60. Righting arm curves for El Faro, with annotated downflooding angles. Downflooding angles are indicated at various points on curves for convenience; they do not represent values used in righting-arm calculations. (Illustration by Coast Guard Marine Safety Center)

NTSB

Marine Accident Report

157 Flooding of Multiple Cargo Holds. The report also considered the effects of flooding in hold 2A after hold 3 flooded. With hold 3 flooded to equilibrium, a significant reduction in GM and righting arms for hold 2A flooded at 10 to 20 percent of hold volume was found. Similar to hold 3 flooded alone, the result was due to an initial free surface effect. At the 10 percent level, negative GM and righting arms indicated “lolling” (vessel would not remain upright but would list to either side) to an angle of about 7° without any wind in calm water. Analysts noted that with hold 3 flooded and hold 2A in the process of flooding, the vessel could have survived in calm water because it theoretically had sufficient residual righting energy. The report concluded, however, that “with almost any significant wind heel and additional wave effects including dynamic rolling, the vessel would likely have capsized.” Analysts investigated the effect of a third cargo hold flooding by running analyses with different compartments flooded. They concluded that it was “evident that any additional free surface effect due to the flooding of a third cargo hold would be sufficient to capsize the vessel, even in calm water.” Cargo Shifting or Loss. The analysis considered cargo shifting or cargo loss. Cargo shifting was treated as a transverse weight shift. If bays of containers lost structural integrity and leaned to one side without washing overboard, the result would have been similar to a transverse weight shift. The effects of a transverse moment were applied to the intact condition and to the condition of hold 3 flooded 20 percent with 80-knot beam winds. Using an example of 20 containers weighing 25 long tons each shifting an average of 10 feet, the net effect was equivalent to a transverse shift in the ship’s center of gravity, reducing the righting arms and producing a list. Even small transverse shifts in containers would have exacerbated the effects of floodwater and beam winds. However, compared with the effect of floodwater and hurricane-force beam winds, the shift produced relatively “small reductions in righting arms and small induced heel angles.” Cargo loss was modeled by the complete loss of topside containers in a container bay. The loss was found to temporarily improve the vessel’s stability by lowering its center of gravity and increasing the righting arms. The analysis also considered trapped water on the second deck, which would have allowed water to enter through openings in the sideshell as the vessel rolled. The hydrostatic effects of water on deck 2 were included in the analysis, but dynamic effects could not be incorporated. The reason was that roll motions would have been altered by transverse force components on the sideshell from water trapped to one side and damped by the restriction of flow through the sideshell openings. Summary of Sinking Analysis. The analysis found it highly unlikely that the vessel sank by the bow, even though the captain said, “bow is down,” but highly likely that it capsized (but not that it completely inverted because deck containers washing overboard would have temporarily improved stability). The analysis also found it likely that most or all of the deck containers were lost and that most of the internal Ro/Ro cargo broke free and shifted. The 6,700 tons of iron ore fixed ballast in the double-bottom tanks would have turned the vessel upright as it sank. The report concluded the following: It is unlikely that the ship could survive uncontrolled flooding into even a single cargo hold with winds in excess of 70 or 80 knots, and it is unlikely that it could survive flooding of more than one cargo hold except in benign conditions with little wind and waves.

NTSB

Marine Accident Report

158 In summary, the report stated the following: Regardless of the sources of flooding, the free surface associated with the floodwater in multiple cargo holds combined with hurricane force winds and seas would likely have resulted in the capsizing of the vessel. The capsizing may have been slowed or temporarily arrested as containers on deck began to wash overboard, but as the vessel slowly rolled onto her port side, floodwater would have entered through the ventilation openings into all of the cargo holds and the engine room, resulting in the sinking. 1.12.11 Dynamic and Forensic Sinking Analysis After the sinking, the NTSB contracted with the company CSRA to study and develop dynamic analyses of the El Faro sinking that would yield probabilities of the vessel’s range of movement and acceleration, hydrostatic pressure and wave slap at various locations modeled in irregular waves, and storm conditions over time. The analyses considered the vessel under way, dead in the water, and dead in the water in flooding (heeled) condition. Brief analyses of the sinking, the seabed impact, and the debris field were desired to compare the observed results to surface events that could have led to the sinking. The analysis yielded time-domain simulations and visualizations of vessel motions in hindcast hurricane-force winds and seas. Hindcast data were produced by numerical models run by NOAA’s Environmental Modeling Center at times and locations corresponding to those of El Faro on October 1, in 15-minute intervals. The study’s salient conclusions were as follows: • Traveling at 14 knots at even keel (no heel), seas 45° off the bow at the departure draft with no flooding, seawater would not reach the ship’s ventilation louvers in wave heights below about 7.25 meters (23.8 feet). • After loss of power, with a chosen heel angle of 15° to 18° in storm waves, the vent openings on the lower port side would be submerged a significant part of the time from almost every wave encountered (figure 61). • Larger heel angles were more likely from cargo hold flooding than a shift of Ro/Ro cargo. • The severe damage to the stern and the large transverse hull crack just aft of the aft engine room bulkhead (between bays 16 and 17) were both consistent with seafloor impact. Sonar images that appeared to be hydraulic outburst marks to both port and (to a lesser degree) starboard of the crack indicated entrained water jetted outward, moving the bottom sediment. • The cargo containers most likely floated for some time after they came off the vessel. Dents on the forward side of the deckhouse and the small number of containers found in the mapped part of the underwater debris field support this conclusion. • After capsizing or foundering (sinking below the surface), the vessel most likely plunged bow-first, with containers tearing away from and floating off the main deck. Consistent with the last conclusion were the following observations: • The two separated uppermost house decks (navigation deck and lower navigation deck) probably came off near the surface, as supported by their distance from the main hull

NTSB

Marine Accident Report

159 wreckage. The mast and stack also probably came off during the plunge near the surface. • The damage and scraping on the port part of the front of the deckhouse probably resulted from containers floating up or against it. • The damage to the lifeboat davits probably occurred near the surface as they were hit by containers and other debris. • The damage to joiner bulkheads inside the remaining upper deckhouse indicated that debris was ejected aft.

Figure 61. El Faro rolling about a 15° to 18° static heel with waves or green water reaching ventilation openings after propulsion loss. (Screen shot at extreme position from CSRA video simulation) 1.13 Operational and Management Information The parent company of TOTE Services and TOTE Maritime Puerto Rico was TOTE, Inc. The TOTE companies were part of a larger organization, Saltchuk Resources, a privately held company headquartered in Seattle. 1.13.1 Company History According to various company histories, TOTE began in 1975, when Sun Shipbuilding and Drydock Company established Totem Ocean Trailer Express, offering Ro/Ro trailer service (on the SS Great Land) from Seattle to Anchorage. In 1976, the company added the Ro/Ro ship SS Western Adventure to its Alaska service and moved to the port of Tacoma. The SS Northern Lights (later El Faro) joined the company’s Alaska service in 1993. Sea Star Line was founded as Sea-Barge line in 1985, with two tugs and barges operating from south Florida. In 1982, Totem Resources Company purchased Totem Ocean Trailer Express from Sun Shipbuilding (Sun Company). In 1998, Sea-Barge became Sea Star Line, LLC, when it was purchased by Totem Resources and other investors. Sea Star Line owned and operated El Faro, El Yunque, and El Morro. On September 19, 2015, just before El Faro sank, Sea Star Line and TOTE (Alaska service) were renamed TOTE Maritime Puerto Rico and TOTE Maritime Alaska.

NTSB

Marine Accident Report

160 TOTE Services was founded in 1975 as Interocean Management Corporation, which managed crewing for Totem Ocean Trailer Express vessels and a fleet of oil tankers. The company was sold to Totem Resources in 1989 and was known by several names afterward, including Interocean Ugland Management Corporation and Interocean American Shipping. The name of Interocean American Shipping was changed to TOTE Services in 2012. The owner of the company’s new LNG ships, which were under construction at the time of the accident, was listed as TOTE Shipholdings. 1.13.2 Corporate Organization TOTE Services operated primarily out of Jacksonville, although company officials also worked in the Tacoma office or in other cities, such as San Diego. The president/chief executive officer (CEO) was based in Jacksonville. Reporting directly to the president/CEO were two vice presidents and two directors: • The vice president of marine operations–commercial worked from TOTE’s Tacoma office. He was a member of the executive committee and helped formulate long-range goals, objectives, and budgets. He also managed a team of technical personnel who oversaw commercial operations in Jacksonville and Tacoma as well as new construction in San Diego. The vice president was a member of the shoreside emergency response team. He told investigators that he did not know the specific duties of the team and was unsure how the call list was structured. • The vice president of marine operations–government directed the operation of vessels the company managed for the US government. • The director of marine safety and services assisted in the operation of the company’s fleet, both active and deactivated, and managed the supervision of 250 or more seagoing personnel on active vessels. He conducted safety inspections and was also responsible for conducting sea trials for newly built or converted vessels. Before being promoted to director in 2014, he served as a TOTE port engineer. He said that beginning in January 2015, his “main focus” (85 percent of his time) had been on the new LNG ships. Although it was not listed in his position description, the director told investigators that he was the alternate designated person when the DP was not available. • The director of labor relations and risk management managed staff in the industrial relations, human resources, and payroll departments. He represented management in collective bargaining matters; assured that crews possessed the required licenses, training, and certificates; oversaw personnel records and appraised performance; and administered the company’s Equal Employment Opportunity and Affirmative Action programs. The following managers, who reported to the vice presidents and directors listed above, had responsibilities directly relevant to the El Faro investigation: • The director of ship management–commercial operations reported to the vice president of marine operations–commercial. He was responsible for seeing that the commercial

NTSB

Marine Accident Report

161 fleet complied with regulatory requirements; for supervising port engineers and the engineering staff of vessels under his responsibility; for interviewing, hiring, and training employees; and for planning, assigning, and directing work, among other duties. He was hired as director in January 2015. • The crewing manager, who reported to the director of labor relations and risk management, was responsible for recruiting vessel personnel and was the primary contact with unions. Among other duties, the manager was responsible for checking medical backgrounds and providing drug-free letters to the Coast Guard and for maintaining employment records and reviewing shipboard evaluations. The crewing manager had been working in that position since 2005. • The manager of safety and operations/designated person reported to the director of marine safety and services. The manager was responsible for enforcing the company’s drug and alcohol policy for shipboard personnel; formulating safety policies and procedures; conducting ISM training and internal audits; reviewing permits for “hot work” (including welding, cutting, and heating); submitting accident reports; and seeing that periodic emergency drills were conducted. The manager also performed the role of DP and, as such, was required to report any issues and concerns from the fleet directly to the TOTE president/CEO.174 Part of his role as DP was to be available 24 hours a day to respond to calls. TOTE had considered hiring an employee to assist the DP with his duties (he managed 14 active and 10 inactive vessels) but reallocated his duties to other staff. The DP had been hired by TOTE in February 2014. The main offices of TOTE Maritime Puerto Rico were also in Jacksonville. The terminal manager was responsible for managing weather and other significant events and for ensuring that the cargo scales at the terminal were properly calibrated. The manager of marine operations reported to the terminal manager. He oversaw cargo stowage, loading, and discharging; stability calculations; vessel inspections; and weather forecasting and reporting. He was also required to “cover for the port engineer as needed.” He had no training in ship stability before El Faro sank but received CargoMax training for the new LNG vessels. As Sea Star Line, TOTE Maritime Puerto Rico had both port captains and port engineers to oversee vessel operations. After a reorganization in 2012–2013, which moved personnel such as the DP from New Jersey to Jacksonville, the company filled only port engineer positions. TOTE management stated in marine board testimony that the reorganization did not impair shoreside support and, in fact, that the relocation of personnel to Jacksonville enhanced shoreside support and oversight. There were, however, conflicting statements on the topic. A former chief engineer who worked on El Faro during the reorganization said that the biggest change was that the port engineer “was basically the only guy [we] had contact with in Jacksonville, whereas everybody else would have been West Coast . . .” He said that before the reorganization, “They were all there, right there, so you could deal with multiple guys from Jacksonville.” A former captain on El Faro testified that the reorganization did not change the availability of someone ashore with whom he could discuss vessel operations. He stated that before the reorganization, he

174 As noted earlier, the DP was a link between the ship and the highest level of management. Under the ISM code, the DP had the responsibility to monitor “the safety and pollution prevention aspects of the operation of each ship and to ensure that adequate resources and shore based support was applied, as required.”

NTSB

Marine Accident Report

162 spoke with the former DP in New Jersey, and afterward he spoke with the current DP in Jacksonville. He was asked if he recalled anybody in the Jacksonville area who was involved with marine operations. His response was, “No, sir.” While cargo was being loaded onto El Faro before the accident voyage, the manager of marine operations was on vacation. The terminal manager told the marine board that he performed the vacationing manager’s duties. He said he did not discuss the weather with the El Faro captain. He also said that the longshoremen lashed the Ro/Ro cargo for bad weather, that the vessel’s crew did not ask for additional lashings to be placed on the cargo, and that he did not read the vessel’s drafts at departure. 1.13.3 Company Operations At the time of the accident, the company employed more than 500 seamen and crews and operated a fleet of over 30 vessels, according to the TOTE Services website. Oversight of Nautical Operations. TOTE regarded captains as the primary nautical experts. According to the director of marine safety and services, “There is no one in the company that formally provides oversight for nautical. We depend on the captains to take on that role.” Monitoring Ships at Sea. TOTE did not have a policy for monitoring commercial vessels at sea. The vice president of marine operations told the marine board that he did not know if there was anyone in the organization who “may actually know where the ship is . . . through some kind of computer tracking system or some alternate means of communication.” The director of marine services and safety testified that the vessel’s port engineer was responsible for monitoring departure messages, arrival messages, and noon reports. El Faro’s port engineer said he believed he saw El Faro’s noon position report for September 30, 2015. When asked who reviewed the position reports so that the company could track a vessel’s position at any time, the port engineer said, “I don’t believe anyone does that, sir.” The manager of safety and operations stated that storms were “not necessarily” plotted against a ship’s position but that “we know the position at times based on their noon position.” (The last noon report of El Faro reported its position 18 hours before it lost propulsion.) The manager testified that no one in the company was tasked with monitoring tropical weather. He also stated that some of the ships TOTE managed for other companies had an online weather-routing system that tracked both ship and storm positions. Under the company’s SMS, the captain was responsible for monitoring the weather along the vessel’s intended track and for taking action to prevent excessive damage to the vessel from heavy weather. The captain was also required to advise shoreside management of speed reductions or course changes due to adverse weather. In August 2015, both Hurricane Danny and Tropical Storm Erika (see section 1.10, “Meteorological Information”) had affected TOTE and its vessels. On August 20, the DP issued a safety alert for Hurricane Danny that included the location of the hurricane and its forecast track. The alert stated that “all our vessels, in all oceans, should review their general and vessel-specific

NTSB

Marine Accident Report

163 heavy weather procedures and be prepared for the unexpected occurrence.” Management also exchanged emails between August 19 and August 23 regarding the storm and related company operations. TOTE did not issue a safety alert for Tropical Storm Erika. However, managers exchanged a number of emails with each other and with the El Faro captain during that storm. In one email, the captain advised the company that he planned to avoid the storm by taking Old Bahama Channel, that the new route would add 160 nm to the voyage but was safer in case Erika’s track changed, and that the crew would secure cargo the next day. On August 26, the DP emailed the captain and shoreside personnel: “To ensure we are all on the same page and nothing is missed in the risk assessments and action area, please send me a detailed email with your preparedness/avoidance plans and update daily until all clear.” The next day, the captain wrote the DP that he would address cargo securing, the riding gang stopping work and securing its area, and securing all watertight doors in a safety meeting that day. The company issued no alerts about Hurricane Joaquin before or during the accident voyage. Emails, interviews, and the VDR audio recording yielded no evidence that the company requested a risk assessment during the voyage. The only email communications between the company and the captain were the captain’s departure report on September 29, his noon report on September 30, and an email on September 30 in which he summarized the weather information and stated that he “would like” to take Old Bahama Channel on the return to Jacksonville. The director of marine operations authorized the diversion by email. The only telephone contact was initiated by the captain during the last hour of the voyage, when he called the DP to report the emergency. According to management, the company’s concerns during Hurricane Danny and Tropical Storm Erika were its terminals. Hurricane Joaquin was not predicted to affect the terminals. In testimony to the marine board, the director of ship management explained that if a hurricane is bearing down on a port, “You have nowhere to run.” In contrast, he said, “Joaquin was—as recently as several days before the incident—a tropical depression heading to the North Atlantic.” Investigators surveyed nine other companies that operated similar vessels, traded on similar routes, or operated in heavy weather. All respondents reported that they provided weather-routing services to their vessel masters. Eight responded that they held weather-related discussions with their masters. All the respondents’ SMSs or operations manuals addressed heavy weather. Seven had checklists for securing for sea that specifically referenced heavy weather. Most companies had an assigned person or entity that actively monitored and became involved in their vessels’ movements. All company management either contacted vessel masters directly or followed correspondence between shoreside weather routers or nautical personnel and masters. The stability books of respondents to the survey included situations to avoid (such as certain wave or sea conditions); operations to undertake with caution, such as shifting liquids to correct a list caused by flooding or changing course; and recommendations on ship headings in heavy seas. Some stability booklets contained information relating to windheel. One book contained the wind velocity used to compute weather criteria required by SOLAS. The same books also contained advice or instructions to masters to ensure that closures were made watertight or weathertight.

NTSB

Marine Accident Report

164 Weather-Related Training. The Coast Guard did not require deck officers to take any formal heavy-weather training courses, and TOTE did not provide it. TOTE management stated, however, that mariners were given informal heavy-weather safety training on El Faro as part of the company’s onboard training program. TOTE was not required to ensure that officers obtained additional training outside of what the STCW Convention and Coast Guard regulations required. According to its director of marine services, TOTE did not have a “dedicated trainer” responsible for shipboard training records or ship-specific training. The El Faro captain and bridge officers had not attended courses in advanced shiphandling, nor were they required to. Requirements for such training as part of the licensing process did not take effect until 2016. Investigators found no evidence that users on El Faro of the BVS weather forecast and analysis program had any formal training with the system. Testimony from deck officers indicated that there was on-the-job training, and a BVS user’s manual and quick reference guide were readily available for use on the vessel. According to crewmembers and TOTE employees, the ship’s monthly safety meetings rarely included a discussion of hurricane preparedness. Safety Training for Riding Gang. Company policy was stated in its SMS as follows: “All members of a riding gang shall be given an indoctrination tour of the vessel before or as soon after sailing as possible.” The indoctrination was to be noted on a logsheet and signed by the riders before they started work. Investigators received records of completed indoctrinations up to May 19, 2015. Familiarization and training logs for the Polish workers, who came aboard El Faro in August, were retained on the ship, not at company headquarters. At the third marine board hearing, a Polish worker who had been on El Faro in the days and weeks before the sinking (from August 18 through September 29) stated that he and his Polish coworkers went to the captain’s office immediately on boarding the ship to fill out forms. He recalled that they were medical. He could not recall having a safety briefing and stated that he was not taken to the lifeboats or liferafts and shown what to do in an emergency. He did state, however, that their supervisor showed them the entire ship when they came aboard. He was aware of where the lifeboats and immersion suits were located, though he never put on a lifejacket or immersion suit while he was on board. When asked if he knew the various emergency signals on El Faro (general alarm, fire, and abandon ship), he said he did not. When queried about emergency drill participation, the Polish worker said they did not participate in the drills “because they did not apply to us.” When asked where they would go during safety drills, he said they “were doing their work.” An off-duty chief engineer said the riding crew participated in the lifeboat drills. An off-duty third mate stated that the riding gang would muster on the bridge during abandon-ship drills, though he did not personally observe them. The El Yunque captain did not recall whether the Polish crew took part in drills or put on lifejackets or immersion suits while he was chief mate on El Faro. None of the logsheets that recorded drills contained any of the Polish riding crew’s names or signatures. Emergency Response and Safety Concerns. TOTE had a dedicated emergency phone number that a service manned 24 hours a day. According to company protocol, once the service was contacted, an emergency response team would be notified and would respond as a team. According to emergency response team members, no heavy-weather scenarios were included in their training, nor did the drills include fire at sea or vessel grounding. Team logs for 2015 showed

NTSB

Marine Accident Report

165 that El Faro had emergencies on September 1 and 2 involving diesel oil spilling into the sea. On September 3, a drill was held on contacting the qualified individual in case of emergency. TOTE provided Tunstall Americas (the contracting company for the call center) with information to help its employees take emergency calls. For example, when a call came in for the emergency response team, operators were instructed to remain on the line until they were sure the call was taken by a TOTE representative. Specific instructions were listed on the operator’s computer screen, similar to a checklist. Crewmembers were directed to contact the DP if they had safety concerns. The DP’s phone number was posted throughout the ship, but the only shipboard phone the crew could access was on the bridge, and permission to use the phone was at the captain’s discretion. Crewmembers were not prohibited from having their own cell phones or satellite phones. In addition to the DP’s phone number, a flyer for an online reporting tool called “Speak Up” was posted on the ship. The flyer listed a link to a company hotline where crewmembers could access “Speak Up.” The vessel’s emergency preparedness manual included an emergency procedure in case of flooding. It referred vessel personnel to the “ship’s stability information to determine what action is necessary to improve buoyancy.” The manual stated: “Intact spaces have to be evacuated and securely battened down. This include[s] any void spaces below the water line and other spaces which could contribute to the ship’s buoyancy if the ship settled in the water.” The manual also advised the captain to obtain “detailed information about the location and extent of damage” and to send the information to company headquarters so that the shoreside emergency response team (coordinated by the manager of safety and operations) could “assess buoyancy and structural effects of flooding and . . . advise the Master of ways to limit stress.” Delivery Schedule. Delivering cargo on time was one of TOTE’s stated goals. The banner on the main page of the company’s website in the days following the accident read, “On time, every time.” Four of TOTE’s largest customers stated that the company was responsive if there were delays in delivering cargo. TOTE’s customer contracts did not include financial penalties for late deliveries. After its competitor Horizon Lines removed two ships from its Puerto Rico service in 2012, then ceased operations in December 2014, TOTE’s business increased. The size of TOTE’s fleet remained the same, however. To meet the demand, TOTE used barges to supplement cargo deliveries by ship. TOTE provided investigators with a record of expected versus actual delivery times. If arrivals were within a 2-hour window of the expected arrival time, they were considered “100% on time.” If arrivals were over 2 hours late, they were considered “0% on time.” Data showed that the El Faro captain made his arrival time in San Juan within the 2-hour window 90 percent of the time. His performance evaluations contained no comments related to timeliness of departures or arrivals. Witnesses at the marine boards did not raise any issues with the captain’s ability to maintain a schedule. During the marine board hearings, off-duty crewmembers and shoreside personnel stated that the company did not put pressure on the crew to make arrival times and that the company was

NTSB

Marine Accident Report

166 not penalized if the vessel arrived late to port. Investigators found ten instances in the VDR transcript of bridge personnel talking about the estimated time of arrival in San Juan. TOTE told investigators that the ship’s personnel did not know or were not aware that timeliness was tracked. 1.13.4 Other Information Departure from Port. Company procedures and guidelines were silent about whether a vessel should remain in port or put out to sea when a storm was approaching. Coast Guard Sector Jacksonville’s 2015 Port Heavy Weather Plan contained detailed instructions to follow on the approach of a hurricane. The plan recommended leaving port if a hurricane was approaching but left the decision to the captain whether to remain in Jacksonville or depart. If a captain wanted to keep his vessel in port under heightened hurricane watch/warning conditions, he had to justify that decision and obtain Coast Guard permission to remain. The plan referenced the Navy’s Hurricane Havens Handbook (NMOC 2016). The handbook deems the port of Jacksonville (including Blount Island, where El Faro docked) a poor hurricane haven, mainly because the low-lying topography provides little shelter from winds and storm surges and the area is on the preferred tropical cyclone track. When sortieing port under a hurricane threat, the handbook recommends that vessels leave in ample time and head eastward, so as to pass north and east of the storm. A second recommended option is for vessels to head south, so as to pass west and south of the storm. Position Assignments for LNG Vessels. Crewmembers slated for the new LNG vessels were required by the company to sign nondisclosure agreements. According to TOTE, the purpose of the nondisclosure agreements was to ensure confidentiality among current officers and crew who were hired for the new vessels. Some of those being hired into senior positions were working as subordinates for people who had not been selected for the sought-after positions. A former boatswain and an AB said that crewmembers were upset about not being selected for the LNG ship positions. The boatswain stated that “all the fellows after being on that run for 5 years to 13 years, sure they wanted a shot at the new ship and were upset that they weren’t picked, or they hadn’t been talked to at least . . .” When asked if the selection of the crew and officers for the new ships caused problems on board, the AB replied, “Oh, it caused a big deal.” TOTE managers told investigators that there were no specific criteria by which they selected officers. Phone Use During Accident Voyage. El Faro’s FleetBroadband voice phoneline, which had handsets in the captain’s stateroom, in the chief engineer’s stateroom, and on the bridge, was the only telephone line used for voice communication to or from the ship on the day of the sinking.175 The captain used the voice phoneline twice around 0700 on October 1, first to call the DP and then to contact the emergency call center.

175 FleetBroadband connects ships to satellites. TOTE’s records indicate that other satellite phones were previously associated with El Faro. TOTE’s emergency response manual and the registration information for the vessel’s EPIRB filed with NOAA each listed a different phone number for El Faro.

NTSB

Marine Accident Report

167 Cell phone use by the captain, the chief engineer, and the DP was examined for October 1 from 0300 until 1000 (except for the captain’s phone, which was also examined from 0001 until 1000 on September 29). No cell phone calls were made in the hours before the accident. The accident occurred out of cell phone range. 1.14 Coast Guard Alternate Compliance Program The ACP is a voluntary process for US-registered vessels to obtain a COI by complying with the standards of an authorized classification society (ACS), international conventions, and a US supplement. The ACP is intended to avoid redundancies in the inspection regimes of the Coast Guard under federal regulations and international conventions and by the classification societies under their class rules, while maintaining equivalent levels of safety for US–flagged vessels. At the time of the accident, about 150 deep-draft vessels were enrolled in the program.176 The ACP is administered under the provisions of 46 CFR Part 8 and Coast Guard NVIC 02-95 (USCG 2006). The program began in February 1995. 1.14.1 General Provisions Under the ACP, the Coast Guard can issue a COI based on reports by an ACS confirming that a vessel complies with the applicable standards. At the time of the accident, the Coast Guard had entered into formal agreements with four classification societies and two pending for ACP participation under the authority of 46 USC 3316. The classification society conducts statutory surveys, while the Coast Guard performs safety inspections. Before being designated as an ACS, a classification society must develop a US supplement that addresses areas where current Coast Guard requirements are not embodied in the class rules or international conventions, or, in the case of international conventions, areas that require interpretation by a flag administration. The supplement, combined with the class rules and international conventions, is equivalent to US regulations. Class societies complete a gap analysis when creating the supplement. The Coast Guard then performs an analysis to ensure that the gaps are filled by the supplement’s provisions. The ISM code is applicable to all vessels enrolled in the ACP, and a recognized organization is responsible for issuing a safety management certificate and for conducting external audits to verify compliance with an enrolled vessel’s SMS.177 El Faro was enrolled in the ACP on February 27, 2006, and as such was required to comply with the ABS steel vessel rules, applicable SOLAS conventions, and the US supplement to the ABS rules for steel vessels certificated for international voyages. The classification society and the Coast Guard share responsibility for updating the supplement to account for changes in the federal regulations and international conventions

176 According to the Coast Guard, as of September 2016, the US-inspected fleet contained 228 active diesel-powered cargo vessels and 39 active steam-propulsion cargo vessels. 177 Recognized organizations are classification societies that are recognized by the IMO as authorized to inspect and survey ships on behalf of a flag administration.

NTSB

Marine Accident Report

168 (USCG 2006). Investigators found that the Coast Guard was not reviewing supplements in a timely fashion. When the ACP was implemented, there was one ACS. At the time of this report, there were five ACSs, which increased the reviewing requirements. At the time of the accident, the Coast Guard last updated the US supplement for ABS in April 2011. Investigators found that some inspectors and surveyors were unfamiliar with the supplements. According to NVIC 02-95 and Coast Guard inspectors interviewed after the accident, ACP oversight includes annual vessel examinations by the Coast Guard to verify that the ACSs are enforcing compliance with applicable standards. According to Coast Guard inspectors, the examinations are more limited in scope than Coast Guard inspections that would be required of a vessel not enrolled in the ACP. The scope of the ACP examinations is comparable to that of annual foreign-flagged-vessel port state control examinations. The Coast Guard may also conduct periodic oversight reexaminations to verify compliance. When conducting oversight examinations of cargo vessels, Coast Guard inspectors are guided by a special ACP examination book for freight vessels (CG-840 ACP FV). The book contains a list of possible examination items but does not require the Coast Guard to inspect each item.178 According to the Coast Guard, CG-840 ACP FV has not been revised since January 2001, and inspectors used a CG-840 with a 1999 revision date during the March 2015 inspection of El Faro. If a non-ACP vessel is found not to conform to the requirements of laws or regulations, the Coast Guard issues a form referred to as CG-835 (“Notice of Merchant Marine Inspection Requirements”) to the vessel’s owner. The form is to be logged into the Coast Guard’s MISLE database and becomes part of the vessel’s history. If Coast Guard examiners identify deficiencies of an ACP vessel during an examination, the Coast Guard reports to the ACS but does not issue a CG-835 deficiency report. The ACS does not log a report into the Coast Guard’s database because it does not have access to MISLE. The Coast Guard has limited access to the ACS database. An ACS must provide the Coast Guard with unrestricted access to any and all records for vessels in the ACP. Coast Guard inspectors may access the records to review previous results before conducting vessel examinations, but there is no written requirement to do so. Under NVIC 02-95, the Coast Guard was to establish and maintain a liaison with the ACS. The liaison officer to recognized and authorized classification societies (LORACS) was a centralized point of contact for the ACS and Coast Guard ACP inspectors. The LORACS position was disestablished, however, and the responsibilities reassigned to other people. Many Coast Guard units did not have an assigned ACP officer, and the duties were shared by several people. 1.14.2 Targeted Vessel List The Coast Guard maintains an “ACP Targeted Vessel” list that is updated annually about October 1. An automated risk matrix is used to determine whether a vessel belongs on the list.

178 Inspectors use inspection book CG-840 MI for full examinations required of vessels not enrolled in the ACP. The examinations involve greater scrutiny, such as testing of relief valves.

NTSB

Marine Accident Report

169 Point values are assigned for issues such as overdue deficiencies, major nonconformities in SMS audits, marine casualties, vessel service, and vessel age. Ten percent of vessels with the highest aggregate score are added to the list. At the time of the accident, El Faro had not been added to the 2016 targeted vessel list but was coincidentally slated to be added on the day of the accident. El Faro had recently reported a medical emergency, which was scored as a “marine casualty” under Coast Guard regulations and added enough points to include the vessel on the 2015 targeted list. Other reportable marine casualties (such as a loss of propulsion because of crew error) would have added points to the vessel’s total but were not scored by the automated risk matrix because data could not be entered into the Coast Guard’s MISLE system at the time. According to the Coast Guard, no operational controls had been placed on El Faro at the time of the accident. Vessels on the targeted list are subject to additional oversight at the 6-month mark of the examination cycle. The examination scope can increase if inspectors find safety issues on board. The Coast Guard’s guidance states that targeted vessels “shall be attended during drydock . . . activities” but that the OCMI could determine whether attendance was necessary. 1.14.3 ABS Surveys ABS surveyors examined El Faro seven times in 2015 before the accident. For planned surveys, vessel owners were required by NVIC 02-95 to give at least 14 days’ notice to ACS surveyors. However, that was rarely the case with El Faro. On January 19, an ABS surveyor completed the vessel’s annual survey. The emergency generator was tested online. Bilge alarms, steering gear, and lube oil pumps were all tested, and paperwork for the radio equipment was verified. There were no concerns or findings. On January 23, an ABS surveyor attended El Faro to conduct the annual hull survey and examined handrails, welding on decks, ventilation ducts, mooring cleats, cargo doors, gangway, and the stability book. A drainage plug in the forward bosun’s locker was found to have a small area of wastage, and the coatings on ballast tanks No. 1 port and starboard were rated in “poor condition.” Regarding the procedure for surveying the ventilation ducts on El Faro, the ABS assistant chief surveyor for the Americas Division stated that inspection ports were fitted on the ventilation trunks for viewing the fire dampers in the cargo hold exhausts. During annual inspections, ABS surveyors would use a port to view the condition of a fire damper and see it exercised. Surveyors would not typically enter the ventilation trunks during annual inspections. During an annual inspection, if a surveyor saw something deficient or suspect inside the trunks, he or she could expand the scope of the survey and access the trunks. A surveyor would be expected to go inside each ventilation trunk at the load line renewal survey, which occurred every 5 years. The last survey carried out on El Faro was on January 29, 2011. On January 27, an ABS surveyor attended El Faro to inspect the coatings on ballast tanks No. 1 port and starboard. The surveyor noted the condition of the coatings as still poor. In addition, while inspecting of the No. 1 port ballast tank, the surveyor found frames 50 and 51 detached at the outboard connection to the tanktop. The fillet welds (triangular welds at, for example, corner

NTSB

Marine Accident Report

170 joints) were fractured from the tanktop plating between the weld access hole on the frame at the sideshell to 2 feet inboard, terminating at another weld access hole. The surveyor recommended repairing the area, but TOTE was not required to perform temporary repairs. Instead, the welds were to be repaired at the special periodical survey due on February 26, 2016. On March 10, 2015, an ABS surveyor attended El Faro to verify repairs of the steering system to correct a problem, identified during the COI inspection, with a faulty potentiometer that caused an error of 3° to 4° when steering to starboard. The repairs were completed, and the system tested properly. On April 14, an ABS surveyor attended El Faro to survey repairs to the overhead of the forepeak space near the hatch in the bosun’s storeroom. The area and related hatch were not watertight spaces, in that they were above both the waterline and the vessel’s watertight deck. The area was repaired to the satisfaction of the surveyor, and no pressure tests were needed to test the sufficiency of the repair to this nonwatertight area. On June 16, an ABS surveyor attended El Faro to conduct a continuous machinery survey, during which various pumps were operated, including the bilge/ballast pumps. The emergency generator was also started and tested. No deficiencies were found. On September 8, an ABS surveyor attended El Faro to survey repairs on the port boiler made about 2 weeks earlier, in which Jacksonville Machinery and Repair had installed jumpers to bypass seven leaking economizer tubes. The vessel had made a round trip between Jacksonville and San Juan under normal operating pressure the week before the repairs were made, with no reported problems. The welding repairs to the tubes were inspected and found satisfactory. A hydrostatic test was performed at 800 psi, which the surveyor considered sufficient. Neither the engine logbook nor AMOS contained any entries about the repairs or tests. 1.14.4 Coast Guard Examinations Investigators found that there was no qualification level required for Coast Guard personnel to conduct ACP oversight examinations. At the time of this report, the Coast Guard did not have a formal training program for the ACP. In an evaluation report on the ACP, the chief of traveling inspectors stated that some Coast Guard marine inspectors lacked significant maritime experience, which limited their ability to accurately assess vessel conditions on the basis of inspections. For the 2015 El Faro inspection, the machinery inspector had not yet received his steam qualifications. Due to the diminishing number of steamships in the US fleet, steam-qualified Coast Guard inspectors were becoming a rarity by the time of the accident, and there were fewer opportunities for Coast Guard inspectors to obtain steam qualifications in their training regime. The Coast Guard Vintage Vessel National Center of Expertise, which was created to be a repository of expertise for steam propulsion, riveted hulls, and other legacy vessels, was discontinued in 2013. Therefore, inspectors did not have a resource to consult for guidance regarding older vessels such as El Faro. After the loss of El Faro, the Coast Guard employed traveling inspectors, who were subject-matter experts, to oversee inspections of targeted vessels that were enrolled in the ACP and had successfully completed surveys by an ACS. A number of vessels were found substandard, yet deficiency records for them were lacking. Safety deficiencies were found on each of 15 ACP

NTSB

Marine Accident Report

171 vessels that were targeted for inspection by the traveling inspection team. Three of the vessels were scrapped and two were issued no-sail deficiencies. The traveling inspectors found that many of the vessels found in substandard condition lacked deficiency records from previous inspections. One of the inspected vessels was El Yunque, the sister ship of El Faro. On February 1, 2016, during a SMS audit in Jacksonville, which was attended by Coast Guard traveling inspectors and led by an ABS surveyor, the traveling inspectors examined the ventilation exhaust system in cargo hold 3 and found severe corrosion inside the ventilation trunk. The Coast Guard instructed ABS to oversee the repairs to the ventilation trunks in hold 3 and inspect trunks in the other cargo holds. The following day, temporary repairs were completed and surveyed by an ABS surveyor, who required that permanent repairs be completed to the hold 3 ventilation ducts in 30 days. The ABS surveyor indicated that ventilation trunks in other cargo holds were randomly inspected, and only the starboard exhaust trunk in hold 3 was found to have similar corrosion. The ship was relocated to Seattle in March 2016 to begin converting the vessel for Alaska service. The Coast Guard traveling inspectors conducted several examinations of El Yunque in Seattle and found multiple locations of long-standing and uncorrected wastage in suspect areas and corrosion in the supply trunks of all the cargo holds. In August 2016, TOTE took El Yunque out of service to be scrapped. Coast Guard inspectors and ABS surveyors typically communicated by email or phone regarding vessel inspections and findings, and the ACS surveyors had no access to MISLE to record deficiencies. Although NVIC 2-95 allows the Coast Guard to request ACS attendance during examinations, joint inspections were rare. 1.15 Tests and Research 1.15.1 Fuel Oil Analysis After the accident, NTSB investigators contacted the fuel oil supplier and obtained samples from El Faro’s last three bunkering operations before the accident voyage (September 8, September 14, and September 21, 2015). The samples were sent for testing to an independent facility, Core Laboratories, in Deer Park, Texas. The fuel was tested for flash point, kinematic viscosity, sediment by extraction, and water. The fuel was found to be within ASTM specifications. Table 11 shows results and standards, as reported by Core Laboratories. Table 11. Analysis of El Faro fuel oil samples from bunkering operations before accident. Sample Date (2015) Flash Point (°F) Min 140 Kinematic Viscosity (cSt @ 100°C) Min 15, Max 50 Sediment by Extraction (Wt%) Max 0.5 Water (LV%) Max 1 Water (Wt%) Max 2 September 8 196 38.45 0.02 0.05 0.07 September 14 196 38.45 0.01 0.05 0.06 September 21 194 36.57 0.01 0.10 0.11 NOTE: cSt = centistokes; Wt% = weight percent; LV% = liquid volume percent.

NTSB

Marine Accident Report

172 1.15.2 Rogue Wave Analysis At the NTSB’s request, researchers from the College of Engineering at the Georgia Institute of Technology and the Italian Ship Model Basin INSEAN Institute in Rome studied the potential that El Faro had encountered a rogue wave around the time of the sinking. The team presented its results in October 2016. The existence of rogue waves—unusually tall surface waves that appear without warning in the open ocean—although previously doubted, has been confirmed over the last decade or so. Instruments on an oil platform off the southern coast of Norway measured an 80-foot wave (known as the Draupner) that struck the rig in January 1995 (crest height—distance from mean sea level to wave top—was about 60 feet); in 2000, a British oceanographic vessel recorded a 95-foot wave off the coast of Scotland; in 2007, a double rogue wave named Andrea (75 feet) was measured in the North Sea (crest height, about 50 feet); and in 2015, an 85-foot rogue wave known as the Killard was observed off the coast of Ireland (crest height, 60 feet). A formal investigation, begun in 2000, into the 1980 sinking of the MV Derbyshire during a typhoon south of Japan concluded that the ship had almost certainly encountered waves of at least 92 feet. The possibility therefore existed that El Faro might have encountered a rogue wave during Hurricane Joaquin. The El Faro rogue wave analysis focused on the hurricane sea state during a 1-hour interval around the sinking. Researchers combined high-resolution hindcasts and nonlinear numerical simulations of hurricane-generated sea states with probabilistic (stochastic) models to quantify conditions at the accident location and time. The sea states were hindcast using NOAA’s Wavewatch III model, balancing wind input, four-wave resonance nonlinearities, and wave breaking. To calculate the maximum wave height that could have been observed during the interval in question, researchers used a stochastic space-time model for the encounter probability of a rogue wave, newly developed to support the El Faro investigation. The probability of a vessel encountering a rogue wave is higher if the ship is drifting than if it is anchored at a fixed location, such as an oil platform.179 The study found that the probability of El Faro encountering a rogue wave with a crest height exceeding 14 meters (46 feet) while drifting at a speed of 2.5 meters per second for 10 minutes was approximately equal to 1/400, accounting for vessel size.180 Assuming that the vessel drifted for 50 minutes yielded a probability roughly three times larger (≈ 1/130) of encountering a rogue wave of the same size. Comparing significant wave height, dominant wave period, depth, and other parameters for the simulated El Faro sea state with those for the Andrea, Draupner, and Killard rogue waves yielded similar results. That is, the predicted rogue wave for El Faro had similar generating mechanisms and characteristics as the Andrea, Draupner, and Killard waves.

179 This idea is discussed further in an article published in Scientific Reports, an online publication of the journal Nature (Fedele, Lugni, and Chawla 2017). 180 Corresponding crest-to-trough (wave) height in this calculation was 23 meters (about 76 feet).

NTSB

Marine Accident Report

173 1.15.3 Inmarsat-C Mobile Earth Station Operation Discrepancies of interpretation of the position reports received by authorities, noted in section 1.11.7, warranted further investigation to understand how distress alerts are initiated and sent. Distress messages, including the Inmarsat-C distress alert and the SSAS messages, received from El Faro were transmitted from a Furuno FELCOM 15 mobile earth station installed on the vessel’s bridge. On March 9, 2017, investigators from the NTSB and the Coast Guard Marine Board of Investigation traveled to Furuno’s support center in Denton, Maryland, for familiarization and hands-on testing of a Furuno FELCOM 15 mobile earth station. Testing revealed that on systems equipped with an internal GPS receiver, manual entries superseded automatic position reports. If a manual entry differed from the actual position, the system did not provide a warning or prompt the user about potential discrepancies. Testing further revealed that after a single manual position entry, automatic position updating for distress alerts was disabled for the remainder of a given power cycle. 1.16 Previous NTSB Recommendations 1.16.1 Broadcasting of Position Data by EPIRBs In 2009, the uninspected fishing vessel Lady Mary sank in the Atlantic Ocean southeast of Cape May, New Jersey (NTSB 2011). Six crewmembers died in the accident, and one crewmember survived. The bodies of two crewmembers wearing immersion suits were recovered after the accident, two bodies were discovered later, and two bodies were never found. The NTSB determined that the probable cause of the sinking was flooding originating in the Lady Mary’s lazarette through an access hatch that had been left open during rough weather, contrary to safe shipboard practice.181 The NTSB also found that the inability of the vessel’s EPIRB to transmit position data contributed to a delay in the dispatch of rescue assets. As required by Coast Guard regulations (46 CFR 25.26-20), the Lady Mary was equipped with a float-free, automatically activated EPIRB that could emit a 406-MHz distress signal. An EPIRB signal from the Lady Mary was detected by a geostationary satellite about the time of the sinking, but the satellite could not determine a position because the vessel’s EPIRB was not equipped with an optional GPS receiver. A low earth orbiting satellite, which can establish position information from EPIRBs whether or not their transmissions contain encoded GPS coordinates, had crossed the Lady Mary’s location shortly before the sinking but was out of range of the vessel’s EPIRB signal by the time of the accident. In addition, the EPIRB had not been correctly registered in the database maintained by NOAA, which meant that the sinking vessel could not be identified for search-and-rescue personnel. By the time a Coast Guard rescue helicopter arrived on scene, the two victims whose bodies were retrieved had been in the cold water for 3 to 3.5 hours. The probability of their survival, allowing for their immersion suits, was calculated as between 1 and 1.5 hours for functional time (having the ability to move) and between 2.2 and 3.1 hours for survival time

181 A vessel’s lazarette is the aftermost compartment below its main deck, typically accessed by a deck hatch.

NTSB

Marine Accident Report

174 (staying alive).182 The NTSB concluded that if a rescue helicopter could have been launched after the first EPIRB signal was received, the two victims found in the water wearing immersion suits might still have been alive when the rescuers arrived. Moreover, it was also possible that the two crewmembers whose bodies were never discovered would have been found alive or that their bodies would not have drifted too far from the scene to be found. As a result of the Lady Mary sinking, the NTSB issued a recommendation on March 11, 2010, in advance of the final accident report, that the FCC take the following action: For commercial vessels required to carry 406-MHz emergency position-indicating radio beacons (EPIRBs), mandate that those EPIRBs broadcast vessel position data when activated. (M-10-1) In a response to the NTSB dated July 1, 2010, the FCC stated that it planned to propose a regulation to implement the NTSB’s recommendation. Recommendation M-10-1 was classified “Open—Acceptable Response” on August 19, 2010. On September 1, 2016, the FCC issued a report and order (FCC 16-119) amending 47 CFR 80.1061(a) to incorporate Radio Technical Commission for Maritime Services standard 11000.3, which requires EPIRBs to broadcast position data. Safety Recommendation M-10-1 was classified “Closed—Acceptable Action” on October 14, 2016. 1.16.2 Hurricane Forecasting On June 29, 2017, the NTSB issued ten recommendations addressing tropical cyclone information and its availability to mariners (NTSB 2017b). The recommendations derived from factual information gathered during the El Faro investigation and were addressed to NOAA, the National Weather Service, and the Coast Guard. The factual data revealed that critical tropical cyclone information issued by the National Weather Service was not always available to mariners through well-established broadcast vehicles. The data also suggested that modifying the way the National Weather Service develops certain tropical cyclone forecasts and advisories could help mariners at sea better understand and deal with tropical cyclones. Further, factual data on the official forecasts for Hurricane Joaquin and other recent tropical cyclones suggested that a new emphasis on improving hurricane forecasts was warranted. As noted earlier, the National Hurricane Center reported that it had difficulty in forecasting Joaquin. A branch chief of the National Hurricane Center testified to the marine board that Joaquin “was particularly resistant to wind shear,” which he described as “trying to tear [the cyclone] apart” while “the tropical cyclone is trying to keep the storm vertically coherent.” The crew of El Faro

182 The calculations were made using the Cold Exposure Survival Model, developed by Canada’s Defence and Civil Institute for Environmental Medicine. The model predicts functional time and survival times for cold air exposure and cold water immersion based on cooling of the body’s core and on an individual’s physical characteristics, clothing, and weather and sea conditions. The model does not include the effects of dehydration, injuries, medications, drugs, alcohol, sleeplessness, or circadian hormonal cycles.

NTSB

Marine Accident Report

175 also failed to receive regular advisories about the storm’s changing course and intensity through the ship’s satellite system. In light of this evidence, the NTSB recommended that NOAA take the following actions: Develop and implement a plan specifically designed to emphasize improved model performance in forecasting tropical cyclone track and intensity in moderate-shear environments. (M-17-8) Develop and implement technology that would allow National Weather Service forecasters to quickly sort through large numbers of tropical cyclone forecast model ensembles, identify clusters of solutions among ensemble members, and allow correlation of those clusters against a set of standard parameters. (M-17-9) The NTSB also recommended that the National Weather Service act as follows: Work with international partners to develop and implement a plan to ensure immediate dissemination to mariners, via Inmarsat-C SafetyNET (and appropriate future technology) of the Intermediate Public Advisories and Tropical Cyclone Updates issued by the National Weather Service, in a manner similar to the current process of disseminating the Tropical Cyclone Forecast/Advisory. (M-17-10). Modify your directives to ensure, for all tropical cyclones of tropical storm strength or greater within your jurisdiction, that your facilities issue, at the 3-hour interval between regularly scheduled Topical Cyclone Forecast/Advisories, an Intermediate Public Advisory, a Tropical Cyclone Update, or another product available (or expected to be available) to mariners via Inmarsat-C SafetyNet (and appropriate future technology), and that the product include the coordinates of the current storm center position, maximum sustained surface winds, current movement, and minimum central pressure. (M-17-11) Modify your directives to ensure that the “next advisory” time in a Tropical Cyclone Forecast/Advisory clearly indicates when to expect the next update of “current” or forecast information for that particular tropical cyclone. (M-17-12) Quantitatively define “significant change” in terms of both the track and intensity of a tropical cyclone to guide the issuance of Special Advisory packages. (M-17-13) Ensure that tropical cyclone graphic products issued by entities such as the National Hurricane Center, the Central Pacific Hurricane Center, the Guam Weather Forecast Office, the Joint Typhoon Warning Center, and Fleet Weather Center–Norfolk are made available in near-real time via the FTPmail service. (M-17-14) Allow users to schedule recurring, automated receipt of specific National Weather Service products through an enhanced FTPmail service (and appropriate future technology). (M-17-15) Develop and implement a plan for soliciting feedback from the marine user community, particularly ship masters, about the accuracy, timeliness, and usability of weather services to mariners. (M-17-16) Finally, the NTSB recommended that the Coast Guard take the following action:

NTSB

Marine Accident Report

176 In collaboration with the National Weather Service, provide timely broadcasts of the Tropical Cyclone Forecast/Advisories, Intermediate Public Advisories, and Tropical Cyclone Updates to mariners in all regions via medium-frequency navigational telex (NAVTEX), high-frequency voice broadcasts (HF VOBRA), and high-frequency simplex teletype over radio (HF SITOR), or appropriate radio alternatives (and appropriate future technology). (M-17-17) On June 29, 2017, the NTSB classified Safety Recommendations M-17-8 through M-17-17 as “Open—Await Response.” 1.17 Other Information 1.17.1 Actions Since Accident TOTE. TOTE informed the NTSB of several actions the company had taken since the loss of El Faro. After the sinking, the company introduced a revised approach to risk assessment involving a more quantitative approach that has been incorporated into the EPMV. At the beginning of the 2017 hurricane season, the company sent a reminder to all vessels to review heavy-weather procedures, which included a provision for convening a company hurricane advisory team during cyclones. The company has made weather-routing services available since the accident, even for vessels on short runs, including between Jacksonville and Puerto Rico. It has replaced the previous emergency call center with one that also provides vessel tracking and weather monitoring support to the company. It has increased the availability of email and internet services on its Marlin and Orca vessels.183 The company has formalized its CargoMax training program, instituting regular classes instructed by Herbert Engineering and attended by shoreside personnel and senior deck officers. It has also enhanced its system for tracking crew rest hours and given officers the option to travel the day before they join a ship. It has also upgraded its crew filing and tracking system and is transferring its SMS to an electronic system that will allow access over the internet. The company has contracted with Radio Holland for regular servicing and inspections of bridge equipment on its Marlin vessels and has added a second EPIRB to each vessel (only one is required). It has installed a camera system for monitoring the terminals in Jacksonville and San Juan and is formalizing and documenting a shoreside procedure for tracking inspection and maintenance records for lashing gear. The company has also produced videos for its Marlin-class ships, including one that illustrates a vessel’s general layout and describes the location of safety equipment, escape routes, and emergency equipment. Coast Guard. On October 1, 2017, the Coast Guard Marine Board of Investigation released its report on the El Faro accident. Dated September 24, 2017, the report is titled Steam Ship El Faro (O.N. 561732), Sinking and Loss of the Vessel with 33 Persons Missing and Presumed

183 TOTE’s Orca-class vessels operate between Tacoma and Anchorage.

NTSB

Marine Accident Report

177 Deceased, Northeast of Acklins and Crooked Island, Bahamas, on October 1, 2015. It is publicly available.184 1.17.2 Previous NTSB Investigations Aided by VDRs Information extracted from onboard VDRs has been helpful in several previous NTSB investigations. In certain cases, the VDR information was crucial in revealing the actual course of events, which differed from crewmember or witness accounts. On November 3, 2007, the tankship Axel Spirit allided with Ambrose Light, an aid to navigation, at the entrance to New York Harbor, as the ship was inbound to Perth Amboy, New Jersey (NTSB 2009a). The impact caused $10 million in damage to Ambrose Light and $1.5 million in damage to the ship. The master and the bridge team did not mention the allision to the pilot who boarded the ship shortly thereafter, nor did they notify the Coast Guard or the shipping company about the accident until after the Axel Spirit was docked in Perth Amboy and the master had ascertained that the ship had visible damage. He told investigators that he did not realize that the ship had hit Ambrose Light. However, when investigators reviewed the bridge audio recording captured by the ship’s VDR, it was clear that the allision was audible, alarms began sounding, and the master reacted verbally to the impact. On January 24, 2008, the fruit juice carrier Orange Sun allided with a moored dredge while outbound in Newark Bay, New Jersey, causing more than $6 million in damage (NTSB 2009b). Initial reports suggested that the Orange Sun had experienced rudder failure when it veered off course and struck the dredge. However, when investigators reviewed the extracted wheel input and rudder response information from the juice carrier’s VDR, it was clear that the helmsman and the master had made incorrect wheel inputs, which they did not recall making. On March 5, 2015, tanker Chembulk Houston and container ship Monte Alegre collided and grounded in the Houston Ship Channel, after the pilots agreed to an overtaking maneuver (NTSB 2016b). The VDR data and audio recovered from both vessels allowed the NTSB to determine that the probable cause of the collision was the pilot’s decision to increase speed on the Monte Alegre without informing the deputy pilot on the overtaking Chembulk Houston. On March 9, 2015, the inbound bulk carrier Conti Peridot collided with the outbound tanker Carla Maersk in the Houston Ship Channel near Morgan’s Point, Texas (NTSB 2016a). The NTSB determined that the probable cause of the collision was the inability of the pilot on the Conti Peridot to respond appropriately to hydrodynamic forces after meeting another vessel during restricted visibility and his lack of communication with other vessels about this handling difficulty. VDR data and audio recovered from the Conti Peridot showed that the inbound Conti Peridot experienced a near miss with another outbound vessel about an hour before the collision.

184 See http://www.news.uscg.mil/News-by-Region/Headquarters/El-Faro-Marine-Board-of-Investigation/.

NTSB

Marine Accident Report

178 2 Analysis 2.1 General The analysis first identifies factors for which there was insufficient evidence to support a conclusion or that could be eliminated as causal or contributory to the sinking of El Faro. The analysis then discusses the following: • The sinking • Weather information • Captain’s decision-making • Bridge resource management • Oversight • Contributions to loss of life • Other issues 2.2 Inconclusive Factors 2.2.1 Fatigue The chief engineer told his wife that he was exhausted from all the maintenance and issues he had in the weeks before the accident. Two friends of the second mate told investigators that she complained about fatigue as a result of her watch schedule, coupled with relieving other officers during mealtimes when she was not on watch and the additional work required at sea under company procedures and the union contract (12-hour days for the crew). The captain, similarly to the other officers, normally worked a 10-week rotation (10 weeks off after 10 weeks on the ship). He started a work rotation on May 5, 2015, and left the ship on July 14. When his relief resigned 3 weeks later, the captain was asked to return early. Four weeks into his vacation, on August 11, he returned to work on board El Faro. According to TOTE management, the captain was scheduled to work until December. When the ship was in port, the crew usually requested port mates to help with loading and unloading cargo in an effort to alleviate the work of the crew and allow the possibility for rest. The captain had requested a port mate to assist the ship with the final cargo-loading in Jacksonville. However, with the exception of September 1, no port mates were available in Jacksonville on any of the ship’s September runs, which increased the crew’s workload and reduced the time available for rest. The third mate’s August–September STCW work/rest logs showed four violations of

NTSB

Marine Accident Report

179 Title 46 CFR 15.1111, each of which followed a scheduled day in port (one rest period must be at least 6 hours long).185 Some of the crew had been working 12-hour days, 7 days a week, for 10 weeks straight. Although detailed work-rest records could not be obtained for the crew on the accident voyage, the VDR audio recording confirmed that the captain and the crew were on the bridge at their scheduled duty times leading up to the sinking. A conversation about a crewmember’s use of over-the-counter sleep aids was recorded on the VDR. However, insufficient details (time taken, dosage) prevented investigators from determining whether it could have affected that crewmember’s performance. Although the El Faro crewmembers were most likely fatigued, the degree to which fatigue affected their performance could not be determined. 2.2.2 Drugs/Alcohol Regarding potential drug and alcohol use, no toxicological testing could be completed. Evidence was insufficient to determine whether drug or alcohol use played a role in the accident. 2.3 Exclusions 2.3.1 Boilers/Machinery VDR data did not show that El Faro ever lost electrical power during the sinking, which indicates that the ship’s boiler system―which supplied steam to drive its electrical generators―was operational. Further, the VDR audio recordings did not indicate any boiler failures. The captain mentioned bringing a boiler back online in the VDR, but that does not suggest with certainty that either boiler was ever actually shut down. In fact, that is the only remark throughout the VDR audio recording about the boilers. Further, the VDR data identified that the following electrical systems―among other less-critical ones―were operational until the end of the VDR recording: steering system, ramp tank ballast pumps, bilge/ballast pumps, communication equipment, and various ship’s lighting systems. There was no mention of the emergency generator needing to supply emergency power. Thus, the NTSB concludes that the mechanical condition or operation of El Faro’s boilers, steering, electrical power, and machinery were not factors in the accident. 2.3.2 Riding Gang The five Polish nationals known as the riding gang were working on installations and modifications to the cargo decks for the vessel’s upcoming return to the Alaska trade. The work included reinstalling winches, pulling wiring, and installing piping and was unrelated to the

185 STCW regulations require 77 hours off-duty in any 7-day period—the equivalent of a 91-hour-maximum work week. With a 12-hour minimum day, the El Faro crew already worked 84 hours per week. STCW regulations also require that if rest periods are broken up within a 24-hour period, at least one of the rest periods must be no less than 6 consecutive hours.

NTSB

Marine Accident Report

180 sinking. Thus, the NTSB concludes that the work being performed by the riding gang of foreign nationals did not contribute to the sinking of El Faro. 2.3.3 Failure of Container and Ro/Ro Trailer Lashings Investigators, after reviewing all available data and evidence, determined that some of the Ro/Ro trailers and main deck containers were not loaded and secured in accordance with the guidelines recommended by the vessel’s cargo-securing manual. Investigators also determined that the inspection and maintenance of the vessel’s cargo-securing gear was not in accordance with CSS code requirements. However, the NTSB concludes that neither improper securement of the trailers and containers nor inadequate maintenance of the vessel’s cargo-securing gear contributed to the vessel’s initial list. 2.3.4 Cargo Shift The VDR recorded a crewmember mentioning a trailer leaning and cars loose in hold 3, but there was no specific mention of a large cargo shift or loss of cargo. The Coast Guard’s Marine Safety Center analyzed the effect of a shifting of 20 containers by 10 feet (similar to container deformation and leaning to one side without falling overboard) and found that compared with the effect of floodwater and hurricane-force beam winds, such a shift would have produced “small reductions in righting arms and small induced heel angles.” The Marine Safety Center also analyzed a complete loss of topside containers in a bay and found that such a scenario would have temporarily improved the vessel’s stability. Dynamic analysis showed that larger heel angles were more likely from cargo-hold flooding than from a shift of Ro/Ro cargo. Investigators estimated that the shifting of cars in hold 3 at the tanktop would also not have caused an appreciable heel angle. Thus, the NTSB concludes that cargo shifting was not a major factor in the vessel’s initial list. 2.3.5 Medical Issues Review of the crewmembers’ medical records (on file with the Coast Guard) revealed no medical conditions or use of prescription medications that would have been factors in the sinking. Absent toxicology results, investigators could not verify that crewmembers were not taking medications. The NTSB concludes, however, that the medical fitness of the El Faro crew and any prescription medication use by the crew were most likely not factors in the accident. 2.3.6 Captain’s Decision to Depart Jacksonville El Faro’s first opportunity to avoid Hurricane Joaquin was before the ship left Jacksonville. Ordinarily, a captain and his navigation team would plan to leave port according to the ship’s schedule and after reviewing the passage plan and conducting a risk analysis. Part of a risk analysis should include a review of the weather conditions forecast along the route, giving particular consideration to allowing time to change the ship’s speed or route, or both, if necessary.

NTSB

Marine Accident Report

181 The ship had more than a day before it expected to encounter bad weather, and options were available for changing its route after departing if the storm became a hurricane. Since the storm was still several hundred miles away, its forecast track also had time to change. The captain would have weighed the consequences of delaying his arrival in San Juan and most likely considered the risk to be low of departing as scheduled. El Faro had sufficient speed and options for avoiding the forecast weather if conditions worsened. Thus, the NTSB concludes that the captain’s decision to depart Jacksonville was reasonable considering the availability of options to avoid Tropical Storm/Hurricane Joaquin. 2.3.7 Structural Failure Significant damage was noted to the vessel’s wreckage on the seafloor. Although there was no indication on the VDR recording of a structural failure before the sinking, part of the dynamic sinking analysis was intended to identify the cause of the damage. The severe damage to El Faro’s stern and the large transverse hull crack just aft of the aft engine room bulkhead (between bays 16 and 17) were both consistent with seafloor impact. Sonar images that appear to be hydraulic outburst marks to both port and (to a lesser degree) starboard of the crack indicate that entrained water jetted outward, moving the bottom sediment. In addition, the Marine Safety Center analysis concluded that the ship met all requirements for strength and found no visible evidence of hull failure in video of the wreckage. Thus, the NTSB concludes that there is no evidence that the vessel suffered a hull break or other significant structural failure while on the ocean surface that was a factor in the accident. 2.3.8 Rogue Wave Although rogue wave formation is still not fully understood, scientists know that certain sea conditions are more conducive to rogue waves than others. Postaccident calculations, conducted at the NTSB’s request by scientists from the College of Engineering at the Georgia Institute of Technology and the Italian Ship Model Basin INSEAN Institute in Rome, determined probabilities of about 1/400 and about 1/130 of El Faro encountering a rogue wave during the final 10 minutes and final 50 minutes of the accident voyage, respectively. The VDR recorded no discussion on the bridge (and the investigation provided no other evidence) of a rogue wave encounter. Further, the parametric data on ship’s motion recorded by the VDR showed no evidence of a response to a rogue wave. Thus, the NTSB concludes that a rogue wave was not a factor in the sinking of El Faro. 2.4 The Sinking El Faro sank an hour and a half after it lost propulsion. From the time it left port the evening of September 29, the ship traveled at near-maximum speed, between 19 and 20 knots, for almost 30 hours. But it began to slow and develop a wind-driven starboard list when it came out of the protective lee of San Salvador Island about 0130 on October 1 and encountered the steadily increasing force of the wind. The ship’s speed dropped quickly to 18 knots and fell more or less

NTSB

Marine Accident Report

182 steadily from then on, as shown in figure 62. (Engine speed, or propeller rpm, was not recorded by the vessel’s VDR, but parametric data captured the ship’s speed over ground.)

Figure 62. Ship’s speed over ground from 0200 to 0730 on October 1. The wind and seas intensified as El Faro continued southward. The vessel started to set, or be pushed from its intended course by the wind and current. Around 0245, it began hitting large waves, and at 0253, the first off-course alarm sounded. (The ship was steering by autopilot.) About a half hour later, the off-course alarm sounded for the second time. The winds increased, and the off-course alarm began sounding nearly continuously. After the chief mate came on the bridge at 0345 for the 0400 watch change, he turned the alarm off and began slightly changing the heading more into the wind. About the same time, the engineers began blowing tubes in the boilers, which reduced the ship’s speed by 2 to 3 knots. The graph in figure 63 demonstrates the relationship between ship’s speed over ground and wind speed and direction, based on poststorm weather analyses. It shows that the increasing winds on the port side between 0400 and 0600 account for the vessel’s starboard heel, while the shift of wind to the bow helps explain part of the vessel’s slowing after 0400. The NTSB concludes that the initial list was caused by an increasing wind on the vessel’s beam generated by Hurricane Joaquin. About the time the watch changed, the crew began discussing that they were listing, or heeling, to starboard from the force of wind on the port side (windheel). By that point, the vessel’s speed had dropped to less than 10 knots. The captain talked about shifting the water in the ballast (ramp) tanks to diminish the list. The vessel continued to make headway, though slowly, despite the sustained starboard list and the deteriorating weather.

NTSB

Marine Accident Report

183

Figure 63. Ship’s speed over ground relative to wind direction. Wind directions obtained from NTSB-chartered dynamic analysis (by CSRA Inc.) and TOTE weather analysis submission. 2.4.1 Loss of Propulsion About 0427, blowing tubes concluded, and the main engine propulsion shaft was running at 100 rpm. At 0440, the engine room notified the bridge that the starboard list was affecting the oil levels in the engine room. (The degree of starboard list on the vessel was not quantified from VDR-recorded audio.) In an effort to correct the list, the captain put the vessel into hand-steering and changed course slightly to port (into the wind to reduce windheel). At 0543, rising water levels in hold 3 were reported to the bridge, along with an open scuttle on the starboard side of the second deck. While talking to the chief engineer a few minutes later, the captain ordered the engineers to transfer ballast water from the starboard ramp tank to the port ramp tank. The tanks, which were on either side of the aft bottom of the ship, could correct a list up to about 3°. At 0552, the captain told the chief engineer over the phone that he was going to “turn the ship . . . give us a port list.” A minute later, the chief mate radioed the bridge and reported that the floodwater was knee deep, pouring over the edge of the scuttle on the starboard side. The captain advised him that he was “comin’ left.” The captain made a large (about 60°) course change to port, purposely shifting the vessel’s heading to put the wind onto the starboard side of the ship to generate a port list that would allow the crew to better investigate the source of the flooding. By 0558, the list had shifted to port. The port list may have been slightly greater than the previous starboard list because of the ballast water that had been transferred to the port ramp tank for a few minutes. The vessel lost propulsion shortly after the list was shifted to port, and the vessel’s port list continued until the sinking. 02:00 03:00 04:00 05:00 06:00 07:00 08:00 -80 -60 -40 -20 0 20 40 60 80 On Bow Longitudinal Wind Speed (Knots) Time (hr:mm) EDT CSRA Weather Analysis Tote Weather Analysis From Stern 0 2 4 6 8 10 12 14 16 18 Ship Speed (Knots) Ship's Speed over Ground (Knots) Longitudinal Wind Component -80 -60 -40 -20 0 20 40 60 80 From Starboard From Port Side (Beam) Wind Component Side Wind Speed (Knots)

NTSB

Marine Accident Report

184 The VDR recorded no conversations from the engine room, so it is unknown what actions the crew took to counter the problem with the lubrication oil levels (which were not captured electronically) or what the problem actually was. The mostly likely scenario, however, is that the vessel’s sustained list to port caused the lubrication oil in the main engine sump to fall below the bellmouth of the suction pipe leading to the pumps (refer to figure 11, section 1.3.6). The pumps were about 9 1/2 feet above the suction bellmouth, which was about 10 inches above the bottom of the tank and about 22 inches starboard of the sump’s centerline. Because the bellmouth was offset to the starboard side of the sump’s centerline, the system was more susceptible to losing suction from a port list. Thus, the NTSB concludes that the port list, coupled with the vessel’s motion, most likely caused air to enter the bellmouth of the suction pipe to the lube oil service pump, which resulted in a loss of oil pressure that caused the main engine to shut down. The loss of oil pressure would have triggered a protective device, the low-lube-oil-pressure switch, which would have shut off the flow of steam to the main engine. To reset the switch, lube oil pressure would have had to be restored. Loss of lube oil pressure would also have caused the reserve oil in the 3,200-gallon gravity tank in the upper engine room to start flowing to the main engine. During normal operations, oil in the gravity tank constantly overflowed back to the main engine sump through an illuminated sight glass (“bull’s-eye”). The system was designed so that if lube oil pressure to the pumps was lost, the oil in the gravity tank would automatically flow to the main engine through an orifice and, in about 8 minutes, empty its contents into the sump, giving the engineers time to stop the main engine. Emptying the gravity tank would raise the oil level in the sump above its 2,870-gallon design capacity. But since the bellmouth would already have risen out of the oil and caused a vapor lock in the lube oil pumps (which were nearly 10 feet above the suction inlet), the pumps would have needed priming before they could draw up lube oil and resume pumping. To establish a prime, the pump casings would have had to be filled with lube oil from another source, such as the storage tank in the upper engine room. Both a former port engineer who was authorized to service the main engine and another engineer who had sailed aboard the Ponce-class vessels estimated that the pumps would internally destruct after operating about 30 minutes without lubricating oil. According to logbook entries, the level of oil in the main engine had been kept at 25 or 26 inches for most of the 2 years before the accident. The sounding table from El Faro’s sister ship El Yunque indicated that 26 inches corresponded to a quantity of 1,345 gallons. (El Faro’s sounding table was not available.) TOTE’s operations manual recommended maintaining an operating level of 1,426 gallons. The printout from the CargoMax loading software showed that when El Faro left port, it had 163.8 cubic feet of lube oil in the main sump, or 1,226 gallons. On El Yunque’s sounding table, that amount corresponded to an oil level of 25 inches. Thus, the NTSB concludes that the level of lube oil in the main engine sump was not maintained in accordance with the vessel’s operations manual, which increased the propulsion system’s susceptibility to loss of oil pressure. At 0518, the VDR captured a conversation about a possible 18° list. The captain later reported the list as between 10° and 15°. The 1973 construction standards to which the ship was built required the main engine to operate with a 15° static list (no wind or waves acting on the

NTSB

Marine Accident Report

185 vessel). The Coast Guard Marine Safety Center modeled and analyzed the lube oil levels in the main engine sump in a static condition. The safety center concluded that with 1,226 gallons of oil in the sump, as was likely on the accident voyage, and a 5-foot trim by the stern (0.4°), the bellmouth opening of the line leading from the sump to the lube oil pumps would break the oil’s surface at an 18° port list. At that point, the bellmouth would no longer be submerged in the lube oil and air would enter the pumps, causing a vapor lock. Figure 64 displays the results of the Marine Safety Center’s analysis.

Figure 64. Effect of 18° port list on lube oil system with oil level at 26 inches. (Graphic by Coast Guard Marine Safety Center, modified by NTSB) By 0558, the vessel was listing to port, and about 5 minutes afterward, the ship’s speed quickly dropped to 4 knots. At 0606, the speed was zero knots. At 0613, after talking to one of the engineers in the engine room, the captain announced that they had “lost the plant.” That is, the main engine had stopped and had not been restarted. From that point, El Faro was “dead in the water,” with the ship’s starboard side nearly perpendicular to the wind (beam to) and at the mercy of the wind and seas. Its speed over ground was now about 6 knots and it was being pushed southwest by the wind, although radar images show that its bow was facing northwest. Heavy weather poses a risk to critical machinery because it can cause movement of the vessel that places equipment outside normal operating parameters. To mitigate the risk, operators

NTSB

Marine Accident Report

186 should provide guidance to vessels on what steps can be taken to reduce the effect of heavy weather. In this case, El Faro departed Jacksonville with lube oil levels in the main sump below normal operating requirements, and TOTE did not provide guidance to the crew about raising the oil level in critical machinery during heavy weather. Previous El Faro engineers testified that the lube oil in the sump had been maintained as high as 32 inches in the past, to keep a safe level. Additional lube oil could be carried in a 4,465-gallon storage tank on the operating level of the engine room and a 4,608-gallon settling tank next to it. Both tanks had 1-inch pipes connecting the bottoms of the tanks to a 2-inch common line for adding lube oil to the sump. According to CargoMax, the lube oil storage tank had 10 tons of reserve oil (2,850 gallons) when the ship left Jacksonville (the settling tank was empty). Even though only one source of additional oil was available, the crew could have added oil to the sump from the storage tank early in the voyage (before oil pressure was lost) without dangerously depleting the reserve supply. With an oil level of about 32 inches, as had been maintained in the past, it is unlikely that the lube oil would have fallen below the bellmouth of the suction pipe that supplied oil to the service pumps, even with the vessel listing as much as 18° at about 0600 the morning of the accident. A simulation of the oil level at a maximum operating level of 32 inches is shown in figure 65. With the bellmouth immersed, the oil supply to the pumps would most likely have continued uninterrupted, the pumps would have continued to supply lubrication oil to the main engine, and the engine would have continued to run for longer than in the accident sequence. Thus, the NTSB concludes that if the company had provided guidance to the engineers about the list- induced operational limitations of the engine as well as about raising the level of lube oil in the main engine sump before or during heavy weather, the additional quantity of oil in the sump would have kept the suction pipe submerged at greater angles of inclination and increased the likelihood of maintaining propulsion. Therefore, the NTSB recommends that TOTE establish standard operating procedures for heavy weather that address operational limitations and oil levels in critical machinery to ensure their continued operation.

Figure 65. Effect of 18° port list on lube oil system for main engine with 32 inches of lube oil in sump, looking from aft to forward. (Graphic by Coast Guard Marine Safety Center, modified by NTSB)

NTSB

Marine Accident Report

187 Design standards known as machinery angle of inclination requirements exist to keep a vessel’s critical machinery and electrical systems operating in static and dynamic conditions that a vessel might encounter at sea. El Faro sailed meeting the standards in place at the time of its construction, which required all lube oil systems to function satisfactorily when the vessel was permanently inclined to 15° athwartships (list) and 5° fore and aft (trim). Current standards require operation with the same athwartships 15° static list but have a separate 22.5° dynamic component (rolling from wind and waves), while fore and aft angles are 5° static and 7.5° dynamic. Even ships with today’s standards can lose propulsion in rough weather and heavy seas. Current standards for lifeboats are that they must be safely launchable at a 20° static list (5° above the machinery standard). The NTSB recently investigated an accident on a Ro/Ro ship built in 2007 (NTSB 2013b) that encountered rough weather and heavy seas (33- to 50-knot gusts and wave heights of 18 to 32 feet). The vessel lost propulsion when the main diesel engine shut down owing to low lube-oil pressure, placing the vessel beam to the seas and resulting in cargo movement in the holds that started an uncontrolled fire. Thus, the NTSB concludes that increasing the minimum athwartships angle of inclination requirements for both static and dynamic conditions would provide an additional margin of safety for vessels exposed to high winds and large sea states. Therefore, the NTSB recommends that the Coast Guard revise regulations and the International Association of Classification Societies (IACS) recommend to its members to increase the minimum required propulsion and critical athwartships machinery angles of inclination. Concurrently, requirements for lifeboat launching angles should be increased above new machinery angles to provide a margin of safety for abandoning ship after machinery failure. The initial starboard list and vessel motion most likely resulted in fluctuating liquid levels in various equipment in the engine room, such as the main engine, boilers, and turbogenerators. After phone conversations with the chief engineer, the captain purposely altered course to ease the starboard list to address the issues with the oil levels and allow the crew to investigate the cause of flooding in hold 3 by shifting the floodwater away, which would also allow the crew to secure the scuttle to hold 3. The course change and subsequent port list resulted in an immediate loss of propulsion, most likely because the ship’s list and motion exceeded the main engine’s maximum design angle of 15o. Interviews of previous engineers and deck officers aboard El Faro and other Ponce-class vessels did not discover a historical example of a loss of oil pressure in rolls above 18°. It is therefore unlikely that engineers passed on any experience involving a loss of propulsion due to a vessel list. Investigators determined that it was unlikely that the El Faro crew had information readily available that would advise them of the maximum list angles of propulsion or critical machinery. Thus, the NTSB concludes that the crew was most likely unaware of the operational limitations on the main engine from a sustained excessive list. Machinery manufacturers design equipment to meet an overall maximum angle for satisfactory operation. Postaccident analysis identified the maximum list angle at which the main engine’s lube oil system would have continued to operate. Had the captain been aware of the maximum angle, that might have influenced his decision to shift the list to port. More importantly, the increasing list should have been addressed earlier. Thus, the NTSB concludes that if the ship’s

NTSB

Marine Accident Report

188 officers had known the maximum static list angle at which the main propulsion engine would operate, they would most likely have attempted to reduce the initial list sooner and possibly avoided the loss of propulsion. Therefore, the NTSB recommends that IACS recommend to its members to require, and the Coast Guard propose to the IMO, that design maximum operating angles of inclination for main propulsion and other critical machinery be included in damage control documents, stability instruments and booklets, and in the SMSs for all applicable vessels. 2.4.2 Flooding At 0543 the morning of the sinking, after receiving a phone call, the captain said they had a problem in hold 3. The chief mate mentioned a “suspected leak” and “the scuttle.” On the captain’s orders, the chief mate went to the hold to check for flooding. About 10 minutes later, in another phone call, the captain confirmed that water was coming into hold 3 through an open watertight scuttle. That was probably the first source of floodwater into hold 3 or any watertight part of the vessel. The scuttle was secured about 0600. Open Scuttle on Second Deck. El Faro had scuttles on the second deck. The scuttles were regularly opened and closed at sea so that crewmembers could access the lower cargo holds from the second deck. Such actions were not reported to the bridge or logged in the deck logbook. The evening before the sinking, after a discussion of the film The Perfect Storm, the chief mate said he needed to send the crew down to the second deck: “Those scuttles need to be dogged—not just flipped down . . . they need to be spun and sealed.” Scuttle covers had handwheels that operated steel dogs (fasteners), which drew the gasket on a cover tight to the lip of a scuttle and made it watertight. No remote indicators were installed on the scuttles to indicate whether they were opened or closed (secured). Witnesses at the marine board testified that a person could not tell by looking whether the covers on the scuttles were secured—one had to try to turn the handwheel to determine whether a hatch was closed. Open/close indicator switches could, however, be installed that would indicate that a scuttle was closed only if the gasket on the scuttle’s cover was compressed sufficiently (by the dogs) to ensure the scuttle’s watertight integrity. International requirements (SOLAS) for cargo ships constructed after February 1, 1992, state that “access doors and access hatch covers normally closed at sea, intended to ensure the watertight integrity of internal openings, shall be provided with means of indication locally and on the bridge showing whether these doors are open or closed.” The SOLAS requirements do not define “internal opening,” which introduces ambiguity and might allow for a hatch similar to the scuttles on El Faro. Thus, the NTSB concludes that if the second deck access hatch (scuttle) had been fitted with a remote open/close indicator at a manned location, such as the bridge, the crew would have known that the watertight hatch to cargo hold 3 was open. Therefore, the NTSB recommends that IACS recommend to its members to require, and the Coast Guard propose to the IMO, that all watertight access doors and access hatch covers normally closed at sea be provided with open/close indicators both on the bridge and locally. The chief mate said the scuttle on the starboard side of the second deck leading to hold 3 was open when he investigated and closed it about 0600 the morning of the sinking. Because of

NTSB

Marine Accident Report

189 the starboard list, the starboard side of the ship would have been lower to the waterline, resulting in green seas accumulating on the second deck through the hull openings. The open scuttle would have allowed the water to enter the lower decks of cargo hold 3. Thus, the NTSB concludes that a watertight scuttle to cargo hold 3 on the second deck was open, allowing the unintended ingress of water and violating the ship’s watertight envelope. Investigators found no written company procedures for monitoring or logging the opening and closing of watertight doors and hatches at sea. Therefore, the NTSB recommends that TOTE establish procedures for opening, closing, and logging all closures that make up a vessel’s watertight envelope while the vessel is at sea. Water Entering Hold 3, Fourth Deck. The second deck (not the main deck above it) was the freeboard deck on El Faro.186 It was only partially enclosed and could take on green water through several openings on both sides of the ship, including two large openings in the starboard side through which trailers were loaded. Once water began flowing down through the open scuttle on the second deck, openings in the third deck (grated air vents and cloverleaf cutouts that formed part of the cargo-securing arrangements) would have allowed water to reach the fourth deck of hold 3, which held 50 of the 149 cars carried on the vessel. According to the VDR, the bridge was notified of water in hold 3 at 0543 the morning of the sinking, and a minute later, the captain said, “We got cars loose.” From testimony and evidence obtained from El Faro’s sister ship El Yunque, the automobile-lashing arrangements on El Faro did not conform to the recommendations of the vessel’s cargo-securing manual. Instead of each automobile being individually secured at each corner to D-rings fixed on the deck, they were secured to a long chain that ran across the width of the ship and was secured to D-rings at either end. Some of the chains passed through a D-ring before being secured to additional D-rings at each end. This arrangement was not as secure as that specified in the cargo-securing manual because it did not allow individual automobiles to be tensioned tightly. Instead of tension at each corner, the cars were attached to chains. Through finite element modeling, the NTSB examined the automobile lashings (and their possible failure points) for the vessel accelerations that were calculated to have been experienced by El Faro on the accident voyage. Given the assumptions employed in the models, the automobile lashings in hold 3 would have failed before the loss of propulsion when the deck became wet, reducing the friction between the tires and the deck. Thus, the NTSB concludes that because the automobile-lashing arrangement on El Faro did not meet the requirements of the vessel’s approved cargo-securing manual, automobiles were more likely to shift from vessel motion in heavy weather. Flooding in hold 3 would have had three effects on the automobile cargo. First, small amounts of water would have reduced the coefficient of friction between the cars’ tires and the ship’s steel deck, lowering the list angle and accelerations (caused by vessel motions in the large sea state) needed to allow the cars to slide. If one car slid, it would have tended to pull with it the other cars lashed to the same chain. Second, as water rose in the hold, the cars would have begun to float. Third, even if the automobiles were secured to prevent floating, the mass of sloshing water would have acted against the cars as the vessel rolled, and crew comments recorded by the VDR

186 The freeboard deck is normally the uppermost continuous deck exposed to the weather and the sea. It has permanent means of closing all openings weathertight, and below it all openings in the sides of the ship are fitted with permanent watertight closings.

NTSB

Marine Accident Report

190 confirm that some had broken free of their lashings. Thus, the NTSB concludes that the introduction of water to cargo hold 3, combined with the vessel’s motion, led to failure of some lashings and automobiles becoming unsecured. Unprotected Inlet Piping to Fire Pump. The vessel’s emergency fire pump, sea chest, inlet strainer and valves, and associated piping were located in the starboard aft corner of hold 3 on the fourth deck. At least one vertical steel stanchion and a steel ladder were installed in front of the pump to protect it. There is no evidence, however, that the piping, the strainer, or the inlet valve were similarly protected. About the time of the initial flooding, the intake pipe (sea suction) for the emergency fire pump was about 22 feet below the waterline, where the head pressure created by seawater would provide ample water supply to the pump. Between the pump and the sea chest was a skin valve that had a manual remote operator, or reach rod, located on the second deck near the scuttle to hold 3. Skin valves with remote operators are fitted aboard a ship to allow the crew to secure the source of unintentional water ingress to a space. The skin valve on El Faro’s emergency fire pump was normally closed at sea. Cars were first reported loose in hold 3 at 0544, at the same time the captain said it was unsafe to enter hold 3 due to “gear adrift” and “a lot of water.” The bilge pumps were already running. If cars were loose by that time, one or more of them could have hit the unprotected inlet piping section of the emergency fire pump, rupturing the piping or damaging the skin valve so that it could not stop seawater from entering the hold. At 0714, the VDR recorded the chief mate reporting that the chief engineer had said that something hit the fire main and “got it ruptured, hard.” (The entire fire system, including the emergency fire pump and piping, was known as the fire main.) The captain asked if there was a means to “secure that,” and the chief mate replied, “between the sea suction and the hull or what uh but anything I say is a guess.” His response indicated that the inlet piping was possibly damaged. No one on the VDR recording mentions that the crew attempted to shut the inlet (skin) valve to stop the flooding, but since it was normally closed, the crew may have already understood that shutting the valve would not stop the flooding. Cars were reported to be floating in hold 3 at 0717, indicating that additional flooding of the hold had reached a level of several feet. Damage to the sea chest or 6-inch sea suction piping would have allowed seawater to rush into hold 3. Thus, the NTSB concludes that it is likely that the seawater piping below the waterline to the vessel’s emergency fire pump in cargo hold 3 was inadequately protected from impact and was struck by one or more cars that had broken free of their lashings. The NTSB estimated that completely severing the 6-inch inlet to the emergency fire piping would have initially allowed about 600 long tons of water per hour into the hold. The Coast Guard Marine Safety Center report (MSC 2017) summarized earlier (in section 1.12.10) shows that partially flooding hold 3 (at 0.7 permeability) to 10 percent would fill it with 693 long tons of seawater. That amount is roughly equivalent to the amount of floodwater that the damaged inlet pipe would produce in the first hour. Considering the reduction in floodwater due to bilge pumping and the 1 1/2 hours from 0543 to 0710, it appears that the piping breach could have filled the hold from 10 to 20 percent. The Marine Safety Center’s report further noted that for lower levels of

NTSB

Marine Accident Report

191 flooding in hold 3 (10 to 30 percent), when considered in combination with an 80-knot beam wind, “the residual righting energy (area under the righting arm curves) is reduced significantly.” In addition, the report noted that “the vessel would have been in a vulnerable state and susceptible to capsizing even with flooding only of hold 3, when considering the combined effects of partial flooding, wind heel and roll motion.” In summary, the floodwater in hold 3 would have reduced El Faro’s freeboard (increased its draft), placing the ship’s cargo hold ventilation openings (tops of baffle plates) closer to the waterline. The floodwater would also have reduced the righting arm and GM, allowing the forces of severe wind and waves to more easily roll El Faro about its sustained port windheel. The rolling would have increased the chance of the portside ventilation openings being submerged as well, which were determined by the Marine Safety Center study to then critically downflood and sink the vessel. Thus, the NTSB concludes that impact damage to the seawater piping below the waterline to the emergency fire pump in cargo hold 3 most likely led to flooding in the hold, which significantly compromised the vessel’s stability. Therefore, the NTSB recommends that IACS recommend to its members to require, and the Coast Guard propose to the IMO, that on new and existing vessels, seawater supply piping below the waterline in all cargo holds be protected from impact. Bilge Pump and Alarm System. Water in the cargo holds collected in port and starboard bilgewells, called roseboxes, which were recessed pockets in the aft corners (one port and one starboard) of each cargo hold on the fourth deck. The bilge pumping system for dewatering the holds took suction through 4-inch pipes from the roseboxes, which each held about 10 gallons of water. The bilge system had two electrically driven bilge pumps that were each rated at 850 gpm. Based on the accident draft of the vessel, the initial rate of flow through a completely severed 6-inch sea suction was calculated at roughly 600 long tons per hour (about 2,600 gpm). If impact to piping also damaged the larger-diameter sea chest, the rate could have been higher. Investigators estimated that with operational factors, the bilge system would pump water out of the hold at a somewhat lower rate than the 850-gpm capacity of a single pump, or 600 to 850 gpm (138 to 195 long tons per hour). The crew continuously pumped the hold 3 bilges from the first indication of flooding at 0543. Thus, the NTSB concludes that the rate of flooding in cargo hold 3 exceeded the design capacity of the bilge pumps and therefore did not lower the water level in the hold, despite continued pumping during the accident sequence. Although El Faro was not required to have a bilge high-level alarm system for its cargo holds, TOTE had earlier installed bilge alarms to alert shoreside personnel of excess water in the holds while the vessel was in layup. According to the installer, a stainless-steel float was installed in the upper section of the roseboxes on the tanktop level. When the water in a rosebox rose high enough to raise the float for 5 seconds, a signal went to an alarm panel in the engine room and activated audible and visible alarms. The sound of the alarm could be turned off, but a red light would remain lit on the alarm panel until the float returned to its normal position. The bilge alarm sounded only in the engine room, not on the bridge. The bilge float was tested by lifting it and verifying that the alarm sounded. Both bilge pumps had been operationally tested and found functional at the vessel’s last ABS machinery survey on June 16, 2015. A former El Faro chief engineer estimated that about 50 gallons might set off the alarm in case of a starboard list.

NTSB

Marine Accident Report

192 Engineers and deck department crew who had worked aboard El Faro told investigators that a bilge high-level alarm in hold 3 was typically investigated by the engine room watch and reported to the bridge watch. The VDR did not provide direct evidence of how the crew became aware of flooding in hold 3, nor did it record any mention of the bilge alarm going off in hold 3. According to a statement on the VDR by the chief mate, the engine room was running bilge pumps at the same time flooding in hold 3 was reported to the bridge. As the water level continued to rise in hold 3, the captain checked periodically with the engineers to confirm that they were still pumping out hold 3. At 0716, the chief mate reported that a bilge alarm in cargo hold 2A had sounded. The sounding of the alarm in hold 2A indicated that the system was functioning on the accident voyage. Thus, the NTSB concludes that crewmembers in the engine room were most likely alerted to water in cargo hold 3 by the installed bilge alarm system. Even if built in 2016, dry general cargo vessels like El Faro have no Coast Guard or SOLAS requirement for bilge alarms. By comparison, the Coast Guard requires domestic passenger vessels to have a bilge high-level alarm in any space with a through-hull fitting below the waterline, in any space subject to flooding from seawater piping within the space, and in nonwatertight spaces. The sea chest for the emergency fire pump in El Faro’s hold 3 was a through-hull fitting below the waterline, and the seawater piping could flood the space. The risk of flooding in such spaces has been identified for passenger vessels, and cargo vessels should be protected against the same risk by alarm systems similar to those on passenger vessels. Cargo vessels with smaller crew complements should have bilge high-level alarms to monitor and identify potential flooding in large or remote spaces where access is difficult. Retrofitting the cargo holds of older vessels with bilge high-level alarms is technically feasible in most cases, as TOTE had done on El Faro before a layup period. Thus, the NTSB concludes that new cargo vessels should be equipped with, and existing cargo vessels should be retrofitted with, bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. The NTSB therefore recommends that IACS recommend to its members, and the Coast Guard propose to the IMO, to require that new cargo vessels be equipped with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. The NTSB also recommends that IACS recommend to its members, and the Coast Guard propose to the IMO, to require that existing cargo vessels be retrofitted with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. Downflooding Through Ventilation Openings. El Faro’s cargo hold ventilation system was sized to remove exhaust gases from driven vehicles during the loading and unloading of Ro/Ro cargo in port. Because El Faro was transporting vehicles that had fuel tanks (automobiles and some other Ro/Ro vehicles) at sea, the vessel’s COI required the supply and exhaust air ventilation ducts to the cargo holds to remain open while under way. The supply ventilation fans fed fresh air through openings that penetrated the second deck and traveled down to the fourth deck through ventilation trunks on both sides of the vessel. The hold was naturally exhausted through openings at the tween deck (third deck) and trunks that passed up through the second deck. Manually operated fire dampers located outboard just above the second deck in the ventilation trunks also served as weathertight (in exhaust trunks) and watertight (in supply trunks) closures for stability and load line assessments.

NTSB

Marine Accident Report

193 El Faro had a fire control and safety plan showing, in part, the locations and type of fire dampers and other ventilation closures. However, it did not specify that the cargo hold supply and exhaust closures should be secured for flooding or damage control (labeling as “fire damper–cargo spaces” gave the impression that they were to be used only in case of fire). Interviews of former officers on El Faro and Ponce-class (sister) vessels found that the dampers (closures) were not secured in heavy weather or at any time except during fire drills, inspections, and testing. During the accident voyage, there was no indication that the cargo hold ventilation dampers were closed in preparation for heavy weather or that they were closed after the crew became aware that the vessel was flooding and listing. Once El Faro was listing in severe winds, green water accumulating on the low side of the second deck would have made securing the dampers difficult and risky. Thus, the NTSB concludes that all the watertight and weathertight ventilation closures to the cargo holds most likely remained open throughout the sinking sequence. El Faro’s COI required that cargo spaces be ventilated in accordance with a drawing that stated while at sea, for each cargo hold, one supply fan must be run and a natural exhaust damper must be open (to dilute gasoline vapors).187 The exhaust vents would not be considered downflooding points in the International Code on Intact Stability because they could be made weathertight with installed closures (dampers). (Although applicable to most ships similar to El Faro today, the intact stability code was not applicable to El Faro, and applicable Coast Guard regulations on intact stability do not consider downflooding points.) The supply vents were not considered downflooding points in either the intact or damage stability calculations because they could be made watertight with installed closures (dampers), according to Coast Guard and international regulations. Although officers might look to secure closures when planning for heavy weather or during casualties, El Faro had no documented guidance or instructions that the closures should be secured to meet damage stability assumptions. And the vessel’s COI contained clear guidance that the closures must remain open. Operators of El Faro were therefore placed between the operational requirements of the vessel’s COI and the efforts of designers and regulators to provide a margin of safety through stability requirements. Recently, IACS created a new interpretation that will no longer allow weathertight closures to engine or generator rooms to be excluded as downflooding points in stability calculations. However, there is no explicit guidance for cargo hold ventilation that is operationally required to remain open. Thus, the NTSB concludes that vessels should not have operational requirements to maintain weathertight or watertight ventilator closures in an open position when the same closures are treated as closed when the vessel’s stability and load line are assessed. Therefore, the NTSB recommends that IACS recommend to its members, and the Coast Guard propose to the IMO, that any opening that must normally be kept open for the effective operation of the ship must also be considered a downflooding point, both in intact and damage stability regulations and in load line regulations under the ICLL. El Faro’s applicable intact stability criteria (46 CFR 170.170) did not consider downflooding points, as would be the case for vessels subject to the International Code on Intact

187 In port, the ventilation fans are run and the dampers are open to prevent asphyxiation from carbon monoxide.

NTSB

Marine Accident Report

194 Stability, and downflooding points were not mentioned in the vessel’s stability booklet. Thus, the NTSB concludes that had the vessel’s stability booklet or CargoMax software identified the vessel’s downflooding points, the ship’s officers might have closed the cargo hold ventilation openings. Therefore, the NTSB recommends that the Coast Guard require that information regarding openings that could lead to downflooding be included in damage control documents, stability instruments and booklets, and SMSs for vessels subject to the intact stability criteria of 46 CFR 170.170, regardless of the designation or treatment of such openings in intact stability calculations. Although the second deck scuttle to hold 3 was secured about 0600 the morning of the sinking, the hold most likely continued to have free communication with the sea from the damaged emergency fire pump piping.188 The Coast Guard Marine Safety Center’s hydrostatic sinking analysis calculated the heel angle for El Faro after loss of power in static conditions with hold 3 flooded to 20 percent of its volume (at 0.7 permeability) combined with an 80-knot beam wind acting on the starboard side. Results showed that El Faro would have heeled to about 15°, which corresponds to the heeling angle the captain reported at 0711. The same static conditions in the analysis resulted in the ventilation openings to holds 3, 2A, and 2 submerging when El Faro would have reached a heel of 26.3°, 26.9° and 28.9°, respectively, while the exhaust ventilation openings would have submerged at a few degrees higher (29° for hold 3, 30° for hold 2A, and 31° for hold 2). Without propulsion and drifting downwind with a sustained heel angle, the beam-to hurricane winds and wave action would have caused the ship to dynamically roll about the mean windheel to larger angles. Corresponding to the Marine Safety Center’s hydrostatic analysis results, the CSRA dynamic modeling and simulation analyses found that with hold 3 similarly flooded and a modeled 15° to 18° heel in storm waves, “the vents on the lower side would be submerged a significant part of the time.” Seawater would then have intermittently entered (downflooded) the ventilation trunks and flowed freely down to the lower cargo decks (refer to figure 59, section 1.12.10). Once seawater flowed down (downflooded) to the fourth deck through the ventilation trunks and their unsecured (open) closures, the vessel would have sunk deeper because of the weight of the added water and rolled more easily as it lost its residual righting arm. At 0716, the bilge alarm sounded for cargo hold 2A (immediately forward of hold 3), indicating that seawater had entered hold 2A. Two cargo holds now had confirmed flooding, and 23 minutes after the bilge alarm sounded in hold 2A, the VDR recording stopped. Presumably, the vessel partially capsized at that point. Thus, the NTSB concludes that about 40 minutes before the sinking, seawater most likely entered the ventilation ducting to several main cargo holds, exacerbating the flooding already under way in cargo hold 3 and accelerating the sinking. During the final stages of the sinking, the free surface effect from the floodwater in multiple cargo holds and eventually the engine room, combined with hurricane-force winds and seas, would most likely have resulted in the vessel capsizing. That likelihood is supported on the VDR audio by the AB on the bridge talking about having difficulty climbing, suggesting an increasing heel.

188 Free communication with the sea occurs when one or more of the exterior boundaries of a ship are ruptured so that the sea flows freely into and out of the damaged compartment, with minimal restrictions, as the ship rolls.

NTSB

Marine Accident Report

195 As the ship rolled onto its port side, containers most likely broke free and washed overboard, momentarily slowing the capsizing. Impact damage consistent with containers striking the forward port side of the deckhouse indicates that floating containers were in the water while the vessel was still on the surface and listing significantly to port. Damage Control. Investigators previously determined that the crew did not secure the fire dampers to the cargo holds during the sinking, which accelerated the sinking after hold 3 began to flood. On the morning of the sinking, the officers and crew of El Faro were involved with stability and damage control. Before the flooding in hold 3 was detected, the senior officers discussed the vessel’s list, and officers mentioned that it was heeling due to wind, or windheel. At 0510, the supervisor of the riding gang, a previous chief engineer with extensive experience aboard the Ponce-class vessels, told the captain that he had never seen the vessel list or “hang” like that and said that it had to be “more than a stack” (a cargo shift contributing to the list). The captain replied that they “certainly have the sail area,” regarding the effect of windheel, and asked the supervisor how the list was affecting “operations as far as lube oil(s)” in the engine room. Once flooding began, the captain ordered both a ballast transfer and a course change to switch the vessel list to the opposite side so that the crew could investigate the flooding and secure the open scuttle. The crew was using the bilge system to dewater hold 3. When they eventually determined that the water level was still rising and entering another hold, they discussed means to more effectively dewater the holds. The chief mate was aware of the potential for progressive flooding past hold 3 and shut a watertight door at 0715. The engineers were also addressing the effects of the list on the lubricating oil as part of their effort to regain propulsion. During the final hours, the VDR recorded no mention of the pumping capacity of the bilge system, and the crew could not quantify how much water was in hold 3. There was no mention of potential downflooding points through which the vessel would begin flooding as its list increased until 20 minutes before the vessel sank. About 0720, the supervisor asked about the downflooding angle, and the captain replied, “I don’t have an answer for (ya).” He then appears to have asked the supervisor what document would provide downflooding angles and said he would check the “chief’s office” for it. The captain then stated that “… we still got reserve buoyancy and stability,” indicating he was at least familiar with those concepts. There is no evidence on the VDR that the captain or crew consulted a plan or procedure for damage control during the heeling, loss of propulsion, and flooding sequence. Investigators later determined that the vessel had no damage control plan or booklet. Damage control plans and booklets are intended to provide ship’s officers with clear information about watertight subdivision and equipment relating to maintaining the boundaries and effectiveness of the subdivision. The information is necessary so that in the event of damage to the ship that causes flooding, officers can take quick action to mitigate the flooding and, where possible, recover the ship’s stability. Information such as downflooding points, watertight closures, advice regarding the cause of any list, and the pumping capacities of dewatering devices are typically provided in a damage control plan. El Faro’s SMS included an EPMV that stated in case of flooding, the ship’s stability information should be referenced, void spaces below the waterline should be secured, water ingress and progressive flooding should be reduced by any means, and detailed information regarding

NTSB

Marine Accident Report

196 location and extent of damage should be sent to TOTE so that the emergency response team could assess buoyancy and limit hull stress. However, there was no guidance or procedures specific to El Faro. The ship’s fire control and safety plan showed egress routes, safety and firefighting equipment locations, and fire dampers and other ventilation closures. However, it did not designate the cargo hold supply and exhaust closures as closures to meet damage stability. A typical damage control plan would have identified those openings to be secured. If the vessel had damage control information, which is typically included in damage control plans and damage control booklets, the crew might have taken action to secure the cargo hold ventilation closures. Cautionary information regarding list could also have helped the captain decide whether a course change to shift the list would be prudent. Having knowledge of the pumping system, the quantity of water in hold 3, and the potential flooding rate would have alerted vessel personnel to the dangerous condition of the vessel and could have influenced the captain’s decision to remain aboard the ship. However, to promptly execute and understand the information available in a damage control plan and booklet in extremis, a crew must undergo drills that incorporate the use of damage control plans and booklets. Thus, the NTSB concludes that if a damage control plan had been available and the crew trained in its use, the crew would have been better able to promptly plan for and address the flooding scenario encountered during the casualty. Therefore, the NTSB recommends that TOTE ensure that damage control plans and booklets are aboard all its load-lined vessels and that officers and crewmembers are trained in their use. SOLAS requires dry cargo ships built after 1992 to have a damage control plan, those built after 2005 to also have a damage control booklet, and those built after 2009 to have an “information to the master” section. Investigators found no evidence that El Faro was ever required to have a damage control plan or booklet. The vessel was not required to comply with SOLAS requirements before or after it was lengthened in 1993 because it was in domestic service. The ship’s 2010 entry into the Coast Guard ACP, which was retroactive to 2006, subjected it to the equivalency requirements that are developed by the Coast Guard and classification societies (which inspect ACP vessels) and are intended to assure that vessels satisfy both SOLAS and federal regulations, as appropriate. The Coast Guard OCMI was responsible for applying the rules, and it is not completely clear whether a damage control booklet should have been required in El Faro’s case. Confusion about the applicability of the rules would be removed if damage control plans were required for all vessels under SOLAS, regardless of age. For both new and existing vessels, the development and review of damage control plans and booklets can be accomplished through review of ship’s plans and other documents, as well as by consultation and cooperation with classification societies, the Coast Guard, naval architecture firms, owners, and crewmembers. As concluded above, had El Faro’s crew had access to and training in a damage control plan, the officers would have had critical information for their decision-making. Thus, the NTSB concludes that existing cargo vessels should have the same damage control plans and booklets as are required for newly built vessels to assist crews in damage and flooding situations. Therefore, the NTSB recommends that IACS recommend to its members that existing cargo vessels be required to have damage control plans and booklets on board that meet current standards. The NTSB further recommends that the Coast Guard propose to the IMO that existing cargo vessels operating under SOLAS be required to have damage control plans and booklets on board that meet current standards.

NTSB

Marine Accident Report

197 Although newly built ships require damage control plans and booklets, as of 2017, SOLAS did not require them to be class-approved. It is important that damage control information be accurately based on conditions used in the damage stability calculations. Classification societies possess the technical expertise to provide meaningful review of damage control information aboard vessels because they typically review the same vessel’s plans, stability calculations, and load line. Thus, the NTSB concludes that approval by a classification society of damage control plans and booklets would provide an independent check to ensure uniformity and compliance with requirements. Therefore, the NTSB recommends that IACS recommend that its members require, and the Coast Guard propose to the IMO, that damage control plans and booklets required by SOLAS be class-approved. Investigators found that in reviewing El Faro’s probabilistic stability calculations, the most likely damage cases that occurred during the accident—the flooding of a single cargo hold or two cargo holds (cargo hold 3, and then hold 3 with hold 2A)—were not specifically examined. The stability calculations examined two flooding scenarios (cases). In the first case, only cargo hold 3 was flooded and the fixed-ballast, double-bottom tank under it was damaged. The vessel passed that case. In the second case, both cargo holds 3 and 2A were flooded and the fixed-ballast tank under each was damaged. The vessel failed that case. Probabilistic damage stability regulations have increased vessel safety for dry cargo ships, considering that there was previously no requirement for damage stability. Probabilistic damage stability criteria calculations demand multiple damage cases to be run for multiple vessel drafts, and in most cases, the vessel must survive (meet stability criteria). However, a vessel can comply overall with the probabilistic damage stability criteria, but specific damage cases will not only fail to meet the minimum stability criteria after damage but could potentially result in the vessel sinking. For El Faro, the case with two compartments damaged did not meet the criteria. The case of cargo holds damaged without a double bottom in the same division was not run. Probabilistic stability calculations are not required to be kept on board a vessel. Even if a captain has access to them, there can be hundreds of different damage cases at each vessel draft, most of which pass the criteria, but some of which do not. The captain must first understand what damage has occurred to his vessel and then go through the cases to see whether they passed the criteria. The assessment of the vessel’s survivability would be in addition to the issues a captain would be addressing in a damage situation. The IMO recognized in 2007 (MSC.1/Cir. 1245) that the probabilistic damage stability concept did not present the survivability of a ship in a simple and easily understandable way when the vessel was subject to the flooding of a compartment or group of compartments. In operational terms, the IMO recognized that a captain experiencing a specific flooding case would not have a means of quickly assessing the vessel’s stability in the flooding scenario being experienced. Expanded guidance for damage control plans included information to masters for vessels built after January 1, 2009. The aim of the expanded guidelines was to set a minimum level for the presentation of damage stability information for evaluation of a ship’s situation when subject to internal flooding and to provide a simple and understandable way of assessing its survivability. Thus, the NTSB concludes that a damage control plan and booklet would have helped the captain of El Faro assess the flooding situation. El Faro did not have a damage control plan or booklet on

NTSB

Marine Accident Report

198 board, and even if it had been determined to have undergone a major conversion when modified in 2005–2006 and been required to have a plan and a booklet, those documents would not have included the IMO’s 2009 guidelines for “information to the master.” The NTSB has recommended above (as a proposal from the Coast Guard to the IMO) that existing cargo vessels operating under SOLAS be required to carry damage control documents meeting current standards (which would include the “information to the master”). El Faro’s onboard CargoMax program included an optional damage stability module. The CargoMax user’s manual contained a section that discussed the calculation steps and theory of damage stability and remedial action. The damage stability module was capable of assessing compartment-specific damage, such as the flooding of hold 3. The program’s “emergency response calc” provided information onscreen including, but not limited to, the vessel’s drafts, range of positive stability, and maximum righting arm angle. Previous senior deck officers questioned about the module said they had never used it. The VDR did not record any conversations indicating that El Faro’s officers consulted the program during the accident. Although TOTE subscribed to a shoreside RRDA service, which functioned as intended after the sinking, it took several hours to provide results. Compared with the CargoMax damage module on El Faro, the RRDA can run more-complex flooding analyses, including estimating windheel (which was not a function in the damage module) and analyzing conditions with experienced technical experts. Investigators compared the results from RRDA with outputs they ran on a shoreside version of the same damage module found in CargoMax on the vessel. With hold 3 flooded to equilibrium, roughly similar graphics for the reduced area under the righting arm curve resulted (considering that RRDA used a permeability of 0.85 for the hold, while CargoMax used 0.7). CargoMax showed that the flooded hold would significantly reduce the range of positive stability to less than 27° of list and that the hull’s strength (percent of allowable shear and bending moment) was not exceeded. The damage module outputs also contained an indicator for the downflooding angle on the righting arm curve that could alert users to downflooding angles, although for El Faro they were not noted. The damage stability module in CargoMax could present information to the captain regarding survivability that would be similar to information provided in damage consequence diagrams but probably would be faster to interpret. Thus, the NTSB concludes that the damage stability module in the CargoMax software on El Faro could have provided timely vessel stability information to the officers for the damage conditions the vessel experienced. Therefore, the NTSB recommends that TOTE require senior officers to receive formal training approved by the manufacturer in all functions found in installed stability programs, including damage stability modules. 2.5 Weather Information In its safety recommendation report Tropical Cyclone Information for Mariners (NTSB 2017b), the NTSB noted that moderate-shear cyclones, such as Joaquin, can be challenging for meteorologists to forecast with great precision (more so than with low- or high-shear cyclones). The report also mentioned that, in addition to the National Hurricane Center’s tropical cyclone forecast/advisories, which are disseminated to ships through Sat-C every 6 hours when coastal

NTSB

Marine Accident Report

199 tropical storm or hurricane watches or warnings are in effect, ships should also automatically receive the intermediate public advisories, which the National Hurricane Center issues every 3 hours during watches or warnings but which are not required to be disseminated to ships.189 According to bridge audio recordings from September 30 (table 12), both the El Faro captain and the chief mate were aware of the “unpredictability” and “erratic” nature of Joaquin. One means by which the El Faro crew remained aware of Joaquin’s changing position, forecast intensity, and forecast track was the tropical cyclone forecast/advisory. That National Hurricane Center product was delivered as text messages on the ship’s Sat-C receiver, with only limited delay.190 The hurricane center issues the advisory four times a day for active tropical cyclones.191 The NTSB identified five instances in the El Faro VDR transcript (“sound of Sat-C terminal receiving incoming message”) where the Sat-C terminal on the vessel’s bridge probably received a tropical cyclone forecast/advisory. The five instances occurred at 0638, 1057, 1654, and 2253 on September 30 and at 0447 on October 1. After reviewing the 2253 Sat-C advisory on September 30, the third mate calculated that El Faro would pass 22 miles from the center of the storm and passed that information to the captain. The vessel also received a processed version of the tropical cyclone forecast/advisory through its weather service BVS, which was delayed by 6 hours compared with the Sat-C information. The VDR audio recording from the bridge made clear that the crew had access to other weather information as well, including the Weather Channel through September 30.192 The third mate spoke numerous times of watching the Weather Channel during the voyage. Investigators requested but were unable to retrieve footage from the Weather Channel broadcasts between 1000 on September 30 and 0500 on October 1.193 However, footage between 0500 and 1000 on September 30 indicated that the Weather Channel provided good coverage of Joaquin and prominently displayed the times of the next expected National Hurricane Center advisory. It is likely that the Weather Channel aired updated Joaquin information (including next advisory times) in all its broadcasts during El Faro’s final voyage. In addition, two broadcasts from a Coast Guard aircraft were identified on the VDR recording during the afternoon of September 30. The broadcasts announced areas under hurricane watches and warnings, advised mariners to use “extreme caution,” and informed them that the Coast Guard was standing by on channel 16. The first broadcast seems to have received attention

189 Intermediate advisories may be available through other onboard communication devices, such as open internet browsing, which El Faro did not have. 190 Further discussion of the Inmarsat-C SafetyNET service and the specific products and times of their availability during El Faro’s final voyage are found in the meteorology group factual report in the accident docket. Text products received via Sat-C are printed on paper and can also be read on a Sat-C terminal monitor. The Sat-C alert tone and the sound of the printer functioning on El Faro’s bridge were documented in the VDR transcript. 191 The National Hurricane Center nominally issues its tropical cyclone forecast/advisories at 0500, 1100, 1700, and 2300. 192 At 2359 on September 30, the comment “ . . . TV went out” is heard on the VDR recording, which probably meant that the ship had lost its satellite television reception, as would be expected at some point during the transit between Jacksonville and San Juan. 193 The footage was not archived, or if it was, the archives were not retained until the time investigators requested them.

NTSB

Marine Accident Report

200 from both the second mate and the captain. However, the captain stated that the watch/warning areas relayed by the Coast Guard aircraft had already been identified elsewhere. The weather information available on board El Faro clearly showed that Hurricane Joaquin would impact the vessel on its planned route. The Sat-C information on its own showed that the vessel would be coming within 22 miles of the strengthening storm and should have been enough to prompt the captain to consider alternate options. Thus, the NTSB concludes that El Faro was receiving sufficient weather information for the captain’s decision-making regarding the vessel’s route. Table 12. VDR conversation between captain and chief mate about Joaquin. Captain 14:02:33.8 14:02:43.6 (yeah) we'll just have to watch it. there’s not much we can do. (but they) the weather pattern itself is crazy erratic. Chief Mate 16:16:00.6 16:16:01.4

this storm. Captain 16:16:01.9 16:16:04.6 oh. no no no. we're not gonna turn around—we’re not gonna turn around. [there is a brief unintelligible comment by either the chief mate or AB during the time the captain is speaking.] Chief Mate 16:16:04.7 16:16:05.7

so that’s it then. Captain 16:16:06.9 16:16:11.1

the—the—the storm is very unpredictable—very unpredictable. Chief Mate 16:16:07.5 16:16:09.7

the storm could . . . [spoken over by the captain’s comment above.] Chief Mate 16:16:11.3 16:16:14.4

it went high—it went left—it went right—it went back again. Captain 16:16:14.1 16:16:16.4

this one in particular is very erratic. Chief Mate 16:16:16.2 16:16:16.7

yeah. Chief Mate 16:16:17.4 16:16:19.7

it’s goin’ left—it’s goin’ right—now it’s headin’. . .

At 2249 on September 30, the National Hurricane Center announced that Joaquin had become a Category 3 hurricane, with maximum sustained winds of 100 knots, and was moving toward the central Bahamas. El Faro received a tropical cyclone forecast/advisory through Sat-C at 2253 that identified the increased intensity, stating that the hurricane was centered near 23.8N, 73.1W (about 120 nm southeast of El Faro’s position) and moving southwest (220°) at 5 knots. Maximum sustained winds were 100 knots, with gusts to 120 knots. The El Faro bridge crew also learned of the hurricane’s intensification to Category 3 from a satellite radio broadcast 2 1/2 hours later.

NTSB

Marine Accident Report

201 At 2305, the third mate called the captain in his stateroom, stating that the hurricane was “advancing toward our trackline and . . . puts us real close to it . . . we’re lookin’ [to] meet it at say like four o’clock in the morning.” Only a few minutes later, at 2313, the third mate was concerned enough, based on the latest weather information, that he again called the captain in his stateroom and suggested diverting to the south: “At 0400 we’ll be twenty-two miles from the center. With max one hundred with gusts to one twenty and strengthening . . .” The captain did not agree to the suggested course change. The third mate subsequently told an AB, “He seems to think that we’ll be south of it by then—so the winds won’t be an issue. . . . I trust what he’s saying—it’s just being twenty miles away from hundred knot winds—this doesn’t even sound right.” The second mate was also increasingly concerned based on the weather information she was receiving. That was evident in her 0352 email to a friend, in which she said that El Faro was “heading into the hurricane right now full force. Tried to alter our course to avoid it but he’s on the war path. Bad seas and really bad winds . . .” At 0353, in an email to her mother, the second mate again expressed concern about the ship’s route, stating that they were “heading straight into” a Category 3 hurricane. She continued, “Winds are super bad and seas are not great . . .” The captain may have felt confident about the ship’s route and proximity to the storm in part because he was relying on weather information that was many hours older than what the bridge crew was reviewing and thus depicted storm positions (and associated wave height and wind fields) that were less threatening. TOTE provided the private weather display system BVS to its ships, and based on VDR bridge audio, BVS was a major source of guidance for El Faro during the voyage. In fact, interviews with or testimony from off-duty crewmembers indicated that the captain preferred BVS as a source of weather guidance. BVS automatically plotted the National Hurricane Center’s present and forecast positions of tropical cyclones for visualization on the computer screen, providing graphic depiction of the information in a format that was relatively easy to understand. The BVS-provided information was thus more visually appealing than Sat-C, which delivered the information as text coordinates only (which the crew then had to manually plot). However, the information in the BVS files about Joaquin’s position and intensity was usually the same National Hurricane Center information that Sat-C had already delivered about 6 hours earlier. Therefore, leading up to the El Faro sinking, the BVS files were not nearly as up-to-date about Hurricane Joaquin as was Sat-C. At 0614 on September 30, the captain stated with regard to Joaquin as reported through BVS, “It’s tracking as the written weather has it. It’s gone a little south.”194 Later that evening, at 2357 on September 30, the VDR recorded the third mate discussing the difference in weather information from various sources, although it is not clear exactly what was being compared.195 In addition, although Applied Weather Technology emailed El Faro the new main BVS weather files at regularly scheduled times, for the files to be read, the emails had to be downloaded

194 This statement also calls into question whether the captain understood that the original source (the National Hurricane Center) of Joaquin’s current and forecast positions depicted in BVS was also the source of Joaquin’s coordinates in the tropical cyclone forecast/advisories disseminated through Sat-C. 195 According to the VDR recording, weather information was compared at least three times on El Faro’s bridge during the accident voyage.

NTSB

Marine Accident Report

202 by a separate action on the part of the captain.196 On the evening of September 30 and into the morning of October 1, a significant delay occurred in downloading the most recent BVS file. At 2302 on September 30, Applied Weather Technology emailed El Faro the new BVS weather file (containing information about Joaquin that was already 6 hours old), but the file was not downloaded until 0445 on the morning of the sinking. Therefore, by the time the captain read that BVS weather file, the information was about 12 hours old. At 0503 the morning of the sinking, the VDR recorded the captain assessing the available information about Joaquin’s present and forecast position and intensity and stating the following: . . . Here’s the thing—you got two GPSs—you got five GPSs—you gonna get five different positions. You got one weather program (and I use/and use) BVS and that’s what I (sent) up here * we’re gettin’ conflicting reports as to where the center of the storm is. At that point, the captain was comparing the up-to-date information that had just arrived on the bridge via Sat-C with the 12-hour-old BVS information. When the captain identified the discrepancy in the information between BVS and Sat-C, he most likely did not realize that Sat-C was providing more current information than BVS. Thus, the NTSB concludes that although up-to-date weather information was available on the ship, the El Faro captain did not use the most current weather information for decision-making. 2.6 Captain’s Decision-Making From the outset of his final journey in command of El Faro, the captain kept to his announced intention of following the ship’s usual route to San Juan—a direct line passing east of the Bahamas. In an exchange of text messages starting an hour and a half before El Faro set sail, the captain told an off-duty second mate that he planned to follow his “normal direct route” to San Juan, and that he expected the storm to remain to their north as forecast. It could not be determined which forecast the captain was referring to in his text message. The second mate reminded him that there were three passages through the Bahamas that could serve as alternate routes if necessary. The storm that became Hurricane Joaquin was still classified as a tropical storm centered 600 nm away when El Faro and its crew of 33 cast off from Blount Island in Jacksonville. The National Hurricane Center had already predicted, however, that Joaquin could become a hurricane the next day. While the harbor pilot was guiding the ship to a buoy outside Jacksonville, the captain told him, with regard to the storm, “We’re just gonna go out and shoot under it.” An hour after the pilot left the ship, the National Hurricane Center issued a hurricane warning for the central Bahamas, which were directly in El Faro’s path. When El Faro left Jacksonville, Joaquin and its tropical storm and hurricane wind fields were forecast to be near the vessel’s normal route of travel (between Jacksonville and San Juan) during the voyage. Thus, the NTSB concludes that the original passage plan’s straight-line course at departure from Jacksonville would lead directly into the storm’s predicted path. Once under way on the accident voyage, the captain had opportunities to avoid the destructive force of Hurricane

196 Applied Weather Technology emailed the BVS weather files to El Faro at set times of 0502, 1102, 1702, and 2302 during the accident voyage.

NTSB

Marine Accident Report

203 Joaquin. And when the hurricane was forecast to be in El Faro’s direct path, the captain could have decided to divert from the storm. While the captain could have taken action at any time, there were several significant points along the accident route where the captain was provided with new information that gave him opportunities to adjust course and avoid heading into the storm (see figure 66). At 0624 on September 30, after reviewing the latest weather data from BVS, which showed the storm tracking west-southwest, the captain and chief mate decided to alter the vessel’s path slightly southward. The captain described the course change as a “good little diversion” and suggested that Joaquin was not serious enough to warrant what the chief mate described as more “drastic” evasive action.

Figure 66. Significant opportunities for decision-making. The captain was aware that the storm was getting worse. About 0830, he told the AB on watch that they had “a little weather comin’ in” and that the storm had “morphed its ugly head” during the night. Even at this early juncture, the captain stated that they would “be about sixty

NTSB

Marine Accident Report

204 miles south of the eye” but that “it should be fine. We are gonna be fine—not should be—we are gonna be fine.” At 0952 the same morning, the captain received an email from the captain of El Yunque, which was northbound from San Juan, saying the storm was intensifying and moving to the southwest. The captain responded about an hour later, saying he had already altered his course and would be 65 nm south of the storm at its closest approach. The El Yunque captain replied that his ship had recorded a 100-knot relative wind gust as it passed west of the storm. At that point, it would have been prudent for the El Faro captain to reconsider his planned route. Information that the storm might already be producing such strong winds (which investigators could not, however, verify) should have alerted the captain that the storm could be more dangerous than he originally thought. But he continued on his course. Nothing seemed to change the captain’s mind. He did, however, inform the company (by email about 1300 on September 30) that he would like to take another route back to Jacksonville, once they reached San Juan. That route was Old Bahama Channel, a shipping route that follows the north coast of Cuba and would add time and distance to the trip. A month earlier, the captain had avoided Tropical Storm Erika by sailing down the coast of Florida from Jacksonville to reach Old Bahama Channel and then following it to Puerto Rico. While El Faro was still passing the northern Bahamas, the captain indicated that he was aware that the storm was tracking erratically. About 1400, he described the storm to the chief mate as “crazy erratic.” Within the next half hour, the bridge received two sécurité warnings broadcast over the maritime distress channel by a Coast Guard aircraft. Both broadcasts stated that a hurricane warning had been issued for the central Bahamas and said mariners should “use extreme caution.” The captain said “Wow” but did not change his course. Around this time, the vessel was north of Great Abaco Island and close to the entrance to the Northeast Providence Channel, one of the suggested passages through the Bahama Islands. When the AB asked the captain about 1615 whether they might turn around, the captain replied, “No, no, no. We’re not gonna turn around, we’re not gonna turn around.” About 45 minutes later (at 1654), as El Faro passed east of Great Abaco Island, the bridge received a National Hurricane Center advisory on its Sat-C terminal, reporting that Joaquin now had sustained winds of 75 knots, gusting to 90 knots. At 1824, the ship received an urgent high seas forecast that identified seas of between 12 and 27 feet within 90 nm of the storm center and predicted maximum seas of 30 feet for noon on October 1. When El Faro received that message, the ship was about 60 nm from the entrance to Northeast Providence Channel and about 180 nm northwest of the hurricane’s center. Had the captain chosen to divert at that point, Northeast Providence Channel could have taken his vessel and its crew to safer waters inside the Bahama Islands and then, via Northwest Providence Channel, to the shipping lane along the Florida coast. From there, he could have directed the ship south to Old Bahama Channel, as he had done during Tropical Storm Erika, and then east to Puerto Rico. Instead, the captain and chief mate made another slight course change to the vessel’s trackline, plotting a new course past San Salvador Island and northeast of Samana Cay. That course ultimately led the vessel close to the eye of Hurricane Joaquin.

NTSB

Marine Accident Report

205 The captain left the bridge around 2000 on September 30. He was not heard on the bridge again until about 0400 the next morning. He was called three times, however, by the mates on watch, who both wanted to change course. The third mate began discussing his concerns about the storm soon after the captain left the bridge, around 2020. He spent about 5 minutes explaining to the AB where they were relative to the storm, stating, “I’ll show you on the program” (presumably on the computer). The third mate described what they were looking at and said that it was “more powerful than we thought.” Then he said the storm was supposed to hook around and go north but added, “what if it doesn’t . . . maybe I’m just being a Chicken Little.” The third mate called the captain shortly after 2300 to suggest that he come to the bridge to review the weather data. He told the captain the storm had maximum winds of 100 mph (87 knots) and was moving toward El Faro’s trackline. He said that at 0400, they would be 22 nm from the hurricane’s center. The captain did not come to the bridge, and he did not order a course change. The third mate reported to the AB on watch that the captain seemed to think they would stay south of the storm. When the second mate came on watch at midnight, she began plotting another course change through Crooked Island Passage, which would lead the ship south toward Old Bahama Channel. At 0040, she stated that she might “have a solution.” She discussed the route change with the AB on watch, and at 0058, she said, “I might call the captain if he doesn’t come up shortly.” She called the captain at 0120 and told him things were not looking good and, though many of her words were not discernible on the VDR recording, suggested a course change “straight south” about 0200. From what the second mate said to the AB after the call, the captain told her to continue on the course the chief mate had plotted the evening before. The second mate told the AB that their course would intersect with the storm at 0400. At 0247, she told the AB that they were “pretty much committed now.” The captain had chosen not to take advantage of the available escape route through Crooked Island Passage along El Faro’s course. Among the possible explanations for the captain’s decision to continue on his course relates to his understanding of the circumstances, or his mental model. A mental model is a person’s internal representation of events in the real world. Research has shown that people tend to seek confirmation of their mental models. From the beginning, the captain expected the storm to turn north and that they would stay “on the backside” of it, meaning to the south, which would be the safer side for navigation. With that expectation, the captain could have registered only that trend in the weather forecasts and ignored others that predicted different outcomes. Another possible explanation is that the captain could have been normalizing the risk. When someone has experienced a risky situation and emerged without harm, it is not uncommon for that person to repeat the decision that led to the situation or to take the same risks again. Normalizing the risk could have led the captain to feel overconfident, particularly in predicting how the hurricane would behave. The captain had 24 years of experience, which included operations in heavy weather in Alaska and in the North Atlantic. He had also received training in meteorology and shiphandling at Maine Maritime Academy (he graduated in 1988), although he had not been required to study advanced meteorology or shiphandling since obtaining his original credential.

NTSB

Marine Accident Report

206 The captain’s training and years of experience do not appear to have prepared him for the conditions presented by Hurricane Joaquin. During the accident voyage, he compared Joaquin to storms in Alaska, implying that the storm conditions El Faro was experiencing were not as bad as conditions he had previously encountered. The captain also talked about the worst storm he had ever experienced, which happened while he was crossing the North Atlantic, probably while captaining a car carrier. The storm had been fierce—wind gust of 102 knots and multiple rogue waves—but he and his ship had survived, although cars broke loose. The captain did not mention the differences (in size, shape, and stability) between El Faro and the tankers and Ro/Ro vessels in which he had previously experienced severe weather or the fact that he had not served as captain on most of those vessels. Another factor that may have contributed to the captain’s decision-making was maintaining a schedule on weekly liner service. Pressure can come from external or internal sources. The captain was unsure if he was going to be hired to captain one of the new LNG-powered ships. He sent an email to a family member on September 24, suggesting that he still did not know if he was going to get a position on one of the new ships. During the accident voyage, the VDR recorded a conversation between the captain and the chief mate regarding their future employment with the company in which both felt they were “in line for the chopping block.” If the captain thought his performance on this trip would be a deciding factor in getting the job, it might have affected his decision-making. He might have been more risk-tolerant, meaning that he might take additional risks if he thought it would help him get the job. Taking Old Bahama Channel would ultimately cost him more time and fuel and might seem like an unnecessary delay if he thought he understood the storm’s path. During Tropical Storm Erika, the captain did not ask permission to divert to Old Bahama Channel. Instead, he sent an email to management, stating that, due to the most recent weather forecast, “El Faro will transit the Old Bahama Channel enroute to San Juan Puerto Rico.” He then stated that, although the route would add 160 nm to the trip, it was a safer transit. Several managers responded, thanking him for the update. The vice president of the company responded, “Voyage plan noted and concur with your assessment.” This chain of events was unlike those that unfolded during Hurricane Joaquin. On September 30, the captain sent an email requesting permission to take Old Bahama Channel on the return route to Jacksonville as a preemptive strategy to avoid the storm in the coming days. The captain included in the email a caption that read “QUESTION,” further detailing that he would like to take the alternate route on the return voyage from San Juan to Jacksonville. He said he would await a response before taking that route. In a conversation with the second mate, after this email, as well as in the body of the email itself, the captain specifically stated that he sent the email as a professional courtesy. With regard to internal pressure, it is unclear what may have prompted the captain to seek permission for that deviation in the voyage. He had applied for one of the company’s sought-after positions on the new LNG-powered ships but was uncertain about his status regarding the new position. Whether that played a part in his internal motivation to meet the schedule cannot be determined. However, whether internal or external, there was a built-in pressure to keep to the schedule, particularly on the southbound voyage, where customers expected cargo to arrive on time. The northbound route had a buffer that allowed the crew extra time to return to Jacksonville,

NTSB

Marine Accident Report

207 and with a lighter cargo load. Knowing that the return route had a buffer built into the schedule may have been what prompted the captain to request a return route that would avoid what would be left of Hurricane Joaquin. With regard to commercial pressure, it was unlikely to be a matter of the company directly asking the captain to do something unwise and the captain having to either do it or refuse. If the captain was expected to meet the estimated time of arrival, he might have felt pressure regardless of the changing weather forecast. Another element is that when people make decisions under pressure, their judgment suffers, and they tend to accept more risk. A schedule can produce pressure just because it exists—delays are costly, and decisions to change a route must be justified and explained. Sometimes the greatest pressure is one’s own internal, self-induced pressure. The captain rarely arrived in port late and may have been highly motivated to meet his schedule, which could have increased his risk tolerance and blocked his full situation awareness of the weather. Thus, the NTSB concludes that although there is no direct evidence that the company applied pressure regarding the vessel’s schedule, inherent pressure could have influenced the captain’s decision to continue on despite the weather. A further possible explanation of the captain’s actions is what is known as confirmation bias. That is the tendency of a person to search for, interpret, favor, and recall information in a way that confirms his or her beliefs or hypotheses while giving less attention to information that contradicts those beliefs (Plous 1993). Once the captain made his decision to continue on the planned route, he was not swayed by information that contradicted his plan, including his officers’ suggestions of route changes to avoid the storm. The captain was also unwilling to change course even though weather forecasts led the officers to believe they would come within 22 nm of the hurricane’s eye. Throughout his conversations with others on the bridge during the accident voyage, the captain regularly minimized the storm (referring to it as a “low”) and its possible effect on El Faro. The second mate stated that the captain was telling the crew “it’s not a bad storm . . . it’s not even that windy out . . . seen worse.” The captain repeatedly said that things were going to get better, that they would “be fine” or “make it,” even after the second mate sent distress messages half an hour before the ship sank. The captain was aware that he had options to divert away from the hurricane by taking one of three sea passages through the Bahamas. Although the captain altered his course slightly during the voyage, he did not succeed in avoiding the storm. In fact, his last course alteration took El Faro close to the eye of the hurricane. Thus, the NTSB concludes that the captain did not take sufficient action to avoid Hurricane Joaquin, thereby putting El Faro and its crew in peril. 2.7 Bridge Resource Management The captain had ultimate responsibility for the vessel’s safe operation and navigation. He was also leader of the bridge navigation team and was thus responsible for seeing that the team used all resources, human and technical, to assure the safe completion of their voyage. The formal approach to managing bridge teams is known as BRM.

NTSB

Marine Accident Report

208 BRM trains bridge teams to work cooperatively to monitor a vessel’s progress, to acquire and exchange information, and to anticipate dangerous situations that could affect the safety of the crew or the vessel. All the deck officers except the captain had received BRM training in 2013. The captain had completed BRM courses in 1995, 1998, and, most recently, 2003. In 2015, he completed a 5-day leadership and management course, which covered topics such as decision-making, effective communications, and obtaining/maintaining situational leadership. BRM was not required as part of the course. BRM as a management tool in the maritime industry grew out of the concept of crew resource management (CRM) in aviation. CRM, in turn, was a response to a series of fatal aviation accidents in the 1970s, including the deadliest aviation accident in history, the 1977 collision of two Boeing 747s on Tenerife, Canary Islands, that killed 583 people. The accident, which was investigated by Spanish authorities, occurred in part because the copilot and flight engineer failed to challenge the captain’s decision to take off before confirming that the runway was clear.197 The NTSB has played a key role in advocating for CRM. For example, improving CRM was placed on the NTSB’s Most Wanted List in 2006, which led to the Federal Aviation Administration requiring CRM training for all crewmembers, including pilots and flight attendants, on small commuter airlines and on-demand operations such as air ambulances (known as Part 135 operators).198 Indeed, the NTSB’s investigations into aviation accidents that demonstrated a breakdown of cockpit management and teamwork led directly to the development of CRM. Notable examples include a 1977 accident in Anchorage, Alaska, in which a Japanese cargo plane crashed shortly after takeoff, killing three crewmembers and two cargo handlers (NTSB 1979a). Investigators determined that the captain was intoxicated. The driver who took the crew to the airport informed his dispatcher, who notified the airline’s Anchorage office, but no action was taken. The cockpit voice recorder showed that neither flight officer remarked about the captain’s intoxication or tried to stop the captain from controlling the airplane. The captain was a US national and two of the junior crewmembers were Japanese. In its probable cause statement, the NTSB determined that “Contributing to the cause of this accident was the failure of the other flight crew members to prevent the captain from attempting the flight.” Another example is the 1978 crash of United Airlines flight 173 into a wooded residential area in Portland, Oregon. The airplane ran out of fuel while the flight crew coped with a malfunction of the landing gear. Ten people died, and 23 were seriously injured. The NTSB determined that the captain had failed to properly monitor the quantity of fuel remaining on the airplane (NTSB 1979b). The NTSB also found that the first and second officers were not assertive enough in trying to communicate with the captain. As stated in the NTSB’s determination of probable cause, “Contributing to the accident was the failure of the other two flight crewmembers either to fully comprehend the criticality of the fuel state or to successfully communicate their concern to the captain.”

197 See https://ntsb.gov/safety/mwl/Pages/was2.aspx. 198 The Federal Aviation Administration issued its final rule in 2011.

NTSB

Marine Accident Report

209 The NTSB has investigated numerous marine accidents in which ineffective BRM played a role. Most involved poor communication between the master and a pilot who had joined the vessel to guide it through a harbor or down a waterway, and none resulted in fatalities. A recent example of a failure in BRM that had fatal consequences was the 2012 grounding of the cruise vessel Costa Concordia off the Italian island of Giglio. In its analysis of the accident, the Italian Ministry of Infrastructures and Transports cited the “overly passive attitude of the bridge staff” as a factor (MIT 2013). The accident included the risk normalization element described earlier because the ship had previously sailed close to the island to allow tourists to take photographs. The accident resulted in the deaths of 32 passengers and crewmembers. In the case of El Faro, it is evident from the conversations recorded by the VDR that the environment was not such that feedback from the crew was encouraged or considered by the captain. Though the officers discussed the worsening weather during their watch turnovers, they did not assertively voice their concerns in the captain’s presence. Further, the captain repeatedly ignored the officers’ suggestions to alter course so as to avoid the hurricane. Before the captain left the bridge on the night of September 30, he told the third mate that he would be “up for the better part” of his watch and that the mate should call if he saw anything he did not like. The captain’s voice was not detected on the bridge again until the next morning. When the third mate called the captain shortly after 2300 to suggest that he come to the bridge to check the weather forecast, the captain did not go to the bridge and did not approve the course change the third mate suggested. The second mate said she did not see how the captain could be sleeping under the weather conditions before she called him about 0120 to suggest another course change. She and the third mate expected that they would encounter the worst effects of the hurricane about 0400, yet the captain did not come to the bridge during the night to check the weather or the status of the vessel. He also failed to download the BVS weather file that had been available at 2304. When the captain arrived on the bridge shortly after 0400, he announced that he had slept “like a baby” and questioned, “Who’s not sleepin’ good?” According to Crowch (2013), 60 percent of all marine accidents that fault the human operator are related to ineffective communication. As an element of BRM, officers have a duty to speak up if they believe the vessel is at risk. From their statements on the VDR, the El Faro mates were clearly concerned about their safety and that of the rest of the crew. They were reviewing incoming weather data and knew the storm was coming closer. The captain, however, did not take any action or make any statements that indicated he was concerned, nor did he come to the bridge to review updated weather information, as suggested by the third mate. Given the responsibility of his position and the risk of the upcoming weather, it is difficult to explain how the captain could have been absent from the bridge while his ship sailed into a hurricane. The second mate remarked how hard it had been to wake him when she called his cabin about 0130. BRM stresses assertiveness. As this accident shows, however, in practice it can be difficult for officers to challenge a captain’s decisions. There are several possible explanations for the officers’ reluctance to challenge the captain’s decision not to deviate except in minor ways from their route. First, they appeared to have high confidence in the captain’s experience and were reluctant to question his judgment. He had sailed in harsh Alaska conditions and spoke of encountering a severe storm in the North Atlantic before he became captain of El Faro. He even

NTSB

Marine Accident Report

210 stated that the weather they encountered was normal for winter in Alaska. The third mate expressed confidence in the captain’s experience, saying on September 30 at 2122, “I don’t know. I’m not gonna second guess somebody. The guy’s been through a lot worse than this. He’s been sailing for a long—long time—he did it up in Alaska.” He also said that he trusted the captain, even though he worried about being only 20 nm from 100-knot winds: “This doesn’t even sound right.” Second, the officers occupied a subordinate position in relation to the captain. The authority of the captain is traditionally treated as absolute, and mariners are accustomed to deferring to the captain’s decisions. The historical view of the marine industry for the unique environment of a crew at sea is that such a hierarchy is necessary to preserve order on board a ship. Although training in bridge (crew) resource management is required for mariners, it has not been as widely accepted or studied as in the aviation realm. The evolution of CRM was a challenge in aviation, and it took time to “overcome the old way” of doing business. Eventually, the pilots (captains) began to recognize the importance of lower-ranking officers being confident enough to speak up about the best way to operate the aircraft. For example, the “go-around” rule was instituted, ensuring that if the first officer asks for a go-around, it will be executed with no questions asked (“no fault” go-around) and no penalties given. In the marine industry, the gap between the captain and his less-powerful subordinates, known as the power distance, can make it difficult for junior officers to challenge a captain. Power distance refers to the way in which power is distributed and the extent to which the less powerful accept that power is distributed unequally. It is defined as the extent to which a society accepts unequal distribution of power in institutions and organizations (Dorfman and Howell 1988). In a high-power-distance culture, the difference in power is substantial, whereas in a low-power-distance culture, the balance is more team-oriented. For example, in the hierarchical structure of a ship’s bridge team, the power distance between the captain and the third officer is greater than the power distance between the second and third officers. The VDR transcript contains many examples of how the ship’s hierarchical structure influenced the flow of communications. Often, the helmsmen and junior officers frankly discussed their opinions of the weather situation and the captain’s decision-making. The helmsmen frequently voiced their concerns to the junior officers but never in the presence of the captain. Similarly, when the junior officers discussed navigational issues at critical junctures with the captain, such as their calls to the captain on the night of September 30 and the morning of October 1, they generally spoke in a deferential manner, using hints, preferences, or suggestions. At 2305, when the third mate called the captain, he said, “Thought you might wanna take a look at it . . . so (yeah) if you have a chance,” referring to the latest weather report that showed the eye of the hurricane coming within 22 nm of El Faro’s trackline, with observed winds of 100 miles per hour. The third mate phrased his request for the captain to come to the bridge as a suggestion. Such phrasing is indicative of mitigated speech. Mitigated speech is when a person speaks in a deferential way, either to be polite or to show deference to authority. Junior officers would be more likely to make suggestions to the captain or to speak in the form of questions rather than make actionable statements. They would defer to the person in authority to decide instead of proposing an action themselves.

NTSB

Marine Accident Report

211 In a study conducted by the National Aeronautics and Space Administration (NASA) of airline crew communications (Fischer and Orasanu 1999), subordinate crewmembers often voiced concerns relating to a hypothetical situation of an airliner penetrating an embedded thunderstorm in the form of hints, preferences, or queries. Hints, preferences, or queries do not specify a corrective action, and in these dialogue exchanges, the senior crewmember was unlikely to change his or her opinion of the situation. At 0120, after hearing a weather report from the Weather Channel stating that Hurricane Joaquin had been upgraded from a Category 2 to a Category 3 storm and discussing with the helmsman the size of the seas and the ferocity of the wind, the second mate called the captain using the electric telephone. In her call, the second mate stated, “(uh) I just wanted ***. . . we’ll be meeting the storm.” The second mate continued on the phone call, “. . . alter course straight south then (we’ll) * go through all these shallow areas.” In that exchange, the second mate discussed a preference, rather than using a command or a crew obligation statement. The NASA study found that more effective ways to influence a senior crewmember would be to either issue a direct command or to use a crew obligation statement—a statement in which the subordinate obligates the senior crewmember as part of the navigational team by using language such as “we should” or “our route.” Although both mates suggested changing the vessel’s route to avoid the storm during their respective watches, the captain did not act on their suggestions. They posed their suggestions as hints and preferences, and the captain was not receptive to those suggestions. The concept of mitigated speech is common in a hierarchical system, such as on the bridge of a ship. If a member of the bridge team disagrees with the captain and takes action to defy or challenge his or her authority, that is considered insubordination, which could result in disciplinary action. This creates an environment in which there is hesitancy to challenge a higher authority. There was a degree of uncertainty about the outcome of approaching the hurricane, and the mates would have needed absolute confidence in the outcome to feel comfortable in strongly stating their opinions or taking further action. Nevertheless, the examples cited earlier show that the failure to challenge a superior officer can have fatal consequences. In the case of El Faro, even though the mates clearly had concerns about their route in relation to the storm, they ultimately deferred to the captain’s decision to continue on the planned route. Perhaps if the mates had spoken more assertively to the captain, he might have taken their concerns more seriously. Thus, the NTSB concludes that had the deck officers more assertively stated their concerns, in accordance with effective BRM principles, the captain’s situation awareness might have been improved. Regardless, the second and third mates did voice concerns, but the captain chose not to listen. The suggestions of not one but two of his officers should have prompted the captain to at least review the weather information. Whatever the captain’s possible other actions, he did not return to the bridge. Moreover, by not coming to the bridge as the mates suggested and by dismissing their suggestions to change course and avoid the storm, the captain missed an opportunity to reassess the situation and alter the voyage plan. Thus, the NTSB concludes that the captain should have returned to the bridge after the second and third mates called him to gain a better awareness of the changing weather situation.

NTSB

Marine Accident Report

212 As the person with ultimate responsibility for the vessel and its primary decision-maker, the captain should have gone to the bridge to guide the navigators as the third mate requested when he realized the ship was on a collision course with the storm. The captain’s dismissal of the junior officers’ suggestions may have made them reluctant to further assert themselves as the weather worsened. Thus, the NTSB concludes that by failing to adequately consider the suggestions of the ship’s junior officers to alter the passage plan and failing to alter his decision to proceed, the captain endangered El Faro and its crew. Creating an environment in which all members of the navigation bridge team can freely discuss issues and be comfortable challenging each other’s actions, especially in the face of imminent danger, is a core BRM concept. Although the helmsmen and junior officers frequently discussed alternative voyage plans and their awareness of the weather conditions, their information and concerns were not effectively communicated to the captain. He exhibited poor team leadership and did not discuss alternative options with the other officers after he and the chief mate plotted a new route, and there is no evidence that he gathered the crew to discuss the weather or any changes in the voyage plan due to the storm. The disconnect between the captain’s and crew’s awareness of the proximity of El Faro to the hurricane using the available weather information demonstrates inadequate BRM and resulted in the inability of the crew to function as a cohesive team that had a shared mental model of the voyage necessary to maintain a safe distance from the storm. Thus, the NTSB concludes that the concepts of BRM were not implemented on board El Faro. Therefore, the NTSB recommends that the Coast Guard publish policy guidance to approved maritime training schools offering BRM courses to promote a cohesive team environment and improve the decision-making process, and specifically include navigational and storm-avoidance scenarios. The NTSB also recommends that the Coast Guard require recurring BRM training for all deck officers when renewing their credentials. Actively promoting BRM was the ultimate responsibility of the company. TOTE’s SMS stated that the captain was responsible for providing onboard BRM training to the crew every quarter, in accordance with a training addendum to the SMS. However, the most recent version of the training addendum (dated August 2015) did not include a section on BRM, though a version dated February 2013 did. In fact, the section on BRM was marked as deleted on the contents page of the August 2015 addendum. The document control list indicated that El Faro had received the newest training addendum. Logs of safety training meetings held during the first two quarters of 2015 contained no reference to BRM as a training topic. TOTE was required by its SMS to ensure that quarterly BRM training was conducted aboard El Faro and that BRM principles were addressed in the captain’s standing orders. Investigators found no evidence that TOTE management implemented BRM aboard El Faro. Thus, the NTSB concludes that the company’s failure to ensure the implementation of BRM contributed to the sinking. 2.8 Oversight 2.8.1 Company Safety Management System. According to the ISM code, it is the responsibility of the company—the owner or any other organization that has assumed responsibility for operation of a

NTSB

Marine Accident Report

213 ship—to establish an SMS for its vessels. According to section 1.2.2 of the code, the SMS should “assess all identified risks to its ships, personnel and the environment and establish appropriate safeguards.” In this manner, the code (section 7) directs that the “company should establish procedures, plans and instructions, including checklists as appropriate, for key shipboard operations concerning the safety of the personnel, ship, and protection of the environment.” Furthermore, the code requires that the company “identify potential emergency shipboard situations, and establish procedures to respond to them.” Section 10.8 of the OMV (the operations procedures element of TOTE’s SMS) was titled “Adverse Weather.” It advised the captain to properly handle the ship and to properly stow and secure all equipment. The section did not address securement of cargo, such as adding additional lashings, or checking watertight doors and hatches. Section 5.12 of the EPMV (the emergency procedures element of the company’s SMS) stated that severe weather at sea was to be avoided, if possible, and it directed masters to consult The American Practical Navigator for instructions on how to maneuver in extreme weather.199 Company personnel stated that they believed bad or adverse weather posed a risk to their vessels, yet little other guidance was given for preparing for heavy weather or actions to take if a vessel entered heavy weather. Investigators did not find a heavy-weather checklist in any of the documentation provided by TOTE. The SMS also did not include guidance on the CargoMax software’s damage stability module that was capable of assessing compartment-specific damage, such as the flooding of hold 3. Of the other operating companies surveyed by investigators, seven of the nine stated that their vessels had heavy-weather checklists. Investigators found directives in the manuals and SMS procedures of the companies relating to steps taken before entering heavy weather. They included making closures watertight, increasing GM margin, and using weather routing. Investigators could not find the same level of specificity in TOTE’s SMS. The ISM code recognizes that “no two shipping companies or shipowners are the same, and that ships operate under a wide range of different conditions.” Hence, “the Code is based on general principles and objectives.” But based on these general principals and objectives, it would be expected that a properly functioning SMS would address planning for a safe passage, ensuring vessel watertight integrity, preparing for heavy weather, and crew preparedness for emergencies. The company identified heavy or severe weather as a risk to its vessels, yet it inadequately mitigated that risk by failing to provide specific guidance, instructions, and checklists to prepare the vessel for heavy or severe weather. Furthermore, company audits did not identify the gaps. As a result, the El Faro crew did not adequately prepare for heavy weather, and an open scuttle went unnoticed. Thus, the NTSB concludes that the company’s SMS was inadequate and did not provide the officers and crew with the necessary procedures to ensure safe passage, watertight integrity, heavy-weather preparations, and emergency response during heavy-weather conditions. Therefore, the NTSB recommends that TOTE conduct an external audit, independent of its organization or class society, of its entire SMS to ensure compliance with the ISM code and correct noted deficiencies. The NTSB also recommends that TOTE revise its SMS and BRM programs to

199 See appendix E for more information about The American Practical Navigator and its advice to mariners regarding extreme weather.

NTSB

Marine Accident Report

214 contain detailed polices, instructions, procedures, and checklists to mitigate the risks of severe weather to its vessels. Evaluation and Training. To ensure that a vessel’s officers effectively carry out their duties and responsibilities, it is essential that a system be implemented to assess and evaluate the officers’ performance. Investigators could not to determine how TOTE assessed the capabilities and proficiency of its shipboard officers, though annual evaluations of senior officers were required according to the SMS. The captain’s most recent performance evaluation was drafted a year before the accident, had not been completed, and had not been signed by the technical manager or the captain. The evaluation was not formally received by the TOTE crewing department or placed in the captain’s personnel file. The chief engineer’s most recent evaluation likewise had been drafted a year before the accident and was not completed. The second mate’s most recent personnel evaluation was dated November 2011, when she was sailing as a third mate, and the third mate’s most recent evaluation was dated February 2014, over 19 months before the accident. In the unsigned evaluation from October 2014, the port engineer scored the captain’s performance as excellent in all categories except one: “cooperation with the technical manager.” The evaluation noted that the captain “handles all aspects of the master’s position with professionalism.” However, in emails during 2015, the crewing manager expressed “dwindling confidence” in the captain, and the director of ship management stated, “He’s stateroom Captain, I’m not sure he knows what a deck looks like period. Least engaged of all four Captains in the deck operation.” None of those concerns were formally documented, and no letters of warning or reprimand were found in the captain’s TOTE personnel file. (Email records confirmed that a verbal warning was issued to the captain about welding repairs not being carried out, but no record of that was found in his personnel file.) Company officials initially did not want to consider hiring the captain to command one of its new ships, though nothing in his personnel file suggested that he was not qualified. The captain had been disciplined by a previous employer for causing “disharmony” among officers, as well as failing to follow the chain of command. The company described a loss of confidence in his ability to lead. Before rehiring the captain in 2013, TOTE did not request his personnel records from the previous employer, and according to management, management was not aware that he had two disciplinary letters issued by that company. A company selection process for hiring or promoting personnel should be described in its policies and procedures. However, when management was asked about hiring practices and policies, no written instruction or documentation was provided, and no notes from interview sessions were kept on file for potential hires or current employees who interviewed for other positions. Training and officer competency were managed by two different departments in TOTE. While the crewing department supervised evaluations and Coast Guard–mandated training, the safety and operations department handled shipboard training (TOTE did not have a separate training department). The safety and operations department was responsible for ensuring that familiarization training was completed and that quarterly training logs were collected from the

NTSB

Marine Accident Report

215 vessels. Company management required that the captain conduct crew safety training on board according to its training addendum, although the training topics were general and no additional training materials were provided. The quarterly training logs included a list of topics, and the logs varied as to whether crew signatures were required. When asked how the safety and operations department determined if an officer needed remedial training, an assistant manager stated, “It’s not part of my job, so I don’t know.” When asked how the department evaluated the quality of the training conducted by the captain aboard the ship, that manager again stated that she did not know. Shipboard training information was not included in the crew personnel files kept by the crewing department. Crisis management skills are often not tested. But when circumstances arise that challenge the abilities of senior leaders, weaknesses in those skills become apparent. TOTE had a dedicated emergency response team. Training included running scenarios with vessels and any follow-up when scenarios did not go as planned. The SSAS was tested quarterly on all vessels. According to the log of the emergency response team, the tests were conducted on El Faro on three separate occasions in 2015. According to interviews with emergency response team members, no scenarios specific to heavy weather were ever included in training. In addition, none of the drills conducted with the emergency response team included fire at sea, vessel grounding, or flooding of various compartments. Emergency response team logs for 2015 show that El Faro had two emergencies in early September, when diesel oil was spilled. After those incidents, a drill on contacting the qualified individual in case of emergency was conducted. The yearly log did not include any drills in which the captain and crew responded to flooding. When asked if those types of drills were conducted, emergency team members and management said they were not. Evaluations were not completed regularly, and the company did not follow its own general guidelines for evaluations and oversight. There was no evidence of reassessment of officer competency in the hiring process. Furthermore, there was a clear division between the department evaluating crew competency and the department overseeing training, thus limiting the ability of the company to effectively evaluate the skill level and training needs of its officers. Emergency response team drills failed to include scenarios that would assess responses of the crew when faced with emergencies at sea, such as fire, flooding, and grounding. Thus, the NTSB concludes that the company did not have an effective process for evaluating the performance of its officers. The ISM code (part A, section 6.5) requires companies to “establish and maintain procedures for identifying any training which may be required in support of the SMS and ensure such training is provided for all personnel concerned.” The company SMS required the chief mate to be completely familiar with the vessel’s stability/cargo computation system. The primary method that El Faro officers and company shore-based personnel used to calculate ship stability was the CargoMax program. However, TOTE did not provide any formal training to the officers on El Faro, and none of the former senior deck officers of El Faro who were interviewed said they had any formal training in the use of the software before the accident. A review of the accident voyage captain’s and chief mate’s records indicates that they did not have such training. Officers interviewed stated that their CargoMax training was on the job.

NTSB

Marine Accident Report

216 The CargoMax program contained a damage stability module. Although the damage stability module was not approved by the classification society, investigators found it a fairly quick and useful tool for determining the amount of flooding needed for El Faro to lose positive stability. Using the program, crewmembers could have simulated different damage conditions (or the effect of various types of damage to the vessel), which would have allowed them to calculate the effects of different stages of flooding and would have provided them with conditions of particular vulnerability. None of the former El Faro officers who were interviewed understood how the damage stability module in CargoMax operated. Training by the CargoMax developers or by instructors certified by the developers would have allowed El Faro personnel to be conversant with the full capabilities of the software. They could have experimented in advance with different conditions of damage that would seriously affect the stability of the vessel, quickly determined the status of the vessel during the storm, and recognized the dangerous state El Faro was in. Understanding shipboard stability, particularly in severe conditions, is a critical skill requiring specialized training and experience. That skill allows officers to make competent decisions when faced with complex stability hazards such as list and windheel. The officers on El Faro had no training, and the shipboard guidance was not suitable for the circumstances. Thus, the NTSB concludes that the company did not have an effective training program for the use of the CargoMax stability instrument, including its damage stability module. According to Coast Guard NVIC 10-14 (USCG 2014), an STCW endorsement to master and chief mate credentials on vessels of 3,000 gross tons or more requires, among other obligations, training and assessment in advanced meteorology and advanced shiphandling. Standards for advanced meteorology include “knowledge of characteristics of various weather systems, including tropical revolving storms and avoidance of storm centers and the dangerous quadrants.” Standards for advanced shiphandling include the “management and handling of ships in heavy weather”; the “means of keeping an unmanageable ship out of trough of the sea”; and suggestions of methods, such as weather routing, to prevent vessel damage. About 0500 on the morning of the accident, the El Faro bridge team was looking at two different weather data reports that gave differing positions for the center of Hurricane Joaquin. The BVS report, which was downloaded at 0445 but was almost 12 hours old, forecast the advanceable position of the storm’s center to the northwest of the vessel’s position, placing El Faro in the navigable semicircle and proceeding away from the storm. The Inmarsat-C report, which was current as of 0446, reported the storm’s center directly east of the vessel’s position, placing El Faro in the dangerous semicircle and proceeding toward the storm (see figure 42, section 1.10.3). At 0503, the VDR recorded the captain saying, “We’re getting conflicting reports as to where the center of the storm is,” but it appears that there was no recognition that the perceived conflict was due to the difference in valid times for the weather sources’ center positions for Joaquin. Investigators’ review of the BVS program indicated that the user interface is not difficult to use. However, setting up the system to deliver optimal information can be complex, particularly if no additional training is provided. Operators need to consult the manual, which is not easy to understand and, at times, was confusing to investigators. Because the purpose of using the software is safe navigation of the vessel, a full understanding of how the system works and the data used to

NTSB

Marine Accident Report

217 populate the program is critical. Decision-makers on board any vessel, as well as any shoreside support personnel, should be thoroughly familiar with weather information that is readily available to them, including the latency, or time delay, of the data. Mariners and shoreside personnel should also understand the information that is not available to them through routine channels, determine whether the information is critical, and identify when and how to acquire it. TOTE did not require or provide formal training for its officers on the shipboard weather services and information sources. BVS was one of the El Faro crew’s primary sources of weather information—VDR audio indicates that BVS was, in fact, the preferred source—yet the officers did not have formal training in using the system. Officers did not have adequate knowledge of the capabilities and limitations of BVS. Therefore, they did not recognize the time delay in the BVS tropical cyclone information and thus the source of conflict between it and the more-current Sat-C information. Tropical storm updates were available through Applied Weather Technology, the BVS system developer, but because the crew did not have that function set up in their system, they did not obtain those data. The crew’s lack of understanding was illustrated by the actions they took or failed to take throughout the entire voyage. Thus, the NTSB concludes that the company did not have an effective officer training program for the use of the ship’s BVS weather information software. There is no formal requirement for vessels to have a weather-routing or information service, such as BVS, or other bridge software. However, bridge officers should have adequate training in the use of such a system, including all functionalities, if it is on board a vessel. For example, BVS data could be customized to receive updated storm information more frequently, yet the El Faro crew was either not aware of that function or was not familiar enough with the program to use it. Knowledge of the system (via training and functional user manuals) would have provided them with the information they needed to acquire the additional weather information. Applied Weather Technology provides training to companies that request it, though the training varies according to company needs. Crewmembers should also be fully knowledgeable about all sources of weather information at their disposal and understand the time delays in the information provided. Therefore, the NTSB recommends that TOTE provide formal and recurrent training to its deck officers on the public and commercial weather information systems provided on board each vessel to ensure that the officers are fully knowledgeable about all weather information sources at their disposal and understand the time delays in the information provided. Shipboard Instruments. An accurate determination of wind speed, wind direction, and barometric pressure on board El Faro would have allowed the crew to resolve the conflicting weather reports.200 Although El Faro had a functioning aneroid barometer and a digital barograph, it did not have a properly functioning anemometer. As the American Practical Navigator (Bowditch 2002) notes,

200 It is unlikely that the crew would have been able to use Buys Ballot’s Law to determine the direction of the storm center without an anemometer (the law states that an observer whose back is to the wind has the low pressure on his or her left in the Northern Hemisphere; see appendix E for further information about Buys Ballot). The ship’s motion, combined with worsening conditions and squalls, would have made it extremely difficult to determine the direction of the wind from the bridge wings or weather decks.

NTSB

Marine Accident Report

218 the winds are probably the best guide to the direction of the center of a tropical cyclone. . . . Within the cyclonic circulation, a wind shifting to the right in the northern hemisphere . . . indicates the vessel is probably in the dangerous semicircle. A steady wind shift opposite to this indicates the vessel is probably in the less dangerous semicircle. A former El Faro second mate, who left the vessel less than 2 weeks before the accident, stated that El Faro had one anemometer and that it had not been working for 2 to 3 months. In a conversation recorded on the VDR between the captain and chief mate, investigators confirmed that the anemometer did not work properly. The captain said, “obviously the direction is not good,” and the chief mate, when asked about a number on the readout, stated he would not trust it. The captain also said, “they’re not (gonna buy) a new one for it.” At the first marine board hearing, the vessel’s port engineer said that he knew the anemometer was not operating properly, that it was not captured in the planned maintenance system for the vessel, and that no one told him to fix it. A properly working anemometer would have allowed the ship’s crew to compute the true wind direction and speed. With that information, the captain would have had additional information to determine the vessel’s position in relation to Hurricane Joaquin. Thus, the NTSB concludes that the company did not ensure that El Faro had a properly functioning anemometer, which deprived the captain of a vital tool for understanding his ship’s position relative to the storm. The NTSB therefore recommends that TOTE require its vessels to be equipped with properly operating meteorological instruments, including functioning barometers, barographs, and anemometers. To ensure that vessels are equipped with properly functioning weather equipment, the NTSB also recommends that the Coast Guard require that vessels in ocean service (500 gross tons or over) be equipped with properly operating meteorological instruments, including functioning barometers, barographs, and anemometers. RRDA Program. When El Faro experienced a large heel angle hours before sinking, the crew did not consider using the RRDA service from ABS, which could have helped the captain evaluate the situation and determine courses of action. Although not required to do so by regulation, TOTE subscribed to the RRDA program for El Faro. Based on VDR audio, El Faro personnel did not know the effects of windheel on their vessel or, initially, the source of the list. Shortly after 0722 on the accident morning, the riding gang supervisor asked the captain about the ship’s downflooding angles, and the captain did not know the answer. That was the type of information that RRDA could have provided. With windheel and stability information in hand, the captain could have taken early proactive steps to determine the source of the list and might have decided to muster the crew sooner. Support would have been even more effective had the RRDA team been supplied with vessel loadout data for the voyage. According to statements by company representatives and a former El Faro master, the company did not actively use or require the crew to be familiar with the RRDA system, and no drills were conducted in its use. No information about the vessel’s loadout was provided to ABS before the accident voyage. Nominal departure conditions for Jacksonville and San Juan using various container stack heights would have been helpful. Conceivably, windheels for full deck loads of two-high or four-high container stacks could have been modeled for loadouts of lesser or greater heights, and RRDA should have been able to provide the El Faro captain with a worst-case windheel. However, based on VDR audio, RRDA was neither discussed nor considered by the crew. Enrollment in RRDA allows for drills, but the company had not participated in any. The

NTSB

Marine Accident Report

219 RRDA manager stated that the program would be more effective if the captain and crew knew what RRDA could do. Thus, the NTSB concludes that the company subscribed to the RRDA service, although not required, but did not train the crew in its use. Therefore, the NTSB recommends that TOTE provide shoreside management and vessel senior personnel with training in the RRDA program and standard operating procedures, to include requirements to conduct annual drills and submit departure stability conditions for each vessel on each voyage. Shoreside Support. The ISM code states that the “Company should ensure that the master is given the necessary support so that the master’s duties can be safely performed.” When investigators asked TOTE personnel if they monitored the movements of their vessels, especially when they were in or set to enter an area of heavy weather, they stated that no one was assigned that duty and that they were not required to do so. Although the port engineer said he believed he looked at the September 30 noon message from El Faro, he told investigators that he did not believe anyone tracked the vessel’s position at any time. For weather tracking, two TOTE terminal personnel received BVS weather reports, but none of the management personnel obtained BVS or other contracted weather service information. The company did not provide the captain with competent sources of nautical experience for the purpose of consultation. According to TOTE representatives, the captain was the primary nautical expert. There were other captains in the TOTE organization, such as the DP, but he was overwhelmed with other duties. The captains at sea themselves were the company’s nautical experts. According to the director of marine safety and services, “There is no one in the company that formally provides oversight for nautical. We depend on the captains to take on that role.” In the past, TOTE had both port captains and port engineers to oversee vessel operations. After the company reorganized, port captains were no longer in the organizational structure for the commercial fleet, though port engineer positions remained. TOTE management stated during marine board testimony that the company’s reorganization in 2012–2013 did not negatively impact shoreside support and that the relocation of personnel from New Jersey to Jacksonville had enhanced shoreside support and oversight. Investigators, however, found very little shoreside oversight or support for the accident voyage. When El Faro left Jacksonville, then-Tropical Storm Joaquin’s wind fields were forecast to be near the vessel’s normal route of travel to San Juan. TOTE shoreside personnel did not monitor the vessel, even as the storm was upgraded to a hurricane. There is no indication that anyone from TOTE management contacted the vessel once it departed Jacksonville, aside from responding to the captain’s email regarding the return transit from San Juan. The lack of engagement from TOTE management differed from company practices earlier in the 2015 hurricane season. Hurricane Danny prompted the DP to issue a safety alert to all vessels, with guidance to review heavy-weather procedures and “be prepared for the unexpected occurrence.” For Tropical Storm Erika, TOTE management contacted El Faro’s captain and asked for his preparedness/avoidance plans, action area, and risk assessment “to ensure we are all on same page and nothing is missed.” El Faro’s captain responded with a message outlining the route he was taking (Old Bahama Channel), why he was taking the route, and the steps taken to mitigate damage. The vessel successfully weathered the storm.

NTSB

Marine Accident Report

220 During the accident voyage, the captain wrote in the notes section of the September 30 noon report, “Precautions observed regarding hurricane Joaquin.” After receiving the report, the company did not question the captain’s plans or monitor the ship’s progress. In fact, the company seemed unaware that a potential hurricane was affecting the vessel’s route. The company’s lack of engagement during Hurricane Joaquin indicates that management had become complacent. Investigators learned that shoreside managers of the company that managed the Sea Star Line vessels (which were subsequently managed by TOTE) had a process by which they would contact the vessel to determine the captain’s plans for any weather systems that might affect the vessel. Also, eight of nine companies that were voluntarily surveyed stated that they contacted their captains directly or monitored routing and weather-related correspondence between their ships’ captains and contracted with weather or nautical services. Thus, the NTSB concludes that the company did not monitor the position of El Faro relative to the storm and did not provide the captain with support for storm avoidance and heavy-weather preparations during the accident voyage. The NTSB further concludes that the company failed to assess the risk posed by Hurricane Joaquin to El Faro. The NTSB therefore recommends that TOTE institute a formal company process to provide independent weather routing, passage-planning assistance, and vessel position monitoring. Summary. Merely having an SMS is not sufficient to prevent catastrophes. It is necessary to have dedicated personnel assigned to provide captains with effective guidance and procedures. Robust training and auditing ensure that guidance and procedures are being followed. DPs should be actively involved in the maintenance of the SMS and should monitor their assigned vessels throughout each voyage. The NTSB has concluded that the company had an inadequate SMS and an ineffective process for assessing officer performance; that it did not provide effective training for onboard equipment and programs; that it did not ensure that El Faro had a functioning anemometer; that it failed to ensure that the risk posed by Hurricane Joaquin was adequately addressed; and that it failed to track the vessel’s position relative to the storm and support the captain during the accident voyage. Had the company addressed some of the safety issues identified in this report, the casualty might not have occurred. Thus, the NTSB concludes that the company’s lack of oversight in critical aspects of safety management, including gaps in training for shipboard operations in severe weather, denoted a weak safety culture in the company and contributed to the sinking of El Faro. 2.8.2 Regulatory Training for Heavy Weather. The El Faro captain obtained his master’s credential in

1. The requirements for assessing competency in heavy-weather operations went into effect in

2002, with Coast Guard National Maritime Center Policy Letter 04-02 (USCG 2002) for new applicants only. The policy did not address masters and chief mates who had received their licenses before 1998 and thus were not subject to the requirements. NVIC 10-14, issued in 2014 (and which superseded the policy letter), extended the requirements to all mariners. However, masters and chief mates credentialed before 2014 were grandfathered under the former policy until December 31, 2016.

NTSB

Marine Accident Report

221 As of the date of this report, the Coast Guard has no plans to address this gap in training. Therefore, because of the grandfathering clause, mariners who had obtained their initial credential before 1998 were not, and are still not, required to take an advanced meteorology course approved by the Coast Guard. Thus, the captain was not required to have completed the advanced meteorology and advanced shiphandling courses. As of January 1, 2017, those courses are now a requirement for new applicants. Those who already hold credentials are required to take the courses only if upgrading to a higher license. The same was true for the chief mate on El Faro. According to their most recent certificates, none of the bridge officers had attended the advanced meteorology or advanced shiphandling courses. If the captain had had training in advanced meteorology and advanced shiphandling, he may have made different decisions with respect to storm avoidance. Current Coast Guard training requirements include a grandfathering clause that exempted the captain (and any other mariner credentialed before 1998) from taking a Coast Guard–approved advanced meteorology course. Thus, the NTSB concludes that training in heavy-weather operations, including advanced meteorology and advanced shiphandling, from which the captain was exempt, might have provided him with additional information to consider while evaluating options and might have resulted in a different course of action. The NTSB therefore recommends that the Coast Guard require that all deck officers, at both operational and management levels, take a Coast Guard–approved advanced meteorology course to close the gap for mariners initially credentialed before 1998. In addition, the NTSB recommends that the Coast Guard publish policy guidance to approved maritime training schools offering management-level training in advanced meteorology, or in an appropriate course, to ensure that the curriculum includes the following topics: characteristics of weather systems including tropical revolving storms; advanced meteorological concepts; importance of sending weather observations; ship maneuvering using advanced simulators in heavy weather; heavy-weather preparations; use of technology to transmit and receive weather forecasts (such as NAVTEX or weather-routing providers); ship-routing services (capabilities and limitations); and launching of lifeboats and liferafts in heavy weather. The NTSB further recommends that the Coast Guard provide policy guidance to approved maritime training schools offering operational-level training in meteorology to ensure that the curriculum includes the following topics: characteristics of weather systems, weather charting and reporting, importance of sending weather observations, sources of weather information, and interpreting weather forecast products. Stability Guidance. Stability booklets are required on most ships and are used by the crews to operate vessels in compliance with applicable criteria. It is important that the vessel’s stability booklet bring vessel vulnerabilities related to stability to the attention of the ship’s officers. When the ship encounters forces that cause unusual angles of heel, such as wind and unintentional flooding, the stability booklet must clearly indicate safe limits and identify hazards to aid officers in decision-making during normal operations and crisis management situations. Discussions between the captain and deck officers on El Faro, as captured by VDR audio in the hours before the sinking, indicate that the crew did not have sufficient information about the

NTSB

Marine Accident Report

222 vessel’s downflooding angles—openings that might result in unintentional flooding, and the effect of windheel.201 Raising the vessel’s load line meant that it sat lower in the water by more than 2 feet, increasing the risk of unintentional flooding through all openings above the waterline, including ventilation ducts and scuttles to the cargo holds. (The ducts and scuttles had not been modified from the vessel’s previous configurations.) El Faro’s stability booklet did not contain any information on the downflooding angles (heel angle at which an opening reaches the waterline) for the openings or for closures that needed to be made to prevent downflooding through the openings. The importance of the openings as potential downflooding points would have been obscure to the crew for several reasons. First, the stability booklet did not contain guidance about closing the cargo hold ventilation ducts. Second, the vessel’s COI required the closures to remain open while under way. Third, the ventilation closures doubled as fire dampers and were tested and operated as such. Fourth, the ventilation closures were labeled on vessel plans and on the closures themselves as fire dampers, not closures. Investigators believe that wind velocity and windheel information would have helped the El Faro captain determine what was causing his vessel to list because he would have an estimate of the wind-driven heel at given wind velocities. His awareness of the extent to which hurricane winds would have heeled his vessel might have influenced his decision to seek an alternate route or a greater closest-point-of-approach to the hurricane. Thus, the NTSB concludes that El Faro’s stability booklet should have included downflooding angles and windheel criteria to increase the officers’ awareness of the ship’s vulnerabilities in heavy weather, such as unintentional flooding and listing. The guidance and instructions in El Faro’s stability booklet complied with current regulations and were little changed from when the vessel originally traded as a Ro/Ro. The Coast Guard NVIC outlining stability information to be included in a stability booklet (NVIC 3-89) provides only guidelines. Coast Guard regulations (46 CFR 170.110) contain broad requirements for stability information and other provisions described as “consideration must be given,” not as required. Several of the provisions would have provided the El Faro officers with critical information during the accident voyage, such as plans showing watertight compartments, closures, vents, downflooding angles, precautions to prevent unintentional flooding, and other necessary guidance for the safe operation of the vessel under normal and emergency conditions. That information was not in El Faro’s stability booklet. The stability booklet was developed for TOTE by a naval architecture firm. The classification society reviewed the booklet and the Coast Guard could have as part of its oversight role (though it did not). Thus, the NTSB concludes that neither the Coast Guard nor the classification society adequately assessed the vessel’s stability booklet to ensure that it contained critical information detailed in Coast Guard regulations and guidance. In summary, a more comprehensive stability booklet might have changed the course of events. If the vessel’s stability booklet had contained specific information (downflooding angles, ventilation damper closure, the effects of wind [windheel], the wind speed used in calculating required stability, and actions to avoid and consider when flooding and cargo shifting occur), the

201 Deck officers, such as captains and mates, are the shipboard officers who calculate ship stability.

NTSB

Marine Accident Report

223 captain might not have taken the route that brought him close to strong winds or taken the actions that placed the vessel in danger. The Coast Guard provides general guidance in NVIC 3-89 and 46 CFR 170.110, but the information listed above is not specified or required. Therefore, the NTSB recommends that the Coast Guard revise 46 CFR 170.110 (stability booklet) to require (1) stability instructions, guidance, or data on wind velocity used to calculate weather criteria; (2) list of closures that must be made to prevent unintentional flooding; (3) list of closures that must be made for an opening not to be considered a downflooding point; and (4) righting arm curve (GM) table to note the angle at which initial downflooding occurs; also, add a windheel table for vessel full load displacement or the condition of greatest vulnerability to windheel. El Faro had flooding in a cargo hold with cars adrift (Ro/Ro cargo) and a sustained starboard windheel. The captain made a course change to put the wind onto the opposite side, intending to switch the list to port. At the same time, he was attempting to correct the list by shifting water between the ramp tanks. Those actions resulted in a rapid shift to a port list. Coast Guard NVIC 4-77 (Shifting Weights or Counter Flooding During Emergency Situations) was developed in response to an accident related to bulk cargo stability. The NVIC encourages captains (masters) to make every effort to determine the cause of a vessel’s list before taking corrective action. It also gives specific guidance (regarding shifting weights and counter-ballasting) for vessels carrying bulk cargo. The El Faro accident shows that the guidance in NVIC 4-77 is applicable to Ro/Con cargo ships. Attempts by ship personnel to correct a list (course changes, counter-ballasting) can produce dangerous results if cargo is already adrift. In addition, if wet decks have reduced the friction between Ro/Ro cargo and decks, the risk of lashing failure and subsequent cargo shift increases. NVIC 4-77 would benefit from specific guidance tailored to Ro/Ro or Ro/Con vessels. Thus, the NTSB concludes that Coast Guard NVIC 4-77 should be revised to include specific guidance regarding the dangers of taking corrective action if Ro/Ro cargo is adrift or the decks are wet. The NTSB therefore recommends that the Coast Guard update the guidance in NVIC 4-77, based on the circumstances of the El Faro accident, to include a warning that actions by ship personnel intended to correct a list can produce dangerous results if Ro/Ro cargo is already adrift and water has reduced the coefficients of friction for lashed cargo. Alternate Compliance Program. Investigators examined the inspection history of El Faro, interviewed Coast Guard and ABS staff regarding the vessel’s enrollment in the ACP, and reviewed the Coast Guard chief traveling inspector’s report on the program. The investigation revealed a number of significant failures in the implementation of the program: • The Coast Guard lacked resources to complete the reviews of US supplements for ACSs, and Coast Guard marine inspectors and surveyors were either not familiar with the supplements or were using unapproved versions. Thus, gaps between ACS rules, international conventions, and Coast Guard safety regulations could not be identified. • TOTE (as well as other owners and operators surveyed by Coast Guard traveling inspectors) provided inadequate notice to ABS for planned surveys, and therefore Coast Guard inspectors had little to no notice of those surveys. Joint examinations were rarely conducted.

NTSB

Marine Accident Report

224 • Communications between the Coast Guard and ACSs was lacking. The LORACS position required by NVIC 2-95 had been discontinued and duties distributed among several individuals. OCMI offices did not have dedicated ACP officers to coordinate with ACSs for surveys and inspections. • Shipboard discrepancies and nonconformities found by ACS surveyors were not reported to OCMIs and thus not recorded in Coast Guard databases. Thus, the Coast Guard did not have a record of high-risk vessels enrolled in the ACP program. • Coast Guard marine inspectors lacked experience and training that would have allowed them to discover discrepancies with enrolled vessels. Vessels that had successfully completed ACS surveys and were later inspected by Coast Guard traveling inspectors were found to have serious safety deficiencies, some resulting in scrapping or no-sail orders. The deficiencies had gone unnoticed during oversight examinations due to the inexperience and inadequate training of field inspectors. • Coast Guard marine inspectors lacked extensive experience to make proper decisions regarding questionable ACP vessel inspections. • The Coast Guard has no procedures or authority to assess the performance of the ACS surveyors that are performing inspections on its behalf. • During Coast Guard annual quality audits of ACSs, Coast Guard personnel attend as observers and are limited in their ability to assess an ACS’s performance for compliance to ACP for US-flagged vessels. • During audits of the documents of compliance and safety management certificates performed by the ACS, the Coast Guard attends only as an observer and has no authority to make findings or nonconformities. • A lack of guidance, experience, and qualification requirements has degraded the inspection knowledge and experience of Coast Guard marine inspectors. In 1983, the Coast Guard conducted a Marine Board of Investigation for the capsizing and sinking of the bulk carrier Marine Electric (the NTSB also investigated the accident [NTSB 1984]). Although the ACP was not in effect at the time, the Coast Guard had delegated to ABS the authority to survey and assign load line certificates to US-flagged vessels. In its 1984 report, the marine board found that ABS failed to properly conduct surveys on the Marine Electric, allowing the vessel to continue in service with significant wastage and insufficient repairs to hatch covers and decks (USCG 1985). It was determined that failures in the hatch covers and decks allowed water to enter the forward holds and eventually sink the ship. Coast Guard inspectors with oversight responsibilities had also failed to detect the problems with the hatch covers and decks. The marine board concluded that ABS surveys and visits were “oriented toward protecting the best interest of marine insurance writers, and not for the enforcement of Federal safety statutes and regulations.” Furthermore, the board concluded that Coast Guard examinations of the vessel before the accident were performed by Coast Guard personnel who lacked the experience to conduct safety examinations of a vessel the size, service, and configuration of the MARINE ELECTRIC. The incompleteness of these inspections as to the dictates of regulations and policy was attributed to the lack of training and experience on the part of the Coast Guard inspectors.

NTSB

Marine Accident Report

225 Based on its findings in the Marine Electric investigation, the marine board recommended that examinations of US commercial vessels should “be conducted and determined by knowledgeable members of a U.S. Government agency. The responsibilities for these functions should not be delegated or entrusted to the private sector.” The marine board also called for a commission to conduct an in-depth review of the Coast Guard’s commercial vessel safety program, with emphasis on the experience and training of program administrators, program and project managers, OCMIs, and field inspectors. In response to the marine board’s report on the Marine Electric accident, the then-Commandant of the Coast Guard rejected the recommendations to cease delegation of responsibilities to third-party organizations and to review the commercial vessel safety program. The commandant stated that “the MARINE ELECTRIC surveys in question were poorly conducted, but the fact does not condemn the entire system of third party delegation which has been authorized and encouraged by Congress.” Delegation of authorities did not end. In fact, with the advent of the ACP program in 1995, the practice increased. A review of the commercial vessel safety program was also not conducted because, according to the commandant, “efforts commenced before and after this tragic casualty are already addressing the mentioned issues.” Thirty-two years after the Marine Electric accident, Coast Guard and NTSB investigators found similar issues with El Faro and other vessels enrolled in the ACP, which revealed that the Coast Guard is not performing sufficient oversight of the ACSs to adhere to federal safety standards and that Coast Guard field inspectors do not have the resources, experience, training, and authority required to perform effective oversight. Thus, based on the evidence, the NTSB concludes that the Coast Guard’s ACP is not effective in ensuring that vessels meet the safety standards required by regulations and that many vessels enrolled in the program are likely to be operating in substandard condition. Accordingly, the NTSB recommends that the Coast Guard conduct a complete review of the ACP program to assess the adequacy and effectiveness of the program. The NTSB further recommends that the Coast Guard review and implement training of Coast Guard inspectors and ACS surveyors to ensure that they are properly qualified and supported to perform effective, accurate, and transparent vessel inspections, meeting all statutory and regulatory requirements. The NTSB further recommends that ABS enhance training of its surveyors to ensure that they are properly qualified and supported to perform effective, accurate, and transparent vessel surveys, meeting all statutory and regulatory requirements. Major Conversions. The Coast Guard’s final determination not to designate the conversion of El Faro to a Ro/Con as a major modification appears to have been based on past determinations. However, the conversion resulted in a significant increase in load line draft and new load-on/load-off container capacity. The converted ship lost over 40 percent of its Ro/Ro cargo but gained 1,414 more TEUs of container cargo. The relatively higher position and added weight of the containers raised the vessel’s center of gravity, requiring nearly 5,000 long tons of additional fixed ballast that increased the ship’s maximum allowable draft by over 2 feet, thereby lowering the unmodified hull openings the same amount. Load line draft is typically considered a principal dimension of a vessel in naval architecture and marine engineering and can be found under the same title on vessel plans, vessel

NTSB

Marine Accident Report

226 particulars, and in naval architecture textbooks. Under 46 USC 2101(14a), which defines major conversion, the draft increase could have been considered a substantial change in the vessel’s dimension. The conversion to carry load-on/load-off containers could be argued to be a change in the type of the vessel, and the carriage of containers could be assumed to prolong the life of the vessel by allowing it to competitively trade in a new service. Thus, the NTSB concludes that the 2005–2006 conversion of El Faro to carry load-on/load-off containers and the associated increase in draft should have been designated a major conversion by the Coast Guard. The NTSB therefore recommends that the Coast Guard review and revise the policy for major conversion determinations to consider load line (maximum) draft as a principal vessel dimension. Lifesaving Appliances. Designating the 2005–2006 conversion as a major conversion would not have affected the stability standards the vessel had to meet (because the applicable standards were the same as in 1993). The OCMI could still have reviewed other systems and possibly required the vessel to meet newer safety standards, such as lifesaving. In 1993, the OCMI did not require El Faro’s lifeboats to be updated to closed-type standards because the lifeboats themselves were not modified in the conversion. Rather, the OCMI stated that if the lifeboats were replaced in the future, they would have to meet the standards applicable at the time of replacement. The same situation prevails today. That is, the OCMI uses the guidance of “reasonable and practicable” when considering whether vessel systems and equipment must comply with the standards current at the time of modification. Therefore, there is no objective guidance for lifesaving appliances to comply with current standards on the date vessels undergo a Coast Guard– designated “major modification.” In addition, existing vessels that have not undergone a major modification might be in service for decades without their safety and lifesaving appliances ever being reviewed—even to the “reasonable and practicable” standard. Advances in lifesaving appliances increase the safety and survivability of crewmembers. Those advancements are incorporated in newer standards, such as those for enclosed lifeboats. All vessel crews should be afforded modern lifesaving equipment on board their vessels. The NTSB believes that vessel owners and operators who choose to repower, modify, convert, or make significant repairs to their vessels should not be placed at a competitive disadvantage (compared with owner/operators who do not modify their vessels) by being required to replace existing lifesaving appliances during designated major conversions. Thus, the NTSB concludes that for inspected vessels in coastal, Great Lakes, or ocean service, having their lifesaving appliances regularly reviewed for compliance with current standards would improve crew survivability. The average life of international merchant ships varies by ship type but is roughly 20 to 30 years. El Faro was 40 years old. Open lifeboats were superseded by closed lifeboats about 30 years before the sinking. SOLAS currently requires vessels to be drydocked twice in a 5-year period. A multiple of 5 years, or another interval coinciding with significant regulatory or class examinations, could be a practicable method of reviewing and upgrading lifesaving appliances to new standards. Considering the average service life of vessels, a maximum 20-year interval for upgrading lifesaving appliances is reasonable. Therefore, the NTSB recommends that the Coast Guard, at regular intervals, not to exceed 20 years, review all lifesaving appliances on inspected vessels that are required by 46 CFR Part 199, and require compliance with current standards.

NTSB

Marine Accident Report

227 2.9 Contributing to Loss of Life Hours before El Faro sank, it developed a starboard list (heel) from the wind and weather. At 0545, the engineer supervising the riding gang and the chief mate reported that El Faro was in danger, with uncontrolled flooding and cargo (cars) adrift in hold 3. The reports should have prompted the captain to take immediate action, including sounding the general alarm and notifying the DP ashore of the vessel’s condition. Sounding the general alarm would have woken and mustered the crew, providing additional resources to assist the chief mate in investigating and potentially locating and controlling the sources of flooding. At 0554 the morning of the accident, the captain turned the vessel to port, after discussing with the chief engineer problems with the oil levels in the engine room machinery, and put the wind on their starboard side to shift the list to port. It appears that the captain believed that shifting the list to port would allow them to identify the source of the flooding on the starboard side. The shift of the list to port eventually resulted in a loss of lubrication oil pressure and a main engine shutdown (loss of propulsion) at 0613 near the Category 3 hurricane’s center. The lubrication system that caused the engine shutdown was designed to operate with up to 15° of list and 5° of trim, suggesting that El Faro’s port list had exceeded 15°. El Faro’s main propulsion could not be regained because of the list. The loss of propulsion, placing the vessel at the mercy of increasing hurricane-force winds and seas, should have been a clear indicator to the captain to sound the general alarm, yet he did not. Not until 12 minutes before the sinking did the captain sound the general alarm to muster the crew, despite obvious signs that the ship was in extremis. He did not order abandon ship until 10 minutes before the ship sank. The captain had sufficient information regarding the ship’s perilous condition, and sounding the general alarm much earlier, when flooding intensified in hold 3, would have been prudent. Failing that, the loss of propulsion should have spurred him to muster the crew. The captain clearly held to the conventional wisdom that the vessel provided the best shelter from the elements and should only have been abandoned when it became apparent that it was no longer seaworthy. However, by the time the captain finally recognized that the vessel was no longer seaworthy, it was too late for the crew to successfully abandon ship. Thus, the NTSB concludes that the captain’s decision to muster the crew and abandon ship was late and may have reduced the crew’s chances of survival. El Faro’s open lifeboats were in compliance with the lifeboat standards in force when the vessel was delivered in 1975. Specifically, the vessel carried two open lifeboats, one motor-propelled and the other manually propelled, that were capable of being launched with a list of up to 15° and a trim of up to 10°. Marine regulators recognized in the early 1980s that open lifeboats did not provide adequate protection to the occupants and needed to be phased out. Standards were updated accordingly. Open lifeboats and manually propelled lifeboats were not allowed on oceangoing vessels delivered after 1986. However, vessels delivered before that time could still carry lifeboats that adhered to the previous standards as long as they were maintained in adequate condition.

NTSB

Marine Accident Report

228 Current US and SOLAS regulations require enclosed lifeboats to be powered by a compression ignition engine. Modern enclosed lifeboats can be launched with a list of up to 20°; can be boarded and launched directly from the stowed position; have added reserve buoyancy when watertight doors, hatches, and ports are closed; and protect the occupants from exposure. Half of all US-inspected oceangoing vessels currently in service (152, or 49 percent) were delivered before 1986 and have onboard side-launched open lifeboats. The remaining vessels were delivered after 1986 and have enclosed lifeboats in either side-launched (110, or 35 percent) or freefall-launched (49, or 16 percent) configurations. Thus, roughly half of US-inspected oceangoing vessels are equipped with lifesaving appliances that have been considered insufficient for over 30 years. Stern-launched freefall lifeboats provide additional safety benefits above even side-launched enclosed lifeboats in that they can be launched by one person, that once launched they separate themselves from the vessel, and that they are free from the limitations of fall wires for launching. Thus, the NTSB concludes that survivability would be increased if new cargo vessels were equipped with stern-launched freefall lifeboats, where practical. When an existing vessel undergoes a major modification, it provides the Coast Guard with the opportunity to bring that vessel’s systems and equipment into line with the latest safety standards, if determined reasonable and practicable. When El Faro was lengthened in 1993, the Coast Guard determined that it was a major modification, but the owner was not required to upgrade its lifeboats. When the captain ordered abandon ship at 0729 the morning of the accident, the ship was most likely listing more than 15°, based on VDR audio statements and the fact that lube oil pressure had been lost. Thus, the vessel’s list exceeded the capabilities of the lifeboat-launching equipment, and a successful launch was unlikely. The hurricane-force winds and seas would have made a successful launch even less likely. Further, because the captain instructed the crew to prepare liferafts when the order to abandon ship was given, it appears that he realized launching the lifeboats was impractical (either because they were outside launching parameters or because they would not provide adequate protection). During the investigation, the lifeboat manufacturer’s representative testified that there has been no known successful launching of a lifeboat or liferaft with survivors under hurricane conditions with winds of over 96 knots. Photo evidence of El Faro’s port and starboard lifeboats and their associated davits suggests that neither was successfully launched. Even if successfully launched, the lifeboats would have provided little protection from the hurricane-force winds and seas. Thus, based on the evidence, the NTSB concludes that the severe weather, combined with El Faro’s list, made it unlikely that the lifeboats could be boarded or launched. The NTSB further concludes that the vessel’s open lifeboats would not have provided adequate protection even if they had been launched. Modern enclosed lifeboats enhance survivability compared with the open lifeboats carried by El Faro. It is possible that some of the crew of El Faro would have survived if the vessel had been outfitted with modern enclosed lifeboats. Thus, the NTSB concludes that survivability would be increased if open lifeboats on all vessels remaining in service were replaced with enclosed lifeboats that adhered to the latest safety standards. Therefore, the NTSB recommends that the Coast Guard

NTSB

Marine Accident Report

229 require that open lifeboats on all US-inspected vessels be replaced with enclosed lifeboats that meet current regulatory standards and freefall lifeboats, where practicable. El Faro had four 25-person liferafts stowed in pairs just aft of each lifeboat and a 6-person liferaft stowed forward. The liferafts were designed to be manually launched. To do so, crewmembers would have had to traverse the weather decks of the listing El Faro in hurricane-force winds, tie off the liferaft painters to the ship, lift each encapsulated liferaft (weighing 380 or 406 pounds) from its stowage cradle and throw it overboard, then inflate the liferafts by pulling on the painter, jump into the water, and finally board the liferaft. If the crew could not manually launch the liferafts, the rafts were designed to automatically inflate when the vessel sank. No matter how the liferafts were launched, any crewmembers who survived the sinking would have had to swim to the liferafts and board them under the prevailing conditions. An hour and a half before the order came to abandon ship, the Ocean Prediction Center had reported winds in the area of 105 knots sustained, with gusts up to 130 knots and seas reaching 36 feet. Also, postaccident examination of El Faro’s superstructure showed multiple deep cuts and battered metal, most likely from floating containers that hit the superstructure before the vessel sank. Any crewmembers in the water would have had to swim to an inflated liferaft through the wind-swept, floating containers, mountainous seas, and unbreathable wind-driven sea foam before boarding a liferaft. Thus, the NTSB concludes that the severe weather, combined with El Faro’s list, made it unlikely that the liferafts could be launched manually or boarded by crewmembers once in the water. According to the National Hurricane Center’s poststorm report, at the time of the sinking on October 1, Joaquin was a Category 3 hurricane (a major hurricane) with 110-knot winds. Twenty minutes after the sinking, Joaquin was upgraded to a Category 4 hurricane with 115-knot winds. The storm remained near the Bahamas through October 2. On October 3, the hurricane accelerated northeastward away from the Bahamas and reintensified, reaching a peak intensity of around 135 knots, just below Category 5 strength (winds 137 knots and higher). At the request of Coast Guard D7CC, an Air Force hurricane hunter aircraft flew over El Faro’s last known position less than 3 hours after the sinking, made radio callouts on VHF channel 16, and conducted a radar search. However, the aircraft was unable to descend below 10,000 feet because of the storm, and radar detection was ineffective due to excessive feedback from heavy precipitation. The nearest vessel to El Faro, the inter-island freighter Emerald Express, was unable to assist in the search for El Faro because it was sheltering from the storm in the lee of Acklins and Crooked Island. On October 2, a Coast Guard HC-130 aircraft tasked with searching for El Faro could not get within 100 miles of the hurricane because of severe winds at 3,000 feet altitude. The flight crew reported visibility of 2 miles, heavy rain and spray, and heavy seas with whitecaps and foam. The aircraft was damaged by the severe weather, prompting cancellation of the second sortie of the day. During the first 2 days, D7CC positioned surface and air assets behind the storm, but search-and-rescue efforts did not fully begin until Hurricane Joaquin moved away from the area on October 3. Beginning at sunrise on October 3 and ending at sunset on October 7, altogether 50 air and surface sorties were conducted, with over 274 hours of active searching for El Faro and

NTSB

Marine Accident Report

230 survivors. Fifteen different Coast Guard, Air Force, and Navy search-and-rescue assets searched 195,601 square miles. Thus, the NTSB concludes that search-and-rescue efforts were carried out as effectively as possible given the extreme weather conditions in the days following the accident. An accurate position of a vessel in distress is critical to ensuring that search-and-rescue assets can reach the vessel in time to rescue people or prevent environmental damage. The distress message that was sent from El Faro via Inmarsat-C and relayed to the Coast Guard’s rescue coordination center in Norfolk, Virginia, gave the vessel’s position as 23.28N, 73.48W. (As written in traditional format, the position was 23°28′N, 73°48′W.) Inmarsat-C formatting, however, uses a period (full stop) to separate the degrees and minutes in a vessel’s latitude and longitude. When the Inmarsat-C position (23.28N, 73.48W) was entered into the Coast Guard’s SAROPS program, the period was misinterpreted as a decimal point, with the numbers after the point being read as tenths and hundredths of a degree. SAROPS then erroneously converted the position to degrees and decimal minutes—23-16.800N, 073-28.800W. (The Coast Guard format for latitude/longitude uses a hyphen to separate degrees from minutes.) The SAROPS position had an error of 23 nm compared with the last known position of El Faro, and as a result D7CC launched its search for El Faro and survivors at a distance from the accident site. Thus, the NTSB concludes that because of differences in latitude and longitude formatting between Inmarsat-C and the Coast Guard’s SAROPS, the last known position of El Faro according to SAROPS was 23 nm from the actual position. In addition to the differences between Coast Guard and Inmarsat-C formatting, the SSAS used yet another format, separating degrees and minutes of latitude and longitude with a colon and expressing minutes as a decimal. The SSAS position for El Faro sent to the Coast Guard was thus 23:25.39N, 073:52.51W. The different formats that can be used to express the same latitude and longitude are shown in the hypothetical example below (seconds are used in the traditional format to further illustrate the differences, and the decimal format used throughout this report is added for comparison): Traditional (deg, min, sec) . . . . . . 23°28′15″N, 73°48′30″W Inmarsat-C . . . . . . . . . . . . . . . . . . 23.28N, 73.48W SSAS . . . . . . . . . . . . . . . . . . . . . . 23:28.25N, 73:48.5W Coast Guard . . . . . . . . . . . . . . . . . 23-28.25N, 73-48.5W Decimal degrees . . . . . . . . . . . . . . 23.47N, 73.80W The differences between location formats can create confusion. Although the error in the last known position did not ultimately affect the outcome of the El Faro search-and-rescue efforts, it highlights the potential that similar errors could hinder future time-critical search-and-rescue operations. Thus, the NTSB concludes that although position errors did not affect the outcome of search-and-rescue efforts after El Faro sank, position information should adhere to a standardized format to eliminate similar errors in future accidents. Therefore, to prevent future errors in converting position data such as occurred in the El Faro accident, the NTSB recommends that the Coast Guard work with manufacturers of GMDSS equipment, communication providers, and land earth stations to remove ambiguity from the Inmarsat-C distress alert position reports.

NTSB

Marine Accident Report

231 EPIRBs are designed to save lives by automatically alerting rescue authorities and indicating the location of a vessel in distress. A category I 406-MHz EPIRB is float-free, automatically activated, and detectable by satellite anywhere in the world. The EPIRB’s digital code indicates the identity of the vessel to search-and-rescue authorities, who can refer to a registration database to find vessel information, vessel contact information, and the 24-hour emergency contact’s information. El Faro was equipped with a non-GPS-enabled EPIRB. The EPIRB was detected at 0736 on October 1 by a geostationary satellite, and a “406 beacon unlocated first alert” was sent to the Coast Guard D7CC at 0739. The position of a non-GPS-enabled EPIRB can, however, be determined to within about 2 miles by low earth orbit satellites, which travel about 1,200 miles above the earth. According to SARSAT, no low earth orbit satellites were in view of El Faro’s position during the 24 minutes the EPIRB was transmitting. The EPIRB stopped transmitting 6 minutes before a low earth orbit satellite passed in view of where the EPIRB had been transmitting. Therefore, no position could be derived from the low earth orbit satellite system. The ship’s EPIRB was designed to transmit a signal for 48 hours. Why its transmissions stopped after only 24 minutes is unknown. The position transmitted by a GPS-encoded EPIRB, available since 1998, is accurate to under 100 yards on the first transmission. Had El Faro been carrying that type of EPIRB, it is likely that a position would have been transmitted on activation. A previous accident investigated by the NTSB, the sinking of the commercial fishing vessel Lady Mary on March 24, 2009, which resulted in six fatalities, also involved a non-GPS-enabled EPIRB. The NTSB determined that the inability of the EPIRB to transmit position data following activation contributed to a delay in the dispatch of rescue assets. Accordingly, the NTSB recommended that the FCC mandate that, for commercial vessels required to carry 406-MHz EPIRBs, those EPIRBs broadcast vessel position data when activated (Safety Recommendation M-10-1). In September 2016, the FCC amended 47 CFR 80.1061(a) to require that EPIRBs meet Radio Technical Commission for Maritime Services standard 11000, which includes the capability of EPIRBs to provide position data on activation. This change implements the NTSB recommendation, but the new requirement does not come into effect for new EPIRBs until January 2018, and EPIRBs currently in service that do not meet the standard will be allowed to remain in service until January 2023. Thus, given the impact to the search-and-rescue efforts in the El Faro and Lady Mary accidents and the potential to affect future search-and-rescue operations, the NTSB concludes that the use of older EPIRBs such as the one on El Faro that do not transmit GPS positions reduces positional accuracy in search-and-rescue operations. Therefore, the NTSB recommends that the FCC require that all US vessels required to carry 406-MHz EPIRBs immediately discontinue the use of EPIRBs that are not GPS enabled. The probability of survival after a sinking depends on weather and sea conditions and the availability of lifesaving gear such as immersion suits and liferafts. However, the probability of survival decreases exponentially over time as the threat of hypothermia and drowning increases. Further, as time progresses, the search for and rescue of survivors becomes more difficult as those adrift in the seas may become separated because of winds and currents. The major debris fields for El Faro were separated by 77 nm, with immersion suits and a liferaft found between the two fields.

NTSB

Marine Accident Report

232 In another accident the NTSB investigated, the abandonment of the weather-damaged liftboat Trinity II in 2011, all 10 crewmembers successfully escaped the vessel and clung to a lifefloat, but they were not found until 3 days later (NTSB 2013a). The survivors were found about 150 miles northeast of the accident site, and four of the crewmembers died from the effects of exhaustion and hypothermia. This case demonstrates that early detection and rescue are critical to the chances of survival. The 406-MHz personal locator beacon is a portable unit that operates like an EPIRB. The device is designed to be carried by a person and is registered through NOAA to a person (not a vessel or aircraft). The personal locator beacon is activated manually and operates on 406 MHz to get an accuracy of within 3 miles using the 406-MHz satellite system. The device also has a low-power homing beacon that transmits on 121.5-MHz frequency. Newer models allow GPS input to the distress signal to achieve an accuracy of about 300 feet. Personal locator beacons are not required at sea, but several manufacturers offer marine models costing between $300 and $400. A personal locator beacon can be assigned to crewmembers by billet number while aboard a vessel in the same manner as other safety gear such as lifejackets and immersion suits. Three days after the sinking, on October 4, searchers spotted the remains of one El Faro crewmember in an immersion suit. It is not clear when the crewmember perished, or whether any other crewmembers were able to abandon ship. But had that crewmember, or any others who were able to evacuate, been equipped with a personal locator beacon, the device would have provided essential information to focus rescue efforts. Given the wide availability and relatively low cost of personal locator beacons, the NTSB concludes that providing all persons employed on board vessels in coastal, Great Lakes, and ocean service with personal locator beacons would enhance their chances of survival. Therefore, the NTSB recommends that the Coast Guard require that all personnel employed on vessels in coastal, Great Lakes, and ocean service be provided with a personal locator beacon to enhance their chances of survival. 2.10 Other Issues 2.10.1 VDRs The sound quality of El Faro’s VDR bridge audio recording was poor. Of the approximately 61,300 words in the VDR transcription, the audio transcription group detected 1,792 individual words that were unintelligible and unable to be transcribed, and the group could not unanimously agree on 827 other phrases or words. Table 13 shows that the recorded audio quality of all channels on board the bridge varied from poor to unusable. The transcript was prepared primarily from channels M1 and M2, because the other channels were either of unusable quality or inactive. Each channel of audio (M1, M2, and M3) recorded two microphone inputs. The two inputs were mixed into each channel in the VDR electronics cabinet on the bridge. The cabinet mixed the two microphones on each channel into a single mono track. Using a monaural channel to record two independent inputs does not allow for isolation of individual microphones during audio postprocessing. Because individual microphones cannot be isolated, poor performance or a “noisy” recording from a single microphone can cause irreparable damage to a recorded monaural audio channel. In this manner, a poorly performing

NTSB

Marine Accident Report

233 microphone or loud noises next to an individual microphone will cause the overall audio quality to be degraded across a monaural audio channel. If an introduced noise is present near one bridge-mounted unit, the audio from a different area of the ship’s bridge can become degraded or unusable. Table 13. Audio quality and channel description. Source Microphone Location Channel Quality BMU 1A; BMU 1B Bridge center; bridge starboard M1 Poor BMU 2A; BMU 2B Chart table; bridge port M2 Poor BMU 3A; BMU 3B Port bridge wing; starboard bridge wing M3 Unusable VHF 1 Unknown VHF source V4 Inactive AUD 4 N/A - Unused M5 Crossover For example, the placement of the bridge-mounted microphones in relation to other hardware on El Faro’s bridge affected the quality of the audio recording. Specifically, microphone BMU 2A, mounted near the chart table, repeatedly captured noise pollution from a metal curtain rail that hung in the area. The continual sound of metal chafing of the curtain rod hangers on the metal curtain track affected the audio transcription group’s ability to discern what was being said near that microphone during critical moments of the voyage. The chafing sound was initially correlated with crewmembers entering the chart table area and manipulating the curtain to gain access to the table. The chafing sound also correlated with the crew’s comments about El Faro rolling in rough seas during the voyage. As the weather deteriorated further, the nature of the metal chafing sound increased in frequency, duration, and intensity. During the final transcribed portion, the chafing sound persisted, and many crew conversations were drowned out by the sound of the metal curtain track. Thus, the NTSB concludes that the poor audio quality and poor placement of the VDR microphones aboard El Faro inadequately recorded conversations on the navigation bridge, which impeded investigators’ ability to accurately transcribe the recording. Microphone installations that record audio of poor or unusable quality restrict the ability of investigative authorities to review audible activity on the bridge. Performance testing of the bridge audio and downloads of related VDR data typically occur while a ship is pierside, not while it is under way using its main propulsion. Performing such a test pierside does not simulate realistic conditions on the ship’s bridge while under way. The current standard applicable to VDRs on new ships (since July 2014) states that a performance test of VDR microphones be such that “a normal speaking voice should provide adequate intelligibility while the ship is performing its normal operations.” According to IMO resolution MSC.333(90), 5.5.5:

NTSB

Marine Accident Report

234 Microphones should be positioned on the bridge covering all work stations as described in MSC/Circ. 982 so that conversation is recorded. The recording should be such that, on playback, a normal speaking voice should provide adequate intelligibility while the ship is performing its normal operations. This performance should be maintained at all work stations while there is a single audio alarm anywhere on the bridge or any noise, including noise from faulty equipment or mounting, or wind. This should be achieved through the use of at least two channels of audio recording. Microphones positioned outside on bridge wings should be recorded on at least one additional separate channel. Although IMO resolution MSC.333(90), 5.5.5, clearly identifies potential sources of noise pollution that could interfere with a VDR’s audio recording, the resolution does not define how performance testing should be conducted other than that it should be done during “normal operations.” The IMO does not define “normal operations.” However, it would be reasonable to expect that it would mean when a ship is under way using its main propulsion unit. Thus, the NTSB concludes that the most effective performance testing of VDR audio quality would take place while the ship is under way using its main source of propulsion. In addition, during the accident voyage, critical voice exchanges took place over the telephone between the officers on El Faro’s bridge and crewmembers in other locations on the ship. However, the IMO does not require a VDR to capture both sides of internal phone calls, and as designed, the VDR recorded only the bridge officers’ side of the conversations. As a result, investigators could not hear what personnel in the engine room were communicating to the bridge. Once El Faro encountered rough seas and began flooding and listing, the frequency of calls from other areas of the ship to the bridge increased, and the calls continued until the sinking. However, because only the bridge side of the phone conversations was recorded, the VDR missed potentially critical information concerning safety and the ship’s status that was exchanged between the bridge officers and the engineering crew. In phone calls to the bridge, the captain commonly responded “yeah” or “okay,” which left investigators with few details regarding the conversations. Thus, the NTSB concludes that El Faro’s VDR system was not configured or required to capture both sides of internal phone calls, which prevented investigators from hearing the engineering officers’ communications with the bridge. In addition, channel V4 for the VDR’s hardwired VHF was inactive. During the voyage, the ship’s VHF radio was used by the El Faro bridge crew; however, inactive VDR channel V4 did not record those VHF communications. Instead, investigators had to transcribe the VHF communications through ambient noise from an open speaker system recorded to VDR channels M1 and M2. Investigators found that VDR channel V4’s signal trace was a flat signal with minimal interference. The presence of the flat signal suggests that VDR channel 4 recorded an unpowered VHF radio signal. It is possible that the bridge crew used another VHF radio than the one being recorded by the VDR. Thus, the NTSB concludes that to ensure optimum sound quality for accident investigation, it is vital that all VHF radios used for ship operations be recorded by individual inputs on the ship’s VDR. During El Faro’s most recent VDR annual performance test (in December 2014), the battery on the acoustic locator beacon was still current. However, although the form the VDR

NTSB

Marine Accident Report

235 technician completed during the performance test indicated that the battery would expire that next spring (May 2015), the technician did not replace the battery. Moreover, no actions were taken to ensure that the battery was replaced later (before or by the expiration date). When investigators arrived at the site of the El Faro sinking on October 23, 2015, and began listening for the sound of the VDR locator beacon, they did not know that the battery had expired nearly 4 months earlier. Investigators had requested VDR service records from the manufacturer, Northrop Grumman Sperry Marine, which included the battery’s expiration date, but they did not receive the service records until November 12, 2015. After a few days on site with no sound detected from the locator beacon, it became clear that the wreck of El Faro would not be found by listening for the locator beacon. Instead, investigators deployed sidescan sonar to try to locate the wreck. VDR manufacturers are not required to demonstrate performance on expired locator beacons, and empirical data on the performance of such beacons are not available. Thus, the NTSB concludes that the annual performance test for El Faro’s VDR was inadequate because the technician did not replace the locator beacon’s battery even though it would expire before the next performance test. The NTSB further concludes that the postaccident recovery of El Faro’s VDR was greatly hampered because the battery had expired about 4 months before the sinking and the beacon was silent during the search. Therefore, the NTSB recommends that the Coast Guard modify guidance and training for marine inspectors to ensure that VDR annual performance tests include the replacement of locator beacons prior to expiration and that audio used to evaluate quality is recorded while a ship is under way using its main propulsion unit. The NTSB further recommends that the Coast Guard propose to the IMO to amend resolution MSC.333(90) to specify that “normal operations” are defined as when a ship is under way using its main propulsion unit and to assess VDR problems, including not capturing both sides of internal phone calls on the bridge electric telephone and unrecorded VHF communications, and identify steps to remedy them. 2.10.2 GMDSS Position Safety Alert—FELCOM The Furuno FELCOM 15 terminal that the El Faro bridge crew used to transmit the Inmarsat-C distress alert had an interface that did not automatically update the ship’s position report once crewmembers had manually entered a position at any time during the power cycle. About an hour before the sinking, in preparation to send a distress alert, the second mate entered the ship’s present GPS position. (Note that she entered the position incorrectly.) However, she did not send the distress alert until about 0713, when the captain approved her doing so. The software was not designed to ask a user whether the position entered earlier should be updated before sending a distress alert (the ship would have moved since the position was originally entered). Moreover, the software was not designed to detect and correct the second mate’s error in entering the ship’s position by sending the ship’s actual position. Thus, the NTSB concludes that the design of the GMDSS equipment used on El Faro allows erroneous ship positions to be sent in emergency alerts. The NTSB therefore recommends that Furuno Electric Company, Ltd., update its GMDSS software to detect and correct user errors when entering ship positions using GPS.

NTSB

Marine Accident Report

236 Moreover, Inmarsat-C records GPS positions in an ambiguous format allowing for misinterpretation of degrees and minutes as decimal degrees. In fact, recent investigations showed that because of such ambiguous formats, the Coast Guard misinterpreted the ship positions of both El Faro and the fish-processing vessel Alaska Juris (which sank in the Bering Sea in July 2016) in Inmarsat-C distress alerts (NTSB 2017a). Although the Coast Guard’s misinterpretation of the GPS positions for the El Faro distress alert did not play a role in the search-and-rescue effort, the NTSB is concerned that the originally reported ship position (even though it contained a GPS error entered by the second mate) was 23 nm away from the location where the Coast Guard subsequently interpreted the ship to be. 2.10.3 Ship Reporting of Weather Information Using AIS In situ collection and near real-time dissemination of meteorological and oceanographic data is vital to support global meteorological authorities who aim to produce the best possible weather forecasts and advisories to keep mariners safe. However, although surface-based data collection networks on land are geographically extensive and, in many cases, provide good temporal coverage, no such network exists over the world’s oceans, despite their covering 71 percent of the earth’s surface. Satellites retrieve valuable data from the ocean surface; however, there are limitations. For example, there are large areas of the world’s oceans from which meteorologists receive limited or no satellite weather data. Moreover, according to the National Weather Service’s Voluntary Observing Ship program―which recruits vessels to take, record, and disseminate weather observations at sea―satellite information is best when used together with other data sources. In addition, forecasting can be challenging and awareness of current conditions limited even when extensive technologies, such as satellite data, are available. Weather observations by ships could provide crucial, in situ weather information to mitigate such challenges. The Ocean Prediction Center (a division of the National Weather Service) gave a recent example of the upgrading of an existing gale warning to a hurricane warning based on one weather report from a ship that encountered 70-knot winds southeast of Newfoundland. Although that particular storm structure had initially looked impressive in satellite imagery, Ocean Prediction Center forecasters had not expected hurricane-force winds at that time of year. The in situ report from the one ship provided critical evidence to the contrary. Another recent example involved a ship that was traveling off the US East Coast when it encountered winds of more than 100 knots despite the weather forecast having predicted only 65-knot winds. Had the incident not occurred and the vessel’s VDR information not been retrieved, meteorologists might never have known that such severe weather conditions actually occurred that day. During the event, the bridge crew did not send manual, conventional weather reports because they were busy responding to the developing situation, and the ship’s AIS was not calibrated to automatically send weather reports. Nevertheless, other vessels in the region―especially those headed toward the storm―could have greatly benefited from such a real-time, in situ warning. According to the Joint World Meteorological Organization/Intergovernmental Oceanographic Commission Technical Commission for Oceanography and Marine Meteorology, only a fraction of the number of ships that could provide regular weather reports actually do so.

NTSB

Marine Accident Report

237 Globally, about 2,000 to 2,500 ships are considered active participants in weather reporting, and the reports may be as infrequent as every 6 months. Most of the ships provide manual, conventional reporting, which requires crewmembers to compile and report the data. The remainder use automated weather systems to provide weather reports; globally, only about 13 to 16 percent of ships use automated weather systems for weather reporting.202 Meteorologically, ships can provide critical ground truth for buoys and satellite data. In addition, weather observations from vessels can be assimilated into global weather models, which provide key guidance to all weather forecasters. According to the National Weather Service’s Environmental Modeling Center, the most important parameters that vessels can provide for weather modeling are barometric pressure and sea-surface temperature.203 Pressure is important in part because it yields information about the entire column of the atmosphere, and knowledge of sea-surface temperature is critical because the models must try to resolve the complex air–sea interaction that occurs over water. In addition, both air temperature and wave height information can be useful, particularly in regions with limited or biased satellite coverage (such as coastal areas and high latitudes). Vessels whose drafts are 10 meters (33 feet) or greater and that can be outfitted with water-temperature sensors down the submerged portion of their hull could also provide important water-temperature data below the sea surface. Also, according to the Environmental Modeling Center, observations from vessels are an important input for weather models because they provide data from locations that satellites might not cover for extended periods. Such a situation can occur, for example, when prolonged cloud coverage exists over a region, prohibiting satellite retrieval of sea-surface temperature. A 2003 paper in the Bulletin of the American Meteorological Society highlighted model performance issues with the forecasting of cyclones off the East Coast of the United States (Thiébaux et al. 2003). The paper identified that, during their development, cyclones are sensitive to sea-surface temperature and that persistent regional cloudiness can hamper satellite-only retrieval of sea-surface temperature. Further, ship reports of meteorological data can be beneficial in regions that can pose problems for space-based remote sensing (as within several kilometers of coastlines). Ships providing a continuous stream of real-time marine data would enhance both awareness of current conditions and forecasting or early-warning tools, benefiting not only the marine industry but also other public and private entities across the globe. In October 1998, the 282-foot-long schooner Fantome sank in the waters north of Honduras while encountering Hurricane Mitch. All 31 people on board were lost. At the time, Mitch was the strongest hurricane on record for the month of October and one of the deadliest Atlantic tropical cyclones in history.

202 The term automated weather systems in this report refers to onboard vessel systems that collect and automatically disseminate (without human involvement) weather information to external users. Automated weather systems allow more frequent observations (compared with manual observations); also, because the instrumentation is usually calibrated and more aptly quality-controlled at the source, data quality is overall good. Another positive aspect of automated weather systems is that most countries that implement the systems use standardized instrumentation or algorithms and are moving toward standard best practices on instrument standards globally. According to the National Weather Service, Europe is implementing autonomous (or stand-alone) automated weather systems, whereas the United States has not done so. In the United States, only vessels with integrated automated systems, or ships that have on-site, self-developed automated systems, contribute hourly reports. 203 This report defines sea surface as the top 20 centimeters of the ocean.

NTSB

Marine Accident Report

238 The National Hurricane Center’s poststorm report cited that even the most reliable weather models had a “persistent northwest bias” with regard to the storm’s forecast track (Guiney and Lawrence 1999). But instead, the storm moved westward and southward, and the predicted turn toward the northwest did not happen until after the hurricane moved across Honduras and Nicaragua. Limited local weather observations (such as lack of information about barometric pressure and humidity levels―data that ships could provide) contributed to the difficulty in forecasting for Mitch. The NTSB believes that the already widespread and mandatory use of AIS by vessels around the globe and the fact that AIS is already engineered to support the transfer of meteorological data via predefined messages (discussed further below) establishes AIS as a suitable means to report weather observations, in near real time, from ships at sea to global meteorological authorities and other vessels. AIS-equipped fleetwide dissemination of automated (and also manually obtained) meteorological and oceanographic data could ensure that global meteorological authorities have much-enhanced access to near real-time weather data at a high temporal resolution from an extensive global network of ships. As a National Hurricane Center branch chief stated during the El Faro marine board hearings, “No meteorologist would ever turn down more observations.” Thus, the NTSB concludes that increased reporting and improved transmission of meteorological and oceanographic data from vessels at sea would significantly improve the availability of vital information to enhance weather awareness, forecasting, and advisory services aimed at improving mariner safety. To make sure that the most significant benefits are realized, automated weather service on board AIS-equipped vessels must be able to communicate its data to the AIS system in a format that can be translated into a predefined AIS message. Currently, a commercially available off-the-shelf solution with a standard interface between weather equipment and existing AIS equipment is unavailable, primarily due to lack of a single preferred application-specific message (ASM) format for meteorological and oceanographic data. Further, consideration must be given to the quality of data currently provided by automated instrumentation on board vessels, for example, the proper placement and calibration of equipment to measure wind speeds and sea-surface temperatures. Whenever a ship is outfitted with such equipment, standards established by the International Organization for Standardization should be used. In addition, manual observations must be able to be entered into the system that can translate the information to AIS for dissemination via the proper predefined message. Because certain weather parameters that are useful to global meteorological authorities can be observed only by humans despite onboard instrumentation, the ability to manually report via AIS must be recognized; it is also important that mariners are able to augment automated reporting.204 From its inception, AIS was designed to adapt to future needs by establishing a robust framework to facilitate effective communications of short messages in standardized formats. Formats for ASM have been established to transmit, for example, virtual navigation aids, lock

204 The parameters observable only by humans include sea state (period and height), visibility, ice accretion, and cloud cover. The NTSB recognizes that human augmentation of high-frequency automated weather reporting would not be feasible; however, the ability to correct or supplement automated observations in AIS transmissions to alert recipients to suspect weather information (biases, instrument issues, etc.) is important.

NTSB

Marine Accident Report

239 orders, meteorological and oceanographic data, and more.205 IMO SN.1/Circ. 289 defines standard data formats for selected AIS ASM, recommended for broad international use. Included in SN.1/Circ. 289 are messages for “weather observation report from ship” and “WMO [World Meteorological Organization] weather observation report from ship,” which contain all parameters typically reported by voluntary observing ships. Benefits of using AIS ASM to automatically disseminate meteorological and oceanographic ship reports include reduced crew workload, reduced potential for error resulting from approximated times of observation and inaccurate position determination, and minimized operator costs.206 In fact, when the second mate on board El Faro prepared and sent a weather report the day before the sinking, she entered an incorrect vessel position.207 Automated weather reporting through AIS would eliminate such errors.208 Any proposed solution for improved weather reporting from vessels at sea by ASM should ensure timely inclusion of data from as many vessels as is practicable into the Global Telecommunication System and should consider adaptive scaling of weather report transmissions in areas of heavy AIS traffic (where fewer AIS slots may be available) to prevent system overload. Additionally, a single ASM format should be defined to ensure standardization for disseminating meteorological and oceanographic data from ships. Although AIS appears to be the most suitable technology for significantly improving the quantity of weather observations from vessels at sea, the NTSB is unaware of any trials that have been conducted with AIS to specifically establish the viability of transferring weather information via AIS predefined messages from vessels at sea, by way of land stations and space-borne satellites, to meteorological authorities in real time (or near real time). Such a trial could also establish what environmental parameters, formats, and metadata available from vessels are the most critical and could ensure that processing of such data by meteorological authorities after AIS relay is feasible. Thus, the NTSB concludes that because of the significant benefit that AIS could provide in improving the quantity of weather reports from ships globally, a “proof-of-concept” project is warranted to establish its viability. The NTSB therefore recommends that NOAA coordinate with the National Weather Service, vessel operators, AIS service providers, and required onboard technology vendors to perform a “proof-of-concept” project to establish whether AIS, or another suitable alternative, can practically deliver, in a single message (1) meteorological

205 The International Association of Marine Aids to Navigation and Lighthouse Authorities maintains a list of all existing ASM. See www.iala-aism.org/asm. 206 Once installed, a functioning AIS requires no additional expense to transmit or receive AIS communications. As it currently exists in the Voluntary Observing Ship program, the primary financial burden for introducing weather observations from vessels at sea to the Global Telecommunication System would be the responsibility of the meteorological authorities that seek to include more data. The Global Telecommunication System is part of the World Weather Watch, which collects and distributes meteorological information worldwide. 207 The second mate appeared aware of the importance of weather reporting from ships. At 1355 the day before the accident, she stated, “ . . . (when we’re) going through this storm (they’d) probably like to have weather reports . . . don’t know if they’ll have any other ships reporting (although) I don’t know if any other ships are going right into it like we are.” 208 The incorrect vessel position rendered the weather report from El Faro essentially unusable. However, a recipient of the report (for example, a National Weather Service forecaster) could identify the specific vessel by the report and then locate its position in real time using the AIS broadcast.

NTSB

Marine Accident Report

240 and oceanographic data obtained directly from automated instrumentation and manual observation on board vessels at sea, (2) vessel position and time of observation, and (3) other important metadata, by satellite and land-based receivers, to global meteorological authorities via the Global Telecommunication System with acceptable time delay. The NTSB understands that the IMO may be reluctant to establish new mandates on ship reporting of weather that could cause vessel operators additional burden and workload. However, vessels at sea provide such an important platform for retrieving data that effort should be made to increase global participation in weather reporting. Thus, the NTSB concludes that if the “proof-of-concept” project recommended above establishes that AIS can deliver, in a single message, (1) meteorological and oceanographic data obtained directly from both automated instrumentation and humans on board vessels at sea, (2) vessel position and time of observation, and (3) other important metadata, via satellite and land-based receivers, to global meteorological authorities via the Global Telecommunications System with acceptable time delay, AIS must be used immediately to improve the quantity of ship weather reports across the globe. Therefore, the NTSB recommends that, if the actions recommended to NOAA in Safety Recommendation M-17-52 establish that AIS is a viable means by which to relay (with acceptable time delay) meteorological and oceanographic data and metadata from vessels at sea for use by global meteorological authorities, the Coast Guard propose to the IMO that vessels required to use AIS also be equipped with meteorological and oceanographic sensors―including, at a minimum, sensors for barometric pressure and sea-surface temperature―that will automatically disseminate the data at high-temporal resolution via AIS. The NTSB also recommends that the Coast Guard propose to the IMO that vessels under SOLAS regulations that are not already automatically disseminating meteorological and oceanographic data by other means be required to manually disseminate such data while at sea via AIS or the Voluntary Observing Ship program at the times of 0000 UTC, 0600 UTC, 1200 UTC, and 1800 UTC. Since implementation of AIS, usage has expanded significantly.209 With a limited number of slots available per minute and certain messages occupying multiple slots, system overload is a concern. Increased usage of AIS, including ASM, will eventually affect standard AIS ship-to-ship communications. The International Telecommunications Union (ITU), in coordination with the International Association of Marine Aids to Navigation and Lighthouse Authorities, the IMO, and providers of AIS equipment and service, has already acted to mitigate the problem by assigning two separate frequencies in the VHF maritime mobile band for the transmission of AIS ASM. Moving ASM transmissions to dedicated ASM channels will improve the efficiency of ASM transmissions and protect the original functions of AIS, including collision avoidance, and is included as part of international standards commonly referred to as the VHF data exchange system (VDES). One challenge to these efforts is global acceptance of the allocation of frequencies for VDES transmissions. Although some countries have adopted the new standard, the United States has yet to reserve the specific radio frequencies for this purpose. In the United States, the specific VDES ASM frequencies are within a band that is currently commercially licensed for other use by the FCC. The license expires in 2018.

209 In addition to mandatory AIS installations, commercial and recreational ships may install AIS transponders.

NTSB

Marine Accident Report

241 Thus, the NTSB concludes that expanding AIS message transmission capabilities to provide mariners with timely access to a variety of navigational, weather, and marine safety information by establishing new channels for VDES is a prudent international effort. Therefore, the NTSB recommends that the FCC reserve the designated ASM frequencies for VDES use in US territories, as identified in ITU recommendation ITU-R M.2092-0, and consistent with international efforts.

NTSB

Marine Accident Report

242 3 Conclusions 3.1 Findings 1. The mechanical condition or operation of El Faro’s boilers, steering, electrical power, and machinery were not factors in the accident. 2. The work being performed by the riding gang of foreign nationals did not contribute to the sinking of El Faro. 3. Neither improper securement of the trailers and containers nor inadequate maintenance of the vessel’s cargo-securing gear contributed to the vessel’s initial list. 4. Cargo shifting was not a major factor in the vessel’s initial list. 5. The medical fitness of the El Faro crew and any prescription medication use by the crew were most likely not factors in the accident. 6. The captain’s decision to depart Jacksonville was reasonable considering the availability of options to avoid Tropical Storm/Hurricane Joaquin. 7. There is no evidence that the vessel suffered a hull break or other significant structural failure while on the ocean surface that was a factor in the accident. 8. A rogue wave was not a factor in the sinking of El Faro. 9. The initial list was caused by an increasing wind on the vessel’s beam generated by Hurricane Joaquin. 10. The port list, coupled with the vessel’s motion, most likely caused air to enter the bellmouth of the suction pipe to the lube oil service pump, which resulted in a loss of oil pressure that caused the main engine to shut down. 11. The level of lube oil in the main engine sump was not maintained in accordance with the vessel’s operations manual, which increased the propulsion system’s susceptibility to loss of oil pressure. 12. If the company had provided guidance to the engineers about the list-induced operational limitations of the engine as well as about raising the level of lube oil in the main engine sump before or during heavy weather, the additional quantity of oil in the sump would have kept the suction pipe submerged at greater angles of inclination and increased the likelihood of maintaining propulsion. 13. Increasing the minimum athwartships angle of inclination requirements for both static and dynamic conditions would provide an additional margin of safety for vessels exposed to high winds and large sea states. 14. The crew was most likely unaware of the operational limitations on the main engine from a sustained excessive list.

NTSB

Marine Accident Report

243 15. If the ship’s officers had known the maximum static list angle at which the main propulsion engine would operate, they would most likely have attempted to reduce the initial list sooner and possibly avoided the loss of propulsion. 16. A watertight scuttle to cargo hold 3 on the second deck was open, allowing the unintended ingress of water and violating the ship’s watertight envelope. 17. If the second deck access hatch (scuttle) had been fitted with a remote open/close indicator at a manned location, such as the bridge, the crew would have known that the watertight hatch to cargo hold 3 was open. 18. Because the automobile-lashing arrangement on El Faro did not meet the requirements of the vessel’s approved cargo-securing manual, automobiles were more likely to shift from vessel motion in heavy weather. 19. The introduction of water to cargo hold 3, combined with the vessel’s motion, led to failure of some lashings and automobiles becoming unsecured. 20. It is likely that the seawater piping below the waterline to the vessel’s emergency fire pump in cargo hold 3 was inadequately protected from impact and was struck by one or more cars that had broken free of their lashings. 21. Impact damage to the seawater piping below the waterline to the emergency fire pump in cargo hold 3 most likely led to flooding in the hold, which significantly compromised the vessel’s stability. 22. The rate of flooding in cargo hold 3 exceeded the design capacity of the bilge pumps and therefore did not lower the water level in the hold, despite continued pumping during the accident sequence. 23. Crewmembers in the engine room were most likely alerted to water in cargo hold 3 by the installed bilge alarm system. 24. New cargo vessels should be equipped with, and existing cargo vessels should be retrofitted with, bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. 25. All the watertight and weathertight ventilation closures to the cargo holds most likely remained open throughout the sinking sequence. 26. Vessels should not have operational requirements to maintain weathertight or watertight ventilator closures in an open position when the same closures are treated as closed when the vessel’s stability and load line are assessed. 27. Had the vessel’s stability booklet or CargoMax software identified the vessel’s downflooding points, the ship’s officers might have closed the cargo hold ventilation openings. 28. About 40 minutes before the sinking, seawater most likely entered the ventilation ducting to several main cargo holds, exacerbating the flooding already under way in cargo hold 3 and accelerating the sinking.

NTSB

Marine Accident Report

244 29. If a damage control plan had been available and the crew trained in its use, the crew would have been better able to promptly plan for and address the flooding scenario encountered during the casualty. 30. Existing cargo vessels should have the same damage control plans and booklets as are required for newly built vessels to assist crews in damage and flooding situations. 31. Approval by a classification society of damage control plans and booklets would provide an independent check to ensure uniformity and compliance with requirements. 32. A damage control plan and booklet would have helped the captain of El Faro assess the flooding situation. 33. The damage stability module in the CargoMax software on El Faro could have provided timely vessel stability information to the officers for the damage conditions the vessel experienced. 34. The original passage plan’s straight-line course at departure from Jacksonville would lead directly into the storm’s predicted path. 35. Although there is no direct evidence that the company applied pressure regarding the vessel’s schedule, inherent pressure could have influenced the captain’s decision to continue on despite the weather. 36. El Faro was receiving sufficient weather information for the captain’s decision-making regarding the vessel’s route. 37. Although up-to-date weather information was available on the ship, the El Faro captain did not use the most current weather information for decision-making. 38. Had the deck officers more assertively stated their concerns, in accordance with effective bridge resource management principles, the captain’s situation awareness might have been improved. 39. The captain should have returned to the bridge after the second and third mates called him to gain a better awareness of the changing weather situation. 40. The captain did not take sufficient action to avoid Hurricane Joaquin, thereby putting El Faro and its crew in peril. 41. By failing to adequately consider the suggestions of the ship’s junior officers to alter the passage plan and failing to alter his decision to proceed, the captain endangered El Faro and its crew. 42. The concepts of bridge resource management were not implemented on board El Faro. 43. The company’s failure to ensure the implementation of bridge resource management contributed to the sinking. 44. The company’s safety management system was inadequate and did not provide the officers and crew with the necessary procedures to ensure safe passage, watertight integrity, heavy-weather preparations, and emergency response during heavy-weather conditions. 45. The company did not have an effective process for evaluating the performance of its officers.

NTSB

Marine Accident Report

245 46. The company did not have an effective training program for the use of the CargoMax stability instrument, including its damage stability module. 47. Training in heavy-weather operations, including advanced meteorology and advanced shiphandling, from which the captain was exempt, might have provided him with additional information to consider while evaluating options and might have resulted in a different course of action. 48. The company did not have an effective officer training program for the use of the ship’s Bon Voyage System weather information software. 49. The company did not ensure that El Faro had a properly functioning anemometer, which deprived the captain of a vital tool for understanding his ship’s position relative to the storm. 50. The company subscribed to the Rapid Response Damage Assessment service, although not required, but did not train the crew in its use. 51. The company did not monitor the position of El Faro relative to the storm and did not provide the captain with support for storm avoidance and heavy-weather preparations during the accident voyage. 52. The company failed to assess the risk posed by Hurricane Joaquin to El Faro. 53. The company’s lack of oversight in critical aspects of safety management, including gaps in training for shipboard operations in severe weather, denoted a weak safety culture in the company and contributed to the sinking of El Faro. 54. El Faro’s stability booklet should have included downflooding angles and windheel criteria to increase the officers’ awareness of the ship’s vulnerabilities in heavy weather, such as unintentional flooding and listing. 55. Neither the Coast Guard nor the classification society adequately assessed the vessel’s stability booklet to ensure that it contained critical information detailed in Coast Guard regulations and guidance. 56. Coast Guard Navigation and Inspection Circular 4-77 (Shifting Weights or Counter Flooding During Emergency Situations) should be revised to include specific guidance regarding the dangers of taking corrective action if roll-on/roll-off cargo is adrift or the decks are wet. 57. The Coast Guard’s Alternate Compliance Program is not effective in ensuring that vessels meet the safety standards required by regulations, and many vessels enrolled in the program are likely to be operating in substandard condition. 58. The 2005–2006 conversion of El Faro to carry load-on/load-off containers and the associated increase in draft should have been designated a major conversion by the Coast Guard. 59. For inspected vessels in coastal, Great Lakes, or ocean service, having their lifesaving appliances regularly reviewed for compliance with current standards would improve crew survivability.

NTSB

Marine Accident Report

246 60. The captain’s decision to muster the crew and abandon ship was late and may have reduced the crew’s chances of survival. 61. The severe weather, combined with El Faro’s list, made it unlikely that the lifeboats could be boarded or launched. 62. The vessel’s open lifeboats would not have provided adequate protection even if they had been launched. 63. Survivability would be increased if open lifeboats on all vessels remaining in service were replaced with enclosed lifeboats that adhered to the latest safety standards. 64. Survivability would be increased if new cargo vessels were equipped with stern-launched freefall lifeboats, where practical. 65. The severe weather, combined with El Faro’s list, made it unlikely that the liferafts could be launched manually or boarded by crewmembers once in the water. 66. Search-and-rescue efforts were carried out as effectively as possible given the extreme weather conditions in the days following the accident. 67. Because of differences in latitude and longitude formatting between Inmarsat-C and the Coast Guard’s search-and-rescue optimal planning system (SAROPS), the last known position of El Faro according to SAROPS was 23 nautical miles from the actual position. 68. Although position errors did not affect the outcome of search-and-rescue efforts after El Faro sank, position information should adhere to a standardized format to eliminate similar errors in future accidents. 69. The use of older emergency position-indicating radio beacons such as the one on El Faro that do not transmit global positioning system positions reduces positional accuracy in search-and-rescue operations. 70. Providing all persons employed on board vessels in coastal, Great Lakes, and ocean service with personal locator beacons would enhance their chances of survival. 71. The poor audio quality and poor placement of the voyage data recorder microphones aboard El Faro inadequately recorded conversations on the navigation bridge, which impeded investigators’ ability to accurately transcribe the recording. 72. The most effective performance testing of voyage data recorder audio quality would take place while the ship is under way using its main source of propulsion. 73. El Faro’s voyage data recorder system was not configured or required to capture both sides of internal phone calls, which prevented investigators from hearing the engineering officers’ communications with the bridge. 74. To ensure optimum sound quality for accident investigation, it is vital that all very-high-frequency radios used for ship operations be recorded by individual inputs on the ship’s voyage data recorder. 75. The annual performance test for El Faro’s voyage data recorder was inadequate because the technician did not replace the locator beacon’s battery even though it would expire before the next performance test.

NTSB

Marine Accident Report

247 76. The postaccident recovery of El Faro’s voyage data recorder was greatly hampered because the battery had expired about 4 months before the sinking and the beacon was silent during the search. 77. The design of the Global Maritime Distress and Safety System equipment used on El Faro allows erroneous ship positions to be sent in emergency alerts. 78. Increased reporting and improved transmission of meteorological and oceanographic data from vessels at sea would significantly improve the availability of vital information to enhance weather awareness, forecasting, and advisory services aimed at improving mariner safety. 79. Because of the significant benefit that the automatic identification system could provide in improving the quantity of weather reports from ships globally, a “proof-of-concept” project is warranted to establish its viability. 80. If the “proof-of-concept” project recommended in this report establishes that the automatic identification system (AIS) can deliver, in a single message, (1) meteorological and oceanographic data obtained directly from both automated instrumentation and humans on board vessels at sea, (2) vessel position and time of observation, and (3) other important metadata, via satellite and land-based receivers, to global meteorological authorities via the Global Telecommunications System with acceptable time delay, AIS must be used immediately to improve the quantity of ship weather reports across the globe. 81. Expanding automatic identification system message transmission capabilities to provide mariners with timely access to a variety of navigational, weather, and marine safety information by establishing new channels for the very-high-frequency data exchange system is a prudent international effort. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the sinking of El Faro and the subsequent loss of life was the captain’s insufficient action to avoid Hurricane Joaquin, his failure to use the most current weather information, and his late decision to muster the crew. Contributing to the sinking was ineffective bridge resource management on board El Faro, which included the captain’s failure to adequately consider officers’ suggestions. Also contributing to the sinking was the inadequacy of both TOTE’s oversight and its safety management system. Further contributing factors to the loss of El Faro were flooding in a cargo hold from an undetected open watertight scuttle and damaged seawater piping; loss of propulsion due to low lube oil pressure to the main engine resulting from a sustained list; and subsequent downflooding through unsecured ventilation closures to the cargo holds. Also contributing to the loss of the vessel was the lack of an approved damage control plan that would have assisted the crew in recognizing the severity of the vessel’s condition and in responding to the emergency. Contributing to the loss of life was the lack of appropriate survival craft for the conditions.

NTSB

Marine Accident Report

248 4 Recommendations As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations. To the US Coast Guard: Revise regulations to increase the minimum required propulsion and critical athwartships machinery angles of inclination. Concurrently, requirements for lifeboat launching angles should be increased above new machinery angles to provide a margin of safety for abandoning ship after machinery failure. (M-17-21) Propose to the International Maritime Organization that design maximum operating angles of inclination for main propulsion and other critical machinery be included in damage control documents, stability instruments and booklets, and in the safety management systems for all applicable vessels. (M-17-22) Propose to the International Maritime Organization that all watertight access doors and access hatch covers normally closed at sea be provided with open/close indicators both on the bridge and locally. (M-17-23) Propose to the International Maritime Organization that on new and existing vessels, seawater supply piping below the waterline in all cargo holds be protected from impact. (M-17-24) Propose to the International Maritime Organization to require that new cargo vessels be equipped with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. (M-17-25) Propose to the International Maritime Organization to require that existing cargo vessels be retrofitted with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. (M-17-26) Propose to the International Maritime Organization that any opening that must normally be kept open for the effective operation of the ship must also be considered a downflooding point, both in intact and damage stability regulations and in load line regulations under the International Convention on Load Lines. (M-17-27)

NTSB

Marine Accident Report

249 Require that information regarding openings that could lead to downflooding be included in damage control documents, stability instruments and booklets, and safety management systems for vessels subject to the intact stability criteria of Title 46 Code of Federal Regulations 170.170, regardless of the designation or treatment of such openings in intact stability calculations. (M-17-28) Propose to the International Maritime Organization that existing cargo vessels operating under the International Convention for the Safety of Life at Sea be required to have damage control plans and booklets on board that meet current standards. (M-17-29) Propose to the International Maritime Organization that damage control plans and booklets required by the International Convention for the Safety of Life at Sea be class-approved. (M-17-30) Publish policy guidance to approved maritime training schools offering bridge resource management courses to promote a cohesive team environment and improve the decision-making process, and specifically include navigational and storm-avoidance scenarios. (M-17-31) Require recurring bridge resource management training for all deck officers when renewing their credentials. (M-17-32) Require that all deck officers, at both operational and management levels, take a Coast Guard–approved advanced meteorology course to close the gap for mariners initially credentialed before 1998. (M-17-33) Publish policy guidance to approved maritime training schools offering management-level training in advanced meteorology, or in an appropriate course, to ensure that the curriculum includes the following topics: characteristics of weather systems including tropical revolving storms; advanced meteorological concepts; importance of sending weather observations; ship maneuvering using advanced simulators in heavy weather; heavy-weather preparations; use of technology to transmit and receive weather forecasts (such as navigational telex or weather-routing providers); ship-routing services (capabilities and limitations); and launching of lifeboats and liferafts in heavy weather. (M-17-34) Provide policy guidance to approved maritime training schools offering operational-level training in meteorology to ensure that the curriculum includes the following topics: characteristics of weather systems, weather charting and reporting, importance of sending weather observations, sources of weather information, and interpreting weather forecast products. (M-17-35)

NTSB

Marine Accident Report

250 Require that vessels in ocean service (500 gross tons or over) be equipped with properly operating meteorological instruments, including functioning barometers, barographs, and anemometers. (M-17-36) Revise Title 46 Code of Federal Regulations 170.110 (stability booklet) to require (1) stability instructions, guidance, or data on wind velocity used to calculate weather criteria; (2) list of closures that must be made to prevent unintentional flooding; (3) list of closures that must be made for an opening not to be considered a downflooding point; and (4) righting arm curve (metacentric height) table to note the angle at which initial downflooding occurs; also, add a windheel table for vessel full load displacement or the condition of greatest vulnerability to windheel. (M-17-37) Update the guidance in Navigation and Inspection Circular 4-77 (Shifting Weights or Counter Flooding During Emergency Situations), based on the circumstances of the El Faro accident, to include a warning that actions by ship personnel intended to correct a list can produce dangerous results if roll-on/roll-off cargo is already adrift and water has reduced the coefficients of friction for lashed cargo. (M-17-38) Conduct a complete review of the Alternate Compliance Program to assess the adequacy and effectiveness of the program. (M-17-39) Review and implement training of Coast Guard inspectors and accredited classification society surveyors to ensure that they are properly qualified and supported to perform effective, accurate, and transparent vessel inspections, meeting all statutory and regulatory requirements. (M-17-40) Review and revise the policy for major conversion determinations to consider load line (maximum) draft as a principal vessel dimension. (M-17-41) At regular intervals, not to exceed 20 years, review all lifesaving appliances on inspected vessels that are required by Title 46 Code of Federal Regulations Part 199, and require compliance with current standards. (M-17-42) Require that open lifeboats on all US-inspected vessels be replaced with enclosed lifeboats that meet current regulatory standards and freefall lifeboats, where practicable. (M-17-43) To prevent future errors in converting position data such as occurred in the El Faro accident, work with manufacturers of Global Maritime Distress and Safety System equipment, communication providers, and land earth stations to remove ambiguity from the Inmarsat-C distress alert position reports. (M-17-44)

NTSB

Marine Accident Report

251 Require that all personnel employed on vessels in coastal, Great Lakes, and ocean service be provided with a personal locator beacon to enhance their chances of survival. (M-17-45) Modify guidance and training for marine inspectors to ensure that voyage data recorder annual performance tests include the replacement of locator beacons prior to expiration and that audio used to evaluate quality is recorded while a ship is under way using its main propulsion unit. (M-17-46) Propose to the International Maritime Organization to amend resolution MSC.333(90) to specify that “normal operations” are defined as when a ship is under way using its main propulsion unit and to assess voyage data recorder problems, including not capturing both sides of internal phone calls on the bridge electric telephone and unrecorded very-high-frequency communications, and identify steps to remedy them. (M-17-47) If the actions recommended to the National Oceanic and Atmospheric Administration in Safety Recommendation M-17-52 establish that the automatic identification system (AIS) is a viable means by which to relay (with acceptable time delay) meteorological and oceanographic data and metadata from vessels at sea for use by global meteorological authorities, propose to the International Maritime Organization that vessels required to use AIS also be equipped with meteorological and oceanographic sensors―including, at a minimum, sensors for barometric pressure and sea-surface temperature―that will automatically disseminate the data at high-temporal resolution via AIS. (M-17-48) Propose to the International Maritime Organization that vessels under regulations of the International Convention for the Safety of Life at Sea that are not already automatically disseminating meteorological and oceanographic data by other means be required to manually disseminate such data while at sea via the automatic identification system or the Voluntary Observing Ship program at the times of 0000 coordinated universal time (UTC), 0600 UTC, 1200 UTC, and 1800 UTC. (M-17-49) To the Federal Communications Commission: Require that all US vessels required to carry 406-megahertz emergency position- indicating radio beacons (EPIRBs) immediately discontinue the use of EPIRBs that are not global positioning system enabled. (M-17-50) Reserve the designated application-specific message frequencies for very-high- frequency data exchange system use in US territories, as identified in International Telecommunications Union (ITU) recommendation ITU-R M.2092-0, and consistent with international efforts. (M-17-51)

NTSB

Marine Accident Report

252 To the National Oceanic and Atmospheric Administration: Coordinate with the National Weather Service, vessel operators, automatic identification system (AIS) service providers, and required onboard technology vendors to perform a “proof-of-concept” project to establish whether AIS, or another suitable alternative, can practically deliver, in a single message, (1) meteorological and oceanographic data obtained directly from automated instrumentation and manual observation on board vessels at sea, (2) vessel position and time of observation, and (3) other important metadata, by satellite and land-based receivers, to global meteorological authorities via the Global Telecommunication System with acceptable time delay. (M-17-52) To the International Association of Classification Societies: Recommend to your members to increase the minimum required propulsion and critical athwartships machinery angles of inclination. Concurrently, requirements for lifeboat launching angles should be increased above new machinery angles to provide a margin of safety for abandoning ship after machinery failure. (M-17-53) Recommend to your members to require that design maximum operating angles of inclination for main propulsion and other critical machinery be included in damage control documents, stability instruments and booklets, and in the safety management systems for all applicable vessels. (M-17-54) Recommend to your members to require that all watertight access doors and access hatch covers normally closed at sea be provided with open/close indicators both on the bridge and locally. (M-17-55) Recommend to your members to require that on new and existing vessels, seawater supply piping below the waterline in all cargo holds be protected from impact. (M-17-56) Recommend to your members to require that new cargo vessels be equipped with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. (M-17-57) Recommend to your members to require that existing cargo vessels be retrofitted with bilge high-level alarms in all cargo holds that send audible and visible indication to a manned location. (M-17-58) Recommend to your members that any opening that must normally be kept open for the effective operation of the ship must also be considered a downflooding point, both in intact and damage stability regulations and in load line regulations under the International Convention on Load Lines. (M-17-59)

NTSB

Marine Accident Report

253 Recommend to your members that existing cargo vessels be required to have damage control plans and booklets on board that meet current standards. (M-17-60) Recommend that your members require that damage control plans and booklets required by the International Convention for the Safety of Life at Sea be class-approved. (M-17-61) To the American Bureau of Shipping: Enhance training of your surveyors to ensure that they are properly qualified and supported to perform effective, accurate, and transparent vessel surveys, meeting all statutory and regulatory requirements. (M-17-62) To Furuno Electric Company, Ltd.: Update your Global Maritime Distress and Safety System software to detect and correct user errors when entering ship positions using the global positioning system. (M-17-63) To TOTE Services, Inc.: Establish standard operating procedures for heavy weather that address operational limitations and oil levels in critical machinery to ensure their continued operation. (M-17-64) Establish procedures for opening, closing, and logging all closures that make up a vessel’s watertight envelope while the vessel is at sea. (M-17-65) Ensure that damage control plans and booklets are aboard all your load-lined vessels and that officers and crewmembers are trained in their use. (M-17-66) Require senior officers to receive formal training approved by the manufacturer in all functions found in installed stability programs, including damage stability modules. (M-17-67) Revise your safety management system and bridge resource management programs to contain detailed polices, instructions, procedures, and checklists to mitigate the risks of severe weather to your vessels. (M-17-68) Conduct an external audit, independent of your organization or class society, of your entire safety management system to ensure compliance with the International Safety Management code and correct noted deficiencies. (M-17-69)

NTSB

Marine Accident Report

254 Require your vessels to be equipped with properly operating meteorological instruments, including functioning barometers, barographs, and anemometers. (M-17-70) Institute a formal company process to provide independent weather routing, passage-planning assistance, and vessel position monitoring. (M-17-71) Provide formal and recurrent training to your deck officers on the public and commercial weather information systems provided on board each vessel to ensure that the officers are fully knowledgeable about all weather information sources at their disposal and understand the time delays in the information provided. (M-17-72) Provide shoreside management and vessel senior personnel with training in the Rapid Response Damage Assessment program and standard operating procedures, to include requirements to conduct annual drills and submit departure stability conditions for each vessel on each voyage. (M-17-73)

NTSB

Marine Accident Report

255

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member CHRISTOPHER A. HART T. BELLA DINH-ZARR Member Member

Adopted: December 12, 2017

NTSB

Marine Accident Report

256 Board Member Statements Chairman Robert L. Sumwalt, III, filed the following concurring statement on December 19, 2017. The Spanish words El Faro mean “the lighthouse” in English. I am confident that the safety recommendations that stemmed from the investigation of the SS El Faro sinking can serve as a beacon to guide present and future generations of mariners. The Board unanimously adopted a probable cause statement that stated, in part, “contributing to the sinking was ineffective bridge resource management on board El Faro, which included the captain’s failure to adequately consider the officer’s suggestions.” This statement shines light on an area I feel can help ensure voyage safety by increasing the effectiveness of bridge resource management (BRM). BRM grew from aviation’s crew resource management (CRM), which came about from a series of aviation disasters in which crewmembers didn’t adequately relay their concerns to the captain. Through effective CRM courses, aviation employees of all ranks—including first officers, flight attendants, maintenance technicians, and dispatchers—now feel empowered to clearly state concerns to the captain to ensure the captain has information he/she needs to ensure safety of flight. Likewise, an objective of BRM is to ensure those in command have accurate, unfiltered information that could affect safety. In that light, as stated in the El Faro report, “As an element of BRM, officers have a duty to speak up if they believe the vessel is at risk. From their statements on the VDR, the mates were clearly concerned about their safety and that of the rest of the crew.” The report also states, “BRM stresses assertiveness.” Despite the crewmembers’ concerns, and despite BRM stressing assertiveness, the crewmembers’ speech lacked assertiveness when they called the captain (on a total of three occasions) to notify him that their planned route would pass extremely close to the hurricane’s projected path. There is no doubt that the final responsibility for the operation of the vessel falls squarely upon the captain. However, in order for the captain to make informed decisions, he/she must have an accurate perception of the current and future state of his/her vessel. In this case, the captain seemingly had no situational awareness regarding the storm’s location relative to the ship’s planned course. Absent his coming to this realization himself, the only way to increase his awareness of the perilous situation facing his ship would be for crewmembers to clearly, and in unambiguous terms, state their concerns and then agree upon an acceptable plan to ensure safety. Therefore, in a 3 to 1 vote, the Board adopted a finding that stated: “Had the deck officers more assertively stated their concerns, in accordance with effective bridge resource management principles, the captain’s situation awareness might have been improved.” Communication is a two-way street; if someone isn’t getting the message, the person attempting to communicate must alter his/her communication style to ensure the message is truly understood and addressed.

NTSB

Marine Accident Report

257 This report will be studied by mariners, young and old, for many, many years. It is critical that we point out how important it is for all crewmembers to voice concerns and achieve agreement on a suitable solution. It would be easy to take from this tragedy that the captain just didn’t listen to his crew. While that may be a true statement, the message should be that “although the captain didn’t take action upon the crewmembers’ concerns, the mates were not assertive enough to make their concerns clearly known to effect a safer course of action.” CRM has taught, and BRM is intended to teach, when someone is not comfortable, they have an obligation to speak up. The purpose of BRM is not, nor is it the intention of this concurring statement or this accident report, to encourage “command by committee.” Rather, a guiding light of BRM is that senior officers should establish an environment where all crewmembers feel comfortable voicing concerns, and where senior officers encourage and welcome such input. But an equally important facet of BRM is to ensure that crewmembers know how to be assertive enough to convey their concerns to senior officers, and then achieve agreement on a suitable solution.

Member Earl F. Weener joined in this statement.

NTSB

Marine Accident Report

258 Member T. Bella Dinh-Zarr filed the following concurring and dissenting statement on December 18, 2017. As I stated on scene and during the board meeting, I extend my deepest condolences to the families and friends of the crew of El Faro. I assure you that from that first day I had the privilege of meeting many of you in Jacksonville, our NTSB investigative team has worked tirelessly to provide answers and to craft this report in hope that no other maritime families will have to endure what you have endured. I applaud and thank the NTSB staff for completing a thoughtful, evidence-based report. I wholeheartedly concur with the work of the NTSB staff on this report. However, I do not agree with the amendment about adding the mates’ lack of assertiveness as a finding to the report. Therefore, I dissent to the addition of Finding 38 regarding the actions of the mates and the potential effect those actions might have had on the master/captain (an amendment made during the board meeting). Seafaring has existed for thousands of years. The term and position of a professional master has existed for centuries. In the maritime profession, much like in the military profession, a power differential exists that is necessary to maintaining good order and discipline. This power differential has existed for hundreds, if not thousands of years—so in that respect, the power differential is not comparable to that of a pilot and copilot in aviation—an industry which is just over 100 years old. As a master, you oversee a floating city. The ship has its business, its bridge, its engine, its living quarters, its mess hall, and, yes, its brig. The master must balance maintaining discipline and command of the ship with creating an environment where his/her crew will speak up during times of concern. In this respect too, it is far more comparable to the military than to the other modes of transportation we see here at the NTSB. We must be cognizant of those key differences when we talk about bridge communications. We cannot take a one-size-fits-all approach to the modes. While crew resource management (CRM) has helped improve aviation safety and bridge resource management (BRM) has important lessons to learn from CRM, there must be adjustments to accommodate the differences that exist in different modes to be truly effective. BRM in maritime is important—it is important for the crew to communicate and work as a team. However, in this case, the mates “challenging” the master during a storm is more akin to the lieutenant challenging the general’s orders on the battlefield—there is a proper way to do it given the necessary power differential. While I understand, in BRM, there are certain phrases that crew can be trained to say to better or more clearly communicate the urgency of a message. I would note, in the maritime world, a single call to the captain’s quarters in the middle of the night is the equivalent of these phrases. In response to my question in the board meeting as to whether it was unusual that the captain did not return to the bridge prior to 0400, an NTSB investigator and former master of El Faro (when it was named the Northern Lights) stated, “Pretty much industry standard would be if a junior officer, a third mate or second mate, calls and expresses concern, the master would be up on the bridge to address that concern.”

NTSB

Marine Accident Report

259 I am not, in any way, implying that training in BRM is not necessary, but I think we also cannot ignore hundreds of years of seafaring history or minimize the importance and courage of the El Faro mates in making these middle-of-the-night calls to the captain. Therefore, I dissent on adding the mates’ (or deck officers’, as the term “mate” was changed to “deck officer” in this finding) assertiveness as a finding in this report. At sea, it is an unusual circumstance for a mate to call the captain during the evening in his stateroom once, let alone on three different occasions. All the mates aboard El Faro were more than competent and qualified to perform their duties. The third mate and his helmsman had a specific conversation discussing challenges to authority. The third mate stated he did not have a problem speaking up to authority. During his call to the captain, he told the captain that they would be 22 nautical miles from the center of the hurricane. He personally called the captain twice. As third mate, he was the junior bridge officer and stood the 2000–2400 watch, so the captain would be available to assist him, if needed. On the voyage data recorder (VDR), the second mate sounds confident. She called the captain and woke him up just after 1 a.m. We’ll never know why the captain did not return to the bridge sooner the evening before the sinking or the morning of the sinking, but I do not think it was due to lack of trying on the part of the crew. I would ask my fellow Board Members, whose experience in CRM and aviation I respect, to reflect on this hypothetical situation: If you were captain on a long-distance flight and the pilots flying called back to you during your rest period, not once, not twice, but three times, would it matter what words or tone they used with you? Most captains would be up in the cockpit to check and see what was going on. The same was true on El Faro. Finally, to the families of those mariners lost on El Faro, I ask you not to let the inclusion of one finding in this report take away from the memory of your loved ones. The men and women of El Faro fought, as a crew, to save their ship. What I heard in that last hour on the VDR reflected the courage and teamwork of the crew, including the master who refused to leave a crewmember alone. It was, as the maritime community would say, “all hands on deck.” They fought, as they lived, together. My hope is that our report and its recommendations will prevent other families from suffering as I know you all have suffered—that your loss will lead to real, meaningful change. Treasure the memories of your loved ones. They will not be forgotten.

NTSB

Marine Accident Report

260 Appendix A Investigation The NTSB learned of the accident from the Coast Guard on the afternoon of October 1,

1. A team of five investigators, Board Member T. Bella Dinh-Zarr, and support staff launched

from NTSB headquarters on October 6 and arrived on scene in Jacksonville, Florida, later the same day. The investigative team consisted of specialists in engineering, operations, naval architecture, survival factors, human performance, meteorology, and electronic data. The on-scene part of the investigation, led by the NTSB, was completed on October 15,

1. On October 31, the US Navy ship Apache, fitted with underwater detection equipment,

located the wreckage of El Faro at a depth of about 15,000 feet. In April 2016, the oceanographic research vessel Atlantis located El Faro’s VDR but did not retrieve it. In August 2016, the Apache returned to the wreckage and retrieved the VDR. In February 2016, May 2016, and February 2017, the Coast Guard convened Marine Board of Investigation hearings in Jacksonville. The NTSB participated fully in the hearings. The NTSB investigated the accident under the authority of the Independent Safety Board Act of 1974, according to NTSB rules. Parties to the investigation were the Coast Guard, TOTE Services, Inc., the American Bureau of Shipping, the National Weather Service, Harding Safety USA (Palfinger), and Herbert Engineering.

NTSB

Marine Accident Report

261 Appendix B Note on the Drawing What looks like an artist’s hand-drawn sketch of the wreckage of El Faro resting on the ocean floor (figure 2 in the report) is actually the computer-generated result of a sophisticated series of modeling exercises involving various people, organizations, and software. The drawing is based on four types of data. First, archival photographs and architectural drawings of El Faro and its sister vessel El Yunque. Second, photos and video of the El Faro wreckage taken during the three underwater searches for the vessel and its VDR on the bottom of the Atlantic Ocean. Third, bathymetric (undersea topographic) sonar data obtained during the second underwater search. Fourth, a three-dimensional model of El Faro developed by the Coast Guard’s Marine Safety Center using the Rhinoceros® (Rhino) computer graphics software. A naval architect in the NTSB Office of Marine Safety gathered and reviewed the vessel photographs and structural drawings. Scientists at Woods Hole Oceanographic Institution supplied bathymetric sonar data from the second underwater search mission and produced a “point cloud” model of the hull and surrounding seafloor. Point clouds consist of a set of data points located in a three-dimensional coordinate system that when put together, give the impression of the surface of an object. Next, staff in the NTSB Office of Research and Engineering verified that the Coast Guard’s three-dimensional model was compatible with the Woods Hole point cloud model. Staff added a break to the Coast Guard model to match a crack in the vessel shown in the sonar data. Accurate hull dimensions were retained. The top two navigation decks were removed from both models because they had separated from the hull when El Faro sank and were lost or lying at a distance from the other wreckage. A graphic artist in the Digital Services Division of the NTSB Office of Safety Recommendations and Communications then imported the Rhino model into the Autodesk Maya® three-dimensional software and added details such as windows, ladders, draft marks, and lifeboat davits—even a dangling cargo trailer. In collaboration with the NTSB naval architect, the artist scrutinized the architectural drawings and images captured during the underwater searches to make the details as accurate as possible. Adobe Illustrator® software was used to render the three- dimensional image in the style of a hand-drawn sketch. Over several weeks, the artist fine-tuned the digital image with further details and the use of Adobe Photoshop® to produce the final drawing.

NTSB

Marine Accident Report

262 Appendix C Search for El Faro Wreckage and Voyage Data Recorder At the beginning of the accident investigation, the NTSB contacted the Navy’s Superintendent of Salvage and Diving (SUPSALV) for help in locating the El Faro wreckage. (The NTSB and the Navy have a memorandum of understanding to support accident investigations.) The Navy ship Apache was made available, with support personnel from SUPSALV and a contractor, Phoenix International, along with three underwater assets. The assets consisted of a towed ping locator, a towed side-scan sonar (ORION), and the ROV CURV-21. Apache departed Little Creek, Virginia, on October 19 and arrived at the site of the sinking on October 23. Using the ping locator, investigators listened for the VDR acoustic beacon but heard nothing. On October 27, the team deployed ORION. Four days later, on October 31, ORION located a large target of interest. The next day, November 1, the team deployed CURV-21. The ROV’s portable transponder, which was mounted on a lowered mast, did not function, necessitating manual (dead-reckoning) navigation through the debris field while looking at a live video feed from the vehicle. Communication from Apache to NTSB headquarters was limited to email and voice. During the ROV’s second dive, investigators spotted the wreck of El Faro at a depth of more than 15,000 feet, near the vessel’s last known position off Crooked Island, Bahamas. The team surveyed the hull and found that the top two decks of the superstructure—including the navigation bridge, mast, and VDR—were missing. On November 11, CURV-21 located the missing decks but did not find the mast or VDR (the VDR was attached to the mast during normal operations). On November 15, after the team had further surveyed and documented the wreckage, Apache departed the scene, returning to Little Creek on November 24. NTSB investigators analyzed CURV-21’s video footage of the hull and debris field and calculated the trajectory of several objects to identify where the mast and VDR might have come to rest, given their weight and dimensions. Three fields of high probability emerged. In addition, objects seemed to rest on a firm ocean floor where visibility was fair, making both sonar and visual detection possible. The NTSB determined that it would be feasible to launch a second search, focused on locating El Faro’s mast and VDR. In consultation with SUPSALV and the Woods Hole Oceanographic Institution, the NTSB developed a new mission outline. If the VDR could not be located near the mast, the search area would have to be widened, and assets would need upgrading to maximize their search capacity. A vessel with dynamic positioning would be preferable, with a mix of sonar and image capabilities fitted to an autonomous underwater vehicle (AUV) to recover the VDR if found.1 The team would need the ability to send large quantities of data from the vessel to investigators on shore, who could help with processing and prioritization.

1 An AUV is a programmable, robotic device that differs from an ROV in that it that can move through the ocean without control by human operators, whereas an ROV is attached to an operator by cables.

NTSB

Marine Accident Report

263 The NTSB and the Woods Hole National Deep Submergence Facility entered an interagency agreement for a second mission. To locate a dynamic-positioning vessel (dynamic positioning allows a vessel hosting underwater search vehicles to remain on station even during bad weather), the NTSB contacted the National Science Foundation’s National Oceanographic Laboratory System and learned that the oceanographic research vessel Atlantis was available in April 2016. Also available during the same time was the AUV Sentry, which could be programmed to search wide areas with different sonar frequencies, take photographs, and operate independently while the team on Atlantis did other work.2 Atlantis had on board an observation vehicle that was suspended from a winch cable and had limited means to maneuver. The observation vehicle was expected to generate a great deal of sonar and video material. The University of Rhode Island’s Inner Space Center, which had provided NOAA with a real-time “telepresence” that allowed scientists ashore to view data and video from the seafloor, was contracted to support the second search mission. The University of Rhode Island, the NTSB, and Verizon prepared a data stream from Atlantis to NTSB headquarters. The second voyage to the accident site began when Atlantis departed Charleston, South Carolina, on April 18, 2016. The ship arrived at the site on April 21. Investigators used the ship’s hull-mounted multibeam sonar to create a bathymetric base map for use in planning a search grid. The team first deployed Sentry (figure C-1) with 120-kHz sidescan and 400-kHz multibeam sonar on preprogrammed searches of high-probability debris corridors. The AUV detected more than 200 targets of interest. The National Deep Submergence Facility used the same navigation method to operate its underwater vehicles as SUPSALV. Video from the first mission had shown mooring lines from El Faro floating above areas of the wreck, which posed entanglement hazards, and the 15,000-foot depth at the site still posed a challenge. The observation vehicle obtained high-definition video and photos of El Faro’s hull and interrogated the various targets the AUV had previously detected. One of them turned out to be the El Faro mast, with the VDR attached. It was located in the search area the NTSB determined from its wreckage trajectory studies. The telepresence transmitted the imagery in real time to NTSB headquarters. The VDR appeared to investigators to be in fair condition but entangled and possibly attached to the mast with obstructions, which would preclude a simple recovery. Therefore, the NTSB decided to leave the VDR in place and arrange with SUPSALV to return to the site later, using CURV-21 and the first available support vessel. A third mission, aimed at recovering El Faro’s VDR, was launched in August 2016, the first available date for the Navy ship Apache, which could support CURV-21. In preparation for the trip, CURV-21 was equipped with high-definition cameras. Apache departed Little Creek on August 5 and arrived at the accident site on August 8. At 1950 that evening, CURV-21 freed the VDR capsule from the mast, which was partly buried in the seafloor, and brought the capsule to the surface (figures C-2, C-3, and C-4). The investigative team spent several additional days surveying the El Faro hull before returning to port on August 12.

2 Sentry can explore the ocean down to 6,000 meters (19,685 feet), according to the Woods Hole website (https://www.whoi.edu/main/sentry).

NTSB

Marine Accident Report

264

Figure C-1. Sentry deployed on second search mission.

NTSB

Marine Accident Report

265

Figure C-2. CURV-21 freeing VDR capsule from seafloor. (US Navy photo)

Figure C-3. CURV-21 placing VDR capsule in basket for transport to surface. (US Navy photo)

NTSB

Marine Accident Report

266

Figure C-4. CURV-21 landing on Apache deck after retrieving VDR.

NTSB

Marine Accident Report

267 Appendix D Vessel Particulars Vessel Name SS El Faro Owner/operator TOTE Maritime Puerto Rico/TOTE Services Port of registry San Juan, Puerto Rico Flag United States Type Cargo—Ro/Ro container Built 1975, Chester, Pennsylvania Official number 561732 IMO number 7395351 Classification society American Bureau of Shipping Construction Steel, reduced scantlings Draft, full load (extreme) 30 feet 2 3/8 inches (9.2 meters) Displacement, full load 34,677 long tons Draft (departure) 29 feet 8 5/16 inches (9.05 meters) Length 790 feet 9 inches (241.0 meters) Beam 105 feet 0 inches (32.0 meters) Depth, main deck to keel 60 feet 1 5/8 inches (18.3 meters) Gross/net tonnage (international) 31,515/21,473 Engine power and type Steam turbine, 30,000 shaft horsepower (22,370 kilowatts), single screw Service speed 20 knots Cargo Containers and rolling cargo (automobiles and trailers) Container Capacity 1,414 TEUs Autos/40-ft trailers/20-ft trailers capacity 74/24/290 Fuel capacity 11,757 barrels Freshwater capacity 410 long tons Ballast water capacity 4,623 long tons Complement, total 42 (33 crew and 9 others) Persons on board 33 Fatalities 33 Damage cost Estimated $36 million

NTSB

Marine Accident Report

268 Appendix E Hurricane Avoidance The best-known encyclopedia of navigation in the United States, The American Practical Navigator (commonly known as Bowditch), states, “The safest procedure with respect to tropical cyclones is to avoid them” (Bowditch 2002).1 The ideal action, according to Bowditch, is to set a course “that will take the vessel well to one side of the probable track of the storm, and then continu[e] to plot the positions of the storm center as given in the weather bulletins, revising the course as needed.” For a vessel inside the storm area, the correct action for avoiding danger depends on where the ship is in relation to the storm center and the direction in which it is traveling. Bowditch offers a vivid description of the onset of a tropical cyclone: An early indication of the approach of a tropical cyclone is the presence of a long swell. In the absence of a tropical cyclone, the crests of swell in the deep waters of the Atlantic pass at the rate of perhaps eight per minute. Swell generated by a hurricane is about twice as long, the crests passing at the rate of perhaps four per minute. Swell may be observed several days before arrival of the storm. When the storm center is 500 to 1,000 miles away, the barometer usually rises a little, and the skies are relatively clear. Cumulus clouds, if present at all, are few in number and their vertical development appears suppressed. The barometer usually appears restless, pumping up and down a few hundredths of an inch. As the tropical cyclone comes nearer, a cloud sequence begins which resembles that associated with the approach of a warm front in middle latitudes. Snow-white, fibrous “mare’s tails” (cirrus) appear when the storm is about 300 to 600 miles away. Usually these seem to converge, more or less, in the direction from which the storm is approaching. This convergence is particularly apparent at about the time of sunrise and sunset. Shortly after the cirrus appears, but sometimes before, the barometer starts a long, slow fall. At first the fall is so gradual that it only appears to alter somewhat the normal daily cycle (two maxima and two minima in the Tropics). As the rate of fall increases, the daily pattern is completely lost in the more or less steady fall. The cirrus becomes more confused and tangled, and then gradually gives way to a continuous veil of cirrostratus. Below this veil, altostratus forms, and then stratocumulus. These clouds gradually become more dense, and as they do so, the weather becomes unsettled. A fine, mist-like rain begins to fall, interrupted from time to time by rain showers. The barometer has fallen perhaps a tenth of an inch. As the fall becomes more rapid, the wind increases in gustiness, and its speed becomes greater, reaching perhaps 22 to 40 knots (Beaufort 6–8). On the horizon appears a dark wall of heavy cumulonimbus, called the bar of the storm. This is the heavy bank of clouds comprising the main mass of the cyclone. Portions of this heavy cloud become detached from time to time, and drift across the sky, accompanied by rain squalls and wind of

1 The American Practical Navigator is called Bowditch after its first author, Nathaniel Bowditch. The work has been published for over 200 years. The US government bought the copyright in 1867. The document is accessible online through Wikisource. Hurricane avoidance is treated in chapter 35 of the document (https://en.wikisource.org/w/index.php?title=The_American_Practical_Navigator/Chapter_35&oldid=4344173).

NTSB

Marine Accident Report

269 increasing speed. Between squalls, the cirrostratus can be seen through breaks in the stratocumulus. As the bar approaches, the barometer falls more rapidly and wind speed increases. The seas, which have been gradually mounting, become tempestuous. Squall lines, one after the other, sweep past in ever increasing number and intensity. With the arrival of the bar, the day becomes very dark, squalls become virtually continuous, and the barometer falls precipitously, with a rapid increase in wind speed. The center may still be 100 to 200 miles away in a fully developed tropical cyclone. As the center of the storm comes closer, the ever-stronger wind shrieks through the rigging, and about the superstructure of the vessel. As the center approaches, rain falls in torrents. The wind fury increases. The seas become mountainous. The tops of huge waves are blown off to mingle with the rain and fill the air with water. Visibility is virtually zero in blinding rain and spray. Even the largest and most seaworthy vessels become virtually unmanageable, and may sustain heavy damage. Less sturdy vessels may not survive. Navigation virtually stops as safety of the vessel becomes the only consideration. The awesome fury of this condition can only be experienced. Words are inadequate to describe it. If the eye of the storm passes over the vessel, the winds suddenly drop to a breeze as the wall of the eye passes. The rain stops, and the skies clear sufficiently to permit the sun or stars to shine through holes in the comparatively thin cloud cover. Visibility improves. Mountainous seas approach from all sides in complete confusion. The barometer reaches its lowest point, which may be 1 1/2 or 2 inches below normal in fully developed tropical cyclones. As the wall on the opposite side of the eye arrives, the full fury of the wind strikes as suddenly as it ceased, but from the opposite direction. The sequence of conditions that occurred during approach of the storm is reversed, and passes more quickly, as the various parts of the storm are not as wide in the rear of a storm as on its forward side. Hurricanes can be viewed as “atmospheric heat engines,” in which heat energy from warm ocean waters is transferred to the atmosphere and transformed into mechanical energy, i.e., wind. As spiraling warm air moves up, then outward, it loses heat in the cold upper atmosphere, then sinks back down into the lower atmosphere, where it warms again. As long as the warm air rises faster than the cooler are spirals inward, the pressure at the center of the storm will fall. Bowditch points out that relying on weather bulletins to determine the storm center and the semicircle in which a vessel is located is problematic “because of the lag between the observations upon which the bulletin is based and the time of reception of the bulletin, with the ever-present possibility of a change in the direction of the storm.” Although radar can eliminate the lag, “the return may not be a true indication of the center.” Bowditch concludes: Perhaps the most reliable guide is the wind. Within the cyclonic circulation, a wind shifting to the right in the northern hemisphere indicates the vessel is probably in the dangerous semicircle. A steady wind shift opposite to this indicates the vessel is probably in the less dangerous semicircle. . . . If in doubt, the safest action is usually to stop long enough to define the proper semicircle. The loss in time may be more than offset by the minimizing of the possibility of taking the wrong action, increasing the danger to the vessel. If the wind direction remains steady (for a vessel which is stopped), with increasing speed and falling barometer, the vessel is in or near the path of the storm. If it remains steady with decreasing speed and rising barometer, the vessel is near the storm track, behind the center.

NTSB

Marine Accident Report

270 Bowditch presents specific guidelines for avoiding hurricane-force winds: As a general rule, for a vessel in the Northern Hemisphere, safety lies in placing the wind on the starboard bow in the dangerous semicircle and on the starboard quarter in the less dangerous semicircle. . . . If it becomes necessary for a vessel to heave to [stop], the characteristics of the vessel should be considered. A power vessel is concerned primarily with damage by direct action of the sea. A good general rule is to heave to with head to the sea in the dangerous semicircle, or stern to the sea in the less dangerous semicircle. This will result in greatest amount of headway away from the storm center, and least amount of leeway toward it. If a vessel handles better with the sea astern or on the quarter, it may be placed in this position in the less dangerous semicircle or in the rear half of the dangerous semicircle, but never in the forward half of the dangerous semicircle. It has been reported that when the wind reaches hurricane speed and the seas become confused, some ships ride out the storm best if the engines are stopped, and the vessel is left to seek its own position, or lie ahull. In this way, it is said, the ship rides with the storm instead of fighting against it. These rules are summarized as follows: Right or dangerous semicircle: Bring the wind on the starboard bow (045° relative), hold course and make as much way as possible. If necessary, heave to with head to the sea. Left or less dangerous semicircle: Bring the wind on the starboard quarter (135° relative), hold course and make as much way as possible. If necessary, heave to with stern to the sea. On storm track, ahead of center: Bring the wind 2 points on the starboard quarter (about 160° relative), hold course and make as much way as possible. When well within the less dangerous semicircle, maneuver as indicated above. On storm track, behind center: Avoid the center by the best practicable course, keeping in mind the tendency of tropical cyclones to curve northward and eastward. In 1857, a Dutch meteorologist, C.H.D. Buys Ballot, published a law outlining general rules for steering vessels away from the worst part of any rotating storm system. Buys Ballot’s technique relies on cloud formations, wind speed, and barometric pressure. The underlying principles of Buys Ballot’s law state that for anyone ashore in the northern hemisphere and in the path of a hurricane, the most dangerous place to be is in the right front quadrant of the storm. There, the observed wind speed of the storm is the sum of the speed of wind in the storm circulation plus the velocity of the storm’s forward movement. Buys Ballot’s Law calls this the “dangerous quadrant.” Likewise, in the left front quadrant of the storm, the observed wind is the difference between the storm’s wind velocity and its forward speed. This is called the “safe quadrant” due to the lower observed wind speeds. If a person stands with his or her back to the wind, the atmospheric pressure is low to the left, high to the right, because wind travels counterclockwise around low-pressure zones in the northern hemisphere. The left side is thus the direction in which the storm is moving. According to the Mariner’s Guide for Hurricane Awareness in the North Atlantic Basin, published by the National Weather Service (Holweg 2000), typical hurricanes possess tropical storm force wind fields of about 300 nm in diameter. The guide therefore advises mariners:

NTSB

Marine Accident Report

271 do not focus on the location and track of the center, because the hurricane’s destructive winds and seas cover a broad path. Hurricane force winds can extend outward about 25 nautical miles from the storm center of a small hurricane to more than 150 nautical miles for a large one. The range over which tropical storm force winds occur is even greater, possibly extending as far as 300 nautical miles from the eye of a large hurricane. The mariner’s guide contains rules for hurricane avoidance as well as information about the nature of tropical cyclones and where to obtain storm forecasts. The guide recommends doing a risk analysis four times a day when an active tropical cyclone is approaching or near the region where the vessel is operating. (Four times a day coincides with the issuance of the National Hurricane Center’s tropical cyclone forecast/advisory.) The risk analysis should include obtaining the latest forecasts and charts, including surface, upper level, and sea state; plotting current and forecast positions of active tropical cyclone activity; and comparing forecast tracks to evaluate whether to increase the buffer zone around the tropical cyclone. According to the guide’s risk-analysis checklist, plotting should ensure that the vessel meets the requirements of the 34-knot rule and the 1-2-3 rule. The 34-Knot Rule. For vessels at sea, the maximum wind speed of a storm and its position and forecast track are less important than the size and shape of the wind field—in particular, where sustained wind speeds are at least tropical storm force (34 knots) or could become that strong. Hence, avoiding the 34-knot wind field of a tropical cyclone is critical for mariners. As stated in the mariner’s guide, “All vessels in the vicinity of a tropical cyclone should, at a minimum, remain outside of this danger area.” The 1-2-3 Rule. One method of avoiding the dangerous area of a tropical storm or hurricane is by following the “mariner’s 1-2-3 rule.” The danger area is plotted by adding 100 nm to the maximum radius of the 34-knot winds in the 24-hour forecast, 200 nm to the maximum radius of the 34-knot winds in the 48-hour forecasts, and 300 nm to the maximum radius of the 34-knot winds forecast for 72 hours. A circle is then drawn around each forecast position (moving across the chart with the storm), and a line is drawn connecting the circles. The area enclosed by the line is the danger area. The 1-2-3 rule is illustrated in figure E. The National Hurricane Center’s tropical cyclone danger graphic is based on the mariner’s 1-2-3 rule (the rule was replaced in 2016 with a method based on wind speed probabilities), shading a map to show the danger area of a tropical cyclone. The danger graphic for Hurricane Joaquin valid for the time El Faro departed Jacksonville on September 29 is included as figure 39 in the report.

NTSB

Marine Accident Report

272

Figure E. Diagram of 1-2-3 rule. Green line represents center of storm track. (Adapted from figure 29 in Holweg 2000)

NTSB

Marine Accident Report

273 Appendix F Detailed Information about Vessel’s Lifesaving Equipment The manufacturer, dates of manufacture and approval, if known, and other details of the survival gear carried on El Faro are listed in table F-1. The Coast Guard certificates of approval for items marked “Former—May Use” were in effect indefinitely but had been transferred to the National Archives in Washington, DC, for storage. Coast Guard approval numbers were provided by Harding Safety, the company that serviced El Faro’s lifeboats, then searched on a Coast Guard database. Table F-2 lists details of the debris from El Faro’s survival gear that was discovered or recovered after the sinking. Table F-1. Details of survival equipment carried by El Faro. Equipment Manufacturer Manufacture Date Approval Characteristics Lifeboat 1 (starboard) MASECO 9/5/1974 (boat 2413) Coast Guard No. 160.35/461/0 Issued: 4/11/1980 Exp: 9/6/1986 Status: “Former—may use lifeboat for merchant vessels” Dimensions: 26.5 ft x 9 ft x 3.83 ft Capacity: 43 persons Construction: open Propulsion: mechanical (hand- propelled Fleming gear) Material: fiberglass-reinforced plastic with internal buoyancy foam Launch: gravity davit Recovery: winch Lifeboat 2 (port) MASECO unknown (boat 2412) Coast Guard No. 160.035/460/0 Issued: 5/9/1975 Exp: 6/2/1980 Status: “Former—may use lifeboat for merchant vessels” Vessel’s rescue boat

Dimensions: 26.5 ft x 9 ft x 3.83 ft Capacity: 48 persons Wt. (full load): 12,782.4 lb Construction: open Propulsion: motor (diesel engine) Material: fiberglass-reinforced plastic with internal buoyancy foam Launch: gravity davit Recovery: winch Davits (same on both lifeboats) MASECO unknown Coast Guard No. 160.032/173/0 Issued: 3/16/1982 Exp: 3/16/1987 Status: “Former—may use” Type: gravity Serial No.: 26-15 Maximum working load: 15,000 lb per set (7,500 lb per arm) using 2-part fall wires Winch (same on both lifeboats) MASECO unknown Coast Guard No. 160/015/93/2 Issued: 11/12/1988 Exp: 11/12/1993 Status: “Former—may use lifeboat winch for merchant vessels” Type: 35G-MK II Model: 256 Serial No.: 1070-1 Load: 3,750 lb per fall

NTSB

Marine Accident Report

274 Equipment Manufacturer Manufacture Date Approval Characteristics Release hook (same on both lifeboats) MASECO unknown (a) Type: Rottmer SWL 7000 Liferaft 1 Viking Life- Saving Equipment 10/2005 Coast Guard no. 160.151/117/0 Issued: 6/24/2015 Exp: 6/24/2020 Status: Approved Type: inflatable Serial No.: Viking 25DK+10245946 Emergency pack: SOLAS A Capacity: 25 persons Packed weight: 380 lb Location: boat deck, starboard side Inspected: 9/4/2015 Next Insp: 9/2016 Liferaft 2 Viking Life- Saving Equipment 10/2005 Coast Guard no. 160.151/117/0 Issued: 6/24/2015 Exp: 6/24/2020 Status: Approved Type: inflatable Serial No.: Viking 25DK+10245947 Emergency pack: SOLAS A Capacity: 25 persons Packed weight: 380 lb Location: boat deck, port side Inspected: 9/4/2015 Next Insp: 9/2016 Liferaft 3 Viking Life- Saving Equipment 11/2010 Coast Guard No. 160.151/108/0 Issued: 6/24/2015 Exp: 6/24/2020 Status: Approved Type: inflatable Serial No.: Viking 06DK+11355928 Emergency pack: SOLAS A Capacity: 6 persons Packed weight: 155 lb Location: port side, forward on main deck Required on vessels over 100 m long Inspected: 5/18/2015 Next Insp: 5/2016 Liferaft 4 Survitec Group, Ltd. 7/2015 Coast Guard No. 160.151/130/3 Updated: 6/24/2014 Issued: 8/22/2016 Exp: 6/24/2019 Status: Approved Type: inflatable Model: Elliot SOLAS style MkIV TO Serial No.: 5086300200735, lot 2451 Emergency pack: SOLAS A Capacity: 25 persons Packed weight: 406 lb Manufactured: 7/2015 Next Insp: 7/7/2017 Liferaft 5 Survitec Group, Ltd. 7/2015 Coast Guard No. 160.151/130/3 Updated: 6/24/2014 Issued: 8/22/2016 Exp: 6/24/2019 Status: Approved Type: inflatable Model: Elliot SOLAS style MkIV TO Serial No.: 5086300200613, lot 2463 Emergency pack: SOLAS A Capacity: 25 persons Packed weight: 406 lb Manufactured: 7/2015 Next Insp: 7/27/2017

NTSB

Marine Accident Report

275 Equipment Manufacturer Manufacture Date Approval Characteristics Lifejackets Safegard Corporation unknown Coast Guard No. 160.002/70/0 Issued: 12/6/2004 Exp: 12/6/2009 Status: “Former— may use” Type: with whistle and light Model: 3, 190, or 190RT kapok most recent type 1 on CG EQList database Location: crew quarters (41); bridge (3); engine room control station (3); bow (2); port lifeboat (2); starboard lifeboat (2); gear locker spares (12) Lifebuoys Datrex, Inc. For 2 recovered: 12/2004, 11/2008 Coast Guard No. 160.050/127/0 Update: 1/29/2009 Issued: 1/29/2014 Exp: 1/29/2019 Status: Approved Size: diameter = 30 in. Type: with self-igniting ACR lights (13); quick-release with light and smoke floats (2); with buoyant line (2); without attachments (13); spare (1) Location: weather decks, except 2 quick-release on port and starboard bridge wings Immersion suits Various: Imperial, Stearns, Baileys, Fitzwright, Revere; Kent for 4 new XL suits For 1 recovered: 6/1985 (Imperial Manufacturing Co.) Coast Guard No. 160.071/1/2 Issued: 9/1/1987 Exp: 9/1/1992 Status: “Former— may use” Type: Adult universal Model: 1409 Serial Nos.: 94797, lot 348; and 95015, lot 351/6 Size: total includes 4 oversize, newly purchased Location: crew quarters EPIRB Jotron unknown FCC: Type- accepted Coast Guard No. 161.011/91/0 Issued: 3/26/2008 Exp: 3/26/2018 Status: Approved Model: Jotron Tron 40S MkII Frequency: 406.037 MHz Serial Nos.: 09170 (on 1/27/2015 safety survey by Imtech Marine/Radio Holland); ADCDO 28F4A 40C01 (ID FCC registration); 49989 (on ABS certificate) Antenna: omnidirectional, 5 watts GPS: none Operating life: minimum 48 hr Battery exp: 2/1/2019 Release: manual or hydrostatic Bracket: Type FB-6; Serial 03101 Hydrostatic release exp: 2/1/2016 Date Registered: 2/1/2012 Last Update: 12/3/2013 Decal exp: 12/3/2015 In service: 2/16/2007, Jacksonville FL Lifeboat radios (3) ACR Electronics unknown FCC: B668L2ACR-SR- 102 Issued: 2/8/2000 Exp: none Serial Nos. (battery exp): 952061 (1/1/2019); 14609 (1/1/2019); 95703 (12/12/2018) Model: SR-102R, 2-channel VHF GMDSS survival radio

NTSB

Marine Accident Report

276 Equipment Manufacturer Manufacture Date Approval Characteristics SART 2 Jotron unknown FCC: VRVTRONSART20 Issued: 5/16/2008 Exp: none Model: Tron, SART, 9 gigahertz Serial Nos.: 10595, 10601 Both units’ batteries exp: 2/1/2018 Operation life: 96 hr standby, 8 hr continuous Trigger: X-band radar on search- and-rescue vessel Long-range identification and tracking Thrane &Thrane unknown Coast Guard No.165.207/1/0 Issued: 3/16/2009 Exp: 3/16/2004 Status: Expired FCC cert. required Model: TT-3000LRIT ID: 4TT088FF662A Freq: Rx and Tx GPS: 1575.42 MHz GPS module: 12-ch; 1 sec updates Serial No.: 436820881 TT-3026M Mini-C transceiver In service: 4/2/2010, Baltimore MD Last ABS survey: 4/15/2010 NOTE: “Former” approval status indicates “product is no longer approved for production but previously produced items may continue to be used as long as in good and serviceable condition” (Coast Guard Maritime Information Exchange, Approved Equipment List). a No information available. Certificate of approval for release hook had been removed from Coast Guard files but was not found in Coast Guard records deposited at National Archives. Table F-2. El Faro survival debris discovered or recovered. Survival Debris Evidence ID Description Starboard lifeboat None Lifeboat 1 sighted by air ~1500 on October 4, at 23.4033N, 073.9083W. Tug Hawk arrived at 1537 and found lifeboat heavily damaged, floating vertically with 2-3 ft of bow above water. At 1552, Coast Guard helicopter lowered rescue swimmer onto tug Hawk. Rescue swimmer was in water from 1600 until 1616, inspecting lifeboat. Helicopter retrieved rescue swimmer at 1620. Lifeboat damage: -Port bow missing section of gunwale 61 in. long and 32 in. toward keel. -Port quarter missing gunwale section 42 in. long and 33 in. down. -Starboard quarter missing 150-in. section of gunwale extending down to keel. -Many sections of hull cracked. -Propeller fouled with lines, blade bent. -Bow and stern manual hook release handles bent and inoperable. -Rudder tiller missing. -Sea anchor tangled with sea painter. Port lifeboat Dive S381 Contact 0153 Lifeboat 2 found on ocean floor by AUV Sentry at position 23.3916N, 073.9083W. One end was cut off. Liferaft N/A Discovered 2057 UTC on October 4 at 23.4866N, 073.5883W by cutter Northland. Searched and found empty, then sunk. Second liferaft, reported at 1657 on October 4 by Navy P-8 at 23.4116N, 073.915W, could not be relocated. Coast Guard determined that it was vessel’s starboard lifeboat.

NTSB

Marine Accident Report

277 Survival Debris Evidence ID Description Lifejacket Mission III, ROV CURV- 21, date/time 8/9/2016 09:10:06 Lifejacket with reflective material found by AUV under debris on aft starboard side of El Faro’s boat deck, near ladder down to cabin deck. Immersion suit—1 of 3; with human remains N/A Found 2047 UTC on October 4 at 23.4266N, 074.1966W. Investigated, but after helicopter was called away, could not be reacquired. Immersion suit—2 of 3 176809 Recovered 2306 UTC on October 6 at 24.0644N, 073.235W by cutter Charles Sexton. Label: “Imperial Manufacturing Co., Bremerton, WA 98310; Adult Universal (more than 110 lbs); Model No. 1409; Serial No. 94797; Lot No. 348; manufacture date 6-85.” Immersion suit—3 of 3 176812 Recovered 1603 UTC October 7 at 23.9816N, 073.325W by cutter Charles Sexton. Label: “Imperial Manufacturing Co., Bremerton, WA 98310; Adult Universal (more than 110 lbs.); Model No. 1409; Serial No. 95015; Lot No. 351/6; manufacture date 6-85.” Lifebuoy—1 of 8 None Recovered by El Yunque and passed to cutter Northland for transfer to Coast Guard Sector Jacksonville. Lifebuoy —2 of 8 None Stenciled “El Faro”; damaged DATREX label; missing circular plastic plug for inserting flotation material. Lifebuoy—3 of 8 176808 Recovered 1810 UTC on October 6 at 24.0983N, 073.4266W by cutter Charles Sexton. DATREX buoy broken in half; stenciled “El Morro San Juan, PR.” Lifebuoy—4 of 8 197131 Recovered October 5 at 24.6266N, 073.055W by cutter Resolute.Stenciled “El Faro.” DATREX Inc. Kinder LA commercial ring buoy type IV PFD; Model DX03250; deck buoy; issue no. e-843; lot no. 822; insp. 12-08; mfg date 11-08. Lifebuoy—5 of 8 197132 Recovered October 5 at 24.62N, 073.0616W by cutter Resolute.Stenciled “El Morro.” Torn, missing circular plastic plug for inserting flotation material. Embossed DATREX Buoy. Lifebuoy—6 of 8 197134 Recovered October 5 at 24.6383N, 073.03W by cutter Resolute. Stenciled “El Faro.” Damaged label reads “No. E-122” and “2002”; same label format as DATREX deck buoy. Lifebuoy—7 of 8 197135 Recovered October 5 at 24.64N, 073.02W by cutter Resolute. Stenciled “El Far.” DATREX Inc. Kinder LA USA; issue No. E-843; lot No. 711; mfg date 12-04; insp. 12-04. Lifebuoy—8 of 8 None Recovered around November 11 on Man-O-War Cay, Abaco Island, Bahamas, at about 26.5983N, 077.0033W, by beachcomber. Stenciled “El Faro.” DATREX Inc. Kinder LA USA. Smoke float—1 of 2 None Recovered by cutter Charles Sexton. Smoke float—2 of 2 Dive S385 Found on ocean floor by AUV Sentry at 23.3866N, 073.91W.

NTSB

Marine Accident Report

278 References ABS (American Bureau of Shipping). 2005. The Implementation of Bridge Resource Management. Houston, Texas: ABS. June. Baatz, Y. 2014. Maritime Law. Abingdon, United Kingdom, and New York: Informa Law from Routledge. Berg, R. 2016. Hurricane Joaquin, Tropical Cyclone Report AL112015. Miami, Florida: National Hurricane Center. January 12. Bowditch, N. 2002. The American Practical Navigator. Bethesda, Maryland: National Imagery and Mapping Agency, 524–526. Bureau Veritas. 2017. “Saybolt Universal Viscosity (SUV) or Saybolt Universal Seconds (SUS),” The Analyst (e-newsletter). https://oil-testing.com/glossary. Chawla, A. 2016. Estimating Sea State and Surface Winds During Hurricane Joaquin Using State-of-the Art Wave and Hurricane Models from the National Center for Environmental Prediction (NCEP), Technical Note prepared for NTSB. College Park, Maryland: National Center for Weather and Climate Prediction. November 4. Crowch, T. 2013. Navigating the Human Element. An introduction to Human Factors for Professional Mariners. N.p.: MLB Publishing. Dorfman. P. W., and J. P. Howell. 1988. “Dimensions of National Culture and Effective Leadership Patterns: Hofstede Revisited.” Advances in International Comparative Management, vol. 3: 127–150. EPA (Environmental Protection Agency). 2011. Designation of Emission Control Area to Reduce Emissions from Ships in the US Caribbean. Report EPA-420-F-11-024. Ann Arbor, Michigan: EPA, Office of Transportation and Air Quality. Fedele, F., C. Lugni, and A. Chawla. 2017. “The Sinking of the El Faro: Predicting Real World Rogue Waves during Hurricane Joaquin.” Scientific Reports 7, article 11188. September 11. http://www.nature.com/articles/s41598-017-11505-5 . Fischer, U., and J. Orasanu. 1999. “Cultural Diversity and Crew Communication.” Paper presented at 50th Astronomical Congress in Amsterdam. October. GAO (Government Accountability Office). 2013. Puerto Rico: Characteristics of the Island’s Maritime Trade and Potential Effects of Modifying the Jones Act Report GAO-13-260. Washington, DC: GAO. Guiney, J. L., and M. B. Lawrence. 1999. Hurricane Mitch, 22 October–05 November 1998, preliminary report. Miami, Florida: National Hurricane Center. http://www.nhc.noaa.gov/data/tcr/AL131998_Mitch.pdf.

NTSB

Marine Accident Report

279 Holweg, E. J. 2000. Mariner’s Guide for Hurricane Awareness in the North Atlantic Basin. NOAA, National Weather Service, Tropical Prediction Center, Tropical Analysis and Forecast Branch. August. Husick, C. B. 2009. Weather. Chap. 24 in Chapman Piloting and Seamanship. New York: Hearst Books, 825. IMO/ICAO (International Maritime Organization/International Civil Aviation Organization).

1. IAMSAR Manual (International Aeronautical and Maritime Search and Rescue

Manual), vol. II, Mission co-ordination, publication IF961E. London/Montreal: IMO and ICAO, figure N-14. JAXPORT (Jacksonville Port Authority). 2016. JAXPORT 2015 Annual Report. Florida: JAXPORT. May. Lewandowski, M. J., and C. J. Clark. 2016. Immersion Suit Flotation Testing REACT (Rapid Evaluation and Analysis of Critical Technologies) Report. Report CG-D-08-16. New London, Connecticut: US Coast Guard Research and Development Center. http://www.dcms.uscg.mil/Portals/10/CG-9/RDTE/RDTE%20PDFs/CG-D-08- 16.pdf?ver+2017-04-03-070333-920. MIT (Ministry of Infrastructures and Transports). 2013. Report on the Safety Technical Investigation, Cruise Ship Costa Concordia, Marine Casualty on January 13, 2012. Rome, Italy: MIT, Marine Casualties Investigative Body. May 24. MSC (US Coast Guard Marine Safety Center). 2017. SS EL FARO Stability and Structures, technical report. Washington, DC: MSC. March 22. Nautical Institute. 2014. The Navigator, issue 7. London. Nelson, J. K., N. B. Regan, R. Khandpuir, A. C. Landsburg, and R. L. Markle. 1994. “Implementation of Free-Fall Lifeboats on Ships.” Marine Technology, vol. 31, no. 1 (October 1994): 269–277. NGA (National Geospatial–Intelligence Agency). 2016. Sailing Directions (Enroute): Caribbean Sea, vol. 1, pub. 147, corrected to January 23, 2016. Springfield, Virginia: NGA. NMOC (Naval Meteorology and Oceanography Command). 2016. Hurricane Havens Handbook, Blount Island, Florida. Stennis Space Center, Mississippi: NMOC. Originally published 1982, modified May 2016. https://www.nrlmry.navy.mil/portguides/html/hurricanehavens/blount_island/summary.ht m. NOAA (National Oceanic and Atmospheric Administration). 2012. Straits of Florida and Approaches, chart 00103, February 2012, corrected July 2016. Washington, DC: NOAA, Office of Coast Survey. http://www.charts.noaa.gov/OnLineViewer/11013.shtml.

NTSB

Marine Accident Report

280 ———. 2015a. “How Deep is the Ocean?” NOAA, National Ocean Service. https://oceanservice.noaa.gov/facts/oceandepth.html. ———. 2015b. “Ocean Explorer.” NOAA, Office of Ocean Exploration. http://oceanexplorer.noaa.gov/facts/hurricanes.html. ———. 2016. US SARSAT Engineering Report on MV El Faro Incident, Oct. 1, 2015. Suitland, Maryland: NOAA Satellite Operations Facility. ______. 2017a. “Comparison of 406 MHz and 121.5 MHz Distress Beacons.” NOAA, SARSAT. http://www.sarsat.noaa.gov. ———. 2017b. United States Coast Pilot 4, Atlantic Coast: Cape Henry to Key West, chapter 9. NOAA, Office of Coast Survey. https://nauticalcharts.noaa.gov. NRC (National Research Council). 1994. Minding the Helm: Marine Navigation and Piloting, NRC. Washington, DC: The National Academies Press. NTSB (National Transportation Safety Board). 1979a. Aircraft Accident Report, Japan Airlines Company, Ltd., McDonnell-Douglas DC-8-62F, JA 8054, Anchorage, Alaska, January 13,

1. AAR-78-07. Washington, DC: NTSB.

———. 1979b. Aircraft Accident Report, United Airlines, Inc., McDonnell-Douglas DC-8-61, N8082U, Portland, Oregon, December 28, 1978. AAR-79-07. Washington, DC: NTSB. ———. 1984. United States Bulk Carrier Marine Electric, Capsizing and Sinking about 30 Nautical Miles East of Chincoteague, Virginia, February 12, 1983. MAR-84-01. Washington, DC: NTSB. ———. 2009a. Allision of Bahamas-Registered Tankship M/T Axel Spirit with Ambrose Light, Entrance to New York Harbor, November 3, 2007. MAR-09/02. Washington, DC: NTSB. ———. 2009b. Allision of Liberia-Registered Fruit Juice Carrier M/V Orange Sun with U.S.- Registered Dredge New York, Newark Bay, New Jersey, January 24, 2008. MAR-09/03. Washington, DC: NTSB. ———. 2011. Sinking of US Fishing Vessel Lady Mary. MAB-11-01 Washington, DC: NTSB. ———. 2013a. Personnel Abandonment of Weather-Damaged US Liftboat Trinity II, with Loss of Life, Bay of Campeche, Gulf of Mexico, September 8, 2011. MAR-13/01. Washington, DC: NTSB. ———. 2013b. Fire Aboard Vehicle Carrier M/V Alliance Norfolk. MAB/13-05. Washington, DC: NTSB. ———. 2016a. Collision between Bulk Carrier Conti Peridot and Tanker Carla Maersk, Houston Ship Channel near Morgan’s Point, Texas, March 9, 2015. MAR-16/01. Washington, DC: NTSB.

NTSB

Marine Accident Report

281 ———. 2016b. Collision between Tanker Chembulk Houston and Container Ship Monte Alegre. MAB-16/04. Washington, DC: NTSB (reissued April 3, 2017, with corrections). ———. 2017a. Flooding and Sinking of Fishing Vessel Alaska Juris. MAB-17/26. Washington, DC: NTSB. ———. 2017b. Tropical Cyclone Information for Mariners. MSR-17/02. Washington, DC: NTSB. Pasch, R. J., and A. B. Penny. 2016. Tropical Storm Erika, Tropical Cyclone Report AL052015. Miami, Florida: National Hurricane Center. February 8. PBS (Public Broadcasting Service). 2000. “Escape! Pioneers of Survival (Ship).” NOVA television program originally broadcast February 17, 1999; transcript updated November

1. http://www.pbs.org/wgbh/nova/escape/

Plous, S. 1993. The Psychology of Judgment and Decision Making. New York: McGraw-Hill, 233. Stewart, S. R. 2016a. Hurricane Danny, Tropical Cyclone Report AL042015. Miami, Florida: National Hurricane Center. January 19. ———. 2016b. 2015 Atlantic Hurricane Season, Annual Summary. Miami, Florida: National Hurricane Center. February 10. Thiébaux, J., E. Rogers, W. Wang, and B. Katz. 2003. “A New High-Resolution Blended Real- Time Global Sea Surface Temperature Analysis.” Bulletin of the American Meteorological Society, vol. 84, no. 5: 645–656. USCG (US Coast Guard). 1977. Shifting Weights or Counter Flooding During Emergency Situations, Navigation and Vessel Inspection Circular No. 4-77. Washington, DC: US Department of Transportation, USCG. December 2. ———. 1981. Coast Guard Certification and Inspection of Certain Categories of Existing Vessels, Navigation and Vessel Inspection Circular No. 10-81, change 1 included. Washington, DC: US Department of Transportation, USCG. October 5. ———. 1985. SS Marine Electric, O.N. 245675, Capsizing and Sinking in the Atlantic Ocean on 12 February 1983 with Multiple Loss of Life, Marine Casualty Report 16732/001 HQS 83. Washington, DC: US Department of Transportation, USCG. ———. 1989. Guidelines for the Presentation of Stability Information for Operating Personnel, Navigation and Vessel Inspection Circular No. 3-89. Washington, DC: US Department of Transportation, USCG. September 7. ———. 1997. Stability Related Review Performed by the American Bureau of Shipping for U.S. Flag Vessels, Navigation and Vessel Inspection Circular No. 3-97. Washington, DC: US Department of Transportation, USCG. January 1.

NTSB

Marine Accident Report

282 ———. 2002. Applicants for Ocean or Near Coastal Master and Chief Mate Licenses for Service on Vessels of 3000 Gross Tonnage (GT) or More with Qualifying Service or Training Beginning after 1 August 1998 and All Applicants Beginning 1 February 2002, NMC Policy Letter No. 04-02. Washington, DC: US Department of Transportation, USCG, National Maritime Center. January 11. ———. 2006. U.S. Coast Guard’s The Alternate Compliance Program (ACP), Navigation and Vessel Inspection Circular No. 02-95, change 2. Washington, DC: US Department of Homeland Security, USCG. May 5. ———. 2008. Medical and Physical Evaluation Guidelines for Merchant Mariner Credentials, Navigation and Vessel Inspection Circular No. 04-08, Washington, DC: US Department of Homeland Security, USCG. September 15. ———. 2014. Guidelines on Qualifications for STCW Endorsements of Master or Chief Mate on Vessels of 3,000 GT or More (Management Level), Navigation and Vessel Inspection Circular No. 10-14. Washington, DC: US Department of Homeland Security, USCG. April 28.

FD07482 ｜ 2017_美国_PAB1701.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56301

NTSB/PAB-17/01 National Transportation Safety Board Pipeline Accident Brief Colonial Pipeline Company Petroleum Product Leak Centreville, Virginia

The Accident On September 21, 2015, at 12:03 p.m., an employee of Bonefish Grill in Centreville, Virginia, called the Fairfax County 911 Center to report a gasoline odor.1 The Fairfax County Fire and Rescue Department (FCFRD) immediately dispatched units to the restaurant in the Centre Ridge Marketplace shopping center. (See figure 1.) After arriving at the scene, firefighters confirmed everyone had left the restaurant; they established an incident command center, and they began the investigation. They did not detect the presence of flammable vapor inside Bonefish Grill and ruled out a natural gas leak; however, they noted a gasoline odor coming from the storm drains at the shopping center. Firefighters detected the presence of flammable vapor in most of the storm drains behind Bonefish Grill and Chipotle. Flammable vapor in some storm drains in front of Bonefish Grill was as high as 100 percent of the lower explosive limit (LEL); however, no liquid was visible in the storm drains.2 After establishing that the gasoline did not come from the gas station that was located about 400 feet west of Bonefish Grill and that gasoline was not illegally dumped into a storm drain, firefighters considered that the odor could be coming from a leak in a nearby, buried Colonial Pipeline Company pipeline. Colonial confirmed the pipeline leak 2 days later.

1 All times in this document are eastern daylight time. 2 LEL refers to the lowest concentration of gas in the air that is capable of igniting. For natural gas, the LEL is about 5 percent; 100 percent of the LEL means that the vapor concentration in the air is 5 percent. For gasoline, the LEL is about 1.4 percent.

Colonial Pipeline Company Petroleum Product Leak

2

Figure 1. Aerial view of the accident site; dotted lines show the locations of Colonial pipelines.

Locating Leak and Initial Response About 1:37 p.m., the Fairfax County fire marshal’s office asked Colonial—which operates underground 36- and 32-inch-diameter pipelines (lines 3 and 4, respectively) that transport gasoline and other refined petroleum liquids—to determine if the company’s pipelines could be the source of the gasoline odor. Two Colonial right-of-way inspectors contacted the Colonial Control Center to determine if there were abnormalities in the pressures in lines 3 and 4. The Control Center told them the line pressures were normal. The inspectors examined the Colonial right-of-way and told the fire department incident commander there was no evidence of a leak—including an odor, dead vegetation, or gasoline on any pavement or in nearby water retention ponds; the inspectors left the area about 3:30 p.m. With the source of the odor still unknown, the FCFRD hazardous materials (hazmat) team continued checking the storm drain system and reviewed the storm drain drawings provided by the Fairfax County Department of Public Works to locate the outflow points. After discovering the outflow culvert near Sweetwater Tavern was blocked, the hazmat team cleared the vegetation and debris from the outlet of a 60-inch-diameter storm drain that ran under Bonefish Grill’s front parking lot. Almost immediately, the collection weir (barrier) filled with water covered with a black petroleum product. The hazmat team assigned the name “recovery site 1” to the location and began pumping the black petroleum product into a 95-gallon, poly-overpack drum with a small portable pump. The crew also placed absorbent pillows and containment booms around the weir

Colonial Pipeline Company Petroleum Product Leak

3

to contain the liquid. A fire marshal investigator then notified Colonial that the hazmat team had discovered some unknown petroleum product in the storm drain. Within about 5 hours of the initial odor complaint, the hazmat unit had collected about 90 gallons of product (a combination of liquid hydrocarbon and water). Because some product remained in the storm drain, the Fairfax County fire marshal’s office requested assistance from a hazmat contractor to continue the cleanup operation. The contractor dispatched a vacuum truck crew to the scene and continued to collect product along with water from the rain that began to fall shortly after they discovered the spill. At that point, the FCFRD believed the gasoline was likely from an illegal dumping operation, and the incident was contained. By 7:30 p.m., the cleanup crews had collected more than 3,000 gallons of water-petroleum product mixture in the vacuum truck. Crews also deployed absorbent booms and collected a similar mixture in a vacuum truck at the storm water retention pond northwest of Sweetwater Tavern. Because spill estimates continued to increase during that evening, investigators had to reconsider their conclusion that the source was illegal dumping; they again suspected there was an active leak. The fire marshal’s office contacted the Colonial Control Center at 8:53 p.m. and requested assistance. After discussing the situation with the right-of-way inspector, the Colonial controller started shutting down lines 3 and 4 as a precaution and dispatched inspectors to the site. Colonial shut down the line 3 and 4 pumps and the main-line block valves at the Chantilly and Remington stations in Virginia by 9:17 p.m. (See figure 2.) Colonial inspectors arrived about 10:00 p.m. About 2 1/2 hours later, Colonial’s lead operator contacted the company’s district environmental coordinator and the director of northeast operations to report he still did not know if the Colonial pipeline might be the source of the product in the storm water drain system. Over the next 3 hours, Colonial engineers analyzed computer operating data, but they were unable to determine whether either pipeline might be leaking. Colonial crews at the scene conducted bar hole testing in the pipeline right-of-way to try to identify a leak location; however, the rocky soil made it difficult to insert the probes deep enough to obtain meaningful data. Colonial crews also continued working with responders to determine where the product might be entering the storm water system.

Colonial Pipeline Company Petroleum Product Leak

4

Figure 2. Valves for lines 3 and 4 (clouded areas) used to isolate leak on line 4 (identified by arrow).

On September 22, 2015, about 1:00 a.m., Colonial initiated a district-level response to address a potential leak; they elevated it to a companywide response about 8 1/2 hours later. About 10:00 a.m., Colonial performed a static pressure analysis between two block valves of lines 3 and 4 to determine whether a leak existed. The analysis suggested a possible leak in line 3 but not in line 4.3

Just before noon, Colonial employees and contract personnel arrived and began marking dig locations along the right-of-way to search for product and the leak location. Colonial then began excavating at possible leak locations around lines 3 and 4 on the south side of Route 28 and south of New Braddock Road, which the Colonial Integrity Management senior engineer identified and prioritized using information about appurtenances, prior repairs, and recent inline inspections. The company selected and excavated six dig sites throughout the afternoon. About 7:00 p.m., excavation began above a dent in line 4 that had been documented in an inline inspection. Product-contaminated soil was exposed near the centerline of the buried pipe. Further excavation continued throughout the night until the entire pipe diameter was exposed. This allowed access to the existing dent at the 6 o’clock position where, the following morning, the workers discovered a crack in the pipe and saw product dripping and accumulating in the trench. (See figure 3.)

3 Valve leakage and changes in temperature can result in false indications when using this leak detection technique.

Colonial Pipeline Company Petroleum Product Leak

5

Figure 3. Leak discovered at the bottom of line 4 (arrow points to leak). Colonial captured and removed the product and installed a sleeve around the pipe to stop the leak. (See figure 4.) The company prepared a restart plan and submitted it to the Pipeline and Hazardous Materials Safety Administration (PHMSA) for approval. Following satisfactory installation of a repair sleeve on September 25, 2015, PHMSA approved the temporary restart for line 4, which included a 20 percent reduction in operating pressure.

Colonial Pipeline Company Petroleum Product Leak

6

Figure 4. Two NTSB investigators examine red repair sleeve on line 4. The line 4 leak occurred in a high consequence area.4 No fatalities or injuries resulted from this accident. Colonial estimated that 4,000 gallons of product were released from the pipe. Colonial estimated the cost of accident-related expenses at $16.5 million, including initial emergency response, environmental cleanup and remediation, pipe replacement, and inline inspection. Colonial Pipeline Company Colonial is an interstate pipeline company that delivers refined petroleum products (gasoline, kerosene, home heating oil, and jet fuel) to cities, airports, and military bases throughout the southeastern, mid-Atlantic, and northeastern regions of the United States. The Colonial pipeline system begins in Houston, Texas, and ends in Linden, New Jersey. It crosses 13 states,

4 A high consequence area is defined in 49 Code of Federal Regulations [CFR] 195.450 as (1) a commercially navigable waterway, which means a waterway where a substantial likelihood of commercial navigation exists; (2) a high population area, which means an urbanized area, as defined and delineated by the Census Bureau, that contains 50,000 or more people and has a population density of at least 1,000 people per square mile; (3) an other populated area, which means a place, as defined and delineated by the Census Bureau, that contains a concentrated population, such as an incorporated or unincorporated city, town, village, or other designated residential or commercial area; or (4) an unusually sensitive area as defined in §195.6.

Colonial Pipeline Company Petroleum Product Leak

7

spans more than 5,500 miles, and connects 29 refineries on the US Gulf Coast to 270 marketing terminals. The Colonial pipeline system consists of four, large-diameter (30 inches or more) main transmission pipelines and numerous small-diameter pipelines (stub lines) that serve local markets. All four main lines (lines 1–4) and most stub lines are continuously monitored and controlled using a Supervisory Control and Data Acquisition (SCADA) system in the Alpharetta, Georgia, control center. Some of the stub lines and delivery lines are controlled locally. The pipeline system is divided into three operational districts: northeast, southeast, and Gulf Coast. Lines 1 and 2 run from Houston, Texas, to Greensboro, North Carolina. Line 3 runs from Greensboro to Linden; line 4 runs from Greensboro to Dorsey, Maryland. Lines 3 and 4 transport gasoline, kerosene, and fuel oil and are in the same right-of-way at the leak location. The maximum operating pressure for line 3 ranges from 663 to 695 pounds per square inch, gauge; the maximum operating pressure for line 4 ranges from 657 to 682 pounds per square inch, gauge. 5 The pipe for line 4 has a 32-inch nominal pipe diameter with a 0.281-inch-thick wall and double submerged arc-welded longitudinal seam; the pipe is coated with asphalt enamel. It is 288 miles long and began operating in 1964. The depth of cover on line 4 in the vicinity of the leak was between 5 1/2 and 6 1/2 feet. Corrosion protection for the pipeline in the area of the leak was provided by an impressed current cathodic protection system. Field Investigation

Colonial was not aware of a possible leak in either line 3 or line 4 until the fire department notified the company on September 21, 2015, that firefighters were responding to an odor complaint in the vicinity of the pipeline right-of-way. Control room operators closely examined the SCADA operating records for the two pipelines, but they were unable to identify evidence of a possible leak. Additionally, Colonial inspectors did not see soil discoloration, distinct areas of dead vegetation, or a colorful sheen on water, nor did they detect an odor of petroleum products in the pipeline right-of-way that would confirm a leak.

But after the fire department personnel discovered product in a storm water retention pond located hundreds of feet from the pipeline right-of-way, Colonial investigated further. On September 21, 2015, about 9:00 p.m., the company shut down both pipelines as a precaution and dispatched field inspectors to Centreville to again search for the source of the odor. As a part of the investigation, Colonial excavated down to the buried pipes at numerous locations along the right-of-way until—almost 2 days after the first odor report—they discovered the line 4 leak from a crack at a previously documented dent.

5 Colonial officials said the company does not set a single maximum operating pressure for the entire line because pressures in their refined petroleum pipeline can fluctuate due to temperature, surges, transient conditions, flow rates, and the type of batch being delivered.

Colonial Pipeline Company Petroleum Product Leak

8

As an added precaution, Colonial excavated around line 4 at a second previously documented dent location that was 70 feet upstream from the leak location. The pipe coating was intact, and magnetic particle inspection showed no evidence of cracks in the dent. A few weeks after the temporary sleeve was installed at the leak location, the two dented pipe sections were removed. Colonial installed new pipe and returned the pipeline to service as permitted by the PHMSA Corrective Action Order (CPF No. 1-2015-5018H), which was issued on September 29, 2015, and amended on October 22, 2015. Two 4-foot-long pipe segments containing dents were shipped to the NTSB materials laboratory for further evaluation. In the pipe section containing the leak, a through-wall crack is visible on both the outside surface and the inside surface in the area of the dent. (See figures 5 and 6.)

Figure 5. Magnetic particle inspection shows multiple longitudinal cracks on pipe outer wall (inside oval).

Colonial Pipeline Company Petroleum Product Leak

9

Figure 6. View of the dent and crack from inside the pipe. . Inline Inspection Colonial records show that line 4 was excavated and examined around the two dents, the one that resulted in the 2015 leak and the other about 70 feet upstream, in 1994 and 2002 respectively. Magnetic particle inspection of the dents during the earlier excavations did not identify any cracks. Because the dents did not exceed the limits that would have required repairs, Colonial removed any large rocks that might have caused the dents, repaired the pipeline coating, and backfilled the excavations. Inline inspections conducted by Colonial from 1998 to 2014 showed no evidence of corrosion or cracking on line 4 along the Centreville right-of-way near the leak. The month following the accident, Colonial conducted an inline inspection using an ultrasonic crack-detection tool before cutting out the dented and cracked segment. This inspection detected the crack in the dent. Pipe Coating Examination Compromised coatings could expose the pipe to underground water, which could corrode these unprotected areas of the pipeline due to shielding from the cathodic protection current even when the overall cathodic protection potentials are adequate.6 NTSB investigators observed

6 The loss of the bond (adhesion) between a pipeline and its protective coating is commonly called disbondment. This could allow moisture to penetrate the gap between the surface of the pipe and the coating, creating an environment that may be corrosive. Under some circumstances, the pipeline’s cathodic protection current is prevented from reaching the exposed pipe surface under the disbonded coating (a phenomenon known as shielding); corrosion can occur on this unprotected pipe surface.

Colonial Pipeline Company Petroleum Product Leak

10

disbonded coating in the dented area of the leak, but they could not determine if the extent of the coating damage occurred before the leak or as a result of the leaking product. Environmental Impact

Colonial estimated that 4,000 gallons of hydrocarbon product were released in this accident.7 Cleanup crews used a vacuum truck to recover about 1,285 gallons of light non-aqueous phase liquid (LNAPL) product from the storm water outfall, and about 700 more gallons of LNAPL products were recovered in the week after the release.8 Cleanup crews excavated contaminated soil containing an estimated 350 additional gallons of product.

An environmental contractor installed dual-phase extraction systems in the excavated areas along the storm water drain system. An analysis of groundwater samples collected from various shallow monitoring points indicated that the extraction systems were reducing hydrocarbon contamination along the storm drain system. Colonial Pipeline Emergency Response The Colonial Emergency Response Plan requires an investigation of all reports of a product odor. Accordingly, on September 21, 2015, about 2:00 p.m., two Colonial inspectors responded to the report that the fire marshal’s office was investigating a gasoline odor near the pipeline right-of-way. The inspectors examined the right-of-way and found no soil discoloration, distinct areas of dead vegetation, colorful sheen on water, or odor of petroleum products. In addition, the Colonial Control Center told the inspectors that the pressures in lines 3 and 4 were normal, so the inspectors concluded that lines 3 and 4 were not leaking. They did not use any flammable-gas detection equipment during their inspections. The inspectors performed limited bar hole testing because the dry, hard soil and rock prevented them from effectively probing down to the buried pipelines. On September 21, 2015, Colonial received a second request for assistance at 8:53 p.m. after the fire marshal investigator reported that refined petroleum product was found in a nearby storm water retention pond. At 9:09 p.m., Colonial sent inspectors again, and this time Colonial shut down lines 3 and 4 as a precaution. About 10:00 p.m., two Colonial inspectors, a lead operator, and a senior operator arrived at the incident scene to assist the FCFRD. Colonial inspectors continued to inspect the pipeline right-of-way and attempted additional bar hole testing. They did not see or smell any product on their probe bars, but they continued to have difficultly probing deep enough to get close to the buried pipelines because of the rocky soil. The technicians did not use flammable vapor detectors to search for evidence of a hydrocarbon liquid leak in the bar holes; Colonial procedures did not require it. However, the FCFRD battalion chief showed the Colonial lead operator the drum containing the hydrocarbon product that had been collected earlier in the day from recovery site 1. The lead operator then notified Colonial management that product had been discovered.

7 The leaking pipeline transported several liquids. Although most of the product released was likely gasoline, other liquids transported through the pipeline might have escaped through the crack. 8 LNAPL is a liquid petroleum product that contains almost no water.

Colonial Pipeline Company Petroleum Product Leak

11

Colonial activated the Northeast District Response Team on September 22, 2015, about 1:00 a.m. Colonial staff in the Alpharetta control center reviewed alignment sheets, inline inspection data, static pressure analysis, and SCADA data to determine possible leak locations. A dig plan and priorities were being developed as Colonial response resources were arriving at the accident site that morning. This included the hazardous liquids cleanup contractor that took over cleanup efforts at the weir wall—a barrier at the storm water outfall pond (recovery site 1). Colonial employees told NTSB investigators that the company would not positively confirm its pipeline was the source of a hydrocarbon product leak until they could see liquid escaping from one of the two transmission pipelines. On September 23, 2015, at 9:30 a.m., Colonial employees saw liquid dripping from line 4, nearly 24 hours after the companywide response team was activated and about 2 days after the initial odor report. Colonial then assumed responsibility for the spill and began aggressive clean-up activities. Liquid Pipeline Small Leak Detection

Colonial informed the NTSB that four additional pipeline leaks had occurred in their pipeline system that were undetectable on the SCADA system. One leak occurred about 5 months before the Centerville accident, and the other three occurred in less than 6 months after the Centerville accident. These leaks were discovered by the landowner, aerial patrol contractors, or inspectors. On April 2, 2016, TransCanada reported a similar liquid pipeline failure involving a small leak near Freeman, South Dakota, that went undetected on its SCADA system.

Detecting small leaks in large hazardous liquid pipelines in a reliable, timely, and cost-effective manner has been a challenge for hazardous liquid pipeline operators and regulators. 9 The PHMSA party representative on the Centreville accident investigation said:

PHMSA is not aware of widely used industry technologies to detect small leaks similar to the one that occurred on Colonial’s line 4 in Centreville. However, PHMSA is taking a number of approaches through rulemaking, R&D [research and development], and taking part in standard development related to enhancing leak detection on hazardous liquid and natural gas pipelines. He further stated that he was not aware of any automated systems that are capable of detecting small leaks in large diameter, long-distance pipelines. Typically, SCADA systems use computer programs to calculate losses based on mismatches in liquid transfer quantities between process equipment. Considering all the process variables, typically, the SCADA system is not capable of accurately detecting actual leak rates below about 2 percent of the flow volume in a liquid pipeline.

9 Hazardous Liquid Leak Detection Techniques and Processes, Report No. DTRS56-02-D-70037-01, Dr. Jim C. P. Liou, PE; Robert J. Hall, PE; Mona C. McMahon, PE; General Physics Corporation—Elkridge, Maryland, 21075; Prepared for US Department of Transportation, Washington, DC; April 2003.

Colonial Pipeline Company Petroleum Product Leak

12

Colonial told the NTSB that the average flow volume in line 4 is about 15.6 million gallons per day, or about 10,800 gallons per minute. Considering a 2 percent detection limit, the smallest leak that the SCADA system could detect is about 216 gallons per minute. Assuming the recovered liquid volume is doubled to 8,000 gallons to account for unrecoverable product and a leak duration of 2 weeks based on when witnesses said they first smelled gasoline, the estimated leak rate would be 571 gallons per day, or 0.4 gallons per minute. This estimated leak rate, based on our outlined assumptions, represents only 0.004 percent of the average flow, which is about 550 times lower than the SCADA leak detection performance limit.

Technology and computer models are available to detect small hydrocarbon leaks. In 2015, the Environmental Protection Agency published new standards for underground storage tanks to help prevent and detect leaks. The new regulation requires facilities (such as gas stations and airport fuel supply systems) to have leak detection systems capable of detecting small leaks.10

PHMSA has conducted research on leak detection methods that can be practically applied to hazardous liquid transmission pipelines. In 2012, PHMSA completed a study of leak detection systems that was required by the Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011.11 The same year, PHMSA held a pipeline research forum to identify technological gaps and issues, including the advancement of leak detection methodologies. In April 2016, PHMSA published a notice of proposed rulemaking on leak detection that considered these studies and other available research.12 Until the technology is improved so that these small-flow-rate leaks in a long transmission pipeline can be detected in a cost-effective manner, the liquid pipeline industry will continue to rely on visual observation as evidence of a leak. By the time a small leak is detected in a buried pipeline, days or months may have passed since the leak began, resulting in the likelihood of significant environmental damage as occurred in the September 2013 crude oil pipeline leak in Tioga, North Dakota.13

Alternatively, leak detection devices could be installed along a pipeline at specific locations where inline inspection data confirm the pipe has been damaged, such as at a dent.14 The leak detection device could provide an early warning that a through-wall crack or corrosion damage in the pipeline has begun to leak. The operator could then take immediate corrective action to repair the damaged pipe before a large, environmentally damaging spill results. Therefore, the NTSB recommends that Colonial Pipeline Company revise the dent excavation evaluation procedure to require either (a) the repair of all excavated dent defects, or (b) the installation of a local leak

10 Title 40 CFR 280.41, Requirements for Petroleum UST Systems. 11 US Department of Transportation, Leak Detection Study – DTPH56-11-D-000001, Final Report no. 12-173 , Decem ber 10, 2012. 12 Safety of Gas Transmission and Gathering Pipelines Notice of Proposed Rulemaking (NPRM), Volume 81, No. 68, Federal Register, 20722, April 8, 2016. 13 A farmer discovered oil in his 7.3-acre wheat field. Investigators found that a 6-inch nominal pipe diameter crude oil pipeline leak had released more than 20,000 barrels of oil. State health officials estimated the cleanup could take up to 4 years, http://fuelfix.com/blog/2015/05/25/cleanup-of-oil-spill-at-nd-farm-to-take-2-more-years/ (accessed August 2016). 14 US Department of Transportation, Leak Detection Study – DTPH56-11-D-000001, Final Report no. 12-173 , Decem ber 10, 2012.

Colonial Pipeline Company Petroleum Product Leak

13

detection system at each location where a dent is not repaired, continuous monitoring for hydrocarbons, and prompt corrective action to stop a detected leak.

Laboratory Investigation Pipe Material Testing Testing at a third-party laboratory revealed that the chemical composition and mechanical properties were consistent with the original specifications (American Pipeline Institute 5L X52 steel) when the pipeline was installed.15 Crack Examination The outside surfaces of both dents, one that contained the leak and another that was located 70 feet upstream from the leak location, were examined using the magnetic particle inspection. For the pipe segment with the upstream dent that was removed as a precaution, no crack defects were identified in the dent or around its perimeter. Magnetic particle inspection of the dent in the downstream pipe segment that contained the leak revealed a network of short longitudinal crack indications within the dent parallel to the main crack. No crack indications were observed around the perimeter of the dent. The dent containing the crack was cut from the pipe segment for further evaluation. After removal, the main crack was opened to expose the fracture surfaces. Laboratory examination of the pipe fracture surfaces revealed the crack was 5.97 inches long at the outside diameter and 4.52 inches long on the inside diameter. The pipe thickness adjacent to the crack was between 0.266 and 0.270 inches; the nominal pipe wall thickness was 0.281 inches. The fracture faces exhibited features consistent with corrosion fatigue crack propagation, including ratchet marks, crack arrest marks, and intergranular facets. These features are consistent with inward crack propagation from multiple crack initiation sites on the outside of the pipe.16 (See figure 7.)

15 API Specification 5L, Specification for Line Pipe, 41st edition. American Petroleum Institute, Washington, DC, (1995). 16 Corrosion fatigue is the process in which metal fractures prematurely under the conditions of simultaneous corrosion and repeated cyclic loading at either lower stress levels or fewer cycles than would be required in the absence of the corrosive environment. Ratchet marks are the lines or the markings on a fatigue fracture surface that result from the intersection and connection of separate fatigue cracks propagating from multiple origins. Ratchet marks are parallel to the overall direction of crack propagation and are visible to either the unaided eye or at low magnification. Crack arrest marks are macroscopic progression marks on a fatigue fracture or a stress-corrosion cracking surface that indicate successive positions of the advancing crack front, typically appearing as either irregular elliptical or semielliptical rings, radiating outward from one or more origins. Crack arrest marks are also known as "beach marks." These marks are usually found on service fractures where the part is: (1) loaded randomly, (2) loaded intermittently, or (3) subjected to periodic variations in either the mean stress or the alternating stress. Intergranular facets are fracture features showing separated microscopic grains. These facets are also called "rock-candy," and these features are indicative of intergranular fracture in a polycrystalline metals or alloys.

Colonial Pipeline Company Petroleum Product Leak

14

Figure 7. Close-up of the fracture. Arrows show crack arrest marks, ratchet mark, and initiation sites.

Cracks on the fracture surface were observed propagating from exterior surface corrosion pits. Both the pits and the fracture surfaces contained corrosion products/deposits; and the elemental analysis of the material was consistent with an iron corrosion product. These cracks showed no significant branching. (See figure 8.)

Colonial Pipeline Company Petroleum Product Leak

15

Figure 8. Photomicrograph of fracture shows straight crack originating from corrosion pit (circled). An examination of the fracture surface with a scanning electron microscope revealed fatigue striations consistent with fatigue crack propagation. The fracture surfaces showed a mix of fracture features (faceted morphology and striations) that are consistent with corrosion fatigue cracks emanating from corrosion pits. Dent Evaluation The dent at the leak location was likely caused by a rock impinging on the underside of the pipeline. A detailed study of the dent showed its depth to be about 1.6 percent of the outer pipe diameter. The dent shape was documented by laser scanning and the shape data were incorporated into a finite element model to determine the stresses in the dent region. Based on the finite element model, the peak stress values after the dent was created exceeded the measured yield strength for the pipe, resulting in areas within the dent with high residual tensile stresses. These residual stresses made the pipeline more susceptible to externally initiated cracking, such as stress corrosion and corrosion fatigue. In addition, the change in geometry in the dent area created stress concentrations sufficient to enable fatigue cracking under cyclic loading conditions caused by pressure variations in the pipeline.

Colonial Pipeline Company Petroleum Product Leak

16

Pipeline Dent Acceptance Criteria After the accident, the inline inspection data from before and after the accident were reviewed and compared by a consultant hired by Colonial.17 The detailed study showed the depth of the dent at the leak location was about 1.6 percent of the outer pipe diameter and the upstream dent was 1.57 percent of the outer pipe diameter. Colonial did not repair either dent because they did not meet PHMSA’s repair criteria. PHMSA pipeline regulations do not specifically require dents having depths less than 6 percent of the pipeline diameter to be repaired unless there is an indication of metal loss, cracking, or a stress riser, or unless the dent affects pipe curvature at a girth weld or a longitudinal seam weld.18 The American Society of Mechanical Engineers (ASME) B31.4 piping design code is similar to the PHMSA requirements, including the threshold limits.19 In addition to the Centreville accident, Colonial reported to the NTSB that pipelines in Pelham, Alabama; Felixville, Louisiana; and Simpsonville, South Carolina (Hunter Road) also developed through-wall cracks in dented pipe. The depths of these dents were less than 2 percent of the pipe outer diameter and were located away from seam and girth welds. Colonial data indicate that through-wall cracks can develop in dents shallower than the current acceptable criteria of 6 percent of the pipe diameter. The Colonial pipeline failure data indicate that PHMSA’s criteria allowing dents with depths up to 6 percent of the pipe diameter to remain in the pipe is not a conservative approach from the safety view point. The curvature of the dent may be more important than dent depth because of stress concentrations, local plasticity, and local surface corrosion effects. Degraded or damaged coating at a dent may contribute to external pipe wall corrosion. Pipeline dents caused by a rock impingement with the rock present (a constrained condition) can have a different stress magnitude and distribution than dents where the rock is later removed (unconstrained conditions), due to system constraint. Unconstrained dents have been shown to fail faster because of higher local hoop stresses.20 Furthermore, the coating material used and the quality of the installation after the removal of an impinging rock can change the dent’s susceptibility to stress corrosion cracking.21 According to the NTSB’s finite element study of the dent at the leak location, the highest stress values were not found at the point of maximum dent depth, but in areas within the dent and near the dent edges having smaller radii of curvature due to the non-smooth nature of the dent. An experimental fatigue study (also including stress analysis through finite element modeling) was

17 L. Barkdull, M. Lewis. “Detailed Integrating ILI [Inline Inspection] Raw Data Review Corrective Action No. 6” Quest Integrity, L.L.C., Stafford, Texas. (January 20, 2016). 18 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 19 ASME B31.4-2012. “Pipeline Transportation Systems for Liquid and Slurries.” American Society of Mechanical Engineers, New York, New York. (November 20, 2012). 20 S. Tiku, V. Semiga, A. Dinovitzer, G. Vignal. “Full Scale Cyclic Fatigue Testing of Dented Pipelines and Development of a Validated Dented Pipe Finite Element Model.” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012). 21 J. Bratton, T. Alexander, T. Bubenik, S. Finneran, H.O. Heggen. “An Approach for Evaluating the Integrity of Plain Dents Reported by In-Line Inspection Tools,” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012).

Colonial Pipeline Company Petroleum Product Leak

17

conducted on the upstream dented pipe section by a Colonial contractor and similar observations were noted.22 PHMSA requires pipeline operators to develop a written integrity management program with pipeline integrity to be evaluated using internal inspection tool or tools capable of detecting corrosion and deformation anomalies including dents; gouges and grooves; pressure test[s]; external corrosion direct assessment; and other technology that the operator demonstrates can provide an equivalent understanding of the condition of the line pipe.23 The rule also requires pipeline operators to “prioritize anomalies … for evaluation and repair,” requiring pipeline repair in immediate, 60-day, or 180-day timeframes. Pipelines must be assessed every 5 years, although the operator can delay a single assessment up to 8 months beyond the 5-year deadline.24 The regulations allow exceptions to the 5-year assessment interval under limited circumstances.25 In addition to the current requirements, pipeline integrity management programs should incorporate all the effects of dents and anomalies when developing risk management strategies, even if those dents and anomalies are below the PHMSA thresholds for repair or replacement. As stated in the Postaccident Actions section later in this report, Colonial has already incorporated these factors into its integrity management program. The factors that impact effects of dents and anomalies include shape, curvature, and depth. In addition, local variations in the steel, coating type, coating adhesion, soil type, seasonal soil conditions, and impingement constraint may be important factors in the failure at or near dents. Therefore, the NTSB recommends that PHMSA work with pipeline trade and standards organizations to modify the pipeline dent acceptance criteria to account for all the factors that lead to pipe failures caused by dents, and promulgate regulations to require the new criteria be incorporated into integrity management programs. Most of the effort associated with evaluating a dent and returning the pipeline to service with or without a repair arises from the excavation work required to expose and examine the buried pipe. The various accepted dent repair methods allowed by the PHMSA pipeline regulations (such as installing a full encirclement sleeve) provide a permanent repair. Because myriad factors are involved in determining if and when an existing dent will develop a through-wall leak, the NTSB believes a more prudent approach is to proceed with a dent repair whenever a dented pipe is excavated. Therefore, the NTSB recommends that PHMSA require operators to either (a) repair all excavated dent defects, or (b) install a local leak detection system at each location where a dent is not repaired, continuously monitor for hydrocarbons, and promptly take corrective action to stop a detected leak. The NTSB also recommends that the Association of Oil Pipe Lines and the

22 S. Tiku, V. Semiga, A. Dinovitzer, G. Vignal. “Full Scale Cyclic Fatigue Testing of Dented Pipelines and Development of a Validated Dented Pipe Finite Element Model.” Proceedings of the 2012 9th International Pipeline Conference. Calgary, Alberta, Canada. ASME (2012). 23 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 24 Title 49 CFR 195.452, Pipeline Integrity Management in High Consequence Areas. 25 49 CFR 195.452(j)(4) sets requirements for variance from the 5-year intervals in limited situations.

Colonial Pipeline Company Petroleum Product Leak

18

American Petroleum Institute communicate to their members the findings of this report on the susceptibility of dents to cracking even when the dent is acceptable under current criteria. Postaccident Actions After the accident, Colonial developed a new abnormal operating procedure to improve the process and provide general guidance to all qualified personnel who perform aboveground inspections of facilities and rights-of-way for suspected pipeline leaks and inspections conducted after natural disasters. Colonial trained more than 47 employees on this procedure—including right-of-way inspectors, senior operators, and project inspectors. Third Party Consultant Colonial hired a consultant to analyze the inline inspection data from 17 prior inline inspections on the Colonial system. The consultant’s focus was on cracks in dents, particularly integrating ultrasonic crack tool inline inspection (ILI) data with magnetic flux leakage/caliper combination ILI tool data. Also, Colonial has developed a risk-based approach and prioritization process for dent screening based on the dent size and the pipe characteristics that place an emphasis on bottom-side, rock-caused dents. This independent third-party consultant’s analysis on line 4 identified 10 dent locations—including the original two at the leak location—where verification digs were scheduled to examine the condition of the pipe. As of January 2017, Colonial has completed nine digs. Of these nine, Colonial repaired two by cutting out the damaged portions and installing new pipe. The company confirmed fatigue cracks at three of the remaining seven; they repaired all seven using a Type B steel sleeve.26 Colonial added 40 additional shallow dents to the line 4 supplemental dig list; they have excavated 30 locations. The company has not detected any cracks in the dents. Of the 30 excavations for suspected dents, Colonial repaired 29 dents with a Type B steel sleeve; the company recoated at one location because there was no dent or indication of cracks.

Colonial also revised its dent repair criteria, redefined what constitutes an actionable anomaly, and issued an Asset Integrity Directive to project personnel to implement the new repair methodology change. The directive also addresses requirements for the control center personnel to plan for additional repair time and for pipeline availability schedule updates. Colonial incorporated these changes into a revised Pipeline Maintenance Manual and provided training to the Colonial Projects Group, which is responsible for managing and inspecting the Colonial dent repair program. Probable Cause The National Transportation Safety Board determines that the probable cause of the release of gasoline and other refined petroleum liquids from the Colonial pipeline was a through-wall

26 In accordance with ASME B31.4, a Type B sleeve consists of two half-pipe sections of steel that are placed around, and welded to, the exterior wall of a pipeline to provide a full encirclement, pressure-containing repair.

Colonial Pipeline Company Petroleum Product Leak

19

corrosion fatigue crack that developed at a dent in the pipeline due to residual and operational stress and exposure to the underground environment. Contributing to the accident were vague Pipeline and Hazardous Materials Safety Administration regulations that allowed the dent to remain in the pipeline. Also, contributing to the delay in recognizing the release were the limitations of pipeline Supervisory Control and Data Acquisition systems to detect small pipeline leaks. Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration Work with pipeline trade and standards organizations to modify the pipeline dent acceptance criteria to account for all the factors that lead to pipe failures caused by dents, and promulgate regulations to require the new criteria be incorporated into integrity management programs. (P-17-1) Require operators to either (a) repair all excavated dent defects, or (b) install a local leak detection system at each location where a dent is not repaired, continuously monitor for hydrocarbons, and promptly take corrective action to stop a detected leak. (P-17-2) To Colonial Pipeline Company: Revise the dent excavation evaluation procedure to require either (a) the repair of all excavated dent defects, or (b) the installation of a local leak detection system at each location where a dent is not repaired, continuous monitoring for hydrocarbons, and prompt corrective action to stop a detected leak. (P-17-3) To the Association of Oil Pipe Lines and the American Petroleum Institute: Communicate to your members the findings of this report on the susceptibility of dents to fatigue cracking even when the dent is acceptable under current criteria. (P-17-4) For more details about this accident, visit the NTSB investigations page, and search for NTSB accident identification number DCA15MP002.

Adopted: June 5, 2017

Colonial Pipeline Company Petroleum Product Leak

20

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a pipeline accident in which there is a fatality, substantial property damage, or significant injury to the environment. (49 US Code § 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 USC 1154(b).

FD07483 ｜ 2017_美国_RAB1701.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

24423 NTSB/RAB-17/01 National Transportation Safety Board Railroad Accident Brief BNSF Railway Train Derailment and Subsequent Train Collision, Release of Hazardous Materials, and Fire Casselton, North Dakota The Accident On Monday, December 30, 2013, at 2:10 p.m. central standard time, a westbound BNSF Railway Company (BNSF) train with 112 cars loaded with grain derailed 13 cars while traveling on main track 1 at milepost 28.5 near Casselton, North Dakota.1 The first car that derailed (the 45th car) fouled the adjacent track, main track 2. At 2:11 p.m. an eastbound BNSF train with 104 tank cars loaded with petroleum crude oil (crude oil), traveling on main track 2, struck the derailed car that was fouling the track and derailed two head-end locomotives, a buffer car, and 20 cars loaded with crude oil.2 After the collision, about 476,000 gallons of crude oil were released and burned. (See figure 1.) On the day of the accident, the weather was cloudy with a temperature of -1°F and winds from the north at 7 mph. No injuries were reported by residents or either of the train crews. The BNSF reported damages of $13.5 million, not including lading and environmental remediation. Parties to the investigation were the Federal Railroad Administration (FRA); the BNSF; the Brotherhood of Locomotive Engineers and Trainmen; the International Association of Sheet Metal, Air, Rail and Transportation Workers; Standard Steel; and Trinity Rail Car. Figure 1. Burning petroleum crude oil. (Photo by Dawn Faught) 1 All times in this brief are central standard time. 2 The nonplacarded cars between the engine and the placarded cars (carrying hazardous materials) are called buffer cars.

2 Accident Narrative The westbound BNSF train (grain train), G-RYLRGT9-26A, traveling on main track 1, had two head-end locomotives and one rear-end distributed locomotive power unit (DPU) in addition to the 112 cars that were loaded with grain.3 Four crewmembers were on board the train: an engineer, a conductor, a road foreman of engines conducting a check ride with the grain train crew, and a student engineer.4 At the accident site near Casselton, North Dakota, there were two main tracks, part of a traffic control system, with each track signaled for train movements in both directions. The tracks were parallel and oriented geographically in an east-west direction. The north track was designated main track 1, and the south track was designated main track 2. A signal maintainer, who was near the west switch of the Casselton crossover at milepost 28.5, noticed that some of the switch heater covers were damaged and told the grain train crew by radio.5 The damage to the covers, which were on the outside of the rails, suggested that the cause of the damage could be equipment hanging from a rail car and dragging along the track. During that conversation, the grain train experienced an emergency brake application when 13 cars (the 43rd through the 55th) derailed, at milepost 28.5. Data from the grain train’s event and video recorders showed that at 2:10 p.m. the grain train went into an emergency brake application.6 The first car that derailed was the 45th car, which fouled the adjacent main track 2, pulling the 44th car off the track. The 44th car caused one truck of the 43rd car to derail. At the time, the eastbound BNSF train loaded with crude oil, U-FYNHAY4-05T (oil train), with two head-end locomotives, a rear DPU, and one buffer car on either end of the 104 tank cars loaded with crude oil, was leaving the Jamestown Subdivision and entering the KO Subdivision at milepost 31.1, operating on main track 2 west of control point Casselton. The crew of the oil train consisted of an engineer and a conductor. At the time the grain train experienced the emergency brake application, the oil train was visible from the grain train. In figure 2, an image from the forward-facing camera of the grain train at the time of the emergency brake application shows the oil train in the distance.

3 A distributed locomotive power unit (DPU) controls locomotives in a train by command signals originating at the lead locomotive that are transmitted to the remote (rearward) locomotive. 4 A road foreman of engines is a railroad supervisor who monitors the performance of locomotive engineers. This includes participating in check rides with engineers and student engineers to evaluate their performance. 5 Track switch heaters blow hot air along the rails along the switch point area to melt snow and ice and prevent any buildup so the movement of the switch point is not obstructed. Switch heater covers fit on the outside of the rails to hold in, or channel, the hot air. 6 An emergency brake application is made when a train must be stopped in the minimum distance possible for the equipment. It may be made from the conductor’s brake valve or from the engineer’s brake valve on the locomotive. An emergency application may also occur when a brake pipe is broken or when air hoses between cars are disconnected when angle cocks are open. An emergency application is brought about by the very rapid exhausting of air pressure from the brake pipe, and it results in a correspondingly rapid buildup of brake pressure.

3

Figure 2. View from forward-facing video camera of grain train at the time the train went into emergency braking because the train had separated. After the grain train’s emergency brake application, the crew began to implement the safety protocols required after an emergency brake application: a crewmember immediately broadcast an emergency announcement to other trains in the area, using radio channel 70, and as the train was stopping the crew prepared to inspect the train to determine the reason the brake line air pressure had been lost (as shown on gauges in the locomotive cab) that resulted in the emergency stop.7 The safety protocol also required the train crew to walk along the train to ascertain the cause of the loss of pressure and to determine whether cars had derailed. However, the oil train crew did not hear the emergency announcement from the grain train because they were releasing track warrant authority to the train dispatcher on radio channel 39 assigned to the Jamestown Subdivision. This was in accordance with BNSF operating rules, which state that a train must release a track warrant after it leaves the limits of the warrant. After the grain

7 (a) The radio channels discussed in this report are assigned by the Association of American Railroads (AAR). AAR channel 70 is used for the KO Subdivision, and channel 39 is used for the Jamestown Subdivision. The grain train was operating on the KO Subdivision. (b) BNSF operating rules, the General Code of Operating Rules – Sixth Edition, and the BNSF’s Railway Air Brake and Train Handling Rules No. 5 require specific actions by train crew members when an emergency brake application occurs: Move the automatic brake valve handle to “Emergency” and wait until the train stops. After stopping, if operating conditions permit, place the automatic brake valve handle in “Release” to release the brakes, and help locate the air hose separation or other problem.

4 train crew made the emergency announcement, the road foreman of engines attempted to contact the oil train crew by radio to alert them to the emergency brake application. As the oil train proceeded on main track 2 toward the Casselton crossover, it passed the head end of the grain train, which was still traveling about 17 mph and was about 245 feet away from where it eventually stopped. About 33 seconds later, the oil train crew saw the derailed car on the track ahead, and the engineer made an emergency brake application. (See figure 3.) The lead locomotive of the oil train was traveling 42 mph when it struck the derailed grain car at 2:11 p.m., causing the oil train’s two locomotives, single buffer car, and the first 20 loaded tank cars to derail to the south of the track.

Figure 3. View from forward-facing video camera of oil train before collision. The front door of the lead locomotive of the oil train was damaged, preventing the crew from using that door. The crew escaped through the rear door of the lead locomotive and went east to the nearest highway-rail grade crossing, where they met emergency responders. In total, about 476,000 gallons of crude oil were released from derailed tank cars that were punctured, from those with damaged bottom valves and top fittings, and from those that ruptured during the fire. The spilled crude oil created pools that caught fire. Other derailed tank cars eventually ruptured as the pool fires weakened the tank steel and increased the internal pressure. The resulting thermal tears released superheated crude oil vapor that immediately erupted into violent fireballs above the tank cars. (See figure 1.)

5 Emergency Response At 2:11 p.m. the local fire department received a 911 call reporting a train derailment west of Casselton, North Dakota. A second call to the Red River Regional Dispatch Center at 2:12 p.m. reported a train derailment and fire. Shortly thereafter, Cass County established a unified command for the incident that included the Cass County Sheriff’s Department and the Casselton Fire Department. At 4:14 p.m., the Cass County sheriff ordered a 3/4-mile isolation perimeter around the accident site. The unified command estimated that about 1,400 people had voluntarily evacuated. Emergency responders established a safe perimeter and allowed the tank cars to burn. At 5:32 p.m., the tactical operations center, which was coordinating the emergency response, verified that the voluntary evacuation had been expanded to include a western portion of the city. After the grain train stopped, the crew walked to a nearby highway-rail grade crossing where they were met by the assistant fire chief of the Casselton Fire Department. The train crew then assisted the emergency responders by pulling the nonderailed west portion of the oil train cars away from the burning derailed cars. The cars were moved about 1/4 mile west using the DPU at the end of the train. About 30 to 45 minutes after the grain train crew completed moving the first set of cars away from the fire, the assistant fire chief of the Casselton Fire Department met the grain train crew at the rear locomotive (the DPU) of the oil train and asked if additional tank cars closer to the derailment area could be moved. The student engineer accompanied the assistant fire chief to couple the train back together and make an additional separation between the tank cars near the derailed burning tank cars. The student engineer borrowed fire-protective clothing, walked to a location less than 10 cars away from the fire, and uncoupled the cars to the east. The engineer then pulled about 20 tank cars 1/4 mile west away from the fire. At 7:11 p.m., the voluntary evacuation order was expanded to encompass all of Casselton, because the wind was coming from the west, and a weather system was forcing smoke and combustion products to the ground. Near the end of the evacuation, the unified command estimated that the number of evacuees had increased to about 1,560 residents. The next day at 3:00 p.m., the unified command lifted the voluntary evacuation recommendation, and residents returned to their homes. Method of Operations Train movements on the KO Subdivision are governed by signal indications of a traffic control system. Train movements on the Jamestown Subdivision are governed by a track warrant control/automatic block system. The Jamestown Subdivision train dispatcher grants track authority by mandatory directive, which means authorities are dictated by the dispatcher and copied by the train crew on standard track warrant forms. BNSF operating rules state that when a train exits track warrant control territory, the crew must release its authority by communicating its location to the train dispatcher. The oil train crew made the required communication to the Jamestown Subdivision dispatcher using radio channel 39. According to signal data, about 2:10 p.m. the oil train occupied the track east of the controlled signal displaying a flashing yellow over red aspect at

6 control point 30 on main track 2.8 At this point, the oil train was about 1 1/2 miles from the point of collision with the grain car. Hazardous Materials The oil train was a unit train with 104 tank cars containing petroleum crude oil that were in positions 2 through 105.9 The train was designated a key train placarded with United Nations identification number 1267, signifying petroleum crude oil, which is a hazard Class 3 flammable liquid.10 The shipper classified the crude oil as Packing Group I, meaning that it poses the greatest degree of danger during transportation.11 Commercial transport of petroleum crude oil is subject to the requirements of the Hazardous Materials Regulations in Title 49 Code of Federal Regulations (CFR) Parts 100–185.12 Twenty hazardous materials tank cars derailed in this accident. These tank cars were in positions 2 through 21 in the train. All of the 20 derailed tank cars were general service US Department of Transportation (DOT) specification 111 (DOT-111) tank cars that contained petroleum crude oil from the Bakken region of North Dakota.13 Eighteen of these tank cars were breached and released product. (See figure 4.) The damages included 13 tank cars with torn or punctured heads and shells, 3 with thermal tears, 10 with damaged valves and fittings, and 3 that released product from bottom outlet valves. Some tank cars had more than one breach of the types listed here.

8 The BNSF flashing yellow over red aspect is an “Approach Medium” signal, which means trains are to proceed prepared to pass the next signal not exceeding 40 mph and be prepared to enter diverging route at prescribed speed. 9 A unit train carries the same commodity in all cars, and all cars are shipped from the same origin to the same destination. 10 (a) A key train has speed restrictions and other operating criteria and carries any of the following: 1 or more car loads of spent nuclear fuel or certain types of high-level radioactive waste; 1 or more loaded tank cars of poison or toxic inhalation hazard material, anhydrous ammonia, or ammonia solutions; 20 or more car loads (including intermodal portable tank loads) of any hazardous material. (BNSF Hazardous Materials Instructions for Rail) (b) Title 49 CFR 173.120 defines a Class 3 flammable liquid as “a liquid having a flash point of not more than 60.5°C (141°F), or any material in a liquid phase with a flash point at or above 37.8°C (100°F) that is intentionally heated and offered for transportation or transported at or above its flash point in a bulk packaging,” with certain exceptions. Class 3 flammable liquids include petroleum crude oil, aviation and diesel fuel, kerosene, and paint, and many others. 11 The Packing Group of a hazardous material is based on the degree of danger it presents: Packing Group I - Great Danger, Packing Group II - Medium Danger, Packing Group III - Minor Danger. 12 See 49 CFR 171.1, Applicability of Hazardous Materials Regulations to persons and functions. 13 The specification DOT-111 tank car is a nonpressure tank car commonly used in North America to transport a variety of hazardous materials and nonregulated commodities. DOT-111 tank cars have a relatively thin 7/16-inch minimum shell thickness. DOT-111 tank cars are not puncture resistant, and they lack top and bottom fittings protection and thermal protection systems.

7

Figure 4. Derailed tank car with large thermal tear. Event Recorder Data The grain train had three event recorders that were undamaged and provided data from the two locomotives at the head end and the DPU. From the oil train, event recorder data from only the DPU locomotive could be retrieved. The remaining two event recorders, in the lead locomotives, were damaged by the severe thermal conditions, and fire destroyed the nonvolatile memory.14 Investigators retrieved video recorder images from the forward-facing video recorders on both trains. The video from the grain train was downloaded from the undamaged GE Lococam on the lead locomotive. Video from the oil train had been transmitted wirelessly when the emergency brake application was initiated; the on-board image recorder was destroyed in the postimpact fire.15

14 Nonvolatile memory is a type of solid state memory that does not require electric power to retain information. 15 When a BNSF train experiences an emergency brake application, its on-board video recorders automatically send a burst of data, generally the 30 seconds before the emergency brake application. For additional information on the destroyed nonvolatile memory, see the Event and On-Board Image Recorders Factual Report in the NTSB docket by visiting NTSB Docket and searching for NTSB accident identification number DCA14MR004.

8 Tests and Research Investigators found an axle assembly in the wreckage that was broken in half. On-scene examination suggested that the axle had fractured at a void along the longitudinal center axis.16 The axle was sent to the National Transportation Safety Board (NTSB) materials laboratory for further examination. The results of the examination are discussed later in this section. The Casselton accident is one of several North American crude oil and ethanol train derailments that have resulted in the release of large volumes of flammable liquids.17 These accidents raise concern for the safety of people, property, and the environment and led the NTSB to conduct a study to quantify the expected stopping distance of a train as a function of train mass, train speed, track grade, train braking type, emergency or full service brake application, and the use of locomotive brakes (released or applied, as applicable) or dynamic brakes.18 The study is in the appendix of this report. Broken Axle The broken axle was an Association of American Railroads (AAR) Class K axle manufactured for freight car service.19 The wheels mounted on the axle were stamped with a manufacturing date of January 2010. The end of the broken axle was stamped with “SSD 1102 7A1 E 0912 F,” indicating it was made by Standard Steel LLC (Standard Steel) in November 2002. According to the AAR Manual of Standards and Recommended Practices, (MSRP) Specification M-101, Appendix C, dated May 1, 1998, AAR serial number designations contain a heat identification number that is stamped on the end of the axle.20 The term “heat” refers to a specific pour of molten steel used to cast the axles, and heat numbers identify production runs for quality control. The broken axle’s heat number was E0912. The NTSB performed an ultrasonic inspection of the axle to characterize the dimensions of the void. Figure 5 shows the two broken axle segments after testing, indicating the size and location of the exposed, confirmed void at the fractured ends of both axle segments (shown in blue). The figure also shows three other indications found by the inspection, which at the time

16 A void is a manufacturing defect in an otherwise solid material that can lead to premature failure of a component. 17 Other accidents include Lac Mégantic, Quebec, Canada (DCA13SR006); Cherry Valley, Illinois (DCA09MR006); and Mount Carbon, West Virginia (DCA15FR005). For more details about these accidents, go to NTSB Docket and search for the NTSB accident identification numbers listed. 18 National Transportation Safety Board, Train Braking Simulation Study (Washington, DC: National Transportation Safety Board, 2015). NTSB Train Braking Study. Technical representatives from the BNSF, Trinity Rail Car, Standard Steel, the Brotherhood of Locomotive Engineers and Trainmen, the Federal Railroad Administration (FRA), and Sharma & Associates Inc. reviewed draft versions of this study and provided valuable feedback regarding railroad industry operations. Their technical comments were used to revise the study to account for physical constraints (based on locomotive tractive effort and dynamic braking limitations) as well as for operational considerations. 19 The AAR is the trade association that sets railroad policy, conducts research, sets standards, and advances technology for its member railroads. The AAR is responsible for the interchange rules and the billing for freight car repairs and repair databases. 20 Association of American Railroads, Manual of Standards and Recommended Practices (Washington, DC: AAR, 1998).

9 were potential voids, all of which were located closer to the wheel seat ends of the axle segments (shown in green).

Figure 5. Axle segments after nondestructive ultrasonic testing. The internal centerline void on the longer axle segment, after removal of the fracture surface (about 1 inch deep), is shown in figure 6. On the cut plane, the void measured 1.25 inches by 0.75 inches. 0.

10

Figure 6. Centerline void on axle segment. After the fracture surface was cleaned, fracture surface features indicative of fatigue and overstress were visible. (See figure 7.) Examination using a scanning electron microscope confirmed fatigue striations propagating from the internal void. The dashed line is the boundary between the fatigue and the overstress areas of the fracture.

11 Figure 7. Surface of axle fracture. The fractured axle halves were laser scanned to develop a three-dimensional geometrical model of the axle including the void. This geometrical model and added details from specification drawings were combined to create a model of the axle and wheel assembly; and the model was analyzed using finite element modeling to evaluate the stress distribution in the axle. The geometry of the void in the axle is shown in figure 8. The model of the axle/wheel assembly was subjected to loads that result in a bending deformation as shown in figure 9. Under a bending deformation like this, the maximum tensile stress in the axle is expected to be at the top surface of the axle, but the sharp corner in the void created a stress concentration so that the maximum tensile stress would occur at the edge of the void, as shown in figure 10. The modeling showed that the internal void caused a concentration of stress substantially higher than the expected bending stress in the axle and that this stress was high enough to initiate fatigue cracking. The location of this calculated stress concentration was consistent with the region at the edge of the void where fatigue cracking initiated.

Figure 8. Geometry of the axle with the internal void defect.

12

Figure 9. Computer model of deformed shape of bent wheelset. (Deformation magnified 50 times.)

Figure 10. Cutaway view showing bending stress contours (in pounds per square inch). Investigators reviewed BNSF documentation and mechanical maintenance history, which showed that wheel axle assemblies on two of the derailed cars from the grain train had been replaced within the previous 4 years. Records also showed that the axle bearings and wheels on the broken axle had been installed, or remounted, in April 2010 at the BNSF wheel shop in Havelock, Nebraska. At that time, the axle was nondestructively tested in accordance with

13 MSRP-659, which required only magnetic particle inspection.21 This type of test reveals only cracks and flaws on or near the surface, and it cannot reveal voids or other defects that may be present below the surface of the material. Voids, like those found in the broken axle, can be found only by a test that detects internal flaws, such as ultrasonic inspection.22 The AAR 1998 MSRP in place at the time of the 2002 axle manufacture prescribed an inspection method that was not capable of detecting the internal void. The MSRP was updated in 2009 to require both axial and radial (along the length of the axle) ultrasonic inspections to better locate internal voids. However, there was still no requirement for wheel shops to conduct this type of inspection of secondhand-use axles.23 The NTSB concludes that had the broken axle been subjected to more thorough nondestructive testing when its bearings and wheels were remounted in 2010, the void would likely have been found, and the axle would not have been returned to service. On April 7, 2014, the NTSB issued a safety recommendation to the AAR to address the immediate need for more thorough nondestructive testing of secondhand-use railroad axles: R-14-10 Require secondhand-use railroad axles to undergo nondestructive testing specifically designed to locate internal material defects in axles. The AAR incorporated this recommendation into its requirements; therefore the NTSB classified this safety recommendation “Closed—Acceptable Action” on September 26, 2014. While on scene on January 3, 2014, NTSB investigators notified Standard Steel that an axle from the Standard Steel foundry had been involved in a railroad accident. Investigators later worked with Standard Steel to determine how many similar axles might still be in use. Because the axle had fractured at a void, which is created during the manufacturing process, it is possible that other axles manufactured in the same pouring of metal into a fixed array of molds could have similar defects. Standard Steel told the NTSB that the axle had been manufactured in November 2002 in heat E0912, which was consistent with the information on the axle (SSD 1102 7A1 E 0912 F). On January 14, 2014, the AAR contacted Standard Steel to inquire about the status of axles produced from heat E0912. Standard Steel responded that the wheels on the broken axle were Standard Steel wheels manufactured in January 2010, confirming that the axle, cast in 2002, was a secondhand-use axle. This exchange of information about the axles from heat E0912 was the

21 (a) MSRP S-659 contains the mandatory interchange rules governing wheel shop practices. (b) Magnetic particle inspection is a method for testing ferromagnetic materials, such as steels and cast irons. 22 Ultrasonic inspection uses high-frequency acoustic energy to detect internal flaws. Ultrasonic testing is used primarily to find internal defects, whereas axle fatigue cracks more typically arise from surface and subsurface defects, where magnetic particle inspection is more appropriate. Debris impacts and bad bearings tend to create initiation sites on the axle surface where fatigue cracks grow from the outside inward. In this case, there was an internal defect where the crack grew from inside outward. Also, magnetic particle inspection is somewhat easier and faster than having a technician rub a transducer with couplant (substance that enhances sound transmission from the transducer to the test part) all over an axle. 23 Secondhand-use describes an axle that is reused or requalified. This is a common industry practice when new wheels or bearings are installed on axles that previously have been in service.

14 beginning of an ongoing collaborative effort by the AAR and Standard Steel that continued through May 2015. On January 15, 2014, Standard Steel gave the AAR a list of the 48 axles in heat E0912 and where each axle had originally been shipped. Standard Steel also described to the AAR how to identify the axles. On January 17, 2014, the AAR requested a list of axle serial numbers from heat E0912 so it could search its Comprehensive Equipment Performance Monitoring (CEPM) system for axles that had been through a wheel shop and remounted. On January 21, 2014, the AAR informed Standard Steel that no serial numbers from heat E0912 were in its CEPM system. On January 23, 2014, the AAR issued Maintenance Advisory MA-144 to railroads and wheel shops asking them to inspect axle serial numbers to identify and remove from service the remaining axles in heat E0912.24 Beginning on February 14, 2014, Standard Steel contacted car manufacturers in an ongoing and sustained effort requesting a list of railcars on which axles from heat E0912 may have been installed. From the responses, Standard Steel compiled a list of 1,691 cars that might have been equipped with one or more of the axles and sent the information to the car manufacturers. On March 4, 2014, the AAR’s Wheels, Axles, Bearings, and Lubrication Committee discussed performing radial ultrasonic testing on secondhand axles and the CEPM reporting of axle serial numbers when remounting secondhand axles. On March 14, 2014, the AAR responded to a request from Standard Steel with the information that according to its car repair billing records for wheel set removals, 233 of the 1,691 cars that might have been built with axles from heat E0912 had had all four axles replaced since they were built, and therefore were no longer suspect. On March 17, 2014, Standard Steel requested that the AAR provide a list of the owners of the remaining 1,458 cars so that owners could check billing records on those cars. The AAR provided the list the next day. On March 24, 2014, NTSB investigators visited Standard Steel’s facility to further discuss recent efforts by Standard Steel and the AAR to identify and locate rail cars with axles from heat E0912. All agreed to continue the collaborative effort in the hope of finding additional axles. This effort identified a total of 531 cars that might have axles from heat E0912 and 1,160 cars that did not (including the 233 noted above). On June 16, 2014, the AAR issued a supplement to MA-144 (Supplement 1), listing the 531 cars that might have axles from heat E0912 and needed to be field tested.25 On April 25, 2015, Railinc, on the AAR’s behalf, issued a supplement to its Early Warning notice #5295.26 The supplement listed the 104 cars that were restricted from interchange by #5295,

24 Association of American Railroads, Maintenance Advisory C-12095, MA-144, Inspection & Removal of Suspect Class K (6-1/2 X 9) Axles, January 23, 2014 (Washington, DC: Association of American Railroads, 2014). 25 Association of American Railroads, Maintenance Advisory C-12095, MA-144, Inspection & Removal of Suspect Class K (6-1/2 X 9) Axles Supplement 1, June 16, 2014 (Washington, DC: Association of American Railroads, 2014). 26 Railinc is a wholly owned for-profit subsidiary of the AAR that maintains rail industry databases, applications, and services information.

15 which is still in effect.27 However, only 2 of the 104 cars have not been physically located; they are not easily accessible because they are in deep storage and not likely to enter service or interchange with other railroads. By the end of December 2016, 10 additional axles had been identified, primarily through AAR-approved wheel and axle shop inspections resulting from the MA-144 advisory. The axles were sent to Standard Steel’s facility for examination and ultrasonic testing. Five of the axles tested had no indications of internal voids. The other five axles did have indications, but the axles met the acceptance criteria in AAR M-101.28 BNSF Postaccident Actions In February 2014, the BNSF began radial ultrasonic testing of all secondhand axles at its Havelock wheel shop. This action was taken before Safety Recommendation R-14-10 was issued to the AAR on April 7, 2014. In March 2014, the AAR, along with its member Class I railroads, including the BNSF, entered into a voluntary agreement with the US Secretary of Transportation that included commitments the railroads would make. Those commitments include the following, which had been stated in a February 21, 2014, letter from the Secretary of Transportation to the AAR President and Chief Executive Officer:29  Speed reduction to 40 mph for hazardous materials carried in DOT-111 tank cars traveling through high-threat urban areas (effective July 1, 2014)  Increased trackside safety technology on crude oil routes by installing additional hot bearing detectors spaced at least 40 miles apart (effective July 1, 2014)30  Increased the frequency of rail flaw inspections (effective March 25, 2014)  Implemented the following additional emergency response actions:  Allocated $5 million for crude oil-specific hazardous materials training  Developed an inventory of emergency response resources along crude oil train routes

27 Restricted from interchange means that the cars on Early Warning notice #5295 cannot be moved from one railroad to another, which uses an interchange track between railroad properties. 28 Association of American Railroads, Manual of Standards and Recommended Practices, Section G, Wheels and Axles, M-101, 16.7, Inspection (Washington, DC: Association of American Railroads, 2009), 8. 29 Letter from the US Secretary of Transportation to the AAR and its railroad subscribers, February 21, 2014: 02/21/2014 Letter to AAR. 30 A hot bearing detector, also called a hot box, is a heat-sensitive device that measures the relative temperature of passing journal bearings.

16  Identified locations for staging emergency response equipment  Identified contacts for community notification To implement these voluntary agreements, the BNSF developed geographic response plans for certain routes and increased geometry car operations on key train routes from once a year to twice a year. In July 2014, the BNSF entered into an agreement with the Brotherhood of Railway Carmen that included the following:  Increasing the number of qualified mechanical inspectors  Inspecting crude oil unit trains at origination31  Expanding the BNSF’s employment of about 17 mobile [car] inspectors who inspect, repair, and maintain equipment at originating crude oil terminals in the Bakken region to include crude oil unit train origination points in Wyoming and Colorado By the end of 2014, the BNSF had trained more than 8,500 local emergency responders and sponsored the training of 713 firefighters at the Transportation Technology Center, Inc. (TTCI), in Pueblo, Colorado. The BNSF sponsored 500 firefighters to attend TTCI training in 2015. Effective March 25, 2015, the BNSF took voluntary action to reduce or restrict to 35 mph the authorized operational speed for all key trains through population centers of 100,000 or more people. The BNSF conducts remote audits of event recorder downloads to ensure compliance with these new operational changes. The BNSF has increased the use of trackside safety technology by adding hot box detectors spaced 10 miles apart near critical waterways. Also, the company has improved the handling of indications from wheel impact load detectors (WILD), which monitor the health of in-service railcar wheels.32 The improved procedures treat a level II readout of 120−140 kips the same way a more serious level I indication is treated, and they require that the car be set out of the train immediately.33 Additionally, the BNSF has increased rail detection frequency along critical waterways to 2 1/2 times the frequency required by the FRA.

31 Title 49 CFR 174.9 requires a hazardous materials acceptance inspection. 32 (a) A wheel impact load detector (WILD) measures impact loads, indicates wheel tread defects, and signifies damage protection. (b) A WILD indication is a measurement based on the reading from WILD equipment. A level 1 indication refers to those cars (wheels) that measure more than 140 kips, indicating that there is something seriously wrong with the impact level that the wheel is making. The BNSF requires the train to be stopped and the car and wheels to be inspected, and depending on the inspection results the train is given a slow order or the car is set out of the train. A level 2 indication is less serious than a level 1, and it refers to those cars that measure greater than or equal to 120 kips but less than 140 kips. 33 A kip is a unit of force equal to 1,000 pounds.

17 The BNSF also has taken the following actions on equipment health:  All wheels with WILD indications greater than 90 kips on key trains will be repaired at the next available car repair location.  New composite alarm/threshold: A wheel on a key train with (1) WILD indications equal to 70 kips and (2) one warm bearing outlier (K value greater than 2.5) will be repaired at next available car repair location.34  Hot journal bearings, or “hot wheels” (HW): A key train meeting “hot wheels 1” (HW1) (stop and inspect), HW2 (running air brake release), or HW3 (bad order to destination) criteria will be monitored in real time, and the appropriate action will be taken based on hot-wheel defect criteria.  Wheel quality: Defect criteria for car inspection based on more restrictive AAR condemnable thresholds for thin rims, thin flange, and shelled tread.  Installation of 5 additional cracked-wheel detectors, for a total of 10, on key routes.  Research on vertical split rims (wheels): Destructive testing for 90 kips and greater wheels off BNSF key trains to understand correlation between kip level and propagation of subsurface horizontal wheel cracks.  TTCI tank car/track dynamics research: Incremental funding for TTCI to model the interaction between loaded tank cars and certain track irregularities that lead to high wheel/rail forces and derailments. Before the Casselton accident, BNSF policy was that when a track occupancy indication was left in two consecutive signal blocks behind a key train, that train was required to stop and be inspected before any further movement. A track occupancy indication is a display on a train dispatcher’s screen that shows that a train is in a specific signal block. When the train leaves the signal block, the display should indicate that the train is in the next signal block and no longer in the previous block. Thus, in the case that a dispatcher’s screen display indicates that a key train is occupying two consecutive signal blocks, the dispatcher knows that a train is not in the first block and another condition is causing the track occupancy indication. Because the track occupancy indication was not displayed before the train entered the signal block, the most likely reason for the indication is that the passage of the train caused a broken rail or other track condition that could adversely affect the safe passage of the next train. Because the track condition could have been caused by a defect in the train, such as a broken wheel, the train needs to be stopped and inspected to find out what caused the problem. After this accident, the BNSF changed this procedure to require a key train to be stopped and inspected for any defects after one track-occupancy indication is left behind the train in a signal block.

34 K value is a normalized temperature value of the bearing relative to the bearings on the same side of the train in which it is traveling. The value “k” is calculated by dividing the range between actual bearing temperature and the median bearing temperature for a group of data by the interquartile range for the same group of data.

18 Pipeline and Hazardous Materials Safety Administration and Federal Railroad Administration Actions The Pipeline and Hazardous Materials Safety Administration (PHMSA), in coordination with the FRA, published a final rule, HM-251, Hazardous Materials: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains, Federal Register 80, no. 89 (May 8, 2015): 26644, adopting safety improvements in tank car design standards, operational requirements, and notification requirements for tank cars used in trains defined as high- hazard flammable trains (HHFT).35 The rule also includes new requirements for a sampling and classification program for unrefined petroleum-based products. With respect to tank car and train requirements, the rule specifically provides for the following:  Enhanced standards for new tank cars, which could include such tank car enhancements as thicker shell material, full-height head shields, jackets, thermal protection, and fittings protection  Existing tank cars phased out or retrofitted to an equivalent level of safety  Rail route safety and security risk assessment and alternate route analysis  Reduced operating speeds  Enhanced braking Fixing America’s Surface Transportation Act The President signed the Fixing America’s Surface Transportation Act (FAST Act), Pub. L. 114-94, on December 4, 2015. Division A, Title VII, Subtitle C of the FAST Act affects the implementation of PHMSA rule HM-251.36 The PHMSA final rule required that by January 1, 2021, each railroad carrier that operates high-hazard flammable unit trains composed of at least one tank car loaded with a Packing Group Me material, at a speed exceeding 30 mph, must meet the electronically controlled pneumatic (ECP) braking capability requirements. Section 7311 of the FAST Act requires the Comptroller General of the United States to conduct an independent study and testing of ECP brake systems. This study evaluated ECP brake systems, pilot program data, and DOT research and analysis on the costs, benefits, and effects of ECP brake systems.37

35 High-hazard flammable train (HHFT) means a single train transporting 20 or more loaded tank cars of a Class 3 flammable liquid in a continuous block, or a single train carrying 35 or more loaded tank cars of a Class 3 flammable liquid throughout the train consist. 36 FAST Act. Accessed October 6, 2016. 37 Government Accountability Office, Train Braking: DOT’s Rulemaking on Electronically Controlled Pneumatic Brakes Could Benefit from Additional Data and Transparency, GAO-17-122, (Washington, DC: US Government Accountability Office, 2016). GAO ECP Braking Report.

19 Sections 7301–7310 of the Act contain further mandates to enhance tank car safety for all flammable liquid commodities regardless of train composition and to provide for safer and more efficient emergency responses to accidents involving trains transporting hazardous materials. Protecting Train Crews from Hazardous Materials The placement requirement of hazardous material cars (placarded cars) in trains is contained in 49 CFR 174.85. The regulation specifies that “when train length permits, [a] placarded car may not be nearer than the sixth car from the engine or occupied caboose,” meaning that if there are enough cars in the train to put five cars between a placarded car and the locomotive or occupied caboose. However, when the train is not long enough to allow for a five-car buffer, trains may move with only a single buffer car. Railroads commonly use this exception to operate unit trains carrying hazardous materials with only one no placarded (buffer) car separating placarded cars from locomotives and occupied cabooses, in contrast to the requirement for five buffer cars separating placarded cars from locomotives and occupied cabooses on mixed-freight trains.38 In the Casselton accident, the placement of cars in the oil train consist complied with the current PHMSA interpretation of § 174.85. Figure 11 is an aerial photograph taken after the collision.

Figure 11. Aerial view of of oil train after collision. (PHMSA photo) Although unit trains transporting nonhazardous commodities such as coal and grain have existed for many years, 49 CFR 174.85 does not specifically address unit trains containing a single hazardous materials commodity. The FRA, PHMSA, and the railroads have recognized that buffer

38 The NTSB is aware of the development and use of liquefied natural gas (LNG) tender cars and is not commenting on those as part of this discussion.

20 cars should be required on unit trains transporting hazardous materials to comply with the intent of 49 CFR 174.85. Since a hazardous materials unit train is composed of cars loaded with the same hazardous commodity, additional nonplacarded cars must be added to the train to provide a buffer between occupied railcars and locomotives and the hazardous materials. The FRA, PHMSA, and the railroads have interpreted the regulation to allow use of a single buffer car between the locomotives and the first placarded car, and those trains may travel across the country with only one buffer car required.39 Conversely, a train of mixed freight cars with one hazardous materials car must have a five-car buffer between that car and the occupied locomotives unless the train is too short and does not have enough cars to allow for a five-car buffer. Previous NTSB Actions The practice of using a single buffer car in unit trains transporting hazardous materials has been a concern to the NTSB since the October 20, 2006, derailment of a Norfolk Southern Railway Company train transporting ethanol in New Brighton, Pennsylvania. The accident raised questions about the number and placement of buffer cars on trains transporting hazardous materials. The New Brighton accident train was a unit train consisting of 3 locomotives pulling 3 empty freight cars (buffer cars) followed by 83 tank cars loaded with denatured ethanol, a flammable liquid. Twenty-three of the tank cars, cars 23 through 45 from the head end of the train, derailed. Because the first car to derail was the 23rd car from the head end of the train, the train crew was not endangered by the ethanol release, and therefore the placement of the buffer cars relative to the ethanol tank cars in the accident train was not a factor in the crew’s protection in the accident. In contrast, at Casselton, there was only one buffer car between the head-end locomotives and the first tank car that derailed and burned. As a result of the New Brighton investigation, the NTSB issued Safety Recommendations R-08-12 to the FRA and R-08-13 to PHMSA: R-08-12 Assist the Pipeline and Hazardous Materials Safety Administration in its evaluation of the risks posed to train crews by unit trains transporting hazardous materials, determination of the optimum separation requirements between occupied locomotives and hazardous materials cars, and any resulting revision of 49 Code of Federal Regulations 174.85. R-08-13 With the assistance of the Federal Railroad Administration, evaluate the risks posed to train crews by unit trains transporting hazardous materials, determine the optimum separation requirements between occupied locomotives and hazardous materials cars, and revise 49 Code of Federal Regulations 174.85 accordingly. Both of these safety recommendations are currently classified “Open—Acceptable Response.”

39 Director of the PHMSA Office of Hazardous Materials Standards, March 29, 2007, letter, reference number 06-0278, to the NTSB Investigator-In-Charge of the October 20, 2006, derailment of a Norfolk Southern Railway Company train transporting ethanol in New Brighton, Pennsylvania. See National Transportation Safety Board, Derailment of Norfolk Southern Railway Freight Train 68QB119 with Release of Hazardous Materials and Fire, New Brighton, Pennsylvania, October 20, 2006, RAR-08/02 (Washington, DC: National Transportation Safety Board, 2008).

21 The FRA stated in its latest response to Safety Recommendation R-08-12 on May 23, 2014, that it has reviewed 49 CFR Part 174, Carriage by Rail, which applies to rail carriers that accept and transport hazardous materials by rail, and identified regulations that may be outmoded, ineffective, insufficient, or excessively burdensome. Among those regulations identified as potentially ineffective is the requirement for a single buffer car in a train where train length does not permit additional buffer cars, such as a unit train. The FRA stated that it and PHMSA were deliberating the best path forward to modify, streamline, expand, or repeal regulations in 49 CFR Part 174, including the option of a rulemaking action to address Safety Recommendation R-08-12. PHMSA provided a similar response to Safety Recommendation R-08-13 on July 16, 2013. On November 5, 2015, the Hazardous Materials Issues Working Group of the FRA Railroad Safety Advisory Committee agreed upon Task No. 15-04, in participation with PHMSA, to consider revisions to the Hazardous Materials Regulations, 49 CFR Parts 100–185, to enhance rail safety. Among the Working Group proposals are the train placement and buffer car requirements of 49 CFR 174.85 to provide unit trains with increased separation distance between placarded tank cars and occupied locomotives. The FRA and PHMSA have planned to incorporate draft rule revisions for Part 174 into an upcoming Notice of Proposed Rulemaking. Eight years have passed with no action on Safety Recommendations R-08-12 and R-08-13 from the New Brighton accident investigation. Therefore the NTSB reclassifies Safety Recommendations R-08-12 and -13 from “Open—Acceptable Response” to “Closed―Unacceptable Action.” Casselton Oil Train Crew Safety Following the collision, the crew of the oil train narrowly escaped the area before the locomotives were destroyed by the eruption of a postaccident fire and energetic fireballs. During an interview with NTSB investigators the oil train conductor stated the following: [I] was exiting the cab … and started to get away from all the fire. … The heat was intense. … I was in knee-deep snow. I couldn’t get away as quickly as I would like to. … It was about a minute later the locomotive that we were traveling in was engulfed in flames. I suppose we were about 200 yards [away]. I believe that that’s when one of the tankers exploded.40 NTSB investigators asked the conductor how long it took for the locomotive to be engulfed in flames, and he said the following: [It] seems like a minute to me, a couple minutes. … I turned around to make sure my engineer was behind me, and that’s when I noticed that the locomotive was being engulfed in flames.41

40 Conductor of oil train, interview by NTSB investigator, January 2, 2014. 41 Conductor interview, January 2, 2014.

22 He also stated that the first explosion occurred about 5 minutes after the derailment. He added that an explosion occurred about every 10 minutes.42 The oil train engineer stated that after the collision, they saw “that there [was] fire, … a lot of fire.”43 The engineer expressed concern that they had to exit the locomotive through the back door because, “that’s the last place you wanted to go because [the] ground was on fire, the engine was on fire.”44 As previously stated, egress from the locomotive door exiting toward the front of the locomotive was not an option due to damage to the door. Freight train crews may survive collisions and derailments only to be injured or killed by hazardous materials released in the accident. A crew involved in a locomotive collision may experience injuries that would limit the ability to rapidly exit the locomotive and thereby increase the risk of injury from hazardous material release or fire. Postaccident examination of the derailed tank cars in this accident found that hazardous materials tank cars in positions 2 through 5 were breached and exhibited severe thermal damage. The proximity of the locomotives to the hazardous materials tank cars placed the oil train crew in peril following release of the crude oil that ignited and engulfed the locomotives in the postaccident fire within a minute or two. The NTSB concludes that had additional buffer cars, instead of flammable hazardous material tank cars, been placed in positions 2 through 5 of the train, the danger to the train crew would have been significantly reduced and would have allowed for more time for a safe egress from the locomotive. The NTSB further concludes that a one-car buffer between the locomotives and the hazardous materials exposes the train crew to unnecessary risk in accidents where cars are derailed closer to the head end of the train. In a July 29, 2009, letter to the FRA about Safety Recommendation R-08-12, the NTSB clarified that it recognized that the five-car buffer standard was not based upon any rigorous engineering safety analysis, but since the 1920s it has become accepted by regulators and railroads. Although the five-car buffer standard is considered to have been validated over many years, the one-car buffer exception for hazardous materials unit trains does not have as lengthy a historical record and also may not be sufficiently justified by historical or other data. The NTSB therefore concludes that without safety justification of the one-car buffer exception, the current regulation for the separation of hazardous materials from occupied locomotives and its interpretation by the FRA, PHMSA, and the railroads create different levels of safety for crew protection from hazardous materials on unit trains and general freight trains. Unit trains that carry hazardous materials present a special risk because of their high concentration of hazardous materials. Additional separation would provide greater protection to train crews in the event of an accident. The NTSB concludes that the number and placement of buffer cars should minimize the risk to the crew in occupied equipment. Therefore, the NTSB recommends that PHMSA evaluate the risks posed to train crews by hazardous materials transported by rail, determine the adequate separation distance between hazardous materials cars and locomotives and occupied equipment that ensures the protection of train crews during both normal operations and accident conditions, and collaborate with the FRA to revise

42 Conductor interview, January 2, 2014. 43 Engineer of oil train, interview by NTSB investigator, January 1, 2014. 44 Engineer interview, January 2, 2014.

23 49 CFR 174.85 to reflect those findings. The NTSB also recommends that the FRA evaluate the risks posed to train crews by hazardous materials transported by rail, determine the adequate separation distance between hazardous materials cars and locomotives and occupied equipment that ensures the protection of train crews during both normal operations and accident conditions, and collaborate with PHMSA to revise 49 CFR 174.85 to reflect those findings. These new safety recommendations supersede Safety Recommendations R-08-13 and -12 to PHMSA and the FRA, respectively. Therefore Safety Recommendations R-08-12 and -13, reclassified “Closed―Unacceptable Action” in this report (under Previous NTSB Actions) are reclassified “Closed―Unacceptable Action/Superseded.” The NTSB concludes that the regulatory interpretation 06-0278 permits PHMSA, the FRA, and the railroads to ignore the plain language of 49 CFR 174.85 for unit trains carrying hazardous materials allowing them to operate with only a single nonplacarded car rather than five nonplacarded cars. In the interim, until the completion of Safety Recommendation R-17-01, the NTSB recommends that PHMSA withdraw regulatory interpretation 06-0278 that pertains to 49 CFR 174.85 for positioning placarded rail cars in a train and require that all trains have a minimum of five nonplacarded rail cars between any locomotive or occupied equipment and the nearest placarded car transporting hazardous materials, regardless of train length and consist. Thermal Protection for Tank Cars Carrying Flammable Liquids The NTSB has investigated other crude oil train derailments in addition to the Casselton accident, including one in Mount Carbon, West Virginia, on February 16, 2015. Similar to Casselton, derailed tank cars transporting crude oil were breached and released product, which created pool fires that resulted in thermal tears in adjacent tank cars and the release of more crude oil that fed the pool fires. Neither the DOT-111 tank cars nor those manufactured to the CPC-1232 standard were required to be equipped with thermal protection systems to protect the tanks from exposure to pool or torch fire conditions that can occur in accidents.45 When a bare steel tank car filled with flammable liquids is exposed to a large pool fire or torch fire, the internal pressure of the tank increases and the strength of the tank decreases, which can result in tank failure from a thermal tear in the tank. The NTSB issued urgent Safety Recommendations R-15-14 through -17 on April 6, 2015, after the February 16, 2015, derailment of a CSX Transportation crude oil unit train in Mount Carbon, West Virginia, and other similar accidents.46 These recommendations urged

45 (a) Title 49 CFR Part 170, Subpart D, provides specifications for nonpressure tank cars, including the DOT-111 tank cars involved in this accident. These tank cars had tank head and shell material 7/16 inch thick. Each car was fitted with a bottom outlet valve, unprotected top fittings, hinged and bolted manway, and a pressure relief device. None of these tank cars were equipped with head shields, jackets, thermal protection, or insulation. (b) CPC-1232 tank cars meet the August 31, 2011, AAR Casualty Prevention Circular CPC-1232 specification that established requirements for DOT-111 tank cars ordered after October 1, 2011, for the transportation of Class 3, Packing Groups I and II materials with the proper shipping names Petroleum Crude Oil, Alcohols, n.o.s., (Not Otherwise Specified [in the DOT Hazardous Materials Table]), and Ethanol and Gasoline Mixture. CPC-1232 tank car features include thicker shells, half-height head shields, and top fittings protection. (c) Some tank cars may have insulation (typically fiberglass, mineral wool blankets, or foam) applied over the tank and enclosed within a metal jacket. Insulation is used to moderate the temperature of the lading during transportation, but it disintegrates at high temperature. In contrast, a thermal protection system is designed to protect the tank car from the high temperature of a pool fire or torch fire. 46 Galena, Illinois, March 5, 2015, and Gogama, Ontario, March 7, 2015. The NTSB did not investigate these accidents.

24 PHMSA to take action to expeditiously improve the thermal performance of tank cars used to transport flammable liquids: R-15-14 (Urgent) Require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with thermal protection systems that meet or exceed the thermal performance standards outlined in Title 49 Code of Federal Regulations 179.18(a) and are appropriately qualified for the tank car configuration and the commodity transported. R-15-15 (Urgent) In conjunction with thermal protection systems called for in safety recommendation R-15-14, require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with appropriately sized pressure relief devices that allow the release of pressure under fire conditions to ensure thermal performance that meets or exceeds the requirements of Title 49 Code of Federal Regulations 179.18(a), and that minimizes the likelihood of energetic thermal ruptures. R-15-16 (Urgent) Require an aggressive, intermediate progress milestone schedule, such as a 20 percent yearly completion metric over a 5-year implementation period, for the replacement or retrofitting of legacy DOT-111 and CPC-1232 tank cars to appropriate tank car performance standards that include equipping these tank cars with jackets, thermal protection, and appropriately sized pressure relief devices.47 R-15-17 (Urgent) Establish a publicly available reporting mechanism that reports at least annually, progress on retrofitting and replacing tank cars subject to thermal protection system performance standards as recommended in Safety Recommendation R-15-16. Thermal Protection Systems and Implementation Schedule Contrary to NTSB safety recommendations R-15-14 and -15, PHMSA’s final rule, HM-251, did not require thermal protection systems for all tank cars used to transport Class 3 flammable liquids. Rather, PHMSA mandated thermal protection systems only for higher risk HHFT configurations because the regulatory impact analysis did not support extending this requirement to all tank cars configured in any type of train. Section 7304 of the FAST Act requires that all tank cars used to transport any Class 3 flammable liquids shall meet the DOT-117, DOT-117P, or DOT-117R specifications in 49 CFR Part 179, regardless of train composition.48 The FAST Act kept an implementation schedule for

47 Legacy DOT-111 tank cars are DOT-111 tank cars built for the crude oil or ethanol markets before the introduction of a more robust variant—the CPC-1232 tank car—in October 2011. 48 The specification DOT-117 tank cars, in contrast to DOT-111 tank cars, have jacketed and thermally insulated 9/16-inch tank shells, full-height 1/2-inch-thick head shields, top fittings protection, a reclosable pressure relief device,

25 continued use of tank cars in crude oil and ethanol service similar to that provided in the PHMSA rule, requiring full DOT-117 compliance by May 1, 2025. However, the FAST Act also requires retrofitting or removing from service tank cars transporting other Class 3 flammable liquids in Packing Group I by May 1, 2025, and in Packing Groups II and III by May 1, 2029. Section 7305 of the FAST Act further directs the Secretary of Transportation to issue within 180 days regulations that require that each tank car built to meet the DOT-117 specifications, and each nonjacketed tank car modified to meet DOT-117 specifications, be equipped with an insulating blanket of DOT-approved material at least 1/2 inch thick. The NTSB is concerned that Section 7305 does not include a thermal blanket requirement for existing jacketed tank cars, nor does the Act specify other measures that may be required to ensure these tank cars perform adequately in pool fires or torch fires. On July 13, 2016, the NTSB hosted a roundtable discussion on rail tank car safety.49 The Railway Supply Institute (RSI) Vice Chairman of the Committee on Tank Cars was asked about his February 2016 request that the FRA and PHMSA approve the use of fiberglass insulation as part of a thermal protection system for the existing jacketed and insulated CPC-1232 and legacy DOT-111 tank cars that will be modified for continued use in Class 3 flammable liquids service. He responded— Based on our modeling, and some research done by the FRA on fiberglass insulation systems, the existence of a jacket and insulation … meets the federal pool fire requirement, and so it would perform per the federal requirement as a thermal protection system, even though it’s not listed as … an approved thermal-blanket-type material.50 The FRA and PHMSA reviewed the RSI analysis and determined the jacket and fiberglass insulation is sufficient thermal protection.51 The FRA and PHMSA also determined that approval for car usage in flammable liquid service is not required as long as the performance-based requirements of 49 CFR 179.18 are met. While the RSI modeling suggests that fiberglass insulation could allow jacketed and insulated tank cars to meet federal minimum thermal protection standards, the NTSB believes the available circumstantial thermal performance evidence for these tank cars is not compelling since there is little data to suggest a significant number of these cars have been thermally challenged in pool fires. Although insulation moderates the temperature of the lading during transportation, it is not intended to protect lading from external fires. Fiberglass insulation disintegrates at high temperatures typically found in pool fires and torch fires. Therefore, the NTSB will continue to

and a redesigned bottom outlet operating mechanism. Tank cars retrofitted to the DOT-117R standard have all of these features except for the additional shell thickness. In addition, the FAST Act included a performance standard for tank cars that carry crude oil and ethanol; tank cars that meet this standard are specification DOT-117P tank cars. 49 National Transportation Safety Board, Roundtable Discussion: A Dialogue on What’s Next in Rail Tank Car Safety, Washington, DC, July 13, 2016. 50 Railway Supply Institute (RSI) Vice Chairman of the Committee on Tank Cars, NTSB Roundtable Discussion: A Dialogue on What’s Next in Rail Tank Car Safety, (discussion transcript, NTSB, Washington, DC, July 13, 2016), Tank Car Safety Roundtable Transcript. 51 AllTranstek, L.L.C., RSI Fiberglass Insulation Approval, Railblazers Vol. 2, No. 3 (December 2016): 5, RSI Fiberglass Insulation Approval, see page 5.

26 monitor and investigate occurrences that may yield further evidence about the performance of jacketed and insulated tank cars transporting flammable liquids. Comments at the roundtable discussion by the RSI Vice Chairman of the Committee on Tank Cars and other industry representatives further suggest that the viability of retrofitting legacy DOT-111 tank cars, similar to the tank cars that were involved in this accident, has diminished with the decreased demand for these tank cars to service the crude-by-rail market. The industry representatives remarked that shippers would likely focus their retrofitting efforts on the more robust CPC-1232 tank cars, while legacy DOT-111 tank cars would ultimately be retired from flammable liquids service. On August 15, 2016, PHMSA issued final rule HM-251C, Hazardous Materials: FAST Act Requirements for Flammable Liquids and Rail Tank Cars.52 The new PHMSA regulations address the applicability of thermal protection requirements to all tank cars used to transport Class 3 flammable liquids, whether or not they are operated in a HHFT. In accordance with the FAST Act mandate, the new PHMSA regulations require a thermal protection blanket of at least 1⁄2-inch-thick material on tank cars built to meet the DOT-117 standard and nonjacketed DOT-117R tank cars. Although questions remain about the suitability of allowing the continued use of existing jacketed tank cars without further modifications to the tanks, the provisions of PHMSA final rule HM-251C discussed above have sufficiently implemented the recommended actions. Safety Recommendations R-15-14 and -15 were classified “Open—Acceptable Response” on July 12, 2016. PHMSA issued the final rule on August 15, 2016; therefore the NTSB reclassifies Safety Recommendations R-15-14 and -15 “Closed—Acceptable Action.” In a May 4, 2015, letter to the NTSB, PHMSA responded to Safety Recommendation R-15-16, outlining the timeline for phaseout and retrofit of legacy tank cars used in HHFT service. PHMSA stated that the timeline strived to strike a balance between the safety of transporting flammable liquids by rail and the economic viability of the rail industry. Upon consideration of shop capacity and the potential impacts associated with the retrofit schedule, PHMSA developed the timeline with a targeted phaseout of the DOT-111 tank cars. However, the intent of Safety Recommendation R-15-16 was to replace the existing tank cars that are less safe as quickly as possible. As of August 16, 2016, AAR fleet statistics indicate that the industry has progressed slowly with the retrofit and replacement work, and only 1,362 tank cars have been retrofitted to DOT-117R specifications and about 9,448 new DOT-117 tank cars have entered into service. Although the NTSB would have preferred a more aggressive schedule for full implementation, the PHMSA timeline was based on an analysis of shop capacity and logistics and it is closely aligned with that of Transport Canada. Accordingly, Safety Recommendation R-15-16 was classified “Open—Unacceptable Response” on July 12, 2016. The current phaseout deadlines provided by PHMSA’s final rule HM-251C and mandated by the FAST Act did not include intermediate progress milestones as called for by the safety recommendation. Tank Car Retrofitting Reporting The PHMSA final rule, HM-251C, does not require complete transparency or full reporting for the retrofitting of all tank cars subject to the HHFT requirements; rather, the rule includes only one milestone date (January 1, 2017) by which tank car owners were required to report to the DOT

52 Federal Register 81, no. 157 (August 15, 2016): 53935.

27 the number of tank cars they own that have been retrofitted and the number that remain to be retrofitted. Further, this milestone pertains only to the retrofitting of nonjacketed DOT-111s in Packing Group I service, and the rule does not specify what the DOT will do with the reports or whether the data will be made public. Section 7308 of the FAST Act now requires the Secretary of Transportation to implement a reporting mechanism to monitor industrywide progress toward modifying rail tank cars used to transport all Class 3 flammable liquids by the applicable deadlines established in Section 7304. The data collected shall consist of the total number of tank cars modified to meet the DOT-117R specification, the total number of tank cars built to meet the DOT-117 specification, and the total numbers, types, and specifications of tank cars used to transport Class 3 flammable liquids that have not been modified. The Act requires the Secretary to report the aggregate results of the DOT tank car data survey to Congress annually. While PHMSA’s new regulation, HM-251C, did not include provisions for complete transparency in progress reporting to retrofit and phase out existing tank cars, which the NTSB believes is critical for ensuring deadline compliance, the provisions of the FAST Act have fully addressed the recommended action. As noted previously in this report, PHMSA issued the final rule on August 15, 2016, and the NTSB has reclassified Safety Recommendations R-15-14 and -15 “Closed―Acceptable Action.” Event Recorder Data Recoverability The NTSB investigation of the June 24, 2012, collision near Goodwell, Oklahoma, was limited by the extensive fire and collision damage to both lead locomotives that destroyed the functionally integrated railroad equipment computers that sent operating data to certified crashworthy event recorder memory modules.53 Although the memory modules (nonvolatile memory) from both lead locomotives were taken to the NTSB’s vehicle recorder division for readout and evaluation, no data could be recovered from the severely damaged modules. In the Casselton accident, the memory modules were destroyed on all of the head-end locomotives on the crude oil train. (See Event Recorder Data section.) The NTSB successfully recovered data from the trailing locomotives’ event recorders, but the data those recorders captured were limited. Investigators had to calculate the motion at the front of the trains, including the collision time and collision speeds. Furthermore, the type of recorder that was on the lead locomotives was designed to capture more parameters than the recorder type on the trailing locomotive. These parameters included those for alarms, the horn, and emergency brake applications, among others. Despite the recorders’ being certified crashworthy, however, the data modules on the lead locomotives were destroyed, important data were not available to investigators, and the investigation lacked critical information. As a result of the Goodwell accident investigation, the NTSB issued Safety Recommendation R-13-22 to the FRA on August 14, 2013:

53 National Transportation Safety Board, Head-On Collision of Two Union Pacific Railroad Freight Trains Near Goodwell, Oklahoma, June 24, 2012, RAR-13/02 (Washington, DC: National Transportation Safety Board, 2013).

28 R-13-22 Require all information captured by any required recorder to also be recorded in another location remote from the lead locomotive(s) to minimize the likelihood of the information’s being unrecoverable as a result of an accident. This recommendation is currently classified “Open—Unacceptable Response.” Exclusions The track structure, the signal system, and train crewmembers’ compliance with operations rules and procedures did not contribute to the cause of the accident. Investigators conducted mechanical inspections of the equipment that did not derail and found no evidence of other causes that contributed to the derailment of either train. The pretrip mechanical inspections of both trains identified no defects. Probable Cause The National Transportation Safety Board determines that the probable cause of the collision of the oil train with the derailed grain train car was a broken axle on the 45th car of the grain train caused by an internal void that was created during axle manufacture. Contributing to the cause of the derailment were inadequate interchange rules used to locate internal material defects in secondhand-use axles. Contributing to the severity of the accident was the release and pooling of a highly flammable product that resulted in a fire and caused additional cars to fail. Recommendations As a result of its investigation, the NTSB makes the following safety recommendations: New Recommendations To the Pipeline and Hazardous Materials Safety Administration: Evaluate the risks posed to train crews by hazardous materials transported by rail, determine the adequate separation distance between hazardous materials cars and locomotives and occupied equipment that ensures the protection of train crews during both normal operations and accident conditions, and collaborate with the Federal Railroad Administration to revise 49 Code of Federal Regulations 174.85 to reflect those findings. (R-17-01) Pending completion of the risk evaluation and action in accordance with its findings prescribed in Safety Recommendation R-17-01, withdraw regulatory interpretation 06-0278 that pertains to 49 Code of Federal Regulations 174.85 for positioning placarded rail cars in a train and require that all trains have a minimum of five nonplacarded cars between any locomotive or occupied equipment and the nearest placarded car transporting hazardous materials, regardless of train length and consist. (R-17-02)

29 To the Federal Railroad Administration: Evaluate the risks posed to train crews by hazardous materials transported by rail, determine the adequate separation distance between hazardous materials cars and locomotives and occupied equipment that ensures the protection of train crews during both normal operations and accident conditions, and collaborate with the Pipeline and Hazardous Materials Safety Administration to revise 49 Code of Federal Regulations 174.85 to reflect those findings. (R-17-03) Recommendations Reclassified in This Report As a result of this accident investigation, the National Transportation Safety Board reclassifies from “Open—Acceptable Response” to “Closed―Unacceptable Action/Superseded,” by Safety Recommendation R-17-03 to the FRA, the following safety recommendation to the FRA: R-08-12 Assist the Pipeline and Hazardous Materials Safety Administration in its evaluation of the risks posed to train crews by unit trains transporting hazardous materials, determination of the optimum separation requirements between occupied locomotives and hazardous materials cars, and any resulting revision of 49 Code of Federal Regulations 174.85. As a result of this accident investigation, the National Transportation Safety Board reclassifies from “Open—Acceptable Response” to “Closed―Unacceptable Action/Superseded,” by Safety Recommendation R-17-01 to PHMSA, the following safety recommendation to PHMSA: R-08-13 With the assistance of the Federal Railroad Administration, evaluate the risks posed to train crews by unit trains transporting hazardous materials, determine the optimum separation requirements between occupied locomotives and hazardous materials cars, and revise 49 Code of Federal Regulations 174.85 accordingly. As a result of this accident investigation, the National Transportation Safety Board reclassifies from “Open—Acceptable Response” to “Closed―Acceptable Action” the following safety recommendations to PHMSA: R-15-14 (Urgent) Require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with thermal protection systems that meet or exceed the thermal performance standards outlined in Title 49 Code of Federal Regulations 179.18(a) and are appropriately qualified for the tank car configuration and the commodity transported.

30 R-15-15 (Urgent) In conjunction with thermal protection systems called for in safety recommendation R-15-14, require that all new and existing tank cars used to transport all Class 3 flammable liquids be equipped with appropriately sized pressure relief devices that allow the release of pressure under fire conditions to ensure thermal performance that meets or exceeds the requirements of Title 49 Code of Federal Regulations 179.18(a), and that minimizes the likelihood of energetic thermal ruptures.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD CHRISTOPHER A. HART ROBERT L. SUMWALT Chairman Member T. BELLA DINH-ZARR (Dissenting with EARL F. WEENER Vice Chairman the report format) Member Adopted: February 7, 2017 Vice Chairman Dinh-Zarr filed the following concurring and dissenting statement:

31 Board Member Statement Vice Chairman T. Bella Dinh-Zarr filed the following statement, concurring in part and dissenting in part, on February 14, 2017. While I concur with the findings, recommendations, and probable cause, I dissent on the report itself. I do so not because I disagree with the staff’s analysis, but rather, because I believe this “brief” format does not provide a product that is consistent and transparent. I also believe the brief format does not adequately highlight the importance of this accident investigation and the tremendous collaboration by NTSB staff and industry to make real change. For the reasons outlined below, I encourage my fellow Board Members to join in my dissent so we can put the final report into the same high-quality packaging that the Board and the public expect to see from the NTSB—with an executive summary, conclusions section, table of contents, list of figures and tables, list of acronyms and abbreviations, and numbered paragraphs. This full report format would elevate this investigation to the status it deserves. As Member Sumwalt noted in his memo calendaring this accident for a Board meeting, “many of the issues discussed in this report—buffer cars, ECP braking, etc.—would benefit from a robust discussion in a Sunshine Act Board Meeting.” When we consider an accident at a Sunshine Act meeting, the Board is choosing to highlight a given accident. The formality of the report format at those meetings further exemplifies this fact. In drafting this dissenting statement, I reviewed every report that the Board has voted out in a Sunshine Act meeting since I joined the Board two years ago. Each of those formal reports contained an executive summary, conclusions section, table of contents, list of figures and tables, list of acronyms and abbreviations, and numbered paragraphs. Of note, the Office of Highway Safety Tire Special Investigation Report initially did not contain an executive summary. However, staff added one prior to the Board meeting stating in a memorandum to the Board “[a]lthough an Executive Summary is not always provided for a Special Investigation Report, some reviewers suggested that such a section would be beneficial in this case. Staff has provided an Executive Summary section and accordingly revised the existing Introduction section to avoid unnecessary repetition of summary information.” We are a highly technical agency but our job is to ensure our work is accessible and understandable to the public. Our Sunshine Act meetings and accompanying formal reports serve that purpose. Our formal reports adopted at Board meetings also elevate certain investigations over briefs with recommendations that the Board adopts through a written vote or the briefs without recommendations that are delegated to the modal office directors to complete. The Casselton report is a departure from the format I am used to seeing before the Board at a Sunshine Act meeting. I simply seek to elevate the fine investigative work done by the Office of Railroad, Pipeline and Hazardous Materials to the same level of the other 21 reports mentioned above. By presenting this information in the full format, we increase our transparency and we provide the most useable information about this accident to the public—which includes industry, the media, Congressional leaders, and most importantly, the crew of this train whose lives were in danger and the hundreds of people in the community who were forced to evacuate their homes. Member Weener joined in this statement.

For more details about this accident, visit NTSB Docket and search for NTSB accident identification number DCA14MR004.

32

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a railroad accident in which there is a fatality or substantial property damage, or that involves a passenger train. (49 United States Code § 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code § 1154(b).

33 Appendix Train Braking Simulation Study The NTSB conducted its Train Braking Simulation Study, published July 20, 2015, to quantify the expected stopping distance of a train as a function of train braking type (conventional pneumatic [Conv], distributed power pneumatic [DP], or electronically controlled pneumatic [ECP]) and a range of parameters including train mass, train speed, and track grade.54 Although several crude oil unit train consists were modeled in this study, the results were not intended to be used to evaluate the specific stopping performance capability of the BNSF oil train involved in the Casselton accident. The scope of the braking simulation study was limited to scenarios with a train line emergency initiated at the head-end locomotive on uniform grade tangent track with clean, dry rail. The trains were assumed to have no inoperative locomotives, no inoperative brakes, no wheel or car derailments, no collisions among cars or with other obstacles, and no loss of communications among applicable electronic devices. The study documents the calculated stopping performance capability of Conv, DP, and ECP train braking systems for a nominal car net braking ratio (NBR) of 10 percent (to compare the effect of different brake signal propagation rates).55 In addition, the stopping distance benefit that is due to increasing NBR for exemplar Conv, DP, and ECP trains is illustrated. The study also evaluates the combined brake signal propagation rate and increased brake shoe force benefits of increasing the NBR for an ECP train relative to a Conv train. All simulation scenarios reflect initial conditions with the train in a balanced state (constant initial speed) for level, ascending, and descending track grades. Emergency and service braking applications had different stopping distance performance envelopes with some regions of overlap. For all train braking types, the stopping distance benefit relative to the Conv 10 percent NBR baseline generally increases with increasing train length and/or descending grades. Exemplar brake signal propagation rate benefits at 10 percent NBR for emergency and full service braking relative to the Conv 10 percent NBR baseline are shown in table 1. For emergency braking at a constant NBR value of 10 percent, the ECP brake system provides somewhat better stopping performance than the DP configuration.

54 National Transportation Safety Board, Train Braking Simulation Study, (Washington, DC: NTSB, 2015). NTSB Train Braking Study. 55 Net braking ratio (NBR) is the ratio of the car net braking force to the car gross rail load. In verbose form, NBR is the ratio of the car net braking force (the sum of the forces applied by each brake shoe against each wheel tread) to the car gross rail load (the sum of the car empty weight and the car freight/cargo/payload).

34 Table 1. Percent Stopping Distance Reduction Due to Brake Signal Propagation Rate at 10 Percent NBR (relative to Conv 10 Percent NBR baseline, released).

Stopping Distance Reduction (%) Braking Configuration Speed (mph)

DP

ECP Emergency 20 4 to 17 5 to 26 30 4 to 11 5 to 19 40 3 to 9 4 to 15 50 3 to 8 4 to 13 Full Service 20 7 to 46 37 to 75 30 44 to 39 37 to 68 40 10 to 39 30 to 64 50 9 to 37 25 to 60

Smaller percent stopping distance reduction values relative to the Conv 10 percent NBR baseline generally correspond to three independent variables: steeper ascending grades (more train kinetic energy is converted to potential energy rather than dissipated by the brake system), shorter consist lengths, and higher train speeds (calculated percent stopping distance benefit decreases even though the absolute stopping distance benefit measured in equivalent car lengths increases). Calculated Conv, DP, and ECP increased NBR benefits for exemplar emergency and full-service braking scenarios are provided in table 2 relative to the respective brake system 10 percent NBR baseline. For emergency braking, increasing the NBR for a given brake system and speed yields comparable percent stopping distance reductions among the Conv, DP, and ECP systems.

35 Table 2. Percent Stopping Distance Reduction Due to Increased Net Braking Ratio, Level Grade (relative to respective Conv 10 Percent NBR, DP 10 Percent NBR, and ECP 10 Percent NBR baseline, released).

Stopping Distance Reduction (%)

1. 8% Net Braking Ratio

14% Net Braking Ratio Braking Configuration Speed (mph) Conv DP ECP Conv DP ECP Emergency 20 12 14 15 16 18 19 40 15 17 17 20 22 23 60 17 18 19 22 24 24 Full Service 20 8 8 16 11 11 21 40 10 11 18 13 15 24 60 11 13 19 15 18 25

Combined ECP brake signal propagation rate and increased NBR benefit results for emergency and full-service braking are presented in table 3, relative to the Conv 10 percent NBR baseline. Increasing the nominal car NBR clearly provides measurable stopping performance benefits. Note that the summary results in tables 1–3 are subject to specific train mass (consist length) and track grade conditions. Table 3. Percent Stopping Distance Reduction Due to Combined ECP Brake Signal Propagation Rate and Increased Net Braking Ratio (relative to Conv 10 Percent NBR baseline, released).

Stopping Distance Reduction (%) Braking Configuration Speed (mph) ECP 10% NBR ECP 12.8% NBR ECP 14% NBR Emergency 20 5 to 26 13 to 39 16 to 43 30 5 to 19 17 to 33 21 to 38 40 4 to 15 17 to 31 22 to 36 50 4 to13 19 to 30 24 to 36 Full Service 20 37 to 75 42 to 80 45 to 82 30 37 to 68 45 to 74 48 to 76 40 30 to 64 41 to 71 44 to 73 50 25 to 60 40 to 68 44 to 71

The in-train force benefits of DP and ECP braking are shown by substantially lower car-to-car buff forces (75,000 to 250,000 pounds lower) during emergency brake application.

36 Although this generic stopping distance study yields some useful in-train force results and trends, it is not intended to exhaustively compare the in-train force benefits among the train braking configurations evaluated. Kinetic energy data for an exemplar emergency stop could be used to estimate the energy dissipated (relative to the Conv 10 percent NBR baseline) over a finite distance window as a function of braking configuration (DP 10 percent NBR, ECP 10 percent NBR, ECP 12.8 percent NBR, or ECP 14 percent NBR). For example, use of ECP braking at 12.8 percent NBR to bring the train to a full stop on level grade from an initial speed of 50 mph would decrease the required stopping distance by about 500 to 550 feet (about 8 to 9 tank-car lengths) relative to the Conv 10 percent NBR baseline. The kinetic energy dissipated over a finite time window could also be compared to estimate the response time margin available (as a function of the brake system configuration) for engineer/conductor corrective or mitigating action via emergency brake application. For the same 50 mph to full stop (zero kinetic energy) example on level grade, use of ECP braking at 12.8 percent NBR would add about 13 seconds of response time margin relative to the Conv 10 percent NBR baseline. A hypothetical target vehicle kinetic energy decrease of 50 percent or more (relative to the initial train speed) using ECP braking at 12.8 percent NBR would equate to a distance reduction of about 850 feet (about 14 tank-car lengths) and a time margin benefit of about 27 seconds relative to the Conv 10 percent NBR baseline. The benefits of advanced train braking systems come from three sources: reduced stopping distances (fewer cars in a potential pileup), reduced vehicle kinetic energy (less energy available to puncture cars in a pileup), and lower and more uniform in-train coupler forces (more compatible car-to-car interaction). Many railroads, including the BNSF, use locomotive distributed power to enable longer trains with the added benefits of improved in-train forces and braking performance. One technique to improve train stopping performance is to increase the nominal car NBR. This could be accomplished through new car construction or by retrofitting Conv, DP, or ECP trains by changing the brake shoe mechanical lever ratio on the foundation brake rigging, adjusting the target brake cylinder pressure, or some combination of these two methods. Increasing the nominal car NBR increases the brake shoe force against the wheel tread during brake application, which in turn increases the energy required to be dissipated as heat. As a result, the brake shoe and the wheel tread will be subjected to increased thermal loads and higher wear rates.56 The study did not evaluate or quantify the consequences of higher thermal loads on in-service wheels.

56 Higher thermal loads (heat input) from braking may reduce the residual compressive hoop stress in a wheel, increase the risk of wheel defect origination and growth, and increase the risk of brake shoe fade.

FD07484 ｜ 2017_美国_RAB1707.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

56781

NTSB/RAB-17/07

National Transportation Safety Board Railroad Accident Brief BNSF Railway Unit Ethanol Train Derailment Lesterville, South Dakota The Accident On September 19, 2015, about 6:18 a.m., central daylight time, BNSF Railway Company (BNSF) unit ethanol train GMNXDPK717, with 3 locomotives, 96 loaded tank cars, and 2 hopper cars filled with sand, derailed at a small bridge at milepost (MP) 597.7 near Lesterville, South Dakota.1 Seven cars (tank car 2 through tank car 8 from the head end of the train) derailed. Two of the derailed cars breached and released 49,743 gallons of denatured fuel ethanol (ethanol) that caught fire. A third car leaked ethanol from its bottom outlet valve. There were no injuries and no evacuation. The estimated damage was $1.1 million. Figure 1 shows an overhead view of the accident site.

Figure 1. The accident site. (Photograph provided by BNSF.)

1 (a) Unit trains are trains that contain all of the same type of cars and commodity. (b) The two hopper cars that were filled with sand served as buffer cars, in compliance with Title 49 Code of Federal Regulations (CFR) Part 174.85 “Position in train of placarded cars, transport vehicles, freight containers and bulk packagings,” which requires that when the train length permits, placarded cars must not be nearer than the sixth car from the engine or occupied cars. Cars loaded with ethanol are placarded and, therefore, require separation from the locomotives.

BNSF Railway Unit Ethanol Train Derailment

2 The train crew, consisting of a conductor and a locomotive engineer, boarded the train in Scotland, South Dakota. The BNSF train dispatcher issued a track warrant at 5:40 a.m., authorizing the crew to depart Scotland and to occupy the main track from MP 605 to MP 566 which, according to the locomotive event recorder, the crew did 3 minutes later. The maximum timetable speed for this segment of track was 25 miles per hour (mph); however, a BNSF General Track Bulletin restricted the train speed to 10 mph between MP 600.8 and MP 587.9.2 According to the locomotive event recorder, the train primarily traveled at 10 mph, but the speed varied between 8 mph and 13 mph until the derailment.3 The train crewmembers said the 1-hour trip before the derailment occurred was uneventful, although they added there was heavy fog and poor visibility, and the sight distance was between 50 and 100 feet. The video recording from the outward-facing camera on the lead locomotive confirmed the existence of dense fog as the train approached and traversed the bridge near the derailment site. Shortly after the locomotives crossed the bridge at MP 597.7, the emergency air brakes applied, without crew initiation.4 According to the event recorder, the locomotive continued for about 80 feet before stopping. The engineer and conductor stated they looked back and could see that the cars had derailed behind the locomotive and had caught fire. After the engineer reported the derailment and fire to the train dispatcher, he and the conductor gathered the train consist documents, left the locomotive, and walked a safe distance from the fire. At the request of the emergency responders, the train crew returned to the locomotive and separated the buffer car and the two locomotives from the derailed train and moved them a safe distance from the fire. They also cleared the highway-railroad grade crossing to allow access by the fire department. Track and Structure Site Description The BNSF has owned the Aberdeen Subdivision, consisting of a single main track between MP 777.0 (Aberdeen, South Dakota) to MP 513.0 (Sioux City, Iowa), since 2005. The track was

2 BNSF Railway Company, BNSF General Track Bulletin No. 32595, September 19, 2015. 3 Title 49 CFR Part 240 and BNSF company policy allow these speed variations. 4 Emergency air brakes engage through the rapid release of air pressure from the brake pipe, resulting in the correspondent increase of brake pressure. Engineers and conductors can apply the emergency air brakes from their brake valves on the locomotive. However, the emergency brake may also engage because of a broken brake pipe or disconnected air hoses.

BNSF Railway Unit Ethanol Train Derailment

3 90-pound jointed rail sections near the point of derailment (POD).5 This rail was installed in 1929, and had manufacturing dates varying from 1909 to 1918. In 2010, BNSF surfaced the track and renewed the crossties.6 Postaccident Rail Recovery The POD at MP 597.7 was just east of the bridge. A forward-facing video from BNSF 5135, a train that traversed this section of track the day before this accident, showed misalignment of the track at the eastern end of the bridge.7 (See figure 2.) Further, the audio track on this video captured an obvious “clunking” sound when the engine traversed this location.

Figure 2. Still photograph from a forward-facing video from the day before the accident. (Photograph provided by BNSF.) The POD was about 10 feet east of the east-end bridge abutment on the right-hand rail in the direction of the train’s movement. This location corresponded with the image noted from the previous day’s forward-facing video.

5 Rail is classified by its linear weight for every 3 feet. This rail was designated as 9020 rail. Early rail designations showed slight changes in rail profiles and weights and other minor increases with 9020 and 9030 rail. For simplicifation, in this report, the rail is referred to as “90-pound rail.” 6 Surfacing a track involves tamping ballast (gravel) tightly against the ties between the rails and building up the proper amount of ballast against the ends of the ties on both sides of the track. This process stablizes the track structure, improves drainage, and returns the track to the required geometry specifications. 7 A forward-facing video recording from train BNSF 5135 captured a misalignment of the rail at the POD as it traversed the site at 4:07 p.m. on the previous day. This can be found in NTSB Public Docket DCA15FR016.

BNSF Railway Unit Ethanol Train Derailment

4 The derailment shattered the rail into many pieces. Investigators gathered the rail and reassembled the track at the derailment site. Pieces of broken rail from the east end of the bridge were sent to the NTSB materials laboratory in Washington, DC, for examination. (See figure 3.)

Figure 3. Recovered right-hand rail just east of the bridge. The laboratory examination of the break between rail pieces 3S and 2S showed wear marks where the mating fracture faces had been moving up and down against each other. Therefore, the rail broke before the accident train derailed. Two issues were identified at the site of the broken rail: (1) the track gage was “tight” or narrow, and (2) the east end of the bridge approach needed additional surfacing to better support the track structure During geometry inspections, it was noted that the gage was tight between MP 596.72 to MP 596.67.8 Standard gage for rail is 4 feet, 8 1/2 inches measured in a plane 5/8 inches from the top of the rail head. Federal Railroad Administration (FRA) track standards allow a minimum gage of 4 feet, 8 inches; however, as early as 2014, this section of track was measured and reported to be tighter than 4 feet, 8 inches. On April 8, 2015, the BNSF track geometry car reported tight gage (that is, 9/16-inch more narrow than the FRA minimum) at MP 596.67 and the BNSF inspector noted that this was a repeated defect from the previous year. BNSF had a contractor evaluate the track geometry on October 27, 2014, and August 8, 2015. The contractor also found gage that was more narrow than the FRA minimum standards at two other locations near the POD―one was 5/16-inch too tight, and the other was 13/16-inch too tight. The contractor did not report the defects because the instrumentation showed a spike in the laser, which means the reading could be unreliable.

8 For additional information, see 49 CFR 213.53 “Gage”. North rail South rail 4S 3S 2S 1S East

BNSF Railway Unit Ethanol Train Derailment

5 The rail at the POD showed signs of wheel wear against the inside head (top) of the rail. In tangent (straight) track, the wheel flange generally does not touch the inside of the rail head and the wheels of the cars center themselves on the top of the rail head.9 The wear patterns on the rail indicated the tightening of the gage, which would have applied lateral pressure to the rail by the wheels of passing trains. The wooden cap on bent #2, at the east end of the bridge, was replaced on April 13, 2015.10 The BNSF bridge inspector said the repairs to the bridge affected the track approaching the bridge by altering the alignment and disturbing the ballast that supports the track structure. According to the bridge inspector, the following improvements were needed: repairing the erosion of the east-end slope, constructing wing walls, and the lining and surfacing of the track.11 Train crews also reported track issues on the east end of the bridge, according to the bridge inspector.12 However, the BNSF track supervisor, who had worked the territory since 2013, said that he was unaware of the bridge repairs. The gage tightened at the POD and the track was unstable, which required repair. However, by designating the track as Class 1, BNSF was able to defer maintenance on the track. These issues, along with lateral pressure on the rail from the tight gage and the poor track structural support, increased the likelihood of rail failure. Track Maintenance and Inspections The FRA track standards are based upon track category classifications.13 The categories for conventional railroad territories range from Class 1 for the lowest classification and escalate to Class 5.14 Railroads designate the classification of track for given territories, which subsequently determines the tolerances allowed during maintenance, the minimum structural requirements, the frequency of inspections, and the allowed track speed. A lower track classification results in greater tolerances, less-frequent inspections, and a lower maximum speed. Railroads often lower the classification of a track to defer maintenance on routes that have lower train traffic. At one time, the Aberdeen Subdivision had been designated as a Class 2 track; however, when BNSF lowered the speed limit at the accident area to 10 mph several years earlier, this section of the subdivision became a Class 1 track.15 In addition, the track supervisor said that because fewer trains operated on this section of the Aberdeen Subdivision, it had a lower priority for maintenance.

9 The wheel flange is the inside rim which projects below the tread. 10 Bents are part of the upright supports that the deck of the bridge rests upon. 11 A wing wall is an extension of an abutment wall which retains adjacent earth and/or deflects or guides a stream into pipes, culverts, and the waterway of a bridge. The bridge inspector noted that wing walls were never constructed for this bridge, despite being needed. 12 Train crews will report locations in the track where they feel a rough spot or if the engine makes unusual movements while traversing. 13 Track classifications are outlined in 49 CFR 213.9 “Classes of track; operating speed limits”. 14 High-speed train operations have their own classifications which are covered in 49 CFR Part 213, Subpart G “Train Operations at Track Classes 6 and Higher”. 15 The track supervisor said that the Aberdeen Subdivision had been classified as Class 1, with a speed limit of 10 mph, when he was assigned the territory in 2013.

BNSF Railway Unit Ethanol Train Derailment

6 A BNSF track inspector visually inspected the track once a week, as required by regulation.16 The track inspector said that he normally operated the test vehicle at speeds between 5 and 7 mph when he inspected the jointed rail. He said that he had inspected the track at the accident site on September 15, 2015—4 days before the accident. During the 6 to 7 weeks prior to the accident, the track inspector’s supervisor accompanied him twice during inspections. BNSF evaluated the track geometry on this subdivision twice a year, alternately using a specially equipped railcar and contracting with an outside company.17 The three most recent track geometry evaluations prior to the accident occurred on October 27, 2014, April 8, 2015, and August 8, 2015. These evaluations identified tight gage, as discussed in the section on Postaccident Rail Recovery. BNSF also had a contractor scan the rail for internal defects on a quarterly basis.18 The most recent internal defect inspections prior to the accident were held on April 22, 2015, and July 9, 2015, neither of which detected a defect in the rail at the POD. However, several other locations on this track were noted as “shelled, spalled, and corrugated” (SSC), which is a surface condition that limits the ability of the instruments to detect internal defects. If there was a length of track with extensive SSC surface conditions, the contractor was required under FRA regulations to note that a valid search for internal defects was not conducted. There was also an additional subjective requirement that if the surface condition was “bad enough,” the operator—in this case, the contractor hired by BNSF—was required to perform a visual inspection of the rail. The records indicated that the contractor stopped and inspected the rail where the SSC had obscured the internal scans. Postaccident Inspections and General Rail Condition During postaccident examinations, investigators found many track defects near the accident site, including: • a break in a portion of the rail head on the north rail at MP 596.65, about 250 feet east of the POD • a 6-inch vertical split head on the field side of the rail head near MP 596.68, which was where the internal defect report of July 9, 2015, showed SSC, and where the contractor performing the scan had visually inspected, but did not note finding any defects • two significant vertical split heads were found between MP 595.2 and MP 596.6—one was 13-inches long, and the other was 96-inches long • excessive rail head wear

16 Title 49 CFR 213.233 “Track inspections”. 17 This railcar is known as a “STAR car.” STAR is an acronym for Strength, Testing, Analysis, and Recording. It has a split axle that applies a 10,000-pound lateral load to both rail heads and measures the geometry under a load. 18 Internal rail defects are found by using ultrasonic or electric induction methods. If possible, BNSF would have a contractor conduct a second inspection in the fourth quarter so there would be five inspections for internal defects per year.

BNSF Railway Unit Ethanol Train Derailment

7 BNSF track standard wear limits for rail heads were based on the specified weight of the rail and allowed more wear for heavier rail.19 All rail that weighed less than 119 pounds had a 0.5-inch vertical wear limit.20 In the case of a 90-pound rail, such as the one shown in figure 4, 0.5-inch of vertical wear would reduce the rail head to the extent where it may not be able to support the weight of a modern tonnage train and could increase the possibility that the rail would fail.21 Although the wear on the accident rail had not reached the level for replacement for 90-pound rail by the BNSF wear limit, NTSB investigators considered the wear in the accident rail to be excessive because the remaining head area in the worn 90-pound rail was less than the remaining head area in heavier rail at the wear limits listed in the BNSF track standard.

19 Heavier rail generally has more mass in the rail head. 20 BNSF Engineering Instructions, Rail, revised December 1, 2015, Table 6-1: “Rail Head and Side Wear Limits”. 21 Tonnage trains are heavy trains that carry large loads.

BNSF Railway Unit Ethanol Train Derailment

8

Figure 4. Excessive rail head wear on a 90-pound rail from the Aberdeen Subdivision. Despite being limited because of rail surface issues, BNSF conducted track geometry and internal scanning inspections that exceeded the FRA requirements. However, BNSF continued to operate high-hazard flammable unit trains (HHFUT) on a track with significant defects.22 Because BNSF lowered this track’s classification to Class 1, none of the defects required either a suspension of train operations or increased maintenance requirements. Further, the track met the FRA Track Safety Standards found in Title 49 Code of Federal Regulations (CFR) Part 213. Since the

22 An HHFUT is a single train transporting 70 or more loaded tank cars containing Class 3 flammable liquid.

BNSF Railway Unit Ethanol Train Derailment

9 accident, BNSF rerouted unit ethanol trains (HHFUT) so that they no longer operate on the Aberdeen Subdivision. Rail Wear and Train Weights According to the second edition of Railroad Engineering, rough estimates show that 10 pounds of rail weight can carry 3,000 pounds of load—or in this case, if it were new 90-pound rail, 27,000 pounds.23 The maximum weights for the tank cars for this train were 286,000 pounds and 263,000 pounds. The wheel loading for 286,000-pound cars with four axles was 35,750 pounds per wheel, and the wheel loading for 263,000-pound cars with four axles was 32,875 pounds per wheel. Railroads did not use cars of this size at the time when the rail on this track was manufactured. Therefore, the 90-pound rail may have been overloaded regardless of the excessive head wear. Modern high-strength steel rail is harder than the century-old rail used on this track and wears down at a lower rate. The hardness of the rail at the POD was about 30 percent lower than the minimum acceptable value for today’s rails. Older rail is susceptible to head checks, spalls, and other rolling contact fatigue damage; deformed rail head flow; and increased wear rates.24 The rail segments recovered at the scene of the accident showed evidence of rolling contact fatigue. According to BNSF, since January 2015, at least one loaded unit ethanol train, such as the accident train, traversed the Aberdeen Subdivision each week. Excluding the locomotives, the accident train weighed 12,585 tons and had an average wheel loading of 32,104 pounds.25 More significantly, 98 cars delivered this excessive wheel loading. The age of the rail compounds the fatigue and wear caused by the unit trains with heavy wheel loading. The NTSB believes that freight railroads and the FRA should more closely consider the weight of rail when operating high tonnage trains, particularly those containing highly flammable material. Hazardous Material/Tank Cars Retrofit and Phase-out The Fixing America’s Surface Transportation (FAST) Act is a funding and authorization bill governing United States surface transportation spending.26 Section 7304 of the Act requires that all tank cars used to transport Class 3 flammable liquids must meet US Department of Transportation (DOT) specifications DOT-117, DOT-117P, or DOT-117R in 49 CFR Part 179, regardless of train composition. These specifications make tank cars less susceptible to breaching and releasing flammable or hazardous contents during a derailment.

23 William W. Hay, Railroad Engineering, 2nd Ed. (Hoboken, New Jersey: Wiley, 1982). 24 These conditions are all examples of SSC. 25 Investigators used the following calculation to arrive at this total: 12,585 tons ÷ 98 cars = 128 tons per car x 2,000 pounds = 256,826 pounds per car ÷ 8 wheels per car = 32,104 pounds per wheel. 26 Public Law No. 114-94.

BNSF Railway Unit Ethanol Train Derailment

10 The FAST Act contains a schedule for phasing out tank cars in crude oil and ethanol service and requires fleets to be fully DOT-117 compliant by May 1, 2025. However, the FAST Act requires retrofitting or removing from service tank cars transporting other Class 3 Packing Group I flammable materials by May 1, 2025, and Class 3 Packing Groups II and III flammable materials by May 1, 2029.27 On August 15, 2016, the Pipeline and Hazardous Materials Safety Administration (PHMSA) published a final rule codifying the phase-out schedule for all DOT Specification 111 tank cars used to transport crude oil, ethanol, and other Class 3 flammable liquids.28 Continued damages, injuries, and loss of life caused by accidents involving flammable liquids in rail transportation are intolerable given that multilayered mitigation measures involving the tank car, railroad operating practices, and emergency response were painstakingly developed, but are far from being fully implemented. The NTSB is concerned that the ethanol fleet of about 27,900 unmodified DOT-111 legacy tank cars and Association of American Railroads (AAR) Casualty Prevention Circular (CPC)-1232 tank cars may continue to remain in service without safety retrofits during the next 6 years.29 Operators are required to retrofit or phase out ethanol fleet tank cars in parallel with that of an estimated 127,000 tank cars that carry other flammable liquids. The first two tank cars to derail in this accident were constructed using the CPC-1232 specifications; both tank cars remained intact. The remaining derailed cars were part of the older DOT-111 legacy tank car fleet. While the ethanol releases and the postaccident pool fire might have been prevented had the two affected tank cars had head shields and tank jackets, these features are not required for nonjacketed DOT-111 tank cars in ethanol service until May 1, 2023. The NTSB believes that the continued use of DOT-111 tank cars in trains transporting flammable hazardous materials emphasizes the importance of routing trains on tracks that are well maintained and less likely to cause derailments. Routing High-Hazard Flammable Trains Postaccident examinations of the track near Lesterville revealed multiple rail defects that could result in derailments. Some of these defects were not found during routine inspections; had they been identified, the Class 1 track designation would still have allowed BNSF to defer making the repairs. The FRA Track Safety Standards use a strategy of lowering the classification of track, thereby lowering the speed of the trains, to mitigate the risk of a catastrophic derailment.30

27 The Packing Group of a hazardous material is based on the degree of danger it presents: Packing Group I - Great Danger, Packing Group II - Medium Danger, Packing Group III - Minor Danger. 28 “Hazardous Materials: FAST Act Requirements for Flammable Liquids and Rail Tank Cars,” Federal Register 81, no. 157 (August 15, 2016): 53935. 29 (a) K. Neels & M. Berkman, A Review of the Pipeline and Hazardous Materials Safety Administration’s Draft Regulatory Impact Analysis, Docket No. PHMSA 2012-0082 (HM-251), prepared for the Railway Supply Institute Committee on Tank Cars (November 2014); (b) AAR CPC-1232 required that tank cars ordered for crude oil or ethanol service after October 1, 2011, include a thicker shell and half-height head shield for greater puncture resistance than other Specification-111 tank cars. 30 Title 49 CFR 213.113 “Defective rails”.

BNSF Railway Unit Ethanol Train Derailment

11 Although this may be a practical approach for low-density, slow-speed tracks that handle general freight, the results of even a minor derailment can be catastrophic when a high-hazard flammable train (HHFT) is involved.31 The NTSB believes that the maintenance standards allowed for Class 1 track increases the risk of derailments, particularly of HHFTs, to unacceptable levels. Although both newer tank cars and older legacy DOT-111 tank cars were involved in the derailment, only the legacy DOT-111 tank cars breached. The legacy DOT-111 tank cars are eligible to transport ethanol until May 1, 2023. The NTSB believes that routing trains that transport flammable hazardous materials on well-maintained tracks lowers the possibility of derailment, which counteracts the increased risk of tank car failures caused by the continued use of legacy DOT-111 tank cars. On March 31, 2016, PHMSA changed its regulations to require railroads to analyze HHFT routes. Railroads are required under 49 CFR 172.820 to perform a risk analysis to determine the routing of a train identified as an HHFT. Appendix D to Part 172 lists 27 items for railroads to consider when performing the risk analysis. Item 5 of appendix D states, “Track type, class, and maintenance schedule.” However, the regulation does not provide specific direction for railroads to analyze the risks associated with the track type, class, and maintenance schedule. Further, the list in appendix D does not mention the increased risk associated with the use of the older DOT-111 tank cars. The NTSB believes that three additional significant factors must be considered when routing HHFT trains: (1) the increased derailment risk associated with Class 1 track, (2) the weight of the tank cars in relation to the weight of the rail, and (3) the potential failure of legacy DOT-111 tank cars during derailments. Therefore, the NTSB recommends that PHMSA include the increased derailment risks associated with Class 1 track, the relationship between the weight of the railcars and the weight of the rail, and the potential failure of legacy DOT-111 tank cars during derailments in the list of items for railroads to consider when determining the routes for HHFTs or HHFUTs, as found in appendix D of 49 CFR Part 172. In addition, the NTSB recommends that PHMSA and the FRA work together to develop specific guidance for railroads when using the list of items found in appendix D of 49 CFR Part 172 in their risk assessments and apply the information gathered in those risk assessments when analyzing proposed routes for HHFTs or HHFUTs. Probable Cause The National Transportation Safety Board determines that the probable cause of the broken rail, derailment, and subsequent fire was BNSF Railway Company’s decision to defer track maintenance and continue to operate high-hazard flammable unit trains on the Aberdeen Subdivision. Contributing to the accident was the Federal Railroad Administration’s track maintenance regulation that allowed high-hazard flammable unit trains to continue to operate after the track was reclassified to a lower standard. Contributing to the tank car breach and subsequent fire was the continued use of legacy US Department of Transportation-111 tank cars to carry flammable products.

31 An HHFT is a single train transporting 20 or more loaded tank cars of a Class 3 flammable liquid in a continuous block or a single train carrying 35 or more loaded tank cars of a Class 3 flammable liquid throughout the train consist.

BNSF Railway Unit Ethanol Train Derailment

12 Recommendations The National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration: Include the increased derailment risks associated with Class 1 track, the relationship between the weight of the railcars and the weight of the rail, and the potential failure of legacy US Department of Transportation-111 tank cars during derailments in the list of items for railroads to consider when determining the routes for high-hazard flammable trains or high-hazard flammable unit trains, as found in appendix D of title 49 Code of Federal Regulations Part 172. (R-17-05) To the Pipeline and Hazardous Materials Safety Administration and Federal Railroad Administration: Work together to develop specific guidance for railroads when using the list of items found in appendix D of title 49 Code of Federal Regulations Part 172 in their risk assessments and apply the information gathered in those risk assessments when analyzing proposed routes for high-hazard flammable trains or high-hazard flammable unit trains. (R-17-06) For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident identification DCA15FR016. BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

EARL F. WEENER Acting Chairman

Member

CHRISTOPHER A. HART

T. BELLA DINH-ZARR Member

Member

Adopted: June 26, 2017

BNSF Railway Unit Ethanol Train Derailment

13

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a railroad accident in which there is a fatality or substantial property damage, or that involves a passenger train. (Title 49 United States Code (USC) Section 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 USC 1154(b).

BNSF Railway Unit Ethanol Train Derailment

14 Appendix The operating speed limits for the various classes of track are as follows:1 Table 1. Speed limits for classes of track. Type of track Maximum speed for freight trains Maximum speed for passenger trains Excepted track 10 mph N/A Class 1 track 10 mph 15 mph Class 2 track 25 mph 30 mph Class 3 track 40 mph 60 mph Class 4 track 60 mph 80 mph Class 5 track 80 mph 90 mph

1 Title 49 CFR 213.9 “Classes of track: operating speed limits”.

FD07485 ｜ 2017_美国_RAB1712.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

57242

NTSB/RAB-/

National Transportation Safety Board Railroad Accident Brief BNSF Railway Crude Oil Unit Train Derailment Heimdal, North Dakota The Accident On May 6, 2015, at 7:21 a.m. central daylight time, a BNSF Railway (BNSF) crude oil unit train derailed six cars (81 through 86) near Heimdal, North Dakota.1 The train, consisting of three locomotives, two buffer cars, and 107 loaded tank cars carrying crude oil, was operating at 45 mph when the cars derailed. The train separated after a broken wheel on the 81st car struck the leading edge of the highway-rail grade crossing at milepost 149.01. A mark on the track structure at milepost 153.87 indicated that the broken wheel could not maintain its normal position on the rail at that point and the derailment sequence began.2 The momentum of the train pulled the 81st car and the following five cars off the track. Five of the derailed tank cars breached and released about 96,400 gallons of crude oil, which fueled a fire about 1 mile east of Heimdal.3 About 30 people were evacuated from Heimdal and the surrounding area due to the smoke plume that extended north. At the time of the accident, the sky was overcast and the temperature was 57°F. BNSF estimated damage at $5 million.

1 The investigation of this accident was limited in scope and focused on the failure of the railroad equipment and its cause, regulations, and guidance regarding identification of the conditions that lead to such failures, and the results of railroad equipment failures on unit trains carrying hazardous materials, specifically crude oil from the Bakken region. These issues and their interrelation were detailed, broad, and timely, and, thus, the investigation did not look at the role of human performance in this accident. 2 Milepost numbering decreases in the direction of train travel. 3 The number of derailed cars that breached and released crude oil is incorrectly stated as four in documents in the NTSB public docket for this accident. This error is corrected in this brief report.

BNSF Railway Crude Oil Unit Train Derailment

2

Figure 1. Accident scene. The Investigation Train Inspection According to BNSF records, 2 days before the accident, mechanical inspectors conducted a Class I air brake test and a predeparture inspection of the train at the Hess Corporation loading facility in Tioga, North Dakota. The inspectors found a defective wheel on one car, which was removed from the train, and they had seven repairs made to other cars before the train went into service. After the accident, investigators conducted an air brake test and inspected the cars that did not derail. No significant defects were found. During an inspection of the six derailed cars, investigators found that the left wheel in the second position on car 81was broken due to a vertical split rim (VSR).4 Two pieces of the broken wheel were found at milepost 150.7. Wheel Impact Load Detector Data A wheel impact load detector (WILD) is an electronic data collection device that measures the vertical impact forces of a train wheel on the rail via rail-mounted strain gauges placed on the web of the rail. A WILD can measure impact forces caused by flat, shelled, spalled, out-of-round, and damaged wheels and wheels with built-up tread.5 A WILD measures impact force in kips (1,000 pounds of force). High-impact wheel forces can damage cargo and track infrastructure, primarily rails. The severe stress on a wheel from impacting the rail can cause a fracture that can spread and start chipping off pieces of the tread surface. Once this starts, the fracture and chipping

4 Vertical split rim failures in wheels manifest as subsurface fatigue cracking parallel to the tread surface of the train wheel, followed by an inward vertical overstress fracture perpendicular to the tread surface. This complex cracking eventually leads to the catastrophic failure of the wheel under repeated loads. 5 Spalling is the separation of particles in the form of flakes from a surface that is commonly associated with rolling- element bearings and with gear teeth. Spalling is usually the result of subsurface fatigue.

BNSF Railway Crude Oil Unit Train Derailment

3 can continue to grow if the wheel is left in service; this process is called wheel shelling. The geometry of the shelled spot on the wheel does not conform to that of the rest of the wheel surface, and the spot impacts the rail with every rotation (similar to a hammer strike on the railhead). The larger the shelled spot, the harder the impact. A preemptive reduction of the high-impact forces is achieved by “truing” faulty wheels and removing damaged wheels.6 These actions benefit the railroads by reducing derailments, rail fatigue, bearing damage, cold weather rail fractures, car and truck damage, concrete tie cracking, and wood tie-plate cutting and by improving wheel tread life and fuel efficiency. The WILD data history of the broken wheel indicated increasing forces that exceeded 80 kips before ultimate failure of the wheel. (See figure 2.)

Figure 2. Wheel impact load of car TRFX 1224 November 5, 2014–May 3, 2015. The impact load of car TRFX 1224 increased between November 5, 2014, and May 3, 2015, to the point where it exceeded 80 kips. In four instances before the derailment, the impact load reading for the subject wheel was near or above 80 kips: (1) March 2, 2015, 79.27 kips; (2) March 30, 2015, 79.02 kips; (3) April 19, 2015, 81.58 kips; and (4) April 24, 2015, 82.74 kips. Broken Wheel Examination The fractured wheel fragments, sectioned axle halves, and an intact wheel were sent to the NTSB Materials Laboratory for examination. (See figure 3.) The fracture surface exhibited subsurface fatigue cracking parallel to the tread surface of the train wheel followed by a vertical overstress fracture perpendicular to the tread surface running inward. The wheel fracture features were consistent with VSR failure. Subsequent fatigue cracking propagated from the bottom of the VSR. Once these cracks progressed far enough into the wheel, the wheel catastrophically failed due to multiple overstress fractures, leaving a remnant of the inner wheel hub about the axle.

6 Truing is a process that reshapes a defective wheel or wheel set to an acceptable standard (that is, the wheel becomes trued).

BNSF Railway Crude Oil Unit Train Derailment

4

Figure 3. Broken accident wheel at accident site placed as if it were unbroken. Additional examination of wheel sections found that the wheel met the prescribed chemical composition. The mechanical properties, including hardness and tensile strength, also met all requirements. There were no indications that the fractured wheel was manufactured improperly. Examination of the internal residual stress profile of the wheel found surface compressive stress followed by a subsurface tensile stress region. This residual stress profile was consistent with those of VSR failures and was also consistent with the observed fracture features. Association of American Railroads Interchange Rules Rail car equipment and wheel inspections are part of the Association of American Railroads (AAR) interchange rules. Interchange rule 41 specifies the impact threshold values at which qualified mechanical inspectors can remove a rail car from service and designate or schedule that car for specific billable repairs. The Federal Railroad Administration (FRA) mechanical equipment regulations also define specific deficiencies that an inspector uses to assess rail car repair decisions.7 A WILD, described above, is one method of assessing in-service equipment and wheel health. As the railroad reviews the WILD data, it notifies the car owner to repair the car, provides a slow order for the car, or removes the car from service until repairs are completed.8 The AAR thresholds for impact loads at the time of this accident were:

7 Title 49 Code of Federal Regulations (CFR) Part 215 “Railroad freight car safety standards;” Part 231 “Railroad safety appliance standards;” and Part 232 “Brake system safety standards for freight and other non-passenger train and equipment; end-of-train devices.” 8 A slow order is an operating procedure for informing train crews of a restriction in the authorized speed for a given area and track.

BNSF Railway Crude Oil Unit Train Derailment

5 • 65 kips: Issue maintenance advisory for the affected car • 80 kips: Change the wheel at the tank car’s next visit to a repair or shop track • 90 kips: Condemn the wheel and replace at the first opportunity9 Normally, the carrying railroad will make repairs to a car that has a defect and meets the AAR interchange rules criteria. These rules, if met, allow the carrying railroad to bill the car owner for repairs made to the defective condition. If a repair to a car does not meet this criterion, the carrying railroad is responsible for the cost and is less likely to make these repairs. FRA Safety Advisory On April 27, 2015, the FRA issued Safety Advisory 2015-01, Mechanical Inspections and Wheel Impact Load Detector Standards for Trains Transporting Large Amounts of Class 3 Flammable Liquids. The safety advisory cited multiple derailments due to wheel failures and focused on the March 5, 2015, derailment and fire of a BNSF unit crude oil train near Galena, Illinois. The FRA’s preliminary investigation concluded that a broken wheel from one of the loaded tank cars caused the derailment. During the investigation, the FRA discovered that the broken wheel’s impact load registered 83.87 kips just prior to the derailment. The same wheel’s impact load was measured over 80 kips 1 month earlier at two different WILD locations. The FRA safety advisory recommended that railroads (and the AAR via amendment to its interchange rules) lower the impact threshold for action to replace the wheels on any car in a high-hazard flammable train (HHFT).10 The safety advisory essentially lowered the wheel impact load thresholds below the AAR requirements, to 60-, 70-, or 80-kips for the actions listed above. If the parameters in the FRA advisory had been followed before the accident, the failure of the wheel and ultimate derailment may have been prevented. The AAR interchange rules restrict railroads subject to those rules to replacing wheel sets in accordance with the FRA’s guidance. The 90-kip threshold appears to be too high a level of wheel impact/damage before initiating any remedial action as the Heimdal accident indicates.11 However, with the FRA’s safety advisory suggesting lower wheel impact load thresholds, it is advisable that the appropriate levels of those loads be determined before a regulation is developed and implemented. Therefore, the NTSB recommends that the FRA research and evaluate wheel impact load thresholds to find remedial actions that address the mechanical condition of tank cars used in HHFTs. The NTSB further recommends that after the evaluation is completed, the FRA mandate remedial actions that railroads should take to prevent mechanical defects that are identified by WILDs.

9 According to L.B. Foster Salient Systems, a major manufacturer of wheel impact load detectors (WILD), “a series of strain gage load circuits, micro-welded directly to the neutral axis of a rail, create an instrumented zone for the measurement of vertical forces exerted by each wheel of a passing train. Signal processors, housed in a nearby enclosure, analyze the data to isolate wheel tread irregularities. If any wheel generates a force that exceeds a customer-configured alarming threshold, a report identifies that wheel for action. Customers can configure multiple alarm thresholds corresponding to their operation procedures. These reports are distributed in real time to such interested parties as rail traffic control centers and vehicle repair shops.” (LBFoster Salient Systems website) 10 An HHFT is a single train transporting 20 or more loaded tank cars of a Class 3 flammable liquid in a continuous block or a single train that is carrying 35 or more loaded tank cars of a Class 3 flammable liquid. 11 See descriptions of additional accidents with similar impact load readings, below at “Review of Transportation Safety Board of Canada Accident Data.

BNSF Railway Crude Oil Unit Train Derailment

6 Current Industry Practice In September 2016, investigators contacted the seven largest freight railroads and Amtrak (National Railroad Passenger Corporation) for information about their adoption of (1) the FRA safety advisory, (2) the AAR’s wheel change policy, and (3) the procedures for addressing impact loads of 80 kips or more. Six of the eight railroads responded: Two railroads had adopted elements of the FRA’s safety advisory, four did not adopt any elements of the advisory, three follow the AAR requirement, and two have restrictions that exceed the AAR requirement for 80 kips or more.12 . Three railroads did not respond. Review of Transportation Safety Board of Canada Accident Data Specific data on VSR failures in the United States are limited because most train wheel fractures have been categorized as shattered rims, which are typically caused during manufacturing. The analysis of the VSRs showed that the fractures usually begin at areas of tread damage that result from shelling or from spalling and cracking that propagates into the rim section under load because of induced residual stresses. The Transportation Safety Board of Canada (TSB) has investigated accidents where a VSR was the probable cause. The NTSB requested accident investigation data from the TSB to obtain data for VSR-caused accidents. The TSB’s data show that the agency investigated multiple VSR accidents, including: • Fort Frasier, British Columbia: A gondola car carrying coal sustained a VSR resulting in a derailment after receiving three impact load readings between 80 and 89 kips during the prior months. • Copart, Ontario: A car sustained a VSR resulting in wheel failure and derailment about 6 hours after receiving an 83-kip impact load reading. • Cariboo, British Columbia: A gondola car carrying coal sustained a VSR resulting in a wheel failure and derailment less than 2 hours after receiving an 83-kip impact load reading. • White River, Ontario: A US Department of Transportation (DOT)-111 tank car carrying crude oil sustained a VSR that resulted in a derailment after receiving nine 80- to 89-kip impact load readings in the months before the wheel failure. Studies of Vertical Split Rim Failures Loaded tank cars typically weigh 286,000 pounds and carry some of the heaviest loads impacting the railroad infrastructure. The Transportation Technology Center, Incorporated (TTCI) and the railroad industry test train wheels in both laboratory and field conditions that include finite element modeling.13 Crack propagation studies have been performed using induced flaws to study

12 The two railroads that made changes indicated that wheel replacements have increased, more wheels with impact loads greater than 80 kips are being removed, and crews are stopping trains that have impact loads greater than 120 kips. 13 TTCI is a transportation research and testing organization that is a subsidiary of the AAR. TTCI also manages the FRA’s Transportation Technology Center in Pueblo, Colorado, which is involved in the research, development, and testing of rail infrastructure and equipment and the training of first responders to handle hazardous materials accidents.

BNSF Railway Crude Oil Unit Train Derailment

7 effects of crack growth rate, wheel and rail loads, and ambient temperature.14 In a study of 24-wheel sets with broken wheels, the TTCI determined that the dominant failure mode was VSR. Re-creating a VSR defect under laboratory conditions has been difficult and has produced inconclusive results.15 Based upon the FRA’s initiative with its safety advisory, the accident WILD data, the lack of universal adoption by the railroads of the safety advisory, and the high risk associated with HHFT trains, the NTSB believes that additional research is needed to determine safe operating levels of equipment with elevated impact load readings. Therefore, the NTSB recommends that the FRA and the AAR collaborate in evaluating safe impact load thresholds to determine remedial actions for suspect defective wheels in HHFT service based upon equipment detector data and revise the FRA safety advisory and the AAR interchange rules. Hazardous Materials In this accident, five of the derailed tank cars breached, releasing about 96,500 gallons of crude oil from the Bakken region of North Dakota.16 The cars were placarded with United Nations number 1267, signifying petroleum crude oil, which is a Hazard Class 3 flammable liquid. The shipper classified the crude oil as a Packing Group (PG) I, which reflects the most severe level of danger.17 The Pipeline and Hazardous Materials Safety Administration (PHMSA) tested crude oil samples from the Heimdal shipment and confirmed the shipper had appropriately classified and packaged the crude oil as PG I. All the derailed tank cars were Specification DOT-111A100W1 (DOT-111) cars constructed to the AAR’s CPC-1232 industry standard for tank cars that were ordered after October 1, 2011.18 These nonjacketed CPC-1232 tank cars are authorized for the shipment of PG I crude oil until April 1, 2020.19 The tank cars were equipped with 0.531-inch-thick heads, 0.5-inch-thick tank shells, and half-height head shields. The tank cars did not have jackets or thermal protection systems. Two of the tank cars were punctured from impact with objects in the derailment, two sustained small thermal tears from exposure to the pool fire, and one released some of its contents when the bottom outlet valve handle was damaged in the derailment and partially opened. One of the punctured tank cars, car 83 (TRFX1374), sustained mechanical tears near the edge of its head and over a more than 12-feet-long area along the lower center of the tank where it had contacted a piece of broken rail. It is unknown whether thicker shell material, a jacket, and a thermal protection blanket would have added enough puncture resistance to prevent such severe breaching damage.

14 Cameron Lonsdale, et. al, “Development of Railroad Wheel Rim Axial Residual Stress in Heavy Axle Load Service,” proceedings of the ASME Rail Transportation Division 2013 Fall Technical Conference. 15 K. Jones, S. Cummings. “Wheel Failures: Digging Down to the Roots,” Railway Age (September 10, 2014). 16 Bakken crude oil comes from the Bakken geological formation, which is a rich source of oil and natural gas that extends through North Dakota and Montana, as well as some Canadian provinces. For more information, see the Hazardous Material Group Factual Report. 17 Title 49 CFR Part 173 contains packing group assignment criteria. The Packing Group of a hazardous material is based on the degree of danger it presents: Packing Group I - Great Danger, Packing Group II - Medium Danger, Packing Group III - Minor Danger. For more information, see the Hazardous Material Group Factual Report. 18 AAR CPC-1232 required that tank cars ordered for crude oil or ethanol service after October 1, 2011, include a thicker shell and a half-height head shield for puncture resistance greater than other Specification-111 tank cars. 19 Hazardous Materials: FAST Act Requirements for Flammable Liquids and Rail Tank Cars,” Federal Register 81, no. 157 (August 15, 2016): 53935.

BNSF Railway Crude Oil Unit Train Derailment

8 The second mechanically breached tank car, car 84 (TRFX1056), released part of its contents when it was impacted by the adjacent tank car coupler. This car was punctured near the head-shell interface. Headshields would normally be expected to arrest such an impact to prevent the head from breaching. However, the bolt-on, half-height headshield separated from the tank car and failed to protect the tank head from the impact damage. Full-height headshields, such as those affixed to jacketed tank cars, are incorporated into the jacket and would not have separated from a tank car even during severe derailment conditions. If the CPC-1232 tank cars in this accident had been equipped with full headshields incorporated into tank jackets, the head puncture and subsequent release of crude oil from this tank car probably would not have occurred. Because the CPC-1232 tank cars in this accident were not equipped with jackets and thermal protection systems, they were not designed to survive prolonged pool-fire exposure. Nevertheless, the lack of a high-energy fireball in the case of two thermally exposed tank cars (TRFX1170 and TRFX1176) suggests that the rate and intensity of fire exposure did not overwhelm the capacity of the pressure relief devices. Moreover, both tank cars exhibited small 10-inch thermal tears, and the tank shell material did not show evidence of extensive thermal damage. Even though any tank car breach and any release of product are undesirable, the relatively minor thermally induced shell tears sustained in two tank cars did not significantly contribute to the severity of the accident. Since this accident, PHMSA has issued regulations that require a more robust new Specification DOT-117 tank car for flammable liquids service, including crude oil.20 The DOT-117 tank cars are designed with protective features to mitigate and prevent both mechanical and thermally induced breaching damages. The federal regulations require nonjacketed CPC-1232 tank cars in crude oil service, such as the derailed tank cars in this accident, to be either removed from service or retrofitted to DOT-117 standards by April 1, 2020, with the addition of jackets, thermal protection systems, full headshields, and top and bottom fittings protection.21 Crude oil transportation market conditions have led to a reduction in the number of nonjacketed CPC-1232 tank cars used in crude oil service from 17,962 in 2015 to 8,498 in 2016.22 Many of those tank cars taken out of crude oil service are idle or have been repurposed for other commodities. Also, only about 13.5 percent of the tank cars used to ship crude oil in 2016 were compliant with DOT specification 117.23 Crude Oil Classification and Characterization The classification of Bakken crude oil emerged as a safety concern after the TSB released its findings for the investigation of the July 6, 2013 Lac-Megantic crude oil rail accident.24 The crude oil testing results from that shipment revealed that the shipper had reported the wrong packing group, indicating a less hazardous material. As a result of its participation in the TSB investigation, the NTSB issued the following safety recommendation to PHMSA: R-14-6

20 Specification requirements for DOT-117 tank cars are contained in 49 CFR Subpart 179.202. 21 Federal Register 81, no. 157 (August 15, 2016): 53935. 22 R. Fronczak, “Status of the North American Flammable Liquids Fleet,” presentation to the AAR Tank Car Committee, April 19, 2017. 23 Fronczak, 2017. 24 Transportation Safety Board of Canada, Runaway and Main-Track Derailment, Montreal, Maine & Atlantic Railway Freight Train MMA-002, Mile 0.23, Sherbrooke Subdivision, Lac-Mégantic Quebec, 06 July 2013, Railway Investigation Report R13D0054 (Gatineau, Quebec, Canada: Transportation Safety Board of Canada, 2014).

BNSF Railway Crude Oil Unit Train Derailment

9 Require shippers to sufficiently test and document the physical and chemical characteristics of hazardous materials to ensure the proper classification, packaging, and record-keeping of products offered in transportation. PHMSA has not issued new requirements for shippers with specific testing requirements, and the NTSB changed the status of Safety Recommendation R-14-6 to “Open—Unacceptable Response.” Both PHMSA and the FRA issued safety alerts to warn the public and emergency responders that crude oil from the Bakken region “may” be more flammable than traditional heavy crude. The agencies also issued joint safety advisories and emergency orders to shippers of hazardous materials and rail carriers to emphasize the importance of “proper characterization, classification and selection of a packing group for Class 3 materials.” The advisories also instructed shippers not to rely solely on generic Safety Data Sheets, which do not validate the properties of each shipment of crude oil. Recent research by both federal agencies and the petroleum industry evaluated the physical and chemical properties of crude oil and found wide variations in the composition of the material.25 This was due to a number of factors such as geographical origin and lack of uniform and consistent sampling and testing methods for crude oil. The inconsistencies with the crude oil and testing methods could lead the shipper to misclassify the material and erroneously select the wrong packing group. In response to the classification issues and a spate of crude oil accidents in North America, the North Dakota Industrial Commission (NDIC) issued Oil Conditioning Order 25417, which took effect on April 1, 2015.26 The NDIC order focused on the vapor pressure of crude oil, requiring production facilities in North Dakota to separate gaseous and light hydrocarbons from Bakken crude oil and establish vapor pressure limits for crude oil in transportation. The order to limit crude oil vapor pressure was intended to decrease its volatility or flammability and enhance transportation safety, in an attempt to reduce the risk of major fires and energetic fire ball releases in accidents. The Heimdal accident was the first crude oil unit train accident to occur since the NDIC issued the order. To reduce the vapor pressure of crude oil, the material must be treated in a process called “stabilization,” which is a distillation process to separate the gas, or “light ends,” from the liquid. Oil producers have used stabilization for many years to adjust vapor pressure limits for the transport in pipelines, as well as for refinery specifications.27 The shipper involved in this accident had been stabilizing its crude oil for decades prior to the NDIC order. The shipper’s records indicate that its crude oil product exhibited a lower than mandated vapor pressure before the NDIC order went into effect. The volatility of crude oil has also been a subject of federal rulemaking. On January 17, 2017, PHMSA issued an Advanced Notice of Proposed Rulemaking requesting scientific, safety, and cost/benefit information to assess the merits of a petition to require a Reid vapor pressure limit less

25 (a) PHMSA, “Operation Safe Delivery Update”, July 23, 2014; (b) The North Dakota Petroleum Council Study on Bakken Crude Properties, Bakken Crude Characterization Task Force, August 4, 2014; (c) Survey of Bakken Crude Oil Characteristics Assembled for the U.S. Department of Transportation, American Fuel & Petrochemical Manufacturers, May 14, 2014. 26 See NDIC Oil Conditioning Order 25417. 27 High vapor pressure can result in pump cavitation, which can damage pumps.

BNSF Railway Crude Oil Unit Train Derailment

10 than 9.0 psi for crude oil transported by rail.28 This information is needed to supplement the limited available scientific data on crude oil properties and the role of flammable liquid volatility in the consequences of railroad accidents. Other factors such as thermodynamic properties, weather conditions, volume of material released, and landscape, have also been identified as relevant factors in the severity of injuries and damages caused by fiery crude oil releases. Furthermore, available empirical accident data is not yet available to evaluate the extent to which new specification DOT-117 tank cars mitigate the risk associated with transporting volatile crude oil. As of the date of this report, PHMSA has not announced any regulatory initiatives to address this issue. In 2014, the Department of Energy (DOE) and the DOT commissioned Sandia National Laboratories (Sandia) to develop a multiphase plan to study and quantify the risks associated with frequent and large volume rail transport of flammable crude oils. In March 2015 Sandia released a report following the first phase to assess publicly available chemical and physical data on crude oil properties that could contribute to the potential for accidental combustion events.29 The report found the data on crude oil properties to be insufficient because of the lack of standardized sampling and testing methods across the crude oil supply chain. Sandia’s next tasks involve actual sampling, testing, and modeling of different crude oils obtained from different regions of the United States to understand the behavior of the material. As of the date of this report, work is ongoing; the DOE is expected to publish another report in early 2018. The completion of Sandia’s research would assist in identifying the key chemical and physical properties of crude oil, as well as any other external factors, which may contribute to the severity of a rail accident, including validating what role, if any, that vapor pressure plays in tank car accident performance. Such information is critical when trying to develop effective regulations for safe transport of crude oil. Postaccident Actions BNSF modified its Level 1, 2, and 3 handling instructions for cars as follows: • Level 1 (stop and inspect) o for hazardous materials: greater than or equal to 120 kips o for all other traffic: greater than or equal to 140 kips • Level 2 (next assigned set out location) o for hazardous materials: 110–120 kips o for all other traffic: 120 –140 kips • Level 3 (next scheduled mechanical or empty return) o for hazardous materials: 90–110 kips o for all other traffic: 90–120 kips

28 (a) Hazardous Materials: Volatility of Unrefined Petroleum Products and Class 3 Materials, Advance Notice of Proposed Rulemaking Federal Register 82, no. 11 (January 18, 2017): 5499, January 18, 2017; (b) Reid vapor pressure is one of several methods for measuring vapor pressure. 29 Literature Survey of Crude Oil Properties Relevant to handling and Fire Safety in Transport, DOT/DOT Tight Crude Oil Flammability and Transportation Spill Safety Project (Sandia National Laboratories, Albuquerque, New Mexico, 2015).

BNSF Railway Crude Oil Unit Train Derailment

11 According to BNSF, the company did not change or add to the handling instructions for wheels with 60-, 70-, and 80-kip readings. BNSF implemented the Comprehensive Mechanical Equipment Health application to raise the visibility to actionable alerts as follows: (1) car wheels with readings greater than or equal to 80 kips while on the repair track will be replaced, and (2) car wheels with readings greater than or equal to 90 kips in the train yard will be replaced. Probable Cause The National Transportation Safety Board determines that the probable cause of this derailment was failure of a wheel on the 81st tank car due to a vertical split rim. Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Railroad Administration: Research and evaluate wheel impact load thresholds to find remedial actions that address the mechanical condition of tank cars used in high-hazard flammable trains. (R-17-032) Mandate remedial actions that railroads should take to avoid or identify mechanical defects that are identified by wheel impact load detectors. (R-17-033) To the Federal Railroad Administration and the Association of American Railroads: Collaborate in the evaluation of safe kip thresholds to determine the remedial actions for suspected defective wheels conditions in high-hazard flammable train service based upon equipment detector data, and revise the Federal Railroad Administration Safety Advisory 2015-01 and the Association of American Railroads interchange rules. (R-17-034) BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

EARL F. WEENER Chairman

Member

CHRISTOPHER A. HART

T. BELLA DINH-ZARR Member

Member

Adopted: December 29, 2017

For more details about this accident, visit the NTSB Docket and search for NTSB accident identification number DCA15FR009.

BNSF Railway Crude Oil Unit Train Derailment

12

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a railroad accident in which there is a fatality or substantial property damage, or that involves a passenger train. (49 United States Code, Section 1131 - General authority) The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code, Section 1154(b).

FD07486 ｜ 2017_美国_RAR1701.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Highway-Railroad Grade Crossing Collision Commerce Street Valhalla, New York February 3, 2015

Accident Report NTSB/RAR-17/01 PB2017-102658

National Transportation Safety Board

NTSB/RAR-17/01 PB2017-102658 Notation 56754 Adopted July 25, 2017

Railroad Accident Report Highway-Railroad Grade Crossing Collision Commerce Street Valhalla, New York February 3, 2015

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2017. Highway-Railroad Grade Crossing Collision, Commerce Street, Valhalla, New York, February 3, 2015. Railroad Accident Report NTSB/RAR-17/01. Washington, DC.

Abstract: On February 3, 2015, at 6:26 p.m., a vehicle driven by a 49-year-old woman, traveled northwest on Commerce Street in Valhalla, New York, toward a highway-railroad grade crossing. The driver entered the boundary of the grade crossing and stopped. The driver then moved beyond the boundary and stopped adjacent to the railroad tracks. The grade crossing warning system activated and the gate came down, striking the rear of the vehicle. She exited her vehicle, examined the gate, then returned to her vehicle and moved forward on to the tracks. Meanwhile, a Metro-North Railroad train approached the grade crossing. The engineer activated the emergency brakes and collided with the vehicle at 51 mph. The train and the vehicle continued north, damaging the electrified third rail which pierced the vehicle and penetrated the lead railcar. Five passengers died and nine passengers and the engineer were injured, all in the lead railcar. The driver of the vehicle also died. The NTSB made new recommendations to the Federal Transit Administration; Metro-North; Long Island Rail Road, Amtrak, Port Authority Trans-Hudson Corporation, and Southeastern Pennsylvania Transportation Authority; the New York Department of Transportation, and the town of Mount Pleasant, New York.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA15MR006. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2017-102658 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

56754 Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iv Abbreviations and Acronyms .......................................................................................................v Executive Summary .................................................................................................................... vii

1. Factual Information .................................................................................................................1
2. 1 Accident Narrative ...................................................................................................................1
3. 2 Factors Associated with the SUV .............................................................................................4
4. 2.1 Accident Trip .................................................................................................................4
5. 2.2 SUV Driver ....................................................................................................................7
6. 2.2.1 ... Recent Activity and Sleep History ..................................................................7
7. 2.2.2 ... Cell Phone Use ................................................................................................8
8. 2.2.3 ... Medical Factors ...............................................................................................9
9. 2.2.4 ... Licensing .........................................................................................................9
10. 2.2.5 ... Driving History and Experience ......................................................................9
11. 2.2.6 ... Vehicle Familiarity ........................................................................................10
12. 2.3 SUV Inspection and Recalls ........................................................................................10
13. 3 Highway Factors and Railroad Grade Crossing .....................................................................11
14. 3.1 Commerce Street Grade Crossing ................................................................................11
15. 3.2 Highway Grade Crossing Warnings ............................................................................12
16. 3.3 Commerce Street Grade Crossing Warning System ....................................................14
17. 3.4 Taconic State Parkway and Commerce Street Traffic Signals ....................................15
18. 3.5 Railroad Warning System Data Logger .......................................................................17
19. 3.6 Grade Crossing Warning System .................................................................................17
20. 4 Metro-North Railroad .............................................................................................................18
21. 4.1 Railroad Operations .....................................................................................................18
22. 4.2 Method of Operation ....................................................................................................19
23. 4.3 Metro-North Train 659 ................................................................................................20
24. 4.3.1 ... Event Recorder Data .....................................................................................20
25. 4.3.2 ... Train Horn Requirements ..............................................................................21
26. 4.4 Engineer’s Sleep/Wake/Work History .........................................................................21
27. 4.5 Cell Phone Use .............................................................................................................22
28. 4.6 Toxicological Testing ..................................................................................................22
29. 5 Metro-North’s Track and Third Rail Power ...........................................................................22
30. 5.1 Third Rail Structure .....................................................................................................24
31. 5.2 Other FRA-Regulated Third Rail Properties ...............................................................24
32. 5.3 Traction Power Data ....................................................................................................25
33. 5.4 Third Rail Inspection Requirements ............................................................................25
34. 6 Survival Factors ......................................................................................................................26
35. 7 Emergency Response .............................................................................................................26
36. 8 Railcar Crashworthiness, Materials, and Fire ........................................................................27

NTSB Railroad Accident Report ii

1. 8.1 Third Rail During Collision .........................................................................................27
2. 8.2 Interior Damage ...........................................................................................................30
3. 8.3 Materials and Fire ........................................................................................................32
4. 8.4 Electrical Damage ........................................................................................................33
5. Analysis ...................................................................................................................................35
6. 1 Introduction ............................................................................................................................35
7. 2 Driver Performance ................................................................................................................35
8. 2.1 Alcohol or Other Drugs ...............................................................................................35
9. 2.2 Medical Factors ............................................................................................................35
10. 2.3 Fatigue..........................................................................................................................35
11. 2.4 Response to Railroad Grade Crossing Warning Systems ............................................36
12. 2.5 Train Warning Devices ................................................................................................37
13. 2.5.1 ... Visual Devices...............................................................................................37
14. 2.5.2 ... Audible Devices ............................................................................................37
15. 2.6 Vehicle Familiarity ......................................................................................................38
16. 2.7 Navigation Systems .....................................................................................................39
17. 3 Metro-North Railroad Third Rail ...........................................................................................40
18. 3.1 Power Control ..............................................................................................................40
19. 3.2 Third Rail Structure .....................................................................................................40
20. 4 Materials, Flammability, and Evacuation ...............................................................................42
21. 5 Highway-Railroad Grade Crossing Warning System ............................................................43
22. 6 Factors Not Contributing to this Accident .............................................................................45
23. Postaccident Actions ..............................................................................................................46
24. 1 Highway Traffic Signal Preemption .......................................................................................46
25. 2 Closure of Commerce Street Grade Crossing ........................................................................47
26. 2.1 Guidance Regarding the Closure of Grade Crossings .................................................47
27. 3 Grade Crossing Awareness and Risk Assessment .................................................................50
28. Conclusions .............................................................................................................................53
29. 1 Findings ..................................................................................................................................53
30. 2 Probable Cause .......................................................................................................................55
31. Recommendations ..................................................................................................................56

Board Member Statements .........................................................................................................58

1. Appendix .................................................................................................................................65
2. 1 Appendix A. Investigation .....................................................................................................65
3. 2 Appendix B. Chronology of Events .......................................................................................66

References .....................................................................................................................................67

NTSB Railroad Accident Report iii

Figures Figure 1. Metro-North train 659 on track 2 after collision with the SUV. .................................... 2 Figure 2. Photograph of the SUV and Metro-North train 659 after the collision. ......................... 3 Figure 3. Postaccident photograph of the interior of the lead railcar. ............................................ 4 Figure 4. Map of the driver’s route. .............................................................................................. 5 Figure 5. Illustration of the grade crossing with the gate arm on the rear of the SUV. ................. 6 Figure 6. 2011 Mercedes Benz ML350 electronic gear-selection lever. ..................................... 10 Figure 7. Accident location. ........................................................................................................ 11 Figure 8. Accident site. ............................................................................................................... 12 Figure 9. Warning sign locations on the northwest approach to the Commerce Street grade crossing. .............................................................................................................................. 13 Figure 10. Approach of the Commerce Street grade crossing, facing northeast. ........................ 14 Figure 11. Traffic signal preemption at accident site................................................................... 16 Figure 12. Metro-North system map highlighting the accident location. .................................... 19 Figure 13. Metro-North’s third rail configuration. ...................................................................... 23 Figure 14. Simplified electrical schematic of traction power substations near Commerce Street. ......................................................................................................................... 24 Figure 15. Path of the third rail entry into Metro-North 4333. .................................................... 28 Figure 16. Entry points and the approximate position of the third rail inside the lead railcar. .... 29 Figure 17. Third rail between railcars Metro-North 4332 and 4333. ........................................... 30 Figure 18. Interior of the lead railcar, front to rear. ..................................................................... 31 Figure 19. Left side of the lead railcar. ........................................................................................ 32 Figure 20. Localized thermal damage to the third rail nose piece surface removed from the lead railcar. .................................................................................................................................... 34 Figure 21. Localized thermal damage to the surface of the third rail removed from the SUV. .. 34 Figure 22. Third rail nose piece involved in this accident. .......................................................... 40 Figure 23. Illustration of third rail and splice bar subjected to in-plane bending. ....................... 41 Figure 24. Billboard advertising grade crossing safety in Astoria, New York. .......................... 51

NTSB Railroad Accident Report iv

Tables Table 1. Driver activities prior to the accident. .............................................................................. 7 Table 2. Driver’s opportunity for sleep. ......................................................................................... 8 Table 3. Engineer's 72-hour on- and off-duty history. ................................................................. 22 Table 4. Occupant injury summary. ............................................................................................. 26 Table 5. Driver’s opportunity for sleep. ....................................................................................... 36 Table 6. Distances between grade crossings on Metro-North near the accident site. .................. 49 Table 7. Closure criteria data for the Commerce Street grade crossing. ...................................... 50 Table A. Chronological listing of accident events. ...................................................................... 66

NTSB Railroad Accident Report v

Abbreviations and Acronyms AC

alternating current Amtrak

National Railroad Passenger Corporation CAMI

Civil Aerospace Medical Institute CFR

Code of Federal Regulations dB

decibels DC

direct current DES

Department of Emergency Services DOT

US Department of Transportation ECC

emergency communications center EMS

emergency medical services FAA

Federal Aviation Administration FHWA

Federal Highway Administration FRA

Federal Railroad Administration FTA

Federal Transit Administration GCT

Grand Central Terminal GPS

global positioning device GIS

geographic information system grade crossing

highway-railroad grade crossing IC

incident command LED

light emitting diode LIRR

Long Island Rail Road Metro-North

Metro-North Railroad

NTSB Railroad Accident Report vi

mph

miles per hour MTA

Metropolitan Transportation Authority MTAPD Metropolitan Transportation Authority Police Department MUTCD

Manual on Uniform Traffic Control Devices NHTSA National Highway Traffic Safety Administration NYDMV state of New York Department of Motor Vehicles NYS MUTCD New York State supplement to Manual on Uniform Traffic Control Devices NTSB

National Transportation Safety Board NYSDOT

state of New York Department of Transportation ODI

Office of Defect Investigation ODOT

state of Ohio Department of Transportation PATH

Port Authority Trans-Hudson Corporation POC

point of collision SCADA

supervisory control and data acquisition SEAR II Safetran Event Analyzer Recorder II SEPTA Southeastern Pennsylvania Transportation Authority SUV

sport-utility vehicle TDOT

state of Texas Department of Transportation UDOT

state of Utah Department of Transportation VVFD

Valhalla Volunteer Fire Department WMC

Westchester Medical Center

NTSB Railroad Accident Report vii

Executive Summary On February 3, 2015, at 6:26 p.m. eastern standard time, a 2011 Mercedes Benz ML350 sport-utility vehicle driven by a 49-year-old woman, traveled northwest on Commerce Street in Valhalla, New York, toward a public highway-railroad grade crossing on the Harlem Subdivision of the Metro-North Railroad. Traffic on Commerce Street was heavy and congested when the driver turned northeast and entered the boundary of the highway-railroad grade crossing and stopped.1 The highway-railroad grade crossing consisted of two highway lanes (one for each direction) and two railroad tracks, and was equipped with reflectorized pavement markings, advance warning signs, flashing lights, and gates. The driver moved beyond the highway-railroad grade crossing boundary (stop line) and stopped adjacent to the railroad tracks. The grade crossing warning system activated and the gate came down, striking the rear of her vehicle. She then exited her vehicle and examined the gate. The driver then returned to her vehicle and moved forward on to the tracks. Meanwhile, Metro-North Railroad passenger train 659, consisting of eight passenger railcars, traveled north and approached the highway-railroad grade crossing at a speed of 59 miles per hour. The engineer from train 659 activated the train’s emergency brakes about 260 feet before the highway-railroad grade crossing and collided with the sport-utility vehicle at a recorded speed of 51 miles per hour. The train and the sport-utility vehicle continued northbound, resulting in the damage of the electrified third rail on the west side of the track. The third rail detached, pierced the sport-utility vehicle, and then entered the railcar. The train and the sport-utility vehicle came to rest about 665 feet from the point of collision. An estimated 343 feet of third rail penetrated the first passenger railcar. Metro-North Railroad estimated 645 passengers were onboard train 659 at the time of the accident. Five passengers died and nine passengers and the engineer were injured, all in the lead railcar. The driver of the sport-utility vehicle also died. This report addresses the following safety issues: • Metro-North Railroad third rail design. Metro-North Railroad’s third rail system was not constructed to fail in a controlled manner or break away.2 The National Transportation Safety Board found that Metro-North Railroad’s third rail system was not constructed to break away when subjected to undesirable overloaded conditions such as those involved in this accident. • Grade crossings. There were three grade crossings within 2 miles of the Commerce Street grade crossing. The state of New York Department of Transportation has a policy that allows for the consolidation of grade crossings wherever possible. The National

1 In this report, the term boundary is used for the reader to conceptualize the location of the sport-utility vehicle past the stop line of the highway-railroad grade crossing. This stop line indicates the point behind which highway vehicles are stopped or might be required to stop when the grade crossing warning system activates. 2 Third rail refers to a conducting rail by which electric traction power is delivered to trains. On this system, as with most systems, the conductor rail is placed on the outside of the running rails.

NTSB Railroad Accident Report viii

Transportation Safety Board determined that the town of Mount Pleasant, New York, should take action to improve grade crossing safety. • Grade crossing risk assessment. The investigation found that the proximity of highway-railroad grade crossings with third rail systems belonging to commuter railroads or rail transit properties could increase the severity of highway-railroad grade crossing accidents. The National Transportation Safety Board found that conducting a risk assessment of such conditions could help mitigate this increased risk of grade crossing accident severity. The National Transportation Safety Board determines that the probable cause of the accident was the driver of the sport-utility vehicle, for undetermined reasons, moving the vehicle on to the tracks while the Commerce Street highway-railroad grade crossing warning system was activated, into the path of Metro-North Railroad train 659. Contributing to the accident was the driver of the sport-utility vehicle: (1) stopping beyond the stop line, within the boundary of the highway-railroad grade crossing, despite warning signs indicating the approach to the grade crossing; and (2) reducing the available time to clear the grade crossing by exiting the vehicle after the grade crossing warning system activated because the driver’s attention was diverted by the grade crossing warning system crossing gate arm striking her vehicle. Contributing to the severity of the accident was the third rail penetrating the passenger compartment of the lead passenger railcar and the postaccident fire.

NTSB Railroad Accident Report 1

• Factual Information

1. 1 Accident Narrative

On February 3, 2015, at 6:26 p.m. eastern standard time, a 2011 Mercedes Benz ML350 sport-utility vehicle (SUV) driven by a 49-year-old woman (driver), traveled northwest on Commerce Street in Valhalla, New York, toward a public highway-railroad grade crossing (US Department of Transportation [DOT] crossing 529-902V) on the Harlem Subdivision (Line) of the Metro-North Railroad (Metro-North).1 Traffic on Commerce Street was heavy and congested when the driver turned northeast and entered the boundary of the highway-railroad grade crossing (grade crossing) and stopped.2 The grade crossing consisted of two highway lanes (one for each direction) and two railroad tracks, and was equipped with reflectorized pavement markings, advance warning signs, flashing lights, and gates. The driver moved beyond the grade crossing boundary (stop line) and stopped adjacent to the railroad tracks. The grade crossing warning system activated and the gate came down, striking the rear of her vehicle. She then exited her vehicle and examined the gate. The driver then returned to her vehicle and moved forward on to the tracks. Meanwhile, Metro-North passenger train 659, consisting of eight passenger railcars, traveled north and approached the grade crossing at a speed of 59 miles per hour (mph). The engineer from train 659 activated the train’s emergency brakes about 260 feet before the grade crossing and collided with the SUV at a recorded speed of 51 mph. (See figure 1.) 1 (a) All times in the report are eastern standard time; (b) although the general direction of the road is northwest, the road jogged northeast to cross the tracks. 2 In this report, the term boundary is used for the reader to conceptualize the location of the SUV past the stop line of the grade crossing. This stop line indicates the point behind which highway vehicles are stopped or might be required to stop when the grade crossing warning system activates.

NTSB Railroad Accident Report 2

Figure 1. Metro-North train 659 on track 2 after collision with the SUV. Metro-North train 659 was traveling north on track 2 toward the Commerce Street grade crossing when it struck the SUV on its passenger side door and pushed it about 665 feet north on the tracks before stopping. During the collision, the electrified third rail first pierced the SUV on its left side under the rear passenger seats, then pierced its fuel tank, and subsequently exited the SUV on the right side, below the frame and behind the right-side rear wheel. As the train and SUV continued to move, the rail was shoved under the left-side front portion of the lead railcar, and subsequently penetrated it from the underside in two locations near the left-side front passenger doorway. (See figure 2.)

NTSB Railroad Accident Report 3

Figure 2. Photograph of the SUV and Metro-North train 659 after the collision. An estimated 386 feet of third rail was damaged, including 11 sections totaling about 343 feet that penetrated the passenger compartment of the lead railcar. A fire ignited that consumed both the SUV and the interior compartment of the lead railcar. (See figure 3.)

NTSB Railroad Accident Report 4

Figure 3. Postaccident photograph of the interior of the lead railcar. Metro-North estimated that train 659 carried 645 passengers at the time of the accident. Five passengers died and nine passengers and the engineer were injured on the train; all of whom were riding in the lead railcar. The driver of the SUV also died. The temperature at the time of the accident was 20°F, it was dark with no precipitation. The area of Commerce Street near the grade crossing was clear and recently plowed of snow. 1.2 Factors Associated with the SUV 1.2.1 Accident Trip According to the driver’s spouse (spouse), the driver was traveling to Scarsdale, New York, to meet a business client at a coffee shop.3 The driver was the sole occupant of the SUV at the time of the accident. In an interview, the spouse said the driver was unfamiliar with the accident location. The driver would have traveled south on Taconic State Parkway, about 8 miles from the intersection with Commerce Street, to reach the destination.

3 The location of the coffee shop was determined to be 51 East Parkway, Scarsdale, New York.

NTSB Railroad Accident Report 5

The driver likely had been detoured on to Commerce Street because of an automobile crash that occurred at the intersection of Taconic State Parkway and Lakeview Avenue at 5:25 p.m. on the day of the accident. (See figure 4.) Lakeview Avenue is located about 0.4-mile southeast of the intersection of Commerce Street and Taconic State Parkway. The earlier crash was in the process of being cleared and the right southbound lane of Taconic State Parkway was being detoured on to Lakeview Avenue.4 After the detour, the driver traveled northwest on Commerce Street toward the grade crossing, back to the intersection of Commerce Street and Taconic State Parkway. To reach Scarsdale, the driver would again have had to turn southeast on to the Taconic State Parkway and choose the left lane to avoid the detour, located in the southbound lanes at the intersection of Taconic State Parkway and Lakeview Avenue.

Figure 4. Map of the driver’s route. (Source: Google Maps.) A motorist (witness) who was traveling behind the SUV when the accident occurred described to investigators that heavy traffic on Commerce Street was “slow and inching along”. The witness said he was traveling behind the SUV at the approach to the grade crossing and that traffic stopped. He said that his vehicle, along with the SUV, had stopped for a “few” seconds when he observed the warning system gate arm begin to lower. The witness said the SUV was

4 Taconic State Parkway is a divided four-lane parkway, with two lanes for each direction.

NTSB Railroad Accident Report 6

sitting within the boundary of the grade crossing when the warning system at Commerce Street activated. (See figure 5.)

Figure 5. Illustration of the grade crossing with the gate arm on the rear of the SUV. (Not to scale.) Investigators asked the witness if the gate arm struck the SUV while it was moving; he answered, “No; it [the SUV] was stopped.” According to the witness, the gate arm lowered on to the rear portion of the SUV. The witness said he looked in his rearview mirror, saw no vehicles behind him, and backed up his vehicle, believing the SUV driver would do the same. The witness said that after he backed his vehicle up about one car-length, he saw the driver of the SUV exit the vehicle, slowly walk around to the rear of the SUV, and touch the gate arm. He characterized the driver’s behavior as calm, and presumed it was because the SUV was not on the track. He said that the front of the car was “just barely making it,” and he believed that the front of the SUV was very close to—but not on—the railroad track. The witness said the driver turned and made eye contact with him after examining the gate arm on the rear of the SUV. From inside his vehicle, the witness motioned to the driver to back up. The witness began backing up his vehicle, while motioning with his hand for the driver to do the same.

NTSB Railroad Accident Report 7

The witness said the driver turned away from him and re-entered the SUV. The witness said he had expected the SUV to back up; however, after a slight pause the SUV moved forward. The SUV moved forward only about one car-length before the train struck it. The witness told investigators he could not see if there was traffic ahead of the SUV that prevented the driver from moving the SUV forward off the tracks. 1.2.2 SUV Driver Investigators obtained information about the driver from interviewing the driver’s spouse, and examining employee time and attendance records, medical records, and cell phone records. 1.2.2.1 Recent Activity and Sleep History Information from cell phone records and interviews with her spouse and co-workers formed the basis of investigators’ reconstruction of the driver’s recent activity history and opportunity for rest. Table 1 summarizes the driver’s activities for the 72-hour period leading up to the accident. Table 1. Driver activities prior to the accident. February 1, 2015 Time Event Source 1:28 a.m. Last text sent before available rest period Cell phone records 8:45 a.m. Driver wakes up Spouse interview 9:00 a.m. Driver leaves home Spouse interview 10:38 a.m. First outbound text message of the day Cell phone records 6:34 p.m. Last phone call of the day Cell phone records February 2, 2015 Time Event Source 12:00 a.m. Driver goes to bed Spouse interview 9:00 a.m. Driver wakes up, works from home Spouse interview 9:47 a.m. First outbound text message of the day Cell phone records 9:29 p.m. Last phone call of the day Cell phone records February 3, 2015 Time Event Source 12:00 a.m. Driver goes to bed Spouse interview 9:00 a.m. Driver wakes up Spouse interview 9:21 a.m. First phone call of the day Cell phone records 9:44 a.m. Driver begins shift at work Employer records 6:00 p.m. Driver ends shift at work Employer records 6:11 p.m. Last phone call before accident occursa Cell phone records 6:26 p.m. Accident occurs

a The driver’s cell phone records indicate this was an incoming call from the spouse that lasted 8 minutes, 41 seconds. The driver was not using the cell phone when the accident occurred. During an interview, the driver’s spouse provided information on the driver’s recent sleep history and general sleep health. Table 2 summarizes the driver’s opportunity for sleep. The reported times are approximate.

NTSB Railroad Accident Report 8

Table 2. Driver’s opportunity for sleep. From To Elapsed Time Date Time Date Time (approximate) February 1 1:27 a.m. February 1 8:45 a.m. 7 hours 18 minutes February 2 12:00 a.m. February 2 9:00 a.m. 9 hours February 3 12:00 a.m. February 3 9:00 a.m. 9 hours The driver’s spouse described the driver’s sleep habits in the days leading up to the accident as typical; she usually stayed up until close to midnight and got up around 9:00 a.m. He said that he considered her sleep health, generally speaking, as normal and indicated she usually got sufficient sleep. The driver’s spouse said he knew of no recent life stressors that would have affected the driver’s emotional health. Additionally, he stated that he spoke on the phone with her on the day of the accident, as she drove to an appointment with a potential business client. The driver’s spouse said that the driver seemed normal during the conversation, and was focused on meeting the potential client. The Metro-North Police Department contacted the potential business client regarding the planned meeting with the driver. According to the potential client, she and the driver planned to meet at a coffee shop in Scarsdale, New York, at 6:15 p.m. on the day of the accident. The driver texted the potential client around 5:45 p.m., saying she was working late and they would meet at 6:30 p.m. The driver’s employment record indicated she worked until 6:00 p.m. on the day of the accident. After the driver failed to show up for the meeting, the potential client said she made several unsuccessful attempts to contact her. 1.2.2.2 Cell Phone Use Investigators reviewed the driver’s cell phone records to determine if cell phone use at the time of the accident may have been a distraction. The cell phone records indicated that the driver was not using the cell phone when the accident occurred. The cell phone records further indicated there were two text messages sent to the potential client at 5:40 p.m. and 5:43 p.m., before the driver left work. The driver last communicated with her spouse on the cell phone at 6:11 p.m., after she left work and while driving to meet the potential client. The driver’s spouse stated that during the call he provided the driver with directions to her destination. The call ended 6 minutes before the accident occurred. Although no evidence was available to indicate whether or not the driver used a hands-free device during that conversation with her spouse, he stated in an interview with investigators that the driver’s cell phone automatically connected to the SUV’s integrated hands-free system when the phone was detected inside the vehicle. The driver’s spouse also said that the driver had usually used it to make phone calls while driving.5

5 New York State law prohibits the use of hand-held cell phones or portable electronic devices while driving. However, using a hands-free device is acceptable. New York Vehicle and Traffic Law § 1225-C (2014).

NTSB Railroad Accident Report 9

1. 2.2.3 Medical Factors

Medical records indicated that the driver’s primary care physician was treating her for hypothyroidism at the time of the accident. The driver’s spouse said she had successfully managed the symptoms of the condition for several years, with her most common symptom being fatigue. However, the driver had not complained of being fatigued in the days prior to the accident. Although the driver wore contact lenses, information in her medical records indicated her primary care physician characterized her vision as normal. According to her spouse, the driver routinely wore contact lenses and had adapted well to them. No information in the driver’s medical records indicated she had hearing problems, and her spouse described her hearing as good, with no known issues. Following the accident, investigators obtained a postmortem blood sample from the driver, and sent it to the Federal Aviation Administration’s (FAA) Bioaeronautical Research Sciences Laboratory (an organizational unit within the Civil Aerospace Medical Institute [CAMI]) for analysis. (FAA 2017) The analysis, completed on April 8, 2015, showed the driver tested negative for alcohol and other drugs.6 1.2.2.4 Licensing At the time of the accident, the driver held a valid New York Class D noncommercial driver’s license.7 The driver first obtained her license on March 27, 1995, and her current license was slated to expire on March 27, 2020. The license had a corrective lenses restriction.8 1.2.2.5 Driving History and Experience An inquiry through the New York Department of Motor Vehicles indicated the driver had three points assessed against her driving record at the time of the accident. The points were assessed for a November 2013 conviction for passing a red light. She had no record of convictions or accidents in the National Driver Registry.9 Investigators could find no information regarding the driver’s initial driver training. Her spouse told investigators that she had been a licensed driver since she was a teenager. He further stated that he had known her since she was 25 years old and she had been a safe driver throughout that time. He recalled her being involved in two minor accidents, but no major accidents. He also stated that the driver did not typically encounter grade crossings and was not familiar with them.

6 The FAA laboratory tests for more than 1,300 substances. 7 A New York Class D driver’s license allows the license holder to operate a passenger car or truck with a gross vehicle weight rating of 26,000 pounds or less, or a combination vehicle in which the towed vehicle has a maximum gross weight of 10,000 pounds, or if the combined weight of the two vehicles is 26,000 pounds or less. 8 The New York Department of Motor Vehicles requires a driver who needs eyeglasses or contact lenses to pass the required vision test to obtain a “corrective lenses” restriction on their license. 9 The National Driver Registry is a database containing information on drivers in the United States who have had their licenses revoked or suspended, or who have been convicted of serious traffic violations.

NTSB Railroad Accident Report 10

1. 2.2.6 Vehicle Familiarity

The 2011 Mercedes Benz ML350 SUV involved in this accident had an electronic gear-selection lever located on the right side of the steering column. According to the driver’s spouse, he and the driver purchased the SUV about 3 months prior to the accident, and she used it as her primary means of transportation. He stated that the driver liked the vehicle and had not experienced any difficulties operating the electronic gear-selection lever. Investigators obtained and examined an exemplar 2011 Mercedes Benz ML350. The gear-selection lever is electronically operated, and etching on the lever indicates the movements required to make gearshift selections. A driver must depress the brake pedal and move the lever up or down to select the desired vehicle direction (forward or reverse). The button at the end of the gear-selection lever puts the vehicle into park. (See figure 6.)

Figure 6. 2011 Mercedes Benz ML350 electronic gear-selection lever. 1.2.3 SUV Inspection and Recalls The SUV was registered in the state of New York on December 18, 2014, and the registration was valid until December 2016. The SUV passed a required annual New York state inspection on December 22, 2014. (State of New York Department of Motor Vehicles [NYDMV] 2017) Investigators queried the National Highway Traffic Safety Administration’s (NHTSA) database for recalls associated with the 2011 Mercedes SUV, and found one recall related to the driver’s-side frontal airbag. (NHTSA 2017) Additionally, NHTSA’s Office of Defect Investigation (ODI) listed no complaints or investigations related to the operation of the electronic gear-selection lever for the 2011 Mercedes Benz ML350. (ODI 2017)

NTSB Railroad Accident Report 11

1. 3 Highway Factors and Railroad Grade Crossing
2. 3.1 Commerce Street Grade Crossing

Commerce Street is a northwest-southeast, two-lane asphalt road that turns slightly northeast and crosses the railroad tracks at milepost 26.6 and then intersects with the Taconic State Parkway. The Taconic State Parkway is a restricted four-lane divided principal and limited access parkway for passenger car vehicles only, while Commerce Street is an unrestricted two-lane undivided minor arterial. (See figure 7.)

Figure 7. Accident location. (Modified from Google Earth.) Solid yellow double lines that were each 6 inches-wide separated the through lanes of Commerce Street. An edge line separated the through lane and shoulder. The edge line consisted of a 6-inch-wide solid white line. The total width of the two-lane cross section was 18 feet-wide southwest of the grade crossing and 20 feet-wide northeast of the grade crossing. The grade crossing at Commerce Street and the Metro-North tracks formed about a 62° angle. The distance from the farthest eastern rail to the western edge line of the intersection of Commerce Street and Taconic State Parkway was 109 feet. (See figure 8.)

NTSB Railroad Accident Report 12

Figure 8. Accident site. (Not to scale.) The highway intersection at Commerce Street and Taconic State Parkway did not have video monitoring devices to allow investigators to determine the extent of the traffic congestion at Commerce Street prior to the accident. 1.3.2 Highway Grade Crossing Warnings A reflectorized grade crossing pavement marking symbol was located in a through lane on the northwest approach to the Commerce Street grade crossing, with its center about 252 feet from

NTSB Railroad Accident Report 13

the nearest rail. A grade crossing advance warning symbol (yellow warning sign) was located about 160 feet from the nearest rail. A “Do Not Stop on Tracks” sign was located about 65 feet from the nearest rail and a grade crossing warning crossbuck indicating two tracks was 17 feet before the nearest rail.10 A reflectorized white stop line, measuring 16 inches wide and 10 feet long, was located about 4 feet from the automatic gate. (See figure 9.)

Figure 9. Warning sign locations on the approach to the Commerce Street grade crossing.

10 A crossbuck is an X-shaped highway warning sign at a highway-railroad grade crossing with the words “railroad crossing” printed on the sign.

NTSB Railroad Accident Report 14

1. 3.3 Commerce Street Grade Crossing Warning System

The warning system at the Commerce Street grade crossing consisted of reflectorized flashing lights and gates, including eight 12-inch diameter flashing light-emitting diode (LED) light units configured for bidirectional operation, and two gate arms mounted on two signal masts; however, it did not have bells.11 This system provided warning for both directions of traffic on Commerce Street. One gate arm extended across one lane for the northeast direction of Commerce Street and a second gate arm extended across the southwest lane. Each aluminum and fiberglass gate arm had alternating red and white reflective striping and was equipped with three 3-inch LED light units mounted along the top. (See figure 10.) Postaccident testing confirmed that when the warning system activated, the light unit mounted at the tip of the gate arms remained lit, while the other two light units flashed alternately. Both signal masts had signs affixed with a toll-free telephone number to report emergencies.

Figure 10. Approach of the Commerce Street grade crossing, facing northeast.

11 (a) Bells are only required for grade crossing warning systems where pedestrian crossings are present. (b) Although most grade-crossing gates are designed to break away, including the one at the Commerce Street grade crossing, there are no requirements for them to do so.

NTSB Railroad Accident Report 15

The train detection and warning system activation is configured using overlay track circuits and provided a minimum of 35 seconds of warning time until a train traveling at the maximum authorized speed of 60 mph arrived at the grade crossing. The approach track circuits for northbound trains extended 3,078 feet south from the center of the Commerce Street grade crossing, and the approach track circuits for southbound trains extended 3,088 feet north from the center of the Commerce Street grade crossing. Whistle boards were located about 1,340 feet from the grade crossing for northbound trains.12 1.3.4 Taconic State Parkway and Commerce Street Traffic Signals Traffic signals directed highway traffic in all directions through the intersection of Taconic State Parkway and Commerce Street.13 The highway traffic signal system had a simultaneous preemption connection with the grade crossing warning system.14 After the traffic signal controller received a preempt signal from the railroad train detection circuit, it would immediately transfer to a special operating mode to transition out of the active phase(s) and into a track clearance phase(s).15 When the track clearance phase began, vehicles could clear out of the intersection and the grade crossing. The railroad train detection circuits provided one relay contact that opened a traffic signal circuit after detecting a train on either of the Commerce Street grade crossing approach track circuits and triggered the highway traffic controller to initiate the preemption sequence of the traffic signals and simultaneously activate the grade crossing warning devices. The traffic signal at the Commerce Street and Taconic State Parkway intersection was designed with two preemptions. A loop detector in the pavement of the southwest approach of the Commerce Street grade crossing for southbound vehicles turning from Taconic State Parkway on to Commerce Street toward the grade crossing activated preemption #1.16 (See figure 11.)

12 A whistle board (or whistle post) is a sign along the track marking a location where an engineer should begin sounding the horn or whistle. 13 A Siemens 2070L Advanced Transportation Controller microprocessor controlled the traffic signals. 14 Examples of preemption control include a sequence of signal phases and timing to expedite and/or provide additional clearance time for vehicles to clear the tracks prior to the arrival of rail traffic, and a sequence of signal phases to display a steady red indication to prohibit turning movements toward the tracks during the approach of passing rail traffic. 15 The preemption of a highway traffic signal requires an electrical circuit between the control device of the railroad’s grade crossing warning system and the controller assembly of the highway department’s traffic signal. The railroad is only responsible for the maintenance and testing of its interconnections. 16 A loop detector is an inductive-loop traffic sensor embedded in the road that can detect vehicles arriving or passing at a certain point, for instance when approaching a traffic light.

NTSB Railroad Accident Report 16

Figure 11. Traffic signal preemption at accident site. (Not to scale.) Preemption #1, when activated, allowed vehicles to clear the Taconic State Parkway and Commerce Street intersection before any additional vehicles could turn or travel through the intersection, avoiding the potential of trapping vehicles in the intersection of Commerce Street and Taconic State Parkway. The railroad train detection circuit, shown in Figure 11, is designed to activate Preemption #2 to provide green signal time for highway vehicles traveling northeast on Commerce Street to clear the queue. When Preemption #2 activates, the traffic signal for north and southbound traffic on the Taconic State Parkway terminates the active green phase, activates the corresponding

NTSB Railroad Accident Report 17

yellow and red phases, and turns green only for vehicles traveling northeast on Commerce Street. This phase was designed to remain green for a minimum of 2 seconds and a maximum of 10 seconds, followed by 4 seconds of yellow. Depending on the traffic signal phase in effect, the clearance phase of the traffic signal for the northeast approach on Commerce Street could take a maximum of 7 seconds to start. After detecting a train, the traffic signal phases for northbound and southbound Taconic State Parkway are designed to cycle to red. The traffic signals for vehicles approaching the grade crossing traveling southeast on Commerce Street would also cycle to red, and would remain red while the warning system was activated. 1.3.5 Railroad Warning System Data Logger A Safetran Event Analyzer Recorder II (SEAR II) data logger was a component of the railroad warning system and recorded information associated with train movements through the Commerce Street crossing. National Transportation Safety Board (NTSB) investigators obtained the railroad warning system data log for all train movement for both tracks through the Commerce Street crossing from February 2, 2015, until the time of the accident. The data logs for the Commerce Street warning system showed train 659 occupying the southern approach track circuit on main track 2 at 6:25:34 p.m. The data indicated the warning system activated 39 seconds before the train occupied the island circuit.17 As mentioned in section 1.3.3, the design of the Commerce Street grade crossing provided a minimum of 35 seconds of warning time, but a train moving slower than the maximum authorized speed will result in longer warning times. 1.3.6 Grade Crossing Warning System On February 4, 2015, NTSB investigators conducted a field examination of the grade crossing warning system and highway traffic-light preemption system at the intersection of Commerce Street and the Taconic State Parkway. An examination of the grade crossing warning equipment at Commerce Street found the signal bungalow and all flashing light units to be locked and secured with no evidence of vandalism or tampering. Investigators also inspected both approach track circuits and verified each was properly operating in both track directions approaching the Commerce Street grade crossing. During postaccident testing, investigators determined the gate arms began lowering 4 seconds after the flashing light units activated. The gate arms reached a full horizontal position 9 seconds after the gate arms began their descent—13 seconds after the flashing light units activated. Investigators did not identify any sight distance issues or visual obstructions that would

17 (a) Title 49 Code of Federal Regulations (CFR) 234.225 “Activation of Warning System,” says a highway-rail grade crossing warning system shall be maintained to activate in accordance with the design of the warning system, but in no event shall it provide less than 20 seconds warning time before the grade crossing is occupied by rail traffic. (b) The island circuit refers to a short track circuit that spans the length of the paved roadway on each of the railroad tracks at a grade crossing.

NTSB Railroad Accident Report 18

interfere with the ability of drivers on the highway to see the flashing light units from either direction. Investigators verified that the warning system preemption circuit in the Metro-North signal case was properly configured and functioned as designed. Activation of the warning system would trigger the correct signal to the highway traffic signals, which would then initiate the railroad preemption sequence phase. 1.4 Metro-North Railroad Metro-North operates over three main lines east of the Hudson River, all originating at Grand Central Terminal (GCT) in Manhattan, New York. The Hudson Line extends north toward the Hudson River Valley to Poughkeepsie, New York. The Harlem Line extends north to Wassaic, New York. The New Haven Line extends northeast to New Haven, Connecticut, with branch lines extending to New Canaan, Danbury, and Waterbury, Connecticut. Metro-North also owns equipment and maintains infrastructure on two lines west of the Hudson River (the Port Jervis and Spring Valley Lines) in New Jersey and New York. New Jersey Transit operates Metro-North trains on those lines. Metro-North is one of the largest and busiest commuter railroads in the United States. It operates about 700 passenger trains daily and has an annual ridership of about 83 million passengers. In addition, National Railroad Passenger Corporation (Amtrak) operates about 22 trains each weekday on Metro-North tracks. CSX Transportation, Norfolk Southern Railroad, Consolidated Rail Corporation, and several short line railroads also operate freight trains on Metro-North tracks. Metro-North operates trains with a number of different types of passenger equipment. Some are electric-powered multiple unit trains that use third rail or overhead catenary wires, others are diesel-powered locomotives that push or pull passenger trains, and others are combinations of the two. Some diesel-electric locomotives operate into GCT and transition to third rail power in underground areas. Railroad traffic controllers working from the Metro-North Operations Control Center in GCT are responsible for train operations on the Hudson, Harlem, and New Haven Lines. 1.4.1 Railroad Operations Metro-North train 659 originated from GCT with a destination of Southeast Station in Brewster, New York. The train crew, consisting of an engineer and a conductor, performed all required predeparture equipment tests after receiving the train at GCT. At the time of the accident, the engineer was in the control compartment of the lead railcar and the conductor was located in the train’s sixth railcar. On the day of the accident, the train departed GCT on schedule—at 5:44 p.m.—and the trip was uneventful until the point of the accident. Train 659’s first scheduled stop was Chappaqua, New York, which was north of the accident location. (See figure 12.) The train passed North White Plains Station on time, at about 6:22 p.m. The train proceeded within the maximum authorized speed until the accident.

NTSB Railroad Accident Report 19

Figure 12. Metro-North system map highlighting the accident location. (Source: Metropolitan Transportation Authority.) 1.4.2 Method of Operation Train movements on the Harlem Line of Metro-North are governed by operating rules, timetable instructions, general notices, and traffic control system signal indications, including cab signals.18 There are no wayside signals between control points.19 The railroad at Commerce Street is multiple main track, with two tracks designated as track numbers 1 and 2.20 On the day of the

18 Cab signals are located in the engineer’s compartment or cab, and indicate a condition affecting the movement of a train or locomotive. They are used in conjunction with interlocking signals, and in conjunction with or in lieu of block signals. 19 Wayside signals are fixed signals that are located along a track right-of-way. 20 Multiple main track means that two or more tracks are signaled for travel in both directions.

NTSB Railroad Accident Report 20

accident, train 659 passed a proceed signal (green aspect) at the North White Plains Station, just prior to Valhalla Station, which authorized the maximum authorized speed. 1.4.3 Metro-North Train 659 Metro-North train 659 consisted of eight electrically powered Bombardier M-7 railcars that operate in a multiple unit arrangement and are powered by a 700-volt direct current (DC) third rail system. The lead railcar (Metro-North 4333) did not have an outward-facing (track image) video recorder.21 The lead railcar was also equipped with an external active alerting light system, also known as auxiliary lights. The auxiliary lights are arranged to flash on approach to a grade crossing, as required by Title 49 Code of Federal Regulations (CFR) 229.125. The engineer told investigators that he noticed a reflection of light at or near the Commerce Street grade crossing from about 1,200 feet away, but initially could not determine what was causing the reflection. He said he then realized that the reflection had come from a vehicle that was fouling the Commerce Street grade crossing.22 The engineer said, “after proceeding a little bit closer, I realized it was the front end of a SUV, a black SUV.”23 The engineer then told investigators that “the front of [the SUV] was fouling the track, and which anyway, if they weren't able to move, I still would have hit―even with braking [sic].” The engineer said that after realizing the SUV was in the grade crossing, he immediately applied the train’s emergency air brakes and sounded the horn on the lead railcar. The engineer told investigators that at about one railcar-length (85 feet) before the collision, the SUV moved further into the grade crossing and stopped on the tracks, in the direct path of the train. He said he then stood up and braced himself for the impact. The engineer told investigators he did not see vehicle traffic in front of the SUV before the collision, and believed the SUV could have cleared the crossing. 1.4.3.1 Event Recorder Data According to the event recorder data from train 659, the train horn began to sound at 6:25:56 p.m. The data indicated this was about 1,424 feet before the point of collision (POC). The event recorder data showed the train was traveling at 59 mph when the engineer activated the emergency air brakes, 14 seconds after sounding the horn and about 260 feet from the collision. Event recorder data indicated the train horn sounded four times before the collision. Event recorder data showed the train collided with the SUV at a speed of about 51 mph at 6:26:13 p.m., about 17 seconds after the engineer sounded the horn.

21 Federal regulations do not require outward-facing video recorders. However, Metro-North was in the process of installing them, but had not yet equipped this locomotive. 22 According to the FRA, fouling a track means the placement of an individual or equipment within 4 feet of the nearest rail or in such proximity to a railroad track that the individual or equipment could be struck by a moving train or other on-track equipment. 23 The transcript of the engineer’s interview is available in NTSB Docket DCA15MR006.

NTSB Railroad Accident Report 21

1. 4.3.2 Train Horn Requirements

The Federal Railroad Administration (FRA) requires that trains sound their horns to warn drivers and pedestrians when approaching and entering grade crossings.24 The requirement stipulates that engineers must begin sounding the horn at least 15 seconds, and no more than 20 seconds, before reaching a grade crossing: “If a train is traveling faster than 60 mph, engineers will not sound the horn until it is within 1/4 mile (1,320 feet) of the crossing, even if the train is less than 15 seconds away.” The horn must have a minimum warning sound level of 96 decibels (dB) at a distance of 100 feet from the front of the train. For the train horn to be effective, its sound must be 3 to 8 dB above the threshold of detection to be heard and 10 dB above ambient noise to attract attention. (FRA 2008) Metro-North operating rules required train crews to test the horns of controlling railcars on a daily basis and ensure that they are in working order before departing the initial terminal. (Metro-North 2011)25 Investigators recovered and examined what was left of the horn from the lead railcar of train 659. The fire from the accident heavily damaged the horn and postaccident testing could not be completed. Investigators completed a sound study at the Commerce Street grade crossing, using an exemplar vehicle (2011 Mercedes ML350) and Metro-North trains with the same type of horn as the one on train 659’s lead railcar.26 This allowed investigators to assess the horn’s sound levels from a driver’s perspective. The study showed the sound levels as: • The average sound level outside the test vehicle of the train horn for a train 100 feet from the grade crossing was 101.5 dB; • The average ambient sound level inside the exemplar vehicle with the engine at idle was 43 dB; • The sound levels inside the test vehicle began to measurably increase when the horn sounds from the test trains were 350 feet from the grade crossing; and • The sound levels inside the test vehicle with a train 100 feet from the grade crossing averaged 93.5 dB, 50.5 dB greater than the ambient sound level. 1.4.4 Engineer’s Sleep/Wake/Work History Investigators reviewed the engineer’s hours of service records for the 72 hours immediately prior to the accident. (See table 3.)27 These records showed that the engineer worked two shifts in the 3 days prior to being called in to work on the day of the accident. His records showed that he

24 See 49 CFR Part 222 “Use of Locomotive Horns at Public Highway-Rail Grade Crossings” for more information. 25 Rule 4-E (1) – Engine horn must be tested and in working order prior to departure from initial terminal. 26 Investigators used Bombardier M-7 railcars for this study. 27 Title 49 CFR Part 228, Subpart F “Substantive Hours of Service Requirements for Train Employees Engaged in Commuter or Intercity Rail Passenger Transportation.”

NTSB Railroad Accident Report 22

had more than the 8-hour minimum required rest period on all 3 days and had a rest period of over 23 hours prior to being called in to work the day of the accident. Table 3. Engineer's 72-hour on- and off-duty history. Date Time on duty Time off duty Total time on duty January 31 Day off Day off 0 Hours 0 Min. February 1 5:08 a.m. 1:26 p.m. 8 Hours 18 Min. February 1 11:59 p.m. 9:59 a.m. (February 2) 10 Hours 0 Min. February 2 Day off Day off 0 Hours 0 Min. February 3 9:37 a.m. Day of accident Day of accident

In his interview with investigators, the engineer stated he felt fully rested when he was called to work and during his shift on the day of the accident. 1.4.5 Cell Phone Use A review of the engineer’s cell phone records from the day of the accident determined that there were no calls or texts to or from his cell phone during his shift. 1.4.6 Toxicological Testing The engineer provided a blood sample to investigators on February 3, 2015, following the accident. The investigators then sent the blood sample to the FAA’s Bioaeronautical Research Sciences Laboratory (an organizational unit within CAMI) for testing. The analysis identified no alcohol or other drugs in the engineer’s blood sample. 1.5 Metro-North’s Track and Third Rail Power The track through the Commerce Street grade crossing area was designated as Class 3 track and consisted of continuous welded steel rail on treated wooden ties, secured with tie plates and a combination of spikes and screws.28 FRA Class 3 track standards required Metro-North to inspect the track twice each week. Investigators reviewed the Metro-North track inspection records from December 28, 2014, through the time of the accident, which indicated Metro-North was inspecting the track according to federal requirements. The last inspection, on January 30, 2015, recorded no defects. Metro-North’s third rail is a conducting rail that provides electrical power to the train. It was constructed from a rolled thick flange steel beam weighing 150 pounds per 3-foot section. Each section is 39 feet-long, but the length may be adjusted as needed during installation and maintenance. The third rail sections, joined together with bolts and splice bars, are attached to brackets attached to ties that support it with three bolts.29 The conducting surface is on the bottom of the rail and is known as “under-running”. In other words, Metro-North’s electric trains collect

28 Title 49 CFR Part 213 “Track Safety Standards” describes the maximum authorized speed on Class 3 track as 60 mph for passenger trains and 40 mph for freight trains. 29 Splice bars join third rail sections together and include two bars and four bolts.

NTSB Railroad Accident Report 23

power to operate from the bottom side of the rail. The third rail has a protective cover. (See figure 13.)

Figure 13. Metro-North’s third rail configuration. Traction power substations B26 and B29, each four megawatt rectifier substations, supply power to the third rail system in the area of the Commerce Street grade crossing. (See figure 14.) Each substation contained electrical switchgear, circuit breakers, a supervisory control and data acquisition (SCADA) control cabinet, relays, rectifiers, transformers, and battery control systems.30 Two 13,000 volt alternating current (AC) utility services supplied the substations, which convert the AC service to 700-volt DC service to power the trains. The substations are configured to supply power for both the north and south directions for each track. The third rail may be located on either side of the track, often connected with a transition jumper where it changes sides.31 Gaps in the third rail are common at all grade crossings. (See figure 14.) The power director’s office, located at GCT, controls and monitors the substations

30 (a) The battery control system provides extended power to operate the circuit breakers during both normal and emergency conditions. (b) SCADA is a system that operates with coded signal over communication channels to provide control of remote equipment. The control system may be combined with a data acquisition system by adding the use of coded signals over communication channels to acquire information about the status of the remote equipment for display or recording functions. 31 A transition jumper provides electrical continuity between two segments of the third rail. In this case, transition jumper 2266 electrically joined the east and west third rails involved in this accident.

NTSB Railroad Accident Report 24

remotely. There were no security video cameras at substation B26, the substation closest to the Commerce Street grade crossing.

Figure 14. Simplified electrical schematic of traction power substations near Commerce Street. (Not to scale) 1.5.1 Third Rail Structure In interviews with investigators, Metro-North’s power director reported that he believed designers intended for the third rail system to break away (to the right side or left side of the track) from the train during specific types of accidents. He explained that based on his experience, the material and design of the splice bars allow them to break when a large force, perpendicular to the movement of a train, strikes them. The basis of the power director’s belief was a 1984 accident at the Commerce Street grade crossing in which the third rail broke away from the train and did not damage the train. 1.5.2 Other FRA-Regulated Third Rail Properties The FRA regulates four railway systems, in addition to Metro-North, that use a third rail system to power passenger trains: Long Island Rail Road (LIRR), Amtrak, Port Authority Trans-Hudson Corporation (PATH), and Southeastern Pennsylvania Transportation Authority (SEPTA). All are similar in design in that a rolled thick flange steel beam was used to construct the rail that provides electrical power to the train. PATH has initiated an upgrade to use a composite third rail made from aluminum and stainless steel. Like Metro-North, third rail power collection is under running on the LIRR and the Market-Frankford line on the SEPTA system. All other systems are top running, in which the system collects power from the top of the third rail.

NTSB Railroad Accident Report 25

1. 5.3 Traction Power Data

Investigators examined the SCADA data from the traction power systems from the day of the accident to understand how long the third rail power was energized after the collision. The protective relaying circuit at substation B26 detected the first fault, indicating a protective circuit breaker trip, and logged it at 6:26:21 p.m., 8 seconds after the collision. Protective circuit breakers for traction power substations attempt to reclose three times after they trip. This reclose feature attempts to repower the third rail and is designed into the traction power system because electrical power spikes occasionally occur during normal operations. The reclose feature mitigates unnecessary power outages for trains. After the accident, as train 659 and the SUV continued to move north, they physically damaged transition jumper 2266, located about 300 feet north of the POC. (See figure 14.) The damage caused the east and west third rails to electrically disconnect from each other and isolated substation B26 electrically from the damaged west third rail. As a result of damage to transition jumper cable 2266, the load measuring circuitry at substation B26 for the track 2 north circuit breaker was no longer detecting a fault on the east side of track 2 and re-energized. The reclose feature re-energized the east third rail at 6:26:28 p.m., 7 seconds after the circuit breaker tripped. This re-energized the last four cars of the train, which were contacting the east third rail. At 6:26:51 p.m., a protective circuit breaker tripped at the B29 traction power substation de-energizing the power to the west third rail. At 6:27:02 p.m., the power director’s office sent an open command for breaker at B29 for track 2 south. At 6:27:50 p.m., 1 minute and 29 seconds after substation B26 detected the first fault, the power director’s office sent an open (power off) command for the circuit breaker at B26 controlling track 2 north. This de-energized the third rail power between substation B26 and the last four cars of the train. 1.5.4 Third Rail Inspection Requirements There are no federal requirements for third rail inspection standards. However, railroads may create their own requirements. The Metro-North power department’s Standard of Maintenance Manual July 2005 edition requires an annual inspection of the third rail. (Metro-North 2005) However, Metro-North performs proactive and reactive inspections and repairs at a greater frequency. Proactive inspections include patrols to identify both loose or missing insulator bolts, broken or loose bolts, worn insulators, broken or missing third rail covers, broken third rail splice bars, broken brackets, and planned work. Reactive inspections include searching for loose third rail joints and investigating low-voltage conditions, reports of arcing or burned brackets, circuit breaker trips, and missing current collector shoes. Investigators verified that Metro-North’s inspection records complied with their own standards. The last inspection of the third rail at the grade crossing, on December 8, 2014, documented no defects.

NTSB Railroad Accident Report 26

1. 6 Survival Factors

Table 4 provides, based on available evidence, a summary of the severity of injuries incurred in this accident.32 Based on crew interviews, about 20 passengers were riding in the lead railcar at the time of the accident.

Table 4. Occupant injury summary. Occupant Uninjured Unknown Minor Serious Fatal 2011 Mercedes ML350 Driver 0 0 0 0 1 Metro-North Train 659 Crew 1 0 1 0 0 Metro-North Train 659 Passengers ~630 1 3 6 5 Total ~631 1 4 6 6 Emergency medical services (EMS) transported 13 people to the hospital. There were no records of treatment for one person who was transported to the hospital. EMS transferred two other people to the hospital; however, those passengers were not diagnosed with an injury. Table 4 shows these people as uninjured. Four of the passengers in the lead railcar died as a result of blunt trauma. Surface burns may have obscured injuries or underlying medical conditions for the fifth fatality. All five of the railcar fatalities sustained extensive surface burns, but did not have soot in their airways. The driver of the SUV died as a result of blunt force trauma. 1.7 Emergency Response The accident occurred in Westchester County, New York, between Metro-North’s Valhalla Station and Mount Pleasant Station. Valhalla is a hamlet of the town of Mount Pleasant, which has its own independent police department. Because the accident occurred on railroad property, the primary law enforcement agency for this collision was the Metropolitan Transportation Authority Police Department (MTAPD); the primary fire/rescue agency was the Valhalla Volunteer Fire Department (VVFD), and the primary EMS agency was the Valhalla Volunteer Ambulance Corps. The nearest level-one trauma center was Westchester Medical Center (WMC) located in Valhalla, New York, just a few miles from the accident site. EMS transported most of the injured passengers to WMC. The Westchester County Department of Emergency Services (DES) monitors incidents and receives notifications from the various emergency services agencies within the county. Westchester DES Emergency Communications Center (ECC) provided investigators with incident logs from the day of the accident, as extracted from its computer-aided dispatch system. ECC logged its first call at 6:28:08 p.m. and dispatched the VVFD at 6:28:25 p.m. VVFD arrived on

32 The NTSB classifies serious injuries as any injury which: (1) Requires hospitalization for more than 48 hours, commencing within 7 days from the date of the injury; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface. (Classification based on 49 CFR 830.2)

NTSB Railroad Accident Report 27

scene at 6:34:24 p.m. The VVFD chief assumed incident command (IC) and established a command post on the Taconic State Parkway adjacent to the forward part of the train. EMS set up a triage area at the Commerce Street grade crossing and initiated a mass casualty and mutual aid response. Authorities closed both lanes of the Taconic State Parkway, from which VVFD staged firefighting operations. The Metropolitan Transportation Authority (MTA) chief safety officer arrived on scene within a few minutes of the accident, and helped EMS responders identify the most effective access points for establishing the IC, fighting the fire, and conducting rescue operations. Emergency responders were aware of the potentially electrified third rail. The fire progressed quickly inside the lead railcar and firefighters noted they had limited opportunity to evacuate it before it fully engulfed in fire. However, firefighters were able to suppress the fire before it engulfed the second railcar. EMS responders noted that passengers primarily evacuated themselves from the wreckage, assisting one another as needed. EMS responders primarily helped move passengers away from the burning train to the triage area. Metro-North conducted a postincident debriefing, as required by federal regulations, and cofacilitated an after-action debriefing for emergency responders.33 As a result of this debrief, Metro-North and the MTA drafted job aids for personnel tasked with coordinating postaccident family assistance activities. NTSB’s Transportation Disaster Assistance division supported this effort in the form of education and meetings to discuss best practices. NTSB provided a 2-day workshop in New York for Metro-North and the MTA. Additionally, Metro-North staff attended family assistance training at the NTSB Training Center. 1.8 Railcar Crashworthiness, Materials, and Fire 1.8.1 Third Rail During Collision During the collision, the third rail from the west side of track 2 first pierced the SUV near the bottom of the left-side rear passenger door, extending through the bottom of the SUV. It then impacted the fuel tank and exited the SUV at the top of the right-side rear wheel. The third rail then moved under the front left side of the lead railcar, Metro-North 4333, beside the train wheels. At the lead railcar, the third rail was forced between the left-side antiroll vertical link and the truck side frame assembly. (See figure 15.) Investigators found segments of burned third rail cover on top of the truck and the third rail. As the rail continued past the antiroll vertical link, it angled upward and made its first entry into the passenger compartment of the lead railcar, introducing sparks and flaming debris into the railcar, contributing to a fire, which will be discussed in section 1.8.3.

33 Title 49 CFR 239.105 “Debriefing and critique” says, “[E]ach railroad operating passenger train service shall conduct a debriefing and critique session after each passenger train emergency situation or full-scale simulation to determine the effectiveness of its emergency preparedness plan, and shall improve or amend its plan, or both, as appropriate, in accordance with the information developed.”

NTSB Railroad Accident Report 28

Figure 15. Path of the third rail entry into Metro-North 4333. The third rail entered the lead railcar in two locations. One section of the third rail punctured a hole into the exterior subfloor under the railcar, about 8 feet from the left-side front corner of the car. (See figure 16.) This hole extended through the floor into the passenger compartment. In the interior of the railcar, the hole was located under the first row of passenger seats, behind the left-side electrical locker. At this location, the nose piece of the third rail, a segment about 6 feet-long, came to rest between the center hand holds of the second seat row. The second entry point punctured the railcar’s exterior subfloor near the left-side front passenger doorway, about 18 feet from the left-side front corner of the car. The third rail then continued into the interior of the car, under the first row of passenger seats behind the vestibule. Overall, 11 sections of third rail entered the lead railcar and came to rest in the passenger compartment. (See figure 16.)

NTSB Railroad Accident Report 29

Figure 16. Entry points and the approximate position of the third rail inside the lead railcar.

NTSB Railroad Accident Report 30

One third rail section pierced through the top right-side rear of the lead railcar and punctured the second railcar, Metro-North 4332. The third rail lodged inside the second railcar between the exterior car body shell and the interior ceiling panels. (See figure 17.)

Figure 17. Third rail between railcars Metro-North 4332 and 4333. 1.8.2 Interior Damage In the center section of the lead railcar, the left-side seat frames and backs bent toward the rear of the railcar. The right-side seat frames generally were secure in their correct position. Sections of broken overhead baggage racks scattered throughout the car. (See figure 18.) The railcar’s rear door was impassible and could not be used because one section of the third rail prevented the door from opening.

NTSB Railroad Accident Report 31

Figure 18. Interior of the lead railcar, front to rear. Outside the left side of the lead railcar, investigators found the rear emergency exit window on the ground; however, the accompanying zip strip and window gasket were inside.34 The second window in the rear section of the railcar was in place, but all remaining windows on the left side of the railcar were melted or missing. The emergency access window from the front side passenger door was found on the ground outside of the railcar, although its exterior zip strip remained in place in the door. The left-side passenger doors would not open, and there was thick soot near the window openings on the left side of the railcar. (See figure 19.)

34 A zip strip is a neoprene gasket that holds a window panel in place. For emergency windows, the zip strip has handles that are intended to allow the emergency removal of the window.

NTSB Railroad Accident Report 32

Figure 19. Left side of the lead railcar. Outside the right side of the lead railcar, investigators found a partially melted window on the ground next to the emergency exit window near the front of the train. On the ground outside the center section of the railcar, investigators discovered an emergency exit window and a piece of its zip strip with one emergency pull handle, near the emergency exit window. The other center-section windows were melted or missing, although the right-side rear windows remained in place. Investigators discovered pieces of the rear emergency door release cover on the ground near the door, and both right-side passenger doors were open. There was thick soot on the right side of the railcar near the window openings. Investigators recovered and examined 11 emergency exit window zip strips (both small single-handled zip strips and large two-handled zip strips) from several of the accident train’s windows, which had been opened after the accident, including pieces found from the lead railcar. Investigators found tears of various lengths and depths in nine of them. All of the tears originated from where the emergency pull handles and the zip strip attach. The fracture patterns of the torn zip strips were consistent with overstress. None of the zip strips exhibited visible indicators of age or environmental-related degradation. 1.8.3 Materials and Fire According to statements from witnesses who were passengers in the lead railcar, Metro-North 4333, upon the third rail’s intrusion into the car, flaming debris—likely a combination of third rail cover, and components of the train and SUV—and sparks scattered throughout the passenger compartment. The entire lead railcar sustained heavy fire damage.

NTSB Railroad Accident Report 33

Investigators collected and examined samples to assess the flammability of materials that made up the interior components of the lead car such as: seat cover upholstery, cushion materials, seat panels, wall panels, light lenses, and the third rail cover.35 Due to the amount of damage to the lead railcar, investigators tested interior materials from the second car, Metro-North 4332, to assess the flammability. Title 49 CFR Part 238, Appendix B outlines prescribed flammability requirements for interior materials in new passenger railcars, beginning in 2000. These requirements applied to both the lead and second railcars.36 The flammability of in-service materials is not required by Part 238 to be re-evaluated during the service life of the railcar. Investigators discovered that three of the material samples from the second railcar no longer complied with the flammability requirements.37 The testing showed that materials in the passenger seat, including the passenger seat upholstery, the seat back and bottom shell (a single component), and the passenger seat cushion failed to meet the federal standards. The passenger seatback cushion, constructed from a different material than the seat cushion, still complied with the regulation. Witnesses stated that the fires were initially small, did not spread with extreme speed, and did not significantly hinder passengers and crew from exiting the train. 1.8.4 Electrical Damage The railcar structure showed no obvious signs of electrical arcing. Two rails—the nose piece and the rail removed from the SUV—exhibited atypical, localized thermal damage on the surface of the rail. (See figures 20 and 21.)

35 For a complete list and test results, see NTSB docket DCA15MR006. 36 Metro-North railcars 4332 and 4333 were a “married pair,” which are railcars that are semipermanently coupled together. Bombardier manufactured these railcars in July 2006 at the same time and with similar materials. 37 Flammability resistance can decrease due to aging and environmental exposure.

NTSB Railroad Accident Report 34

Figure 20. Localized thermal damage to the third rail nose piece surface removed from the lead railcar.

Figure 21. Localized thermal damage to the surface of the third rail removed from the SUV.

NTSB Railroad Accident Report 35

• Analysis

1. 1 Introduction

The NTSB considered the following factors in the investigation of this accident: (1) the performance of the driver, (2) the Metro-North third rail, (3) the flammability of railcar materials, (4) the grade crossing design, (5) the mechanical condition of the train and SUV, (6) the performance of the engineer, (7) environmental factors and weather, (8) the condition of the track, (9) the condition of the railroad signal system, (10) cell phone use by the engineer and the driver at the time of the accident, (11) alcohol or other drug use by the driver and engineer, and (12) the emergency response. 2.2 Driver Performance 2.2.1 Alcohol or Other Drugs Following the accident, investigators obtained a postmortem blood sample from the driver and sent it to the FAA’s Bioaeronautical Research Sciences Laboratory (an organizational unit within CAMI) for analysis. The analysis, completed on April 8, 2015, showed the driver tested negative for alcohol or other drugs. The NTSB concludes that the driver was not under the influence of alcohol or other drugs at the time of the accident. 2.2.2 Medical Factors According to medical records, the driver was following a medical treatment regimen for hypothyroidism at the time of the accident. According to the driver’s spouse, she had successfully managed the symptoms of the condition after being diagnosed several years earlier, with her most common symptom being fatigue. However, she had not complained of being fatigued in the days prior to the accident. The driver’s medical records did not indicate any other medical conditions which may have contributed to the collision. The NTSB concludes that the driver had no identified medical condition that contributed to the accident. 2.2.3 Fatigue Information from cell phone records and interviews with her spouse and co-workers formed the basis of investigators’ reconstruction of the driver’s recent activity history and opportunity for rest. In an interview with investigators, the driver’s spouse stated that the driver generally slept well. This table was presented in section 1.2.2.1 and here to show the driver’s opportunity for sleep. NTSB Railroad Accident Report 36

Table 5. Driver’s opportunity for sleep. From To Elapsed Time Date Time Date Time (approximate) February 1 1:27 a.m. February 1 8:45 a.m. 7 hours 18 minutes February 2 12:00 a.m. February 2 9:00 a.m. 9 hours February 3 12:00 a.m. February 3 9:00 a.m. 9 hours

Available information on the driver’s opportunity for rest shown in table 5 indicates that she had more than 7 hours available for rest in each of the 3 nights prior to the accident and 9 hours available for rest in each of the 2 nights prior to the accident. The driver was not experiencing a chronic or acute sleep debt at the time of the accident. The NTSB concludes the driver was not experiencing performance decrements from chronic or acute fatigue at the time of the accident. 2.2.4 Response to Railroad Grade Crossing Warning Systems The warning systems at the Commerce Street grade crossing consisted of pavement markings, signs, flashing lights, and gates, including eight 12-inch diameter flashing LED light units, and two gate arms mounted on two signal masts; however, it did not have bells. An FRA literature review, focusing on driver behavior at grade crossings, found that drivers do not always understand the distinction between a crossbuck and an advance warning sign. (FRA 2008) Drivers are generally aware that they are approaching a grade crossing; however, drivers do not always understand what actions they should take upon encountering one. Based on available evidence, it was likely a traffic queue formed prior to the SUV approaching the Commerce Street grade crossing. As the traffic moved toward the grade crossing, the driver encountered a reflectorized grade crossing pavement marking symbol located in the through lane, a grade crossing advance warning sign, a “Do Not Stop on Tracks” sign, and was in clear view of a grade crossing warning crossbuck indicating two tracks. According to a witness, the SUV stopped within the boundary of the crossing prior to the warning devices activating. The flashing red lights on the signal masts and the red lights on the lowering gate arms later activated, indicating that the grade crossing warning system was active, which the driver should have observed. According to the witness, the gate arm lowered and contacted the rear of the SUV while it was stopped past the reflectorized stop line within the boundary of the grade crossing. The witness stated that in response to the gate arm striking her vehicle, the driver exited the vehicle, slowly walked to the rear of the SUV, and touched the gate arm. He characterized the driver’s behavior as calm and presumed it was because the SUV was not on the track. The witness said the driver turned and made eye contact with him after examining the gate arm on the rear of the SUV. The witness said the driver entered her vehicle and that he expected the SUV to back up; however, after a slight pause, the SUV moved forward on to the tracks. Despite the flashing red lights and the lowered gate arm, the driver appeared not to have realized the train was approaching. The NTSB concludes the SUV driver, for undetermined reasons, did not comply with the advance warning system at the Commerce Street grade crossing; stopped past the stop line within the boundary of the grade crossing; and moved on to the tracks.

NTSB Railroad Accident Report 37

Although the witness attempted to signal the driver to back up and clear the grade crossing, the driver did not follow his signal. The gate arm striking the SUV likely diverted the driver’s attention. The driver’s decision to exit her vehicle to examine the gate arm suggests that she was distracted by it, rather than being concerned about being within the boundary of the grade crossing. According to the witness, when the driver exited her vehicle, she calmly walked to the rear of the vehicle and appeared to assess the vehicle for damage. This focus likely consumed her attention; hindering her ability to detect, perceive, and respond to audible and visual cues that the train was approaching. The NTSB concludes that after the grade crossing activated, the driver’s attention was most likely diverted to the crossing gate arm striking her vehicle, and she was unaware of the proximity of the approaching train. 2.2.5 Train Warning Devices Train 659 had visual devices and audible devices, such as active alerting lights and a horn, to alert the driver of its approach. 2.2.5.1 Visual Devices The lead railcar of the accident train had an external active alerting light system (auxiliary lights) to warn drivers as it approached grade crossings, as required by the FRA.38 Investigators could not perform postaccident testing on the system because it was destroyed during the accident and fire. In an interview with investigators, the engineer stated that the crew performed all required predeparture equipment tests on the day of the accident and found no problems with the equipment. As train 659 approached the Commerce Street grade crossing, the driver exited her SUV and walked to the rear of the vehicle where the gate arm was resting. From this position, given the angle between the road and the tracks, the likelihood that the driver would see the train would be substantially reduced as both the SUV and a building to the southeast (substation B26) were between her and the approaching train, limiting her sight distance. As she re-entered her vehicle, it is uncertain if ambient lighting from surrounding traffic, perimeter lighting from a nearby building, and the headlamps from her own vehicle and those behind her may have diminished her ability to detect the lights from the approaching train. 2.2.5.2 Audible Devices As mentioned in section 1.4.3.2, investigators completed a sound study at the Commerce Street grade crossing to assess the audibility of a typical Metro-North train horn from inside and outside an exemplar Mercedes Benz ML350 SUV. The results of the study showed a measurable increase in sound levels inside the SUV beginning when the train was 350 feet from the crossing compared to ambient sound levels inside the SUV. The results further showed that sound levels averaged 93.5 dB when a train was 100 feet from the crossing, and 50.5 dB greater than ambient sound levels inside the SUV. Research has shown that under ideal listening conditions, train horn sounds may be detected at thresholds as low

38 See 49 CFR 229.125 for more information.

NTSB Railroad Accident Report 38

as 10 dB below the levels of vehicle interior noise. (Dolan and Rainey 2005) A 1999 FRA report indicated that horn detection thresholds could range from –1 to +9 dB, depending upon whether a motorist anticipated encountering a train at a crossing. (FRA 1999) According to the International Organization for Standardization, standard 7731:1986(E), to ensure audibility under adverse conditions, it is recommended that an auditory signal level exceed masked threshold levels by 13 dB. (International Organization for Standardization 2003) Based on these results, an individual inside a Mercedes Benz ML350 SUV could have heard the sounds of the horn approaching the grade crossing beginning when a train was 350 feet, or about 4 seconds, from the grade crossing. The use of the vehicle’s heater or radio was not factored into the study; therefore, the car configuration was assumed to be a best-case scenario for a driver to detect the horn. The NTSB concludes that the sound of a Metro-North train horn was audible from inside an exemplar 2011 Mercedes Benz ML350 SUV when a train was 350 feet from the Commerce Street grade crossing. 2.2.6 Vehicle Familiarity Investigators considered whether the driver could have unintentionally placed the SUV in a forward gear, causing the vehicle to unexpectedly move forward at the grade crossing. Investigators obtained information regarding the driver’s experience operating the vehicle, reviewed vehicle recalls or defects, and examined the electronic gear-selection lever in an exemplar 2011 Mercedes Benz ML350 SUV. In his interview with investigators, the driver’s spouse stated that his wife previously drove a Honda vehicle, which had a traditional gear-selection lever. When asked about the driver’s experience with the 2011 Mercedes Benz ML350 SUV, he said that she liked driving it and had not complained of any difficulties in using the gear-selection lever. He further stated that he had also driven the vehicle on several occasions and had not experienced any difficulties in using the gear-selection lever. In an interview with investigators, the driver’s spouse said, “You want to go forward, you push the gear down; you want to go backwards, you push the gear up.” NHTSA’s safety database showed no issues or recalls related to the SUV’s gear-selection lever. (NHTSA 2017) Additionally, NHTSA’s ODI listed no complaints or open investigations related to the operation of the electronic gear-selection lever for the 2011 Mercedes Benz ML350. (ODI 2017) Upon examining the exemplar vehicle, NTSB investigators noted that the gear-selection lever is electronically activated from a central position. Selecting a gear position does not have the feel of manipulating a mechanical gear-selection lever, and the actions required to select reverse or forward movement are up for reverse and down for forward. Column-style gear-selection levers require a downward movement to shift from park to reverse and further downward movement to select drive. The driver’s previous vehicle had a floor-style gear-selection lever, which had similar movements with a column-style gear-selection lever. Based upon the interview with the driver’s spouse, the examination of the operational characteristics of the exemplar vehicle, and the absence of safety recalls and user complaints in the ODI, investigators could not determine if any factors regarding the driver’s familiarity with

NTSB Railroad Accident Report 39

the operation of the SUV caused her to inadvertently select forward instead of reverse while on the grade crossing. The NTSB concludes there was insufficient evidence to determine if the driver’s familiarity with the operation of the SUV caused an inadvertent or unintentional movement forward at the Commerce Street grade crossing. 2.2.7 Navigation Systems The driver’s spouse told investigators that there was a global positioning device (GPS) built into the SUV, but he wasn’t sure if the driver used it. Although the NTSB could not determine if the driver in the Valhalla accident was using a navigation system, had she been using one with cues for grade crossings, it may have alerted her of the upcoming grade crossing and it could have provided an opportunity to prevent this accident. In its investigation of a February 24, 2015, passenger train collision with a highway vehicle at a grade crossing in Oxnard, California, the NTSB made a recommendation to Google, Apple, Garmin Ltd., HERE, TomTom NV, INRIX, MapQuest, Microsoft Corporation, Omnitracs LLC, OpenStreetMap US, Sensys Networks, StreetLight Data, Inc., Teletrac, Inc., and United Parcel Service of America, Inc.: Incorporate grade crossing-related geographic data, such as those currently being prepared by the Federal Railroad Administration, into your navigation applications to provide road users with additional safety cues and to reduce the likelihood of crashes at or near public or private grade crossings. (H-16-15) The FRA, in June 2015 announced that Google agreed to integrate FRA-supplied geographic information system (GIS) data on 250,000 public and private grade crossings into its mapping and navigation applications, thereby providing drivers and passengers with additional cues when approaching a grade crossing. (DOT 2015) The FRA indicated that it continues to invite other technology companies to follow suit.39 As posted on the FRA website, “For drivers and passengers who are driving an unfamiliar route, traveling at night, or who lose situational awareness at any given moment, receiving an additional alert about an upcoming [grade] crossing could save lives.” (FRA 2015) In April 2016, the FRA informed the NTSB that Apple, Garmin, HERE, and TomTom had also agreed to incorporate grade crossing GIS data into their navigation applications; however, a number of the companies indicated that they were uncertain when they would be able to do so because other projects held higher priority. In June 2017, the FRA informed the NTSB that it was reviewing its grade crossing data for accuracy, and it expects to have the data ready for integration into mapping and navigation applications in the Fall of 2017.

39 The FRA has also consulted with INRIX, MapQuest, Microsoft Corporation, Omnitracs, OpenStreetMap US, Sensys Networks, StreetLight Data, Teletrac, and United Parcel Service of America to discuss integrating grade crossing information into their mapping and navigation applications.

NTSB Railroad Accident Report 40

1. 3 Metro-North Railroad Third Rail
2. 3.1 Power Control

As the sections of third rail separated during the accident, they were no longer connected to the power source. Investigators were unable to determine exactly when the third rail segments separated; but available evidence indicates the rails separated after entering the lead railcar. At 6:27:02 p.m., the power director’s office sent an open (power off) command for the circuit breaker at substation B29 for track 2 south. At 6:27:50 p.m., 1 minute and 29 seconds after substation B26 detected the first fault, staff in the power director’s office sent an open (power off) command for the circuit breaker at substation B26 controlling the power to the third rail on track 2 north. This de-energized the electrical power between the east portion of the third rail and the last four cars of train 659. The NTSB concludes that power controller commands de-energized the electrical power to substations B26 and B29 in a timely manner following the collision. The NTSB further concludes the power controller completed the emergency power shutdown in a manner such that electrical power did not cause or contribute to injuries to the emergency responders or the train evacuees. 2.3.2 Third Rail Structure The third rail nose piece is a 6-foot section of tapered rail attached at the ends of the regular third rails to smoothly transition the current collector shoes from the trains on to the third rail. (See figure 22.) This section of the third rail was the first part to puncture the lead railcar’s underside structure and enter the passenger compartment.

Figure 22. Third rail nose piece involved in this accident. During postaccident examinations of recovered third rail sections from inside the lead railcar, investigators observed fractures in the splice bars and bolts that joined the third rail together, but found the third rail sections themselves to be intact and unbroken. Based on the Metro-North power director’s belief that the third rail system was designed to break away from trains during specific types of accidents, investigators obtained design specifications for the third rail structure. With this information, the NTSB then used a computer-based simulation tool called finite element modeling to investigate Metro-North’s third rail system and the splice bars in order to understand the mechanical behavior under specific loading conditions. To accomplish this, investigators constructed a three-dimensional finite element model of the third rail assembly based upon Metro-North’s drawings, and applied

NTSB Railroad Accident Report 41

hypothetical loads and boundary conditions simulating deformations that may have occurred during the accident. The study focused on the potential failure modes of the assembly under applied loads. The model considered two modes of deformation: in-plane (up-and-down) and out-of-plane (side-to-side) bending. (See figure 23.) Investigators chose these modes based on the entry path of the third rail into the lead railcar during this accident. Figure 23 shows the finite element model of the third rail, splice bar, and bolts demonstrating in-plane bending.

Figure 23. Illustration of third rail and splice bar subjected to in-plane bending. In both analyses, investigators used compressive loads to simulate the forces the SUV and the train exerted on the rail and splice bar assemblies during the accident. The analyses showed Metro-North’s third rail splice bar system would have undergone large deformations before failing. Breakaway designs are constructed to fail at predetermined locations without requiring large deformations in mechanically overloaded situations to protect surrounding systems or equipment. The analyses showed that Metro-North’s third rail system did not have any breakaway mechanisms. In this accident, the third rail was first longitudinally loaded in compression, then subjected to both in-plane and out-of-plane bending during the collision sequence. The joined ends or splice bars were not subjected to in-plane and out-of-plane bending until they were inside the lead railcar. Once inside the lead railcar, the third rail splice bars underwent large deformations before fracturing or causing fracture of the attachment bolts. The NTSB concludes that Metro-North’s third rail system was not constructed to fail in a controlled manner or break away when subjected to undesirable overloaded conditions such as those involved in this accident. Of the 11 sections of third rail recovered, five were about 39 feet in length, and each of them weighed nearly 2,000 pounds. In this accident, the third rail overwhelmed the structural elements of the railcar’s understructure. The NTSB has investigated passenger railcar strength in other railroad accidents and has made safety recommendations to improve railcar crashworthiness. Crashworthiness research and improvements specific to railcar strength have focused on the ends of the railcars because they have been the primary locations of failure in collisions and crossing accidents. Rarely do rails intrude through the floor into passenger compartments. This accident demonstrated that Metro-North’s third rail assembly catastrophically compromised a passenger railcar with fatal

NTSB Railroad Accident Report 42

consequences. Metro-North’s third rail system penetrated the passenger compartment and broke apart at the splice bars. The third rail entering the lead railcar caused significant damage and increased the number and severity of injuries and fatalities. The NTSB concludes that the continued use of Metro-North’s current third rail system (which lacks controlled failure mechanisms) may increase the severity of railcar damage and serious injuries when accidents occur at or near grade crossings. The NTSB recommends that Metro-North conduct a risk assessment for all grade crossings that have third rail systems present at or near those grade crossings and implement corrections based on its risk assessment findings that will mitigate the risk of grade crossing accident severity. The NTSB acknowledges the efforts that Metro-North and the MTA have initiated to assess and remediate risk at some grade crossings; however, a thorough and more comprehensive assessment is necessary. (See section 3.3 below.) The NTSB recognizes that other commuter railroads and rail transit properties with grade crossings have third rail systems that could pose similar risks. Therefore, the NTSB concludes that the presence of third rail systems at or near grade crossings on commuter railroads and rail transit properties could increase the severity of grade crossing accidents. Therefore, the NTSB recommends that the LIRR, Amtrak, PATH, and SEPTA conduct a risk assessment for all grade crossings that have third rail systems present at or near those grade crossings and implement corrections based on their risk assessment findings that will mitigate the risk of grade crossing accident severity. The NTSB further recommends that the Federal Transit Administration (FTA) notify all rail transit properties that have third rail systems at or near grade crossings about this accident and advise them to conduct a risk assessment for all grade crossings that have third rail systems present at or near those grade crossings. The NTSB also recommends that after a full risk assessment is complete, the FTA require all rail transit properties to implement corrections based on their findings that will mitigate the risk of grade crossing accident severity. 2.4 Materials, Flammability, and Evacuation The SUV and train 659 moved about 250 feet north after the collision, before the third rail from the west side of track 2 punctured the SUV near the bottom of its left-side rear door. The rail continued through the bottom of the SUV and impacted the fuel tank, exiting at the top of the right-side rear wheel. The third rail then entered the left side of the leading railcar, Metro-North

1. The SUV and the train then continued to move about 415 feet before stopping. According

to the engineer, the cab compartment quickly filled with smoke. When he exited the cab, he saw a significant amount of fire in the center and rear of the passenger area. He described the fire as moving toward the front of the railcar. The engineer and passengers described the initial fire in the railcar to investigators as multiple spot fires and dripping flames within the center of the passenger compartment. NTSB investigators analyzed the materials that could have contributed to the multiple spot fires in the lead railcar. During the accident sequence, the third rail punctured the SUV’s fuel tank. Once the third rail entered the lead railcar, gasoline from the SUV’s fuel tank transferred to the third rail cover, made of a type of polymer. During postaccident examination of the railcar,

NTSB Railroad Accident Report 43

investigators found pieces of fire-damaged third rail cover on the third rail and in the lead railcar. The sections of the third rail cover ignited and burned. During the crash sequence, eleven sections of the third rail penetrated the lead railcar floor and came to rest inside the passenger compartment. Witnesses in the lead railcar told investigators that upon the third rail entering the passenger compartment, they saw sparks and flaming debris⸺which is consistent with a combination of fragments from the third rail cover, train components, and SUV components, including fuel—scattering throughout the passenger compartment spreading fire. The NTSB concludes that the introduction of sparks, flaming debris, and fuel into the lead railcar was the source of ignition and multiple areas of ignition contributed to the spread of a postaccident fire. The amount of the third rail and its location within the lead railcar impeded some passengers’ ability to evacuate Metro-North 4333. A section of third rail blocked the rear door, preventing its use as an exit. Passengers in the center and the rear of the car would have had to climb over sections of the third rail to access the side doors. Furthermore, a postaccident fire was developing. Witnesses stated that the fires were initially small, did not spread with significant speed, and did not significantly hinder their exit from the train. Passengers reported they used the closest accessible exits. The left-side doors were damaged, so passengers used emergency window exits on both sides of the car and the right-side front door to evacuate the car. According to statements from passengers who survived the intrusion of the third rail, some passengers on the right side of the center section of the lead railcar egressed through an emergency window exit. Passengers in the back of the car used the left-side rear emergency window exit to vacate the lead railcar. The NTSB concludes that the emergency window exits that passengers used on the left side of the lead railcar functioned as designed, and there likely would have been more serious injuries due to the fire and smoke had these exits not functioned properly. 2.5 Highway-Railroad Grade Crossing Warning System The Metro-North Railroad was responsible for the inspection, testing, and maintenance of the Commerce Street grade crossing warning system. Investigators examined and tested it, including the flashing lights and gate arms. Railroad maintenance and inspection records for the Commerce Street grade crossing warning system did not indicate a history of activation failures. Testing conducted after the accident determined that the gate control circuit was functioning properly, and the electromechanical relay for that circuit functioned normally. According to the downloaded grade crossing data, the warning system detected the presence of the train at 6:25:38 p.m. About 4 seconds later, the crossing control relay was de-energized, which then de-energized and opened both gate motor control relays. The open gate motor control relays removed power from the gate hold-clear mechanism and released the gates. The gate arms reached their full horizontal position about 13 seconds after the flashing light units activated. The NTSB investigation did not identify any fault that would have caused a delay or failure in the lowering of either of the crossing gate arms at the Commerce Street grade crossing. Investigators determined the LED units installed for the warning system at the Commerce Street

NTSB Railroad Accident Report 44

grade crossing were intact and operational and found the lighting circuit voltages for both signal masts and gate arm lights to be in compliance with federal regulations. Postaccident tests determined the flashing light units operated at 44 flashes per minute, which was within design specifications and regulatory requirements. Investigators determined the train detection track circuits were of sufficient length to provide a minimum of 35 seconds of warning time for trains traveling in both directions and on either track at the maximum authorized speed of 60 mph. Postaccident testing of the warning system found no evidence of a failure in the electronic or electromechanical components of the system. The data logger for the warning system indicated the warning system provided 39 seconds of warning time.40 The data logger operated within equipment manufacturer specifications, which allowed investigators to determine that the warning system data were recorded accurately. The FRA regulations found in 49 CFR Part 234 “Grade Crossing Safety,” the federal Manual on Uniform Traffic Control Devices (MUTCD), and the New York State Supplement to the Manual on Uniform Traffic Control Devices (NYS MUTCD) comprise the specifications for a uniform system of traffic control devices, including grade crossing warning systems, within the state of New York. (State of New York Department of Transportation [NYSDOT] 2009)41 The NTSB concludes that the grade crossing warning system on Metro-North at Commerce Street functioned as designed when the accident occurred and met federal and state requirements. The investigation determined that the grade crossing warning system preemption circuit in the Metro-North signal case was properly configured and it functioned as designed.42 Activating the warning system transmitted the correct signal to the highway traffic signals to initiate the railroad preemption sequence phase. The NTSB concludes that the Metro-North grade crossing warning system preemption circuit was properly configured and it functioned as designed. Without a recording device capable of monitoring both the railroad warning system and the traffic signal operation, investigators could not determine which preemption (Preemption #1 or Preemption #2) was active at the time of the accident. However, when asked about traffic in front of the SUV on Commerce Street in the moments before the collision, the engineer said that “there was nothing in front of her,” and the driver of the SUV could have proceeded forward. The engineer’s statement suggests that Preemption #2 influenced the northeast approach of Commerce Street, thus providing time with a green traffic signal for vehicles traveling northeast on Commerce Street to clear the grade crossing. (See section 3.1, for more information on the preemption of the traffic signal and postaccident actions.)

40 The warning time of 39 seconds was due to the train’s reduction in speed. 41 Some of the specifications found in the MUTCD and NYS MUTCD are requirements, and are indicated as such by the use of the word “standard”, while others are regarded as guidelines or suggestions by the use of the words “guidance”, “option”, and “support”. 42 The preemption of a highway traffic signal requires an electrical circuit between the control device of the railroad’s grade crossing warning system and the controller assembly of the highway department’s traffic signal. The railroad is only responsible for the maintenance and testing of its interconnections.

NTSB Railroad Accident Report 45

1. 6 Factors Not Contributing to this Accident

The NTSB determined that the factors described in this section did not contribute to the accident. Postaccident inspections of the train and the SUV did not disclose any defective mechanical condition that contributed to the accident. The driver had properly registered the SUV with the state of New York and it had recently passed the required annual safety inspection. The train’s event recorder showed that the engineer operated the train at 1 mph below the maximum authorized speed for the territory and sounded the train horn within the required 15-20 seconds prior to arrival at the Commerce Street grade crossing. There was no precipitation at the time of the accident and the road had been recently plowed for snow removal. Postaccident inspections of the railroad track and the railroad signal systems revealed that Metro-North had maintained the systems properly and they were performing within their prescribed requirements. The engineer had rested longer than the minimum 8-hour rest period for at least 3 days prior to the accident, and had a rest period in excess of 23 hours prior to going to work the day of the accident. The engineer tested negative for alcohol or other drugs. Cell phone records indicate the engineer was not using his cell phone at the time of the accident, and the driver’s last call ended 6 minutes before the accident. The NTSB concludes that none of the following were factors that contributed to this accident: (1) the mechanical condition of the train or SUV, (2) the engineer’s performance, (3) environmental factors and weather, (4) the condition of the track, (5) the condition of the railroad signal system, (6) fatigue of the engineer, (7) cell phone use while operating the train or SUV, and (8) the use of alcohol or other drugs by the engineer.

NTSB Railroad Accident Report 46

• Postaccident Actions

1. 1 Highway Traffic Signal Preemption

During postaccident examinations of the traffic signal preemption system, NTSB investigators identified a circumstance in which the traffic signal preemptive order did not comply with federal requirements outlined in the 2009 MUTCD. At the accident location, Preemption #2 (activated by the railroad train detection circuit) did not receive priority over Preemption #1 (activated by highway traffic) when Preemption #1 was already active. According to the MUTCD, “when multiple or successive preemptions occur, train activation shall receive first priority.” (Federal Highway Administration [FHWA] 2009) Although the preemptive order did not follow the MUTCD, NTSB investigators found that it did not contribute to the accident. After the accident, on May 1, 2015, the NYSDOT adjusted the traffic signal preemption at the Commerce Street and Taconic State Parkway intersection to ensure railroad preemption is the highest priority and that successive preemptions cannot interrupt the railroad preemption. Further, the NYSDOT inspected and confirmed all traffic signals with railroad preemption in Region 8 met the requirements of the 2009 MUTCD, ensuring railroad preemption is the highest priority at all intersections.43 The NYSDOT expanded the improvement program to include all traffic signals with railroad preemption for the remaining regions in the state, to ensure that all of the intersections met the 2009 MUTCD requirements and that railroad preemption is the highest priority. Additionally, the FHWA sent an Information and Action Bulletin to all FHWA division offices notifying them of this accident, and of the 2009 MUTCD requirement that “when multiple or successive preemptions occur, train activation shall receive the highest priority.” (FHWA 2009) While adjusting the traffic signal preemption, the NYSDOT also adjusted the clearance time for vehicles traveling northeast on Commerce Street under Preemption #2. NYSDOT changed the clearance time from its range of 2 to 10 seconds⸻which was in effect at the time of the accident⸻to 29 seconds of clearance time, followed by 4 seconds of yellow. This change, according to NYSDOT, was calculated using the “Guide for Determining Time Requirements for Traffic Signal Preemption at Highway-Rail Grade Crossings” contained in the August 2007 Railroad-Highway Grade Crossing Handbook. (FHWA 2007) This guideline uses an intermediate semi-trailer, serving as a “worst-case vehicle” to assess the time it would take to move from a stopped position on the far side of the crossing, clear the tracks, and proceed through the intersection.44 The interconnection for the traffic signal preemption was installed on October 27, 2008, and at that time the NYDOT determined that a range of 2 to 10 seconds as the clearance time at 43 Region 8 is one of 11 geographically defined regions in the state of New York, and is the region in which this accident occurred. 44 An intermediate semi-trailer has five axles. The intermediate semi-trailer was chosen as a “worst-case vehicle” because it is presumed that it would take the longest amount of time to move through the crossing.

NTSB Railroad Accident Report 47

the grade crossing was appropriate. Although guidance documents were available in the August 2007 Railroad-Highway Grade Crossing Handbook, it does not appear that NYSDOT used them to establish the clearance time. When questioned by NTSB investigators, NYSDOT staff could not explain how the preemption timing range was determined at that time, nor could they identify what guidance, if any, was used when making that decision.45 The NYSDOT identified another traffic signal in Region 8 that is “similar” to the one at Taconic State Parkway and Commerce Street that has a maximum clearance time of 10 seconds. The traffic signal is located at River Road and Global Terminal in New Windsor, New York. The NYSDOT is currently examining whether grade crossings with preempted traffic signals at intersections in the state’s other regions have the 10-second maximum clearance time. The NTSB concludes the NYSDOT should assess the intersections in its regions near grade crossings with preempted traffic signals to determine whether timing adjustments are established based on engineering principles or current industry guidance. The NTSB recommends that once the NYSDOT completes an assessment in its regions at intersections near grade crossings with preemptive traffic signals, it proceed with making any necessary adjustments based on engineering principles and current industry guidance. 3.2 Closure of Commerce Street Grade Crossing As a result of this accident, the town of Mount Pleasant conducted a volume, speed, and vehicle-classification count study on Commerce Street, just south of the grade crossing. The town used the results of this study to determine the feasibility of closing the Commerce Street grade crossing. A town of Mount Pleasant official told investigators they are preparing an internal report that will describe the town’s grade crossings in relation to their attributes, noted deficiencies, and traffic volumes. The official added that the report would likely recommend that the Town Board petition the state of New York to close of the Commerce Street and Cleveland Avenue grade crossings.46 3.2.1 Guidance Regarding the Closure of Grade Crossings In the state of New York, the commissioner of transportation has the authority to order the elimination of grade crossings. According to the listing for New York in “Appendix H: State

45 States can establish their own policies for setting maximum clearance time for preempted traffic signals near grade crossings. Resources available for states to establish preemption timing for traffic signals include: “Guide for Determining Time Requirements for Traffic Signal Preemption at Highway-Rail Grade Crossings” contained in the August 2007 Railroad-Highway Grade Crossing Handbook, establishing a standard practice based on the field measurements and critical intersection data. Some examples of state guidance include the Texas Rail-Highway Operations Manual (State of Texas Department of Transportation [TDOT] 2015) and Preempting Traffic Signals near Railroad Crossings in Utah (State of Utah Department of Transportation [UDOT] 2017). The state of Ohio has guidance in several related manuals, including the Traffic Engineering Manual (State of Ohio Department of Transportation [ODOT] 2016) and the Ohio Manual of Uniform Traffic Control Devices. (ODOT 2012) 46 On April 14, 2016, a spokesperson for the town of Mount Pleasant indicated to investigators that the town will wait for the release of the findings and recommendations of this investigation before presenting any findings and recommendations to the Town Board regarding the potential closing of the grade crossings.

NTSB Railroad Accident Report 48

Crossing Consolidations and Closures” from the revised second edition of FHWA’s Railroad-Highway Grade Crossing Handbook: Any railroad company or governing body of a municipality that contains a highway-rail crossing can petition the commissioner to institute grade crossing elimination procedures. The commissioner may hold public hearings on any elimination requested by petition after giving due notice to the parties in interest. At the conclusion of the hearing, the commissioner shall, by order, determine whether it is in the public interest to require the elimination of the highway-rail grade crossing. In any elimination order, the procedures for elimination are to be specified. (FHWA 2007)47 The following is an excerpt from NYSDOT’s guidance regarding the closure of grade crossings: Ultimately, the safest option regarding highway-railroad grade crossings is to eliminate or close them, thereby eliminating all possibility of vehicle/train contact. Such an objective can be obtained via crossing consolidation, closure and/or grade separation of the two modes of transportation. Consequently, it has been the policy of New York State to reduce, wherever possible, the number of highway-railroad grade crossings on public thoroughfares. Dozens of highway-railroad grade crossings have been safely and permanently closed under this initiative. (NYSDOT 2017) The FHWA guidance regarding the closure of crossings is contained in Chapter IV “Identification of Alternatives,” Section E “Closure” in the August 2007 Railroad-Highway Grade Crossing Handbook which indicates the following: Closure of a highway-rail grade crossing to highway traffic should always be considered as an alternative. … Closure of at-grade crossings is normally accomplished by closing the highway. … A study of highway traffic flow should be conducted to determine origin and destination points and needed highway capacity. (FHWA 2007) The town of Mount Pleasant conducted a study of highway traffic volumes in which it simulated closing the Commerce Street grade crossing to estimate the effect of increased traffic volumes on nearby intersections—primarily, the intersection of Commerce Street and Taconic State Parkway and the intersection of Lakeview Avenue and Taconic State Parkway. Investigators reviewed the results of the town’s study, specifically the increased traffic volumes. The study results showed that traffic volumes could be accommodated at both intersections by providing additional highway capacity and readjusting the timing of the traffic signals.

47 The information in Appendix H is excerpted from New York [Transp.] Law Section 222.

NTSB Railroad Accident Report 49

FHWA’s Railroad-Highway Grade Crossing Handbook provided further information regarding the closure of grade crossings: Eliminating redundant and unneeded [grade] crossings should be a high priority. Barring highway or railroad system requirements that require crossing elimination, the decision to close or consolidate [grade] crossings requires balancing public necessity, convenience, and safety. (FHWA 2007) Table 6 summarizes the distances between several grade crossings in the area near the accident site: Stevens Avenue, Commerce Street, Lakeview Avenue, and Cleveland Avenue, a total distance of about 2 miles. Consolidating the number of grade crossings from four to two would conform to NYSDOT’s policy of consolidating grade crossings wherever possible. Table 6. Distances between grade crossings on Metro-North near the accident site. Grade crossings listed from north to south Distance between grade crossings Stevens Avenue to Commerce Street 3,996 feet Commerce Street to Lakeview Avenue 1,875 feet Lakeview Avenue to Cleveland Avenue 4,722 feet Total Distance 10,593 feet (or 2 miles)

Additional guidance on grade crossing closures included in the FHWA Railroad-Highway Grade Crossing Handbook states: Closure criteria vary by locality but typically include train and roadway traffic volume, speed of trains, number of tracks, material being carried, crossing location, visibility, distance to traffic signals, and number of crashes. (FHWA 2007) Investigators applied data from the town of Mount Pleasant’s study on the potential for closing the Commerce Street grade crossing with the “typical” closure criteria outlined above. Table 7 summarizes this information, the results of which supports the closure of the Commerce Street grade crossing.

NTSB Railroad Accident Report 50

Table 7. Closure criteria data for the Commerce Street grade crossing. Closure Criteria Comment Train volume High train volumes: 107 trains per day (weekday) and 58 trains per day (weekend) Roadway traffic volume Low roadway traffic volumes: 1,024 vehicles per day (535 westbound + 489 eastbound) Speed of trains High train speeds: 60 mph Number of tracks More than one track: 2 tracks Material being carried High volume of passengers being carried: passenger trains Crossing location Poor angle of approach: 64 degrees in eastbound direction looking to the right Visibility Poor visibility: 90 feet in eastbound direction looking to the right. A Metro-North substation is located in the railroad right-of-way that restricts visibility in the eastbound direction looking to the right Distance to traffic signals Short distance: 82 feet Number of crashes Two fatal crashes resulting in seven deaths: February 3, 2015 – 6 deaths October 10, 1984 – 1 death The NTSB concludes that the postaccident process taken by the town of Mount Pleasant to recommend closure of the Commerce Street grade crossing complied with NYSDOT and FHWA guidance regarding the closure of grade crossings. The NTSB further concludes closure criteria attributes from the town of Mount Pleasant’s study support closure of the Commerce Street highway-railroad grade crossing as outlined in FHWA’s August 2007 edition of the Railroad-Highway Grade Crossing Handbook. The NTSB recommends that the town of Mount Pleasant take action based on the results of its traffic study and the FHWA August 2007 guidelines to improve grade crossing safety in the town of Mount Pleasant. 3.3 Grade Crossing Awareness and Risk Assessment As a result of this accident, the MTA partnered with Operation Lifesaver to create a safety awareness campaign using a multimedia approach and focusing on grade crossing and right of way safety.48 Additionally, the MTA has developed a customer-awareness information webpage, in conjunction with Operation Lifesaver, that informs the public on safety issues, including safety at grade crossings. (MTA 2015) The MTA developed educational media posters regarding grade crossing safety and placed them on 2,400 commuter rail trains, as well as 480 stations. The campaign also featured animated videos and broadcast them on over 24 digital screens at Penn Station, GCT, Jamaica Station, Atlantic Avenue Station, and Fulton Center Station, as well as on social media. The MTA also aired videos on 405 movie theater screens and placed print advertisements in local news publications, as well as online paid advertisements on Facebook, Crain’s, New York Business

48 (a) Operation Lifesaver is a nonprofit public safety education and awareness organization dedicated to reducing collisions, fatalities, and injuries at grade crossings and trespassing on or near railroad tracks. (b) A right of way is a type of easement granted or reserved over the land for transportation purposes, this can be for a highway, public footpath, rail transport, canal, as well as electrical transmission lines, and oil and gas pipelines.

NTSB Railroad Accident Report 51

online, Newsday, New York Daily News, LoHud, and the Connecticut Media Group to further educate the public in grade crossing safety.

Figure 24. Billboard advertising grade crossing safety in Astoria, New York. (Source: Metro-North.) The MTA and Operation Lifesaver also enhanced the grade crossing safety information that was found in the New York State Drivers Manual and consolidated the information into a chapter on “Special Driving Conditions.” (NYSDMV 2017b) According to the MTA, the partnership with Operation Lifesaver has created more opportunities to enhance education and public awareness programs and bring relevance to urban areas that previously had limited exposure to Operation Lifesaver materials. The MTAPD has increased its education and enforcement actions with coordinated efforts including local law enforcement. The MTAPD, along with the Metro-North, has developed a Right of Way Task Force to address conditions that may cause safety concerns. As of November 2016, the MTAPD has shared 9,173 educational pamphlets with motorists, covered 1,900 specific grade crossing details, issued 200 summonses and 894 warnings to grade crossing violators, and made 5 arrests. The MTA engaged the services of a design and engineering firm to assess grade crossing site conditions and coordinate with state and local department of transportation officials to develop action plans to improve site conditions and interaction with traffic control devices across its territory. The MTA continues to work with the national MUTCD technical committee on grade

NTSB Railroad Accident Report 52

crossings to enhance the MUTCD, and develop tests of new road markings, signage, and lighting to determine their effectiveness on behavior modification at grade crossings. As a result of these efforts, the FRA awarded $1.91 million to the MTA to install cameras to record movements at 43 identified grade crossings within Metro‐North territory in New York to investigate specific incidents and analyze grade crossing/traffic operations for targeted modifications to improve safety. (MTA 2016)

NTSB Railroad Accident Report 53

• Conclusions

1. 1 Findings

1 None of the following were factors that contributed to this accident: (1) the mechanical condition of the train or sport-utility vehicle, (2) the engineer’s performance, (3) environmental factors and weather, (4) the condition of the track, (5) the condition of the railroad signal system, (6) fatigue of the engineer, (7) cell phone use while operating the train or sport-utility vehicle, and (8) the use of alcohol or other drugs by the engineer. 2 The sport-utility vehicle driver was not under the influence of alcohol or other drugs at the time of the accident. 3 The sport-utility vehicle driver had no identified medical condition which may have contributed to the accident. 4 The sport-utility vehicle driver was not experiencing performance decrements from chronic or acute fatigue at the time of the accident. 5 The sport-utility vehicle driver, for undetermined reasons, did not comply with the advance warning system at the Commerce Street highway-railroad grade crossing; stopped past the stop line within the boundary of the grade crossing; and moved on to the tracks. 6 After the grade crossing activated, the sport-utility vehicle driver’s attention was most likely diverted to the crossing gate arm striking her vehicle, and the driver was unaware of the proximity of the approaching train. 7 The sound of a Metro-North Railroad train horn was audible from inside an exemplar 2011 Mercedes Benz ML350 sport-utility vehicle when a train was 350 feet from the Commerce Street highway-railroad grade crossing. 8 There was insufficient evidence to determine if the driver’s familiarity with the operation of the sport-utility vehicle caused an inadvertent or unintentional forward movement at the Commerce Street grade crossing. 9 The introduction of sparks, flaming debris, and fuel into the lead railcar was the source of ignition and multiple areas of ignition contributed to the spread of a postaccident fire. 10 The emergency window exits that passengers used on the left side of the lead railcar functioned as designed, and there likely would have been more serious injuries due to the fire and smoke had these exits not functioned properly. 11 The power controller commands de-energized the electrical power to substations B26 and B29 in a timely manner following the collision. NTSB Railroad Accident Report 54

12 The power controller completed the emergency power shutdown in a manner such that electrical power did not cause or contribute to injuries to the emergency responders or the train evacuees. 13 Metro-North Railroad’s third rail system was not constructed to fail in a controlled manner or break away when subjected to undesirable overloaded conditions such as those involved in this accident. 14 The continued use of the Metro-North Railroad’s current third rail system (which lacks controlled failure mechanisms) may increase the severity of railcar damage and serious injuries when accidents occur at or near grade crossings. 15 The presence of third rail systems at or near highway-railroad grade crossings on commuter railroads and rail transit properties could increase the severity of highway-railroad grade crossing accidents. 16 The highway-railroad grade crossing warning system on the Metro-North Railroad at Commerce Street functioned as designed when the accident occurred and met federal and state requirements. 17 The Metro-North Railroad highway-railroad grade crossing warning system preemption circuit was properly configured and it functioned as designed. 18 The state of New York Department of Transportation should assess the intersections near highway-railroad grade crossings in its regions with preempted traffic signals to determine whether timing adjustments are established based on engineering principles or current industry guidance. 19 The postaccident process taken by the town of Mount Pleasant to recommend closure of the Commerce Street highway-railroad grade crossing complied with the state of New York Department of Transportation and the Federal Highway Administration guidance regarding the closure of highway-railroad grade crossings. 20 The closure criteria attributes from the town of Mount Pleasant’s study support closure of the Commerce Street highway-railroad grade crossing, as outlined in the Federal Highway Administration’s August 2007 edition of the Railroad-Highway Grade Crossing Handbook.

NTSB Railroad Accident Report 55

1. 2 Probable Cause

The National Transportation Safety Board determines that the probable cause of the accident was the driver of the sport-utility vehicle, for undetermined reasons, moving the vehicle on to the tracks while the Commerce Street highway-railroad grade crossing warning system was activated, into the path of Metro-North Railroad train 659. Contributing to the accident was the driver of the sport-utility vehicle: (1) stopping beyond the stop line, within the boundary of the highway-railroad grade crossing, despite warning signs indicating the approach to the grade crossing; and (2) reducing the available time to clear the grade crossing by exiting the vehicle after the grade crossing warning system activated because the driver’s attention was diverted by the grade crossing warning system crossing gate arm striking her vehicle. Contributing to the severity of the accident was the third rail penetrating the passenger compartment of the lead passenger railcar and the postaccident fire.

NTSB Railroad Accident Report 56

• Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Transit Administration: Notify all rail transit properties that have third rail systems at or near highway- railroad grade crossings about this accident and advise them to conduct a risk assessment for those highway-railroad grade crossings. (R-17-07) After a full risk assessment is complete, require all rail transit properties to implement corrections based on their findings that will mitigate the risk of highway-railroad grade crossing accident severity. (R-17-08) To the Metro-North Railroad: Conduct a risk assessment for all highway-railroad grade crossings that have third rail systems present at or near those highway-railroad grade crossings and implement corrections based on your risk assessment findings that will mitigate the risk of highway-railroad grade crossing accident severity. (R-17-09) To the Long Island Rail Road, National Railroad Passenger Corporation, Port Authority Trans-Hudson Corporation, and Southeastern Pennsylvania Transportation Authority: Conduct a risk assessment for all highway-railroad grade crossings that have third rail systems present at or near those highway-railroad grade crossings and implement corrections based on your risk assessment findings that will mitigate the risk of highway-railroad grade crossing accident severity. (R-17-10) To the state of New York Department of Transportation: Once you complete an assessment at intersections in your regions near highway-railroad grade crossings with preemptive traffic signals, proceed with making any necessary adjustments based on engineering principles and current industry guidance. (R-17-11) To the town of Mount Pleasant, New York: Take action based on the results of your traffic study and the Federal Highway Administration’s August 2007 guidelines to improve grade crossing safety in the town of Mount Pleasant. (R-17-12) NTSB Railroad Accident Report 57

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

EARL F. WEENER Acting Chairman

Member

CHRISTOPHER A. HART

T. BELLA DINH-ZARR Member

Member

Adopted: July 25, 2017

Acting Chairman Sumwalt, Member Weener, and Member Dinh-Zarr filed the following statements.

NTSB Railroad Accident Report 58

Board Member Statements Acting Chairman Robert L. Sumwalt, III filed the following concurring statement on July 26, 2017. When the gavel dropped to begin the Board Meeting for this accident, I suspect some may have had the expectation that the NTSB would be able to explain with certainty why the driver of the SUV ended up on the tracks that fateful evening. Unfortunately, for those of us looking for answers, as I’ve seen during the past 11 years as a Member of the NTSB, sometimes we can’t absolutely explain human behavior – especially when we don’t have that person to talk to. Although not specifically discussed in the report, one explanation I believe is quite plausible is that the driver simply did not realize she was on or near railroad tracks. At first glance, that theory may not seem credible. After all, the grade crossing was denoted by advance warning signs and pavement marking, including a sign along the right side of the road that stated, “DO NOT STOP ON TRACKS.” Once the train was 39 seconds from reaching the grade crossing, the gate arm began lowering and, seconds later, struck the rear of her car. Furthermore, there were bi-directional flashing red lights that would have been visible in front of her. So, it’s legitimate to ask, “How could she not know?” To answer that in context, the roadway leading up to the accident location was not lighted. “It was really dark,” the driver in the car behind her later recounted to investigators. Furthermore, the accident driver was not familiar with this location. She had not originally intended to be on Commerce Street, but traffic had been diverted onto this street due to an earlier nearby traffic crash. As a result, traffic along Commerce Street was reported to be “inching along,” according to the driver behind her. Anyone who has driven in such conditions can relate to how a driver’s focus can simply narrow to following the car in front of you. When that car stops, you stop. When that car moves a few feet, you move. Stop and go. Stop and go. Stop and go. Your focus can become mesmerized with mimicking the movements of the vehicle creeping along in front of you. The driver in the vehicle behind the accident SUV offers an account that lends credence to this theory. Explaining that he is usually well-aware of his situation, he told investigators: I’m aware—and even I wasn’t aware I was that close to those crossing gates. … I don’t know if because I was driving slow and we were just inching along—or I didn’t expect it, but it was dark and that’s—that’s what sticks out now, that I didn’t think I was that close to the tracks…. I think that could have been me up in there. And, I would have went [sic] through the gate, but it was just that kind of situation where because you were inching slow and wasn’t—I wasn’t paying attention. Normally, I do. My belief that the driver was not aware she was anywhere near a railroad track is further bolstered by her actions and demeanor after the gate arm struck her car. She got out of her car and calmly walked to the car’s rear to see what had struck it, according to the witness. He recounted to investigators that “she was not hurried at all” and that she did not seem at all panicked. According to the witness, she touched the gate arm that was resting on the rear of her vehicle, as

NTSB Railroad Accident Report 59

if she wasn’t sure what it was. She then returned to get back into her vehicle, paused a few seconds, as if she were taking time to fasten her seatbelt, and then proceeded forward. That’s when she was struck by the train. Someone in a good state of mind, as this driver apparently was, who is aware that they are in close proximity to a railroad crossing, and in imminent danger of being struck by a train going 60 mph, would not act this way. In summary, I believe the driver of the SUV was not aware she was located perilously close to railroad tracks on that fateful evening. If she were aware, and had she responded appropriately, this tragedy would have been avoided. One way to heighten awareness of proximity to railroad crossings was highlighted in the NTSB’s investigation of a highway-railroad grade crossing accident that happened three weeks after the tragedy at Valhalla. In that accident, the driver of a pick-up truck inadvertently turned onto railroad tracks and drove his car about 80 feet before becoming stuck. Shortly after he abandoned his vehicle a commuter train stuck the vehicle and derailed several cars. The engineer of the train lost his life. Following that accident, the NTSB issued the following recommendation to several electronics manufacturers, including Google, Apple, and Garmin: Incorporate grade-crossing related geographic data, such as those currently being prepared by the Federal Railroad Administration, into your navigation applications to provide road users with additional safety cues and to reduce the likelihood of crashes at or near public or private grade crossings. (H-16-15) The Federal Railroad Administration has also pushed for such enhancements, stating: “For drivers and passengers who are driving an unfamiliar route, traveling at night, or who lose situational awareness at any given movement, receiving an additional alert about an upcoming [grade] crossing could save lives.” I hope this recommendation can be complied with soon, as well as those that were issued in the Valhalla report. Only then can we rest easier by knowing that tragedies such as that in Valhalla can be avoided.

NTSB Railroad Accident Report 60

Member T. Bella Dinh-Zarr filed the following concurring statement on August 1, 2017 This extremely thorough investigation conducted by a multi-modal NTSB investigative team once again highlights what the NTSB does best—preventing injuries and saving lives. Yet this accident, like so many that we investigate across all modes, was especially difficult and challenging because the one person we all wanted to interview—the SUV driver—was killed in the accident. At the scene of an accident, the NTSB tells the news media that our objective is not just to find what happened but why it happened, so we can make recommendations to ensure it does not happen again. We emphasize that the NTSB is an investigative agency that examines factual evidence and that we will not speculate about what may have caused an accident. The nature and circumstances of this particular accident make it so tempting to speculate. We want to know what was going on in the driver’s mind. What caused the driver to be at that location at that exact time? What caused the driver to exit the vehicle and walk to the back of it? What caused the driver to get back into the vehicle and pull forward? Our investigators do not have the power to answer questions that can only be answered by the SUV driver, but they conducted an exhaustive investigation examining physical evidence, interviewing every available witness, obtaining an exemplar vehicle, examining the quality of the interior railcar materials, conducting a train sight distance test, and much more. While we will never know what the driver was thinking that evening and, importantly, as an investigative agency, we refuse to speculate, after conducting our detailed analysis of the evidence, we do know much of what happened. Before crossing the boundary onto the highway-railroad grade crossing, the SUV driver passed five different highway markings indicating that the driver was approaching a grade crossing. We do not know whether the driver knew or did not know that the vehicle was on railroad tracks before or at the time of the accident. But the real question we need to examine is why this accident happened, so we can make recommendations to ensure it does not happen again. Our report accomplished just that in the findings and recommendations. In the end, nothing about the design of the highway-railroad infrastructure caused the car to stop on the highway-railroad grade crossing. The highway-railroad grade crossing signage complied completely with federal and state standards. The NTSB made no recommendations to change anything in this regard. The highway preemption correctly detected and signaled for the train allowing any traffic queue which may have existed to clear the tracks. The timing and the operation of the preemption worked as designed and complied with federal and state standards. We made no recommendations with respect to preemption. The highway infrastructure operated as designed and was safely designed. The train was in good mechanical condition and the engineer placed the train into emergency braking at a reasonable and prudent time under the circumstances. The weather was not causal. Neither the SUV driver nor the train engineer were fatigued, suffering from medical conditions that affected their performance, or were impaired by alcohol and other drugs. After ruling out everything that did not cause the accident, quite simply, we concluded that the probable cause was the SUV driver, for undetermined reasons, moved the vehicle forward into

NTSB Railroad Accident Report 61

the path of oncoming train. It resulted in tragedy for dozens of families. Our recommendations seek to prevent this from happening again. In our recommendations, we ask both the regulator and the operators to examine grade crossings near third rail operations to conduct a risk assessment and implement any results to mitigate this type of catastrophic penetration of the third rail into railcars. We recommend the state of New York examine whether it should close certain grade crossings, including Commerce Street, to improve safety. We applaud the ongoing efforts of the Operation Lifesaver, the Federal Railroad Administration, the Metropolitan Transportation Authority, and the Metro-North Railroad to increase public awareness of the dangers of highway-railroad grade crossings. We also are very encouraged by the work of the Federal Railroad Administration with GPS providers to integrate highway-railroad grade crossing information into navigation applications available to drivers. This exhaustive investigation and detailed report provides key recommendations that will aid in preventing this type of tragic accident in the future. Acting Chairman Robert L. Sumwalt, III joined this statement.

NTSB Railroad Accident Report 62

Member Earl F. Weener filed the following dissenting statement on August 1, 2017. I submit this statement to address concerns regarding the scope and probable cause determination of this report. The NTSB investigates accidents to help prevent future similar tragedies. We do not lay blame or assign fault. Any death resulting from a preventable transportation accident is unacceptable. In the collision between the SUV and train involved in this event, six lives were lost. It falls to the NTSB to ask why this occurred and how it could have been prevented. We know many facts about this accident. A prior accident caused both a detour and slow-moving traffic. The detour route was partially snow covered, and it was dark. At some point, the SUV driver and a following driver became completely stopped by traffic. The SUV was stopped just beyond the stop line, then warning lights activated. The SUV remained stopped and a gate descended on the rear of the vehicle. This crossing was not equipped with warning bells. The driver exited the SUV, walked to its rear, touched the gate, and reentered the vehicle. The SUV was fouling the track, and would likely have caused a collision with a passing train. The SUV moved forward on to the tracks, directly into the path of the oncoming train, resulting in a multiple-fatality collision occurred. These events occurred within 40 seconds. We can also conclude that the SUV had stopped initially in response to traffic ahead. At this point, there was at least one vehicle immediately behind the SUV. Several seconds before the collision, as the engineer saw the SUV moving forward, the traffic ahead of the SUV had cleared. After the crossing activated, the following driver reversed, attempting to increase the distance between the SUV and the following vehicle. The gate remained down, behind the SUV, the warning lights continued to flash red, and the traffic light across the tracks was green to clear traffic over the tracks. The available evidence limits further conclusions. The following driver was unable to see the traffic in front of the SUV, and, despite some confusion during the meeting, there is no evidence regarding exactly how long the traffic in front of the SUV continued to block its forward path. We do not know what the SUV driver did or was able to perceive relating to the crossing markings or the train’s approach. Given the collected data, our analysis, and the witness statements, the SUV driver’s ability to hear or understand the warning whistle of the train is unclear. We do not know why the driver exited or returned to the SUV, or why the driver then moved the vehicle forward across the tracks. It is human nature to put oneself in the place of another, trying to interpret or judge whether actions are reasonable given all the circumstances. However, speculation does not serve those affected by this accident or further the investigation. It is as important or, perhaps more important, to ask how the SUV ended up within the crossing gates as to consider how the driver attempted to exit the crossing. While the dangers of the third rail are clear, if the driver had stopped before the stop line, no accident would have occurred. Had the driver not pulled forward, the accident would almost certainly have been substantially less severe. I had hoped to see more emphasis placed on the causes of the SUV driver’s actions. While the report notes warning markings along the approach to the track met minimum federal standards, it is reasonable to ask whether minimum standards are sufficient, particularly in conditions subject to winter weather, without supplementary lighting, or subject to volume delays.

NTSB Railroad Accident Report 63

The report seems instead to focus on the theories that the SUV driver became distracted by the gate striking the SUV and that the driver’s exit from SUV and examination of the gate reduced the available time to clear the tracks. While possible, these theories seem speculative and suggest only one of many possible scenarios. It is possible that the SUV driver drove forward as soon as traffic ahead cleared. While the SUV driver may have been able to move backwards, it is unclear when and how far back the following driver moved to allow the SUV to reverse. We cannot be sure the SUV driver felt the gate’s impact and correctly interpreted it as caused by the gate rather than another object, or a vehicle. Possibly, the driver exited the SUV to investigate the impact or, because of front and rear blind spots, to visually assess the SUV’s proximity to the tracks. I am persuaded by evidence, including a witness statement, that the driver likely lost situational awareness between the time the SUV passed the crossing signs and road marking and, perhaps several minutes later, stopped within the crossing. As the Acting Chairman suggested during the meeting, the SUV driver may not have realized the SUV’s proximity to the tracks. After the driver left the SUV, the following driver’s headlights could have made accurately assessing the SUV’s position difficult, and we do not know what the SUV driver perceived. It is impossible to say if the driver could tell if the SUV had room to reverse safely or whether the gate would allow it. I was glad to hear Operation Lifesaver discussed during this Board meeting. This Board has previously addressed the importance of educating rail crossing users. While it is impossible to say how an experienced driver with a relatively good driving history wound up on the wrong side of the stop line in this accident, rail crossing accidents are not uncommon. We did not examine the adequacy of driver education regarding the appropriate procedures for crossing tracks in slow moving traffic. Past rail safety efforts have worked on model legislation to deter drivers from advancing into crossings without first making sure the way completely across is clear. We did not examine the sufficiency of New York State’s existing law or its enforcement, nor did we make any recommendations related to it or its potential deterrent or educational benefits. My final observation relates to driver self-rescue, an issue not well covered in this report. No driver should proceed into a roadway intersection or rail crossing without being certain that the way across is clear. However, drivers are human and can, all too easily, find themselves inside a crossing that has become active. It is for this reason that many crossing gates are frangible, allowing trapped drivers to break through them. This feature, however, is only useful if drivers are made aware about what to do when caught by gates. I wonder if sufficient education is being given to drivers on this topic. This issue was not explored in the report. I am concerned that comments during the meeting may suggest that the SUV driver should have waited, inside a stopped vehicle within an active crossing, for traffic to clear before moving forward, across the tracks. If a driver is moving at or near the posted speed and finds himself inside the crossing when the alarms activate, then, as with a green light that has turned yellow, the driver should keep going to clear the crossing allowing it to function as designed. If, however, a driver is prevented from immediately moving forward or backward due to traffic or vehicle immobility, the driver should leave the vehicle and move away. In this case, if the driver could not move the vehicle after the warning activated, exiting the vehicle to flee would have been correct. If only the way ahead was blocked, and it was possible to immediately reverse the SUV, this would have been correct. Once a crossing becomes active, drivers have only seconds to reach safety. Waiting inside

NTSB Railroad Accident Report 64

a trapped vehicle for any reason or length of time is extremely dangerous. Moving a vehicle that has stopped further onto tracks under active warning does not seem consistent with known guidance. I am left unsatisfied as to how the configuration of this angled crossing, the signage approaching the crossing, the deterrent effect of existing New York rail crossing statutes, and the New York State driver education regarding rail crossing safety may have affected these events. Further, I am concerned that the statement of probable cause does not reflect the real causes of this accident. It is my hope that the State of New York, federal authorities, local municipalities, state driver licensing agencies, and all safety stakeholders will consider these events and look for ways to prevent similar events in the future.

NTSB Railroad Accident Report 65

• Appendix

1. 1

Appendix A. Investigation The National Transportation Safety Board (NTSB) was notified on February 3, 2015, of the collision of northbound Metro-North Railroad passenger train 659 with a 2011 Mercedes Benz ML350 sport-utility vehicle at the Commerce Street highway-railroad grade crossing on the Harlem Line. The NTSB launched Board Member Robert Sumwalt, who was the on-scene spokesperson, and a team to investigate highway human performance, the highway-railroad grade crossing, track and power, signals and train control, railroad operations, survival factors and crashworthiness, mechanical/equipment, event/data recorders, and an investigator-in-charge. The NTSB Transportation Disaster Assistance division was also on scene to provide assistance with victims and victims’ families. The parties to the investigation include Metro-North Railroad; the Federal Railroad Administration; the Association of Commuter Rail Employees; the town of Mount Pleasant, New York; and the New York Public Transportation Safety Board. NTSB Railroad Accident Report 66

1. 2

Appendix B. Chronology of Events The following is a chronological list of the events that occurred during this accident. Table A. Chronological listing of accident events. Timea Event 6:25:34 p.m. South approach track circuit indicates occupied (train 659 detected) Grade crossing flashing light units activate 6:25:38 p.m. Grade crossing gate arms release and begin descending 6:25:47 p.m. Grade crossing gate arms in full horizontal position 6:26:10 p.m. Train 659 emergency brake applied 6:26:13 p.m. Island track circuit indicates occupied 6:26:13 p.m. Train 659 collides with SUV 6:26:15 p.m. North approach track circuit indicates occupied (train 659 across Commerce Street) 6:26:21 p.m. Protective relay trip at substation B26 6:26:51 p.m. Protective relay trip at substation B29 6:27:20 p.m. Power Director de-energizes substation B29 6:27:50 p.m. Power Director de-energizes substation B26 6:28:08 p.m. Westchester Department of Emergency Services Communications Center logged first call regarding the collision 6:28:25 p.m. Valhalla Volunteer Fire Department dispatched to collision 6:34:24 p.m. Valhalla Volunteer Fire Department arrives on scene a. Grade crossing data log clock time was synched to on-board event recorder clock time.

NTSB Railroad Accident Report 67

References Dolan, T. and J. Raney, 2005. “Audibility of Train Horns in Passenger Vehicles,” Human Factors. 47:2, 613-629. FAA (Federal Aviation Administration). 2017. CAMI Drug Information Web Site. (http://jag.cami.jccbi.gov/toxicology), accessed March 10, 2017. FHWA (Federal Highway Administration). 2015. Information and Action Bulletin: Traffic Signal Preemption and Highway-Rail Grade Crossings. (Washington, DC: US Department of Transportation, FHWA). ----. 2009. Manual on Uniform Traffic Control Devises, 2009 edition, incorporating Revisions 1 and 2, May 2012. (Washington, DC: US Department of Transportation, FHWA). ----. 2007. Railroad-Highway Grade Crossing Handbook, Revised second edition, August 2007. (Washington, DC: US Department of Transportation, FHWA). FRA (Federal Railroad Administration). 2015. “FRA Announces $10 Million for States to Improve Highway-Rail Crossings, Track Along Energy Routes,” news release, September 1, 2015. (http://www.fra.dot.gov/eLib/Details/L18347), accessed April 14, 2017. ----. 2008. Driver Behavior at Highway-Railroad Grade Crossings: A Literature Review from 1990-2006. (Cambridge, Massachusetts: US Department of Transportation, FRA). ----. 1999. Railroad Horn Systems Research, Final Report DOT/FRA/ORD-99/10 (Washington, DC: US Department of Transportation, FRA). ISO (International Organization for Standardization). 2003. Danger Signals for Public and Work Areas – Auditory Danger Signals. ISO7731:2003. (Geneva, Switzerland: ISO). Metro-North (Metro-North Railroad). 2011. Metro-North Operations Manual, 2011 Edition, February 27, 2011. (New York, New York: Metro-North). ----. 2005. Standard of Maintenance Manual, July 2005. (New York, New York: Metro-North). MTA (Metropolitan Transit Authority). 2016. “FRA Awards $4 Million to Improve MTA Railroad Crossings” news release, September 12, 2016. (http://www.mta.info/news-lirr-long-island- rail-road-grade-crossings-fra/2016/09/12/fra-awarded-about-5m-improve-metro), accessed April 14, 2017. ----. 2015. “MTA Enters Partnership to Pursue Rail Crossing Safety” news release, June 17, 2015. (http://www.mta.info/press-release/mta-headquarters/mta-enters-partnership-pursue-rail- crossing-safety), accessed April 14, 2017. NHTSA (National Highway Traffic Safety Administration). National Highway Traffic Safety Administration Recalls website. (http://www.nhtsa.gov/recalls), accessed March 10, 2017.

NTSB Railroad Accident Report 68

NYDMV (State of New York Department of Motor Vehicles). 2017. New York State Vehicle Safety Emissions Inspection Program website. (https://dmv.ny.gov/brochure/newyorkstatevehiclesafetyemissionsinspectionprogram), accessed March 10, 2017. ----. 2017b. “Special Driving Conditions.” New York State Driver’s Manual. (Albany, New York: NYDMV) (https://dmv.ny.gov/about-dmv/chapter-10-special-driving-conditions), accessed March 23, 2017. NYSDOT (State of New York Department of Transportation). 2017. Highway-Rail Grade Crossing Safety Section. (https://www.dot.ny.gov/divisions/operating/osss/rail/grade- crossings.), accessed March 10, 2017. ----. 2009. New York State Supplement to the Manual on Uniform Traffic Control Devices for Streets and Highways, 2009 Edition. Effective March 16, 2011. (Albany, New York: NYSDOT). ODI (Office of Defect Investigation [NHTSA]). 2017. National Highway Traffic Safety Administration, Office of Defect Investigation, Keeping You Safe website. (https://www- odi.nhtsa.dot.gov/owners/SearchSafetyIssues), accessed June 8, 2017. ODOT (state of Ohio Department of Transportation). 2016. Traffic Engineering Manual, July 2016 Edition. (Columbus, Ohio: ODOT). ----. 2012. Ohio Manual of Uniform Traffic Control Devices. 2012 Edition. Effective April 12,

1. (Columbus, Ohio: ODOT).

TDOT (state of Texas Department of Transportation). 2015. Texas Rail-Highway Operations Manual, Effective August 2015. (Austin, Texas: TDOT). US Department of Transportation. 2015. “Google, FRA team up for safety; will add rail crossing data to maps,” news release, June 29, 2015. (https://content.govdelivery.com/accounts/USDOT/bulletins/10c6d31), accessed April 14, 2017. UDOT (state of Utah Department of Transportation). 2017. Preempting Traffic Signals near Railroad Crossings in Utah, a UDOT Manual. Effective January 2017. (Salt Lake City, Utah: UDOT).

FD07487 ｜ 2017_美国_RAR1702.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2017 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Amtrak Train Collision with Maintenance-of-Way Equipment Chester, Pennsylvania April 3, 2016

Accident Report NTSB/RAR-17/02 PB2018-100263

National Transportation Safety Board

NTSB/RAR-17/02 PB2018-100263 Notation 57150 Adopted November 14, 2017

Railroad Accident Report Amtrak Train Collision with Maintenance-of-Way Equipment Chester, Pennsylvania April 3, 2016

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2017. Amtrak Train Collision with Maintenance-of-Way Equipment, Chester, Pennsylvania, April 3, 2016. NTSB/RAR-17/02. Washington, DC.

Abstract: On April 3, 2016, about 7:50 a.m. eastern daylight time, southbound Amtrak train 89 (train 89) struck a backhoe with a worker inside at milepost 15.7 near Chester, Pennsylvania. The train was authorized to operate on main track 3 (track 3) at the maximum authorized speed of 110 mph. Beginning on the morning of April 1, Amtrak had scheduled track-bed restoration―ballast vacuuming—at milepost 15.7 on track 2 on the Philadelphia to Washington Line. Track 2 had to be taken out of service between control points Baldwin (milepost 11.7) and Hook (milepost 16.8) for the 55 hour duration of the project. As train 89 approached milepost 15.7, the locomotive engineer saw equipment and workers on and near track 3 and initiated an emergency brake application. The train speed was 106 mph before the emergency brake application and 99 mph when it struck the backhoe. Two roadway workers were killed, and 39 other people were injured. Amtrak estimated property damages to be $2.5 million. The accident investigation focused on the following safety issues: roadway worker protection, communication between dispatchers and foremen, lack of job briefing, and safety management. As a result of this investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, Amtrak, Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen. The National Transportation Safety Board also reiterates a recommendation to the Federal Railroad Administration.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit NTSB investigations website and search for NTSB accident ID DCA16FR007. Recent publications are available in their entirety on the Internet at NTSB website. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza, SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service’s Technical Report Library at https://ntrl.ntis.gov/NTRL/. To download this publication, use product number PB2018-100263. For additional assistance, contact:

National Technical Information Service, 5301 Shawnee Rd., Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see NTIS website).

NTSB Railroad Accident Report

i Contents Figures and Tables ....................................................................................................................... iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary ..................................................................................................................... vi 1 Factual Information ....................................................................................................................1 1.1 Amtrak .......................................................................................................................................1 1.2 Accident Synopsis ......................................................................................................................2 1.3 Preaccident Activities ................................................................................................................3 1.3.1 Amtrak Train 89 ..............................................................................................................3 1.3.2 Amtrak Ballast-Vacuuming Project .................................................................................4 1.4 Roadway Worker Protection ......................................................................................................8 1.4.1 Form D .............................................................................................................................8 1.4.2 Foul Time .........................................................................................................................9 1.4.3 Supplemental Shunting Devices ....................................................................................11 1.4.4 Site-Specific Work Plans ...............................................................................................14 1.4.5 Job Briefings ..................................................................................................................15 1.5 Accident Narrative ...................................................................................................................17 1.6 Personnel Information ..............................................................................................................21 1.6.1 Amtrak Roadway Workers ............................................................................................21 1.6.2 Amtrak Train Engineer and Dispatchers .......................................................................21 1.7 Medical and Toxicology Information ......................................................................................22 1.7.1 Backhoe Operator ..........................................................................................................22 1.7.2 Track Supervisor ............................................................................................................22 1.7.3 Night Foreman ...............................................................................................................23 1.7.4 Day Foreman .................................................................................................................23 1.7.5 Assistant Nighttime Supervisor .....................................................................................23 1.7.6 Watchman ......................................................................................................................23 1.7.7 Train Engineer ...............................................................................................................23 1.7.8 Train Conductor and Assistant Conductors ...................................................................23 1.7.9 Train Dispatcher ............................................................................................................23 1.8 Injuries .....................................................................................................................................24 1.9 Damages ...................................................................................................................................24 1.10 Recorder Data ........................................................................................................................26 1.10.1 Video Recorder Data ...................................................................................................26 1.10.2 Locomotive Event Recorder Data ...............................................................................26 1.11 Method of Operation ..............................................................................................................27 1.12 Signal System.........................................................................................................................28 1.12.1 Locomotive Equipment ...............................................................................................29 1.13 Operational Testing ................................................................................................................29 1.14 Meteorological Information ...................................................................................................30 1.15 Sight Distance Observations ..................................................................................................30

NTSB Railroad Accident Report

ii 1.16 Safety Culture and Management ............................................................................................31 1.16.1 Amtrak Safety Management ........................................................................................33 1.16.2 Federal Railroad Administration Role in Safety Management Systems .....................39 2 Postaccident Actions .................................................................................................................40 2.1 Amtrak .....................................................................................................................................40 2.2 Federal Railroad Administration ..............................................................................................41 3 Analysis ......................................................................................................................................44 3.1 Exclusions ................................................................................................................................44 3.2 Toxicology and Medical Information ......................................................................................44 3.2.1 Backhoe Operator ..........................................................................................................44 3.2.2 Track Supervisor. ...........................................................................................................44 3.2.3 Locomotive Engineer.....................................................................................................45 3.2.4 Drugs in the Workforce .................................................................................................45 3.3 Survival Factors .......................................................................................................................46 3.4 Foremen’s Shift Transfer .........................................................................................................47 3.5 Positive Train Control ..............................................................................................................49 3.6 Site-Specific Work Plans .........................................................................................................51 3.7 Job Briefings ............................................................................................................................53 3.8 Train Dispatching.....................................................................................................................54 3.9 Safety Oversight.......................................................................................................................57 3.9.1 First-Line Safety Oversight ...........................................................................................59 3.9.2 Reporting Systems .........................................................................................................60 3.9.3 Corporate Safety Knowledge and Vision ......................................................................62 3.9.4 Government Regulation of Safety Management ...........................................................64 4 Conclusions ................................................................................................................................65 4.1 Findings....................................................................................................................................65 4.2 Probable Cause.........................................................................................................................68 5 Recommendations .....................................................................................................................69 5.1 New Recommendations ...........................................................................................................69 5.2 Recommendation Reiterated in This Report ............................................................................71 Board Member Statements .........................................................................................................72 Appendix A: Investigation ..........................................................................................................76 Appendix B: The Night Owl Accident ........................................................................................77 References .....................................................................................................................................78

NTSB Railroad Accident Report

iii Figures and Tables Figure 1. Amtrak Northeast Corridor showing train route and accident location.......................... 1 Figure 2. RailVac vacuum excavation machine on track 2 at the accident site. ............................ 5 Figure 3. RailVac and backhoe taken from forward-facing video recorder just before accident. . 6 Figure 4. Dispatcher’s display screen at 7:25 a.m. showing tracks 1–4 between Control Points Baldwin and Hook. Track 2 is out of service track (magenta), and tracks 1, 3, and 4 have electronic blocks (blue). ....................................................................................................... 10 Figure 5. Dispatcher’s display screen at 7:31 a.m. showing that the dispatcher has removed the electronic blocking device from track 3. ................................................................................. 10 Figure 6. Dispatcher’s display screen at 7:34 a.m. with a clear signal for train movement on track 3 indicated by the green highlight. ....................................................................................... 10 Figure 7. Dispatcher’s display screen at 7:47 a.m. with train 89 on track 3 shown by the A89 designation. ........................................................................................................................... 11 Figure 8. Day foreman’s job briefing sheet circulated to and signed by roadway workers. ........ 20 Figure 9. Damage to lead passenger car. ..................................................................................... 21 Figure 10. West (right) side of lead passenger car in Train 89. ................................................... 25 Figure 11. Interior of lead passenger car. ..................................................................................... 26 Figure 12. Amtrak’s 10 Cardinal Rules. ...................................................................................... 35

Table 1. Workers on Chester ballast-vacuuming project. .............................................................. 7 Table 2. Injuries............................................................................................................................ 24 Table 3. Speed versus distance. .................................................................................................... 31

NTSB Railroad Accident Report

iv Abbreviations and Acronyms ACSES Advanced Civil Speed Enforcement System Amtrak National Railroad Passenger Corporation ARASA American Railway and Airway Supervisors Association ARJET Amtrak Roadway Joint Efficiency Testing ATC automatic train control BMWED Brotherhood of Maintenance of Way Employes Division BRS

Brotherhood of Railroad Signalmen CEO chief executive officer CFR

Code of Federal Regulations Conrail Consolidated Rail Corporation CP

control point DOT Department of Transportation EIC

employee-in-charge FAA Federal Aviation Administration FAST Act Fixing America’s Surface Transportation Act FRA Federal Railroad Administration LDVR locomotive digital video recorder LED

light-emitting diode MOW maintenance-of-way MP

milepost ng/ml nanograms per milliliter NEC Northeast Corridor NORAC North American Operating Rules Advisory Committee NPRM notice of proposed rulemaking NTSB National Transportation Safety Board Penn Station Pennsylvania Station PTC

positive train control

NTSB Railroad Accident Report

v PTS

positive train stop RailVac Loram RailVac vacuum excavation machine RRR retrospective regulatory review RWP roadway worker protection SMS safety management system SSD

supplemental shunting device SSP

system safety program SSPP system safety program plan SSWP site-specific work plan THC tetrahydrocannabinol THC-COOH carboxy tetrahydrocannabinol Timetable Special Instructions

Northeast Corridor Employee Timetable No. 6, Includes Special Instructions TOL

track occupancy light

NTSB Railroad Accident Report

vi Executive Summary On April 3, 2016, about 7:50 a.m. eastern daylight time, southbound Amtrak train 89 (train 89) struck a backhoe with a worker inside at milepost 15.7 near Chester, Pennsylvania. The train was authorized to operate on main track 3 (track 3) at the maximum authorized speed of 110 mph. Beginning on the morning of April 1, Amtrak had scheduled track-bed restoration―ballast vacuuming—at milepost 15.7 on track 2 on the Philadelphia to Washington Line. Track 2 had to be taken out of service between control points Baldwin (milepost 11.7) and Hook (milepost 16.8) for the 55-hour duration of the project. As train 89 approached milepost 15.7, the locomotive engineer saw equipment and workers on and near track 3 and initiated an emergency brake application. The train speed was 106 mph before the emergency brake application and 99 mph when it struck the backhoe. Two roadway workers were killed, and 39 other people were injured. Amtrak estimated property damages to be $2.5 million. The National Transportation Safety Board determines that the probable cause of the accident was the unprotected fouled track that was used to route a passenger train at maximum authorized speed; the absence of supplemental shunting devices, which Amtrak required but the foreman could not apply because he had none; and the inadequate transfer of job site responsibilities between foremen during the shift change that resulted in failure to clear the track, to transfer foul time, and to conduct a job briefing. Allowing these unsafe actions to occur were the inconsistent views of safety and safety management throughout Amtrak’s corporate structure that led to the company’s deficient system safety program that resulted in part from Amtrak’s inadequate collaboration with its unions and from its failure to prioritize safety. Also contributing to the accident was the Federal Railroad Administration’s failure to require redundant signal protection, such as shunting, for maintenance-of-way work crews who depend on the train dispatcher to provide signal protection, prior to the accident. The accident investigation focused on the following safety issues: • Roadway Worker Protection: Amtrak and the North American Operating Rules Advisory Committee have many ways to protect workers on maintenance-of-way projects. These include positive train control, which is designed, in part, to prevent incursions into work zones; using Form D and foul time to prevent train incursions into the work zone; supplemental shunting devices that activate track occupancy detection within the signal system and create a track occupancy light on the dispatcher’s board, thus serving as an independent layer of safety; site-specific work plans that assess the risk of worksites to guide choices like the number of watchmen needed; and a job briefing conducted before each shift that includes the type of worker protection to be used. • Communication Between Dispatchers and Foremen: This accident included several actions by dispatchers and foremen that affected the performance of their jobs and ultimately the safety of the work on the day of the accident. Most of the communications were made over cell phones instead of the radio. Because of this, no one else at Amtrak was able to hear the content of the conversations. Another listener

NTSB Railroad Accident Report

vii may have been able to identify errors or incorrect decisions or assumptions made during these conversations. • Lack of Job Briefing: The day foreman did not conduct a job briefing for the roadway workers and contractors before the shift began. A job briefing is required and includes the form(s) of protection from intrusions onto out-of-service tracks that will be used during the upcoming shift. The track protection information included in the job briefing makes workers aware of the presence or absence of track protection and enables them to question the absence of that protection if the protection plan has not been followed. • Safety Management: The Chester accident investigation revealed more than 2 dozen unsafe conditions—many involving safety rule violations and risky behaviors by workers. These safety shortcomings occurred across several levels of the Amtrak organization—maintenance of way, dispatchers, management—and reveal Amtrak’s weak safety management. An inconsistent vision of safety throughout the organization, hostile attitudes between labor and management about no-tolerance rule violations, and ill-equipped work crews were among the observed safety culture. Moreover, it is disconcerting that three of the Amtrak employees involved in the accident tested positive for potentially impairing drugs. The company’s safety program and its implementation at all levels of the company were found to be weak and focused on only the lowest level of employees: the roadway workers. As a result of this investigation, the National Transportation Safety Board makes safety recommendations to the Federal Railroad Administration, Amtrak, Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen. The National Transportation Safety Board also reiterates a recommendation to the Federal Railroad Administration.

1 Factual Information 1.1 Amtrak The Rail Passenger Service Act (Public Law 91-518, October 30, 1970), created the National Railroad Passenger Corporation (Amtrak). The Act directed Amtrak to develop and operate a modern rail service to meet intercity transportation needs. Amtrak began operations on May 1, 1971. On April 1, 1976, Amtrak acquired its Northeast Corridor (NEC) property from Conrail (Consolidated Rail Corporation). Amtrak’s NEC is the busiest railroad in North America with about 2,200 commuter and freight trains operating on some portion of the Washington, DC, to Boston, Massachusetts, route each day. (See figure 1.) In fiscal year 2016, Amtrak carried about 17.8 million passenger trips on the NEC.1 The Chester, Pennsylvania, accident occurred on the NEC.

Figure 1. Amtrak Northeast Corridor showing train route and accident location.

1 Amtrak, National Fact Sheet FY 2016.

NTSB Railroad Accident Report

2 Most of the Amtrak operating network of tracks is owned by other railroads. Amtrak has trackage rights agreements with freight railroads for about 20,549 route miles of track, which is 96 percent of the route miles traveled by its trains.2 Amtrak owns about 791 route miles of track, which is about 4 percent of the route miles that Amtrak travels. On the 457-mile NEC, Amtrak owns and operates 363 miles. Of the portion of the NEC not owned by Amtrak, the New York Metropolitan Transportation Authority owns a 10-mile segment, the Connecticut Department of Transportation owns a 46-mile segment, and the State of Massachusetts owns a 38-mile segment. Railroads are responsible for positive train control (PTC) installation where passenger trains operate and where poison or certain hazardous materials are transported.3 PTC systems are designed to prevent train-to-train collisions, overspeed derailments, incursions into established work-zone limits, and movement of a train through a switch left in the wrong position; in particular, PTC is designed to prevent accidents caused by human error. Amtrak has activated the Advanced Civil Speed Enforcement System (ACSES) on the tracks it owns in the NEC and on the Amtrak-owned portion of the Michigan line. ACSES in combination with cab signaling meets the Federal Railroad Administration’s (FRA) requirements of a PTC system. Amtrak has installed PTC on its locomotives and cab cars that operate over the NEC. Amtrak has a president/chief executive officer (CEO) who reports to a board of directors. A vice president/chief operations officer is responsible for day-to-day operations of Amtrak, and a vice president/chief safety officer reports to the chief operations officer. 1.2 Accident Synopsis On April 3, 2016, at 7:50 a.m. eastern daylight time, southbound Amtrak train 89 (train 89) struck a backhoe with a worker inside at milepost (MP) 15.7 near Chester, Pennsylvania.4 Train 89 was authorized to operate on main track 3 (track 3) at the maximum authorized speed of 110 mph.5 Beginning April 1, 2016, at 10:00 p.m., Amtrak had scheduled track-bed restoration―ballast-vacuuming—at MP 15.7 on track 2 on the Philadelphia to Washington Line. Track 2 had to be taken out of service between control points (CP) Baldwin (MP 11.7) and Hook (MP 16.8) for the 55-hour duration of the project. Additionally, adjacent tracks 1, 3, and 4 were intermittently out of service (fouled) because of equipment and workers supporting the RailVac and ballast vacuuming on track 2. As train 89 approached MP 15.7, the locomotive engineer saw equipment and workers on and near track 3 and initiated an emergency brake application. Locomotive event recorder data showed that the train speed was 106 mph before the emergency brake application and 99 mph when it struck the backhoe. The locomotive derailed; the backhoe was destroyed, killing the operator; debris from the collision hit and killed the track supervisor, and part of the backhoe

2 Trackage rights means permission for a railroad to use the tracks of another. 3 Public Law 110-432. Rail Safety Improvement Act of 2008, Sec.104. 4 All times in this report are eastern daylight time except the time in appendix B, which is eastern standard time. 5 All tracks referred to in this report are main tracks, that is, main tracks 1, 2, 3, and 4. In this report they are called tracks 1, 2, 3, and 4.

NTSB Railroad Accident Report

3 damaged the sidewall of the first passenger car. According to the manifest, 337 passengers, including 2 Amtrak employee passengers, and 7 Amtrak crewmembers, were on board train 89. The Chester Fire Department was dispatched at 7:54 a.m. to the Amtrak tracks at Booth Street, where the tracks cross over the street. (See figure 1.) Fire department and emergency medical services personnel accessed the site through a field behind a church near Langley and 9th Streets. A Chester Fire Department battalion chief assumed command of the incident and established a command post at that location. A medic unit walked the tracks to locate and aid the work crew, and firefighters assisted passengers on the train, taking them to the church, which was used as a triage area and shelter. First responders transported 37 people to local hospitals.6 Two roadway workers were killed, and 39 people were injured.7 The weather at the time of the accident was scattered clouds, wind from the west at 38 mph gusting up to 50 mph, and a temperature of 37°F. Visibility was unrestricted.8 Amtrak estimated property damages to be $2.5 million. 1.3 Preaccident Activities 1.3.1 Amtrak Train 89 On April 3, 2016, the crew of train 89 reported for duty at 5:25 a.m. at Pennsylvania Station (Penn Station) in New York City. The crew consisted of an engineer, a conductor, two assistant conductors, and three on-board service attendants. Train 89, consisting of one locomotive, eight passenger cars, a café car, and one baggage car, departed about 6:06 a.m. and traveled southbound on the Amtrak Philadelphia to Washington Line destined for Savannah, Georgia. While in New York City, the train was inspected, and it passed all predeparture tests required by the FRA, including a Class I air brake test. On the trip to Savannah, Georgia, train 89 made scheduled station stops in New Jersey at Newark, Metro Park, and Trenton. The next stop was at Philadelphia, which train 89 departed on track 3. The train crew reported no problems with the brake system throughout the trip. The video from the inward-facing camera in the control cab, beginning with the train’s departure from Philadelphia, showed the locomotive engineer seated in the engineer’s seat facing forward, and he appeared to be alert.9 As the train traveled toward Chester, train operations were routine and the engineer was operating the train at or near track speed, which was 110 mph. About 10 seconds before impact, about 7:49:31, the engineer moved his head and torso forward with his

6 The number of people taken to hospitals by emergency responders does not match the number of hospital records, because some of the injured went to the hospital on their own. 7 These numbers are based on hospital records received by the National Transportation Safety Board (NTSB). 8 Unrestricted visibility is defined as “no obstructions to vision exist in sufficient quantity to reduce the visibility to less than 7 miles.” http://glossary.ametsoc.org/wiki/Visibility Accessed July 31, 2017. 9 The Amtrak locomotive cab had an inward facing image recorder that recorded video and internal audio.

NTSB Railroad Accident Report

4 gaze forward and moved his right hand toward the independent brake handle. About 7:49:32 the engineer moved his hand onto and activated the horn switch. The engineer was first aware of an abnormal situation when he observed a large piece of equipment on the tracks ahead of him. Just afterward, he saw that the backhoe was on track 3. He detected the equipment from about the same distance from which investigators could first see it during the sight distance observations. Concurrently, the engineer stood up from his seat and leaned forward with his gaze fixed directly ahead of him and his right hand on the controls. He then began a series of horn blasts to warn workers at the site that his train was approaching, and he also made an immediate emergency brake application to slow the train to reduce the impact of the impending collision. He then knelt on the floor, continuing to sound the horn as the train approached the work site. Seconds before the collision, the engineer lay down on the floor of the operating compartment in anticipation of the impact. 1.3.2 Amtrak Ballast-Vacuuming Project In the area where the ballast-vacuuming work was to be conducted, Amtrak owned, maintained, and operated on four tracks: tracks 1, 2, 3, and 4. Track 1 is the east track, track 4 is the west track, and tracks 2 and 3 are located in between. The maximum authorized speed on tracks 2 and 3 is 110 mph; it is 90 mph on tracks 1 and 4 between CPs Baldwin and Hook. Also on April 1, track 2 was taken out of service with Form D track authority so the work could begin.10 A Loram RailVac vacuum excavation machine (RailVac) occupied the track while the work was performed. (See figure 2.) To facilitate the ballast-vacuuming, Amtrak used a backhoe situated on track 3 that could reach over into track 2 to loosen the foul ballast before the vacuuming operation began. (See figure 3.) However, the backhoe cannot adequately loosen or move ballast from under the crossties, and additional hand work is often needed to rake the ballast into the space between the ties for better retrieval by the RailVac. When the RailVac was full of captured fouled ballast, it traveled to a preselected spot to off-load onto the right-of-way by extending its conveyor across, and thus fouling, track 1. Therefore, the foreman used foul time periodically on tracks 1, 3, and 4 to keep trains off those tracks to allow the backhoe and workers to foul tracks 1, 3, and 4.11 To conduct the work safely, all four tracks had to be protected, because (1) the boom of the RailVac fouled track 1 when it off-loaded spoils, (2) the backhoe on track 3 could cross over any of the other tracks when it was operating, and (3) the workers could be on or near any of the four tracks at any time during the project.

10 Form D authorization from a dispatcher removes a track from service to protect equipment and activities that cannot be removed readily, such as a RailVac. This is discussed in more detail in section 1.4, Roadway Worker Protection. 11 Foul time authority prohibits the movement of trains or other on-track equipment onto working limits during a specific period and is intended to be used temporarily. This is discussed in more detail in section 1.4, Roadway Worker Protection. Working limits refers to a segment of track with definite boundaries within which trains and engines may move only as authorized by the roadway worker in control of that segment of track.

NTSB Railroad Accident Report

5

Figure 2. RailVac vacuum excavation machine on track 2 at the accident site.

NTSB Railroad Accident Report

6

Figure 3. RailVac and backhoe taken from forward-facing video recorder just before accident. The engineering department of Amtrak’s Mid Atlantic Division within the NEC worked with the transportation department to implement the Chester project’s 55 hour track outage, but it did not prepare a site-specific work plan. This plan is an overall plan for the work project, covering such items as a statement of the work, staffing and equipment requirements, hazard assessment, and safety.12 The engineering department also staffed the continuous operation of the ballast-vacuuming project with a foreman and a track supervisor for each 12-hour night shift, from 7:00 p.m. to 7:00 a.m., and each 12-hour day shift, from 7:00 a.m. to 7:00 p.m. For each shift of a project, the foreman is in charge of the on-track safety protection, and he conducts a job briefing and makes job assignments for the project for his shift. The on-site railroad engineering employees and contractors work under the direction of the foreman. The track supervisor is the highest ranking Amtrak employee on the work project and is responsible for overseeing overall on-site safety and the progress and quality of the work being performed at the work site. The supervisor’s duties include overseeing job briefings, monitoring the foreman transfer between shifts, and ensuring proper and safe track protection procedures are followed. In addition, each shift had a watchman to alert the roadway workers of approaching trains, an electrical lineman to support the changes made to the track surface in relationship to the overhead catenary, a signal maintainer to check for any signal wire damages or other repairs, and a track laborer. Two RailVac operators (Loram contractors) were assigned to each shift, and a RailVac superintendent (Loram contractor) was at the work site during the day shift. An Amtrak backhoe operator began his shift at night and

12 Site-specific work plans are discussed in more detail in section 1.4, Roadway Worker Protection. Supervisor Track 3 Track 2 Track 4 N Backhoe RailVac Watchman Backhoe Operator

NTSB Railroad Accident Report

7 continued into the day shift. Table 1 shows the roadway workers, contractors, and other workers involved in the Chester project. Table 1. Workers on Chester ballast-vacuuming project. Night Shift Day Shift Amtrak Assistant Track Supervisor Amtrak Track Supervisor Amtrak Foreman (Employee-in-Charge)a Amtrak Foreman (Employee-in-Charge)a Amtrak Laborer Amtrak Laborer Amtrak Backhoe Operator Amtrak Backhoe Operator Amtrak Watchman Amtrak Watchman Loram (contractors) Two RailVac operators Loram (contractors) Two RailVac operators

Loram (contractor) RailVac superintendent aThe foreman is the employee-in-charge of on-track safety. The workers on each shift had varied reporting times spaced an hour apart, therefore not all workers were present at the shift change between the night-shift foreman and the day-shift foreman. On the day of the accident, the roadway workers’ shifts officially changed at 7:00 a.m., but the day foreman was late, and the actual shift change occurred later. The shifts of other workers—electrical lineman and signal maintainer—began later than 7:00. On the morning of April 3, before the accident, the RailVac was occupying track 2 (the out-of-service track); a backhoe, with an operator on board, occupied track 3; a roadway worker fouled track 1; a track supervisor was positioned in between tracks 2 and 3, and a watchman was standing just west of track 4. (See figure 3.) Ballast-vacuuming work was ongoing from before the time the foremen began their transfer from the night shift to the day shift until the time of the accident about 7:50 a.m. One RailVac operator was outside the cab of the RailVac actively running the machine. He was readjusting the arm to the center of the gauge of track 2 when the collision occurred. A Loram RailVac superintendent and a general laborer, as well as the Amtrak day foreman, were inside the cab. The backhoe was positioned on track 3 facing north. The backhoe operator was in the cab but not actively maneuvering the bucket. The track supervisor was raking loose spoils of fouled ballast from underneath the crossties of track 2 next to the backhoe. An Amtrak laborer was watching the supervisor at the time of the collision. The watchman was positioned on the western edge of track 4 in line with the backhoe. At the time of the accident, train approach warning on-track safety was not being used. The single watchman had an inadequate view to provide timely warning of approaching trains. The employee acting as the watchman told NTSB investigators that he blew his air horn and raised his banner when he saw the approaching train, and then he fled the track area.13 Evidence from the

13 Amtrak roadway worker protection (RWP) rules require that when using train approach warning the watchman alerts roadway workers to the approach of a train by raising an approved light or orange disc at arm’s length above his head and blowing a horn or whistle. In this case, the watchman raised an orange disc, which he called a “banner.”

NTSB Railroad Accident Report

8 forward-/outward-facing video camera on train 89 indicated that the watchman moved away from the track; the watchman’s other actions were not discernible on the video. The Loram RailVac superintendent told investigators that he did not hear the watchman’s horn or the train horn before the collision. 1.4 Roadway Worker Protection Numerous methods are available to protect workers while they perform maintenance-of-way (MOW) activities. These include regulatory requirements and rules and policies specific to railroads that are signatories to the North American Operating Rules Advisory Committee (NORAC) Operating Rules. (NORAC 2011) These methods are discussed in this section. In addition, Amtrak has an operating policy, called “80 mph Slow By,” that directs train dispatchers to slow trains as they pass by work zones where an undercutter or a track-laying machine is working on out-of-service track.14 This policy was based on the acute hazards of construction work using these two machines. That is, operations using this equipment create noisy work areas where roadway workers may be unable to hear approaching trains, warning sounds, and verbal communications. The maximum authorized speed on track 3, where the collision occurred, was 110 mph, and the dispatcher authorized Amtrak train 89 to travel on track 3 at that speed. The day train dispatcher told investigators, “Every second that a train is delayed, we got the clerks [and] the manager of train operations calling saying, “ ‘what happened to train so and so?’ ” At the time of the accident, the “80-mph Slow By” policy applied only to work zones where undercutting or track-laying equipment was in use, and it did not apply to work zones using a RailVac ballast-vacuuming machine. As of the date of this report, the policy still does not apply to the RailVac. To be clear, this 80-mph Slow By policy is Amtrak’s policy. Other railroads also have policies that require trains to reduce speed when operating past a work zone, but those policies are more restrictive than Amtrak’s. That is, other railroads slow trains to speeds considerably lower than 80 mph when they operate past a work zone. The NTSB is aware of-high speed passenger rail systems in Europe and Asia that prohibit workers from establishing work zones and using maintenance equipment during passenger train operation times. On those rail systems, maintenance work is performed during an overnight window when passenger trains are not operating. 1.4.1 Form D To protect roadway workers, a MOW foreman must follow NORAC Rules 160–162 for requesting a Form D track permit line 4 authorization from the train dispatcher to remove a track from service. Form D authorization protects equipment and activities that cannot be removed readily, such as a RailVac. This authorization creates an exclusive track occupancy for the work crew, and trains are not allowed on the work crew’s track segment, which is considered out-of-service track. To request Form D, an employee tells the dispatcher the track and the limits for the Form D. The dispatcher repeats that information, and then the requesting employee confirms the

14 An undercutter is an on-track machine that removes ballast from beneath the track so it can be cleaned.

NTSB Railroad Accident Report

9 information. The purpose of the repetition of information is to ensure accurate communication, which provides an additional layer of safety. After the train dispatcher authorized (issued) the Form D, he was required to make an entry into the train dispatcher’s log and in the dispatching system indicating that the track covered by Form D was occupied. This caused that area of track on the dispatcher’s board to show a red line indicating track occupancy by equipment. An employee who is issued Form D by the train dispatcher must contact the dispatcher to release the Form D. The employee and the dispatcher request, repeat, and confirm the information as they did when the Form D was requested. 1.4.2 Foul Time The foreman on a MOW project must request foul time for track that will be occupied temporarily. The rules for requesting and authorizing foul time are in NORAC Rule 140 and in Rule SI 140-S1 in Amtrak’s Northeast Corridor Employee Timetable No. 6, Includes Special Instructions (Timetable Special Instructions). (NORAC 2011; Amtrak 2016) Foul time is requested the same way a Form D is requested, with the requesting employee stating the track and the limits, the dispatcher repeats this information, and the employee confirms it. The foul time authorization from the dispatcher blocks the requested area from train traffic, providing what the FRA considers a form of “working limits” for the machinery and employees working in a protected area.15 Specifically, foul time allowed the qualified employee to temporarily conduct “covered fouling activities” on track protected from train intrusions.16 After the train dispatcher authorized foul time, he was required to make an entry into the train dispatcher’s log and in the dispatching system indicating that the track covered by foul time was occupied, causing that area of track to show as blue on the dispatcher’s board indicating that a blocking device is applied, also called a “blue block.” Similarly, when an employee in the field placed a supplemental shunting device (SSD) on the track it caused that area of track to show as red on the dispatcher’s board indicating track occupancy, also called a track occupancy light (TOL). In his interview, the train dispatcher referred to magenta (or blue over red) when describing what the dispatcher’s board would indicate with a blocking device applied and a TOL.17 At the time of the accident, the dispatcher had removed the electronic block from track 3, so it appeared without any color highlighting; it was white. Figures 4–7 illustrate the dispatcher’s display screen at critical times between 7:25 a.m. and 7:49a.m.

15 Working limits refers to a segment of track with definite boundaries within which trains and engines may move only as authorized by the roadway worker in control of that segment of track. 16 Amtrak defines covered fouling activities as equipment fouling a track in signaled territory or within interlocking limits for more than 5 minutes. 17 The color magenta derives from the historical use of lights in train operations: a blue light placed over a red light appears to be magenta.

NTSB Railroad Accident Report

10

Figure 4. Dispatcher’s display screen at 7:25 a.m. showing tracks 1–4 between Control Points Baldwin and Hook. Track 2 is out of service track (magenta), and tracks 1, 3, and 4 have electronic blocks (blue).

Figure 5. Dispatcher’s display screen at 7:31 a.m. showing that the dispatcher has removed the electronic blocking device from track 3.

Figure 6. Dispatcher’s display screen at 7:34 a.m. with a clear signal for train movement on track 3 indicated by the green highlight.

NTSB Railroad Accident Report

11

Figure 7. Dispatcher’s display screen at 7:47 a.m. with train 89 on track 3 shown by the A89 designation. Employees who are granted foul time by the train dispatcher must not release the foul time until they have ensured that all fouling activity under their authority has been cleared. The procedure for releasing foul time is similar to those for requesting foul time: the employee releasing foul time states the track and the limits, the dispatcher repeats that information, and then the requesting employee confirms the information. Amtrak used a sequential procedure in which one foreman released his foul time with the dispatcher, and subsequently the other foreman would request foul time from the dispatcher. However, railroads could use a procedure for two foremen to simultaneously transfer their fouls with the train dispatcher when their shifts change. Amtrak’s director of operating practices indicated that a process that allowed foremen to communicate with a train dispatcher to jointly transfer their fouls with a train dispatcher’s knowledge and approval could be designed and implemented to be safe. Employees who request foul time are required to be trained and to pass tests covering the NORAC Operating Rules and the content in Amtrak’s Timetable Special Instructions. (NORAC 2011; Amtrak 2016) 1.4.3 Supplemental Shunting Devices At the time of the accident, Rule SI 140-S2 required the use of an SSD when equipment fouls a track in signaled territory or within interlocking limits for more than 5 minutes. (Amtrak 2016) This instruction requires the employee-in-charge (EIC) of “covered fouling activities” to apply an approved SSD to the track to be fouled after receiving foul time from the train dispatcher. An SSD activates track-occupancy logic within the signal system and creates a TOL on the dispatcher’s board, thus serving as a second layer of safety. The signal system interacts with the ACSES system that will cause trains to stop short of an area protected by blocking devices applied to the dispatcher’s board and the shunt to the track structure provided by the SSDs. SSDs provide redundant on-track protection. For example, if the blocking device is removed by the train dispatcher, the TOL will remain on the dispatcher’s board if an SSD is on the track. In this situation, the dispatcher cannot route a train on that track, the signal system will display stop signals to tell the engineer to stop, and the PTC system will stop the train if the engineer does not. When an SSD is applied on the track, and a dispatcher cannot route a train through a length of track, the train dispatcher usually calls the foreman to find out why. Thus,

NTSB Railroad Accident Report

12 roadway workers must use SSDs to attain the additional layer of safety that PTC can provide. Otherwise, roadway workers are entirely reliant on perfect performance from the dispatcher. The NTSB has investigated three accidents where redundant signal protection in controlled-track territory would have prevented dispatchers from lining trains into work zones. The first occurred January 29, 1988, when northbound Amtrak train 66, the Night Owl, struck MOW equipment on track 2 in Chester, Pennsylvania. (NTSB 1989) (See a summary of the Night Owl accident at appendix B.) That earlier Chester accident was similar to the Chester accident discussed in this report in that postaccident toxicology testing indicated the use of drugs by Amtrak employees. Also similar was the lack of secondary protection for on-track equipment and out-of-service tracks. The second accident occurred in Woburn, Massachusetts, on January 9, 2007, when a passenger train was lined into a work zone resulting in two MOW employee fatalities and 12 injuries. (NTSB 2008) In the investigation report, the NTSB issued the following safety recommendation to the FRA: R-08-06 Require redundant signal protection, such as shunting, for maintenance-of-way work crews who depend on the train dispatcher to provide signal protection. On August 20, 2012, the FRA published a notice of proposed rulemaking (NPRM), “Railroad Workplace Safety; Roadway Worker Protection Miscellaneous Revisions (RRR),” in the Federal Register, which addressed this safety recommendation.18 (2012, 50323) Safety Recommendation R-08-06 is currently classified “Open—Unacceptable Response.” The NTSB investigated a third accident where redundant signal protection in controlled track territory would have prevented a dispatcher lining a train into a work zone. This accident occurred on Metro-North in West Haven, Connecticut, on May 28, 2013. (NTSB 2014a) A train was lined into a work zone and resulted in the death of a foreman who was working with a crane. On March 26, 2015, the NTSB sent a letter to the FRA that included the following: On October 19, 2012, we submitted comments regarding your [NPRM] titled Railroad Workplace Safety; Roadway Worker Protection Miscellaneous Revisions. [Federal Register 2012, 50323] Although the 2012 NPRM and Safety Advisory 2014-02 constitute positive steps toward satisfying this recommendation, we are disappointed that, after 7 years, you have yet to issue the requested regulation. Our 2014 special investigation report, Organizational Factors in Metro-North Railroad Accidents, highlights once again the need for this rulemaking. [NTSB 2014c] Accordingly, we request that you expedite action to issue the recommended requirement. Pending initiation of rulemaking, Safety Recommendation R-08-6 remains classified “Open―Unacceptable Response.”

18 RRR stands for retrospective regulatory review.

NTSB Railroad Accident Report

13 The FRA finalized and published in the Federal Register its “Railroad Workplace Safety; Roadway Worker Protection Miscellaneous Revisions (RRR)” on June 10, 2016. (2016, 37840) The FRA’s letter to the NTSB in response noted that these revisions included regulatory changes that include “requirements for roadway workers in controlled track territory to adopt redundant signal protection for their working limits.” The NTSB and the FRA consider this change to be “risk mitigation measures or safety redundancies to ensure the proper establishment and maintenance of signal protections for controlled track working limits that are in effect.” The FRA stated the following in its June 23, 2016, response to the NTSB: Specifically, the final rule requires Class I or II railroads and passenger railroads that establish on-track safety using controlled track working limits [49 Code of Federal Regulations (CFR) 214.321–214.323] in signalized territories to evaluate their particular operations and identify what type of redundant signal protection(s) is appropriate. This evaluation must be completed by July 1, 2017. After railroads conduct the required evaluation, railroads must adopt and comply with an appropriate method of redundant signal protections in their on-track safety program by January 1, 2018. FRA may object to a railroad’s method of providing redundant signal protections under the review procedures specified in 49 CFR 214.307, or may take other appropriate enforcement action if a railroad neglects to evaluate, adopt, and comply with appropriate redundant protection procedures. In addition to addressing Safety Recommendation R-08-06, this final rule provision on redundant signal protections is intended to fulfill the rulemaking mandate contained in the Fixing America’s Surface Transportation Act, Public Law 114-94, 129 Statute 1686 (December 4, 2015) (FAST Act). Section 11408 of the FAST Act requires FRA (as the Secretary of Transportation’s delegate) to promulgate a rule requiring railroads to implement redundant signal protections. FRA believes this final rule provision governing redundant signal protections fulfills both the FAST Act mandate and Safety Recommendation R-08-06. FRA does not presently intend to take any further action, but will work with the railroad industry to provide guidance regarding appropriate redundant signal protections that must be in place by January 1, 2018. The NTSB believes that the FRA’s June 10, 2016, final rule, Railroad Workplace Safety; Roadway Worker Protection Miscellaneous Revisions, begins to address Safety Recommendation R-08-06 but is concerned about several aspects of the FRA’s response to Safety Recommendation R-08-06 to date: not requiring railroads to submit to the FRA for review their evaluations and results for mitigating safety shortcomings, that is, appropriate redundant signal protection; delaying the adoption of the railroads’ identified mitigations of safety shortcomings, and the ambiguity of the FRA’s review and audit procedure for the railroads’ implemented mitigations. Therefore, the NTSB reiterates R-08-06 to the Federal Railroad Administration. Amtrak was unable to provide the NTSB with a specific evaluation plan and stated that its actions to enhance redundant protection were fully supported by the FRA through grant programs and an ongoing joint efficiency testing program. Amtrak stated that it could prepare a plan if specifically requested by the FRA.

NTSB Railroad Accident Report

14 1.4.4 Site-Specific Work Plans Amtrak requires some engineering maintenance or renewal projects to have site-specific work plans (SSWP). Amtrak typically creates an SSWP for large production projects that have a large number of employees and equipment (extended exposure and activity over long stretches of the roadway). NTSB investigators reviewed several Amtrak SSWPs, which contained the following elements: • Job summary/statement of work • Scope of work • Hazard assessment worksheet • Manpower and additional departments • Equipment and placement on job site • Tools and training • Job briefings • Safety and personal protective equipment • Emergency phone numbers • Community/public impact • Clean-up/disposal According to Amtrak’s SSWPs, determining the number of watchmen needed to alert roadway workers to train incursions into the worksite is a critical element of safety planning. After two fatalities on Southeastern Pennsylvania Transportation Authority in 2008, representatives from the Amtrak engineering department and from engineering unions formed a group to identify locations where additional watchmen should be considered because of environmental concerns like curvature or other sight limitations. These locations are called hot spots, and in 2008–09, the group developed Amtrak’s Hot Spots Rule 360, which first appeared in the 2010 Roadway Worker Protection Manual: Amtrak Rule 360 Definition: Hot spots are locations on the railroad where additional roadway worker protection (RWP) is required! These physical locations include a variety of conditions. Hot Spot Examples:

1. When a lone worker requires positive protection or a watchman to work safely

at a given location, then that would qualify as a Hot Spot.

NTSB Railroad Accident Report

15

1. When a roadway work group (gang) requires positive protection or advance

gang watchman to work safely, then that would qualify as a Hot Spot.

1. When you have less than 15 seconds to clear the work limits (location) safely,

then that would definitely qualify as a Hot Spot.

1. When your working limits (location) require more than 15 seconds to clear

safely because of limited or no clearance areas nearby, then that would qualify as a Hot Spot. • Curves with limited visibility. • Tunnels with limited and close clearance. • Track locations with heavy outside noise. • Track locations with limited or no clearance. • Bridge locations with limited or no clearance. • Track locations with limited or no visibility due to obstructions. Potential Hot Spots: • Bridges—overhead, undergrade and movable—walkways, hand railings, and clearing bays • Curves—simple (sharp/high degree of curvature), reverse, compound, brokenback, and vertical (grades) • Roadbed—fill section (elevated) and cut section (rock cut) • Tunnels—manholes (cut outs) and bench walls (ladders and handholds) • Fencing—right of way, intertrack and high level platforms • Overbuilts—manholes (cut outs) and clearing bays Rule 360 was included in the manual each subsequent year until 2015, when Amtrak developed a separate handout containing Rule 360 for engineering employees to use as a reference guide. 1.4.5 Job Briefings Title 49 Code of Federal Regulations (CFR) 214.315, “Supervision and communication,” requires that when an employer assigns duties to a roadway worker that call for that employee to foul a track, the employer shall provide the employee with a job briefing that includes information on the means by which on-track safety is to be provided, and instruction on the on-track safety

NTSB Railroad Accident Report

16 procedures to be followed. Additional requirements, effective July 1, 2013, require the job briefing to include information about any adjacent tracks, on-track safety for such tracks, and MOW equipment that will foul the tracks; and a discussion of the nature of the work to be performed and the characteristics of the work location.19 This information is to be communicated again any time the on-track safety procedures change during the work period. The FRA publishes a compliance document, Track and Rail and Infrastructure Integrity Compliance Manual Volume III Railroad Workplace Safety, Chapter 3 Roadway Worker Protection (January 2014). The document is based on five fundamental safety principles:

1. A person who is not fouling a track will not be struck by a train.
2. A person who is fouling a track upon which a train will not move will not

be struck by a train.

1. No person should foul a track unless that person knows either that

a. No train will arrive or b. The person on the track will be able to move to a place of safety before a train arrives.

1. Each roadway worker bears the ultimate responsibility for his own on-track

safety.

1. Each employer is responsible for providing the means for achieving

on-track safety to each roadway worker employee. The FRA’s Roadway Worker Protection Compliance Manual provides the railroad industry with interpretations of and guidance on the railroad workplace safety regulations. The compliance manual regarding 49 CFR 214.315 stresses four points for roadway work group job briefings:

1. An employer shall provide a job briefing for workers fouling a track.
2. A job briefing for on-track safety shall be deemed complete only after

workers have acknowledged understanding the on-track safety procedures and instructions presented.

1. Work groups that will foul a track shall have one qualified roadway worker

designated to provide on-track safety for all members of the group.

1. The designated person shall inform all workers in the group of the on-track

safety procedures to be followed and also shall inform them when any changes to the on-track safety procedures are made.

19 Adjacent tracks mean two or more tracks with track centers spaced less than 25 feet apart.

NTSB Railroad Accident Report

17 1.5 Accident Narrative On April 3, 2016, at 07:10:54, the night train dispatcher approved the fouling of track 1 in a radio communication with the night foreman.20 Recalling the morning of April 3 around the time of the shift change, the day watchman told NTSB investigators that the night foreman was ready to leave after his night shift. It had been windy, snowing, and hailing during the night shift, the day foreman was late arriving at the job site, and the watchman got the impression that the night foreman was anxious to leave the work site. About 7:16 a.m., while the day foreman was driving to the job site for his shift (scheduled to start at 7:00 a.m.), he called the day train dispatcher by cell phone to request Form D out-of-service track authority on track 2. The train dispatcher asked him to call back, which he did, at 07:24:09. The train dispatcher gave him Form D number A1401 at 7:26, taking track 2 out of service.21 They discussed the night foreman’s clearing up fouls and whether the day foreman would pick them up. The day dispatcher told investigators that he asked the day foreman about needing fouls, because although it was Sunday, trains were still running: at least two trains in each direction an hour. The day foreman told the dispatcher that, at the time (about 7:26 a.m.), he was assessing “how much [he had] to do with this backhoe.” He explained that the presence of the backhoe at the jobsite required the fouling of tracks 3 and 4. Additionally, he preferred to maintain fouls for track 1 as well “as much as possible for now.” At that time, the day foreman was unable to provide the dispatcher with a precise estimate of how much longer those tracks would need to be fouled, indicating that he didn’t “know how much longer …’cause my backhoe operator should be getting out of here in about an hour or two.” At the time, all four tracks were out of service with either foul time or Form D authority. At 07:27:23, the day train dispatcher made a personal phone call, using an Amtrak phone, to his spouse.22 During the call, he mentioned that track 2 was out of service and tracks 1, 3, and 4 had fouls. Under Amtrak RWP Rules and FRA Roadway Work Place Safety, foul time is a means of establishing working limits on controlled track. When the day foreman arrived at the job site, he met with the night foreman and they discussed their transfer. At that time, the night foreman explained that he had foul time on tracks 1, 3, and 4 and a Form D on track 2. According to the night foreman, he believed that he had reached an agreement with the day foreman: he would call the dispatcher and give up Form D and his fouls, and the day foreman would immediately call the dispatcher and pick them up.

20 Times given in the format hh:mm:ss are from Amtrak digital recordings of incoming and outgoing radio transmissions and telephone calls between Amtrak train dispatchers and employees in the field. 21 Amtrak had taken track 2 out of service for the 55 hours of the ballast-vacuuming project, but each time the EIC changed, the train dispatcher issued a new Form D number. The night foreman had Form D number A1403, issued on April 2, 2016, at 7:13 p.m. The day train dispatcher issued Form D number A1401 to the day foreman on April 3, 2016, at 7:26 a.m. Following NORAC Rule 160, Form Ds are numbered consecutively each day beginning at midnight. (NORAC 2011) 22 From the start of his shift to the time of the accident the train dispatcher made two outgoing personal phone calls to his spouse. During both calls they discussed both personal and railroad topics. The train dispatcher’s spouse is an employee of another railroad. These calls, made on an Amtrak telephone, are recorded.

NTSB Railroad Accident Report

18 About 7:29 a.m. after speaking with the day foreman, the night foreman called the day train dispatcher and cancelled Form D for track 2 and released the foul time on tracks 1, 3, and 4. In the same call, the night foreman told the train dispatcher that the day foreman would pick up his fouls on tracks 1, 3, and 4 between CPs Hook and Baldwin. However, workers and equipment were still fouling track 3, and NORAC Rule 140-S1 required the track to be clear of workers and equipment before foul time is released. (NORAC 2011) According to the night foreman, directly after his telephone call with the dispatcher, the night foreman told the day foreman that he had released all of his track protections and the day foreman needed to call the train dispatcher to secure on-track protections. The day foreman responded, “I got it,” which the night foreman interpreted to mean that the day foreman understood that he needed to immediately call the dispatcher and secure track protections. The night foreman then left the job site. The day watchman told investigators that he saw the night foreman driving away from the area 10 to 15 minutes before the collision. The day train dispatcher told investigators that after the night foreman released his fouls, he expected the day foreman to call right afterward to request fouls on the same tracks. The dispatcher had noted the pending foul time requests in his logbook and had not removed several of the blocking devices from the previous shift because he was expecting the day foreman to call to obtain the fouls “within seconds, if not a minute, after [the night foreman] cleared up his foul,” and he had contemplated calling the day foreman to find out whether he wanted foul time. The day foreman recalled that, after the night foreman had released, or cleared, his foul time on tracks 1, 3, and 4, he had told the night foreman, “when you are clear of all your fouls, don’t bother getting any more fouls. I’ll get them for the rest of the day.” He said he did not see the night foreman after that time, and that he expected the night foreman to remain in the area until he ensured all the workers were cleared from the tracks. He also noted that he “didn’t pay attention to what [the night foreman] was really doing.” The day foreman also told the RailVac superintendent that tracks 3 and 4 were protected with foul time, and he told the watchman that tracks 1, 3, and 4 were protected with foul time. There was no evidence that the day foreman contacted the train dispatcher to request foul times on tracks 1, 3, and 4 on the morning of the accident. After the day foreman began his shift, he collected signatures on a job briefing form from several workers. The job briefing form is shown in figure 8, and four items, each highlighted with a box around it, indicated that (1) foul time would be used during the shift to protect the tracks, but SSDs would not be applied; (2) only one watchman would be used, (3) railroad maintenance machinery would foul the tracks; and (4) no one had any questions or concerns.23 Between 7:30 a.m. and 7:50 a.m. the day foreman asked the RailVac superintendent to begin work, but the superintendent said that he would not work without a job briefing. The Amtrak watchman and the RailVac superintendent told investigators that the day foreman told them that the tracks were protected with fouls but failed to provide them with a job briefing.

23 Title 49 CFR 214.311 (b) states, “Each employer shall guarantee each employee the absolute right to challenge in good faith whether the on-track safety procedures to be applied at the job location comply with the rules of the operating railroad, and to remain clear of the track until the challenge is resolved.”

NTSB Railroad Accident Report

19

Loram RailVac Operator Night Shift Loram RailVac Superintendent Day Shift Loram RailVac Operator Day Shift Loram RailVac Operator Day Shift

Loram RailVac Operator Night Shift

NTSB Railroad Accident Report

20 Figure 8. Day foreman’s job briefing sheet circulated to and signed by roadway workers (signatures redacted, jobs identified by Amtrak). RMM stands for roadway maintenance machine. Signatures of workers (redacted) and their jobs identified by Amtrak.. At 07:49:24, the day train dispatcher made another personal phone call to his spouse and said that he just saw something he did not like. He said it was a light on the display indicating an abnormal situation, but that no one was fouling that area. At 07:50:18, during the same call, the day train dispatcher said that someone was fouling tracks 1, 3, and 4, and track 2 was out of service. At 07:50:25, someone said that they heard a radio transmission from an unknown source saying, “Emergency, emergency, emergency.” At 07:50:35, the day train dispatcher, on the same personal call, said that he hoped no one was fouling the track without telling him because a train was operating “through there on track 3.” Then the day train dispatcher said he had an emergency and would call back. At 07:51:34, the day foreman called the day train dispatcher and asked whether the night foreman had fouls on tracks 3 and 4. The day train dispatcher replied that the night foreman had given up his fouls. The day foreman then said that the backhoe was hit and that he needed ambulances. As a result of the collision, the lead truck of the locomotive derailed; the backhoe was destroyed, killing the operator; debris from the collision struck and killed the track supervisor; and part of the backhoe struck the sidewall of the first passenger car. (See figure 9.) The sudden deceleration of the train threw passengers about inside the cars, causing injuries to 31 people. When the train came to a stop, the conductor radioed the train dispatcher to report the collision, and emergency responders arrived about 8:00 a.m. The forward-facing video on the accident train showed the work area just before the accident occurred. On the video, the watchman can be seen running moving away from his position outside of track 4. The watchman told NTSB investigators that he saw the train approaching and attempted to warn the workers by sounding his air horn and waving a disc to the train above his head.

NTSB Railroad Accident Report

21

Figure 9. Damage to lead passenger car. 1.6 Personnel Information 1.6.1 Amtrak Roadway Workers The 57-year-old day foreman was hired as a trackman March 17, 1977. He was promoted to qualified foreman on July 17, 1980. The night foreman, 41 years old, was hired March 18, 2013, as a trackman. He was promoted to qualified foreman on November 29, 2015. The 59-year-old supervisor was hired as a trackman on January 16, 1978. He was promoted to qualified supervisor on April 2, 1979. The 62-year-old backhoe operator was hired as a trackman August 9, 1976. The watchman, 36, was hired July 7, 2014, as a trackman. 1.6.2 Amtrak Train Engineer and Dispatchers The locomotive engineer, 47, was hired on May 5, 2014. His last engineer certification was January 19, 2016. The 55-year-old day train dispatcher was hired January 19, 1988, as a block operator. He was promoted to qualified train dispatcher on January 24, 2001, and later qualified as assistant chief train dispatcher. Three days before the accident, on March 31, 2016, he completed Amtrak’s refresher Block Training for Train Movement course. Course materials included the NORAC rules and the Amtrak Timetable Special Instructions. (NORAC 2011; Amtrak 2016) The night train dispatcher completed the same course on March 2, 2015.

NTSB Railroad Accident Report

22 1.7 Medical and Toxicology Information After the accident, Amtrak obtained specimens for toxicology testing on key employees involved in the accident. Title 49 CFR mandates drug and alcohol screening after an accident.24 Postaccident testing was required by the FRA for hours-of-service employees and any on-duty employee who dies in an accident; however, service employees are not subject to this drug testing. All of the specimens were screened for cannabinoids, cocaine, opiates, amphetamines, methamphetamines, phencyclidine, barbiturates, benzodiazepines, and ethyl alcohol. In addition, at the request of the NTSB, specimens from the deceased track workers were tested by the Federal Aviation Administration’s (FAA) Bioaeronautical Sciences Research Laboratory for more than 1,300 substances including prescription, over-the-counter, and illicit drugs. The results of the toxicological tests are discussed in this section along with medical information about those employees from the Amtrak personnel records.25 Amtrak personnel records indicated that the backhoe operator, track supervisor, train engineer, conductors, and the day watchman were medically qualified for their positions. 1.7.1 Backhoe Operator The backhoe operator was subject to urine drug testing at the time of his occupational medicine examinations, but he was not subject to random drug testing. He tested negative in two Amtrak periodic drug tests conducted during occupational medicine examinations in 2014.26 The backhoe operator’s postaccident toxicological test results were positive for cocaine (a potent potentially impairing central nervous system stimulant) and its metabolites, levamisole (a chemical frequently used to dilute illicit cocaine), amlodipine (a prescription blood pressure medicine), chlorthalidone (a prescription blood pressure medicine), and gabapentin (a prescription pain control and anti-seizure medicine), in muscle and urine. 1.7.2 Track Supervisor The track supervisor was subject to urine drug testing at the time of his occupational medicine examinations but not to random drug testing. Seven urine drug tests since 1996 conducted during periodic examinations were negative. His postaccident toxicology was positive for the prescription opioid pain medicines oxycodone at 8.1 nanograms per milliliter (ng/ml) and morphine at 34.5 ng/ml in cavity blood and codeine at 4.0 ng/g, morphine at 77.0 ng/g, and oxycodone in liver. Cavity blood is subject to changes in concentration after death due to movement of drugs from tissues back into the blood, and the blood may be subject to dilution by

24 Parts 219 (Control of Alcohol and Drug Use), 240 (Qualifications and Certification of Locomotive Engineers), 242 (Qualifications of Conductors), and 382 (Controlled Substances and Alcohol Use and Testing). 25 For additional detailed information about toxicology testing see the Medical Factual Report in the NTSB public docket for this investigation. 26 Occupational preemployment and return-to-work urine testing varies but generally includes the following drugs: marijuana metabolites, phencyclidine, amphetamines, ecstasy, cocaine metabolites, and opiate metabolites. Occupational urine testing for the track supervisor and the backhoe operator was negative.

NTSB Railroad Accident Report

23 other fluids. These effects can result in blood levels that do not represent levels at the time of the accident. 1.7.3 Night Foreman After the accident Amtrak tested the night foreman for drugs. His postaccident testing was negative. 1.7.4 Day Foreman After the accident Amtrak tested the day foreman for drugs. His postaccident testing was negative. 1.7.5 Assistant Nighttime Supervisor After the accident Amtrak tested the assistant nighttime supervisor for drugs. His postaccident testing was negative. 1.7.6 Watchman After the accident Amtrak tested the day watchman for drugs. His postaccident testing was negative. 1.7.7 Train Engineer The 47-year-old locomotive engineer had been subject to three urine drug tests: a preemployment test in 2014, a periodic test in 2015, and a rules violation test in February 2016. These tests were reported as negative. The postaccident toxicological tests for the engineer were positive for tetrahydrocannabinol (THC), a primary active impairing compound in marijuana, at 2.2 ng/ml and carboxy-tetrahydrocannabinol (THC-COOH, THC’s inactive metabolite) at 16.1 ng/ml in blood collected 5 hours after the accident. Additionally, THC-COOH at 48.6 ng/ml and the sedating opioid morphine at 1,256 ng/ml were detected in urine also collected 5 hours after the accident. The engineer had been treated in the hospital with morphine for pain about 2 hours before urine was collected for postaccident testing. 1.7.8 Train Conductor and Assistant Conductors FRA postaccident tests for drugs and alcohol were negative for the train conductor and the two assistant conductors. 1.7.9 Train Dispatcher FRA postaccident tests for drugs and alcohol were negative for the train dispatcher.

NTSB Railroad Accident Report

24 1.8 Injuries The track supervisor and the backhoe operator died in the collision. Emergency responders transported 37 people to local hospitals. Table 2 shows the injuries from the accident. This table is based on hospital records received by the NTSB. Table 2. Injuries. Injury Typea Work Crew Train Crew Passengers Total Fatal 2 0 0 2 Serious 0 0 1 1 Minor 1 7 30 38 Total 3 7 31 41 a Title 49 CFR 830.2 defines fatal injury as “any injury which: results in deathwithin 30 days of the accident” and serious injury as “an injury which: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface.“ The minor injury category includes all other people, not cited in the other injury categories, who were reported treated by area hospitals within 24 hours following the incident. 1.9 Damages The accident damaged the locomotive and the first trailing passenger car. The undercarriages of other passenger cars were damaged.27 The collision destroyed the backhoe. Amtrak estimated damages to be about $2.5 million. In the damage descriptions below, a reference to “right” refers to the right-hand side of a railcar with respect to its direction of travel at the time of the collision. The impact with the backhoe crushed the lower right front of the locomotive; the pilot, also called a cowcatcher, was deformed rearward and under the locomotive, and the anti-climber was deformed downward.28 Investigators noted a long vertical impact mark on the left side of the locomotive nose. The windshield shattered, dispersing shards of glazing on the consoles, floor, and seats inside the cab. The collision dislodged the radio, and it was inoperable afterwards. The bottom sound diffuser portion of the bell on the front-end cab was missing after the collision, but the bell was fully functional. The auxiliary, or ditch, lights were not functional. The event recorder was downloaded, and it appeared that the event recorder lost power at the time of the collision, and no data was stored after the collision with the backhoe.

27 NTSB investigators examined train 89, both before and after the train was moved during the recovery efforts. All railcars came to rest upright. 28 (a) The pilot, colloquially known as the “snowplow” or “cowcatcher,” is located at the front of a train to deflect objects on the tracks. (b) An anti-climber is a device mounted above the coupler of locomotives and passenger cars to prevent colliding objects from travelling up over the frame and through the locomotive cab or through the passenger car.

NTSB Railroad Accident Report

25 Debris from the backhoe struck the right side of the lead passenger car. The impact deformed the exterior right side, causing inward movement of the sidewall between the second and fourth windows. (See figure 10.) Damage above the second and third windows included a horizontal gouge mark on the side sheet, and the rear edge of the second window had been pushed partially inward. The collision pushed the third and fourth windows completely into the car. The side sheet between the third and fourth windows was torn, with gouge marks around the window opening. The ninth window was completely pushed into the car with a gouge mark at the upper rear corner of the window opening.

Figure 10. West (right) side of lead passenger car in Train 89. Inside the lead passenger car, investigators found the right sixth-row and seventh-row seats separated from the wall and floor pedestal. (See figure 11.) Near the right eighth-row seat, the baggage rack was bent upward, the ceiling panels had fallen onto the seats, and the interior wall panels at the windows were cracked and torn. The right fifth- and the eighteenth-row seats had partially rotated. The first aid kit was empty, and all its supplies had been used.

NTSB Railroad Accident Report

26

Figure 11. Interior of lead passenger car. 1.10 Recorder Data 1.10.1 Video Recorder Data The locomotive had two camera systems. One was a forward-/outward-facing video camera that recorded video in color and sounds captured by a microphone mounted on the exterior front of the locomotive.29 The other camera was an inward-facing image recorder inside the locomotive cab that recorded video and audio. The locomotive digital video recorder (LDVR) captured both video and audio inside the control cab. Video and audio data from both cameras was recorded and stored by the LDVR. 1.10.2 Locomotive Event Recorder Data The locomotive event recorder data showed that the train departed Penn Station in New York City at 06:06:30. It made four station stops before the accident. Between New York and

29 This microphone captured sounds primarily of the train rolling over the track; the sound of the locomotive horn and the watchman’s air horn were not discernible.

NTSB Railroad Accident Report

27 Philadelphia the train speed reached a high of 124 mph, and the train complied with all cab signals. After departing Philadelphia’s 30th Street Station at 07:38:30, the train accelerated to 109 mph. The last 40 seconds of the data contained the following events: • At 07:49:00, the train speed was steady at 107 mph. The throttle was in position T6, and the train was 6,272 feet from the final recorded point.30 The cab signal was Clear 125 mph and remained at this signal setting through the end of the recording. • At 07:49:02, the throttle was moved to the T5 position. Parameters were then stable for the next 28 seconds. • At 07:49:31, the throttle was moved to the Idle position with the train 1,387 feet from the final recorded point. • At 07:49:32, the horn was sounded, and it stayed active until the end of the recording. The train was 1,230 feet from the final recorded point. • At 07:49:33, the train speed dropped to 106 mph (from 107 mph). • At 07:49:35, the train was 760 feet from the final recorded point. An engineer-induced emergency was activated. Brake pipe pressure decreased to 0 psi in about 2 seconds and brake cylinder pressure began to rise. The train was moving at 106 mph, and began to decelerate. • At 07:49:40, the final recorded data point, the train speed was 99 mph, brake pipe pressure was 0 psi, and brake cylinder pressure was 75 psi. At this time, the horn was recorded as active. 1.11 Method of Operation The Philadelphia to Washington Line in the Mid–Atlantic Division of Amtrak’s NEC extended from MP 0.0 at CP Zoo in Philadelphia, Pennsylvania, to MP 134.6 at CP Avenue, Washington Terminal in Washington, DC, in a timetable north-south direction. In the vicinity of the accident, Amtrak operated trains over the four tracks using a traffic control system controlled by a train dispatcher located at the Consolidated National Operations Center in Wilmington, Delaware. Amtrak Operating Rule 261 governs train movements on the Mid-Atlantic Division between CP Phil MP 3.6 to CP Holly MP 20.3.31 Additionally, on tracks where Rule 261 is in

30 The accident locomotive was equipped with a continuous power lever rather than a classic power lever with discrete notches, or throttle positions. The locomotive mapped this continuous power lever into notches for communication with other engines (if equipped). These mapped throttle notches were recorded by the event recorder and included in this description of events. 31 Amtrak’s Operating Rule 261: Track signaled in both directions. Signal indication will be the authority for a train to operate in either direction on the same track. At a hand-operated switch without an electric lock a train may clear the track only where the maximum authorized speed on the track over the switch is 20 mph or less.

NTSB Railroad Accident Report

28 effect, the automatic block signal system and cab signal system Rules 550-561 are in effect for movements in both directions.32 At the time of the accident, Amtrak authorized train movements using NORAC rules, supplemented with the following: • Amtrak Timetable Special Instructions, effective February 22, 2016 • General Order No. 601, effective February 22, 2016 • Bulletin Orders NYW6-03 (sum), effective March 7, 2016; NYW6-06, effective March 28, 2016; and NYW6-01SCH-a, effective February 22, 2016 • Wilmington Dispatching Office Temporary Speed Restriction Bulletin, effective April 3, 2016 (5:00 a.m.) Amtrak train dispatchers authorized all train movements and coordinated all work by roadway workers and equipment on the right of way. These authorizations included granting qualified roadway workers Form D (track out of service) and foul time authority. These authorizations were used to protect roadway workers and equipment from train movements. The authorization of trains through a work zone included determining the speed of the trains. 1.12 Signal System The ACSES portion of the system includes civil speed enforcement and positive train stop (PTS) enforcement capabilities.33 The civil speed enforcement feature of ACSES protects the locomotive from exceeding civil speed limits. The presence of permanent and temporary wayside transponders establishes civil speed limits. The PTS enforcement feature ensures that the locomotive stops at home signals when an absolute stop aspect is present. The FRA-required automatic train control (ATC) and ACSES departure tests are required every calendar day or within 24 hours of departure. Before the day’s initial service run the locomotive engineer must conduct or verify each test. The departure tests include a sequence of steps to verify the operational integrity of the equipment. Any equipment malfunction must be corrected before the locomotive’s service run. ACSES on the Amtrak NEC is currently applied as a complement to an existing wayside signaling system with cab signals that provides train detection through track occupancy logic, interlocking logic, broken rail protection, and on-board enforcement of signal speed. ACSES combined with the ATC Cab Signal System meets all requirements for high-speed passenger rail operation on the NEC and all FRA-mandated PTC requirements to prevent train-to-train collisions,

32 (a) In the automatic block signal system, the use of each block is governed by an automatic block signal, cab signal, or both. (b) The cab signal system is interconnected with the fixed signal system to provide the engineer with continuous information on the occupancy and condition of the track ahead. 33 Civil speed means maximum speed as set by the physical characteristics of the track structure and the mechanical capabilities of the train consist.

NTSB Railroad Accident Report

29 overspeed derailments, incursions into established work zone limits, and movement of a train through a switch left in the wrong position. 1.12.1 Locomotive Equipment The ACS-64 locomotive was equipped with an ATC system. The system is a combined 9-aspect ATC and ACSES configuration that ensures safe operation of the locomotive. The ATC portion of the system includes automatic speed control and automatic train supervision capabilities. The automatic speed control feature protects the locomotive from exceeding speed limits established by track signals. The automatic train supervision feature ensures that the locomotive engineer recognizes and acknowledges track signal (aspect) speed reductions. 1.13 Operational Testing Title 49 CFR Part 217 required that railroads have a program to conduct operational tests and inspections periodically to determine compliance with their operating rules, timetables, and timetable special instructions. Amtrak monitored the effectiveness of and compliance with its operating rules by using field audits, inspections, and its program of operational tests. Amtrak stored records from its operational test program, TESTS, in a database, making them readily available for inspection and analysis. TESTS programs were detailed in Supervisor’s Guide to Efficiency TESTS, which described how to conduct each test and outlined supervisor requirements and program oversight responsibility. The operational tests were based on railroad functions rather than railroad-specific rules or instructions. This permitted the same operational tests to be used throughout the Amtrak system, regardless of host railroad. The selection of available operational tests was keyed to employees’ crafts. When recording noncompliance in an operational test of an employee, supervisors were required to view any previous noncompliance by the employee. Four different types of observations are documented in TESTS: • 1872 Efficiency Tests: Operating rules/instruction compliance (all operating crafts) • 1875 Engineer Evaluations: On-the-job locomotive engineer train operating proficiency • 1876 Student Engineer Evaluation: On-the-job student engineer train operating proficiency • 1877 Conductor Evaluations: On-the-job conductor proficiency in train operations and customer interaction During the 12-month period before the accident, Amtrak recorded 194,343 tests conducted on 8,343 different train and engine employees, train dispatchers, roadway workers, and equipment maintenance personnel on the NEC. These tests included those taken by employees of other railroads that Amtrak hosts on the NEC. Excluding tests of equipment maintenance personnel,

NTSB Railroad Accident Report

30 Amtrak conducted 172,303 tests on 6,670 different train and engine employees, train dispatchers, and roadway workers on the NEC. NTSB investigators learned that at the time of the accident, Amtrak did not have an efficiency test code for observing or evaluating compliance with Amtrak’s SSD process. Supervisors and managers did have the ability to code noncompliance with the SSD process, but the code was placed in the “other” category of the database and thus would not be an item differentiated or assessed adequately for compliance. 1.14 Meteorological Information At 7:00 a.m. the weather was sustained northwest wind of 38 mph gusting up to 50 mph and a temperature of 37°F. Visibility was unrestricted. Thunderstorms with heavy rain were reported between 11:16 p.m. (April 2) and 12:08 a.m. (April 3) at Philadelphia International Airport (KPHL), which is about 7 miles northeast of the accident site. The band of thunderstorms was associated with lightning and small hail and marked the leading edge of high wind that continued into the morning hours. 1.15 Sight Distance Observations Investigators performed sight distance observations on June 12, 2016, from ground level, focusing on the movement of a train approaching the accident site from the north and traveling southbound at 106 mph. The purpose of the observations was to measure the distance at which an observer could first see the approaching train, as well as the distance at which the approaching train appeared clearly on track 3. The observations were made from positions representing the location of the watchman—from outside of track 4 and in the foul of track 4. The time it took the train to reach the accident location after it was first detected also was recorded. From the viewing position located outside and clear of track 4, the first-detection distance ranged from 4,097 to 4,392 feet across the observers, or, equivalently at 106 mph, from 26 to 28 seconds from the accident site. Similarly, from a viewing location in the foul of track 4, the first-detection distance ranged from 4,190 to 4,425 feet, or 26 to 29 seconds from the accident site. Additionally, from the viewing position located outside and clear of track 4, the recognition that the approaching train was on track 3 occurred between 1,788 and 2,150 feet, or between 11 and 14 seconds from the accident site. From the viewing location in the foul of track 4, the recognition that the train was on track 3 occurred between 1,598 and 1,853 feet, or between 10 and 12 seconds from the accident site. Amtrak’s Roadway Worker Protection Manual, System Safety (Rev. 4, January 1, 2015) requires that employees and equipment are in a place of safety, clear of the track, 15 seconds before the arrival of a train. A speed and distance table aids employees to determine the time and distance needed for watchmen to ensure compliance with the “15-second rule.” (See table 3.) The maximum authorized speed for passenger trains on tracks 2 and 3 in the area of the accident is 110 mph; for the outside tracks, tracks 1 and 4, the maximum authorized speed is 90 mph.

NTSB Railroad Accident Report

31 Table 3. Speed versus distance. Speed (mph) Feet per Second Feet per 15 Seconds 90 132.0 1,980 95 139.3 2,090 100 146.7 2,200 105 154.0 2,310 110 161.3 2,420 1.16 Safety Culture and Management Safety culture is a term used to refer to an organization’s attitudes and actions about safety. That is, the beliefs commonly held by all employees throughout a corporation about safety in their workplace, including their safety, that of their peers and colleagues, and that of customers during business activities. All organizations have a safety culture; however, safety cultures can be weak and ineffectual at fostering safe work practices by employees. Safety culture has been studied widely across business communities; organizations that prioritize safety within all business activities have a strong safety culture. James Reason has indicated that organizations with a weak safety culture will have more active failures, as well as latent conditions that undermine safety. Active failures are the errors and violations committed by those in direct contact with the system. Latent conditions are created by system designers, builders, procedure writers, maintainers, and system managers and can lie dormant for many years before they combine with active failures and lead to an accident. (Reason 2013, pp. 82–83) Thus, one would expect employees of an organization with a weak safety culture to engage in more unsafe actions than employees of an organization with a strong safety culture. One would also expect managers of an organization with a weak safety culture to fail to seek and address upstream system factors, such as poor training and a lack of equipment. As Reason observes, perhaps the most insidious and far-reaching effects of a weak safety culture are shown by an organization’s reluctance to proactively address known safety shortcomings. (Reason 2013) An important concept related to safety culture is safety management. Generally, safe organizations have a system in place to manage safety, which is called a safety management system (SMS). The FAA, which has mandated the implementation of SMS, defines an SMS as a “formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls.34 It includes systematic procedures, practices, and policies for the management

34 FAA Order 8000.369, FAA Safety Management System Initiative (FAA Safety Management System Initiative). Accessed August 15, 2017. The order applies to the Air Traffic Organization (ATO), Aviation Safety Organization (AVS), Office of Airports (ARP), Office of Commercial Space Transportation (AST), the Office of the Next Generation Air Transportation System (ANG), and the Hazardous Materials Safety Program Office in the Office of Security and Hazardous Materials Safety (ASH).

NTSB Railroad Accident Report

32 of safety risk.” Further, “an SMS is a structured process that obligates organizations to manage safety with the same level of priority that other core business processes are managed.” Safety culture and SMS programs are interconnected: A safety culture is the manifestation of the internalization of the SMS on the part of the employees that make up the organization. The SMS should take account of and shape the safety culture of the organization. Effective SMS instill and reinforce a safety culture among employees, and that safety culture ensures the effective implementation of the policies, principles, and practices set forth by the management system.35 SMS programs have four functional characteristics: • Corporate policies and procedures for safety and safe operations. All SMS programs must define policies, procedures, and organizational structures to accomplish their goals. The policies and procedures must emanate from the top of the organization with clear support and expectations for compliance throughout all lower corporate levels. The corporate policies and procedures must align and implement senior management’s vision for safety throughout the business operations. • Safety assurance controls that serve as checks and balances for the implementation of safety policies and practices and also as a feedback mechanism to inform management about the effectiveness of the safety programs. These controls must be applied continuously and respected throughout the organization’s operations, and employees must be encouraged to respect and work with the controls, even in changing work environments. • Risk management is a formal system of hazard identification, analysis, and mitigation. It is an essential component of work project planning, and it should be performed for each job and for all work crews working in or for the corporation. Risk management techniques vary and, therefore, can be tailored to fit all jobs. The purpose of risk management is to inform workers about safety hazards and to provide sufficient insights to control risks to acceptable levels. • Safety promotion. The safety policies, practices, and techniques of a safety culture will not influence the actions and decision-making of workers without management’s guidance and support of compliance. The purpose of safety promotion is to convey to all workers that safety is a core value of the organization, which has established practices that support safety and in which management participates.

35 2011. Implementing Safety Management System Principles in Rail Transit Agencies (https://www.transit.dot.gov/regulations-and-guidance/safety/safety-management-systems-sms). Accessed August 22, 2017.

NTSB Railroad Accident Report

33 1.16.1 Amtrak Safety Management NTSB investigators examined the first-line safety supervision at the Chester work site in relation to the unsafe practices found, which led to interviews with senior management personnel to learn about and understand Amtrak’s safety program and safety management and how they affect roadway workers and train-operating employees. Investigators also interviewed senior managers of the unions that represented the roadway workers involved in the accident. The interviews included safety policies, procedures, and assurances; the collection of safety-critical information; risk management strategies; and promotion. Additional safety topics discussed include safety oversight, corporate safety knowledge and vision, and reliance on rule compliance. At the time of the accident, Amtrak had a system safety program (SSP) in place. Amtrak’s SSPP defines “system safety,” as follows: Amtrak defines system safety as a detailed method of applying scientific, technical, operating, and management techniques and principles for the timely identification of hazard risk and initiation of actions to prevent or control these hazards throughout the system life cycle and within the constraints of operational effectiveness, time, and cost. The system to which the SSP applies is Amtrak and all of its organizational and physical components, people, procedures, facilities, and equipment. The Amtrak safety policy contained in the SSPP states the following: To be safer, Amtrak will use behavioral safety principles in developing and implementing safety risk reduction programs. The Safe-2-Safer Program and the SSPP will guide prevention efforts by identifying the policies, programs, and strategies that promote a safe work environment for employees and travelers alike. Safety principles are used to integrate safety into all phases of our business including design, construction, modification and rehabilitation, operation, maintenance, and procurement, and that we reduce risk and eliminate, to the extent possible, potentially hazardous activities and conditions. Amtrak’s safety and occupational health goals can be achieved through a responsive, coordinated safety and risk management effort using the Safe-2-Safer process. We commit to: • Working with all employees to identify safety risks …. According to Amtrak’s deputy chief safety officer, the SSPP was initiated in 2006 and “was developed in accordance with the American Public Transportation Association standards, which are volunteer consensus elements.”36 In general, Amtrak’s SMS programs, including the implementation of the strategies described in the SSPP, were described as “evolving.” In addition

36 There is no federal requirement for Amtrak to have an SSPP.

NTSB Railroad Accident Report

34 to the Safe-2-Safer Program, Amtrak had enacted two other safety programs: a close call reporting system and the Safety Liaison Program. Safe-2-Safer was a peer-to-peer program intended to drive behavior-based safety. The program relied on employees to provide feedback to their peers to encourage them to engage in safer behaviors. Amtrak’s management intended Safe-2-Safer to be a nonthreatening and confidential program for collecting safety-related information. Amtrak adopted the FRA’s Confidential Close-Call Reporting System―C3RS—and anticipated collecting safety-critical information through it.37 The FRA C3RS website provides this description of the system: A[n] FRA sponsored voluntary confidential program allowing railroad carriers and their employees to report close calls. The program provides a safe environment for employees to report unsafe events and conditions. Employees receive protection from discipline and FRA enforcement. Railroads also receive protection from FRA enforcement for events reported within C3RS. The Safety Liaison Program relied on experienced labor personnel to visit work sites randomly to assess the safety of work activities. The safety liaisons were Amtrak employees who were given the authority to challenge workers when they observed unsafe acts and who were expected to counsel workers on proper, safe work techniques. Amtrak’s Safety Division managers told NTSB investigators that because the safety liaisons were experienced in their trades, the workers likely would respect and accept their safety advice more readily than they would if the same advice were formalized in rules. However, Amtrak safety managers said that the Safety Liaison Program started about 3 1/2 years ago, was understaffed, and at the time of the accident many of its tools and procedures for observing and tracking safety issues had not been implemented throughout the company. NTSB investigators determined that no safety liaisons were present at the work site on the day of the accident. Investigators also learned that all the unions that represented the roadway workers involved in the accident had opted out of Amtrak’s Safe-2-Safer program and the C3RS program during their respective labor-management contract negotiations. The union representatives told investigators that the work environment was hostile and made it difficult for workers to perform their jobs safely and to provide peer-to-peer protection for their colleagues, because Amtrak had instituted a “Cardinal Rules” program that could lead to workers’ being fired for a single violation. (See figure 12.)

37 FRA C3RS website (http://www.fra.dot.gov/c3rs). Accessed September 25, 2017.

NTSB Railroad Accident Report

35

Figure 12. Amtrak’s 10 Cardinal Rules.

NTSB Railroad Accident Report

36 The general chairman of the Brotherhood of Maintenance of Way Employes Division (BMWED) expressed frustration with Amtrak’s Cardinal Rules, which he suggested led to employees’ being terminated for minor violations. He said― I can think of 8 or 10 people right now that were fired for minor violations of RWP rules, that probably, in my opinion, should not have been fired. … one guy was fired because he got out of a truck on a, basically a dead track, where the grass is this high, and [he] didn’t get RWP protection. A train hasn’t been on that track for 25 years. The BMWED general chairman added that the fear of being fired “sends terror into every man’s thought and family, when you’re without that income….” The BMWED general chairman indicated that the revocation of an existing close-call policy, and the implementation of the Cardinal Rules, resulted in vital safety information not being reported. He said that “engineers were reluctant sometimes to report close calls with track gangs, because they didn’t want to involve the track gang in discipline.” Other union leaders expressed similar concerns. For instance, the general chairman of the Brotherhood of Railroad Signalmen (BRS) described a culture of fear at Amtrak: “There’s no dialogue … it’s fear. I mean you talk to the managers, they’re afraid. And you can talk to the youngest guy. It’s fear.” The BRS chairman expressed concern that Amtrak threatened to fire employees for not following fall protection protocol, but failed to provide the necessary policy and resources to follow the protocol. A representative for the American Railway and Airway Supervisors Association (ARASA) union indicated that Safe-2-Safer was “nothing but a program that drove down safety statistics,” and that “nobody believed in the program, but if you spoke against [it], especially managers, they were deathly afraid to say anything because their superiors would take action against them.” He said, “This company is driven by fear.” The ARASA representative indicated that there were situations in which employees “reported track conditions that there should have been speed restrictions on, they were pressured into either overlooking it, or changing their reports.” The ARASA representative also expressed concern over training, saying, “we have no training other than the Safe-2-Safer Program, that was basically pushed on us, and then never followed through.” He indicated that the classroom training was insufficient, and that the instructors lacked experience and could not effectively elaborate on classroom materials. He voiced concern that feedback from the field was not being incorporated into classroom training appropriately. The BMWE chairman also expressed concern over the training, indicating that the training instructors at one point were teaching an incorrect way to use SSDs. Investigators reviewed Amtrak records pertaining to the Cardinal Rules to evaluate the extent to which the union representatives’ concerns were consistent with objective data. Amtrak records indicated that the Cardinal Rules were enforced across the entire Amtrak system. In 2016, employees had been terminated in Berlin, Connecticut; Chicago; New York; Denver; Philadelphia; Wilmington, Delaware; and Newark, New Jersey. Investigators confirmed that multiple employees had been terminated for failing to establish RWP. In addition, Amtrak had considered terminating

NTSB Railroad Accident Report

37 an employee for failing to use fall protection but decided not to because the “employee [was] not trained on fall protection, and did not understand [the] requirements.” Investigators spoke with Amtrak management to obtain additional information about the Cardinal Rules. Amtrak’s chief operations officer indicated that “every single Cardinal Rule violation goes to a group that looks at the mitigating circumstances, and that group decides what the discipline is going to be, and there’s a progressive discipline process.” The chief operations officer later added that “The perception is, wrongfully so, and I think communication, again, could have been better, that you violate one of these rules, you’re terminated. Nothing could be further from the truth.” Additionally, the chief safety officer provided information about the enforcement of the Cardinal Rules, indicating that the repercussions an employee experienced for violating a Cardinal Rule varied depending on who discovered the violation. That is, if a safety liaison discovered a Cardinal Rule violation, the employee would be counseled, but not reprimanded. However, if a supervisor discovered a Cardinal Rule violation, the incident would be reported to management, who would review the violation and consider termination of the employee. Amtrak’s chief operating officer did not acknowledge the unions’ concerns with the Cardinal Rules and said that he did not understand their position. The disagreement between Amtrak and its unions over Amtrak’s safety programs became a labor-management contract negotiating issue, putting roadway workers at risk every day. Amtrak acknowledged an awareness of the unions’ refusal to participate in its Safe-2-Safer and close-call reporting programs yet continued to conduct its public transportation business without openly disclosing and proactively promoting resolutions to these safety shortcomings. Investigators interviewed Amtrak senior executives and division heads to further examine safety management practices and efforts to improve safety management throughout the company. The managers had a variety of attitudes about best safety practices. Some managers showed little interest or concern about safety beyond the demands of their immediate job responsibilities, others expressed awareness of safety principles but lacked detailed knowledge of them or experience in applying them, and a few managers enthusiastically espoused their use of well-established and contemporary safety management techniques in performing their jobs. In particular, there appeared to be a gap in Amtrak’s safety training. The Amtrak director of training indicated that there was no field auditing process to evaluate the effectiveness of the classroom training that Amtrak foremen received. Thus, Amtrak could confirm that the workers involved in the accident had probably viewed a presentation pertaining to the use of SSDs. However, Amtrak could not confirm whether this presentation had sufficiently prepared the workers to consistently apply the safety devices in the field. Also, the director of operating practices recognized the fallibility of human performance (that is, humans do not perform error free 100 percent of the time) yet failed to acknowledge the inherent risks associated with train dispatchers initiating passenger train movements based solely on verbal communications that tracks are clear. He would not accept a proposal that train dispatchers can trust the safety-critical information communicated by track foremen, but they must verify that information through follow-up questions. Instead, he strongly relied on old railroad industry adages, such as foremen

NTSB Railroad Accident Report

38 must follow the rules (report only when tracks are clear), and train dispatchers do not need to slow passenger trains through construction zones because there is no rule that requires it. The senior manager of heavy construction (production programs) demonstrated his awareness and knowledge of safety practices by requiring his staff to prepare detailed SSWPs. The chief operating officer and the deputy chief safety officer were able to discuss system safety concepts in detail and conveyed clear visions to improve Amtrak’s safety culture through contemporary system safety strategies. Although the Amtrak managers had disparate views of safety management, they shared one common perspective: workers must follow the rules to remain safe. This was evident in interviews with employees throughout all levels of Amtrak’s management. Amtrak’s reliance on rule compliance, for instance, was highlighted in an interview with Amtrak’s chief safety officer pertaining to construction zones: Question: Do construction zones present any unique challenges from your point of view as chief safety officer? Answer: Not if you follow the rules. You follow the rules, you follow the procedures out there. The rules, there are rules in place that allow the safe passage of trains. It’s when you don’t follow the rules that you get yourself in trouble. Obviously, Amtrak is a high-speed railroad, if you will. They do a lot of their work at nighttime. But nonetheless, if you follow the rules and procedures, I don’t see it as much of an issue. A second example of Amtrak’s reliance on rule compliance is evident in a discussion with Amtrak’s director of operating practices: Question: We know rules probably can’t be written to cover every scenario that’s experienced out on the road. We know that people can’t be relied upon as 100 percent rule followers. Is there a take-away from that that may help Amtrak make some improvements beyond what the NTSB recommends? Answer: I would take exception to your statement that we can’t depend on people to be 100 percent rule followers. Every employee’s life depends on each and every other employee following the rules. As soon as one employee fails to follow the rules, it puts another employee or the riding public in jeopardy and that’s unacceptable. Many similar conversations unfolded as investigators spoke with Amtrak managers about their approach to managing safety.38 The NTSB recognizes that rules and procedures are an essential element of transportation operations. Rules can be viewed as a ‘soft’ safety defense. James Reason (1997, p. 8) stated the following: ‘Soft’ defenses, as the term applies rely heavily upon a combination of paper and people: legislation, regulatory surveillance, rules and procedures, training, drills

38 Transcripts of these interviews are available in the NTSB’s public docket for this accident.

NTSB Railroad Accident Report

39 and briefings, administrative controls (for example, permit-to-work systems and shift handovers), licensing, certification, supervisory oversight and—most critically—front-line operators, particularly in highly automated control systems. Also— ‘Hard’ defenses include such technical devices as automated engineered safety features, physical barriers, alarms and annunciators, interlocks, keys, personal protective equipment, non-destructive testing, designed-in structural weaknesses (for example, fuse pins on aircraft engine pylons) and improved system design. Rules and procedures can provide a layer of protection, but they do not constitute all the layers of protection that would be expected in a safe system. (Reason 1997, p. 7) Safety experts (for example, Reason 1997, pp. 49–51) do not support the notion that a focus on rules compliance can completely assure safety. 1.16.2 Federal Railroad Administration Role in Safety Management Systems The FRA has introduced, but has not yet enacted, an SMS regulation for the intercity and commuter passenger railroads the FRA regulates. In 2012, the FRA published an NPRM that included a draft of 49 CFR, Part 270, System Safety Program. (Federal Register 2012, 55372) The FRA published the final rule on August 12, 2016. (Federal Register 2016, 53850) The regulation required intercity and commuter passenger railroads to provide a formal plan to implement key aspects of SMS, including risk management strategies. The FRA indicated that “an SSP provides a railroad with the tools to systematically and continuously evaluate its system to identify hazards and the resulting risks gaps in safety and to mitigate or eliminate these hazards and risks.” Although the effective date of the regulation initially was October 11, 2016, the regulation has been stayed four times. Most recently, the FRA published a stay of the regulation effective June 2, 2017, until December 4, 2017. (Federal Register 2017, 26359)

NTSB Railroad Accident Report

40 2 Postaccident Actions 2.1 Amtrak Amtrak took immediate actions following this accident including creating a series of Rules Alerts pertaining to specific rules associated with the accident: • Protocols for fouling a track: Actions taken before fouling, the use of SSDs, actions taken before returning a track to service • Communication of mandatory directives: radio use is primary; telephone use is permitted in the event of a radio failure Amtrak also issued a system-wide safety alert and conducted a safety stand-down that addressed the scenario of the accident and Amtrak’s commitment to safety and the standards of excellence; explained the need for effective job briefings, communications, good faith challenge provisions, the good faith challenge process; and FAMES committee guidance; and the use of SSDs.39 Since the accident, Amtrak also has completed the following: • Issued a bulletin clarifying and reiterating the protocols for fouling including a supplement to the Roadway Worker Protection manual regarding SSD instructions. • Created an independent compliance group outside the engineering department that is composed of a director and four compliance officers augmented by contract support. The group reports to the senior vice president for operations with its initial focus on evaluating compliance with RWP regulations and making recommendations to improve compliance. • Revised its drug and alcohol policy to (1) accommodate changes in regulations (MOW employee testing) and (2) “strengthen the disciplinary consequences of violating the drug and alcohol policy.”40 • Created a shift transfer form for use by foremen to document critical protection information in extended outages. Amtrak finalized the form on September 16, 2017, and is developing training and the communication process for the form. Also since the accident, Amtrak has been working on the following efforts to improve safety:

39 (a) FAMES is an acronym for the Fatality Analysis of Maintenance-of-way Employees and Signalmen Committee, which is an ad hoc committee to review roadway worker fatalities that was formed by the FRA in collaboration with railroad labor and management representatives. (b) Safety Alert. 40 A MOW employee does MOW work and is called a roadway worker in this report.

NTSB Railroad Accident Report

41 • Enhanced Employee Protection System: Amtrak is working with Rockwell-Collins to enhance its dispatch system to provide redundant protection for fouling activities. This project is capital funded and will be completed by January 2018. • Prototype Supplemental Shunting Device: Amtrak is working with an equipment supplier to develop a supplemental shunting device with light-emitting diode (LED) indication. • Supplemental Shunting Device Storage: Amtrak is outfitting all roadway equipment with a dedicated box to store SSDs. A predeparture inspection form on each vehicle will include a question asking if SSDs are in the storage box on the vehicle. • To enhance organizational alignment, Amtrak indicated plans to expand its efficiency testing program. Roadway Worker Joint Efficiency Testing: Amtrak is working in collaboration with the FRA to conduct joint efficiency testing. Actions to date include the following: ‒ Creation of a Form O to capture other workgroups working within the authority of a roadway worker in charge. ‒ Clarifying with conductor flagmen how to communicate their methods of protection properly. The term “Foul Time” now refers to any track authority. ‒ Clarifying with large production gangs the proper procedure for assigning a sole roadway worker in charge. Multiple subgroups work under one very long Form D/Track Out-of-Service authority. • System-wide 24/7 Site Visits: Amtrak is developing a process for targeted monitoring of FRA inspection data, TESTS observation data, ongoing systematic use of outward-facing video cameras on locomotives, and electronic communications for train dispatchers. • Roadway Worker Protection: Amtrak will perform a third-party review of its Roadway Worker Protection Manual for readability and comprehension. Following the review, the manual will be revised as necessary and incorporate the FRA regulatory change resulting from this accident. In addition, Amtrak will assess the current initial and recurrent RWP. Another Amtrak initiative is to review equipment training to determine whether additional modifications pertaining to RWP provisions are necessary. • Amtrak prepared and distributed a document, [Amtrak] Post Incident Action Update June 2017, to communicate its actions resulting from the Chester accident. As detailed above, the document described changes that Amtrak made to communications, training, drug and alcohol prevention programs, organizational alignment, and engineering improvements. 2.2 Federal Railroad Administration In response to this accident, the FRA initiated a number of civil penalty actions against Amtrak for its engineering and operating practices. Additionally, the FRA investigated Amtrak’s compliance with 49 CFR Part 272, Critical Incident Plans. The FRA also directed Amtrak to

NTSB Railroad Accident Report

42 conduct a safety stand-down with all Amtrak roadway workers to review safety procedures and compliant safety briefings. Amtrak had begun the stand-down before the FRA directed Amtrak to conduct one. In 2016, the FRA issued two final rules to improve the protection of railroad employees working on or near railroad tracks. The first was a final rule: 49 CFR Part 214, Railroad Workplace Safety, Roadway Worker Protection Miscellaneous Provisions.41 On June 12, 2016, the FRA published amendments to its Roadway Worker Protection regulations at 49 CFR Part 214. The amendments to Part 214.19 required redundant protection for roadway workers who depend on train dispatchers to provide protection in signaled territories. The final Roadway Worker Protection rule became effective April 21, 2017. The second rule addressed another safety issue identified in this accident: the use of potentially impairing substances by MOW workers. This rule, Control of Alcohol and Drug Use, first issued on May 25, 2016, revised the FRA’s existing alcohol and drug testing regulations and expanded the requirements to cover MOW employees. On June 12, 2016, the FRA published amendments specifically including random drug screening for MOW employees. This was implemented on June 12, 2017, after this accident. The rule partially fulfilled NTSB Safety Recommendation R-08-07 that stemmed from an accident where a Massachusetts Bay Transportation Authority passenger train struck a track maintenance vehicle in Woburn, Massachusetts. (NTSB 2008) In that accident, the fatally injured track foreman tested positive for marijuana. Safety Recommendation R-08-07 recommended that the FRA include “all employees and agents performing safety-sensitive functions” in the mandated drug and alcohol testing program; the Control of Alcohol and Drug Use rule covers only MOW employees, not all of those performing safety-sensitive functions. As a result, this recommendation is currently classified “Open―Unacceptable Response.” However, the backhoe operator’s use of cocaine and the maintenance supervisor’s use of codeine and morphine (both MOW employees) in this accident could have been detected and addressed through the now mandated drug and alcohol screening program. In addition, the FRA and the NTSB held a joint meeting with the senior leadership of the Class I and commuter railroads on September 1, 2016, regarding concerns about increasing rates of positive postaccident drug testing results in rail (FRA/NTSB Drug and Alcohol Forum). This was a closed meeting to give industry an opportunity to understand the scope of the problem and to share best practices with each other. On June 12, 2016, the FRA published amendments to its RWP regulations at 49 CFR Part 214 and its drug and alcohol regulations at 49 CFR Part 219. The amendments to Part 214 required redundant protection for roadway workers who depend on train dispatchers to provide protection in signaled territories. The amendments to Part 219 added roadway employees to the drug and alcohol testing program. Specifically, random drug screening for MOW employees was added to the drug and alcohol testing program and implemented June 12, 2017.

41 The miscellaneous provisions final rule included regulatory language to address redundant signal protection recommended in Safety Recommendation R-08-06.

NTSB Railroad Accident Report

43 FRA Regions 1 and 2 completed a Corridor On-Track Safety Initiative consisting of five inspection teams that conducted the equivalent of 59 days of field inspections on the Amtrak NEC.42 This project ran from April 25, 2016, through May 20, 2016. The teams inspected 120 work groups totaling more than 1,000 roadway worker contacts (some roadway workers were contacted more than once). In addition to the field inspections, the FRA monitored several dispatching centers. Beginning July 18, 2016, FRA Regions 1 and 2, in cooperation with Amtrak, initiated an Amtrak Roadway Joint Efficiency Testing (ARJET) project. This effort was intended to ensure a consistent understanding and application of RWP rules, railroad operating rules, and railroad safety rules. The FRA inspectors granted “safe haven” to Amtrak (withheld violations) following the FRA’s Safe Harbor policy, whereby the FRA would not use enforcement against Amtrak during these inspections as long as the Amtrak manager took proper corrective action. According to the FRA, the goal of this effort was to perform joint inspections of roadway workers throughout the NEC and branch lines. Inspections covered every shift and every work team possible to look for proper application of roadway worker safety and operating rules. This project was completed at the end of December 2016. The FRA stated that Amtrak management at all levels had been fully cooperative and proactive during this effort. Regions 1 and 2 have reallocated significant resources toward Amtrak activities. In 2015, Region 2 allocated and filled an additional full-time inspector position. This track inspector has an assigned territory largely consisting of the NEC. Two audits of Amtrak’s TESTS program conducted in February 2016 by the FRA in Regions 1 and 7 revealed numerous deficiencies and several areas of concern with respect to Amtrak’s implementation of its TESTS program.43 On March 9, 2016, Amtrak submitted a corrective action plan for the FRA’s review and comment. On March 29, 2016, FRA representatives met with ranking Amtrak operating officers to discuss and determine an appropriate corrective action. As a result of that meeting, Amtrak on April 7, 2016, submitted a revised corrective action plan that addressed the FRA’s concerns. That plan was scheduled for implementation on or before May 15, 2016, and Amtrak has implemented the plan. The corrective action plan addresses several key areas related to Amtrak’s TESTS program including application modifications, training, tracking, rule violation followup, testing officer accountability, foreign crew observations, and enhanced oversight. According to the FRA, Amtrak has revised training, rules, and standard operating practices based on the FRA’s findings. Amtrak employees now use SSDs as intended, and Amtrak changed training, reconciled rules, and revised RWP manuals to include instructions for using SSDs.

42 FRA Region 1 consists of Maine, New Hampshire, Massachusetts, Vermont, New York, Rhode Island, Connecticut, and New Jersey. Region 2 consists of Pennsylvania; Delaware; Maryland; Washington, DC; Virginia; West Virginia; and Ohio. 43 FRA Region 7 consists of California, Nevada, Utah, and Arizona.

NTSB Railroad Accident Report

44 3 Analysis 3.1 Exclusions NTSB reviewed the signal system data logs, which indicated that the signals were functioning properly at the time of the accident. Review of the forward-facing video from the Amtrak locomotive determined that the signals were Clear (proceed). Interviews with the train crew and postaccident mechanical inspections indicated that the equipment was operating as designed on the day of the accident. Therefore, the NTSB concludes that the track structure, signals, and mechanical equipment did not contribute to the accident. 3.2 Toxicology and Medical Information The postaccident toxicology findings for the backhoe operator and the supervisor were positive, while the surviving roadway workers (including the night and day foremen, the assistant nighttime supervisor, and the watchmen) as well as the dispatcher had negative urine test findings. For the Amtrak train crew, the Amtrak postaccident toxicology tests and the FRA-mandated tests for the engineer were positive; but the conductor’s and the assistant conductors’ test findings were negative. The implications of the positive toxicological findings for the roadway workers and the engineer in this accident are discussed below. 3.2.1 Backhoe Operator The backhoe operator’s actions did not contribute to the circumstances of this accident but toxicology testing identified his use of cocaine and gabapentin (a potentially impairing prescription medication) as well as blood pressure medications. Current US Department of Transportation (DOT) random testing can identify urinary metabolites of cocaine but does not test for gabapentin or many other potentially impairing prescription, over the counter, and illicit drugs. 3.2.2 Track Supervisor. At the time of the accident, the track supervisor was working, rather than performing his supervisory and safety duties, and had not stopped work and challenged the day foreman when he did not provide a safety briefing. His toxicological testing was positive for codeine, morphine, and oxycodone. However, the detected drug levels may not have been indicative of preaccident levels because of postmortem redistribution, and although opioid drugs may be impairing, users can become tolerant of the impairing effects. This means there is no direct way to relate levels and impairment. As a result, the NTSB was unable to determine whether the track supervisor’s actions were the result of the effects of his use of opioids. Therefore, the NTSB concludes that the track supervisor had used two different opioids at some point before the accident, but based on behavioral evidence, drug-induced impairment of his job performance could not be determined.

NTSB Railroad Accident Report

45 3.2.3 Locomotive Engineer Train 89’s last stop before the accident was Philadelphia’s 30th Street Station, which the train departed at 07:38:30. During about 11 minutes between the train’s departing Philadelphia and the accident, the video from the locomotive’s inward-facing video showed the engineer seated in the engineer’s seat performing routine train operations, with the train speed at or near track speed, which was 110 mph. After the engineer saw the backhoe on track 3 ahead of him, he began a series of horn blasts and made an immediate emergency brake application. In apparent anticipation of the impact with the backhoe, he knelt on the floor while continuing to sound the horn until, just before the collision, he lay down on the floor. Because the engineer’s train was on the same track as the backhoe, there were no other maneuvers he could have taken to prevent the accident or lessen its severity. Therefore, the NTSB concludes that the Amtrak engineer took timely and appropriate actions to stop the train and to warn the roadway workers about the train approaching their work area. Although the Amtrak train engineer responded appropriately to the impending collision, postaccident toxicology testing detected 2.2 ng/ml of THC (the primary impairing compound in marijuana) and 16.1 ng/ml of THC-COOH (THC’s inactive metabolite) in blood collected 5 hours after the accident. These results indicate he had used marijuana at some point before the accident. However, calculation of the exact THC level in the engineer’s blood at the time of the crash is not possible. In addition, the relationship between drug concentrations found in toxicological tests and degraded or impaired behavior is complex and depends on the mode of use of marijuana (eaten versus smoked), the amount (dose) used, and the frequency of use. As a result, whether the engineer was experiencing any effects from his marijuana use at the time of the accident could not be determined. However, marijuana use of any type (prescribed or recreational) is expressly forbidden for use by transportation operators subject to DOT-mandated drug testing.44 The NTSB therefore concludes that although there was no operational evidence of impaired performance by the engineer, his use of marijuana was illicit and had not been deterred by his participation in the DOT drug testing program, and any previous marijuana use had not been detected by random drug testing. 3.2.4 Drugs in the Workforce The toxicological test findings in this accident are very disconcerting to the NTSB—three of the employees involved tested positive for drug usage. The presence of metabolites of codeine and morphine in the backhoe operator, cocaine in the supervisor, and THC in the engineer could have been found during random DOT urine drug testing. These employees performed regular job duties that directly affected the safety of the traveling public, as well as the welfare of their work colleagues. The NTSB believes that employees, especially those in safety-sensitive positions, should be drug- and alcohol-free while on duty, and that employers should enforce a zero-tolerance policy for illicit use of misuse of potentially impairing drugs and alcohol as a tenet of their safety

44 (a) DOT Office Of Drug And Alcohol Policy And Compliance Notice, Medical Marijuana. (2009) (https://cms.dot.gov/sites/dot.gov/files/images/ODAPC%20Medical%20Marijuana%20Notice.pdf). Accessed October 27, 2017. (b) US Department of Transportation. DOT “Recreational Marijuana” Notice. (2012) (https://www.transportation.gov/odapc/dot-recreational-marijuana-notice). Accessed October 27, 2017.

NTSB Railroad Accident Report

46 management programs. Indeed, the presence of employees on duty who might be unable to pass a DOT urine drug test is a marker of Amtrak’s ineffective safety culture. The NTSB concludes that Amtrak did not effectively assure that its employees, especially those in safety-sensitive positions, were drug-free while performing their public transportation duties. Since the accident, the FRA implemented rulemaking that became effective in June 12, 2017, requiring DOT random urine drug screening for MOW employees. The NTSB concludes that had the two roadway workers used cocaine, codeine, or morphine with some regularity, been subject to random urine drug screening, and been selected for testing, their use of cocaine, codeine, or morphine may have been detected before the accident. According to the Substance Abuse and Mental Health Services Administration, “Drug testing is a prevention and deterrent method that is often part of a comprehensive drug-free workplace program,” and “random tests are the most effective for deterring illicit drug use.” Before the accident, MOW employees participated in a drug testing program where the date and time of the test was known to the employee ahead of time. These were preemployment, return to duty, and postaccident drug testing, and the results of their periodic testing were negative. The NTSB concludes that the absence of a random drug testing program for MOW employees at the time of the accident meant there was no effective program to deter the MOW employees from using drugs. The use of marijuana by the engineer, who was subject to random testing (that tested for marijuana), demonstrates that the deterrent effect of random testing is not 100 percent. Nonetheless, the NTSB also concludes that the participation of the two roadway workers in the pool for random testing might have deterred them from using cocaine and opiates. 3.3 Survival Factors Train 89 struck the backhoe at 99 mph. After the initial impact, parts of the backhoe struck the right side of the train, causing a disruption to the occupied passenger space. The NTSB investigated another Amtrak accident that damaged the side wall of a passenger car. A grade crossing accident demonstrated the need for improved side impact standards. On June 24, 2011, a 2008 Peterbilt truck-tractor failed to stop and struck the left side of Amtrak train no. 5, which was passing through a grade crossing. (NTSB 2012) The collision destroyed the truck-tractor and two passenger railcars. The train came to a stop without derailing; however, a fire ensued, engulfing two railcars and damaging a third railcar. The accident killed the truck driver, the train conductor, and 4 train passengers; 15 train passengers and 1 crewmember were injured. The NTSB determined that insufficient passenger railcar side impact strength contributed to the number of fatalities and the severity of injuries. As a result, the NTSB issued the following safety recommendation to the FRA: R-12-39 Develop side impact crashworthiness standards (including performance validation) for passenger railcars that provide a measurable improvement compared to the current regulation for minimizing encroachment to and loss of railcar occupant survival space. In response, the FRA reported that it was directing the Volpe Center to conduct simulations of passenger cars undergoing significant side impacts with increasing side strengths to determine

NTSB Railroad Accident Report

47 the adequacy of the current designs and the predictable safety implications of increasing the side strength. The FRA stated that Volpe’s findings may provide a basis for new regulations specifically addressing side impact crashworthiness. As of the date of this report, the recommendation is classified “Open—Acceptable Response.” 3.4 Foremen’s Shift Transfer The night foreman and the day foreman had a discussion at 7:27 a.m. on the day of the accident. They discussed the ongoing work and the protection in place at the time. The day foreman had obtained a Form D for Track 2 before discussing the shift transfer with the night foreman.45 The night foreman believed that he had reached an agreement with the day foreman; he was going to cancel his fouls and his Form D, and then the day foreman was going to immediately call the dispatcher and obtain the fouls. Thus, the workers, who were actively engaged in track work at the time, with a backhoe positioned on track 3, would be subject to a minimum amount of disruption in their work. Amtrak’s procedure to transfer fouls was cumbersome, because it would have required both foremen to stop the track work and remove the backhoe. Thus, the shortcut (release of fouls followed by the request and approval of those fouls) would allow them to quickly finish the transfer process. In his interview, the night foreman appeared to suggest that this was a common shortcut, describing the rule-violating transfer procedure as “just like it’s always done.” The night foreman’s actions after his conversation with the day foreman were consistent with the shortcut described above. That is, he called the dispatcher and canceled his fouls (and his Form D) and told the dispatcher that the day foreman would be picking up his fouls. According to the night foreman, he then reengaged the day foreman and suggested that he call the dispatcher, and drove away from the job site. The day foreman did not call the dispatcher to obtain fouls at any point on the morning of the accident.46 The day foreman’s inaction appears surprising considering the night foreman’s statement that he told the day foreman to pick up the fouls and the day foreman said, “I got it.” But the day foreman told investigators that during his job transfer conversation with the night foreman, “All I told him was when you are clear of all your fouls, don’t bother getting any more fouls ….” The day foreman told investigators that he expected the night foreman to remain at the worksite and clear the workers and equipment from the tracks before giving up his foul time and departing. He also said that he did not pay attention to what the night foreman was doing, and that he “assumed everything was still fouled.” However, the day foreman circulated a job briefing sheet indicating that he was the EIC and had secured foul time to protect the employees and equipment (backhoe). Amtrak training stipulated that only one employee can be the EIC, and FRA regulations state that only one employee be assigned as EIC. Accordingly, the day foreman’s account of the incident is neither consistent nor compliant with Amtrak’s training or FRA regulations. Therefore,

45 Two foremen can hold Form Ds for a track simultaneously but cannot hold foul time simultaneously. 46 The day foreman did call the dispatcher, before he arrived at the work site, to obtain a Form D for track 2 that the RailVac was occupying.

NTSB Railroad Accident Report

48 the NTSB concludes that the result of the night foreman’s actions and the day foreman’s inactions based on their conversation was that tracks 1, 3, and 4 were not protected with foul time from about 7:30 a.m. until 7:50 a.m. when the accident occurred. After their conversation, the day foreman went to the job site and began interacting with several of the workers. The watchman and the RailVac superintendent reported that the day foreman told them that the tracks were protected with fouls, although a job briefing was not provided. At one point (between 7:30 a.m. and 7:50 a.m.), the day foreman asked the RailVac superintendent to initiate work, and the RailVac superintendent responded that he would not without a job briefing. The day foreman had the RailVac superintendent sign a job briefing form, although he failed to provide a job briefing. The day foreman was in the cab of the RailVac when the accident occurred at 7:50 a.m. He told investigators he intended to complete the foul time log eventually while he was in the cab. Thus, the day foreman’s actions and statements in his interviews suggest that he felt no urgency to call the dispatcher to obtain foul protections. There is no evidence verifying that the day foreman thought that the job site was still protected by the night foreman’s fouls or that he forgot to call the dispatcher while he was working. Several factors likely affected the way the night and day foremen conducted the shift handoff: • Amtrak did not have an efficient procedure for transferring fouls. The Amtrak rules required the night foreman to stop the work being performed and clear the track of workers and equipment—moving the backhoe and the workers on track 3 into the wayside—before releasing his fouls. In compliance with Amtrak rules, the day foreman could then request foul time and, when foul time had been granted, the day foreman could return the backhoe and workers to track 3. This procedure, which includes stopping and starting the work and moving workers and equipment, is inefficient and slows the work. • The night foreman described to investigators a procedure that required less time than complying with the Amtrak rule: first the night foreman releases his fouls without removing the backhoe and workers from track 3, and immediately afterward the day foreman requests fouls on track 3. The night foreman said that this “shortcut” procedure was “just like it’s always done.” • According to the watchman, the night foreman was ready to go home after his shift, and the day foreman arrived late at the job site. The shortcut procedure allowed the foremen to conduct the shift transfer quickly, and it caused minimal disruption to the ongoing ballast-vacuuming work. • The day foreman had 36 years of experience, and the night foreman had been a foreman for 4 months. And, the two foremen had not conducted a shift change before. Thus, a lack of rapport may have contributed to their failure to execute the shortcut procedure. • Before the accident in the morning, the supervisor was actively engaged in labor and not participating in or overseeing the shift transfer. Thus, there was no third party to verify that the job transfer process was unfolding as intended.

NTSB Railroad Accident Report

49 Amtrak’s director of operating practices provided information about the foremen’s actions, their options during the shift transfer, and avenues for potential safety improvements (increasing the safety layering and diminishing single points of failure). Amtrak did not have a procedure for two foremen to jointly transfer their fouls with the train dispatcher when their shifts change. Such a procedure would be one in which the fouls would not be released but kept in force with the relieving foreman responsible for those fouls. The director of operating practices indicated that a process that allowed foremen to communicate with a train dispatcher to jointly transfer their fouls with a train dispatcher’s knowledge and approval could be designed and implemented to be safe. The NTSB believes that the absence of a procedure allowing foremen to transfer foul time with the oversight of the train dispatcher increases the opportunity for a single point failure by one or both of the foremen. According to Reason (2016, p. 33), “Good procedures should tell people the most efficient and safest way of carrying out a particular task. It should be noted that clumsy procedures are among the main causes of human violations.” Planning engineering work on the NEC is hazardous because the number of train movements and the speeds at which trains operate too often prove to be so unforgiving that the need for every safety layer is critical; there is no room for error, and single points of failure must be eliminated. Good communication is especially important during transfers between shifts. The NTSB concludes that had the two foremen communicated with the train dispatcher jointly about the transfer of fouls from one foreman to the other, it is likely that on-track safety and protection would not have lapsed and the accident would not have happened. A procedure that allows foremen to transfer their fouls jointly with the train dispatcher could avoid the loss of track protection. Therefore, the NTSB recommends that Amtrak establish a method to ensure that on-track protection in an active work zone is not lost during shift transfer. 3.5 Positive Train Control Amtrak had installed PTC on the track territory where this accident occurred. The PTC system functioned as designed, but human activities before the accident rendered it useless for preventing the train incursion into the work area. When a train dispatcher provides track protection as requested by a foreman, information is entered into the PTC system and an electronic block is applied that prevents a train from being routed into the protected area. However, when a train dispatcher removes the track protection, as done when clearing foul time, the electronic block is removed and a train can be routed into the track. The latter scenario occurred in this accident when the night foreman released his foul time at 7:29 a.m. and the dispatcher removed the electronic block at 7:31 a.m. Thus, human directives removed PTC-based protection for the workers and equipment still positioned on the track. A safeguard for dispatcher removal of track protection is SSDs. Roadway workers on the ground place the physical SSDs on the track, which is interpreted by the PTC system as occupied track. Thus, SSDs provide redundant signal protection to ensure that tracks are protected, even when a dispatcher removes the electronic blocks. In this accident, however, the work crew did not use SSDs, and the dispatcher did not challenge the crewmembers about the absence of SSDs when they discussed foul time. Thus, the human inactions removed the opportunity for PTC to provide track protection.

NTSB Railroad Accident Report

50 The accident in Chester occurred, despite the presence of the PTC system, because human activities rendered it incapable of automatically controlling the train movement. The NTSB therefore concludes that the inadequate and inconsistent use of SSDs by Amtrak engineering personnel effectively defeated the RWP component of Amtrak’s ACSES and thereby placed MOW employees, equipment, and the traveling public at greater risk of harm. The NTSB further concludes that had the foremen ensured SSDs were in place, the accident would not have occurred. To add another layer of protection for roadway workers, the NTSB recommends that the FRA require railroads to install technology on hi-rail, backhoes, other independently operating pieces of MOW equipment, and on the leading and trailing units of sets of MOW equipment operated by maintenance workers to provide dispatchers and the dispatch system an independent source of information on the locations of this equipment to prevent unauthorized incursions by trains onto sections of track where maintenance activities are taking place in accordance with the Congressional mandate under the Rail Safety Improvement Act of 2008. Investigators sought to discover why the foremen, who were responsible for providing track protection for the other roadway workers, failed to use SSDs. The night foreman, the day foreman, and the train dispatcher had specific duties to perform in the proper application and use of SSDs. To be clear, the nature of the work at the job site, on the day of the accident and before the incident, required the day and night foremen to establish foul time with the train dispatcher because the equipment being used occupied either a specific track or the envelope of the equipment extended beyond the track that it occupied; that fact necessitated foul time protection. The night foreman determined that track 1 needed to be protected using foul time, because the track ballast-vacuum train’s equipment extended beyond the track it occupied on both sides. The same rule was in force when the foreman elected to use the backhoe by placing it on track 3; it required that track 4 be protected as well. Therefore, there were times when all four tracks required protection by either a Form D or foul time. Moreover, Amtrak Rule 140-S2 requires the use of SSDs when an EIC engages in covered fouling activities (for example, uses machinery that will foul a track in signaled territory for more than 5 minutes). (Amtrak 2016) However, the night foreman told investigators that he did not have SSDs to use. Thus, it would have been impossible for the foreman to follow Amtrak’s own rules. Therefore, it is reasonable to presume that no SSDs were used the entire time that he provided on-track protection for the project. Nor did the train dispatcher ask the night foreman about his not applying SSDs. The track supervisor on the day of the accident did not insist that SSDs be applied. The NTSB therefore concludes that there was wide acceptance at Amtrak of not using SSDs. Upon discovering that Amtrak management failed to issue SSDs to the night foreman, despite their own rules mandating the use of the safety equipment, investigators sought to discover why this was the case. The evidence collected suggested that the lack of an efficiency test code may have reduced awareness of the issue. During the project, Amtrak had assigned one supervisor per shift to the project, and at the time of the accident Amtrak did not have an efficiency test code for the observation or evaluation of compliance with Amtrak’s SSD process. Even without a code, supervisors and managers had the ability to code noncompliance with the SSD process, but the code was placed in the “other” category of the database, so that SSD compliance was not differentiated or assessed adequately. Without the ability to measure SSD compliance alone, Amtrak cannot verify that SSDs are being used, and without verification, it is possible that SSDs are not being used. The NTSB concludes that a specific efficiency test code for the foul time

NTSB Railroad Accident Report

51 process that assesses SSD use would give Amtrak the ability to monitor and improve SSD compliance and change the culture of noncompliance. Upon discovering that Amtrak did not have an effective method of monitoring SSD use, investigators examined SSD regulations and discovered that, despite an NTSB recommendation, the FRA did not require the use of redundant signal protections. Thus, Amtrak, faced no regulatory consequences for failing to use SSDs. The NTSB concludes that had the FRA required shunting as recommended by the NTSB in Safety Recommendation R-08-06, the accident would not have occurred. 3.6 Site-Specific Work Plans Amtrak required SSWPs for repair and restoration projects that are large, with many employees and equipment and that occupy large stretches of track over a long period of time, for example, a project replacing many miles of track. However, Amtrak does not have specific, measurable criteria for “large” in this context, and determining whether a project requires an SSWP depends on the project manager. Although the ballast-vacuuming project at Chester did not occupy a large stretch of track or more than about 10 workers during each shift, it was complex in several areas. The non-stop work over 55 hours required good communication and coordination during shift changes and between train dispatchers and foremen, careful adherence to foul time and Form D procedures—critical for roadway work projects of all sizes and complexity; strategic positioning of the appropriate number of watchmen to ensure close monitoring of track(s) so an approaching train is seen as soon as possible; and comprehensive assessment of the work site as a whole to ensure that equipment does not block a watchman’s view or a worker’s view of a warning of an approaching train and that the warning can be heard over noisy equipment. Of the four examples of hot spots listed earlier in this report, two related to the requirement that employees and equipment are clear of the track 15 seconds before the arrival of a train. An SSWP was not prepared for the ballast-vacuuming project, and so the work area was not identified as a potential hot spot. However, the examples and descriptions of hot spots do not include the situation of monitoring multiple main tracks where equipment obstructs the view as at Chester. A large, stationary piece of equipment can obstruct sight distance and pose a safety risk similar to those of identified hot spots. These sight distance limitations should be identified when an SSWP is performed. The day watchman at Chester saw the approaching train and attempted to warn the workers by sounding an air horn and waving an orange disc, although the watchman’s actions other than moving away from the track were not discernible on the video. However, it is unclear whether an air horn could be heard over the noise of the RailVac and that the orange disc could be seen by workers with the backhoe creating a visible obstruction. Even if the warnings were heard and seen, however, those potentially in harm’s way likely were not able to clear the track with sufficient time to avoid injury. The backhoe and the operator would not have had sufficient time to clear the track. A watchman was never intended to provide that level of warning because clearing the backhoe from the track would take too long. Protection for a backhoe on a main track had to rise to the level of the issuance of foul time properly authorized and discussed with the work group— all elements that should have been covered in a job briefing. Those risks should have been

NTSB Railroad Accident Report

52 identified through the preparation of an SSWP and a thorough SSWP review before the project began. The primary safety layer that a watchman adds to the protection of a work group is to make a timely warning to workers and equipment of the approach of a train. Amtrak did not consider the accident area to be a hot spot, and there was no plan for the use of multiple watchmen to protect against an approaching train. In addition, the postaccident sight distance observations show that when the watchman could determine that a train was approaching on track 3 there was not enough time for the watchman to communicate to the work crew so that they could be in the clear 15 seconds before the train arrived. This safety issue includes an interpretation that is not always discussed: the 15-second train approach time does not include the time taken for a roadway worker to move clear of the track and into a place of safety. If that movement takes 15 seconds, then a train must be visible in time for a warning to be given 30 seconds before the train arrives. The ballast-vacuuming work was a complicated and significant work project that needed thorough planning and management review to protect the roadway workers, equipment, and the traveling public using Amtrak’s passenger service. Therefore, the NTSB concludes that Amtrak management should have recognized that the project rose to a heightened level of hazard that required a detailed review or SSWP before it began. An SSWP review likely would have identified that a serious hazard existed, since employees would be working in both an Amtrak passenger train and commuter operations environment with the passage or simultaneous movement of trains on adjacent tracks. If an SSWP had been completed, the following hazards at the worksite would have been identified: • A single watchman assigned to the ballast-vacuuming project was inadequate to monitor approaching trains on tracks 1, 3, and 4 at any time and on any track in both directions. • The night shift foreman did not have SSDs to apply, and clearly the night track supervisor did not check to see whether SSDs had been placed on the tracks. • The staggered reporting times of the three different departments supporting the project presented a problem in conducting and completing one comprehensive job briefing for all employees immediately after the shift change between the foremen. Amtrak typically applies the SSWP process to large production projects where it believes the increased number of employees and equipment constitutes a heightened risk. However, the Chester project, although not a large project based on the number of employees and equipment, had the complexity and thus the safety hazards of a larger project. Therefore, the NTSB concludes that safety hazards exist at complex smaller projects, and these hazards should be assessed and addressed with SSWPs. The NTSB recommends that Amtrak develop and implement an engineering safety procedure for preparing SSWPs for maintenance projects on the NEC main line tracks spanning multiple shifts or multiple workdays to reduce or mitigate the inherent risks of MOW work in a high-speed train operations environment.

NTSB Railroad Accident Report

53 3.7 Job Briefings The FRA regulations require that the EIC of work on tracks must conduct a job briefing, which provides workers with information to improve their safety in an otherwise potentially unsafe situation. A job briefing must be timely and provide all workers present for the job briefing the opportunity to thoroughly discuss not only the on-track protection secured but the hazards present at the job site. At Chester, on the day of the accident, the day foreman circulated an Amtrak two-sided Job Briefing Documentation Sheet and On-Track Safety Briefing Sheet for employees to sign without first conducting a job briefing. He said he did this because he intended to conduct the job briefing after all the other project support workers gathered at the work site. The accident occurred within the first 30 minutes after the foreman arrived. The practice of delaying a job briefing is not in compliance with the FRA regulations or the Amtrak RWP training. Another example of the breakdown of on-the-job safety was the track supervisor’s performing laborer tasks at the job site, so he was unable to do his own job of supervising. He was busy while the job briefing sheet was circulated for signatures without the foreman’s conducting the briefing, and therefore he could not ensure that a safety briefing was conducted. When a supervisor does not perform his duties and responsibilities, the wrong signal is sent to the work force. The NTSB concludes that disengagement by a supervisor from a critical and regulated safety communication process reduces safety layering and at a minimum encourages other lax safety habits. The NTSB further concludes that had the supervisor been engaged with his duties and responsibilities, a proper and thorough job briefing would likely have been conducted and the employees would have had an opportunity to ask the day foreman how on-track safety was to be provided. On September 24, 2014, the NTSB adopted its Special Investigation Report on Railroad and Rail Transit Roadway Worker Protection. (NTSB 2014b) The following excerpt on job briefings is from that report: Federal regulations contained in 49 CFR 214.315 require job briefings, and it is likely that the accidents may not have happened had more comprehensive job briefings been conducted beforehand. All except one of the accidents discussed in this special investigation report were preceded by some type of job briefing, safety meeting, or toolbox safety meeting..47 The evidence shows that the briefings omitted essential and job-specific elements related to hazard recognition and mitigation. The NTSB believes it is critical that all members of roadway worker groups actively participate in hazard recognition and ensure that hazards are adequately mitigated before work begins. Title 49 CFR 214.315, “Supervision and communication,” requires that when an employer assigns duties to a roadway worker that call for that employee to foul a track, the employer shall provide the employee with a job briefing that includes information on the means by which on-track safety is to be provided, and instruction on the on-track safety procedures to be followed. Additional

47 NTSB investigators were unable to confirm that a job briefing was conducted before the BART Walnut Creek accident.

NTSB Railroad Accident Report

54 requirements, effective July 1, 2013, require the job briefing to include information about any adjacent tracks, on-track safety for such tracks, and identification of any roadway maintenance machines that will foul the tracks and a discussion of the nature of the work to be performed and the characteristics of the work location. This information is to be communicated again anytime the on-track safety procedures change during the work period. Although on-track protection and procedures are vital elements of a job briefing, a comprehensive job briefing that included an analysis of the task and environmental conditions with appropriate hazard recognition and mitigation would likely have prevented many of these accidents. General discussion of safety and toolbox safety meetings should never suffice for a job briefing. Further, the FRA regulations covering job briefing pertain only to MOW workers’ on-track method of protection and do not go far enough to ensure a comprehensive job briefing for all types of roadway work. In response to the NTSB’s special investigation report, the then president/CEO of Amtrak sent a letter to the NTSB dated September 25, 2014, stating the following: Safety remains Amtrak’s top priority. … Amtrak’s roadway worker safety program exceeds the minimum requirements in 49 CFR Part 214. … Amtrak will review the best practices for comprehensive job briefings in Occupational Safety and Health Administration standards contained in 29 CFR Parts 1910 and 1926 and will revise our programs where required. Although the Amtrak president/CEO’s response to the NTSB’s special investigation report was encouraging, real and effective changes were lacking 18 months later, as this accident shows. The employees who signed the job briefing sheet should have been aware of their responsibility to not sign the sheet unless the foreman had conducted a job briefing, thus they contributed to a lax safety environment (another reduction in the safety layering concept was employees not acting responsibly to ensure their safety). The NTSB concludes that had the day foreman conducted a thorough job briefing for all workers on the day shift, including the supervisor, before the work began, foul time protection or the lack thereof and which foreman had the foul time likely would have been discussed and then rectified or mitigated by removal of the backhoe from track 3. The NTSB further concludes that each employee present at the work site had the obligation to demand that a proper job briefing be conducted before they signed the safety briefing sheet. 3.8 Train Dispatching Both the day and the night dispatchers received training that included the requirement to ensure that SSDs are used when tracks are fouled for longer than 5 minutes. They had completed training that covered NORAC rules and the Amtrak Timetable Special Instructions, both of which contain rules for foul time and application of SSDs. However, despite this training, neither the day nor the night train dispatcher ensured that SSDs were applied. Information from the interviews with the night train dispatcher and from phone conversations between the day train dispatcher and

NTSB Railroad Accident Report

55 the day foreman indicate that both train dispatchers knew that a backhoe was being used on track 3 for longer than 5 minutes. In addition, neither train dispatcher asked the night foreman why he had not used SSDs. The NTSB reviewed the dispatchers’ foul time log sheets for the duration of the work outage. Those log sheets did not include a section to denote the indication of a TOL (indicating the use of SSDs) as part of the application of foul time. Several foul time entries were for time slots longer than 5 minutes, and dispatchers were aware that a backhoe was being used as part of the work project. The foul time entries longer than 5 minutes suggest a lack of supervisory oversight of foul time log sheets in the dispatcher center. After the accident, Amtrak revised its foul time log sheet to include a section to indicate the use of SSDs. The NTSB concludes that the supervisory oversight in Amtrak’s dispatcher center did not adequately monitor dispatcher responsibilities to ensure that SSDs were used. The NTSB therefore recommends that Amtrak require supervisors to review train dispatchers’ foul time log sheets to verify whether SSDs are being adequately applied. The day train dispatcher ran train 89 on track 3 without calling the day foreman to ask whether track 3 was clear. The day train dispatcher had released the night foreman’s fouls and Form D, and the night foreman had told the dispatcher that the day foreman was going to request foul time for tracks 1, 3, and 4. The dispatcher put the pending foul time requests in his logbook and had not removed several of the blocking devices from the previous shift, because he was expecting the day foreman to call to obtain the fouls. Although the dispatcher said he had contemplated calling the day foreman to find out whether he wanted foul time or not, he did not call the day foreman either to ask whether he wanted fouls or to verify that track 3 was clear before authorizing a train to operate on the track. On the day of the accident, the day train dispatcher engaged in two personal phone conversations (via an Amtrak recorded land line) while he was on duty and controlling the railroad, but these calls did not violate any rules. The NORAC Operating Rules prohibit the use of personal electronic devices by railroad employees but do not address the use of a railroad’s business phone to engage in personal phone conversations. (NORAC 2011) The goal of this rule is to eliminate the distraction caused by personal electronic devices in the railroad environment. Train dispatchers are responsible for operating the railroad in their assigned territories efficiently and safely. This responsibility places a significant cognitive demand on a train dispatcher to remain alert, aware, and engaged while in control of one or more train movements. The NTSB has investigated transportation accidents where personal use of business phones by operations personnel has led to distraction and pertinent information that was not conveyed. (NTSB 2010) On the day of the accident, the dispatcher put the pending foul time requests in his logbook and left on his board several blocking devices from the previous shift, and he thought about calling the day foreman to ask about foul time requests or to verify that track 3 was clear before authorizing a train, but he did not call the foreman. The NTSB therefore concludes that the personal phone calls made by the day train dispatcher while he was on duty distracted him from performing his job. The NTSB recommends that Amtrak revise its train dispatcher rules so that potentially distracting activities, such as making personal telephone calls, are not allowed while dispatchers are on duty and responsible for safe train operations.

NTSB Railroad Accident Report

56 Amtrak’s 80-mph Slow By policy, requiring the train dispatcher to slow trains to 80 mph when they pass some construction zones, did not apply to the equipment used in the ballast-vacuuming project. But the project required the use of a RailVac and a backhoe on out-of-service track. This equipment was noisy, like an undercutter and a track-laying machine, and in this case the equipment was on out-of-service track, like the work conditions covered by the “80-mph Slow By” policy. An organization focused on risk management would acknowledge the safety risks of the work conditions of the Chester project and advise train dispatchers to make safety-conscious decisions, such as slowing trains or using slower tracks, to move passenger trains by work areas. Postaccident interviews revealed that the NEC is undergoing a long-term infrastructure project. The project is estimated to last 5 to 8 years and encompass nearly every portion of the NEC. The level of maintenance and programmed capital improvements will be constant and pervasive along the NEC, significantly raising the risk of the work as engineering department projects progress in an environment of dense passenger train traffic. Additionally, passenger trains operate at much higher speeds than freight trains, and thus the time needed to safely clear on-track personnel when a passenger train approaches is greater than that for a freight train. The NTSB therefore concludes that Amtrak’s ongoing infrastructure work creates an increased exposure of roadway workers to incidents like the one at Chester. Other railroads that host Amtrak passenger trains employ various methods to reduce the speed of trains passing by work zones, including slow orders, conditioning stops, and restricted speed. Amtrak complies with these speed limitations on hosts’ properties, and it could apply the same restrictions on its own properties. However, Amtrak typically uses its “slow by” policy only when track undercutting or track-laying machinery is in a defined work zone. Thus, Amtrak has recognized the risks associated with trains passing some construction zones at full track speed, but not others (that is, ballast-vacuuming work). But the 80-mph speed restriction that Amtrak imposes in some situations is still too fast for a train to pass a work zone safely. The NTSB concludes that had Amtrak instructed dispatchers to operate trains at significantly slower speeds through the Chester work zone, the severity of the accident would have been diminished. The NTSB recommends that Amtrak conduct a risk assessment for all engineering projects and use the results to issue significant speed restrictions for trains passing any engineering project that involves safety risks for workers, equipment, or the traveling public, such as ballast vacuuming, as part of a risk-mitigation policy. The evidence from the Chester accident suggests that the operating environment for Amtrak dispatchers was not optimized for safety. Amtrak’s rules did not require that trains be slowed by ballast-vacuuming projects, nor did they restrict dispatchers from engaging in personal phone calls while responsible for safe train operations. In addition, first-line supervisors of dispatchers were not ensuring that dispatchers verified SSD use. It appeared that the only supervisor expectation that the day train dispatcher sought to meet was on-time performance. Therefore, the NTSB concludes that Amtrak’s rules and supervisor expectations for dispatchers did not adequately emphasize safety.

NTSB Railroad Accident Report

57 3.9 Safety Oversight Numerous unsafe conditions were uncovered in the investigation that contributed to the hazards of the work environment on the day of the accident. These safety shortcomings ranged from individual and crew actions to procedural and oversight work practices that facilitated unnecessary risks and increased the likelihood of the accident. These unsafe active failures and latent conditions combined to result in a fatal accident. While mistakes are expected in human work systems, the multitude of unsafe conditions observed indicates a systemic problem. The active failures that occurred indicate that safety was consistently a low priority in the decision- making process of the employees involved. The presence of the unsafe latent conditions indicates that management failed to proactively identify and mitigate unsafe conditions. Indeed, no fewer than 29 active failures and latent conditions were identified: Medical Active Failures

1. The backhoe operator ingested drugs that could have negatively impacted his ability to

perform his work safety.

1. The track supervisor ingested drugs that could have negatively impacted his ability to fulfill

his supervisory responsibly of ensuring that his subordinates were following safe work practices.

1. The train engineer ingested drugs that could have negatively impacted his ability to operate

the train safety. Medical Latent Conditions

1. Roadway workers were not subject to random drug screening.

Maintenance of Way Active Failures

1. The night foreman released foul time with workers and equipment on the track.
2. The night foreman communicated with a cell-phone instead of a radio, which prevented

other workers from discovering that he was releasing his foul time authority.

1. The day foreman did not request foul time authority, even though the night foreman had

departed the work site and workers and equipment were fouling track 3.

1. The day foreman did not conduct a meaningful job briefing.
2. Several employees signed a job briefing signature sheet, even though they were not given

a job briefing, and did not exercise their right to make a good-faith challenge.

1. The day foreman circulated a job briefing signature sheet while the track was unprotected.
2. The RailVac superintendent (a contractor) requested a job briefing before initiating work,

but even upon being prompted, the day foreman did not conduct a job briefing.

NTSB Railroad Accident Report

58

1. The day foreman told the RailVac superintendent that several tracks were protected with

foul time when they were not.

1. The day foreman told the watchman that several tracks were protected with foul time when

they were not.

1. Neither the night foreman nor the day foreman applied SSDs.
2. The day track supervisor did not stop the ongoing work due to the lack of SSDs.
3. The day track supervisor was actively performing the job of a roadway worker, rather than

ensuring that his subordinates were following safe work practices.

1. The watchmen did not have adequate sight distance to see approaching trains and could

not provide adequate protection. He did not stop the ongoing work with a good faith challenge. Maintenance-of-Way Latent Conditions

1. Amtrak did not require or encourage an SSWP be prepared for the 55-hr track work.
2. Amtrak did not have a formal shift transfer procedure for the dispatcher and the foremen

that verified the use of SSDs.

1. Workers reported that radios did not work well in the area, which resulted in cell phone

communications and reduced situation awareness for track workers.

1. Amtrak management did not assure that roadway workers were equipped, properly trained,

and diligently used SSDs. Amtrak management did not have an efficiency testing code for SSD use.

1. Without applying SSDs to the track as a redundant safety protection, the track occupancy

logic of the signal system was not enabled at the time of the accident. Dispatcher Active Failures

1. The day train dispatcher did not verify that SSDs had been applied.
2. The day train dispatcher engaged in personal phone calls while on duty.
3. The day train dispatcher did not call the day foreman to verify that track 3 was clear before

authorizing a train to proceed on it, even though he was anticipating that the day foreman was going to call and request foul time for the track “within seconds.”

1. The day train dispatcher authorized a train to proceed through the work area at maximum

authorized speed, rather than requiring a slower speed as a precaution.

NTSB Railroad Accident Report

59 Dispatching Latent Conditions

1. Amtrak rules did not require speed restrictions for trains passing ballast vacuuming work,

and the speed restrictions that they did have required that trains proceed at 80 mph, which is not slow enough to significantly mitigate the risk associated with construction zones.

1. Amtrak rules did not prohibit dispatchers from engaging in personal phone calls while on

duty.

1. Amtrak supervisor expectations for dispatchers emphasized on-time performance over

safety. As discussed earlier, Reason (2013, pp. 82–83) has maintained that an increased number of active failures and latent conditions are a manifestation of a weak safety culture. Therefore, the NTSB concludes that the 29 active failures and latent conditions indicate a systemic problem with Amtrak’s safety culture. Consistent with this conclusion, further investigation revealed several safety deficiencies at various organizational levels at Amtrak. This section of the report details these issues. 3.9.1 First-Line Safety Oversight Amtrak had three safety programs at the time of the accident—Safe-2-Safer, C3RS, and the Safety Liaison Program—but none of these programs ensured the safety of the workers involved in the accident. The workers belonged to unions that had chosen not to participate in Safe-2-Safer and C3RS. According to the union representatives, the Safe-2-Safer program was inferior to a previous safety program, and they preferred an older close-call policy, which had been cancelled in 2014, over C3RS. Also, the union representatives indicated that the implementation of the Cardinal Rules had contributed to labor employees’ fearing that they would lose their jobs if they reported rule violations. Amtrak management indicated that the Cardinal Rules were not new concepts; they were fundamental railroad safety principles. Beyond this, Amtrak management generally did not acknowledge the union concerns. It is concerning that Amtrak and its unions allowed safety to become a labor-management contract negotiating issue. The lack of participation in the C3RS and Safe-2-Safer programs trivialized safety and made the work environment less safe for everyone, including Amtrak employees, contractors, and the traveling public. It is also concerning that Amtrak was aware of the unions’ refusal to participate in Safe-2-Safer and C3RS, yet the company failed to resolve the unions’ objections and effectively mitigate these safety shortcomings. Amtrak’s third safety program, the Safety Liaison Program, was ineffective, which likely was a consequence of the program’s being understaffed; there was no safety liaison present at the work site on the day of the accident. Although the Safety Liaison Program could be an effective safety management program if implemented and resourced properly, it is concerning that Amtrak’s senior leadership tolerated the ineffective, under-resourced program and failed to collaboratively establish a pervasive and robust safety solution for all jobs potentially encroaching on its passenger railways, especially the busy NEC.

NTSB Railroad Accident Report

60 This concern is heightened by the recognition that Amtrak knew that its two other safety programs were rendered defunct and inoperable by their labor management practices. That is, Amtrak’s senior leaders should have recognized the serious system safety deficiency of nonparticipation in the safety programs. Collaboration is needed to maximize safety in systems, because safety issues often involve interactions among parts of the system. It is important to understand how a change in one subsystem of a complex system may affect other subsystems within that system. As NTSB Board member Christopher A. Hart said in his October 10, 2017, presentation to the ORCHSE Strategies Executive Business Issues Forum in Arlington, Virginia, Using Collaboration to Improve Workplace Safety, collaboration improves the processes of identifying potential issues, prioritizing the issues, developing solutions, and evaluating whether the solutions are effective.48 For these safety-critical processes to occur, a shared trust between the stakeholders is imperative. NTSB Board member Christopher A. Hart provided an example of the effectiveness of collaboration in the aviation industry in a September 28, 2017, key note address to the National Association of State Motorcycle Safety Administrators in Burlington, Vermont. Hart noted that in the 1990s, the FAA, airlines, air traffic controllers, airports, and pilots all began a collaborative effort to reduce the fatal accident rate. By coordinating their safety management efforts, the fatality rate was decreased by more than 80 percent in only 10 years, and the last fatal crash of a US airliner was in 2009. 49 At the time of the accident in Chester, a weak relationship between Amtrak’s management and the unions undermined the effectiveness of Amtrak’s system safety efforts. Specifically, a lack of collaboration between Amtrak’s management and labor resulted in two programs’ being inoperable. A third program was understaffed and underdeveloped. Therefore, the NTSB concludes that Amtrak’s safety programs were deficient and failed to provide effective first-line safety oversight. The NTSB recommends that Amtrak work with labor to achieve full participation in all applicable safety programs. The NTSB also recommends that Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen work with Amtrak to improve the effectiveness of all applicable safety programs. 3.9.2 Reporting Systems Several Amtrak managers and executives told NTSB investigators that they believed rule compliance was the central tenet of safe railroad operations. Amtrak’s reliance on rule compliance was also reflected in their policies. For instance, the Cardinal Rules were implemented with the goal of increased rule compliance. Interviews with Amtrak leaders and a review of the Cardinal Rules policy suggest that Amtrak endorses a Person Model of error, which, as noted by James Reason, is the most commonly held view of errors. (Reason 2013, p. 101) The Person Model places the origin of error squarely on the people in direct contact with the system. Reason observes

48 Christopher A. Hart, presentation slides, Executive Business Forum Presentation, Using Collaboration to Improve Workplace Safety (https://www.ntsb.gov/news/speeches/CHart/Documents/hart-20171010.pdf). 49 Christopher A. Hart, Transcript, Keynote Address to the National Association of State Motorcycle Safety Administrators, Burlington, Vermont) (https://www.ntsb.gov/news/speeches/CHart/Pages/hart_20170928.aspx).

NTSB Railroad Accident Report

61 that typical remedial measures derived from this model include “naming, blaming, shaming, retraining, fear appeals, and writing another procedure.” He notes that “managers like the model because it separates the errant individuals from the organization in which he or she works.” As Reason (1990) observes, the Person Model is ineffective because it isolates the person from the context in which the error was made. The Cardinal Rules program was ineffective for the same reason. The rules placed the burden for safety on workers, and did not hold supervisors or managers accountable for safety. For instance, consider the 10th Cardinal Rule—Failure to comply with applicable RWP procedures. Under this rule, the foremen involved in the accident could have been terminated for failing to use SSDs. However, the foremen did not have access to SSDs, and so it would have been impossible for them to follow the rule. In addition, Amtrak management should have been aware of the need to provide training and reliable equipment to shunt track; this was identified in 1988 after the Night Owl accident. Thus, the lack of SSDs was an upstream system safety shortcoming that Amtrak management failed to address. Using the Cardinal Rules to terminate the foremen would not have addressed the underlying safety problem. In addition to being ineffective, Amtrak’s Cardinal Rules program led to incompatibility with Amtrak’s other safety programs. If an effective reporting system had been in place, management would have been aware of the systemic failures to use SSDs. However, many employees were not participating in Safe-2-Safer or C3RS, and the Safety Liaison Program was still “evolving.” In addition, the unions reported frustration over the incompatibility of the Cardinal Rules with the other three safety programs, which were intended to be nonpunitive. However, Amtrak records revealed that employees had been terminated for violating Cardinal Rules. Also, it was unclear how the Cardinal Rules were intended to synchronize with the other Amtrak safety programs. For instance, discussions with Amtrak management revealed that the likelihood of reprimand for rule violations depended largely on who discovered the violation. That is, if a safety liaison discovered a safety rule violation, counseling would occur, but not reprimand. On the other hand, if a supervisor discovered the violation of a Cardinal Rule, the incident would be reported to management, which would review the violation and consider termination. It does not appear that Amtrak management considered the negative impact the Cardinal Rules have when implemented alongside the other safety programs. Employees who fear that they may lose their jobs for violating a rule have a disincentive to report safety issues. Also, this fear discourages employees from reporting the unsafe behaviors of others, because employees likely fear that they will get their coworkers in trouble. Although Amtrak’s Cardinal Rules, many of which stem from FRA regulations and common safety practices, may have been intended to enforce safety on the railroad, an unintended consequence of their implementation was the reduction of reporting of safety-critical information. Amtrak and FRA rules and their rule enforcement play essential roles in safe railroad operations. However, the establishment and enforcement of rules can undermine workers’ perception that Amtrak has a just culture, which is “an atmosphere of trust in which people are encouraged, even rewarded, for providing essential safety-related information.” (Reason 1997, p. 195) After Amtrak’s leadership penalized Cardinal Rule violators by automatically considering their firing, union workers perceived Amtrak as unfair and became unwilling to report

NTSB Railroad Accident Report

62 safety-critical information. The reaction of the unions placed Amtrak’s management in a weak position to identify and mitigate hazards. A System Model of error, as opposed to the Person Model, is more effective. (Reason 2013, p. 102) From a systems perspective, it is recognized that humans are fallible and errors are to be expected, even in the best organizations. As Reason (2013, p. 102) observed, when taking a system perspective, “errors are seen as consequences rather than causes,” and therefore, organizations must examine system factors to understand the origin of errors. To successfully identify and address system factors, it is imperative that safety data are accurately collected and acted upon. Viable reporting systems are necessary to collect safety-critical information. Two factors affect the viability of reporting systems: (1) Employees must not be afraid that they (or their coworkers) will experience reprisal for using them and (2) Employees must trust that their using reporting systems will be rewarded with improvements in safety, because management will act on the information they provide to address identified hazards in a timely manner. Union representatives reported high levels of fear among employees and indicated that they did not believe Amtrak’s reporting systems (particularly Safe-2-Safer) were effective. Therefore, the NTSB concludes that Amtrak did not have a viable reporting system in place to collect safety-critical information. The NTSB therefore recommends that Amtrak work collaboratively with labor to develop and implement a viable safety reporting system (for example, C3RS); ensure that employees do not experience reprisal for using the system; respond quickly to the data collected; and communicate any resulting safety improvements to all employees. The NTSB also recommends that Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen work collaboratively with Amtrak to develop and implement a viable safety reporting system (for example, C3RS). 3.9.3 Corporate Safety Knowledge and Vision NTSB investigators examined the state of safety management across Amtrak’s management at the time of the accident. Investigators discovered that substantial differences in attitudes and beliefs regarding safety existed among division managers and corporate executives. Some of these individuals conveyed to investigators a strong commitment to safety, as well as a deep knowledge of system safety principles, while others did not convey that they clearly understood or implemented safety management. The inconsistent knowledge and views of safety among Amtrak’s managers and executives indicates a significant shortcoming in the company’s safety culture. It is well established in the literature that effective safety cultures emanate from the top of an organization, embody a set of clear and measurable objectives, and engender shared values and attitudes about safety throughout all levels of an organization. (Reason 1997, 191–220) However, the differing visions of safety within Amtrak have contributed to a failure to establish effective assurances that safety objectives are understood and achieved in a common, progressive manner. Therefore, the NTSB concludes that the lack of consistent knowledge and vision for safety across Amtrak’s management created a culture that facilitated and enabled unsafe work practices by employees. The numerous unsafe behaviors that occurred at the work site leading up to the accident are symptomatic of a deficient safety culture at Amtrak. Although each of the unsafe behaviors

NTSB Railroad Accident Report

63 can be linked to the catastrophic event, the behaviors were enabled by and attributable to failures in the safety attitudes of the individuals involved and the safety management provided by Amtrak. For Amtrak to address the safety issues identified in this report, a systemwide overhaul likely will be required. Amtrak must address the organizational deficiencies that allowed all the active failures to occur. The most logical and effective way for Amtrak to improve safety is to develop and implement a comprehensive SMS program. The importance of SMS programs in improving safety is widely recognized in transportation, and there are numerous resources available from this industry. The FAA and the Federal Transit Administration have provided guidance on the implementation of SMS programs.50 Also, Amtrak has already voluntarily developed an SSPP, which contains elements of an SMS program. Amtrak’s existing SSPP could provide the foundation to meet pending FRA regulation (49 CFR Part 270, System Safety Program). Thus, Amtrak has an existing platform and resources upon which to expand its system safety efforts. However, it is important to recognize that an SSPP is only a written plan, and cannot ensure safety without adequate promotion from senior leadership. In the current accident, unions were allowed to opt out of safety programs, that is, Safe-2-Safer and C3RS. Without employee participation, the SSPP was ineffective, because Amtrak was not able to work with employees to identify and mitigate hazards. For an SMS program to be effective, Amtrak’s leadership must fully endorse it, fund it, and promote it with a comprehensive communication strategy that reaches all levels of the organization. In addition, the unions must fully endorse and promote the SMS for it to be effective. An SMS program must start with a clear vision of safety. A core safety doctrine based on safety principles and best practices, promoted as a corporate value for all workers, is needed. Senior leadership could endorse the core safety doctrine and its safety guidance by making it a requirement for employment for all workers. Amtrak also must address the specific organizational deficiencies identified in this report. To address the weak safety culture at Amtrak, senior leadership must stop blaming employees for errors and adopt a system perspective. Senior leadership must address employee fear and engage with workers to correct safety issues. Employees and contractors cannot experience reprisals or negative outcomes for their use of any safety management initiative that incorporates a reporting system intended to collect information on safety vulnerabilities and weaknesses. With respect to safety initiatives, Amtrak must improve existing programs, or develop new ones, for all employees and contractors that facilitate employee acceptance of and adherence to best safety practices, and that provide effective first-line supervision. To ensure the effectiveness of these safety management initiatives, Amtrak must continuously collect, analyze, and act on safety performance metrics. The data collected should be work-process oriented and include leading indicators of employee acceptance and adoption of the safety initiatives (for example, utilization of reporting systems). Reports of these programs should be provided to Amtrak’s senior

50 (a) See FAA Safety Management System Initiative (https://www.faa.gov/about/initiatives/sms/). (b) FTA Safety Management System Page (https://www.transit.dot.gov/regulations-and-guidance/safety/safety- management-systems-sms).

NTSB Railroad Accident Report

64 leadership and to those who should promote the safety initiatives, confirm that they are effective, and ensure that the data derived from them is acted upon in a timely manner. Additionally, senior leadership must ensure that its safety initiatives are not rendered ineffective because of insufficient funding, staffing, or labor-management negotiations. The evidence uncovered over the course of the investigation revealed that Amtrak’s strategies to manage safety were deficient. Therefore, the NTSB concludes that Amtrak did not have an effective SMS program. The NTSB recommends that Amtrak work collaboratively with labor in an effort to develop a comprehensive SMS program that complies with pending FRA regulation 49 CFR Part 270, System Safety Program, and that vitalizes safety goals and programs with executive management accountability; incorporates risk management controls for all operations affecting employees, contractors, and the traveling public; improves continually through safety data monitoring and feedback; and is promoted at all levels of the company. The NTSB also recommends that once Safety Recommendation R-17-26 is completed, Amtrak implement the SMS program throughout the company with resources sufficient to ensure that all levels of management and all labor unions involved with Amtrak operations accept and comply with the system. The NTSB also recommends that Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen work collaboratively with Amtrak in an effort to develop a comprehensive SMS program that complies with pending FRA regulation 49 CFR Part 270, System Safety Program, and that vitalizes safety goals and programs with executive management accountability; incorporates risk management controls for all operations affecting employees, contractors, and the traveling public; improves continually through safety data monitoring and feedback; and is promoted at all levels of the company. 3.9.4 Government Regulation of Safety Management The FRA has introduced, but has not enacted, a regulation to mandate formal system safety program plans at 49 CFR Part 270, System Safety Program. (Federal Register 2016, 53850) (Federal Register 2017, 26359) This regulation would help improve passenger rail safety by advancing system safety standards in the industry. However, after four delays, these safety improvements have yet to materialize. Therefore, the NTSB concludes that by delaying progressive system safety regulation, the FRA has failed to maximize safety for the passenger rail industry and the traveling public. The NTSB recommends that the FRA enact 49 CFR Part 270, System Safety Program without further delay.

NTSB Railroad Accident Report

65 4 Conclusions 4.1 Findings

1. The track structure, signals, and mechanical equipment did not contribute to the accident.
2. The track supervisor had used two different opioids at some point before the accident, but

based on behavioral evidence, drug-induced impairment of his job performance could not be determined.

1. The Amtrak engineer took timely and appropriate actions to stop the train and to warn the

roadway workers about the train approaching their work area.

1. Although there was no operational evidence of impaired performance by the engineer, his

use of marijuana was illicit and had not been deterred by his participation in the US Department of Transportation drug testing program, and any previous marijuana use had not been detected by random drug testing.

1. Amtrak did not effectively assure that its employees, especially those in safety-sensitive

positions, were drug-free while performing their public transportation duties.

1. Had the two roadway workers used cocaine, codeine, or morphine with some regularity,

been subject to random urine drug screening, and been selected for testing, their use of cocaine and opiates may have been detected before the accident.

1. The absence of a random drug testing program for maintenance-of-way employees at the

time of the accident meant there was no effective program to deter the maintenance of way employees from using drugs.

1. The participation of the two roadway workers in the pool for random testing might have

deterred them from using cocaine and opiates.

1. The result of the night foreman’s actions and the day foreman’s inactions based on their

conversation was that tracks 1, 3, and 4 were not protected with foul time from about 7:30 a.m. until 7:50 a.m. when the accident occurred.

1. Had the two foremen communicated with the train dispatcher jointly about the transfer of

fouls from one foreman to the other, it is likely that on-track safety and protection would not have lapsed and the accident would not have happened.

1. The inadequate and inconsistent use of supplemental shunting devices by Amtrak

engineering personnel effectively defeated the roadway worker protection component of Amtrak’s Advanced Civil Speed Enforcement System and thereby placed maintenance-of-way employees, equipment, and the traveling public at greater risk of harm.

NTSB Railroad Accident Report

66

1. Had the foremen ensured supplemental shunting devices were in place, the accident would

not have occurred.

1. There was wide acceptance at Amtrak of not using supplemental shunting devices.
2. A specific efficiency test code for the foul time process that assesses supplemental shunting

device use would give Amtrak the ability to monitor and improve supplemental shunting device compliance and change the culture of noncompliance.

1. Had the Federal Railroad Administration required shunting as recommended by the

National Transportation Safety Board in Safety Recommendation R-08-06, the accident would not have occurred.

1. Amtrak management should have recognized that the project rose to a heightened level of

hazard that required a detailed review or site-specific work plan before it began.

1. Safety hazards exist at complex smaller projects, and these hazards should be assessed and

addressed with site-specific work plans.

1. Disengagement by a supervisor from a critical and regulated safety communication process

reduces safety layering and at a minimum encourages other lax safety habits.

1. Had the supervisor been engaged with his duties and responsibilities, a proper and thorough

job briefing would likely have been conducted and the employees would have had an opportunity to ask the day foreman how on-track safety was to be provided.

1. Had the day foreman conducted a thorough job briefing for all workers on the day shift,

including the supervisor, before the work began, foul time protection or the lack thereof and which foreman had the foul time likely would have been discussed and then rectified or mitigated by removal of the backhoe from track 3.

1. Each employee present at the work site had the obligation to demand that a proper job

briefing be conducted before they signed the safety briefing sheet.

1. The supervisory oversight in Amtrak’s dispatcher center did not adequately monitor

dispatcher responsibilities to ensure that supplemental shunting devices were used.

1. The personal phone calls made by the day train dispatcher while he was on duty distracted

him from performing his job.

1. Amtrak’s ongoing infrastructure work creates an increased exposure of roadway workers

to incidents like the one at Chester.

1. Had Amtrak instructed dispatchers to operate trains at significantly slower speeds through

the Chester work zone, the severity of the accident would have been diminished.

1. Amtrak’s rules and supervisor expectations for dispatchers did not adequately emphasize

safety.

NTSB Railroad Accident Report

67

1. The 29 active failures and latent conditions indicate a systemic problem with Amtrak’s

safety culture.

1. Amtrak’s safety programs were deficient and failed to provide effective first-line safety

oversight.

1. Amtrak did not have a viable reporting system in place to collect safety-critical

information.

1. The lack of consistent knowledge and vision for safety across Amtrak’s management

created a culture that facilitated and enabled unsafe work practices by employees.

1. Amtrak did not have an effective safety management system program.
2. By delaying progressive system safety regulation, the FRA has failed to maximize safety

for the passenger rail industry and the traveling public.

NTSB Railroad Accident Report

68 4.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the accident was the unprotected fouled track that was used to route a passenger train at maximum authorized speed; the absence of supplemental shunting devices, which Amtrak required but the foreman could not apply because he had none; and the inadequate transfer of job site responsibilities between foremen during the shift change that resulted in failure to clear the track, to transfer foul time, and to conduct a job briefing. Allowing these unsafe actions to occur were the inconsistent views of safety and safety management throughout Amtrak’s corporate structure that led to the company’s deficient system safety program that resulted in part from Amtrak’s inadequate collaboration with its unions and from its failure to prioritize safety. Also contributing to the accident was the Federal Railroad Administration’s failure to require redundant signal protection, such as shunting, for maintenance-of-way work crews who depend on the train dispatcher to provide signal protection, prior to the accident.

NTSB Railroad Accident Report

69 5 Recommendations As a result of its investigation of the April 3, 2016, Amtrak train collision with MOW equipment in Chester, Pennsylvania, the National Transportation Safety Board makes the following safety recommendations: 5.1 New Recommendations To the Federal Railroad Administration: Enact Title 49 Code of Federal Regulations Part 270, System Safety Program, without further delay. (R-17-17) Require railroads to install technology on hi-rail, backhoes, other independently operating pieces of maintenance-of-way equipment, and on the leading and trailing units of sets of maintenance-of-way equipment operated by maintenance workers to provide dispatchers and the dispatch system an independent source of information on the locations of this equipment to prevent unauthorized incursions by trains onto sections of track where maintenance activities are taking place in accordance with the Congressional mandate under the Rail Safety Improvement Act of 2008. (R-17-18) To Amtrak: Establish a method to ensure that on-track protection in an active work zone is not lost during shift transfer. (R-17-19) Develop and implement an engineering safety procedure for preparing site-specific work plans for maintenance projects on the Northeast Corridor main line tracks spanning multiple shifts or multiple workdays to reduce or mitigate the inherent risks of maintenance-of-way work in a high-speed train operations environment. (R-17-20) Require supervisors to review train dispatchers’ foul time log sheets to verify whether supplemental shunting devices are being adequately applied. (R-17-21) Revise its train dispatcher rules so that potentially distracting activities, such as making personal telephone calls, are not allowed while dispatchers are on duty and responsible for safe train operations. (R-17-22) Conduct a risk assessment for all engineering projects and use the results to issue significant speed restrictions for trains passing any engineering project that involves safety risks for workers, equipment, or the traveling public, such as ballast vacuuming, as part of a risk-mitigation policy. (R-17-23)

NTSB Railroad Accident Report

70 Work with labor to achieve full participation in all applicable safety programs. (R-17-24) Work collaboratively with labor to develop and implement a viable safety reporting system (for example, C3RS); ensure that employees do not experience reprisal for using the system; respond quickly to the data collected; and communicate any resulting safety improvements to all employees. (R-17-25) Work collaboratively with labor in an effort to develop a comprehensive safety management system program that complies with pending Federal Railroad Administration regulation Title 49 Code of Federal Regulations Part 270, System Safety Program, and that vitalizes safety goals and programs with executive management accountability; incorporates risk management controls for all operations affecting employees, contractors, and the traveling public; improves continually through safety data monitoring and feedback; and is promoted at all levels of the company. (R-17-26) Once Safety Recommendation R-17-26 is completed, implement the safety management system program throughout the company with resources sufficient to ensure that all levels of management and all labor unions involved with Amtrak operations accept and comply with the system. (R-17-27) To Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and Brotherhood of Railroad Signalmen: Work with Amtrak to improve the effectiveness of all applicable safety programs. (R-17-28) Work collaboratively with Amtrak to develop and implement a viable safety reporting system (for example, C3RS). (R-17-29) Work collaboratively with Amtrak in an effort to develop a comprehensive safety management system program that complies with pending Federal Railroad Administration regulation Title 49 Code of Federal Regulations Part 270, System Safety Program, and that vitalizes safety goals and programs with executive management accountability; incorporates risk management controls for all operations affecting employees, contractors, and the traveling public; improves continually through safety data monitoring and feedback; and is promoted at all levels of the company. (R-17-30)

NTSB Railroad Accident Report

71 5.2 Recommendation Reiterated in This Report To the Federal Railroad Administration: R-08-06 Require redundant signal protection, such as shunting, for maintenance-of-way work crews who depend on the train dispatcher to provide signal protection.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member

CHRISTOPHER A. HART T. BELLA DINH-ZARR Member Member

Adopted: November 14, 2017 Member Christopher A. Hart and Member T. Bella Dinh-Zarr filed the following concurring statements.

NTSB Railroad Accident Report

72 Board Member Statements Member Christopher A. Hart filed the following concurring statement on November 20, 2017. I concur with the report and its findings, probable cause, and recommendations, and I would like to add some additional comments. One of the advantages of investigating accidents in all modes of transportation is that it provides an opportunity for cross-modal comparisons. One cross-modal comparison from this accident is that labor-management relations are far more adversarial and caustic in railroads than in any other mode that we investigate. I would submit that adversarial labor-management relations are a major safety issue, and that safety issue reared its ugly head in this accident. Given that management needs labor, and labor needs management, in order to get the job done, it has never been clear to me why labor-management relations have historically been so adversarial. Because neither can get the job done alone, harping between labor and management is somewhat akin to “Your end of the ship is sinking.” That said, query why the relations appear to be so much worse in railroads than in any other transportation mode. Putting my legal hat on, I wonder if a major cause of the adversarial relationship is the compensation scheme regarding workplace injuries. In very general terms, most worker’s compensation programs in this country provide for compensation without the need to prove fault, i.e., the worker must show only that he or she was at work and that he or she was injured. Not so for railroad employees. Under the Federal Employers' Liability Act (FELA), the employee must also show that (a) the injury was due to the employer’s negligence, and (b) there was no contributory negligence by the employee. Query whether this compensation scheme for workplace injuries contributes to an inherently adversarial relationship between labor and management. This accident provides examples of why this adversarial relationship is a safety issue. For example, Amtrak unions opted out of two programs that, in theory, are intended to help improve safety for employees—C3RS, the Confidential Close Call Reporting System for the reporting of near misses and other potential hazards, and Safe-2-Safer, the program in which employees would be their “brother’s keeper” and inform each other about hazardous conditions and practices. Given that these programs were created to improve safety, something has gone awry when the very employees whose safety is most at risk, and whose safety stands to benefit most from these programs, choose not to participate. One thing that has gone awry is the inherent inconsistency between these types of reporting programs and the existence of the “10 Cardinal Rules” list. Violation of any item on the list often results in dismissal. If these violations are inherently dangerous, query why management has chosen to go after them with punishment rather than establishing a program to collect information to help (a) identify why employees sometimes do things that they know will probably increase the likelihood of injury, and (b) provide a basis for determining what to do about the problem.

NTSB Railroad Accident Report

73 A similar situation exists with the C3RS. It was modeled after the Aviation Safety Reporting System, ASRS, which was created to help the aviation industry identify potential hazards in the system and fix them. One of the incentives of the program is the protection from enforcement that is provided for those who report potential hazards. As with ASRS, C3RS does not provide protection for near miss reports regarding action that reflects criminal or intentional wrongdoing. Unlike ASRS, however, C3RS has an exception for a certain type of event, namely, running red signals. There is no type of event for which ASRS denies protection. Given that employees obviously know that running red signals increases the likelihood of injury, this should be a type of event that management would want to know most about, and management would want to keep the information door open in order to figure out why it is happening and how to remedy it, rather than closing the door on any information flow. Another example of the adversarial labor-management relations is that when the NTSB made recommendations regarding in-cab cameras after the tragic commuter rail accident in Chatsworth, California, in 2008, I made a presentation at an annual railway labor union convention that included reference to the recommendations. Needless to say, the idea was not well received. It was very interesting, however, that the primary concern about the cameras was that management would use the information against employees. When the concept of in-cab cameras was presented to airline pilots, on the other hand, their primary concern was privacy. This difference speaks volumes about differences between the labor-management relationships in the two industries. The airline industry has demonstrated the power of collaboration, including collaboration between labor and management, to improve safety. That collaboration has helped to create the amazing result that no airline passenger has been fatally injured in a U.S. airline accident since

1. I would submit that collaboration between labor and management, and a more robust

information flow about things that can go wrong, can generate safety improvements and improve labor-management relations much more effectively than strict and severe punishment. Query whether a first step in that direction is eliminating the requirement to prove fault in order to recover for workplace injuries.

NTSB Railroad Accident Report

74 Member T. Bella Dinh-Zarr filed the following concurring statement on November 21, 2017. Often, in the accidents we investigate, the biggest safety challenge is human error, and increasingly, there is a solution in the form of some type of technology. Positive train control (PTC) is one such technology. We know that PTC is an effective safety system that will prevent rail accidents, especially in cases of human error or oversight. For 40 years, the NTSB has concluded that PTC would have prevented overspeed accidents, train-to-train collisions, and work zone incursions. The accident in Chester, Pennsylvania, is especially tragic because Amtrak had completed installation of PTC on this track, but a series of human factors circumvented the PTC system, in large part because the area was no longer designated as an established work zone. This circumvention of the PTC system took the lives of two of Amtrak’s own employees. Since 2008, we have been recommending that the Federal Railroad Administration (FRA) require the railroads to provide redundant signal protection for roadway workers. It was not required after the accident in Woburn, Massachusetts. It was not required after the accident in West Haven, Connecticut. It was not required when this accident happened. Unless the railroads are required to take steps to make PTC truly effective, PTC cannot have the meaningful impact on safety that it should. The railroads can, as in this accident, simply fail to “establish” a work zone, which would circumvent PTC requirements. In this accident, the train was traveling at 99 mph at the time of impact. Amtrak is hoping to reach speeds of more than 220 mph on this corridor. We need effective measures to ensure that PTC protects roadway workers making these infrastructure improvements, as well as the traveling public. We routinely add the regulator to the probable cause when its long-time failure could have prevented an accident. We held the FRA accountable in the probable cause in the West Haven accident in 2014. In conclusion #15 of this report, we found that if the FRA had required shunting, this accident would not have occurred. Therefore, I am pleased the Board voted to add the FRA’s failure to provide redundant signal protection prior to the accident as contributing to this accident. I also am very pleased that the Board voted to approve an additional recommendation for the FRA to require the railroads to use other technology, such as Global Positioning Systems (GPS), on maintenance-of-way (MOW) equipment to provide dispatchers and dispatch systems with an independent source of information on the locations of this equipment to prevent unauthorized incursions of trains onto sections of track where maintenance work is taking place. I am concerned that even with requiring shunting, we will not prevent accidents. While shunting is necessary and important, it requires human input just like making a phone call to request foul time. PTC is designed to help prevent these human errors. If you review Amtrak’s PTC Implementation Plan (IP) revisions 3 (prior to Chester) and 4 (after Chester) – there are no changes made to prevention of MOW incursions. Their plan (and perhaps others) fails to meet the Congressional mandate and will not prevent these accidents. Our report cites Dr. James Reason. As Dr. Reason advocates, we need hard defenses to prevent recurrence of these roadway worker incursions. A call from a foreman to a dispatcher requesting foul time is not vital field blocking. A shunt—if failed to be installed—is not vital field blocking. A technological solution to equip MOW equipment with automatic blocking would

NTSB Railroad Accident Report

75 provide vital field blocking. This solution is nothing new. As discussed at NTSB’s own PTC Forum in 2013, Burlington Northern Railroad successfully used such a system to protect its MOW workers. This additional recommendation is a positive step forward to truly protect the workers who maintain and improve our country’s rail infrastructure. I also commend the NTSB staff for suggesting during the Board Meeting that they provide the Board with a standalone recommendation within three months’ time to further enhance MOW worker safety. Staff intends to recommend that the FRA (1) reevaluate their system for approval of PTCIPs and (2) conduct a study of available technologies to better protect MOW workers. I look forward to reviewing these additional recommendations to meaningfully improve roadway worker safety. This will be a crucial step to ensure that roadway workers stop dying and that passengers are not put at risk. The future of rail safety is technology that will protect everyone.

Chairman Robert L. Sumwalt, III, and Member Earl F. Weener joined in this statement.

NTSB Railroad Accident Report

76 Appendix A: Investigation The NTSB Response Operations Center was notified of the accident on April 3, 2016. The NTSB launched a go-team from headquarters in Washington, DC, and locations in Chicago and New York City. The parties to the investigation were the Federal Railroad Administration, Amtrak, Brotherhood of Maintenance of Way Employes Division, American Railway and Airway Supervisors Association, Brotherhood of Locomotive Engineers and Trainmen, and SMART (International Association of Sheet Metal, Air, Rail and Transportation Workers).

NTSB Railroad Accident Report

77 Appendix B: The Night Owl Accident The Night Owl accident (NTSB 1989) occurred almost 30 years ago, and many parallels can be drawn to the Chester accident on April 5, 2016. Both accidents occurred in Chester, Pennsylvania, on Amtrak-operated territories with an Amtrak passenger train striking on-track maintenance equipment. In both accidents, postaccident toxicology testing indicated the use of drugs by Amtrak employees (Chester 1: marijuana, cocaine, and methamphetamines, Chester 2: marijuana, cocaine, opioids/opiates [morphine, oxycodone, codeine]). Contributing to both accidents was the lack of secondary protection because of a failure of the operating rules. Evidence in both accidents shows that Amtrak management had failed to provide employees with the equipment and training to reliably shunt track. Further, in both accidents organizational issues included employee fear of disciplinary actions that rendered safety management systems ineffective caused by a fear of disciplinary actions, prioritizing on-time performance over safety, overreliance on operating rules, and ineffective utilization of the safety department. On January 29, 1988, about 12:36 a.m. eastern standard time, northbound Amtrak Train 66, the Night Owl, struck MOW equipment on track 2 in Chester, Pennsylvania. The accident caused serious injuries to the engineer of train 66, and 8 crewmembers and 15 passengers received minor injuries. The major safety issues identified in this accident concerned the manner in which Amtrak provided protection from intrusions onto out-of-service tracks. The specific issues include Amtrak’s use of blocking devices and train orders to take tracks out-of-service; Amtrak’s use of insulated maintenance-of-way equipment; the lack of redundancy in the operating rules to provide protection from undesired intrusions into out-of-service tracks; the failure of the tower operator and train dispatcher to comply with Amtrak’s operating rules; Amtrak efficiency checks of tower operators and train dispatchers; Amtrak’s selection standards and procedures for the position of tower operator; and the injury-producing features of the interior of Amtrak passenger cars. The National Transportation Safety Board determined that the probable cause of that accident was the failure of the third-shift tower operator at Hook tower, because of impairment by drugs or distraction or both, to operate the 7 switch to allow train 66 to cross over from track 2 to track 1 and the failure of Amtrak to provide positive protection for on-track equipment and out-of-service tracks. Contributing to the accident was Amtrak’s failure to adequately monitor the activities and job performance of the tower operator.

NTSB Railroad Accident Report

78 References Amtrak (National Railroad Passenger Corporation). 2016. Northeast Corridor Employee Timetable No. 6, Includes Special Instructions, effective February 22, 2016. Washington, DC: Amtrak. Bergamaschi, Mateus M., Erin L. Karschner, Robert S. Goodwin, Karl B. Scheidweiler, Jussi Hirvonen, Regina H.C. Queiroz, and Marilyn A. Huestis. 2013.“Impact of Prolonged Cannabinoid Excretion in Chronic Daily Cannabis Smokers’ Blood on Per Se Drugged Driving Laws.” Clinical Chemistry 59 (3): 519–526. Federal Aviation Administration (FAA) website. “Safety Management System.” Washington, DC: US Department of Transportation, Federal Aviation Administration. FAA's Safety Management System Initiative (https://www.faa.gov/about/initiatives/sms/). -----. 2012. Vol. 77, no. 161 (September 7). -----. 2012. Vol. 77, no. 174 (September 7). -----. 2016. Vol. 81, no. 112 (June 20). -----. 2016. Vol. 81, no. 156, (August 12). -----. 2016. Vol. 81, no. 156, (August 12). -----. 2017. Vol. 82, No. 108, (June 7). FRA (Federal Railroad Administration). 2014. Track and Rail and Infrastructure Integrity Compliance Manual, Volume III Railroad Workplace Safety, Chapter 3 Roadway Worker Protection. Washington, DC: US Department of Transportation, FRA. Roadway Worker Protection Compliance Manual (https://www.fra.dot.gov/eLib/details/L18608). Hirschhorn, L. 1993. “Hierarchy vs. bureaucracy: The Case of a Nuclear Reactor.” In New Challenges to Understanding Organizations. Edited by Karlene H. Roberts. New York: McMillan. NORAC (Northeast Operating Rules Advisory Committee). 2011. Operating Rules, 10th edition, effective November 6, 2011. NORAC. NTSB (National Transportation Safety Board). 1989. Collision of Amtrak Train 66, the Night Owl, with On-Track Maintenance-of-Way Equipment, Chester, Pennsylvania, January 29, 1988. RAR-89/01. Washington, DC: NTSB. -----. 2008. Collision of Massachusetts Bay Transportation Authority Train 322 and Track Maintenance Equipment near Woburn, Massachusetts, January 9, 2007. RAR-08/01. Washington, DC: NTSB.

NTSB Railroad Accident Report

79 -----. 2010. Midair Collision Over Hudson River, Piper PA-32R-300, N71MC and Eurocopter AS350BA, N401LH Near Hoboken, New Jersey, August 8, 2009. AAR-10/05.Washington, DC: NTSB. -----. 2012. Highway-Railroad Grade Crossing Collision, US Highway 95, Miriam, Nevada, June 24, 2011. HAR-12/03. Washington, DC: NTSB. -----. 2014a. Metro-North Railroad Employee Fatality in West Haven, Connecticut, May 28, 2013. RAB-14/10. Washington, DC: NTSB. -----. 2014b. Special Investigation Report on Railroad and Rail Transit Roadway Worker Protection. SIR-14/03. Washington, DC: NTSB. -----. 2014c. Organizational Factors in Metro-North Railroad Accidents. SIR-14/04. Washington, DC: NTSB. Reason, James. 1997. Managing the Risk of Organizational Accidents. Aldershot, England: Ashgate Publishing Limited. -----. 2013. A Life in Error: From Little Slips to Big Disasters. Burlington, Vermont: Ashgate Publishing Limited. -----. 2016. Organizational Accidents Revisited. Boca Raton, Florida: CRC Press. Woods, David D., Sidney Dekker, Richard Cook, Leila Johannesen, and Nadine Sarter. 2010. Behind Human Error (2nd Edition). Burlington, Vermont: Ashgate Publishing Limited.

FD07488 ｜ 2018_美国_AAR1801.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Uncontained Engine Failure and Subsequent Fire American Airlines Flight 383 Boeing 767-323, N345AN Chicago, Illinois October 28, 2016

Accident Report NTSB/AAR-18/01 PB2018-100344

National Transportation Safety Board

NTSB/AAR-18/01 PB2018-100344 Notation 57292 Adopted January 30, 2018

Aircraft Accident Report Uncontained Engine Failure and Subsequent Fire American Airlines Flight 383 Boeing 767-323, N345AN Chicago, Illinois October 28, 2016

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2018. Uncontained Engine Failure and Subsequent Fire, American Airlines Flight 383, Boeing 767-323, N345AN, Chicago, Illinois, October 28, 2016. NTSB/AAR-18/01. Washington, DC. Abstract: This report discusses the October 28, 2016, accident involving American Airlines flight 383, a Boeing 767-323, which experienced an uncontained failure of the right engine and subsequent fire during its takeoff ground roll at Chicago O’Hare International Airport, Chicago, Illinois. Of the 2 flight crewmembers, 7 flight attendants, and 161 passengers on board, 1 passenger received a serious injury and 1 flight attendant and 19 passengers received minor injuries during the emergency evacuation. The airplane was substantially damaged from the fire. Safety issues identified in this report include the lack of recent guidance comparing production inspection processes for nickel alloy engine components, the need for improved in-service inspection techniques for critical rotating parts of all engines, the lack of recent guidance about design precautions to minimize hazards resulting from uncontained engine failures, the need for separate engine fire checklist procedures for ground operations and in-flight operations, the need for improved flight attendant training regarding assessing exits for evacuations and using interphone systems during emergencies, the need for research on the effects of evacuating with carry-on baggage, and the need for improved communication between flight and cabin crews during emergency situations, including evacuations. As a result of this investigation, the National Transportation Safety Board makes seven safety recommendations to the Federal Aviation Administration and one recommendation each to Boeing and American Airlines.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b). For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA17FA021 Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting: National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2018-100344 from: National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Aircraft Accident Report i Contents Figures ........................................................................................................................................... iii Tables ............................................................................................................................................ iv Abbreviations .................................................................................................................................v Executive Summary .................................................................................................................... vii

1. Factual Information ...................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Personnel Information ................................................................................................................4
4. 2.1 The Captain ......................................................................................................................4
5. 2.2 The First Officer ..............................................................................................................6
6. 2.3 The Flight Attendants ......................................................................................................7
7. 3 Airplane and Engine Information ..............................................................................................7
8. 3.1 High-Pressure Turbine Stage 2 Disk Manufacturing Process .........................................8
9. 3.1.1 Triple-Melt Process ............................................................................................9
10. 3.1.2 Ultrasonic Inspection Process ..........................................................................11
11. 3.1.3 Manufacture History of Accident HPT Stage 2 Disk ......................................13
12. 3.2 Accident Engine Maintenance Events ...........................................................................14
13. 3.3 Postaccident Engine Observations .................................................................................15
14. 3.4 Metallurgical Examinations ...........................................................................................18
15. 4 Tests and Research ...................................................................................................................22
16. 4.1 Number of Flight Cycles in Low-Cycle Fatigue Regions .............................................22
17. 4.2 Ultrasonic Response Characteristics of Discrete Dirty White Spots .............................23
18. 5 Survival Aspects ......................................................................................................................24
19. 5.1 Interphone Communication System ..............................................................................24
20. 5.2 Evacuation .....................................................................................................................27
21. 6 Organizational Information ......................................................................................................30
22. 6.1 American Airlines Flight Crew Manuals .......................................................................30
23. 6.1.1 Engine Fire Checklist .......................................................................................30
24. 6.1.2 Evacuation Guidance .......................................................................................31
25. 6.1.3 Evacuation Checklist .......................................................................................33
26. 6.1.4 Evacuation Duties ............................................................................................34
27. 6.2 American Airlines Flight Attendant Manual .................................................................35
28. 6.3 American Airlines Training ...........................................................................................36
29. 6.3.1 Flight Crew Training........................................................................................36
30. 6.3.2 Flight Attendant Training ................................................................................37
31. 6.4 American Airlines Operating Manual—Engine Fire Warning System .........................37
32. 6.5 Boeing ............................................................................................................................38
33. 6.6 Federal Aviation Administration ...................................................................................39
34. 6.6.1 Advisory Circular 20-128 ................................................................................39
35. 6.6.2 Inspection Techniques for Nickel Billets .........................................................41

NTSB Aircraft Accident Report ii 1.6.6.3 Definition of Stealth Anomalies ......................................................................41 1.6.6.4 Notice of Proposed Rulemaking ......................................................................42 1.7 Additional Information ............................................................................................................43 1.7.1 Discrete White Spot Formation .....................................................................................43 1.7.2 Master Heat FA94 ..........................................................................................................43 1.7.3 Previous Related Safety Recommendations ..................................................................44 1.7.3.1 Recommendations From United Airlines Flight 232 Accident .......................44 1.7.3.2 Communication and Coordination Among Flight and Cabin Crews ...............46 1.7.3.3 Retrieval of Carry-On Baggage .......................................................................48

1. Analysis .....................................................................................................................................50
2. 1 Accident Sequence ...................................................................................................................50
3. 2 Checklist Issues ........................................................................................................................52
4. 2.1 Decision to Perform Engine Fire Checklist ...................................................................52
5. 2.2 Engine Fire Checklist Design ........................................................................................53
6. 3 Evacuation Issues .....................................................................................................................55
7. 3.1 Evacuation Sequence .....................................................................................................55
8. 3.2 Flight and Cabin Crew Communication ........................................................................57
9. 3.2.1 Interphone Issues .............................................................................................59
10. 3.2.2 Recurring Evacuation-Related Issues ..............................................................61
11. 3.3 Flight and Cabin Crew Evacuation Duties ....................................................................64
12. 3.4 Carry-On Baggage Issue ................................................................................................65
13. 4 High-Pressure Turbine Stage 2 Disk Failure ...........................................................................66
14. 4.1 Discrete Dirty White Spot Detection During Manufacturing ........................................67
15. 4.2 American Airlines Inspection of High-Pressure Turbine Stage 2 Disk .........................69
16. 4.3 Guidance on Design Precautions to Minimize Rotor Burst Hazards ............................71
17. Conclusions ...............................................................................................................................75
18. 1 Findings....................................................................................................................................75
19. 2 Probable Cause.........................................................................................................................76
20. Recommendations ....................................................................................................................77
21. 1 New Recommendations ...........................................................................................................77
22. 2 Previously Issued Recommendations Reiterated in This Report .............................................78
23. 3 Previously Issued Recommendation Classified in This Report ...............................................78
24. Appendixes................................................................................................................................80

Appendix A: Investigation .............................................................................................................80 Appendix B: Cockpit Voice Recorder Transcript ..........................................................................81 References .....................................................................................................................................90

NTSB Aircraft Accident Report iii Figures Figure 1. Right side of airplane after uncontained engine failure and subsequent fire. ................ 4 Figure 2. HPT rotor. ...................................................................................................................... 8 Figure 3. Vacuum arc remelting process. ................................................................................... 11 Figure 4. Longitudinal wave scan used during ultrasonic inspections. ...................................... 12 Figure 5. Main fragments of the HPT stage 2 disk (forward side). ............................................ 16 Figure 6. Disk fragment locations. .............................................................................................. 17 Figure 7. Holes located forward and aft of the right wing front spar. ........................................ 17 Figure 8. Engine cross-section and fracture origin location. ...................................................... 19 Figure 9. Fracture surface from disk fragment A........................................................................ 19 Figure 10. Discrete dirty white spot in fracture surface. ............................................................. 21 Figure 11. Stringer in material microstructure. ........................................................................... 21 Figure 12. Fatigue cracks that initiated from discrete dirty white spot. ...................................... 22 Figure 13. N345AN configuration. ............................................................................................. 24 Figure 14a. Classic model interphone......................................................................................... 25 Figure 14b. New model interphone. ........................................................................................... 26 Figure 15. Engine fire handles. ................................................................................................... 31

NTSB Aircraft Accident Report iv Tables Table 1. Flight attendant position, initial new hire date, and last recurrent training date. ............ 7 Table 2. Evacuation events shown on videos of left side of airplane. ........................................ 27 Table 3. Summaries of flight attendant evacuation actions. ....................................................... 28

NTSB Aircraft Accident Report v Abbreviations AAIB Air Accidents Investigation Branch AC advisory circular AD airworthiness directive AIA Aerospace Industries Association APU auxiliary power unit ARAC aviation rulemaking advisory committee ARFF aircraft rescue and firefighting ATC air traffic control ATI SM ATI Specialty Materials ATSB Australian Transportation Safety Board BOS General Edward Lawrence Logan International Airport CFR Code of Federal Regulations CLT Charlotte/Douglas International Airport CRM crew resource management CVR cockpit voice recorder ECI eddy current inspection EDT eastern daylight time EICAS engine indicating and crew alerting system ESN engine serial number FAA Federal Aviation Administration FDR flight data recorder FPI fluorescent penetrant inspection GE General Electric HPT high-pressure turbine JFK John F. Kennedy International Airport MIA Miami International Airport MTU Motoren- und Turbinen-Union GmbH NPRM notice of proposed rulemaking NTSB National Transportation Safety Board ORD Chicago O’Hare International Airport

NTSB Aircraft Accident Report vi PA public address [system] POI principal operations inspector QRH quick reference handbook RTO rejected takeoff SAFO safety alert for operators SB service bulletin SEM scanning electron microscope TWA Trans World Airlines UPS United Parcel Service V1 takeoff decision speed

NTSB Aircraft Accident Report vii Executive Summary On October 28, 2016, about 1432 central daylight time, American Airlines flight 383, a Boeing 767-323, N345AN, had started its takeoff ground roll at Chicago O’Hare International Airport, Chicago, Illinois, when an uncontained engine failure in the right engine and subsequent fire occurred. The flight crew aborted the takeoff and stopped the airplane on the runway, and the flight attendants initiated an emergency evacuation. Of the 2 flight crewmembers, 7 flight attendants, and 161 passengers on board, 1 passenger received a serious injury and 1 flight attendant and 19 passengers received minor injuries during the evacuation. The airplane was substantially damaged from the fire. The airplane was operating under the provisions of 14 Code of Federal Regulations Part 121. Visual meteorological conditions prevailed at the time of the accident. The uncontained engine failure resulted from a high-pressure turbine (HPT) stage 2 disk rupture. The HPT stage 2 disk initially separated into two fragments. One fragment penetrated through the inboard section of the right wing, severed the main engine fuel feed line, breached the fuel tank, traveled up and over the fuselage, and landed about 2,935 ft away. The other fragment exited outboard of the right engine, impacting the runway and fracturing into three pieces. Examination of the fracture surfaces in the forward bore region of the HPT stage 2 disk revealed the presence of dark gray subsurface material discontinuities with multiple cracks initiating along the edges of the discontinuities. The multiple cracks exhibited characteristics that were consistent with low-cycle fatigue. (In airplane engines, low-cycle fatigue cracks grow in single distinct increments during each flight.) Examination of the material also revealed a discrete region underneath the largest discontinuity that appeared white compared with the surrounding material. Interspersed within this region were stringers (microscopic-sized oxide particles) referred to collectively as a “discrete dirty white spot.” The National Transportation Safety Board’s (NTSB) investigation found that the discrete dirty white spot was most likely not detectable during production inspections and subsequent in-service inspections using the procedures in place. The NTSB’s investigation also found that the evacuation of the airplane occurred initially with one engine still operating. In accordance with company procedures and training, the flight crew performed memory items on the engine fire checklist, one of which instructed the crew to shut down the engine on the affected side (in this case, the right side). The captain did not perform the remaining steps of the engine fire checklist (which applied only to airplanes that were in flight) and instead called for the evacuation checklist. The left engine was shut down as part of that checklist. However, the flight attendants had already initiated the evacuation, in accordance with their authority to do so in a life-threatening situation, due to the severity of the fire on the right side of the airplane. The NTSB identified the following safety issues as a result of this accident investigation: • Lack of recent guidance comparing production inspection processes for nickel alloy engine components. The HPT stage 2 disk was made of a nickel-based alloy. Ultrasonic inspections are typically performed during the manufacture of nickel alloy engine components to detect internal defects (such as cracks and voids) in the material. However,

NTSB Aircraft Accident Report viii the discrete dirty white spot, which is consistent with the description of a “stealth” anomaly in a 2008 Federal Aviation Administration (FAA) report on turbine rotor material design, was most likely not detectable by the ultrasonic inspection methods used during production of the HPT stage 2 disk. A 2005 FAA report that presented the results of industry’s research about nickel billet inspections found that enhanced ultrasonic inspection techniques, such as multizone and phased array inspections, could better detect internal defects than conventional ultrasonic inspection techniques. The report also stated that multizone inspection techniques were being used for titanium engine parts but that conventional ultrasonic inspection techniques were still being used for nickel engine parts during manufacturing. Additional FAA and industry efforts are needed to evaluate the appropriateness of current and enhanced inspection technologies for nickel engine parts. Updated FAA guidance describing the results of such evaluations would benefit those involved with the inspection process for nickel alloy rotating engine components. • Need for improved in-service inspection techniques for critical rotating parts of all engines. In January 2011, American Airlines performed maintenance—an eddy current inspection (ECI) and a fluorescent penetrant inspection (FPI)—of the forward bore region of the HPT stage 2 disk with no anomalies found. (American Airlines did not have another opportunity to inspect the disk before the accident because no engine maintenance between January 2011 and the time of the accident involved disassembling the HPT stage 2 disk.) These inspection techniques were not capable of detecting the cracks that emanated from the discrete dirty white spot (a subsurface anomaly) because they could only detect cracks and other anomalies at the surface (FPI) and near the surface (ECI) of a material. Although ultrasonic inspections might be limited in their capability to detect anomalies during the production stage, such a subsurface inspection technique would be appropriate for in-service maintenance because of the propensity for cracks to propagate over time. If a subsurface ultrasonic inspection had been required at the time of the disk’s last inspection, the cracks that developed from the discrete dirty white spot would most likely have been detectable because of the size of the cracks at that time and the sensitivity of ultrasonic inspection techniques. In September 2017, the FAA issued a notice of proposed rulemaking to mandate the ultrasonic inspection of HPT stage 1 and 2 disks of General Electric CF6-80-series turbofan engines (the model engine on the accident airplane). The proposed airworthiness directive would be an appropriate step for ensuring the continued airworthiness of airplanes with those engines, but the FAA has not addressed ultrasonic inspections on other engine models during in-service maintenance to ensure their continued airworthiness. • Lack of recent guidance about design precautions to minimize hazards resulting from uncontained engine failures. In March 1997, the FAA issued Advisory Circular (AC) 20-128A, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.” The AC provided rotor burst and blade release fragment trajectory data so that airframe manufacturers could integrate appropriate design precautions to minimize hazards to an airplane and its occupants. The AC also contained specific information about accepted design precautions to reduce the overall risk of an uncontrolled fire for airplanes with fuel tanks located in impact areas.

NTSB Aircraft Accident Report ix Since the time that the AC was issued, numerous uncontained disk rupture events have occurred, and lessons learned from these events could be incorporated into more robust guidance, including updated trajectory analyses, for airframe manufacturers to use when considering design mitigations for minimizing hazards resulting from uncontained engine failures. Also, even though the flight 383 accident airplane had design mitigations for reducing the overall risk of an uncontrolled fire that were consistent with the AC’s guidance, the uncontained engine failure resulted in a subsequent fire. • Need for separate engine fire checklist procedures for ground operations and in-flight operations. American Airlines’ engine fire checklist for the Boeing 767 (which was based on Boeing’s engine fire checklist procedure) delayed the flight crew from initiating the evacuation checklist, shutting down the left engine, and commanding an evacuation. The engine fire checklist did not differentiate between an engine fire in flight and an engine fire while the airplane was on the ground and did not include a step, for an engine fire on the ground, to shut down the unaffected engine or perform the evacuation checklist sooner. Also, the engine fire checklist included a 30-second wait time between discharging the first fire extinguishing bottle and determining if the second bottle would also need to be discharged. Engine fire checklists that are specific to ground operations generally instruct flight crews to discharge both fire extinguisher bottles about the same time, which could be critical for containing a fire and/or commanding an evacuation. • Need for improved flight attendant training regarding assessing exits for evacuations and using interphone systems during emergencies. As the evacuation was unfolding, three flight attendants stationed on the right side of the airplane blocked their assigned exits because they recognized that the engine fire would present a danger. A flight attendant stationed on the left side of the airplane blocked her assigned exit until the left engine was shut down. However, another flight attendant stationed on the left side of the airplane assessed the conditions outside the airplane yet opened the left overwing exit while the engine was still operating. The one serious injury that resulted during the evacuation occurred after a passenger evacuated using the left overwing exit. Once on the ground, the passenger stood up to get away from the airplane but was knocked down by the jet blast coming from the left engine. American Airlines 767-300-series airplanes are equipped with one of two interphone system models, which operate differently. After the accident airplane came to a stop, one flight attendant tried to use the interphone to alert the flight crew that the left engine was still operating but was unsuccessful because she operated the interphone incorrectly. Also, another flight attendant tried to use the interphone to make an announcement to the passengers but could not recall how to use the interphone. The NTSB could not determine, based on the available evidence, if the flight attendants’ difficulty operating the interphone was directly related to training deficiencies or the stress associated with the situation. However, the interphone system model installed on the accident airplane was not installed on American Airlines’ 767 simulators used for flight attendant training. Further, although company flight attendants were trained on interphone systems during initial training, airplane differences training, and recurrent training, the subject was presented during recurrent training without providing flight attendants with hands-on experience using an interphone during an emergency.

NTSB Aircraft Accident Report x • Need for research on the effects of evacuating with carry-on baggage. Video taken during the evacuation and postaccident interviews with flight attendants indicated that some passengers evacuated from all three usable exits with carry-on baggage despite instructions to leave the bags. Although the NTSB has not identified any accident evacuations in which delays related to carry-on baggage caused injuries, passengers evacuating airplanes with carry-on baggage has been a recurring safety concern. The NTSB is not aware of any study that measured the potential delays associated with passengers retrieving and carrying baggage during an emergency evacuation. The results of such a study could help determine appropriate countermeasures to mitigate any potential safety risks. • Need for improved communication between flight and cabin crews during emergency situations, including evacuations. The flight crew did not communicate with the flight attendants to relay its intent not to immediately evacuate. The flight attendants had both the evacuation signaling system and the interphone system available to them to alert the flight crew that an evacuation was underway, but none of the flight attendants activated the signaling system, and only two of the seven flight attendants attempted (unsuccessfully) to communicate with the flight crew using the interphone system. Even with an unfolding emergency, there should have been better communication between the flight and cabin crews. The NTSB has a long history of investigating accidents (including three other accident investigations within the last 2 years) in which communication between flight and cabin crews during an evacuation was inadequate and issuing related safety recommendations in response. However, the FAA has not yet acted on a 2009 safety recommendation to revise related guidance (issued in 1988) to reflect the most recent industry knowledge on the subject based on research and lessons learned from relevant accidents and incidents. In addition, the FAA has not yet established a multidisciplinary working group, in response to a 2016 recommendation, to develop best practices to resolve recurring evacuation-related issues. It is time for the FAA to emphasize the importance of ensuring that flight and cabin crew communications can facilitate safe and effective decision-making and action during emergency situations. The NTSB determines that the probable cause of this accident was the failure of the HPT stage 2 disk, which severed the main engine fuel feed line and breached the right main wing fuel tank, releasing fuel that resulted in a fire on the right side of the airplane during the takeoff roll. The HPT stage 2 disk failed because of low-cycle fatigue cracks that initiated from an internal subsurface manufacturing anomaly that was most likely not detectable during production inspections and subsequent in-service inspections using the procedures in place. Contributing to the serious passenger injury was (1) the delay in shutting down the left engine and (2) a flight attendant’s deviation from company procedures, which resulted in passengers evacuating from the left overwing exit while the left engine was still operating. Contributing to the delay in shutting down the left engine was (1) the lack of a separate checklist procedure for Boeing 767 airplanes that specifically addressed engine fires on the ground and (2) the lack of communication between the flight and cabin crews after the airplane came to a stop.

NTSB Aircraft Accident Report xi As a result of this investigation, the NTSB makes safety recommendations to the FAA, Boeing, and American Airlines.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1 History of Flight

On October 28, 2016, about 1432 central daylight time, American Airlines flight 383, a Boeing 767-323, N345AN, had started its takeoff ground roll at Chicago O’Hare International Airport (ORD), Chicago, Illinois, when an uncontained engine failure in the right engine and subsequent fire occurred.1 The flight crew aborted the takeoff and stopped the airplane on the runway, and the flight attendants initiated an emergency evacuation. Of the 2 flight crewmembers, 7 flight attendants, and 161 passengers on board, 1 passenger received a serious injury and 1 flight attendant and 19 passengers received minor injuries during the evacuation. The airplane was substantially damaged from the fire. A section of the high-pressure turbine (HPT) stage 2 disk burst and penetrated through the inboard section of the right wing and was recovered in a United Parcel Service (UPS) warehouse about 2,935 ft from the location where the uncontained engine failure occurred. The airplane was operating under the provisions of 14 Code of Federal Regulations (CFR) Part 121. Visual meteorological conditions prevailed at the time of the accident. Flight 383 was a scheduled passenger flight to Miami International Airport (MIA), Miami, Florida.2 The flight crew’s duty day began in ORD at 1320, with a scheduled departure time to MIA 1 hour later. The captain was the pilot flying, and the first officer was the pilot monitoring. The captain taxied the airplane to runway 28R for a takeoff from the intersection of the runway with taxiway N5. Runway 28R was 13,000 ft long and 150 ft wide, and the available length from the N5 intersection was 9,750 ft. According to the cockpit voice recorder (CVR), at 1430:57, the tower controller cleared the airplane for takeoff, and the first officer acknowledged this instruction.3 At 1431:19, the CVR recorded a sound similar to increasing engine rpm, and the flight data recorder (FDR) indicated that the engines achieved takeoff power at 1431:24.4 During a postaccident interview, the flight

1 (a) All times in this report are central daylight time unless otherwise noted. (b) An uncontained failure of a turbine engine “is any failure which results in the escape of rotor fragments from the engine or APU [auxiliary power unit] that could result in a hazard,” according to Federal Aviation Administration (FAA) Advisory Circular (AC) 20-128A, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.” 2 This flight was the first of two planned sequences that day for the flight crewmembers; they were also scheduled to fly from MIA to ORD. On the day before the accident, the flight crew flew one sequence, from MIA to ORD. The captain reported that he and the first officer had flown together several times before that flight, most recently at the beginning of October 2016. 3 The airplane was equipped with an L-3/Fairchild FA2100-1020 solid-state CVR, which records at least the last 2 hours of digital audio. The CVR records audio information from five channels—the captain’s, first officer’s, and observer’s audio panels; a mixed crew audio panel; and the cockpit area microphone. Each of the channels contained either excellent- or good-quality audio information, and a transcript was prepared for the final 2 minutes 42 seconds of the recording. (See appendix B for the transcript and descriptions of excellent- and good-quality audio.) The transcript begins at 1430:29, just before the airplane turned onto runway 28R, and ends at 1433:12. 4 The airplane was also equipped with an L-3/Fairchild FA2100 256 wps FDR. The recorder was in good condition, and the data were extracted normally from the recorder using the manufacturer’s recommended procedures.

NTSB Aircraft Accident Report 2 crew described the engine spool-up (as thrust advanced to the predetermined reduced power setting for takeoff) as “normal.” At 1431:32, the first officer made a routine callout indicating that the airplane’s airspeed was 80 knots. FDR data showed that, at 1431:43.4 and with the airplane’s airspeed indicating 128 knots, the longitudinal acceleration decreased suddenly from 0.23 to 0.13 G, and variations in the vertical acceleration increased in magnitude, consistent with a sudden engine imbalance causing a vibration force on the airframe.5 About the same time, the CVR recorded a “bang” sound and the captain’s statement “whoa.” Both flight crewmembers reported hearing the sound and feeling the airplane drift to the right. At that time, the airplane was about 3,300 ft from the N5 intersection. The captain initiated the rejected takeoff maneuver; FDR data showed that the throttles were moved to idle power at 1431:45.6 One second later, the autobrakes, which for takeoff had been selected in the “RTO” (rejected takeoff) position, activated.7 At that time, the airplane’s airspeed was 134 knots, which was also the calculated takeoff decision speed (V1). The auto speedbrakes activated about 2 seconds after the autobrakes.8 In a postaccident statement, the captain indicated that he rejected the takeoff because he thought that the airplane was “unable/unsafe to fly.”9 At 1431:50, the first officer contacted the air traffic control (ATC) tower and stated that the airplane would be “stopping on the runway,” and the tower controller responded, “roger roger fire,” which was the flight crew’s first indication that a fire had begun. The first officer asked the controller if he saw any smoke or fire, and the controller stated, “yeah, fire off the right wing.”10 At 1432:00, the CVR recorded the first officer stating, “okay, send out the [fire] trucks,” and a

About 56 hours of operational data were retained on the recording medium, including about 11 minutes of data from the accident flight, from 1422:15 to 1433:09. 5 (a) G is a unit of measurement of acceleration and deceleration. One G is equivalent to the acceleration caused by the earth’s gravity (about 32.2 ft/sec2). (b) FDR data indicated that, between 1431:21 and 1431:37, the airplane reached a steady longitudinal acceleration of about 0.25 G. Between 1431:37 and 1431:43, the longitudinal acceleration began to slowly decrease. When the longitudinal acceleration decreased suddenly at 1431:43, the vertical acceleration also decreased, from 1.14 to 0.97 G. The vertical acceleration before that time had basically been steady— between 0.98 and 1.02 G. 6 The CVR recorded a sound similar to throttles contacting idle stops and a sound similar to a decrease in engine rpm. 7 Autobrakes are selected in the RTO position during takeoff to provide maximum braking in the event of a rejected takeoff. During a postaccident interview, the captain described the performance of the RTO autobrake system as an “aggressive stop.” 8 During that time, the FDR recorded the flight’s maximum airspeed—135 knots—which decreased by 15 knots by 1431:49. 9 American Airlines 767 Operations Manual, QRH (Quick Reference Handbook) indicated that a rejected takeoff was a “non-normal maneuver.” According to the QRH, “the captain has the sole responsibility for the decision to reject the takeoff. The decision must be made in time to start the rejected takeoff maneuver by V1. If the decision is to reject the takeoff, the captain must clearly announce ‘REJECT,’ immediately start the rejected takeoff maneuver, and assume control of the airplane.” The QRH also stated that a takeoff should be rejected between 80 knots and V1 if an engine failure, fire, or fire warning occurred or if the airplane was unsafe or unable to fly and that “the crew member observing the non-normal situation will immediately call it out as clearly as possible.” 10 National Transportation Safety Board (NTSB) investigators sat in the first officer’s seat in an exemplar American Airlines 767 airplane to determine whether the right wing and right engine could be viewed from that position. The investigators found that the right wingtip was visible only when the occupant’s head was pressed against the closed right-side cockpit window. The right engine was not visible with the right-side cockpit window closed. The right engine was visible with the window opened to allow the occupant to look outside the fuselage.

NTSB Aircraft Accident Report 3 sound similar to the engine fire warning. FDR data showed that the engine indicating and crew alerting system (EICAS) warning message “ENG FIRE R” had annunciated at the same time and that the airplane had decelerated to an airspeed of 35 knots.11 The tower controller indicated that he would send emergency vehicles, and the captain called for the engine fire checklist (which included five memory items) at 1432:04.1, 20.6 seconds after the CVR recorded the “bang” sound. FDR data showed that the airplane came to a stop at 1432:09.8, which was 26.4 seconds after the right engine failure. The captain reported that he could smell smoke “as soon as [the airplane] came to a stop.” As part of the engine fire checklist, the fuel switch for the right engine was shut off. Also, the first officer pulled the right engine fire handle, and he later rotated the handle to release the contents of one of the fire extinguisher bottles into the right engine.12 The left engine remained at idle power. At 1432:41, the captain stated, “oh look at the smoke—check out the smoke.” The CVR recording indicated that, at 1432:45, the captain called for the evacuation checklist; the first officer acknowledged the instruction about 1.5 seconds later. The first officer announced the items on the evacuation checklist, and the captain accomplished the items. The second and third steps in the checklist depressurized the airplane, and the captain stated, during a postaccident interview, that it took “a long time” for the airplane to depressurize.13 While performing the checklist, the captain could hear “commotion” outside the cockpit door and realized that the flight attendants had begun an evacuation. The captain stated that, after completing the fourth step in the checklist—to shut down the left engine—he made an announcement to the cabin to evacuate and activated the emergency evacuation signal switch.14 The captain then completed the remaining steps of the evacuation checklist and exited the cockpit, at which time both flight crewmembers observed “a lot of smoke” in the cabin. After exiting the cockpit, the flight crewmembers were met by the lead flight attendant, who informed them that all passengers and the other flight attendants were off the airplane. (Section 1.5.2 describes the evacuation.) The first officer then evacuated the airplane, followed by the lead flight attendant and the captain. After evacuating the airplane, the captain used his personal cell phone to contact American Airlines dispatch to obtain the total count of occupants on board

11 Also at 1432:00, the master WARNING light (on the glareshield in front of each pilot) illuminated. 12 The left and right engine fire handles (for the left and right engines, respectively) were located on the engine fire control panel, which was located on the center console in the cockpit (as shown in section 1.6.1.1). According to American Airlines’ 767 Operations Manual, QRH, “Fire Protection,” the airplane was equipped with two fire extinguisher bottles. One or both bottles, which contained halon, could be discharged into either engine. The FDR parameter for the right engine fire extinguisher bottle activated at 1432:12. (The FDR records when the fire handle is pulled for the first time; the FDR does not record when each fire extinguisher bottle discharges.) Postaccident examination of the fire extinguisher bottles showed that, according to the data in their labels, each weighed about 24 pounds at the time of installation. The weight of both bottles after removal from the airplane was about 10.5 pounds. 13 According to the CVR, the first officer announced the checklist item to depressurize the airplane at 1432:57. (This issue is further discussed in section 2.2.1.) The first officer announced the next evacuation checklist item—to cut off the fuel control switches—at 1433:07. 14 At 1433:10, the CVR recorded the first officer prompting the captain (as part of the evacuation checklist) to make a public address (PA) system announcement to evacuate the passenger cabin; this transmission was interrupted by the sound of a “thunk” 1 second later. The evacuation signal switch was on the emergency evacuation command panel, which was located on the overhead panel above the captain’s head. The signal was intended to alert the flight attendants to evacuate the cabin.

NTSB Aircraft Accident Report 4 for first responders. The 20 injured passengers were transported to local hospitals to receive treatment, and all were released within 24 hours.15 The fire was extinguished by aircraft rescue and firefighting (ARFF) vehicles. According to ARFF, aqueous film-forming foam was first applied within 2 minutes 51 seconds after notification of the fire.16 Most of the fire damage was contained to the right engine, the right wing, portions of the right fuselage, and the right horizontal stabilizer. Figure 1 shows the accident airplane after the fire was extinguished. Figure 1. Right side of airplane after uncontained engine failure and subsequent fire. The airplane’s final position on runway 28R was about 5,975 ft from the N5 intersection (where the takeoff roll began) with about 3,775 ft of runway remaining. Braking marks from the left and right main landing gear tires were observed on the runway surface starting about 3,961 ft from the N5 intersection. The braking marks continued for about 2,284 ft to the airplane’s final position on the runway. 1.2 Personnel Information 1.2.1 The Captain The captain, age 61, held an airline transport pilot certificate with a multiengine land rating and an FAA first-class medical certificate dated May 4, 2016, with no limitations. The captain received a type rating for the Boeing 757 and 767 on March 31, 1995. The captain was employed at Trans World Airlines (TWA) from January 1986 to April 2001 and has been employed by American Airlines since May 2001 (when AMR Corporation, the parent company of American Airlines, acquired TWA). He had been a captain on

15 The flight attendant who received a minor injury was not transported to the hospital but instead went to the ORD medical office. 16 According to the Bureau of Operations, Chicago Fire Department, 21 vehicles (including 8 ARFF units) and 56 personnel responded to the crash/fire alert on runway 28R.

NTSB Aircraft Accident Report 5 the 767 for about 2.5 years before the accident.17 The captain estimated that he had accumulated about 17,400 hours of total flight time, including about 4,000 hours on the 767 and about 1,500 hours as 767 pilot-in-command. He had flown about 157, 59, 12, and 3 hours in the 90, 30, and 7 days and 24 hours, respectively, before the accident. The captain’s last line check occurred on October 21, 2015, and his last recurrent ground training occurred on March 20, 2016. FAA records indicated no accident or incident history or enforcement action. The captain stated that he had never experienced an engine fire or performed a rejected takeoff during his career (except during simulator training). He also stated that he had never performed the evacuation checklist or commanded an evacuation on an actual flight. 72-Hour History According to postaccident interviews and company records, on October 25, 2016, the captain’s duty day started at 1400 eastern daylight time (EDT).18 He departed from BOS at 1502 EDT and arrived at Philadelphia International Airport, Philadelphia, Pennsylvania, at 1703 EDT and then deadheaded to Charlotte-Douglas International Airport (CLT), Charlotte, North Carolina, arriving at 2043 EDT. Afterward, he flew from CLT to JFK, arriving at 2338 EDT. He went to sleep about 0100 EDT on October 26. The captain did not recall his wakeup time on October 26, but he thought that he received 7 to 8 hours of sleep during the night. He left the hotel between 1400 and 1430 EDT and began his duty day at 1440 EDT. He flew from JFK to MIA, arriving at 1829 EDT. He described his duty day as “easy.” He spent the night at his residence near MIA. He did not recall the time that he went to sleep. On October 27, the captain awoke about 0900 EDT and began his duty day at 1550 EDT. He and the first officer departed MIA at 1706 EDT, arriving in ORD at 1943. The captain arrived at the hotel before 2000, got something to eat, and then used his computer until about 0000 on October 28 before going to sleep. The captain awoke between 0800 and 0900. He departed the hotel about 1235 for ORD, where his duty day began at 1320. The captain reported no problems falling or staying asleep in the days before the accident. He woke up each day feeling rested, including on the morning of the accident. His normal sleep pattern when off duty was to go to sleep between 2300 and 0000 and wake up about 0700. He did not take any prescription or nonprescription medicine in the 72 hours before the accident that might have affected his performance on the day of the accident. He did not use tobacco products or illicit drugs, and his only alcohol consumption during the time period was during dinner on October

17 Company records indicated that the captain upgraded to that position on the 767 on January 7, 2014. Before that time, he was an MD-80 captain; he received a type rating for the DC-9 (a variant of which is the MD-80) on July 13, 1998. 18 The captain flew a 3-day trip from October 24 to 26. On October 24, his duty day started at 1726 EDT. He flew from MIA to John F. Kennedy International Airport (JFK), Jamaica, New York, arriving at 2021, and then he deadheaded (traveled as a nonrevenue passenger) to General Edward Lawrence Logan International Airport (BOS), Boston, Massachusetts, arriving at 2346 EDT. He arrived at a hotel and went to sleep between about 0100 and 0130 EDT on October 25. The captain awoke between 0900 and 1000 EDT that day and left the hotel about 1330 EDT to begin his duty day.

NTSB Aircraft Accident Report 6 27.19 He considered his health to be “pretty good” and had no changes in his health, finances, or personal life in the 12 months before the accident that would have affected his performance on the day of the accident. 1.2.2 The First Officer The first officer, age 57, held an airline transport pilot certificate with a multiengine land rating and an FAA first-class medical certificate dated May 3, 2016, with a limitation that required him to possess glasses for near and intermediate vision. (During a postaccident interview, the first officer stated that he was wearing his glasses during the attempted takeoff.) The first officer received a type rating for the Boeing 757 and 767 on June 14, 2014. The first officer was employed at TWA between December 1995 and April 2001 and then American Airlines beginning in May 2001 (when AMR Corporation acquired TWA). He was furloughed in July 2003, recalled from furlough in March 2008, furloughed again in February 2010, and recalled from furlough again in December 2010.20 The first officer estimated that he had accumulated about 22,000 hours of total flight time, including about 1,600 hours on the 767. He had flown about 116, 78, 13, and 3 hours in the 90, 30, and 7 days and 24 hours, respectively, before the accident. The first officer’s last line check occurred on February 15, 2015, and his last recurrent ground training occurred on September 5, 2016. FAA records indicated no accident or incident history or enforcement action. 72-Hour History According to postaccident interviews and company records, the first officer was off duty from October 24 to 26, 2016.21 The first officer could not recall his sleep/wake times for the 3 days before the accident flight. On October 27, he commuted from his home in Tampa, Florida, to MIA and started his duty day at 1550 EDT. He flew from MIA to ORD with the captain, arriving at

1. He recalled going to sleep shortly after arriving at the hotel and not having any trouble falling

or staying asleep. He reported feeling rested when he awoke on October 28. His duty day began at 1320. The first officer stated that he usually slept about 7 hours each night and that he normally went to sleep early and woke up early. He did not take any prescription or nonprescription medication in the 72 hours before the accident that might have affected his performance on the day of the accident. He did not use tobacco products or illicit drugs and did not consume alcohol during the time period.22 He considered his health to be a “10 out of 10.” He had no changes in his health, finances, or personal life in the 12 months before the accident that would have affected his performance the day of the accident.

19 The results of postaccident drug and alcohol screening for the captain were negative. 20 During the first officer’s first furlough from American Airlines, he worked at Atlantic Southeast Airlines as a first officer and then a captain on the Bombardier CL-65. 21 The first officer was on duty from October 20 to 23. 22 The results of postaccident drug and alcohol screening for the first officer were negative.

NTSB Aircraft Accident Report 7 1.2.3 The Flight Attendants The flight was operated with seven flight attendants. Table 1 shows each flight attendant’s position, initial new hire date, and last recurrent training date before the accident. Section 1.5 provides information about the flight attendants’ seating positions within the cabin and their actions before and during the evacuation. Table 1. Flight attendant position, initial new hire date, and last recurrent training date. Flight attendant (FA) position Initial new hire date Last recurrent training date FA 1—Lead April 1988 April 2016 FA 2 November 1998 November 2015 FA 3 November 2014 November 2015 FA 4 July 1991 March 2016 FA 5 October 1989 July 2016 FA 6 April 1984 April 2016 FA 7 November 1989 October 2016 The lead flight attendant was the primary liaison between the captain and the flight attendants. According to American Airlines Flight Manual Part I, “Flight Attendant/Purser Briefing,” dated October 1, 2016, the lead flight attendant is responsible for promptly informing the captain of “all on-board cabin emergencies, irregular issues, passenger concerns, and cabin discrepancies.” 1.3 Airplane and Engine Information Boeing delivered the airplane involved in this accident, serial number 33084, to American Airlines on April 30, 2003; American Airlines records showed that the airplane was registered as N345AN on the same date. At the time of the accident, the airplane had 50,632 total flight hours and 8,120 total flight cycles.23 The airplane was equipped with two General Electric (GE) CF6-80C2B6 turbofan engines, with one engine mounted under each wing. The No. 1 (left) engine had accumulated 46,822 total hours and 7,299 total cycles, and the No. 2 (right) engine had accumulated 68,785 total hours and 10,984 total cycles. The CF6-80C2B6 is a dual-rotor, high-bypass ratio turbofan engine. The low-speed rotor (N1) consists of a large diameter fan and four low-pressure compressor booster stages that are interconnected to a five-stage low-pressure turbine rotor. The high-speed rotor (N2), which is located between the fan rotor/booster and the low-pressure turbine rotor, consists of a 14-stage high-pressure compressor and a 2-stage HPT. The HPT rotor drives the high-pressure compressor rotor by converting the combustor exhaust gas flow into mechanical force. The HPT stage 1 disk has 80 blades, the HPT stage 2 disk has 74 blades, and each blade has its own retaining post.24 Figure 2 shows an HPT rotor for a CF6-80C2B6 engine.

23 A flight cycle is one complete takeoff and landing sequence. 24 For more information about the CF6-80C2B6 engine, see the Powerplants factual report in the docket for this accident investigation, DCA17FA021, at the NTSB’s website (www.ntsb.gov).

NTSB Aircraft Accident Report 8 Source: American Airlines. Figure 2. HPT rotor. 1.3.1 High-Pressure Turbine Stage 2 Disk Manufacturing Process The HPT stage 2 disk installed on the right engine was made of alloy 718 (a wrought nickel-based alloy). The material used to manufacture the disk for GE was produced by TDY Industries LLC doing business as ATI Specialty Materials (ATI SM) in 1997 at the company’s Monroe, North Carolina, facility. ATI SM used a triple-melt process to produce an ingot (a mass of metal cast into a specific size or shape) per GE specifications.25 Afterward, ATI SM converted

25 GE first used alloy 718 in the 1970s, and the material underwent a double-melt process at that time. In the early 1980s, GE started using a triple-melt process for some part applications manufactured with alloy 718. In the mid-1990s, GE began using the triple-melt process for all of its critical life-limited rotating parts manufactured with alloy 718.

NTSB Aircraft Accident Report 9 ingots to billets (larger diameter bars) using thermal and mechanical processes and inspected the billets for internal defects using an ultrasonic inspection procedure. 1.3.1.1 Triple-Melt Process ATI SM’s triple-melt process consisted of vacuum induction melting, electroslag remelting, and vacuum arc remelting, as described below. After completion of the triple-melt process, an ingot undergoes a billet conversion process, which is also described below. Vacuum Induction Melting The first step of the triple-melt process, vacuum induction melting, is also referred to as the master heat. Vacuum induction melting uses an induction furnace in a vacuum chamber to (1) combine raw material to establish the desired chemistry and (2) refine the material by removing impurities. Melting the raw material in a vacuum reduces the oxygen and nitrogen content, thus inhibiting the formation of oxides and nitrides, which are detrimental to the mechanical properties of the alloy. After the material is completely melted and agitated, in-process samples are taken until the desired chemistry has been achieved. The molten material is then poured into a series of vertical molds, creating a series of ingots that function individually as an electrode for the next step in the triple-melt process. Electroslag Remelting The second step of the triple-melt process, electroslag remelting, establishes the cleanliness of the material. This step involves (1) continuously melting an ingot (which functions as an electrode) through a molten bath of electrically conductive and chemically reactive slag and (2) collecting the purified material in a water-cooled mold. A stub, referred to as a stinger, is welded to the ingot to provide a current path to complete the electrical circuit and structurally support the ingot. As the ingot melts, droplets are created that descend through the superheated slag layer, and impurities dissolve or bind with the reactive elements within the slag layer and float toward the top. When the droplets reach the bottom of the water-cooled mold, they solidify, creating a new ingot that builds up from the bottom of the mold and moves the slag layer up the side of the mold. A slag skin layer also builds up between the new ingot and the water-cooled mold, which helps reduce the formation of oxides. The skin layer limits the rate at which heat can be removed from the newly formed ingot, which negatively affects the macrostructure of the material. As a result, before the ingot undergoes the next step in the triple-melt process, the top and bottom of the ingot are removed to reduce the possibility of contamination, and any scale on the outside of the ingot (the slag skin layer in this case) is also removed.26

26 Material defects are most likely to form in the top and bottom of the ingot because the temperature is the least stable in these areas during the melting and subsequent cooling/solidification of the ingot.

NTSB Aircraft Accident Report 10 Vacuum Arc Remelting Although the final step in the triple-melt process, vacuum arc remelting, further refines the cleanliness of an ingot, the main purpose of this process is to establish the desired macrostructure for the ingot material. Similar to electroslag remelting, vacuum arc remelting involves continuously melting an original ingot (which functions as an electrode), collecting the molten material in a water-cooled mold, and forming a new ingot. Unlike electroslag remelting, vacuum arc remelting is a direct current process conducted under a vacuum and does not use a molten slag layer. The original ingot is lowered into the mold until an arc is struck between the electrode and the bottom of the mold. The high-temperature arcing melts the original ingot. As molten droplets fall through a gap, dissolved gases are removed, and unwanted contaminants are vaporized. The molten droplets collect at the bottom of the mold, where they resolidify and form the new ingot, as shown in figure 3.27 The position of the original ingot is controlled to keep the melt rate constant as the new ingot builds up from the bottom of the mold. Similar to electroslag remelting, after the vacuum arc remelting process is completed, the top and bottom of the ingot are removed, and any scale on the outside of the ingot is also removed.

27 Figures showing the vacuum induction melting and the electroslag remelting processes appear in the Powerplants factual report in the docket for this accident investigation, DCA17FA021.

NTSB Aircraft Accident Report 11 Source: ATI SM. Figure 3. Vacuum arc remelting process. Billet Conversion Process The billet conversion process replaces the original non-uniform coarse grain structure of an ingot with a new recrystallized (finer) grain structure. During this process, the ingot is subjected to a series of heat treatments and axial, transverse, and radial forging operations until the material has reached the desired size, shape, and microstructure. At the end of this process, the material becomes a billet. 1.3.1.2 Ultrasonic Inspection Process After completion of the conversion process, a billet is prepared for ultrasonic inspection, which is a nondestructive inspection method for detecting surface and subsurface anomalies and

NTSB Aircraft Accident Report 12 determining the position, shape, and possibly the size of those anomalies. ATI SM uses a longitudinal wave water immersion, pulse-echo ultrasonic inspection technique in which the billet is submerged in a water tank and rotated while two transducers move longitudinally along the length of the billet. The rotation of the billet ensures that its entire diameter is inspected by the combination of the two transducers. The technique involves a pulsed sound wave from a transducer that propagates through the material and reflects off any discontinuity, such as a void (an internal cavity), crack, or variation in material density, providing an echo back to the transducer. The location of a discontinuity can be determined by comparing the amount of time for the echo to return to the transducer with the normal reflective wave from a known discontinuity. Although the size of a discontinuity can be determined by the strength (amplitude) of the echo return, this information must also be correlated with a known defect size. The advantage of this technique is the ease of moving the transducer along the material while both remain acoustically coupled.28 Figure 4 shows a representation of a longitudinal wave scan. Figure 4. Longitudinal wave scan used during ultrasonic inspections. Before the ultrasonic inspection, the top and bottom of a billet are cut off because these areas are where defects are most likely to have formed. Additional cuts at the top and bottom of the billet are made for visual macroscopic inspection. The final steps before the ultrasonic inspection are a machining operation termed “peeling” and polishing to enhance the effectiveness of the inspection. ATI SM uses the requirements of GE specification P3TF15, titled “Ultrasonic Inspection of Billet – Immersion,” class C and class E, for the billets.29 As part of the inspection process, any identified defects are cut out of the billet material for evaluation, and an ultrasonic

28 The immersion transducer uses the water to facilitate the transmission of acoustic waves from the transducer to the material to be inspected. The transducer cables are electrically sealed and waterproof. 29 GE specification P3TF15 called for the surface finish for the polishing step to be 125 microinches or better, which “will normally ensure inspectability.” A microinch (µin) is equal to one-millionth of an inch. Class C refers to alloy 718 (fine grain), and class E refers to general applications (high sensitivity).

NTSB Aircraft Accident Report 13 billet map sheet is created for each billet to provide the location of any defects that were cut out of the material. 1.3.1.3 Manufacture History of Accident HPT Stage 2 Disk According to ATI SM production records related to the accident HPT stage 2 disk, the triple-melt process produced five ingots, designated as FA94-1 through -5, from the master heat, and the ingot designated as FA94-2 was the one from which the HPT stage 2 disk was manufactured. ATI SM stated that the furnaces that were used to produce these ingots were still in use at the company’s facility (as of November 2017). Ingot FA94-2, which became billet FA94-2, was forged into a 10-inch-diameter round. The ultrasonic inspection technique that ATI SM used for billet FA94-2 was the same as that in use as of November 2017, and the equipment that was used for inspecting the billet was the same design as the equipment in use as of November 2017.30 Review of the ultrasonic billet map sheet for FA94-2 showed no defects or rejections in the billet material.31 Two companies, in addition to ATI SM, were involved in manufacturing the HPT stage 2 disk that was delivered to GE: Wyman-Gordon of Houston, Texas, and Motoren- und Turbinen-Union GmbH (MTU) of Germany. Once billet FA94-2 was deemed acceptable (that is, it passed all required inspections), ATI SM cut the billet to the lengths specified by Wyman-Gordon. Review of the ATI SM certification test sheet (used to certify billets) for FA94-2, dated June 17, 1997, indicated that (1) the metallography, microstructure, and grain size were acceptable per specifications; (2) an ultrasonic inspection was performed with no defects found; and (3) macroscopic inspection results were acceptable. ATI SM sent the billet to Wyman-Gordon, which further cut the billet into nine pieces, with each piece representing the precise length of material needed to manufacture the intended part. These pieces were press forged, heat treated, and rough machined. Wyman-Gordon certified the forging on August 8, 1997, and sent the forged pieces to MTU for additional inspections and final machining. MTU performed ultrasonic inspections (with the pulse-echo technique, similar to ATI SM) on “sonic-shape” forged pieces using its own work instructions, which GE approved.32 MTU’s work instructions met GE specification P3TF1, titled “Ultrasonic Inspection,” class A longitudinal

30 The transducers for the ultrasonic equipment need to be replaced periodically to prevent calibration issues resulting from deterioration. 31 For FA94-1, the ultrasonic billet map showed a “macro-rejectable” defect in the bottom of the billet, so additional material was removed. For FA94-3, the ultrasonic billet map showed a “sonic-rejectable” indication in the top of the billet, so material containing the indication was removed, and the defect was located and identified. For FA94-4, the ultrasonic billet map showed a sonic-rejectable indication in the top of the billet, so material containing the indication was removed, but the indication could not be identified after the material was removed. For FA94-5, the ultrasonic billet map showed a macro-rejectable indication in the bottom of the billet, so additional material was removed. 32 MTU performed pre-machining and cleaning operations before the ultrasonic inspection; those operations produced the forging shape configurations (referred to as sonic-shape pieces) for the inspection.

NTSB Aircraft Accident Report 14 and circumferential shear ultrasonic requirements.33 Afterward, additional machining, shot peening, a final visual and dimensional inspection, and a high-sensitivity fluorescent penetrant inspection (FPI), per a GE specification, were performed. Review of the MTU final inspection sheet for the HPT stage 2 disk, dated February 3, 1998, indicated that the completed disk was acceptable. In March 1998, MTU sent the HPT stage 2 disk to GE, which installed the disk in the CF6-80C2B6 turbofan engine that was eventually installed on the right side of the accident airplane. The engine serial number (ESN) for the right engine was ESN 690-373. 1.3.2 Accident Engine Maintenance Events On April 30, 1998, Boeing delivered a 767 airplane to American Airlines with ESN 690-373 (including the HPT stage 2 disk involved in this event) installed; that airplane was registered as N392AN. On March 25, 2007, American Airlines removed ESN 690-373 from N392AN and sent it to the company’s Tulsa, Oklahoma, engine maintenance facility to, among other things, accomplish the mandatory inspection requirements of FAA Airworthiness Directive (AD) 2002-07-12, which were to be performed on the HPT stage 2 disk at “each piece-part opportunity.”34 To satisfy the AD’s HPT stage 2 disk inspection requirements, maintenance personnel performed FPIs and eddy current inspections (ECI) of the HPT stage 2 rim bolt holes and the disk bore. Initial FPI results revealed that the bolt holes needed repairs, which were made; follow-up FPI results revealed no other disk anomalies. Maintenance personnel reinstalled the HPT stage 2 disk into the same engine and, on September 16, 2007, installed ESN 690-373 in company 767 airplane N386AA. On January 15, 2011, American Airlines removed ESN 690-373 from N386AA and sent it to the company’s Tulsa maintenance facility for scheduled heavy maintenance. Among other things, maintenance personnel removed the HPT stage 2 disk from the engine and performed all mandatory inspections as well as visual and dimensional inspections. Among the mandatory inspections performed were those required by AD 2009-04-10, which superseded A 2002-07-12.35 Regarding the CF6-80C2 HPT stage 2 disks, AD 2009-04-10 had the same ECI and FPI requirements as those mandated by AD 2002-07-12, and maintenance personnel documented no anomalies when performing those inspections. Maintenance personnel reinstalled the HPT stage 2 disk into the same engine and, on May 12, 2011, installed ESN 690-373 in the right engine position of the accident airplane (N345AN).

33 GE specification P3TF1 called for a surface finish of 90 microinches for longitudinal wave and circumferential shear wave, which “will usually provide ultrasonic inspection with acceptable surface noise effects.” Class A refers to immersion ultrasonic inspection. 34 FAA AD 2002-07-12, “General Electric Company CF6-80A, CF6-80C2, and CF6-80E1 Series Turbofan Engines” (67 Federal Register 17279, April 10, 2002), effective May 15, 2002, stated the following: “within the next 30 days after the effective date of this AD, revise the manufacturer’s Life Limits Section of the Instructions for Continued Airworthiness…and for air carrier operations revise the approved continuous airworthiness maintenance program” by adding the mandatory inspections detailed in the AD for life-limited rotating engine parts. According to the AD, “piece-part opportunity” meant that “the part has accumulated more than 100 cycles-in-service since the last piece-part opportunity inspection, provided that the part was not damaged or related to the cause for its removal from the engine” (FAA 2002). 35 FAA AD 2009-04-10, “General Electric Company CF6-80A, CF6-80C2, and CF6-80E1 Series Turbofan Engines” (74 Federal Register 7995, February 23, 2009), effective March 30, 2009, incorporated additional inspection requirements (FAA 2009).

NTSB Aircraft Accident Report 15 On November 11, 2013, American Airlines removed ESN 690-373 from the airplane for reliability improvement program tasks while at the company’s Tulsa maintenance facility. Maintenance personnel did not disassemble the HPT rotor and thus did not inspect the HPT stage 2 disk. On December 4, 2013, maintenance personnel reinstalled ESN 690-373 in the right engine position of the accident airplane, where it remained through the time of the accident. As previously stated, the right engine had accumulated 10,984 total cycles since new. The HPT stage 2 disk has a life limit of 15,000 cycles when installed on the CF6-80C2B6 engine. Thus, at the time of the accident, the HPT stage 2 disk had 4,016 cycles of in-service life remaining. Also, since the time of the right engine’s shop visit in January 2011 (the last time before the accident that the HPT stage 2 disk was removed from the engine and inspected), the engine had accumulated 19,139 hours and 3,057 cycles. 1.3.3 Postaccident Engine Observations The HPT stage 2 disk of ESN 690-373 (right engine) was recovered on scene in four fragments, as shown in figure 5. About 96% of the disk, including the entire disk bore, was recovered.36 As mentioned in section 1.1, one disk fragment (labeled “A” in figure 5), which weighed about 56.6 pounds, was recovered on the airport property in a UPS warehouse located about 2,935 ft south of the airplane’s position on the runway where the uncontained engine failure occurred.37

36 After the accident, 71 of the 74 blade retaining posts in the HPT stage 2 disk were recovered. In addition, smaller pieces of engine debris were recovered at or near the location on the runway where the uncontained engine failure occurred. 37 The disk fragment penetrated the roof of the UPS warehouse and was found on the floor.

NTSB Aircraft Accident Report 16 Figure 5. Main fragments of the HPT stage 2 disk (forward side). The other three disk fragments (labeled “B,” “C,” and “D” in figure 5) were recovered on the airport property north of runway 28R. These three disk fragments were located 475 ft (fragment D), 1,365 ft (fragment B), and 1,500 ft (fragment C) from the airplane’s location on the runway where the uncontained engine failure occurred. Specifically, fragment B, which weighed about 83.1 pounds, was recovered in the grassy area near a taxiway; fragment C, which weighed about 6.6 pounds, was recovered on another taxiway; and fragment D, which weighed about 0.2 pound, was recovered on the overrun area at the departure end of runway 15.38 Figure 6 shows the disk fragment locations overlaid on a map of the airport.

38 According to GE, without blades or thermal shield attachment bolts, the HPT stage 2 disk weighs about 153 pounds. The disk fragment weights in this section reflect the weight with blade shanks and attachment bolts removed when possible.

NTSB Aircraft Accident Report 17 Figure 6. Disk fragment locations. On-scene examination of the right wing (inboard of the right engine pylon) revealed two distinct penetration holes.39 One hole (referred to as hole 1) was located forward of the front spar in the leading-edge panel; the other hole (referred to as hole 2) was located aft of the wing front spar. Figure 7 shows holes 1 and 2. Figure 7. Holes located forward and aft of the right wing front spar.

39 All right wing impact damage from exiting HPT stage 2 disk or engine debris was observed inboard of the right engine pylon.

NTSB Aircraft Accident Report 18 The on-scene examination also revealed the following: • fragments of the ruptured HPT stage 2 disk, along with blade and vane fragments, penetrated through the HPT case and right engine nacelle structure; • small engine hardware fragments impacted the right side of the fuselage and the left and right main landing gear doors; • small engine hardware fragments penetrated the left engine nacelle, with no engine damage observed; • a disk fragment, along with smaller engine hardware fragments, impacted the right engine, right wing, and portions of the right fuselage, severing the main engine fuel feed line and breaching the right-wing fuel tank, which led to a fuel-fed fire; and • another disk fragment, along with smaller engine hardware fragments, created multiple impact scars on runway 28R.40 1.3.4 Metallurgical Examinations The NTSB’s Materials Laboratory in Washington, DC, examined the three largest HPT stage 2 disk fragments (A, B, and C; see figure 5). Visual examination found a discolored (heat-tinted) region on the fracture surfaces separating fragments A and B.41 The discolored region was at the forward end of the disk bore region, as indicated in figures 8 and 9, and this region was identified as the location where the fracture originated.

40 The main impact scar was a gouge that was consistent with the impact from exiting HPT stage 2 disk fragments. The gouge was oriented about 30° forward of the direction of airplane travel (relative to the HPT stage 2 plane of rotation) and in the general direction where three separate fragments of the HPT stage 2 disk were located (north of runway 28R). The gouge measured about 33 inches long, 8 inches wide, and 2 inches deep and was located about 32 ft to the right of the runway 28R centerline. 41 The fracture surfaces comprised right and left sides. The right sides were on disk fragment A, and the left sides were on disk fragment B.

NTSB Aircraft Accident Report 19 Figure 8. Engine cross-section and fracture origin location. Figure 9. Fracture surface from disk fragment A.

NTSB Aircraft Accident Report 20 Metallurgical examination of the fracture surfaces revealed multiple subsurface microstructural discontinuities with multiple cracks initiating along the boundary of the discontinuities. The discontinuities, which had a dark gray appearance, were elongated in the direction of, and aligned with, the grain structure pattern produced during forging. The discontinuities spanned a total length of about 0.78 inch, with the largest of the discontinuities measuring about 0.43-inch-long by 0.07-inch-wide and having an inclination of about 26º from the bore centerline. Multiple cracks had initiated along the upper and lower edges of the discontinuities and progressed toward the disk rim and disk bore. Scanning electron microscope (SEM) images of the fracture surface revealed relatively coarse striations at regularly spaced intervals, consistent with crack growth by low-cycle fatigue, followed by a transition to cyclic tensile crack growth and then tensile overstress.42 The net size of the cracked region immediately before the disk fracture (given the size of the discolored region) ranged from about 0.47 to 0.93 inch in the radial direction and about 0.96 inch to 1.13 inches in the axial direction and encompassed an area of about 0.82 square inch. SEM examination of the discontinuities on the fracture surface showed that the discontinuities were regions of discrete micron-sized oxide particles, referred to as stringers, embedded in a material consistent with alloy 718. A polished and acid-etched metallurgical cross-section through the largest of these features showed that these oxide stringers surrounded and were interspersed in a discrete underlying region where the alloy 718 grain size was coarser than the surrounding material. The coarse grain region beneath the discontinuity exhibited a white- etched appearance compared with the surrounding fine grain material due to the acid etch. The stringers and coarse grain region collectively formed a subsurface anomaly referred to as a “discrete dirty white spot” that measured about 0.15 by 0.10 inch.43 Figure 10 shows the discrete dirty white spot, and figure 11 shows a close-up view of one of the stringers.

42 Striations are linear features on a fatigue fracture surface that indicate how far a crack advanced with each stress cycle. The NTSB selected three of six cracks for striation density measurements to estimate the number of low- cycle fatigue crack growth cycles before the disk ruptured. In airplane engines, low-cycle fatigue is associated with one striation per flight cycle. For information about the NTSB’s work in this area, see section 1.4.1. 43 If stringers are present, a white spot is “dirty”; if stringers are absent, a white spot is “clean.” Section 1.7.1 provides information about white spot formation as it related to the manufacturing process for the HPT stage 2 disk.

NTSB Aircraft Accident Report 21 Figure 10. Discrete dirty white spot in fracture surface. Figure 11. Stringer in material microstructure. Crack Stringers Discrete dirty white spot Fracture surface/stringer Fracture Radially Figure 11

NTSB Aircraft Accident Report 22 GE Aviation’s Materials Laboratory in Evendale, Ohio, performed additional metallurgical examinations on the disk segments and produced a report detailing its findings (Morales 2017). This work included additional striation density measurements (discussed in section 1.4.1), hardness measurements, microprobe chemical analysis of the discrete dirty white spot, additional cross-section metallography, and bulk alloy chemistry. The report stated that the hardness, chemistry, and grain size of the material away from the discrete dirty white spot was within the blueprint requirements for the disk and that GE’s cross-sections through the discrete dirty white spot found stringers with no voids. GE and ATI SM conducted a study of discrete dirty white spots “to better understand their ultrasonic response characteristics.” The report detailing the study results is discussed in section 1.4.2. 1.4 Tests and Research 1.4.1 Number of Flight Cycles in Low-Cycle Fatigue Regions As previously stated, the NTSB documented the presence of multiple fatigue cracks that initiated at a discrete dirty white spot in the forward bore region of the HPT stage 2 disk. The NTSB and GE estimated flight cycles for a total of six cracks, numbered 1 through 6, as shown in figure 12. The cracks exhibited striated features consistent with low-cycle fatigue. Figure 12. Fatigue cracks that initiated from discrete dirty white spot. The NTSB selected cracks 1, 2, and 6 for a study to estimate the number of flight cycles in each low-cycle fatigue region. (The NTSB focused on these cracks for the study because they did not emerge from the surface.) SEM images were taken for each of the cracks (along the path of crack progression up to the transition to cyclic tensile crack growth), and striation densities were measured on those images to estimate the number of cycles from crack initiation to the HPT stage 2 disk failure. The study assumed that one striation correlated with one flight cycle and that the

NTSB Aircraft Accident Report 23 forces during takeoff, when the stresses on the HPT stage 2 disk would be at their highest, caused the crack to progress. The study results showed that cracks 1, 2, and 6 progressed by low-cycle fatigue for about 5,700, 5,600, and 3,700 cycles, respectively. GE made striation density measurements for all six cracks, which showed that the greatest striation count, assuming one striation per mission/flight cycle, was about 7,000 cycles before the disk ruptured in tensile overload. This striation density measurement estimate was for crack 6, which progressed outward and did not reach the bore of the disk. GE’s estimates for cracks 1 and 2 were 6,000 and 5,900 low-cycle fatigue crack growth cycles, respectively. (The NTSB notes that striation density measurements can be affected by subjectivity in measuring the striation densities and interpreting the results.) GE’s striation density measurement estimates for cracks 3, 4, and 5 indicated that the cracks progressed by low-cycle fatigue for 1,400, 1,200, and 3,200 cycles, respectively. 1.4.2 Ultrasonic Response Characteristics of Discrete Dirty White Spots As stated in section 1.3.4, GE and ATI SM conducted a study of discrete dirty white spots to better understand their ultrasonic response characteristics. GE provided the NTSB with a report on the results of the study. ATI SM selected and characterized six discrete dirty white spots found by ultrasonic inspection of alloy 718 billets during the 2.5 years before the study was completed (in April 2017). According to GE’s report, the sample represented “a typical range of sizes, shapes, stringer distribution, and radial position observed historically.” GE performed further characterization of the six discrete dirty white spots, including metallographic examination. Voids/cracks were found in five of the six discrete dirty white spots; findings for one discrete dirty white spot were inconclusive. The report concluded that voids/cracks in discrete dirty white spots might provide a reflection surface that is conducive to ultrasonic detection (GE 2017). Specifically, the report compared one of the sample discrete dirty white spots with the discrete dirty white spot found on the HPT stage 2 disk from the accident airplane. The sample discrete dirty white spot had multiple voids along a stringer, which made detection via ultrasonic inspection likely. The discrete dirty white spot on the HPT stage 2 disk from the accident airplane showed no voids, and, as previously stated, ultrasonic detection performed during manufacturing of the billet did not detect any anomalies.

NTSB Aircraft Accident Report 24 1.5 Survival Aspects The airplane was configured with 2 flight crew seats (and a cockpit jumpseat, which was unoccupied during the accident flight), 10 flight attendant jumpseats (3 of which were unoccupied), and 206 passenger seats.44 The airplane had four door exits and four overwing exits. Figure 13 shows the airplane configuration and the seating positions within the cabin for the seven flight attendants. Figure 13. N345AN configuration. 1.5.1 Interphone Communication System The airplane’s interphone communication system comprised a flight crew interphone and five flight attendant interphones, which enabled voice communications to and from the flight deck and five flight attendant locations (1L, 1RC, 2R, 4L, and 4R jumpseats). The interphones were also used to make PA announcements and enable communication between flight attendant locations. American Airlines 767-300-series airplanes have two different interphone models: the “classic” model, shown in figure 14a, which was installed on 767C-300ER airplanes delivered before January 2003, and the “new” model, shown in figure 14b, which is installed on 767N-300ER airplanes delivered beginning in January 2003. The accident airplane, delivered in April 2003, had the new model interphone system installed.

44 The three unoccupied jumpseats were at the 1LC (left center), 4LC, and 4RC (right center) positions.

NTSB Aircraft Accident Report 25 Figure 14a. Classic model interphone.

NTSB Aircraft Accident Report 26 Figure 14b. New model interphone. The classic model interphone has a key pad with four keys (buttons) to call locations within the airplane. The new model interphone has a key pad that resembles a standard telephone key pad. On the back of the new model interphone is a list of 10 communication options for making calls to various locations within the airplane. According to American Airlines flight attendant interphone procedures, although the classic and new model interphones both required flight attendants to activate the interphone buttons slowly and pause between each high/low chime to

NTSB Aircraft Accident Report 27 allow the chiming cycle to complete, the procedures for placing routine and emergency calls between the cockpit and the cabin differed between the models.45 Section 1.5.2 describes the experience of three flight attendants with the interphone during the emergency. Also, section 1.6.3.2 discusses flight attendant training, including the use of simulators. The classic model interphone was installed on one of two Boeing 767 simulators used for flight attendant training. The other 767 simulator had a nonfunctioning mockup of the new model interphone. 1.5.2 Evacuation After the airplane came to a stop (1432:10), the flight attendants began evacuating the airplane. FDR data showed that, at 1432:20 (10 seconds after the airplane came to a stop), the left overwing exit opened. The forward left (1L) and forward right (1R) cabin doors opened 18 and 22 seconds later, respectively. At 1432:48 (38 seconds after the airplane came to a stop), the aft left (4L) cabin door opened. The left engine was shut down at 1433:09. American Airlines provided the NTSB with two videos of the accident airplane that were taken by witnesses. One video was 2 minutes 28 seconds long, and the other video was 57 seconds long. Both videos show only the left side of the airplane. Also, the videos do not show the time that the last passenger evacuated via the left overwing exit slide. From the available information on those videos, the NTSB determined the timeline of evacuation events shown in table 2. Table 2. Evacuation events shown on videos of left side of airplane. Elapsed time (min:sec) Event 0:00 Airplane comes to a stop. 0:15 Left overwing exit opened. 0:19 Left overwing exit slide fully deployed. 0:31 First occupant evacuated via left overwing exit slide. 0:31 1L door opened. 0:37 1L slide fully deployed. 0:40 4L door opened. 0:44 First occupant evacuated via 1L slide. 0:46 4L slide fully deployed but initially unusable—blown aft by left engine. (Slide remained attached to airplane.) 1:09 4L slide repositioned forward unassisted. 1:11 4L slide fully deployed and usable. 1:25 First occupant evacuated via 4L slide. 2:02 Airport operations vehicle arrives. 2:11 Last occupant evacuated via 1L slide. 2:21 Last occupant evacuated via 4L slide. Note: The FDR “door open” signal occurred 2 to 5 seconds before the left overwing exit and the 1L and 4L doors were observed to open. The FDR door open signal is driven by a door proximity sensor that indicates that a door was unlocked or that a door handle changed position. As a result, the FDR door open signal would not be expected to occur at the same time as opening of the overwing exit and doors, which is why the FDR showed that the left overwing exit opened 10 seconds after the airplane came to a stop and the video showed that the left overwing exit opened 15 seconds after the airplane came to a stop.

45 For example, for a routine call to the flight deck, flight attendants were to press the “Pilot” button twice on the classic model interphone or enter “31” on the new model interphone. Also, for an emergency call to the flight deck, flight attendants were to press the “Alert” button four times on the classic model interphone or enter “#4” on the new model interphone.

NTSB Aircraft Accident Report 28 The NTSB conducted postaccident interviews with the flight attendants, who reported that, after hearing a loud noise (described as a “bang” or a “boom”) and feeling the airplane “shudder,” “shake,” and “fishtail,” passengers began moving from the right to the left side of the airplane while it was still moving down the runway. Once the airplane came to a complete stop, passengers started rushing toward the exits and urged the flight attendants to open the doors so that the passengers could evacuate. Table 3 summarizes the flight attendants’ actions before and during the evacuation.46 Two flight attendants reported that they were not able to properly use the interphone. These two flight attendants also reported the 4L door slide could not be immediately used after it deployed because it was blown aft before the left engine had been shut down. (The slide remained attached to the airplane.) In addition, two flight attendants reported passengers evacuating with baggage despite being directed to leave their bags behind. Table 3. Summaries of flight attendant evacuation actions. Flight attendant position and location Evacuation actions FA 1(lead)/1L jumpseat After the airplane came to a complete stop, flight attendant 1 stood up to assess his area and waited for a call from the cockpit. Passengers started to rush the 1L door area, requesting him to open the door so that they could exit the airplane. He recalled picking up the interphone but did not remember if he called the cockpit. After he saw a “haze of smoke” aft of the first-class cabin, he opened the 1L door and initiated the evacuation. He continued the evacuation until all passengers had exited. He told the flight crew that the cabin was clear and then exited from the 1L door. FA 2/4L jumpseat Flight attendant 2 saw flames coming from the right wing. She reported that passengers were immediately at the 4L door, pleading to get off the airplane. She attempted to contact the flight crew about the left engine but was unsuccessful because she selected the wrong button on the interphone. Passengers were continuing to plead with her to let them off the airplane. She continued to hold off passengers to allow more time for the flight crew to shut down the left engine. The cabin began filling with smoke, and she was concerned because the airplane was heavy with fuel, so she decided to allow passengers to evacuate from the 4L door. The slide deployed but was blown aft because the left engine was still running. She and flight attendant 3 held back passengers until the engine stopped running and the slide stabilized itself, and then they began the evacuation. Once flight attendant 2’s area was clear, she exited the airplane from the 4L door. FA 3/4R jumpseat Flight attendant 3 reported that the cabin was “lit up” on the right side of the airplane back to the 4R door. Before the airplane came to a stop, passengers were screaming, climbing over seats, and moving to the left side of the airplane. He picked up the interphone to make a PA announcement instructing passengers to remain calm, but he did not make the announcement because he could not recall how to use the interphone. He moved to the 4L door area to assist flight attendant 2 as passengers asked them to open the door so that they could get out of the airplane. He and flight attendant 2 were waiting to hear from the captain and for the left engine to shut down before they began the evacuation. While they were waiting, the cabin began to fill with smoke, so they decided to open the 4L door. Once the door was opened, he saw the slide blowing. Once the slide stabilized, he evacuated passengers until his assigned area was clear and then exited from the 4L door. FA 4/2R jumpseat Flight attendant 4 reported that she heard a loud explosion and saw fire. Passengers jumped up out of their seats, even though the airplane was still moving. She shouted at the passegers, “remain seated” and “heads down,” but they continued to rush toward her jumpseat. The airplane came to a complete

46 For more information, see the flight attendant interviews (Survival Factors Attachment 1) in the docket for this accident investigation, DCA17FA021.

NTSB Aircraft Accident Report 29 Flight attendant position and location Evacuation actions stop, and she instructed the passengers to “get out.” Her exit was unusable, so she ran to the first-class cabin area, saw that the forward doors were open, and redirected passengers to the front of the airplane. Passengers were trying to get their bags out of the overhead bins, so she told them repeatedly, “don’t take anything with you.” She went to the 2L overwing exit and saw flight attendant 7 evacuating passengers out of the window exits, so she also directed passengers to those exits. A passenger came toward her exit with a bag; she told him to leave the bag, but he did not follow directions and evacuated with the bag over his head. Her location in the cabin was getting smoky, and she feared that the airplane would explode, so, after checking for passengers, she evacuated from the 2L overwing exit. FA 5/1RC jumpseat Flight attendant 5 was waiting for the flight crew to tell the flight attendants what had happened during the takeoff attempt when passengers started rushing toward her shouting, “fire, open the door.” She did not initially see fire but noted that flight attendant 1 had opened the 1L door after seeing smoke in the cabin. Flight attendant 5 assessed the conditions using the 1R door window, saw no fire, and opened the door. She then saw fire outside and blocked the exit by holding up her hands to stop passengers from using that exit. She shouted at passengers to use the 1L door and continued blocking the 1R door. Once all passengers had evacuated, she exited from the 1L door. FA 6/2L jumpseat After the airplane came to a complete stop, flight attendant 6 looked out a window on the right side of the airplane and saw fire. She turned around toward the 2L overwing exit. Flight attendant 7 was opening that exit, so she started directing passengers to the open exits. A passenger came to the area with a large bag, and flight attendant 6 instructed the passenger to leave the bag and evacuate the airplane. The passenger did not listen, so flight attendant 6 tried to take the bag away from the passenger. The flight attendant realized that the struggle over the bag was causing a delay in the evacuation, so the passenger evacuated the airplane with her bag. Once the area was clear, flight attendant 6 exited from the 2L overwing exit. FA 7/3L jumpseat Flight attendant 7 saw a “plume of fire” over the right wing and black smoke and reported that passengers started jumping out of their seats while the airplane was still moving. He yelled, “stay down,” but the passengers did not listen. Once the airplane came to a complete stop, he opened the 2L overwing exit, even though it was flight attendant 6’s assigned exit, and started commanding passengers to evacuate out the window exits on the left side of the airplane. Flight attendant 7 also directed passengers forward toward the first-class section. The cabin was starting to fill with “hazy gray smoke,” and he thought that the interior panels were burning and could see the window glass melting on the right side. After the passengers had evacuated, he exited from the 2L overwing exit. The NTSB also interviewed four passengers from the flight. One of these passengers, who occupied a seat near the 3L overwing exit, reported that everything appeared to be normal during the takeoff roll until he heard a loud “bang” and saw what appeared to be “orange sparks.” He also reported that the flight attendant sitting in front of him instructed passengers, in a forceful yet calm manner, to sit down. As soon as the airplane came to a stop, he opened the exit. He stated that he had not heard an evacuation command but was “very focused” on getting the exit open. In addition, the NTSB interviewed the passenger who sustained the serious injury during the evacuation. The passenger exited the airplane using the left overwing exit slide. He reported that, after reaching the ground, he stood up to get away from the airplane and was “blown over” by the jet blast coming from the back of the left engine. He also reported that, as he stood up again and ran to a grass strip next to the runway, he felt pain in his back.

NTSB Aircraft Accident Report 30 1.6 Organizational Information 1.6.1 American Airlines Flight Crew Manuals 1.6.1.1 Engine Fire Checklist The American Airlines B767 Operations Manual, QRH included a checklist procedure (dated March 11, 2015) for an engine fire (or engine severe damage or separation) occurring on the ground or in flight. This checklist was based on the checklist in Boeing’s 767 Flight Crew Operations Manual QRH for the same engine emergencies. The first five items on the checklist, which detailed actions to be taken immediately in response to the engine emergency, were to be performed from memory. The remaining 11 items on the checklist, which were to be accomplished using the checklist, included actions related to configuring the airplane for landing. The five memory items, as well as the messages and conditions, on the checklist were as follows (bold face type indicated in original): Messages: L ENGINE FIRE R ENGINE FIRE Condition: One or more of these occur: • Engine fire warning • Airframe vibrations with abnormal engine indications • Engine separation

1. A/T ARM switch…………………………………………………. OFF
2. Thrust lever

(affected side)……………………… confirm……….…………………Idle

FUEL CONTROL switch (affected side)…………………….…confirm……….…………...CUTOFF

Engine fire switch (affected side)……………………….confirm………………………... Pull

If the engine fire warning light is illuminated: Engine fire switch (affected side)……………...…Rotate to the stop and hold for 1 second

NTSB Aircraft Accident Report 31 If after 30 seconds the engine fire warning light stays illuminated: Engine fire switch (affected side)……………Rotate to the other stop and hold for 1 second Figure 15 shows the engine fire switches, also referred to as engine fire handles, as described in steps 4 and 5 of the checklist. Figure 15. Engine fire handles. Note: Only the unlock button for the left engine fire handle is labeled. A similar unlock button appears forward of the right engine fire handle. 1.6.1.2 Evacuation Guidance The American Airlines B767 Operations Manual, QRH (dated April 7, 2016) provided the following evacuation guidance in the “General Information” section (bold face type indicated in original): After an airplane has landed following a significant in-flight event, the potential exists for a passenger or Flight Attendant initiated evacuation. If an immediate

NTSB Aircraft Accident Report 32 evacuation is not required, it is important to assure the passengers and Flight Attendants that the situation is under control. Make an immediate PA commanding: ‘This is the Captain. Remain Seated. Remain Seated. Remain Seated.’ If an evacuation might be required after further assessment, consideration should be given to configuring the aircraft for a potential evacuation. (Steps such as shutting down the engines should be considered to avoid the potential passenger injuries which might occur if the aircraft is not configured and the situation deteriorates or an inadvertent passenger or Flight Attendant evacuation takes place.) The guidance also stated that the “primary evacuation signal” was the announcement, over the PA system, “This is the Captain. Evacuate. Evacuate. Evacuate” (as shown in step 5 of the evacuation checklist in section 1.6.1.3). The American Airlines B767 Operations Manual, QRH also provided the following evacuation decision-making guidance under “General Information”: In a non-normal situation, the Captain must decide whether or not to conduct a passenger evacuation. The Captain must balance the hazard of passenger evacuation against the hazard of remaining on board. It is not feasible to establish a rigid set of rules regarding evacuation since there are many situational variables. The Captain must evaluate a specific situation, apply good judgment, and reach the best decision given the information available. The emergency evacuation is a powerful tool. Use it cautiously. The Captain should consider the following: • The decision to evacuate should be deliberate after carefully weighing the risks in evacuating against the risks of remaining on board. • The most hazardous event is fire or smoke within the pressurized area of the airplane (cabin or cargo compartment). • Smoke or flames in the engines, APU, or wheel assembly areas will normally burn out quickly and not endanger the cabin. Request ARFF equipment, pull the Fire Switch, discharge fire suppression agent as appropriate, carefully monitor the area and communicate with crash vehicle crews and tower. Time and conditions permitting, clear the active runway. Evacuate the passengers if the fire does not extinguish in a reasonable time or appears to be spreading. Whatever the decision, be specific and unambiguous in conveying your intent to the Flight Attendants.

NTSB Aircraft Accident Report 33 The QRH provided the following evacuation-related information related to the role of the flight attendants under “General Information”: Since most accidents occur on takeoff and landing, the Flight Attendants are instructed to be alert to clues of an emergency situation, such as unusual impact forces, noises, smoke, fire, or abnormal airplane attitudes. After the airplane stops, the Flight Attendants will assess the situation and, if the need for an evacuation is obvious, will initiate the evacuation without waiting for instructions from the cockpit. A DOOR EICAS message indicates that the evacuation has started. In addition, the American Airlines Flight Manual Part I, “Non-normal and Emergency” (dated October 1, 2016), stated the following regarding flight attendant-initiated emergency evacuations: When an aircraft has come to a stop in an obvious life-threatening situation (fire, dense smoke in the cabin, crash), Flight Attendants are authorized to initiate an evacuation without awaiting instructions from the flightdeck. Flight Attendants will attempt to communicate with the flightdeck if at all possible. If contact with the flightdeck is not possible, or if life threatening conditions still exist, Flight Attendants will make an independent decision and operate all usable exits. 1.6.1.3 Evacuation Checklist The American Airlines 767 evacuation checklist procedure (dated April 7, 2016), appeared on the back cover of the company’s B767 Operations Manual, QRH. The checklist was to be announced by the first officer, performed by the captain, and verified by the first officer. The steps of the checklist were as follows (bold face type indicated in original): Condition: Evacuation is needed. Note: Light override is available.

1. Parking brake……………………………….……………………...…Set
2. Cabin altitude MODE SELECT………………………………...MAN[47]
3. CABIN ALTITUDE MANUAL control……………..…Hold in CLIMB

Note: Hold in CLIMB until the outflow valve indication shows fully open to depressurize the airplane.

47 The 767 pressurization system has automatic and manual operating modes. The 767 pressurization panel, located on the cockpit panel above the first officer’s seat, includes the cabin altitude mode select switch, which can be set to the AUTO 1, AUTO 2, or MAN (manual) setting.

NTSB Aircraft Accident Report 34

1. FUEL CONTROL switches (both)…………………….………CUTOFF
2. PA…………………………………...……............“This is the Captain.

Evacuate, Evacuate, Evacuate.”

1. Evacuation COMMAND Switch

(as installed)…………………………………………………..………...ON

ATC………………………………………………………………Notify

Engine and APU fire switches (all)………………………….……………. Override and pull

If an engine or APU fire warning occurs: Related fire switch………………..Rotate to the stop and hold for 1 second 1.6.1.4 Evacuation Duties The American Airlines B767 Operations Manual, QRH contained the following information (dated March 11, 2015) regarding the flight crew’s responsibilities during an evacuation:48 Cockpit crewmembers will assist in the evacuation after completing required cockpit duties and should wear their hats to identify themselves as authorities to the passengers. Captain – Assist in cabin • After checklist is complete, immediately proceed to forward cabin and assess conditions. • Assist and direct evacuation. Pay attention to utilization of slides; use megaphone, if required, to maintain orderly and rapid passenger evacuation. Instruct Flight Attendants to leave airplane when their areas are clear. • Check entire cabin to ensure that all passengers have evacuated. Exit via any usable rear entry door. • Assemble passengers away from airplane. • Ensure that one or more crewmembers remain with the passengers until relieved by station personnel.

48 The QRH also described “concurrent flight attendant duties,” including, once outside the airplane, assembling passengers away from the airplane. Both flight crewmembers stated that, after evacuating the airplane, they saw the flight attendants moving the passengers away from the airplane. Other concurrent flight attendant duties were making a passenger count and reporting the count to the captain.

NTSB Aircraft Accident Report 35 First Officer – Assist outside airplane • After checklist is complete, immediately proceed to forward cabin and assess conditions. • Take Halon fire extinguisher (if possible). • Exit via first usable door and assist outside as necessary. • Assemble passengers away from airplane. 1.6.2 American Airlines Flight Attendant Manual American Airlines Flight Service Inflight Manual included the following information (dated December 24, 2016) under the heading “General Principles of Evacuation”: • If an emergency situation develops, be prepared to evacuate the aircraft. Stay alert to clues that may signal a possible emergency. o Unusual noises o Impact forces o Fire, sparks, or smoke o Abnormal aircraft attitude o The need to evacuate may not always be obvious. FAs must evaluate the level of danger and clearly communicate any conditions that may warrant an evacuation. • Do not initiate an evacuation until the aircraft has come to a complete and final stop. o Be prepared for more than one impact. o Be alert to any sense of motion, i.e., any sense of movement out the window, or outside noises if vision is impaired. • Begin evacuation command immediately upon signal from the flightdeck. o If one FA initiates an evacuation, all FAs must initiate evacuation procedures immediately by shouting evacuation commands. The guidance also states that it is “critical” for flight attendants to update the captain if cabin conditions warrant an evacuation because the flight crew might be unaware of life-threatening situations, such as excessive smoke and/or fire. The guidance further stated, “if the aircraft is on the taxiway and time permits, notify the flightdeck prior to initiating the evacuation.”

NTSB Aircraft Accident Report 36 Further, the guidance included a table labeled “Evacuation Procedures.” The table comprised nine procedural steps, including “on aircraft such equipped, turn on [evacuation] signaling system” (step 3) and “prior to opening an exit, assess conditions outside to determine if exit and escape route [are] safe” (step 4). Examples of unsafe conditions were provided, including “fire or dense smoke” and “engine(s) still operating.” Under the heading “FA and Flightdeck Crew Authority” (dated January 27, 2016), the flight attendant manual includes the following information: In a life-threatening situation, e.g., fire, smoke, impact forces, or abnormal aircraft attitude, and when the aircraft has come to a complete stop, FAs have the authority to initiate an evacuation without awaiting instructions from the flightdeck. • FAs will attempt to communicate with the flightdeck prior to evacuation, if possible. • If contact with the flightdeck is not possible, FAs will make an independent decision regarding evacuation and operate all usable exits. The flight attendant manual further indicated that, during land evacuations, flight attendants are to command passengers to “come this way” toward usable door and overwing exits and “leave everything.” Under the heading “767 Evacuation Signaling System” (dated March 11, 2015), the flight attendant manual stated that signaling system control panels were located in the cabin on most flight attendant jumpseats and in the cockpit.49 In addition, the manual included a section on interphone calls. This information (also dated March 11, 2015) described how to place and answer calls. As previously stated, depending on their delivery date, 767 airplanes had one of two interphone models—either the classic or the new model—and the procedures for placing calls using each model are described in section 1.5.1. 1.6.3 American Airlines Training 1.6.3.1 Flight Crew Training According to the American Airlines Flight Training B757/767 Instructor Guide – Qualification Training, 12 days of ground school training were followed by 10 days of simulator training. The simulator training was divided into simulator sessions, which were further divided into various types of special purpose operational training, and concluded with a maneuvers validation, line-oriented flight training, and a line operational evaluation.

49 According to Boeing, the evacuation signaling system control panels have a COMMAND switch, an EVAC (evacuation) light, and a horn. Boeing indicated that, when the COMMAND switch is placed in the ON position, the EVAC light illuminates and the horn sounds at each location with system control panels, including the cockpit.

NTSB Aircraft Accident Report 37 One special purpose operational training session titled “Rejected Takeoff (First Look), Evacuation” comprised the following maneuvers:50 • Takeoff — Contingencies: Rejected Takeoff • Takeoff — Contingencies: Engine Fire • Takeoff — Contingencies: Evacuation This training scenario involved either a cargo fire or an engine fire. During the training, the flight crew was expected to perform a fire checklist and not initiate an evacuation until a flight attendant called the cockpit to alert the flight crew of smoke in the cabin. 1.6.3.2 Flight Attendant Training American Airlines uses two training facilities for company flight attendant training: Flagship University and the Flight Academy, both of which are in Fort Worth, Texas. American Airlines instructors conduct the training. Initial new-hire training and recurrent (annual) training followed advanced qualification program guidelines. Flight attendants received classroom instruction, web-based instruction, hands-on door operation training in normal and emergency modes, and hands-on emergency equipment training. Instructor-facilitated, scenario-based simulator training included full-scale evacuations. In addition, American Airlines trained its flight attendants on the use of the evacuation signaling system. 1.6.4 American Airlines Operating Manual—Engine Fire Warning System According to American Airlines’ 757/767 Operating Manual, “Systems,” two detector loops in each engine nacelle provide fire detection. Under normal circumstances, both loops must detect a fire condition to cause an engine fire warning. An engine fire would be annunciated by the following: • sounding of the fire bell, • illumination of the master WARNING light,

50 American Airlines described “first look” maneuvers as “maneuvers which are NOT briefed during the RTS [recurrent training–simulator] briefing period but are flown by each pilot in the simulator and are defined to give some indication of whether the interval between training sessions may be too long to maintain proficiency in rarely exercised critical tasks” (capitalization indicated in original).

NTSB Aircraft Accident Report 38 • display of the EICAS warning message ENG FIRE (left or right), • illumination of the engine fire switch (left or right) fire warning light (on the center pedestal), • illumination of the engine FUEL CONTROL (left or right) switch fire warning light (on the center pedestal), and/or • unlocking of the engine fire handle (left or right) to activate the fire extinguisher bottle(s).51 1.6.5 Boeing The Boeing 767 Airplane Flight Manual included emergency procedures for responding to an engine fire, severe engine damage, or an engine separation. The procedures, which the FAA approved on May 12, 2005, stated that the following actions should be taken if an engine fire has occurred: Thrust Lever……………………………………………...…….…CLOSE Fuel Control Switch…………………………………..…………CUTOFF Engine Fire Switch…………..……………………………………...PULL

If fire warning light remains illuminated:

Engine Fire Switch………………………………...…………..ROTATE

After 30 seconds, if fire warning light remains illuminated:

Engine Fire Switch……………..ROTATE TO REMAINING BOTTLE

APU (if available)……..………………………………………...START

Prepare for one-engine inoperative landing. This procedure (except for the last step) applied to engine fires that occurred on the ground and during flight. The related checklist procedure in Boeing’s 767 Flight Crew Operations Manual QRH (dated August 16, 2013) was based on the information in the Airplane Flight Manual. The engine fire checklist procedure that American Airlines used (see section 1.6.1.1) was based on the checklist procedure in Boeing’s 767 QRH.

51 To prevent an accidental activation of the fire extinguishing system, each fire handle is locked in its down (non-activated) position by a solenoid-operated mechanical interlock device connected to the fire handle’s shaft. A pilot can manually release a handle’s mechanical interlock by pressing a button located on the engine fire control panel forward of the fire handle (see figure 15). The engine fire detection system can also automatically release the mechanical interlock when the system detects an engine fire or overheat condition. Once the mechanical interlock is released, a pilot can pull and rotate the engine fire handle.

NTSB Aircraft Accident Report 39 1.6.6 Federal Aviation Administration 1.6.6.1 Advisory Circular 20-128 Title 14 CFR 25.903(d)(1) states that, for turbine engine installations, “design precautions must be taken to minimize the hazards to the airplane in the event of an engine rotor failure or of a fire originating within the engine which burns through the engine case.” According to the accident airplane’s FAA type certificate data sheet, the Boeing 767-300 was certified on September 22, 1986. At that time, FAA Order 8110.11, Design Considerations for Minimizing Damage Caused by Uncontained Aircraft Turbine Engine Rotor Failures, issued on November 19, 1975, was in effect. The order described, among other things, design considerations for critical systems (including fuel systems) to minimize the damage that uncontained engine debris could cause. On March 9, 1988, the FAA issued AC 20-128, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.” (FAA Order 8110.11 was canceled on May 1, 1988; AC 20-128 contained much of the same information as the order.) AC 20-128 defined various fragment spread angles (based on historical engine failure events) and the area of the airplane that would likely be impacted by uncontained fragments resulting from an uncontained engine failure.52 The AC also included a figure that further explained fragment spread angles. The figure showed that, for a rotor burst event, an airframe manufacturer was expected to assume that large disk fragments would exit the engine at an angle that was ± 3° fore and aft from the center of the plane of rotation and that smaller disk fragments would exit the engine at an angle that was ± 5° fore and aft from the center of the plane of rotation. (These same fragment exit trajectories were specified in FAA Order 8110.11.) On March 25, 1997, the FAA issued AC 20-128A in response to Safety Recommendation A-90-170 (see section 1.7.3.1). The revised AC provided more recent information regarding rotor bursts and blade release fragment trajectory data so that airframe manufacturers could take appropriate design precautions to minimize the hazards to the airplane and its occupants. The fragment spread angle information remained the same as in the previous version of the AC.53 The AC described accepted design precautions for uncontrolled fire, loss of thrust, loss of airplane control, passenger and crew incapacitation, and structural integrity and indicated that airplane designs would be evaluated against proven design practices for each.54 In May 1999, the FAA issued a report titled Large Engine Uncontained Debris Analysis. According to the report’s abstract, the objective of the analysis was to “define the debris, size, weight, exit velocity, and trajectory that can be used to update [AC] 20-128A.” The abstract stated that the results of the analysis showed that, according to the debris trajectories that were examined,

52 A fragment spread angle is “the angle measured, fore and aft, from the center of the plane of rotation initiating at the engine or APU shaft centerline.” 53 AC 20-128A stated that an alternative engine failure model, with a single large one-third piece of disk having a fragment spread angle of ± 5°, could be used for analysis. As part of the investigation of the American Airlines flight 383 accident, Boeing used this more conservative model to perform a trajectory analysis, as discussed in section 2.1. 54 AC 20-128A included accepted design precautions to reduce the overall risk of an uncontrolled fire for fuel tanks located in impact areas, as discussed in section 2.4.3.

NTSB Aircraft Accident Report 40 “the trajectories defined in AC 20-128A are too narrow and should be expanded significantly.” Further, the abstract stated the following: “during an uncontained event the aircraft is subjected to multiple ‘small’ fragment impacts, not just a single impact. It is the combined effects from the small fragments that pose the highest hazard potential to the aircraft” (FAA 1999). In addition, the report indicated that the Aviation Rulemaking Advisory Committee (ARAC) 25.903(d)(1) Task Group was revising the engine uncontainment fragment model defined in AC 20-128A. On November 2, 2001, the FAA issued a notice of new task assignment for the ARAC regarding transport airplanes and engine issues (66 Federal Register 56729, November 9, 2001). The notice indicated that the new task assignment included the following actions: • reviewing the acceptable design precautions for showing compliance with the regulations described in AC 20-128A, including 14 CFR 25.903(d)(1), and developing additional design precautions to mitigate shortfalls that the ARAC previously identified (which, according to the FAA, were associated with difficulties getting manufacturers to fully comply with the AC for minimizing the uncontained engine debris fragment threat); • developing a report that recommends the requirements for minimizing the hazards from uncontained engine debris; and • recommending revisions to AC 20-128A and developing additional advisory materials to address issues resulting from changes to the regulations (FAA 2001). The notice stated that the ARAC accepted the task and assigned it to the Powerplant Installation Harmonization Working Group. The notice also stated that the task was required to be completed no later than November 7, 2003. In an undated letter signed by the manager of the FAA’s Transport Airplane Directorate, Aircraft Certification Service, the FAA informed the Assistant Chair of the Transport Airplane and Engine Issue Group of a moratorium regarding certain ARAC taskings of the group. The FAA’s letter stated the following: During the November 2002 Harmonization Management Team Meeting, industry requested that the FAA consider placing a moratorium on certain lower priority ARAC taskings while the FAA, Joint Aviation Authorities (JAA), and Transport Canada (TCCA), worked to develop a joint rulemaking priority list…to conserve resources until a final rulemaking priority list could be implemented. The FAA agreed with industry’s request and identified tasks to be placed under the moratorium. These tasks included those associated with the Powerplant Installation Harmonization Working Group. As a result, work related to the actions in the November 2001 new task assignment ceased. As of December 2017, AC 20-128A had not been updated.

NTSB Aircraft Accident Report 41 1.6.6.2 Inspection Techniques for Nickel Billets In September 2005, the FAA issued a report titled Inspection Development for Nickel Billet—Engine Titanium Consortium Phase II.55 According to the report, the purpose of the consortium’s Phase II program was to “develop higher-sensitivity inspection methods for nickel (Ni) billets that could be used to reduce the occurrence of melt-related defects in Ni forgings and, therefore, lower the engine failure risk” (FAA 2005). Alloy 718 was evaluated using a 10-inch-diameter billet and a multizone ultrasonic inspection procedure. The program established an overall goal of “four times improvement over the current conventional method,” which was achieved. Specifically, the report stated that the multizone inspection procedure exceeded the program goal of a No. 1 flat-bottom hole for alloy 718 by a minimum of 3.5 times and was a minimum of 31 times more sensitive at the billet center than the current inspection requirements.56 The report also stated that a factory assessment showed that the multizone inspection procedures were “more sensitive” than the current inspection procedures in detecting surface blemishes. In addition, the report stated that a factory demonstration produced conclusive results showing that, for alloy 718, the multizone inspection procedures could detect indications that would be missed by current inspection procedures (FAA 2005). Multizone inspection procedures, as well as phased array inspection procedures (another high-sensitivity ultrasonic inspection technique), were compared with current inspection procedures for a 5-inch-diameter billet, which is another typical billet diameter, made of another nickel alloy. The multizone inspection achieved a sensitivity of about a No. 0.5 flat-bottom hole throughout most of the billet depth, which exceeded the current inspection sensitivity by about 20 times at the billet center. The phased array inspection achieved a sensitivity of about a No. 0.75 flat-bottom hole. 1.6.6.3 Definition of Stealth Anomalies In April 2008, the FAA issued a report titled Turbine Rotor Material Design—Phase II, which addressed “the threat of material or manufacturing anomalies in high-energy rotating

55 The FAA established the Engine Titanium Consortium in 1993 as a result of a recommendation from the agency-sponsored titanium rotating components review team (which was formed in response to Safety Recommendation A-90-167—see section 1.7.3.1). The consortium consisted of a team of researchers from academia and industry. According to the FAA, the objective of the consortium was to provide the FAA and engine manufacturers “with reliable and cost-effective new methods and/or improvements in mature methods for detecting cracks, inclusions, and imperfections in titanium material and components.” Phase I, which was completed in 1998, focused on “developing and understanding the fundamental material properties of titanium and hard alpha defects as they relate to their response to ultrasonic interrogation, developing tools for the detection of fatigue cracks…and developing and applying tools to assess the reliability of inspection of anomalies.” The FAA also stated that the work of the consortium had been expanded to include critical engine rotating components made of nickel alloys. 56 A flat-bottom hole is a machined hole, the bottom of which is perpendicular to the beam of the transducer used for the inspection. The reflective wave height is proportional to the area of the bottom of the hole or the square of the diameter of the hole. Billets with a 10-inch diameter are typically inspected to a sensitivity of a No. 2 flat-bottom hole, which is 2/64 inch (0.031 inch) in diameter. A No. 1 flat-bottom hole is 1/64 inch (0.016 inch) in diameter. Thus, reducing from a No. 2 to a No. 1 flat-bottom hole resulted in a “four times improvement” in sensitivity during inspections because of the change in the area of the hole.

NTSB Aircraft Accident Report 42 components” (FAA 2008). Under the heading “Definition of Stealth Anomalies,” the report stated the following: Historically, a number of rotor disk fracture and cracking events have originated from embedded anomalies, which, although they were substantial in size, were undetected by production inspections. These anomalies have been called ‘stealth’ anomalies due to their ability to evade inspection detection; i.e., the reflected signal is small relative to the inclusion size. The report also described different types of stealth anomalies, including the following: [A] category of stealth anomaly comprises those types that are ductile and well bonded, making them less likely to have cracking and voiding during ingot and billet conversion. The lack of cracking and voiding, combined with a similarity in elastic modulus and density to the parent alloy, renders them indistinguishable from the parent alloy for sonic detection. These anomalies…form a zone of material that is substantially weaker in tensile and fatigue capability than base metal [FAA 2008]. 1.6.6.4 Notice of Proposed Rulemaking GE performed a study of ultrasonic inspection indication rates from the mid-1990s to 2016 using samples from its suppliers of alloy 718 and determined that there were fewer indications in samples manufactured in 2000 and later due to processing improvements that had been implemented before those samples were manufactured. As a result, on June 29, 2017, GE issued Service Bulletin (SB) 72-1562, “CF6-80C2 Stage 1 and Stage 2 HPTR [High Pressure Turbine Rotor] Disk Ultrasonic Inspection,” for HPT stage 1 and 2 disks manufactured before 2000.57 A revised SB was issued on July 28, 2017, because of changes to two paragraphs and an appendix listing the serial and part numbers of affected disks.58 On September 1, 2017, the FAA issued a notice of proposed rulemaking (NPRM) titled “Airworthiness Directives; General Electric Company Turbofan Engines” (82 Federal Register 42261, September 7, 2017). The NPRM stated that the FAA proposes to adopt a new AD for certain GE CF6-80-series turbofan engines, including the CF6-80C2B6, as a result of the uncontained failure of an HPT stage 2 disk. The NPRM also stated that the proposed AD would require ultrasonic inspections for cracks in HPT stage 1 and stage 2 disks at each piece-part opportunity in accordance with GE’s SB 72-1562. Further, the NRPM stated that, if the unsafe condition were not corrected, “uncontained HPT disk release, damage to the engine, and damage to the airplane” could result (FAA 2017). In an October 13, 2017, letter to the Department of Transportation, the NTSB expressed its full support for the proposed AD.

57 CF6-80C2 HPT stage 1 and 2 disks have similar stress/volume characteristics, so GE decided to have stage 1 disks inspected in addition to stage 2 disks. 58 SB 72-0869, “CF6-80A Stage 2 HPTR Disk Ultrasonic Inspection,” was issued on August 22, 2017. The FAA indicated that the part numbers referenced in the appendix of revised SB 72-1562 applied to CF6-80C2 and CF6-80A engines.

NTSB Aircraft Accident Report 43 1.7 Additional Information 1.7.1 Discrete White Spot Formation In the nickel alloy manufacturing industry, it is generally accepted that discrete white spot formation is an inherent, yet infrequent, characteristic of the vacuum arc remelting process (described in section 1.3.1.1 and depicted in figure 3). A discrete white spot forms typically when a solid piece of either the original or the newly created ingot detaches from the outer edge, falls through a molten liquid layer, and becomes incorporated in the newly created ingot before the piece becomes completely molten. Although electroslag remelting and vacuum arc remelting (the second and third steps of the triple-melt process, respectively) both involve an original ingot that is consumed and a new ingot that is formed, discrete white spots are less likely to occur in an electroslag remelting ingot than in a vacuum arc remelting ingot. Specifically, according to a member of the Advanced Metallurgical Group in the Netherlands, with the electroslag remelting process, the molten superheated slag prevents the formation of crown material (solidified material above the liquid level) and gives the small detached pieces more time to become molten before solidification in a newly created ingot.59 Discrete white spots could be harmful depending on their overall size, chemistry, and grain size and the presence of oxide/nitride clusters, which can cause cracks to form during the forging process at the billet conversion stage or during the final forging stage. Data indicated that discrete white spots formed less frequently (based on the number of ultrasonic test inspection indications) using a triple-melt process than a double-melt process, even though both processes include vacuum arc remelting (Moyer et al. 1994). Ultrasonic test inspection data showed that many indications in superalloys (high-performance alloys) were cracks associated with discrete white spots. Those discrete white spots with clusters of oxide, nitride, and/or carbonitride (a carbon and nitrogen compound) particles were considered to be discrete dirty white spots (Jackman et al. 1994). 1.7.2 Master Heat FA94 As stated in section 1.3.1.1, vacuum induction melting—the first step of the triple-melt process—is also referred to as the master heat, and the ingots that were produced during this process, designated as FA94-1 through -5 (with the HPT stage 2 disk manufactured from FA94-2), were part of a group collectively referred to as Master Heat FA94. A total of 36 parts, including the HPT stage 2 disk, were produced from Master Heat FA94.60 At the time of the accident, 8 of the 36 parts (not including the HPT stage 2 disk) were in an operating status, available for installation into an engine/airplane, or scrapped but

59 For more information, see ALD Vacuum Technologies’ web page on electroslag remelting (http://web.ald- vt.de/cms/vakuum-technologie/anlagen/electroslag-remelting-esr/, accessed January 10, 2018). (ALD Vacuum Technologies is a member of the Advanced Metallurgical Group.) 60 Six parts were manufactured from FA94-1. Nine parts were manufactured from FA94-2. Seven parts were manufactured from FA94-3. Eight parts were manufactured from FA94-4. Six parts were manufactured from FA94-5.

NTSB Aircraft Accident Report 44 not destroyed; all 8 parts were sent to GE for inspection.61 GE performed high-resolution ultrasonic inspections on all eight parts using a technique that had a greater detection sensitivity than what was available at the time that the parts were produced. GE did not find defects in any of the eight parts. GE reviewed the production records for Master Heat FA94 and compared the records with those for other ingots/billets that ATI SM produced for GE during that same time period. GE did not identify any information in the records to indicate that Master Heat FA94 had a different potential for white spot formation than other master heats that were produced about the same time. Also, GE did not identify any information in the records to indicate that ingot FA94-2 had a different potential for white spot formation than the other ingots of Master Heat FA94.62 1.7.3 Previous Related Safety Recommendations 1.7.3.1 Recommendations From United Airlines Flight 232 Accident On July 19, 1989, United Airlines flight 232, a DC-10-10, experienced a catastrophic failure of the No. 2 tail-mounted engine during cruise flight when the separation, fragmentation, and forceful discharge of stage 1 fan rotor assembly parts led to the loss of the three hydraulic systems that powered the airplane’s flight controls. The flight crew experienced severe difficulties controlling the airplane, which subsequently crashed during an attempted landing at Sioux Gateway Airport, Sioux City, Iowa. Of the 285 passengers and 11 crewmembers aboard, 110 passengers and 1 flight attendant died.63 As a result of this accident, the NTSB made the following recommendations to the FAA on December 14, 1990: Intensify research in the nondestructive inspection field to identify emerging technologies that can serve to simplify, automate, or otherwise improve the reliability of the inspection process. Such research should encourage the development and implementation of redundant (‘second set of eyes’) inspection oversight for critical part inspections, such as for engine rotating components. (A-90-167) Analyze the dispersion pattern, fragment size and energy level of released engine rotating parts from the July 19, 1989, Sioux City, Iowa, DC-10 accident and include

61 Of the remaining 27 parts produced from Master Heat FA94 (not including the HPT stage 2 disk), 19 had been destructively scrapped, and 8 were being used in industrial power generation applications and were not removed for inspection. 62 The Powerplants Group also reviewed the records for Master Heat FA94 and ingot FA94-2 and found no anomalies or deviations from the approved production process. 63 The NTSB determined that the probable cause of this accident was “the inadequate consideration given to human factors limitations in the inspection and quality control procedures used by United Airlines’ engine overhaul facility which resulted in the failure to detect a fatigue crack originating from a previously undetected metallurgical defect located in a critical area of the stage 1 fan disk that was manufactured by General Electric Aircraft Engines. The subsequent catastrophic disintegration of the disk resulted in the liberation of debris in a pattern of distribution and with energy levels that exceeded the level of protection provided by design features of the hydraulic systems that operate the DC-10’s flight controls” (NTSB 1990).

NTSB Aircraft Accident Report 45 the results of this analysis, and any other peripheral data available, in a revision of AC 20-128 for future aircraft certification. (A-90-170) Create the mechanism to support a historical data base of worldwide engine rotary part failures to facilitate design assessments and comparative safety analysis during certification reviews and other FAA research. (A-90-172) Regarding Safety Recommendation A-90-167, on September 16, 1991, the FAA stated that, in May 1991, its Engine and Propeller Directorate sponsored a titanium review conference, during which the titanium rotating components review team report (dated December 14, 1990) was released to industry and public participants. According to the FAA, the report identified several recommendations regarding manufacturing process control, manufacturing inspection, in-service inspection, design procedures, research and development, and FAA policy and guidance. The FAA also indicated that several agency initiatives defined in the titanium rotating components review team report encompassed the nondestructive evaluation aspects of rotating components. As a result, on April 2, 1992, the NTSB classified the recommendation “Closed—Acceptable Action.”64 Regarding Safety Recommendation A-90-170, on June 19, 1997, the FAA stated that it issued AC 20-128A on March 25, 1997. According to the FAA, the AC presented a method of compliance with the requirements of 14 CFR 23.901(f), 23.903(b)(1), and 25.901(d)(1), which addressed design precautions to minimize the hazards to an airplane in the event of an uncontained engine or APU failure. On the basis of the FAA’s action, the NTSB classified the recommendation “Closed—Acceptable Action” on August 26, 1997. Regarding Safety Recommendation A-90-172, on September 10, 1998, the FAA stated that it would maintain an uncontained turbine engine debris characterization and mitigation database within the aircraft catastrophic failure prevention program. The FAA also stated that these data would be available for future design assessments, safety analyses, and research. As a result, the NTSB classified this recommendation “Closed—Acceptable Action” on December 8, 1998. In January 2010, the Aerospace Industries Association (AIA) issued a report titled High Bypass Ratio Turbine Engine Uncontained Rotor Events and Small Fragment Threat Characterization 1969-2006. The report was developed by an AIA working group comprising experts from transport-category airplane manufacturers and high-bypass turbofan manufacturers; the FAA did not participate.65 The report addressed, among other things, high-bypass turbofan disk bursts, their effects, and related trend analysis. According to the executive summary of the report, the data published in the report were collected from AIA’s rotor burst database for high- bypass turbofan engines, which AIA indicated was consistent with the intent of Safety Recommendation A-90-172 (AIA 2010).66 (As indicated in this section, AIA was not the recipient

64 As previously stated, the FAA established the Engine Titanium Consortium in response to one of the recommendations of the titanium rotating components review team. 65 Although the FAA was not a member of the working group, the report indicated that the FAA was represented on the data collection process team. 66 According to the AIA report, data from the association’s rotor burst database for high-bypass turbofan engines showed that, between 1969 and 2006, 58 nacelle uncontained disk events occurred; 46 of these events involved first-generation engines (designed in the late 1960s), and 12 of the events involved second-generation engines

NTSB Aircraft Accident Report 46 of that recommendation, and the FAA did not ask AIA to take action in response to the recommendation.) 1.7.3.2 Communication and Coordination Among Flight and Cabin Crews Safety Recommendation A-16-26 On October 6, 2016, the NTSB issued Safety Recommendation A-16-26 as a result of its investigation of the March 5, 2015, accident involving Delta Air Lines flight 1086, an MD-88 that was landing at LaGuardia Airport in New York, New York, when it departed the left side of the runway, contacted the airport perimeter fence, and came to rest with the airplane’s nose on an embankment next to Flushing Bay. The NTSB’s investigation determined that the captain did not convey a sense of urgency to evacuate the cabin and that the flight attendants were confused about the timing of the evacuation. The investigation also determined that the evacuation began about 12 minutes after the airplane came to a stop and that more than 17 minutes had elapsed between the time that the airplane came to a stop and the time that the passengers were off the airplane (NTSB 2016). As a result of that accident and the lack of FAA action to fully address recurring evacuation communication, coordination, and decision-making problems, the NTSB issued Safety Recommendation A-16-26, which asked the FAA to do the following:67 Develop best practices related to evacuation communication, coordination, and decision-making during emergencies through the establishment of an industry working group and then issue guidance for 14 Code of Federal Regulations Part 121 air carriers to use to improve flight and cabin crew performance during evacuations. On December 27, 2016, the FAA stated that it understood the importance of crewmember communication, coordination, and decision-making related to emergency evacuations and, as such, was considering the establishment of a working group to examine these issues and make recommendations. The FAA indicated that the working group would include representatives from the Air Line Pilots Association, the Association of Flight Attendants, the Association of

(designed in the 1980s). No events involved third-generation engines (designed in the 1990s). The data also showed that more than 90% of the disk bursts occurred during takeoff or initial climb. Although the AIA report noted the “low incidence of disk uncontainment demonstrated by the 2nd/3rd generation fleet,” the data on which this finding was based were for nacelle uncontained disk events. The American Airlines flight 383 accident was the first rotor burst event involving a second-generation (CF6-80C2) engine. Section 2.4.3 describes an uncontained engine failure involving a third-generation engine. 67 The final report on the investigation of the accident involving Delta Air Lines flight 1086 stated that the accident “demonstrated problems with evacuation communication, coordination, and decision-making. The NTSB has investigated other accidents in which similar problems occurred and made related safety recommendations.” These investigations included the accidents involving (1) a Tower Air 747 at Jamaica, New York, on December 20, 1995 (DCA96MA029); (2) a Delta MD-88 at Pensacola, Florida, on July 6, 1996 (DCA96MA068); (3) a Northwest Airlines DC-9 and a Northwest Airlines A319 at Minneapolis, Minnesota, on May 10, 2005 (CHI05MA111A and CHI05MA111B); and (4) an American Airlines MD-82 at St. Louis, Missouri, on September 28, 2007 (DCA07MA310, cited in the discussion for Safety Recommendation A-09-27 later in this section). The final report also cited the NTSB’s June 2000 safety study on emergency evacuations of commercial airplanes (discussed in section 1.7.3.3), which found continuing communication and coordination problems among flight and cabin crewmembers during airplane evacuations.

NTSB Aircraft Accident Report 47 Professional Flight Attendants, Airlines for America, and the FAA’s Flight Standards Service. On March 27, 2017, the NTSB classified Safety Recommendation A-16-26 “Open—Acceptable Response” pending the establishment of the working group and the development of the recommended best practices. Safety Recommendation A-09-27 On May 19, 2009, the NTSB issued Safety Recommendation A-09-27 as a result of its investigation of the September 28, 2007, accident involving American Airlines flight 1400, an MD-82 that experienced an in-flight engine fire during a departure climb from Lambert St. Louis International Airport, St. Louis, Missouri, and made a successful emergency landing on one of the airport’s runways. The NTSB found that, during the emergency situation, the flight attendants did not relay potentially pertinent information to the captain in accordance with company guidance and training. In addition, the NTSB found that the flight crew considered initiating an evacuation but did not communicate with the cabin crew to obtain and exchange information (NTSB 2009).68 Safety Recommendation A-09-27 asked the FAA to do the following: Revise Advisory Circular 120-48, “Communication and Coordination Between Flight Crewmembers and Flight Attendants,” to update guidance and training provided to flight and cabin crews regarding communications during emergency and unusual situations to reflect current industry knowledge based on research and lessons learned from relevant accidents and incidents over the last 20 years.[69] On August 28, 2012, the FAA stated that it was revising AC 120-48 to update the guidance regarding communications during emergency and unusual situations to reflect current industry knowledge based on lessons learned. The FAA indicated that it anticipated issuing the revised AC in 2013. On March 18, 2014, the NTSB stated that, according to its conversations with the FAA, the issuance of revised AC 120-48 was delayed by work associated with a final rule, but the FAA indicated that it still intended to issue the revised AC. As a result, Safety Recommendation A-09-27 remained classified “Open—Acceptable Response” pending completion of that action.70 In its final report on the Delta Air Lines flight 1086 accident, the NTSB noted that the FAA had still not issued revised AC 120-48. Also, given the inadequate communication and coordination among the Delta flight and cabin crewmembers that the NTSB’s investigation found, the NTSB reiterated Safety Recommendation A-09-27 and reclassified it “Open—Unacceptable Response.”

68 After a discussion with ARFF personnel, the flight crew decided not to evacuate, but the ARFF incident commander decided to deplane the passengers about 30 minutes later after heat and smoke were observed coming from a damaged engine. 69 The NTSB noted that this AC had not been updated since its issuance in July 1988 and thus did not reflect industry knowledge that was current at the time that the safety recommendation was issued. 70 Safety Recommendation A-09-27 was initially classified “Open—Acceptable Response” on April 2, 2010.

NTSB Aircraft Accident Report 48 In a March 27, 2017, letter to the FAA, the NTSB stated that the FAA’s December 23, 2016, letter about recommendations from the Delta flight 1086 investigation did not include any actions that were planned or taken in response to Safety Recommendation A-09-27. The NTSB noted that the FAA stated that, as part of the response to Safety Recommendation A-16-25, it was reviewing AC 120-48 and was considering needed revisions.71 The NTSB stated that the FAA should consider the requested actions in Safety Recommendation A-09-27 in any revisions to AC 120-48 and that Safety Recommendation A-09-27 remained classified “Open—Unacceptable Response.” 1.7.3.3 Retrieval of Carry-On Baggage On July 14, 2000, the NTSB issued Safety Recommendation A-00-88 as a result of the findings in its safety study, Emergency Evacuation of Commercial Airplanes. Specifically, the NTSB found that “the training that flight attendants receive with regard to passengers retrieving carry-on luggage does not address what to do when passengers do not follow the command to leave everything behind” (NTSB 2000). The NTSB also determined that techniques for handling passengers who do not listen to flight attendants’ instructions during evacuations needed to be addressed. Safety Recommendation A-00-88 asked the FAA to “develop advisory material to address ways to minimize the problems associated with carry-on luggage during evacuations.” On November 8, 2000, the FAA stated that, on July 24, 2000, it issued AC 121-29B, “Carry-On Baggage,” which provided information in plain language regarding compliance with carry-on baggage regulations.72 The FAA also stated that the AC indicated that operators were required to provide crewmember training that included the handling of carry-on baggage during an emergency. In addition, the FAA stated that it would issue a flight standards handbook bulletin for air transportation that included guidance for principal operations inspectors (POI) about the handling of carry-on baggage during an emergency. On July 25, 2001, the NTSB classified Safety Recommendation A-00-88 “Open—Acceptable Response” pending the issuance of the bulletin. On July 30, 2001, the FAA stated that FAA Order 8400.10, Air Transportation Operations Inspector’s Handbook, paragraph 1984, was revised to direct POIs to encourage their assigned certificate holders to ensure that specific procedures were included in crewmember manuals and training programs about the handling of carry-on baggage during an emergency.73 The FAA stated that this information should provide flight attendants with clear direction and guidance to minimize

71 Safety Recommendation A-16-25 asked the FAA to “require 14 Code of Federal Regulations Part 121 operators to provide (1) guidance that instructs flight attendants to remain at their assigned exits and actively monitor exit availability in all non-normal situations in case an evacuation is necessary and (2) flight attendant training programs that include scenarios requiring crew coordination regarding active monitoring of exit availability and evacuating after a significant event that involves a loss of communications.” This recommendation was classified “Open—Acceptable Response” on March 27, 2017. 72 According to AC 121-29B, the FAA did not make any substantive changes to the guidance in AC 121-29A. 73 FAA Order 8400.10 was canceled in October 2007. FAA Order 8900.1, Flight Standards Information Management System, was issued in August 2008. Volume 3 of FAA Order 8900.1, “General Technical Administration,” chapter 23, “Flight Attendant Training and Qualification Programs,” states that POIs “should work with their assigned certificate holders to ensure that they have specific procedures in the appropriate crewmember manuals and training programs that address the handling of carry-on baggage during an emergency and provide their F/As [flight attendants] with clear direction and guidance.”

NTSB Aircraft Accident Report 49 the identified problems associated with carry-on luggage. As a result of this revision, the NTSB classified Safety Recommendation A-00-88 “Closed—Acceptable Action” on January 3, 2002.

NTSB Aircraft Accident Report 50

1. Analysis

The flight crew was properly certificated and qualified in accordance with federal regulations and company requirements. A review of the flight crew’s work and sleep schedules and recent activities showed no evidence of factors that could have adversely affected the performance of either crewmember on the day of the accident. The airplane was properly certificated, equipped, and maintained in accordance with federal regulations. No evidence indicated any structural, engine, or system failures before the uncontained engine failure occurred. This analysis discusses the accident sequence, flight crew checklist issues, flight and cabin crew evacuation-related issues, and the manufacture and inspection of the HPT stage 2 disk and related guidance. 2.1 Accident Sequence The right engine failure occurred when the CVR recorded a “bang” sound, at which time the airplane’s airspeed was 128 knots. Both flight crewmembers then felt the airplane drift to the right, and the captain thought that the airplane was unsafe to fly. At that time, no warnings were being annunciated in the cockpit to indicate to the flight crew that an uncontained engine failure had occurred or that a fire had subsequently begun. The captain moved the throttles to the idle position when the airspeed was 130 knots and began the rejected takeoff maneuver. The start of the rejected takeoff maneuver occurred 1.2 seconds after the “bang” sound. The RTO autobrakes activated when the airspeed was 134 knots, which was also V1 for the flight. According to the American Airlines B767 Operations Manual, QRH, the decision to reject the takeoff must be made in time to start the maneuver by V1. The first officer informed the tower controller that the takeoff was being rejected, and the tower controller notified the flight crewmembers of a fire, which was their first indication of the fire. The airplane stopped on the runway about 26 seconds after the “bang” sound. The NTSB concludes that the captain made a timely decision to reject the takeoff and performed the maneuver in accordance with company training and procedures. The uncontained engine failure resulted from an HPT stage 2 disk rupture (rotor burst). The HPT stage 2 disk was recovered in four fragments (shown in figure 5 in section 1.3.3). One disk fragment and other exiting engine debris fragments (for example, blades, static hardware, or HPT stage 2 disk posts) impacted and penetrated through the inboard section of the right wing, creating two separate holes (shown in figure 7 in section 1.3.3). Disk fragments “B,” “C,” and “D” were recovered outboard of the right engine (to the north of the airplane); as a result, they could not have caused the damage observed inboard of the engine. In addition, disk fragments B, C, and D were likely part of a single disk piece that had fractured into three separate fragments after impacting the runway. Specifically, an impact ground scar/gouge was observed about 32 ft to the right of the runway 28R centerline (outboard of the right engine location). This ground scar/gouge was consistent with impact from a single HPT stage

NTSB Aircraft Accident Report 51 2 disk fragment. Thus, this disk fragment was most likely intact as it exited the right engine and nacelle and impacted runway 28R, creating the observed ground scar/gouge and fracturing into three pieces. The overstress fractures on disk fragments B, C, and D were consistent with a hard impact, which would be expected given the exit velocity, size, and weight of the disk fragment before it fractured. Disk fragment “A” was recovered about 2,935 ft south of the uncontainment location at a UPS building. Hole 1 (located in the inboard section of the right wing forward of the front spar) was too small for disk fragment A to fit through, and the edges of the hole exhibited tearing and ripping that were consistent with impact from smaller debris with less momentum, such as that from exiting engine debris fragments. The trajectory of the released debris showed that the debris did not impact the front spar but instead continued upward and exited the top of the leading-edge panel. The trajectory for the disk fragment causing the damage to the inboard section of the right wing aft of the front spar (hole 2) showed that the fragment entered the dry bay through the lower wing skin, severed the main engine fuel feed line, severed rib No. 6 (part of the inboard dry bay boundary), and continued through the upper wing skin.74 To create this damage, a large disk piece with significant energy would be needed. Disk fragment A weighed about 57 pounds and represented more than one-third of the disk. Thus, hole 2 was created by disk fragment A of the HPT stage 2 disk. Disk fragment A did not cause the impact damage observed on the fuselage, landing gear doors, and left engine nacelle; the cause of that damage was consistent with smaller exiting engine debris fragments. If disk fragment A, which was found intact, had struck the fuselage, landing gear doors, or left engine nacelle, the fragment would have created a sizeable hole due to the exit velocity, size, and weight of the fragment. Also, Boeing’s trajectory analysis, which estimated the exit angle for the disk fragment that departed the right engine and penetrated through the right wing, determined that the disk fragment exited the engine about 4.3° aft of the HPT stage 2 disk rotation plane and that the fragment passed over the fuselage. The NTSB concludes that the right engine experienced an uncontained HPT stage 2 disk rupture during the takeoff roll. The HPT stage 2 disk initially separated into two fragments. One fragment penetrated through the inboard section of the right wing, severed the main engine fuel feed line, breached the fuel tank, traveled up and over the fuselage, and landed about 3,000 ft away. The other fragment exited outboard of the right engine, impacting the runway and fracturing into three pieces. Postaccident observations of the HPT stage 2 disk fragments found that the fracture surfaces in the forward bore region of the disk exhibited a heat-tinted appearance. High-magnification optical examination of the fracture surfaces revealed the presence of dark gray subsurface material discontinuities with multiple cracks initiating along the edges of the discontinuities. Examination of the material underneath the largest discontinuity, which was about

74 The dry bay, which contains no fuel, is a compartment in each main fuel tank that is located directly above each engine in the forward part of the fuel tank.

NTSB Aircraft Accident Report 52 0.43 inch in length and 0.07 inch in width and was inclined about 26° to the bore centerline, revealed a discrete region underneath the discontinuity that appeared white compared with the surrounding material. Surrounding and interspersed within this region were stringers of micron-sized oxide particles referred to collectively as a “discrete dirty white spot.”75 The multiple cracks that had initiated along the edges of the discontinuities propagated radially inward toward the bore and outward toward the disk rim and blade slots. Under SEM examination, the cracks exhibited striations that slowly increased in spacing as the crack length increased, which was consistent with low-cycle fatigue.76 (Outside of the heat-tinted region, the fractures exhibited features consistent with overstress.) The NTSB concludes that the HPT stage 2 disk failed because of multiple low-cycle fatigue cracks that initiated from an internal material anomaly, known as a discrete dirty white spot, which formed during the processing of the material from which the disk was manufactured. Section 2.4 provides more information about the HPT stage 2 disk failure. 2.2 Checklist Issues 2.2.1 Decision to Perform Engine Fire Checklist The flight crew received aural and visual engine fire warnings after the captain’s decision to reject the takeoff.77 Given these warnings, the flight crew began the 16-step engine fire checklist, the first 5 steps of which were memory items.78 Step 3, which was accomplished about 4 seconds after the captain called “checklist,” instructed the flight crew to cut off the fuel control switch on the affected side (in this case, the right side), which shut down that engine. Step 5 instructed the flight crew to rotate the engine fire switch (shown in figure 15) to its stop and then wait 30 seconds to see if the engine fire warning light remained illuminated. If the light was still illuminated, the engine fire switch was to be rotated to its other stop.79 FDR data showed that the handle for the right engine fire extinguisher was pulled about 8 seconds after the captain called “checklist.” About 23 seconds after the handle was pulled, the captain asked the first officer if he had discharged the fire extinguisher bottle, and the first officer

75 Metallurgical cross-sections that GE prepared indicated that the discrete dirty white spot was a single anomaly measuring about 0.74 inch in length and that the oxide stringers exposed by the fracture were part of that anomaly. 76 The highest low-cycle fatigue cycle counts that the NTSB and GE obtained (when measuring the striation densities of multiple cracks as a function of crack size) were about 5,700 and 7,000 cycles, respectively, before the disk failed. The difference between the estimates was likely due to the subjectivity in measuring the striation densities and interpreting the results. 77 At 1432:00, the CVR recorded a sound similar to the EICAS engine fire warning, and the FDR recorded the ENG FIRE R and master WARNING annunciations at the same time. These warnings occurred 15 seconds after the captain rejected the takeoff and 10 seconds before the airplane came to a stop. 78 At 1432:04, the CVR recorded the captain stating “ok, let’s run the uh checklist”; about 11 seconds later, the first officer stated, “checklist for engine fire.” Commanding the engine fire checklist was consistent with American Airlines’ special purpose operational training for rejected takeoffs and evacuations (see section 1.6.3.1), which both flight crewmembers had received. 79 The engine fire checklist applied to in-flight operations as well as ground operations. This issue is discussed further in section 2.2.2.

NTSB Aircraft Accident Report 53 replied that he “pushed it twice.” The first officer then realized that he had pulled but not rotated the engine fire switch, at which time he accomplished that step. Because of the wind at the time (from 180° at 10 knots) in relation to the airplane’s location on runway 28R, the smoke was blowing away from the cockpit, and the flight crew could not readily see the amount of smoke coming from the right engine. Also, postaccident observations in an exemplar 767 airplane demonstrated that the first officer would not have been able to see the right engine and most of the right wing when looking out the cockpit right-side window from his seat. Thus, at that point, the flight crew was unaware of the severity of the fire.80 The flight crew was also unaware that the cabin was beginning to fill with smoke. About 4.5 seconds after the first officer discharged the fire extinguisher bottle in the right engine, the captain stated, “oh look at the smoke—check out the smoke.” The captain stated, during a postaccident interview, that he recognized that continuing the engine fire checklist would not be appropriate because the airplane was on the ground. He called for the evacuation checklist, which had nine steps, about 4 seconds after seeing the smoke. The captain stated that, while performing the evacuation checklist, he heard commotion outside the cockpit door and realized that the cabin was being evacuated. The fourth step of the evacuation checklist instructed the flight crew to cut off the fuel control switches to shut down both engines. Although the right engine had already been shut down as part of the engine fire checklist, shutting down the left engine did not occur until the flight crew depressurized the airplane (the third evacuation checklist step), which the captain reported took a long time, even though the airplane had not yet been in flight.81 (The NTSB notes that, at this point, the exits would have been opened, so the cabin would have already been depressurized.) FDR data showed that the left engine was shut down about 59 seconds after the airplane came to a stop, and video evidence showed that the left engine spooled down about 10 seconds later. The NTSB concludes that the captain’s decision to perform the engine fire checklist was appropriate given his training, the information provided by ATC, and the fire warnings in the cockpit. However, the design of the engine fire checklist delayed initiating the evacuation checklist, shutting down the left engine, and commanding an evacuation from the cockpit. 2.2.2 Engine Fire Checklist Design American Airlines’ engine fire/engine severe damage or separation checklist for the Boeing 767 did not differentiate between an engine fire in flight or an engine fire while the airplane was on the ground. As stated previously, step 3 of the checklist instructed the flight crew to cut off

80 During a postaccident interview, the first officer stated that, after evacuating the airplane, he was “surprised” to see flames on the right side of the airplane because he expected to see a small fire. 81 Although only two of the nine items on the evacuation checklist are associated with depressurizing the airplane, the captain thought that the evacuation checklist was “slow and cumbersome” because of the “large portion” of time needed to depressurize the airplane. In an October 2017 e-mail, Boeing indicated that, before the airplane’s takeoff rotation, the cabin pressure would be less than 0.05 psig above the ambient pressure, and the amount of time needed to depressurize the airplane would be “very short.” The CVR transcript showed that, at 1432:57, the first officer called “cabin altitude mode selector manual?” to which the captain replied “OK.” At 1433:01, the first officer called “cabin altitude control hold in climb.” About 4 seconds later, the captain replied, “okay. What about the—.” At 1433:07, the first officer called “fuel control switches both cutoff.”

NTSB Aircraft Accident Report 54 the fuel control switch on the affected side to shut down that engine. For an engine fire during flight, shutting down the affected engine only would be appropriate because the unaffected engine would be needed for continued flight; the items on the checklist after the first five memory items included actions related to configuring the airplane for landing. However, for an engine fire on the ground, the checklist did not include a step to shut down the unaffected engine or direct the flight crew to perform the evacuation checklist after the engine fire checklist memory items. Also, as stated previously, step 5 of the engine fire checklist consisted of rotating the engine fire switch to its stop, holding for 1 second so that a fire extinguisher bottle could discharge its contents (halon) to suppress the fire, and then waiting 30 seconds. If the engine fire warning light remained illuminated, the engine fire switch was to be rotated to its other stop and held for 1 second, which would discharge the second halon bottle. A Boeing fire specialist stated that the 30-second wait period in between discharging halon bottles was necessary because it would allow pilots time to deploy a secondary means to suppress an engine fire if it reignited due to hotspots within the engine core. The fire specialist also stated that the wait period would likely not be required on the ground; however, that information was not included in the checklist. American Airlines based the engine fire/engine severe damage or separation checklist on Boeing’s 767 checklist procedure for the same emergencies. Boeing’s engine fire checklist procedures for its other airplane models also appeared to be the same for an engine fire during flight or on the ground. However, other airplane manufacturers, including Airbus and Embraer, have a set of procedures for an engine fire on the ground and another set of procedures for an in-flight engine fire. American Airlines used both sets of procedures for its fleet of Airbus A319, 320, and 321 airplanes and Embraer E190 airplanes. The American Airlines A319/320/321 QRH “ENG (1 or 2) FIRE (On Ground)” checklist (dated July 5, 2016) had six immediate action items to be accomplished. Those items did not have any associated wait times. After the last item was accomplished, the checklist directed the flight crew to accomplish the evacuation checklist, if required. Similarly, the American Airlines E190 QRH (dated May 31, 2016) showed seven items under the “ENG (1 or 2) FIRE, Severe Damage or Separation” checklist. The first item referred the flight crew to the “Engine Fire on the Ground Checklist” (dated January 3, 2017), which had five items to be accomplished. Those items also did not have any associated wait times. After accomplishing the last item on the checklist, the flight crew was directed to either “establish and communicate a plan” or “accomplish Evacuation.”82 American Airlines’ engine fire checklists that are specific to ground operations did not include the 30-second wait time between discharging a fire extinguishing bottle and determining if the second bottle would need to be discharged as well. That time could be critical in terms of containing a fire and/or commanding an evacuation. The NTSB concludes that engine fire checklists that specifically address ground operations would allow a flight crew to secure an engine

82 The third step on the American Airlines A319/320/321 QRH nine-step evacuation checklist instructed pilots to depressurize the airplane if the pressurization system was in the manual operating mode. The eighth step on the American Airlines E190 QRH 12-step evacuation checklist was to “push in” the “pressurization dump” switch light; Embraer airplanes have a guarded “dump” switch light, which, upon pressing, would allow the outflow valves to quickly open, depressurizing the airplane.

NTSB Aircraft Accident Report 55 and command an evacuation, if required, in a timelier manner than engine fire checklists that do not differentiate between ground and in-flight operations. Therefore, the NTSB recommends that Boeing work with operators as required to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. The NTSB also recommends that American Airlines, for all airplanes that it operates, review existing engine fire checklists and make changes as necessary to ensure that the procedures would expeditiously address engine fires occurring on the ground without unnecessarily delaying an evacuation. The NTSB notes that American Airlines’ evacuation guidance for flight crews was focused on assessing the need for an evacuation occurring after landing because of “a significant in-flight event” rather than assessing the need, after a rejected takeoff, for an evacuation due to an engine fire and announcing the captain’s intentions. American Airlines could mitigate this issue by implementing the recommended action. In addition, the NTSB recommends that the FAA, when approving the operating procedures of a 14 CFR Part 121 air carrier, require operators to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. 2.3 Evacuation Issues 2.3.1 Evacuation Sequence All seven flight attendants reported that they remained in position at their assigned exits after the airplane came to a stop. Passengers moved quickly toward the exits and were urging the flight attendants to open them. The flight attendants stated that they tried to delay the evacuation because they had not received instructions from the flight crew to evacuate. However, due to the severity of the fire and the passengers’ panic, the flight attendants initiated an evacuation in accordance with their authority to do so in a life-threatening situation that involved fire and smoke. The flight attendants evacuated all 161 passengers, checked their assigned areas, and exited the airplane (except for the lead flight attendant, who waited for the flight crew before evacuating). The NTSB evaluated the flight attendants’ actions during the evacuation. The flight attendants assigned to the overwing exits (2L, 2R, and 3L) all observed fire on the right side of the airplane. Flight attendant 4, who was assigned to the right overwing exit, blocked the exit because of fire and smoke outside of the airplane, which was appropriate. Flight attendant 6 was responsible for operating the left overwing exit, and she was seated facing forward on the left-side aisle with flight attendant 7 seated behind her facing aft. During the evacuation, flight attendant 7 was responsible for elevating himself on a seat in the main cabin to provide flow control instructions to passengers, but instead he opened the left overwing exit at 1432:20 (10 seconds after the airplane came to a stop) and started evacuating passengers. Flight attendant 6 saw that flight attendant 7 had opened the exit, and she assumed his responsibility to direct passengers to usable exits. Video evidence showed that the left overwing exit slide was fully deployed 19 seconds after the airplane came to a stop and that the first occupant evacuated from that slide 12 seconds later, even though the engine did not fully spool down for another 38 seconds.

NTSB Aircraft Accident Report 56 Flight attendants 1 and 5 were assigned to the forward cabin doors (1L and 1R, respectively). Flight attendant 1 (the lead flight attendant) decided to initiate an evacuation because smoke had started to fill the cabin and passengers were rushing toward the front of the airplane to evacuate. Consistent with company procedures, flight attendant 1 picked up the interphone to notify the flight crew that he was going to initiate an evacuation, but he did not later remember if he performed the step to call the flight crew. Flight attendant 1 opened the 1L door at 1432:38 (28 seconds after the airplane came to a stop) and evacuated passengers via the 1L door slide. Flight attendant 5 opened the 1R door at 1432:42 (32 seconds after the airplane came to a stop) after flight attendant 1 initiated the evacuation, but she immediately blocked that exit because the engine fire would be too close to the 1R door slide. Flight attendants are trained to assess conditions outside of doors that they are operating by looking through a window in the doors. If all conditions are met (no smoke, fire, or airplane or ground debris), the doors can be opened, and the flight attendants can continue to assess the conditions outside of the airplane. It is possible that flight attendant 5 did not see the extent of the fire until the 1R door was fully opened because of the limited viewing area of the door window. Once the door was fully opened, she recognized that the fire would present a danger and took appropriate action to prevent passengers from using that exit. Flight attendants 2 and 3, who were assigned to the aft cabin doors (4L and 4R, respectively), saw fire on the right side of the airplane. Because she could hear the left engine running, flight attendant 2 initially blocked her assigned exit, which was appropriate. She tried to contact the flight crew on the interphone to report that the left engine was running but had difficulty using the interphone. She opened the 4L door at 1432:48 (38 seconds after the airplane came to a stop).83 Flight attendant 3 also blocked his exit because of smoke and fire outside the door, which was appropriate. He tried to use the interphone to make a PA announcement to calm passengers but also had difficulty using the interphone. (The difficulty that these flight attendants experienced with the interphone is discussed in section 2.3.2.1.) Although the actions of flight attendant 7 in assessing and opening the left overwing exit did not slow the evacuation at this exit, performing flight attendant 6’s assigned responsibilities was contrary to company procedures and training. Also, flight attendant 7 deviated from the evacuation procedures in the Flight Service Inflight Manual, which indicated that “prior to opening an exit, assess conditions outside to determine if exit and escape route [are] safe,” and began evacuating passengers from the left overwing exit. However, after opening the left overwing exit, flight attendant 7 should have recognized, from the sound of the engine, that the exit would not be viable for an evacuation. (The sound of the engine would have been the primary cue to flight attendant 7 that the engine was still operating.) Given the location of the left overwing exit relative to the left engine, flight attendant 7 should have blocked the exit until the engine was shut down. Flight attendant 7 stated that he assumed that the left engine was still running but not at “full blast mode” because the airplane had come to a stop. He also stated that his main concern was getting passengers off the airplane because of the fire. However, the evacuation guidance

83 Flight attendant 2 decided eventually to allow passengers to evacuate from her assigned exit because the cabin was filling with smoke. However, she and flight attendant 3 had to hold passengers back until the slide stabilized; after deployment, the slide was blowing toward the back of the airplane because the left engine had not yet been shut down.

NTSB Aircraft Accident Report 57 specifically indicated that “engine(s) still operating” was an unsafe condition. The one serious injury that resulted during the evacuation occurred after a passenger evacuated using the left overwing exit. Once on the ground, the passenger stood up to get away from the airplane but was knocked down by the jet blast coming from the left engine. The NTSB concludes that the flight attendants made a good decision to begin the evacuation given the fire on the right side of the airplane and the smoke in the cabin, but the left overwing exit should have been blocked while the left engine was still operating because of the increased risk of injury to passengers who evacuated from that exit. Therefore, the NTSB recommends that the FAA develop and issue guidance to all air carriers that conduct passenger-carrying operations under 14 CFR Part 121 regarding (1) discussing this accident during recurrent flight attendant training to emphasize the importance of effectively assessing door and overwing exits during an unusual or emergency situation and (2) providing techniques for identifying conditions that would preclude opening exits, including an operating engine. The NTSB notes that a safety alert for operators (SAFO) could be an effective means for conveying this information to affected Part 121 carriers.84 2.3.2 Flight and Cabin Crew Communication The American Airlines B767 Operations Manual, QRH guidance stated (in the General Information section) that, if an immediate evacuation is not required, the captain should make a PA announcement commanding “This is the Captain. Remain Seated. Remain Seated. Remain Seated” to assure the flight attendants and passengers that the situation was under control. The guidance did not require captains to consult with flight attendants before making this announcement. Although the flight 383 captain called for the engine fire checklist 5.7 seconds before the airplane came to a stop, an announcement communicating the captain’s initial assessment that an immediate evacuation was not necessary would have provided awareness to the flight attendants of the flight crew’s intentions. During postaccident interviews, three of the flight attendants reported that, after the airplane came to a stop, they expected an announcement from the cockpit. It is understandable that the flight crew was focused on securing the right engine (given the engine fire warnings and the report of fire from ATC), and the NTSB recognizes that the flight crew’s performance of the engine fire and evacuation checklists was consistent with American Airlines’ training and procedures. Nevertheless, there would likely have been enough time, after the airplane came to a stop, for the captain to quickly instruct the flight attendants and passengers to remain seated. This statement could have then resulted in the flight attendants notifying the flight crew of the magnitude of the fire on the right side of the airplane and the need to shut down the engines. Such communication between the flight and cabin crews would have been effective crew resource management (CRM). Also, the QRH provided the following flight crew evacuation guidance: “the Captain must evaluate a specific situation, apply good judgment, and reach the best decision given the information available.” Communication from the flight attendants to the flight

84 According to the FAA’s website (www.faa.gov, accessed January 10, 2018), a SAFO “is an information tool that alerts, educates, and makes recommendations to the aviation community.”

NTSB Aircraft Accident Report 58 crew regarding the conditions inside the cabin and outside the airplane would have helped the captain make an informed decision about the timing of the evacuation. The NTSB is also concerned that none of the flight attendants alerted the flight crewmembers about the evacuation. As previously stated, the flight attendants tried to delay the evacuation because they had not received evacuation instructions from the cockpit, but they initiated the evacuation, although the left engine was still running, due to the severity of the fire and the passengers’ panic. The American Airlines Flight Service Inflight Manual described the importance of having flight attendants update the captain if cabin conditions warrant an evacuation. Although the manual described the flight attendants’ authority to initiate an evacuation in a life-threatening situation without awaiting instructions from the flight crew, the manual also stated that flight attendants were to attempt to communicate with the flight crew before the evacuation if possible. Because one (or possibly two) of the seven flight attendants attempted to contact the flight crew via the interphone (but were unsuccessful, as further discussed in the next section), there was adequate time for the flight attendants to communicate with the flight crewmembers and alert them about the evacuation. During a postaccident interview, one flight attendant stated his opinion that it was not a priority to be on the phone if an engine fire occurred. If that were the case, the flight attendants could have activated the evacuation signaling system located on the flight attendant jumpseat control panels, which would have provided an aural and a visual alert in the cockpit. If any of the flight attendants had taken that action, the flight crewmembers would immediately have known that an evacuation was underway, and they could have reacted accordingly. American Airlines trained flight attendants to use the signaling system for an evacuation, and evacuation procedures in the flight attendant manual stated, “on aircraft such equipped, turn on signaling system,” so it is unknown why none of the flight attendants used the system to alert the flight crew. The captain reported that he became aware that a flight attendant-initiated evacuation was underway when he heard commotion outside the cockpit door. Although a “DOOR” message would have appeared on the EICAS screen when the cabin doors were opened, postaccident simulator testing showed that the messages would not have been visible on the EICAS screen for long because of the other displayed alerts resulting from the emergency. Also, because the flight crewmembers would have been focused on performing checklists, they would not likely have noticed the door alerts. Further, after the engines were shut down, the EICAS screen would not have been displaying alerts and other pertinent information. During a postaccident interview, the captain stated that he learned from videos of the evacuation that the left engine was still running when the exits were opened. The captain also stated that, if he had that awareness when he heard the commotion, he would have shut down the left engine sooner. The flight attendants had both the evacuation signaling system and the interphone system available to them to communicate with the flight crew, but none of the flight attendants activated the signaling system, and the flight attendants who attempted communication using the interphone system were unsuccessful in reaching the flight crew.

NTSB Aircraft Accident Report 59 Even with an unfolding emergency, there should have been better communication between the flight and cabin crews. The lack of communication resulted in the flight crew being unaware of the developing situation in the cabin and the flight attendants initiating an evacuation with the left engine still operating. If the left engine had been shut down earlier, the 4L slide would have been available for evacuation sooner because the slide would not have been affected by the jet blast coming from the engine.85 Also, the only serious injury resulting from the evacuation (which, as previously stated, occurred when a passenger, once on the ground, was knocked down from the jet blast coming from the left engine) might have been avoided. The NTSB concludes that, if the flight crew or the flight attendants had communicated after the airplane came to a stop, the flight crew could have become aware of the severity of the fire on the right side of the airplane and the need to expeditiously shut down the engines. Section 2.3.2.2 discusses recurring evacuation-related communication and coordination issues that the NTSB has found during multiple investigations. In this investigation, the flight attendants not alerting the flight crew that the cabin was being evacuated and the captain not announcing his intention not to immediately evacuate are examples of such issues. 2.3.2.1 Interphone Issues During postaccident interviews, three flight attendants indicated that they attempted to use the interphone before the evacuation. Flight attendant 2 tried to use the interphone to contact the cockpit and alert the flight crew that the left engine was running but was unsuccessful because she pressed the wrong numbers. Flight attendant 3 tried to use the interphone to make an announcement in the cabin to calm the passengers but could not recall how to use the interphone. The NTSB could not determine if flight attendant 1 attempted to place a call to the cockpit and experienced difficulty with the interphone or picked up the interphone without actually placing a call. Depending on their delivery date, American Airlines 767-300-series airplanes either have a “classic” model interphone system (shown in figure 14a) or a “new” model interphone system (shown in figure 14b). As a result, flight attendants who are qualified on the 767 airplane need to know how to use both interphone system models. The new model interphone, which was installed on the accident airplane, requires additional steps to operate compared with the classic model interphone. To use the new model interphone, the flight attendant would need to turn over the handset and read the communication options for the location within the airplane to be called and then input the symbol (if required) and/or number(s) for that location on the key pad. In contrast, the classic model interphone has a key pad with buttons labeled for the pilot and forward, mid-, and aft cabin locations. Also, both interphone models have a “push to talk” button, but, for initial calls that do not go through, the new model interphone requires flight attendants to reset the interphone by either placing the interphone back into its cradle or pressing the reset button before pressing the “push to talk” button. During a postaccident interview, American Airlines’ manager of flight attendant training stated that flight attendants are trained on interphone systems during initial training, airplane

85 Video evidence showed that, 46 seconds after the airplane came to a stop, the 4L slide was fully deployed but was unusable because it was blown aft by left engine. After the engine was shut down, the slide repositioned itself, and the first occupant evacuated from that slide 1 minute 25 seconds after the airplane came to a stop.

NTSB Aircraft Accident Report 60 differences training, and recurrent training. However, during recurrent training, which the accident flight attendants received, the subject was presented via a web-based course and not through hands-on experience using an interphone during simulated emergencies. Also, the new interphone system was not installed on either of the 767 simulators used for flight attendant training. The NTSB could not determine, based on the available evidence, if the flight attendants’ difficulty operating the interphone was directly related to training deficiencies or the stress associated with the situation. Because the interphones on the accident airplane were located at the 1L, 1RC, 2R, 4L, and 4R jumpseats, flight attendants who regularly sit in the 2L and 3L jumpseats and the 1LC, 4LC, and 4RC jumpseats (which were unoccupied during the accident flight) would generally not have an opportunity to use the interphone except during training. The NTSB notes that flight attendants 2 and 3, who were located at flight attendant stations with an interphone and would likely have had experience using the interphone during operations, did not use the interphone properly during the emergency. The NTSB concludes that American Airlines did not adequately train flight attendants qualified on the Boeing 767 to effectively use the different interphone system models installed on the airplane during an emergency. According to a September 2017 e-mail from American Airlines, the company planned to incorporate “hands-on training for the handset differences” in January 2018 for initial flight attendant training and in April 2018 for recurrent flight attendant training. American Airlines also stated that it “continues to work on providing a job aid in the interim to our Flight Attendants to further identify the differences in handsets.” In addition, paragraph (b)(2) of 14 CFR 121.417, “Crewmember Emergency Training,” addresses training in the operation of emergency equipment but does not include the interphone system among the equipment required to be trained. It is important that flight attendants are fully knowledgeable about the interphones on every airplane for which they are qualified because flight attendants cannot access the cockpit quickly to speak directly with the flight crew during an emergency given the increased cockpit security that was implemented after the events of September 11, 2001. Further, not all flight attendants have routine experience using the interphone during actual flights; thus, it is also important for flight attendants to receive the necessary training that would allow them to successfully operate the interphone, regardless of the interphone system make and model, under the stress associated with an emergency situation. At the time of the accident, American Airlines operated 13 different interphone systems across its airplane fleet, and the differences among interphone systems could affect evacuation communications during an emergency if company flight attendants were not familiar with, and comfortable operating, various interphone system models. Such a situation could also affect flight attendants at other air carriers as well as flight crews.86 Therefore, the NTSB recommends that the FAA review the training programs of all 14 CFR Part 121 operators and make changes as necessary to ensure that the programs provide flight attendants and flight crews with training aids

86 The American Airlines simulators used to train 767 flight crewmembers included only the classic model interphone.

NTSB Aircraft Accident Report 61 and hands-on emergency scenarios that account for the different interphone systems that air carriers operate. In December 2017, the United Kingdom’s Air Accidents Investigation Branch (AAIB) issued its final report on the June 26, 2016, incident involving an American Airlines Airbus A330 at Heathrow Airport, London, England.87 According to the report, the cabin filled with smoke after boarding due to the failure of the APU load compressor carbon seal, which allowed hot oil to enter the bleed air supply to the cabin. Several flight attendants attempted to contact the flight crew, but they used the normal interphone call function and not the emergency call function.88 The flight crew did not respond to the flight attendants (possibly because the sound of the master warning blocked the tone associated with a normal interphone call from the cabin), and one of the flight attendants initiated a passenger evacuation while the airplane was still parked at the gate. Similar to the NTSB’s findings from the AA383 investigation, the AAIB found that the flight attendants were trained to operate interphones on several types of airplanes and that emergency calls were initiated in different ways depending on the airplane type. Because the interphone handset keypad layouts are not standardized and this lack of standardization might have been a factor in the flight attendants’ inability to initiate an emergency call, the AAIB issued Safety Recommendation 2017-024, which asked the FAA to “regulate the operation of interphone handsets, including during emergency communications, so that it is standardised irrespective of aircraft type.”89 The NTSB recognizes that a standardized interphone system design could minimize any confusion when using the interphone during an emergency. However, the NTSB also recognizes the difficulty that would be associated with standardizing the interphone system design among all airplane models so equipped. As a result, the NTSB issued Safety Recommendation A-18-8 because we believe that the most efficient and effective manner to address issues associated with flight attendants’ use of the interphone would be to have the FAA work directly with Part 121 operators to ensure that their flight attendant training programs account for the different interphone systems that each air carrier operates. 2.3.2.2 Recurring Evacuation-Related Issues The NTSB’s report on the March 5, 2015, Delta Air Lines flight 1086 accident explained that we have a long history of investigating accidents involving inadequate evacuation-related communication and coordination and issuing safety recommendations to resolve these issues (NTSB 2016).90 The report also noted that FAA efforts to fully address the issues had thus far been

87 For more information, see “AAIB investigation into Airbus A330-323, N276AY” at the AAIB’s website (accessed January 10, 2018). 88 The NTSB notes that the flight attendants involved in this incident and the flight attendants aboard the flight 383 airplane received the same general interphone training (in addition to airplane-specific interphone training.) 89 AAIB Safety Recommendation 2017-025 asked that the European Aviation Safety Agency take the same action as requested in Safety Recommendation 2017-024. 90 The Delta flight 1086 report also identified inadequate evacuation decision-making as a recurring safety issue. For this accident, the captain made an appropriate decision to suspend the engine fire checklist and begin the evacuation checklist.

NTSB Aircraft Accident Report 62 insufficient. As a result, the NTSB issued Safety Recommendation A-16-26, which advocated for a multidisciplinary approach to develop best practices to resolve recurring evacuation-related issues by focusing on analyzing data involving airplane evacuations and identifying ways to improve flight and cabin crewmember performance. In response to this recommendation, the FAA stated that it was considering whether to establish a working group comprised of government and industry subject matter experts to examine recurring evacuation-related issues and make recommendations. In March 2017, the NTSB classified Safety Recommendation A-16-26 “Open—Acceptable Response.” The NTSB’s report on the Delta flight 1086 accident also reiterated Safety Recommendation A-09-27, which asked the FAA to update the guidance and training provided to flight and cabin crews regarding communication and coordination during emergency and unusual situations to reflect current industry knowledge based on research and lessons learned. Safety Recommendation A-09-27 is currently classified “Open—Unacceptable Response” because the FAA has still not revised AC 120-48, “Communication and Coordination Between Flight Crewmembers and Flight Attendants,” despite its correspondence indicating that the revised AC was anticipated in 2013. (The AC was last updated in July 1988.) The NTSB is investigating two other accidents with emergency evacuation issues. On September 8, 2015, British Airways flight 2276, a Boeing 777-200 equipped with two GE90-85B engines, experienced an uncontained left engine failure during the takeoff ground roll and caught fire at McCarran International Airport in Las Vegas, Nevada. The fire was extinguished by ARFF personnel. The 157 passengers and 13 crewmembers evacuated on the runway via emergency exit slides. On October 29, 2015, Dynamic International Airways flight 405, a Boeing 767-200ER with 101 occupants aboard, was taxiing for departure at Fort Lauderdale-Hollywood International Airport in Fort Lauderdale, Florida, when fuel began leaking from the left engine, causing a fire.91 Information in the dockets for these accidents indicated that both evacuations began while an engine was still operating, demonstrating that communication and coordination issues between flight and cabin crews continue to exist during airplane evacuations. In its report on the September 2007 accident involving American Airlines flight 1400 in St. Louis, Missouri, the NTSB found that the safety risks posed by inadequate flight and cabin crew communications in emergency situations were not effectively addressed by AC 120-48. When the NTSB issued Safety Recommendation A-09-27 in May 2009, the AC guidance was more than 20 years old. The FAA has not taken any steps to satisfy the recommended action in the more than 8 years since the recommendation was issued. The FAA’s failure to update the almost 30-year-old AC guidance, which does not reflect lessons learned from recent accidents and incidents and address communications challenges resulting from changes in cockpit access for cabin crewmembers after the events of September 11, 2001, is inconsistent with contemporary safety management practices and the FAA’s responsibility for ensuring continual operational safety.

91 The dockets for these accident investigations, DCA15FA185 (Las Vegas) and DCA16FA013 (Fort Lauderdale), can be accessed at the NTSB’s website.

NTSB Aircraft Accident Report 63 Actions to satisfy Safety Recommendations A-09-27 do not require rulemaking or any significant cost to industry or the FAA. The benefit of updating AC 20-148 to incorporate the latest industry knowledge regarding crew communications during emergency situations would be that operators could voluntarily incorporate this information into their training and guidance. More effective communications between flight and cabin crews during emergency situations would improve safety for the traveling public, and updated guidance would help mitigate the recurring evacuation-related safety issues that the NTSB has identified in numerous accident investigations, including four accident investigations within the last 2 years. In addition, the FAA has not updated the NTSB about the status of the working group requested in Safety Recommendation A-16-26, and a notice about the establishment of the working group had not been published in the Federal Register as of November 2017. It is time for the FAA to emphasize the importance of ensuring that flight and cabin crew communications can facilitate safe and effective decision-making and action during situations requiring an evacuation. The NTSB concludes that the FAA’s inadequate actions to improve guidance and training on communication and coordination between flight and cabin crews during emergency situations, including evacuations, could lead to negative consequences for the traveling public if this safety issue continues to be unresolved. Therefore, the NTSB reiterates Safety Recommendations A-09-27 and A-16-26. In addition, because the FAA has not established, or committed to establishing, a working group to address the actions in Safety Recommendation A-16-26 and has not provided another plan to improve flight and cabin crew communication and coordination during evacuations, Safety Recommendation A-16-26 is classified “Open—Unacceptable Response.” The AAIB’s investigation of the June 2016 incident at Heathrow Airport also demonstrated evacuation-related communication and coordination problems between flight and cabin crews. The AAIB’s report stated that the flight attendant who initiated the evacuation did not activate the evacuation signal (similar to the flight attendants aboard flight 383). However, another flight attendant went to the flight deck to report that an evacuation was underway, and the captain saw (from a reflection in the terminal building) that an aft emergency slide had been deployed. The captain then made an announcement to stop the evacuation because he thought that he had isolated the source of the smoke and wanted to prevent unnecessary injuries. However, the captain did not discuss the situation in the cabin with the flight attendants before making his announcement, which indicated “a breakdown in communication and co-operation between flight crew and cabin crew members.” The AAIB’s report also indicated that the captain’s announcement caused confusion. One of the flight attendants thought that the captain was not aware of the smoke in the cabin, so she shouted to the passengers to keep moving. Another flight attendant, who saw the captain standing in the flight deck, told the captain that the evacuation should continue because of “thick smoke” in the cabin, and the captain made a subsequent announcement indicating that the evacuation should continue via a jetbridge (which was in place before the evacuation). The AAIB’s report concluded that “prompt and effective communication between the cabin and the flight deck might have avoided an evacuation” and that one reason for the initiation of the evacuation was that the flight attendants “did not receive specific instructions from the flight crew.”

NTSB Aircraft Accident Report 64 The AAIB noted that American Airlines had taken postincident actions in response to the communication and coordination shortcomings found during the investigation but that action was also needed by the regulator because other operators might be susceptible to similar shortcomings. As a result, the AAIB issued Safety Recommendation 2017-029, which asked the FAA to “require that flight and cabin crews participate in joint training to enhance their co-ordination when dealing with emergencies.” The NTSB has made similar recommendations to the FAA, but joint evacuation exercises for flight and cabin crews are still not required.92 The NTSB recognizes the benefits of joint flight and cabin crew evacuation training and notes that the actions requested in Safety Recommendation A-16-26 would also be an effective way to resolve evacuation-related communication and coordination issues. 2.3.3 Flight and Cabin Crew Evacuation Duties According to postaccident interviews with the flight crewmembers, they completed the evacuation checklist, including the step in which the captain announced over the PA system that an evacuation was underway. The flight crewmembers then exited the cockpit and entered the forward cabin, which was filled with smoke, and were immediately met by the lead flight attendant, who told them that all passengers were off the airplane and that they needed to evacuate.93 The flight crewmembers and lead flight attendant then exited the airplane through the 1L door. ARFF personnel requested the occupant count from the captain, who called dispatch to get the count. ARFF personnel then walked through the cabin and confirmed that all passengers and crew were off the airplane. After the captain received the occupant count from dispatch, ARFF compared that number with the count of occupants who were off the airplane; everyone was accounted for.94 The American Airlines B767 Operations Manual, QRH instructed the captain to conduct a walk-through of the entire cabin to ensure that all passengers evacuated and then to exit the airplane through a usable aft entry door. However, the captain did not check the cabin to verify the lead flight attendant’s report that all passengers had exited the airplane, which was understandable because the captain reported that, upon exiting the cockpit, he could see “thick black smoke” and could not see farther than “about 2 feet” in front of him.95

92 Safety Recommendation A-92-74, issued as part of a special investigation report on flight attendant training and performance during emergency situations, asked the FAA to ensure that “all reasonable attempts” were made to conduct joint flight crew/flight attendant evacuation drills during recurrent training. In response, the FAA directed POIs to ensure that their assigned certificate holders were aware of the performance benefits that result when flight crews and flight attendants conduct emergency evacuation drills together. Because the FAA did not require air carriers to conduct joint exercises with flight attendants and flight crews, the NTSB classified Safety Recommendation A-92-74 “Closed—Unacceptable Action.” Also, as part of our June 2000 safety study on emergency evacuations of commercial airplanes, the NTSB issued Safety Recommendation A-00-85, which again asked the FAA to require air carriers to conduct periodic joint evacuation exercises involving flight and cabin crews. The FAA responded that that most air carriers did not conduct joint emergency evacuation exercises and that the agency would not require such exercises. As a result, the NTSB classified Safety Recommendation A-00-85 “Closed—Unacceptable Action.” 93 Before this point, the lead flight attendant and another flight attendant had met in the middle of the airplane, and then the lead flight attendant went forward, and the other flight attendant went aft. Thus, it is not known if all flight attendants were off the airplane at that time. 94 The NTSB does not know how long it took for the captain to learn the occupant count after he called dispatch. 95 No company guidance indicated when a captain should not perform a walk-through of the cabin. However, the American Airlines manager of flight training and standards stated that a walk-through of the cabin should only be done if it would not compromise the safety of a captain.

NTSB Aircraft Accident Report 65 After evacuating the airplane, the flight crew was responsible for helping assemble passengers away from the airplane, and the captain had the additional responsibility to ensure that at least one crewmember remained with the passengers. According to postaccident interviews, this was not done. Although the captain was unable to verify that everyone was off the airplane due to smoke in the cabin, the captain’s priority, after leaving the airplane, should have been to ascertain this information. However, the American Airlines B767 Operations Manual, QRH did not specify these postevacuation duties nor was there training that emphasized these duties. If these duties had been specified and trained, the captain might have been more likely to obtain an accurate passenger count from the flight attendants. Coordinating with flight attendants about the passenger count would have ensured, before ARFF personnel conducted its walk-though of the cabin, that all passengers were safely off the airplane or would have allowed ARFF to be promptly notified if the passenger count did not match the information provided by dispatch. The American Airlines B767 Operations Manual, QRH stated that a concurrent flight attendant evacuation duty, after leaving the airplane, was to make a count and report it to the captain. The NTSB found no evidence indicating that the flight attendants accomplished this duty. Even though this situation did not result in any adverse outcomes, the NTSB concludes that the flight crewmembers and flight attendants did not coordinate in an optimal manner once the passengers were evacuated. 2.3.4 Carry-On Baggage Issue Video taken during the evacuation and postaccident interviews with flight attendants indicated that some passengers evacuated from all three usable exits with carry-on baggage. In one case, a flight attendant tried to take a bag away from a passenger who did not follow the instruction to evacuate without baggage, but the flight attendant realized that the struggle over the bag was prolonging the evacuation and allowed the passenger to take the bag. In another case, a passenger came to the left overwing exit with a bag and evacuated with it despite being instructed to leave the bag behind. Passengers evacuating airplanes with carry-on baggage has been a recurring concern. In our June 2000 safety study on emergency evacuations of commercial airplanes, the NTSB stated that flight attendants had reported that their attempts to maintain a constant flow of passengers out an emergency exit “were often thwarted by passengers’ insistence on retrieving their carry-on luggage before evacuating.” Most recently, video from the British Airways event in Las Vegas and the Dynamic International Airways event in Fort Lauderdale showed passengers who evacuated with carry-on baggage despite the standard instruction to leave their baggage and similar items behind in the event of an emergency. Flight attendants are trained to instruct passengers not to evacuate with carry-on baggage because doing so could potentially slow the egress of passengers during an evacuation and block an exit during an emergency. Although the NTSB’s June 2000 safety study found that passengers exiting with carry-on baggage was “the most frequently cited obstruction to evacuation,” the NTSB has not identified any accident evacuations in which delays related to carry-on baggage

NTSB Aircraft Accident Report 66 caused injuries. Also, the NTSB is not aware of any study performed to (1) measure the potential delays associated with passengers retrieving and carrying baggage during an emergency evacuation and (2) determine the appropriate countermeasures to mitigate any related potential safety risks. As a result of findings from our safety study on emergency evacuations of commercial airplanes, the NTSB issued Safety Recommendation A-00-88, which asked the FAA to “develop advisory material to address ways to minimize the problems associated with carry-on luggage during evacuations.” In January 2002, the NTSB classified the recommendation “Closed— Acceptable Action” because the FAA had revised Order 8400.10 to direct POIs to encourage their assigned certificate holders to provide, in crewmember manuals and training programs, clear direction and guidance to minimize the problems associated with passengers evacuating with carry-on baggage during emergencies. (This information was subsequently incorporated into FAA Order 8900.1.) In addition, AC 121-24C, “Passenger Safety Information, Briefing and Briefing Cards,” provides guidance to Part 121 carriers regarding the items that should be included in oral passenger briefings and on passenger briefing cards. Specifically, Appendix 1 states that oral briefings must be supplemented with briefing cards and that the content of the briefing cards should, among other things, “inform passengers that in an emergency situation, they should not bring carry-on baggage to the exit.” Further, AC 121-29B, “Carry-On Baggage,” states, in paragraph (k), that air carriers should provide training to all crewmembers regarding the carrier’s approved carry-on baggage program, including how to handle carry-on baggage during an emergency. Although the FAA took action in response to Safety Recommendation A-00-88 to preclude passengers from evacuating with carry-on baggage and provided further related guidance in ACs 121-24C and 121-29B, the NTSB concludes that evidence of passengers retrieving carry-on baggage during this and other recent emergency evacuations demonstrates that previous FAA actions to mitigate this potential safety hazard have not been effective. Therefore, the NTSB recommends that the FAA conduct research to (1) measure and evaluate the effects of carry-on baggage on passenger deplaning times and safety during an emergency evacuation and (2) identify effective countermeasures to reduce any determined risks, and implement the countermeasures. The NTSB notes that the FAA’s Civil Aerospace Medical Institute has facilities, including a simulator with overhead bins, that would enable such research. 2.4 High-Pressure Turbine Stage 2 Disk Failure As previously stated, the NTSB determined that the HPT stage 2 disk failed because of multiple low-cycle fatigue cracks that initiated from a discrete dirty white spot that was located near the forward bore region of the disk. The discrete dirty white spot formed during the processing of the alloy 718 ingot from which the disk was manufactured. The ingot was produced using ATI SM’s triple-melt process. The three steps of this process were vacuum induction melting (also referred to as the master heat), which established the alloy chemistry; electroslag remelting, which established the alloy cleanliness; and vacuum arc remelting, which established the alloy macrostructure. The ingot that was formed during this process then underwent a mechanical and thermal conversion process to create the billet, from which the final forged disk was produced.

NTSB Aircraft Accident Report 67 A discrete dirty white spot is a known anomaly associated with the vacuum arc remelting process. The stringers of oxide and nitride particles associated with a discrete dirty white spot are known to act as initiation sites for fatigue cracks, significantly reducing the low-cycle fatigue life of alloy 718 (Jackman et al. 1994). The NTSB considered whether the discrete dirty white spot and the low-cycle fatigue cracks could have been detected during inspections, as discussed in sections 2.4.1 and 2.4.2. The NTSB also assessed the adequacy of FAA guidance about design precautions to minimize rotor burst hazards, as discussed in section 2.4.3. 2.4.1 Discrete Dirty White Spot Detection During Manufacturing During the billet conversion process, the coarse grain structure of the ingot material is replaced by a fine grain structure. The large strains associated with the conversion process typically cause cracks and/or voids between stringers and the surrounding material. Ultrasonic inspections are performed to detect cracks and/or voids after the billet conversion process is completed. In 1997, as part of the billet conversion process, ATI SM inspected the billet from which the final forged disk was produced. ATI SM conducted the inspection according to the requirements of a GE specification for ultrasonic inspections of billets. A comparison of the inspection requirements with ATI SM’s ultrasonic test data (shown on the ultrasonic billet map sheet for Master Heat FA94) indicated that ATI SM’s inspection was consistent with the required inspection procedures and that ATI SM’s calibration of the equipment also met requirements.96 ATI SM detected no anomalies during its ultrasonic inspection of the billet involved in this event, as shown by the ultrasonic billet map sheet for FA94-2. As of November 2017, ATI SM used the same ultrasonic technique and type of equipment to inspect billets. MTU performed an ultrasonic inspection in 1998 after forging and before final machining. MTU inspected “sonic-shape” forged pieces using the company’s work instructions for ultrasonic inspections, which GE approved. These instructions were consistent with a different GE specification for ultrasonic inspections than the one that ATI SM used.97 GE’s comparison of its inspection requirements with MTU’s inspection records found that MTU’s inspection was consistent with GE’s inspection procedures. MTU found no anomalies during the ultrasonic inspection of the forged pieces that became the HPT stage 2 disk. The ultrasonic techniques that ATI SM and MTU used during the manufacturing of the HPT stage 2 disk are consistent with the current industry standard for the inspection of nickel-based alloys. Such techniques have been effective in detecting anomalies in nickel-based alloys. The uncontained engine failure at ORD was the first failure of a GE nickel-based alloy 718 part due to a melt-related anomaly (the discrete dirty white spot). Also, according to the FAA, this event was the only occurrence in US commercial aviation of a triple-melt-related anomaly that resulted in a cracked or fractured part involving alloy 718.

96 As previously stated, an ultrasonic billet map provides the location of any rejectable indications, nonrejectable indications, and areas where rejectable indications were cut out of the material. 97 Although ATI SM and MTU used different GE specifications to conduct their ultrasonic inspections, both specifications were essentially identical regarding inspector qualifications, calibration standards and schedules, and reject thresholds, with only minor differences between the specifications noted.

NTSB Aircraft Accident Report 68 During the mid-1990s, GE required the use of a triple-melt process for all its critical life-limited rotating parts manufactured with alloy 718. This and other manufacturing improvements since that time have been effective in reducing the overall number of anomalies detected during inspections. When an anomaly is detected, the material or part is not put into service. However, an FAA report on turbine rotor material design stated that “a number of rotor disk fracture and cracking events have originated from embedded anomalies, which…were undetected by production inspections” (FAA 2008). These anomalies, referred to as “stealth anomalies,” included those that were “ductile and well bonded, making them less likely to have cracking and voiding during ingot and billet conversion.” The report also stated that the lack of cracking and voiding, along with a similar density as the parent material, made this type of anomaly “indistinguishable from the parent alloy for sonic detection.” In addition, the report stated that such anomalies “form a zone of material that is substantially weaker in tensile and fatigue capability than base metal.” This anomaly description is consistent with the anomaly (the discrete dirty white spot) found in the HPT stage 2 disk. Specifically, metallurgical examinations noted the lack of cracking and voids between the discrete dirty white spot and the parent (base) material; the discrete dirty white spot and the parent material had similar densities; and the fatigue cracks initiated at the interface of the discrete dirty white spot and the parent material, consistent with an area that is “substantially weaker in tensile and fatigue capability than base metal.” Given the history of effective manufacturing and inspection of alloy 718 triple-melt parts (one related in-service event in the United States since the mid-1990s), the similarity between the discrete dirty white spot on the HPT stage 2 disk and the description of a stealth anomaly, and the improbability that two independent manufacturing facilities did not detect the anomaly during separate ultrasonic inspections, the NTSB concludes that the discrete dirty white spot was most likely not detectable by the inspection methods used during production of the HPT stage 2 disk. Some of the recommendations issued in response to the July 1989 United Airlines flight 232 accident in Sioux City have relevance to the circumstances of the American Airlines flight 383 accident (even though the Sioux City accident involved a manufacturing defect on a fan disk made of titanium). For example, after the Sioux City accident, the NTSB issued Safety Recommendation A-90-167, which asked the FAA to do the following: Intensify research in the nondestructive inspection field to identify emerging technologies that can serve to simplify, automate, or otherwise improve the reliability of the inspection process. Such research should encourage the development and implementation of redundant (‘second set of eyes’) inspection oversight for critical part inspections, such as for engine rotating components. In response to this recommendation, the FAA established the Engine Titanium Consortium in 1993 to provide the FAA and engine manufacturers with “reliable and cost-effective” new methods, and improvements in existing methods, for detecting cracks and other defects in titanium material and components. Phase I of the consortium’s work completed in 1998, and Phase II of the consortium’s work, which focused on critical rotating parts made of nickel alloys, began in mid-1999. In September 2005, the FAA issued a report about nickel billet inspections, which presented the results of the Phase II work. The report findings indicated that enhanced inspection

NTSB Aircraft Accident Report 69 techniques, such as multizone and phased array inspections, could better detect indications than the conventional ultrasonic inspection techniques that were in use at the time, which were also the same techniques that were used in 1997 and 1998 when the HPT stage 2 disk was manufactured. These conventional ultrasonic inspection techniques are still in use for inspecting nickel billets. The FAA’s report stated that, during the Phase I program, the multizone and phased array inspection methods were successful in detecting the same indications in titanium billets and that the multizone inspection method was being used for the commercial inspection of titanium parts.98 However, the report also stated that the phased array inspection for nickel billets was based on “the current best knowledge of how to perform the inspection” and that “future work is needed to optimize this technique” (FAA 2005). Further, it is unknown whether either enhanced inspection technique would have detected the discrete dirty white spot found during the investigation of this accident. Given that more than 12 years have passed since the FAA issued its report on the Engine Titanium Consortium’s work, the NTSB concludes that additional FAA and industry efforts are needed to determine if enhanced ultrasonic inspection methods are a best practice for inspecting nickel parts during manufacturing. Therefore, the NTSB recommends that the FAA establish and lead an industry group that evaluates current and enhanced inspection technologies regarding their appropriateness and effectiveness for applications using nickel alloys, and use the results of this evaluation to issue guidance pertaining to the inspection process for nickel alloy rotating engine components. 2.4.2 American Airlines Inspection of High-Pressure Turbine Stage 2 Disk American Airlines performed an ECI and an FPI of the right engine HPT stage 2 disk during maintenance (shop visits) in March 2007 and January 2011, as mandated by ADs 2002--07-12 and 2009-04-10, respectively. Although both inspection techniques are used to detect cracks on a material surface, an ECI can also detect near-surface defects. The ECI procedure inspects the disk surface to a depth of about 0.013 inch. Internal cracks at greater depths would be undetectable using the ECI procedure. Maintenance records showed that no anomalies, including cracks, were detected in the disk bore during the ECI in March 2007. In January 2011, American Airlines maintenance personnel performed an ECI and an FPI of the forward bore region of the HPT stage 2 disk; between that time and the disk failure, the right engine accumulated 3,057 cycles. The NTSB and GE made low-cycle fatigue flight cycle count estimates for six cracks that initiated from the discrete dirty white spot. Two of those cracks (referred to as cracks 1 and 6, as shown in figure 12) progressed away from the region where the ECI was conducted. The other four cracks (also shown in figure 12) progressed inward toward the bore.

98 In August 2017, GE reported that it used multizone inspection techniques for cast and wrought titanium billets and forgings and ultrasonic inspection techniques for nickel billets and forgings. Also in August 2017, the FAA reported that its specifications included multizone inspection techniques for titanium parts only at the billet level because of experience indicating that essentially all material defects were detected during billet inspections.

NTSB Aircraft Accident Report 70 One crack that progressed inward toward the bore, referred to as crack 2, started at an internal stringer discontinuity and progressed inward and aft until disk failure, at which point the crack propagated due to overstress. The NTSB estimated that the length of crack 2 at the time of the January 2011 inspection was about 0.07 inch.99 The forward innermost edge of the largest discontinuity was located about 0.14 inch from the inner bore surface. As a result, it is unlikely that crack 2 had breached the surface at the time of the HPT stage 2 disk’s last inspection. The other three cracks that progressed to the inner bore surface, referred to as cracks 3, 4, and 5, started at the discontinuity and ended at the surface. GE estimated that the length of cracks at the time of the January 2011 inspection was about 0.03 inch for cracks 3 and 4 and about 0.07 inch for crack 5. However, it was not possible to determine when those cracks reached the surface because they stopped progressing at that point. What is known, according to the low-cycle fatigue flight cycle count estimates, is that cracks 3, 4, and 5 initiated at least about 1,400, 1,200, and 3,200 cycles, respectively, before the disk failure.100 If the cracks had reached the surface at the time of the January 2011 shop visit, they should have easily been detectable by ECI because the cracks would have extended through the depth of the ECI (0.013 inch). Thus, it is unlikely that cracks 3, 4, and 5 had progressed to the surface at the time of the HPT stage 2 disk’s last inspection. Operators’ engine maintenance programs, as part of continued airworthiness efforts, are intended to establish inspection intervals for critical life-limited rotating parts to identify defects, including cracks, so that corrective action can be taken. However, the inspection techniques mandated by ADs 2002-07-12 and 2009-04-10 were techniques for detecting surface (FPI) and near-surface (ECI) cracks and other anomalies. The discrete dirty white spot was a subsurface anomaly, and ECI and FPI were not capable of detecting the cracks that emanated from the anomaly because the cracks remained below the material’s surface when American Airlines inspected the disk during the engine’s January 2011 maintenance. As a result, the NTSB concludes that the fatigue cracks that initiated from the discrete dirty white spot were not detectable at the time of the HPT stage 2 disk’s last inspection using the surface-based inspection techniques mandated by the applicable AD. No engine maintenance between January 2011 and the time of the accident involved disassembling the HPT stage 2 disk; thus, American Airlines did not have another opportunity to inspect the disk before the accident. The NTSB concludes that, if a subsurface inspection technique, such as an ultrasonic inspection, had been required at the time of the HPT stage 2 disk’s last inspection, the cracks that developed from the discrete dirty white spot should have been detectable because of the size of the cracks at that time and the sensitivity of ultrasonic inspection techniques. As previously stated, the discrete dirty white spot found in the material of the HPT stage 2 disk is an example of a possible stealth anomaly. The detection of such anomalies during in-service inspections is important because of the possibility that those anomalies will not be detected during

99 To make this estimate, the NTSB used a mathematical formula that included the low-cycle fatigue cycle count (5,600 cycles) and the number of cycles since the last inspection (3,057 cycles). 100 The right engine had accumulated 10,984 total cycles since new. Thus, crack 3 could have initiated between 0 and 9,584 cycles since new, crack 4 could have initiated between 0 and 9,784 cycles since new, and crack 5 could have initiated between 0 and 7,784 cycles since new.

NTSB Aircraft Accident Report 71 the billet and forging manufacturing stages. Ultrasonic inspections could be appropriate for in- service maintenance because they would provide maintenance personnel with a method to detect cracks emanating from internal material anomalies below a material’s surface. (Enhanced inspection techniques, such as multizone and phased array, are intended for use during the billet and forging manufacturing stages.) In September 2017, the FAA issued an NPRM that proposed an AD mandating the ultrasonic inspection of HPT stage 1 and 2 disks of GE CF6-80-series turbofan engines, consistent with the requirements of GE SB 72-1562. The proposed AD would be an appropriate step for ensuring the continued airworthiness of airplanes with those engines.101 However, stealth anomalies can also affect other engines. Because the potential for an internal material anomaly cannot currently be eliminated during the manufacturing process, effective in-service inspection methods are essential; ECI and FPI are only effective once cracks breach the surface of a material. Therefore, the NTSB recommends that the FAA require subsurface in-service inspection techniques, such as ultrasonic inspections, for critical high-energy, life-limited rotating parts for all engines. 2.4.3 Guidance on Design Precautions to Minimize Rotor Burst Hazards In March 1988, the FAA issued AC 20-128, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure.” The FAA revised the AC in March 1997 in response to Safety Recommendation A-90-170, which was issued as a result of the Sioux City accident. AC 20-128A provided rotor burst and blade release fragment trajectory data so that airframe manufacturers could integrate appropriate design precautions to minimize hazards to an airplane and its occupants. In May 1999, the FAA issued a report that provided the results of the agency’s large engine uncontained debris analysis. The report defined the debris size, weight, exit velocity, and trajectory and noted that this information could be used to update AC 20-128A. The report determined that the trajectories included in AC 20-128A were “too narrow” and needed to be “expanded significantly” and that the “highest hazard potential” to an aircraft during an uncontained engine event was the combined effect from multiple small fragment impacts (and not a single impact). In addition, an FAA working group was tasked, in November 2001, to revise AC 20-128A, but this work ceased after a moratorium was imposed 1 year later (see section 1.6.6.1). The Australian Transportation Safety Board (ATSB) issued a recommendation to the FAA resulting from its investigation of the November 4, 2010, accident involving an Airbus A380 that experienced an uncontained intermediate-pressure turbine disk rupture in a Rolls-Royce

101 GE and ATI SM conducted a study of discrete dirty white spot samples from an alloy 718 billet produced between October 2014 and April 2017. These discrete dirty white spot samples, which were detected by ultrasonic inspection, were compared with the structure and characteristics of the discrete dirty white spot found on the HPT stage 2 disk from the accident airplane. The sample anomalies and the anomaly from the HPT stage 2 disk had similar structures and features except that at least one sample had voids/cracks along stringers. Even though no voids/cracks along stringers were found on the discrete dirty white spot associated with this accident, GE and ATI SM determined that voids/cracks along stringers could provide a reflection surface that is conducive to ultrasonic detection.

NTSB Aircraft Accident Report 72 Trent 900 engine.102 According to the ATSB, the failure in the No. 2 engine sent engine disk fragments through the left wing, which damaged some of the airplane’s systems. Safety Recommendation AO-2010-089-SR-040 asked the FAA to do the following:103 In cooperation with the European Aviation Safety Agency, review the damage sustained by Airbus A380-842, VH-OQA following the uncontained engine rotor failure overhead Batam Island, Indonesia, to incorporate any lessons learned from this accident into the advisory material. The final report on the accident, issued in June 2013, stated that the amount of damage to the airplane resulting from the uncontained engine rotor failure “was greater than the modelling outlined in the advisory material,” which provided a means of compliance with airframe certification standards. The advisory material included AC 20-128A. In a December 2016 letter to the ATSB, the FAA stated that it was evaluating uncontained engine failure events, including the event referenced in the ATSB’s recommendation, to understand the “failure effects” of these events. The FAA also stated that it would use that information to update AC 20-128A. The FAA further stated that its Technical Center tasked the US Naval Air Station China Lake to (1) update the uncontained engine debris model defined in the FAA’s 1999 report on its large engine uncontained debris analysis and (2) develop computer modeling of more recent uncontained engine failures. The FAA indicated that a draft revision to AC 20-128A was expected by the end of 2016 and that it would provide the ATSB, by June 30, 2017, with an update of actions related to the recommendation. In August 2017, the FAA requested an extension to November 6, 2017, for responding to the ATSB. On December 6, 2017, the FAA responded to the ATSB, indicating that a draft revision of AC 20-128A was expected by the end of 2018. During the 20 years since AC 20-128A was issued, the NTSB has investigated, participated in the investigation of, or become aware of at least 40 uncontained rotor burst events in addition to the one referenced in the ATSB’s safety recommendation.104 Also, AIA has a database of rotor burst events involving high-bypass turbofan engines that includes events between 1997 (the time that the AC was last updated) and 2006.105 The lessons learned from all of these events would result in more robust guidance, including updated trajectory analyses, for airframe manufacturers to use when considering design mitigations for minimizing hazards resulting from uncontained engine failures.

102 For more information about this accident, including the final report, see “In-flight uncontained engine failure Airbus A380-842, VH-OQA, overhead Batam Island, Indonesia, 4 November 2010” at the ATSB’s website (accessed January 10, 2018). 103 ATSB Safety Recommendation AO-2010-089-SR-039 recommended that the European Aviation Safety Agency, in cooperation with the FAA, take the same action as requested in AO-2010-089-SR-040. 104 This number was derived from a review of the NTSB’s engine investigations as well as information from Boeing and engine manufacturers. 105 AIA’s database for high-bypass turbofan engines included events from 1969 to 2006. As stated in section 1.7.3.1, in January 2010, AIA issued a report describing uncontained rotor events involving high-bypass ratio turbine engines, which was based on data from the association’s rotor burst database. AIA’s report stated that these data could be used by “airplane designers and regulatory authorities to gain a common understanding of the rotor uncontainment threat.”

NTSB Aircraft Accident Report 73 AC 20-128A contains specific information about accepted design precautions to follow to reduce the overall risk of an uncontrolled fire if fuel tanks are located in impact areas. Specifically, the information stated that “dry bays or shielding” was an acceptable means of protection from the effects of fuel leakage for any fuel tanks “located above an engine or APU and within the one-third disc and intermediate fragment impact areas.” The guidance also stated that the dry bays should be sized based on the manufacturer’s analysis of “possible fragment trajectories through the fuel tank wall and the subsequent fuel leakage from the damaged fuel tank” so that fuel will not travel to an engine during in-flight or ground operations. The guidance further stated that a minimum drip clearance distance of 10 inches from potential ignition sources of the engine nacelle, for static conditions, would be acceptable. Even though the size of the right wing dry bay and the drip clearance distance on the flight 383 accident airplane (a Boeing 767-300) were consistent with this guidance, the uncontained engine failure resulted in a subsequent fire. Postaccident examination of the airplane’s right wing revealed that an HPT stage 2 disk fragment (later identified as disk fragment A) penetrated the lower surface of the right wing beneath the dry bay, resulting in a hole in the dry bay.106 Disk fragment A also severed the main engine fuel feed line and caused a large breach and multiple small breaches between the dry bay and the fuel tank, which allowed fuel to flow into the dry bay and out of the hole of the wing. Video showed that a fire had already begun on the right side of the airplane as the airplane decelerated to a stop (as a result of the rejected takeoff). Although the quantity of fuel that spilled out of the wing as the airplane decelerated could not be determined, the released amount ignited, resulting in a fire that (1) damaged the right wing and its flight control surfaces, the right main landing gear, the right-side fuselage, and the right stabilizer and (2) caused the cabin to fill with smoke.107 Also, the NTSB investigated a September 2000 accident in which an uncontained engine failure on a Boeing 767-200 resulted in a subsequent fire.108 In that accident, the size of the dry bay in the main fuel tanks and the drip clearance distance were also consistent with the guidance in AC 20-128A. Thus, the accepted design precautions in AC 20-128A to reduce the risk of an uncontrolled fire for fuel tanks located in impact areas did not adequately minimize the hazards to the 767-200 and -300 airplanes from an uncontained engine failure. The NTSB concludes that future aircraft certification efforts would benefit from guidance on uncontained engine failure debris models and resulting design mitigations that is based on lessons learned from recent in-service events. Therefore, the NTSB recommends that the FAA revise AC 20-128A, based on an analysis of uncontained engine failure data since the time that the AC was issued, to minimize hazards to an airplane and its occupants if an uncontained engine

106 The hole was triangular shaped and had an area of about 70 square inches. 107 About 2,040 gallons of fuel was released from the right main fuel tank through the hole in dry bay, but the NTSB could not determine the portion of the fuel that was released before, during, and after the deceleration. 108 On September 22, 2000, a US Airways Boeing 767-2B7 airplane, N654US, equipped with GE CF6-80C2B2 engines, experienced an uncontained failure of the HPT stage 1 disk in the No. 1 (left) engine at Philadelphia International Airport, Philadelphia, Pennsylvania, during a high-power ground run performed as part of maintenance. For more information about this accident, see the letter transmitting Safety Recommendations A-00-121 through -124 at the NTSB’s website.

NTSB Aircraft Accident Report 74 failure were to occur. The revised AC should include modifications to the accepted design precautions for fuel tanks given the fires that have occurred after uncontained engine failures.

NTSB Aircraft Accident Report 75

1. Conclusions
2. 1 Findings
3. The flight crew was properly certificated and qualified in accordance with federal regulations

and company requirements. A review of the flight crew’s work and sleep schedules and recent activities showed no evidence of factors that could have adversely affected the performance of either crewmember on the day of the accident.

1. The airplane was properly certificated, equipped, and maintained in accordance with federal

regulations. No evidence indicated any structural, engine, or system failures before the uncontained engine failure occurred.

1. The right engine experienced an uncontained high-pressure turbine (HPT) stage 2 disk rupture

during the takeoff roll. The HPT stage 2 disk initially separated into two fragments. One fragment penetrated through the inboard section of the right wing, severed the main engine fuel feed line, breached the fuel tank, traveled up and over the fuselage, and landed about 3,000 ft away. The other fragment exited outboard of the right engine, impacting the runway and fracturing into three pieces.

1. The high-pressure turbine stage 2 disk failed because of multiple low-cycle fatigue cracks that

initiated from an internal material anomaly, known as a discrete dirty white spot, which formed during the processing of the material from which the disk was manufactured.

1. The discrete dirty white spot was most likely not detectable by the inspection methods used

during production of the high-pressure turbine stage 2 disk.

1. Additional Federal Aviation Administration and industry efforts are needed to determine if

enhanced ultrasonic inspection methods are a best practice for inspecting nickel parts during manufacturing.

1. The fatigue cracks that initiated from the discrete dirty white spot were not detectable at the

time of the high-pressure turbine stage 2 disk’s last inspection using the surface-based inspection techniques mandated by the applicable airworthiness directive.

1. If a subsurface inspection technique, such as an ultrasonic inspection, had been required at the

time of the high-pressure turbine stage 2 disk’s last inspection, the cracks that developed from the discrete dirty white spot should have been detectable because of the size of the cracks at that time and the sensitivity of ultrasonic inspection techniques.

1. Future aircraft certification efforts would benefit from guidance on uncontained engine failure

debris models and resulting design mitigations that is based on lessons learned from recent in-service events.

1. The captain made a timely decision to reject the takeoff and performed the maneuver in

accordance with company training and procedures.

NTSB Aircraft Accident Report 76

1. The captain’s decision to perform the engine fire checklist was appropriate given his training,

the information provided by air traffic control, and the fire warnings in the cockpit.

1. Engine fire checklists that specifically address ground operations would allow a flight crew to

secure an engine and command an evacuation, if required, in a timelier manner than engine fire checklists that do not differentiate between ground and in-flight operations.

1. The flight attendants made a good decision to begin the evacuation given the fire on the right

side of the airplane and the smoke in the cabin, but the left overwing exit should have been blocked while the left engine was still operating because of the increased risk of injury to passengers who evacuated from that exit.

1. If the flight crew or the flight attendants had communicated after the airplane came to a stop,

the flight crew could have become aware of the severity of the fire on the right side of the airplane and the need to expeditiously shut down the engines.

1. American Airlines did not adequately train flight attendants qualified on the Boeing 767 to

effectively use the different interphone system models installed on the airplane during an emergency.

1. The Federal Aviation Administration’s inadequate actions to improve guidance and training

on communication and coordination between flight and cabin crews during emergency situations, including evacuations, could lead to negative consequences for the traveling public if this safety issue continues to be unresolved.

1. The flight crewmembers and flight attendants did not coordinate in an optimal manner once

the passengers were evacuated.

1. Evidence of passengers retrieving carry-on baggage during this and other recent emergency

evacuations demonstrates that previous Federal Aviation Administration actions to mitigate this potential safety hazard have not been effective. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the failure of the high-pressure turbine (HPT) stage 2 disk, which severed the main engine fuel feed line and breached the right main wing fuel tank, releasing fuel that resulted in a fire on the right side of the airplane during the takeoff roll. The HPT stage 2 disk failed because of low-cycle fatigue cracks that initiated from an internal subsurface manufacturing anomaly that was most likely not detectable during production inspections and subsequent in-service inspections using the procedures in place. Contributing to the serious passenger injury was (1) the delay in shutting down the left engine and (2) a flight attendant’s deviation from company procedures, which resulted in passengers evacuating from the left overwing exit while the left engine was still operating. Contributing to the delay in shutting down the left engine was (1) the lack of a separate checklist procedure for Boeing 767 airplanes that specifically addressed engine fires on the ground and (2) the lack of communication between the flight and cabin crews after the airplane came to a stop.

NTSB Aircraft Accident Report 77

1. Recommendations
2. 1 New Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Aviation Administration: Establish and lead an industry group that evaluates current and enhanced inspection technologies regarding their appropriateness and effectiveness for applications using nickel alloys, and use the results of this evaluation to issue guidance pertaining to the inspection process for nickel alloy rotating engine components. (A-18-3) Require subsurface in-service inspection techniques, such as ultrasonic inspections, for critical high-energy, life-limited rotating parts for all engines. (A-18-4) Revise Advisory Circular (AC) 20-128A, “Design Considerations for Minimizing Hazards Caused by Uncontained Turbine Engine and Auxiliary Power Unit Rotor Failure,” based on an analysis of uncontained engine failure data since the time that the AC was issued, to minimize hazards to an airplane and its occupants if an uncontained engine failure were to occur. The revised AC should include modifications to the accepted design precautions for fuel tanks given the fires that have occurred after uncontained engine failures. (A-18-5) When approving the operating procedures of a 14 Code of Federal Regulations Part 121 air carrier, require operators to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. (A-18-6) Develop and issue guidance to all air carriers that conduct passenger-carrying operations under 14 Code of Federal Regulations Part 121 regarding (1) discussing this accident during recurrent flight attendant training to emphasize the importance of effectively assessing door and overwing exits during an unusual or emergency situation and (2) providing techniques for identifying conditions that would preclude opening exits, including an operating engine. (A-18-7) Review the training programs of all 14 Code of Federal Regulations Part 121 operators and make changes as necessary to ensure that the programs provide flight attendants and flight crews with training aids and hands-on emergency scenarios that account for the different interphone systems that air carriers operate. (A-18-8) Conduct research to (1) measure and evaluate the effects of carry-on baggage on passenger deplaning times and safety during an emergency evacuation and

NTSB Aircraft Accident Report 78 (2) identify effective countermeasures to reduce any determined risks, and implement the countermeasures. (A-18-9) To Boeing: Work with operators as required to develop and/or revise emergency checklist procedures for an engine fire on the ground to expeditiously address the fire hazard without unnecessarily delaying an evacuation. (A-18-10) To American Airlines: For all airplanes that you operate, review existing engine fire checklists and make changes as necessary to ensure that the procedures would expeditiously address engine fires occurring on the ground without unnecessarily delaying an evacuation. (A-18-11) 4.2 Previously Issued Recommendations Reiterated in This Report The National Transportation Safety Board reiterates the following recommendations to the Federal Aviation Administration: Revise Advisory Circular 120-48, “Communication and Coordination Between Flight Crewmembers and Flight Attendants,” to update guidance and training provided to flight and cabin crews regarding communications during emergency and unusual situations to reflect current industry knowledge based on research and lessons learned from relevant accidents and incidents over the last 20 years. (A-09-27) Develop best practices related to evacuation communication, coordination, and decision-making during emergencies through the establishment of an industry working group and then issue guidance for 14 Code of Federal Regulations Part 121 air carriers to use to improve flight and cabin crew performance during evacuations. (A-16-26) 4.3 Previously Issued Recommendation Classified in This Report Safety Recommendation A-16-26 is reclassified “Open—Unacceptable Response” in section 2.3.2.2 of this report.

NTSB Aircraft Accident Report 79

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III CHRISTOPHER A. HART Chairman Member

T. BELLA DINH-ZARR

Member

Adopted: January 30, 2018

NTSB Aircraft Accident Report 80

1. Appendixes

Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified about this accident immediately after it occurred. An NTSB investigator located in the Chicago, Illinois, area responded to the accident about 1500 on October 28, 2016, and, after arriving on scene shortly afterward, began gathering initial information and securing the accident site until investigators from NTSB headquarters in Washington, DC, arrived on scene later in the day. The following investigative groups were formed: airworthiness, operations/human performance, powerplants, and survival factors. Also, specialists were assigned to conduct the readout of the flight data recorder and transcribe the cockpit voice recorder at the NTSB’s laboratory in Washington, DC. Parties to the investigation were the Federal Aviation Administration, the Boeing Company, American Airlines, the Allied Pilots Association, the Transport Workers Union of America, the Association of Professional Flight Attendants, General Electric, and ATI Specialty Materials.

NTSB Aircraft Accident Report 81 Appendix B: Cockpit Voice Recorder Transcript The following is a transcript of the L-3/Fairchild FA2100-1020 cockpit voice recorder, serial number 158589, installed on American Airlines flight 383, a Boeing 767-323, N345AN, which experienced an uncontained engine failure and subsequent fire during the takeoff ground roll at Chicago O’Hare International Airport, Chicago, Illinois, on October 28, 2016:

LEGEND

CAM Cockpit area microphone voice or sound source HOT Flight crew audio panel voice or sound source TWR Radio transmission from O’Hare Tower controller -1 Voice identified as the captain -2 Voice identified as the first officer -? Voice unidentified

Expletive [ ] Editorial insertion

Note 1: Times are expressed in Central Daylight Time.

Note 2: Generally, only radio transmissions to and from the incident aircraft were transcribed.

Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken.

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 82 14:30:29.4 START OF TRANSCRIPT 14:30:29.4 TWR American three eighty three heavy runway two eight right at november five line up and wait. winds two zero zero at one four. 14:30:33.5 RDO-2 line up and wait American three eighty three heavy. 14:30:35.6 HOT-1 okay checklist. 14:30:36.4 HOT-2 map display? 14:30:37.3 HOT-1 and checked at two eight right. 14:30:40.3 HOT-2 takeoff PA? 14:30:41.2 HOT-1 complete. 14:30:42.3 HOT-2 packs? 14:30:44.0 HOT-1 are auto. 14:30:45.2 HOT-2 lights? 14:30:46.2 HOT-1 set.

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:30:46.6 HOT-2 checklist complete. 14:30:57.2 TWR American three eighty three heavy turn left heading two two zero runway two eight right at november five cleared for takeoff. 14:31:00.5 CAM [sound of five clicks, similar to light switches] 14:31:02.5 RDO-2 left turn to two two zero cleared for takeoff American three eighty three heavy. 14:31:06.5 HOT-1 cleared for takeoff two twenty heading. 14:31:17.1 HOT-1 and engage. 14:31:19.2 CAM [sound similar to engine rpm increase] 14:31:19.6 HOT-2 clock's running. 14:31:24.8 HOT-2 thrust set. 14:31:32.0 HOT-2 eighty knots. 14:31:32.8 HOT-1 checked. 14:31:43.5 CAM [sound of bang] 83

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:31:44.4 HOT-1 whoa. 14:31:44.7 CAM [sound of click, similar to throttles contacting idle stops] 14:31:45.1 CAM [sound similar to engine rpm decrease] 14:31:50.0 RDO-2 American three eighty three heavy stopping on the runway. 14:31:52.4 TWR roger roger. fire. 14:31:54.0 CAM [sound of two clicks] 14:31:56.2 RDO-2 do you see any smoke or fire? 14:31:57.0 HOT [sound similar to master caution] 14:31:58.0 TWR yeah fire off the right wing. 14:31:59.7 RDO-2 okay send out the trucks. 14:31:59.9 CAM [sound similar to engine fire warning] 14:32:02.1 TWR sending em. 14:32:04.1 HOT-1 okay let's run the uh checklist. 84

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:32:04.4 HOT-2 alright. 14:32:06.7 HOT-2 checklist. 14:32:06.9 HOT-1 we can shut it— 14:32:08.3 HOT-2 just shut it down and get— pull the handle? 14:32:09.4 CAM [sound similar to engine fire warning] 14:32:10.6 HOT-1 pull it yeah. 14:32:11.2 CAM [sound of click, similar to fire handle being pulled] 14:32:11.8 CAM [sound similar to engine fire warning] 14:32:12.9 CAM [sound of three clicks] 14:32:15.6 HOT-2 checklist for engine fire. 14:32:17.9 TWR American three eighty three can you give us any information right now? 14:32:17.9 HOT-1 #. 85

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 86 14:32:21.3 CAM [sound similar to engine fire warning] 14:32:23.4 RDO-2 uh stand by. 14:32:25.9 CAM [sound similar to master caution] 14:32:26.0 HOT-2 just the— 14:32:28.3 CAM-2 engine fire severe damage. 14:32:30.7 CAM [sound similar to engine fire warning] 14:32:31.0 HOT-2 *. 14:32:32.5 HOT-2 okay. 14:32:32.9 HOT-1 you didn't— you didn't fire the bottle. 14:32:34.6 HOT-1 did ya? 14:32:34.9 HOT-2 I did. I pushed it twice. 14:32:35.6 CAM [sound of click] 14:32:35.7 HOT-1 which one?

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:32:36.3 HOT-2 oh I didn't twist it. there we go. 14:32:36.5 CAM [sound of click] 14:32:37.3 HOT-1 oh. 14:32:38.2 HOT-2 okay. 14:32:39.1 CAM [sound of two whooshing sounds] 14:32:40.2 CAM [sound similar to engine fire warning] 14:32:40.9 HOT-2 alright. 14:32:40.9 CAM-1 oh look at the smoke— check out the smoke. 14:32:41.7 HOT-1 [sound of rustling noise, similar to headset being moved] 14:32:42.6 HOT-2 okay. 14:32:44.0 HOT-2 uhh. 14:32:45.2 CAM-1 do the evacuation checklist. 14:32:46.6 HOT-2 okay evacuation checklist. 87

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:32:49.2 CAM-1 #. 14:32:49.7 CAM [sound similar to engine fire warning] 14:32:53.4 HOT-1 okay I'm going both ways. go. 14:32:54.8 HOT-2 okay. 14:32:55.1 HOT-1 go. 14:32:55.5 HOT-2 parking brake set? 14:32:56.5 HOT-1 set. 14:32:57.3 HOT-2 cabin altitude mode selector manual? 14:32:59.2 CAM [sound similar to engine fire warning] 14:33:00.8 HOT-1 okay. 14:33:01.1 HOT-2 uh cabin altitude control hold in climb. 14:33:05.2 HOT-1 okay. what about the— 14:33:06.7 HOT-2 fuel control switches both cutoff. 88

TIME and INTRA-COCKPIT COMMUNICATION TIME and AIR-GROUND COMMUNICATION SOURCE CONTENT SOURCE CONTENT 14:33:06.9 CAM [sound similar to master caution] 14:33:08.6 CAM [sound similar to engine fire warning] 14:33:09.7 HOT-2 PA evac this is the captain— 14:33:11.0 CAM [sound of thunk] 14:33:11.7 END OF TRANSCRIPT END OF RECORDING 89

NTSB Aircraft Accident Report 90 References AIA (Aerospace Industries Association). 2010. High Bypass Ratio Turbine Engine Uncontained Rotor Events and Small Fragment Threat Characterization 1969-2006, Volume 1, January. FAA (Federal Aviation Administration). 2017. “Airworthiness Directives; General Electric Company Turbofan Engines,” Federal Register, September 7: 42261. ———. 2009. “Airworthiness Directives; General Electric Company CF6-80A, CF6-80C2, and CF6-80E1 Series Turbofan Engines,” Federal Register, February 23: 7995. ———. 2008. Turbine Rotor Material Design—Phase II. DOT/FAA/AR-07/13, Washington, DC: FAA Office of Aviation Research, April. ———. 2005. Inspection Development for Nickel Billet—Engine Titanium Consortium Phase II. DOT/FAA/AR-05/29, Washington, DC: FAA Office of Aviation Research, September. ———. 2002. “Airworthiness Directives; General Electric Company CF6-80A, CF6-80C2, and CF6-80E1 Series Turbofan Engines,” Federal Register, April 10: 17279. ———. 2001. “Aviation Rulemaking Advisory Committee; Transport Airplane and Engine Issues—New Task,” Federal Register, November 9: 56729. ———. 1999. Large Engine Uncontained Debris Analysis. DOT/FAA/AR-99/11, Washington, DC: FAA Office of Aviation Research, May. GE (General Electric). 2017. Metallurgical Evaluation of ATI 718 Billet DWS Findings. Metallurgical Investigation Report Log No. FA2017-18058, Evendale, Ohio: GE Aviation, April. Jackman, Laurence A., Gernant E. Maurer, and Sunil Widge. 1994. “White Spots in Superalloys.” Superalloys 718, 625, 706 and Various Derivatives, edited by E.A. Loria. Pittsburgh, Pennsylvania: The Minerals, Metals & Materials Society: 153-166. Morales, Jon. 2017. Metallurgical Evaluation of a CF6-80C2 B6 Stage 2 HPT Disk From ESN 690-737 Operated by American Airlines. Metallurgical Investigation Report Log No. FA2016-17907, Evendale, Ohio: GE Aviation, June. Moyer, J. M., L. A. Jackman, C. B. Adasczik, R. M. Davis, and R. Forbes-Jones. 1994. “Advances in Triple Melting Superalloys 718, 706 and 720.” Superalloys 718, 625, 706 and Various Derivatives, edited by E.A. Loria. Pittsburgh, Pennsylvania: The Minerals, Metal & Materials Society: 39-48. NTSB (National Transportation Safety Board). 2016. Runway Excursion During Landing, Delta Air Lines Flight 1086, Boeing MD-88, N909DL, New York, New York, March 5, 2015. Aircraft Accident Report NTSB/AAR-16/02, Washington, DC: NTSB.

NTSB Aircraft Accident Report 91 ———. 2009. In-Flight Left Engine Fire, American Airlines Flight 1400, McDonnell Douglas DC-9-82, N454AA, St. Louis, Missouri, September 28, 2007. Aircraft Accident Report NTSB AAR-09/03, Washington, DC: NTSB. ———. 2000. Emergency Evacuation of Commercial Airplanes. Safety Study NTSB/SS-00/01, Washington, DC: NTSB. ———. 1990. United Airlines Flight 232, McDonnell Douglas DC-10-10, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989. Aircraft Accident Report NTSB/AAR-90/06, Washington, DC: NTSB.

FD07489 ｜ 2018_美国_HAB1802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

57611 1

NTSB/HAB-18/02 National Transportation Safety Board Washington, DC 20594 Highway Accident Brief Fire Damage to Bridge and Subsequent Collapse, Atlanta, Georgia, March 30, 2017

Accident Number: HWY17IH012 Accident Type: Bridge collapse Location: Interstate 85 north overpass, Piedmont Road, Atlanta, Fulton County, Georgia Date and Time: March 30, 2017, 7:14 p.m. Fatalities: 0 Injuries: 0

Event Description On Thursday, March 30, 2017, about 6:05 p.m., construction materials stored under an Interstate 85 (I-85) overpass in Atlanta, Georgia, were set on fire. The fire propagated throughout the storage area. Just over 1 hour later, at 7:14 p.m., span 30 NB—a 92-foot-long elevated span of I-85—collapsed. No fatalities or injuries were reported from the fire and subsequent bridge collapse. One person was arrested and later charged with criminal damage to property. The Georgia Department of Transportation (GDOT) had been using the area as storage for 76 reels of high-density polyethylene conduit and nine racks of fiberglass conduit. The materials were left over from an earlier project on State Route 400 (SR-400) and were secured inside a chain-link fence. The interstate bridge is located over Piedmont Road, 4 miles northeast of downtown Atlanta (see figure 1). GDOT determined that five bridge spans adjacent to the collapse—two in the northbound direction and three in the southbound direction—required removal due to structural damage from heat exposure. The $15-million replacement project required 43 days.

Fire Damage to Bridge and Subsequent Collapse 2 NTSB/HAB-18/02

Figure 1. Location of I-85 bridge collapse, Atlanta, Georgia.

Fire Damage to Bridge and Subsequent Collapse 3 NTSB/HAB-18/02 Bridge Information Figure 2 shows an aerial view of the I-85 north collapsed bridge span on March 30, 2017.

Figure 2. Aerial view of collapsed bridge span 30 NB and fire on I-85 north. (Source: Internet media modified) At this location, the bridge consists of four northbound travel lanes and four southbound travel lanes, with an additional high-occupancy-vehicle (HOV) lane in each direction adjacent to the highway’s center divider. Figure 3 presents a plan view of the I-85 bridge deck. It shows the collapsed bridge span and the spans that were replaced due to fire damage. Span 30 NB was located between bents 30 and 31 on I-85 north.1 GDOT determined that spans 29 NB and 31 NB and spans 28 SB, 29 SB, and 30 SB required replacement, because excessive heat had caused the loss of pretension of the bridge reinforcement bars, and the bridge spans exhibited delamination and cracking throughout the bottom flanges.2

1 A bent is a rigid frame commonly made of reinforced concrete or steel that supports a vertical load and is placed transverse to the length of a structure. Bents are commonly used to support beams and girders. 2 (a) Pretension is a condition created by stressing the reinforcement bars or tendons prior to placing concrete. (b) Delamination is a mode of failure in which the reinforced concrete separates above and below the reinforcement bars.

Fire Damage to Bridge and Subsequent Collapse 4 NTSB/HAB-18/02

Figure 3. Plan view of I-85 bridge deck, showing location of collapsed span and damaged spans. The bridge deck for span 30 NB was 79 feet wide and 92 feet long.3 Spans 29 NB and 31 NB—the adjacent bridge spans that were removed—measured 79 feet wide by 44 feet long and 79 feet wide by 92 feet long, respectively. The vertical clearance from the ground surface to the underside of the collapsed bridge span was 23 feet, and the minimum vertical clearance from Piedmont Road to the underside of the northbound bridge span was 23.5 feet. Figure 4 shows a profile view of the I-85 north bridge deck.

3 The bridge deck is measured from outer edge to outer edge, which includes the width of travel lanes, the HOV lane, and the shoulders.

Fire Damage to Bridge and Subsequent Collapse 5 NTSB/HAB-18/02

Figure 4. Profile view of I-85 north bridge deck, showing collapsed bridge span 30 NB, adjoining spans 29 NB and 31 NB, and vertical clearance to ground surface. Conduit Storage Under I-85 Bridge Seventy-six reels of high-density polyethylene conduit and nine racks of fiberglass conduit were stored under the bridge span. The materials were intended for use in an earlier project on SR-400, but the contractor defaulted. Figure 5 shows a view of the high-density polyethylene conduit stored under elevated span 30 NB.

Fire Damage to Bridge and Subsequent Collapse 6 NTSB/HAB-18/02

Figure 5. View of storage area under span 30 NB. (Source: Google Street View, February 2017) The SR-400 project included installing changeable message signs, microwave radar detection coverage, closed circuit television cameras, and a conduit/fiber optic cable communications system from I-85 to Interstate 285. The contractor, TDC Systems Integration, Inc., began work on February 19, 2007. However, the project was suspended on April 25, 2008, because the contractor could not obtain the mandated bonds. At that time, the contractor had completed 27 percent of the work.4 GDOT had originally stored the unused reels of high-density polyethylene conduit and racks of fiberglass conduit at a site along Sidney Marcus Boulevard. On January 10, 2012, GDOT moved the materials to the area under the I-85 bridge. GDOT chose this location because it offered shelter from the sun; and it was state-owned, fenced, and adjacent to another GDOT facility on the opposite side of Piedmont Road.5 The materials remained under the I-85 bridge for more than 5 years, up to the time of the collapse. Fire Response and Investigation The Atlanta Fire Rescue Department was dispatched at 6:14 p.m. and arrived on scene at 6:20 p.m. Department personnel fought the fire for nearly 1 hour until the span collapsed at 7:14 p.m. and then continued working until the fire was reported under control at 10:56 a.m. on March 31. Heavy equipment operators subcontracted to GDOT uncovered many burned and crushed reels of conduit material in the area of the fire. The fire department’s incident report indicated that the high fuel load underneath the bridge contributed to the spread of the fire. Once ignited, the large quantity of combustible conduit material provided significant fuel to the incipient fire, resulting in an increase in the overall heat released by the fire.

4 GDOT formally closed the project on March 29, 2012. A new contract was awarded to R. J. Haynie & Associates, Inc., and that work was completed on October 10, 2015. The contract specified a change to the layout of the duct bank and new conduit that was easier to install. 5 GDOT believed that sun exposure could degrade the materials.

Fire Damage to Bridge and Subsequent Collapse 7 NTSB/HAB-18/02 The fire department investigated the source of the ignition. Witnesses reported seeing a man start the fire. He was subsequently arrested and charged with criminal damage to property, a first-degree felony. Conduit Examination At the request of NTSB investigators, GDOT recovered partial reels of the high-density polyethylene and fiberglass conduit while removing the collapsed bridge deck and debris from the scene on April 2, 2017. The material was transported to a secure location at a nearby state maintenance yard. On April 4, GDOT cut the material into 1-foot-long samples, and nine pieces were packaged and delivered to the NTSB materials laboratory for analysis of material composition. The samples were hollow and did not contain fiber optic cable.6 Figure 6 displays the nine samples submitted to the NTSB. The analysis confirmed that three samples were composed of fiberglass (numbered 1 through 3), and six samples were composed of polyethylene (numbered 4 through 9).

Figure 6. Nine submitted samples of conduit material, with samples 1–3 fiberglass and samples 4–9 polyethylene.

6 Fiber optic cable is typically inserted into conduit onsite at the time of construction. The fiber optic cable was stored separately from the conduit material and was not located under the I-85 bridge.

Fire Damage to Bridge and Subsequent Collapse 8 NTSB/HAB-18/02 High-density polyethylene conduit and fiberglass conduit have different flammability characteristics.7 Flammability is tested using UL-94 specified flame classifications.8 Two tests are performed on plastic materials: the first determines the material’s tendency to either extinguish or spread a flame once the specimen has been ignited, and the second measures the resistance of the plastic to electrical ignition sources. Twelve UL-94 specified flame classifications are assigned based on the results of these tests. According to the manufacturer’s data sheet, fiberglass conduit material (samples 1–3) does not meet the UL-94 flame classification “HB” (the lowest flammability classification), because the flame does not extinguish by the time prescribed in the UL standard. High-density polyethylene— the same material from which samples 4–9 were manufactured—typically meets the UL-94 flame classification HB. However, when exposed to sufficient heat, burning polyethylene liquifies, which can spread fire through dripping or flowing of the flaming polymer liquid. The large amount of combustible material being stored underneath this section of the I-85 bridge increased the fire risk to the bridge.9 Guidance for Storage of Materials Under Bridge Structures GDOT Guidance The GDOT Standard Specifications, Construction of Transportation Systems—approved by the State Transportation Board on June 21, 2001—states the following:10 106.08 Storage of Materials No inflammable materials or harmful chemical shall be stored within 200 ft (60 m) of a structure nor within 200 ft (60 m) of a roadway open to traffic. Such materials shall be stored in accordance with directions from the manufacturer. GDOT does not further define “inflammable.” Generally, inflammable materials are those that are easily set on fire. The specifications indicate general construction site items that are inflammable, including fuel storage tanks or wooden forms.

7 The materials from the fire damage and bridge collapse were not subjected to flammability testing. The flammability characteristics were obtained from the materials specification literature. 8 Underwriters Laboratories (UL) is a product safety testing and certification laboratory. See the UL website, accessed April 5, 2018. 9 A combustible material is any material that—in the form in which it is used and under the conditions anticipated—will ignite and burn or will add appreciable heat to an ambient fire. 10 GDOT. 2001. Standard Specifications, Construction of Transportation Systems, page 34. The specifications apply to construction contracts and, therefore, to contractors. However, GDOT—not a contractor—placed the material under the bridge.

Fire Damage to Bridge and Subsequent Collapse 9 NTSB/HAB-18/02 Federal Highway Administration Guidance The Federal Highway Administration (FHWA) airspace guidelines, found in 23 Code of Federal Regulations (CFR) 710.405–710.407, include the following:11 Question 710.405_4: Are there fundamental restrictions against the lease of highway airspace? Under no conditions shall airspace be used for the manufacture or storage of flammable, explosive, or hazardous material or for any occupation which is deemed by the SDOT/SHA or the FHWA to be a hazard to highway or non-highway users. Further, 23 CFR 710.403(b) requires that any alternative use of the right-of-way be consistent with the “. . . safety of the facility, and such use must not impair the highway or interfere with the free and safe flow of traffic.”12 Although the FHWA has not defined flammable as used in the frequently asked question cited above, it has indicated that the plain language definition of flammable—“capable of being easily ignited and of burning quickly”—is consistent with the direction and intent of the question. GDOT Postfire Actions NTSB investigators requested that GDOT provide a list of all other locations in the state in which materials were being stored under bridge structures. GDOT determined that there were no other such instances. However, one work unit—the Highway Emergency Response Operators (HERO) unit—was located underneath I-85 near the site of the bridge collapse. GDOT is considering options to relocate this work unit, where staff meet for shift changes and hold team safety meetings. Supervisors have offices in the buildings under the I-85 bridge, and HERO trucks are parked there as well. Following the I-85 bridge collapse, GDOT requested that the State Fire Marshal inspect the HERO unit facility. The HERO unit was found to comply with all state requirements. As part of GDOT’s response to the bridge collapse, its commissioner requested assistance from the Office of Insurance and Safety Fire Commissioner in conducting a state-wide joint agency review of related GDOT procedures, particularly those regarding storage under bridge structures or other transportation infrastructure. The objectives of the review were to develop recommendations for best practice and to review policy on the safe storage and handling of all materials. A task group of engineers and safety professionals from the Greater Atlanta Chapter of

11 (a) Airspace is a legal term used in highway terminology to describe the area above or below the plane of a transportation facility and located within the right-of-way boundaries. (b) These guidelines can be found on the FHWA webpage on right-of-way airspace guidelines, accessed April 5, 2018. GDOT owned the space under the bridge; it was not leased. 12 See the FHWA webpage on real property management, 23 CFR 710.403(b), accessed April 5, 2018.

Fire Damage to Bridge and Subsequent Collapse 10 NTSB/HAB-18/02 the Society of Fire Protection Engineers produced a summary report, which provides information on managing fire risk and storing combustible materials under bridges.13 The task group made five recommendations to GDOT, based on National Fire Protection Association (NFPA) standard 502, Standard for Road Tunnels, Bridges, and Other Limited Access Highways, and provided prescriptive guidance for managing the storage of combustible materials. On January 1, 2015—prior to the bridge collapse—the state of Georgia had adopted the 2011 edition of NFPA 502 as a recommended practice. NFPA 502 provides instructive fire protection concepts that may be considered for bridges, tunnels, and other transportation infrastructure. The summary report notes that most bridges constructed of steel and concrete are inherently fire resistant and have a relatively low risk of being seriously damaged by fire. However, the consequences from loss of service should be considered when making fire risk decisions. The fire risk for a bridge is typically based on the potential for vehicle fires above or below the structure. Vehicle fires could include heavy goods or tanker truck fires. Further, a fire resulting from materials stored underneath a bridge could exceed the thermal exposure expected from a vehicle fire. Section 6.3 of NFPA 502 provides the following guidance concerning a structure’s exposure to a design fire:14 6.3.2 Where it has been determined by engineering analysis that collapse of the bridge or elevated highway will impact life safety or have unacceptable implications, the bridge or elevated highway, including its primary structural elements, shall be protected from collision and capable of withstanding the time and temperature exposure represented by the selected design fire and its location. (emphasis added) NFPA 502 does not specify requirements for the storage of materials under a bridge or elevated structure, nor does it prohibit such storage. However, the task group posited that the concepts regarding design fires presented in NFPA 502 can be applied to the storage of materials. As such, the group recommended that the quantity, nature, and burning characteristics (that is, heat release rate) of stored material must not exceed the design fire exposure that was considered during the structure’s design. FHWA Actions The FHWA distributed an event report to the states informing them of the circumstances of the I-85 bridge collapse and its concern about storing materials under bridges. The FHWA indicated that once the NTSB investigation was complete, it would update the report and disseminate any additional information. Further, the FHWA encouraged bridge owners to direct

13 Society of Fire Protection Engineers. 2017. Assessing the Storage of Materials – Bridge Structures and Other Transportation Infrastructure, GAC–SFPE Task Group Summary Report, prepared for the Georgia Office of Insurance and Safety Fire Commissioner, Office of the State Fire Marshal. 14 (a) “Design fire” is an engineering description of the development and spread of fire for use in a fire scenario; see IADC lexicon website on standardization of terminology, accessed April 5, 2018. (b) Excerpt from the 2017 NFPA 502, Standard for Road Tunnels, Bridges, and Other Limited Access Highways, NFPA webpage on codes and standards, accessed April 5, 2018.

Fire Damage to Bridge and Subsequent Collapse 11 NTSB/HAB-18/02 inspectors, during their routine inspections, to be mindful of materials stored under bridges and to communicate any concerns to the bridge inspection program manager. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire and subsequent collapse of the span 30 NB bridge structure on Interstate 85 north, in Atlanta, Georgia, was excessive heat from the ignition of 76 reels of high-density polyethylene conduit and nine racks of fiberglass conduit stored beneath the overpass. Contributing to the bridge collapse was the decision of the Georgia Department of Transportation to store construction materials beneath the bridge and its failure to assess the increased fire risk due to the presence of these combustible materials.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member

T. BELLA DINH-ZARR

Member Adopted: March 13, 2018

For more details about this event, visit the NTSB public docket and search for NTSB accident ID HWY17IH012. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code, Section 1154(b).

FD07490 ｜ 2018_美国_HAR1801.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Collision Between Freight Train and Charter Motorcoach at High-Profile Highway–Railroad Grade Crossing Biloxi, Mississippi March 7, 2017 Accident Report NTSB/HAR-18/01 PB2018-101328 National Transportation Safety Board

NTSB/HAR-18/01 PB2018-101328 Notation 57568 Adopted August 7, 2018 Highway Accident Report Collision Between Freight Train and Charter Motorcoach at High-Profile Highway–Railroad Grade Crossing Biloxi, Mississippi March 7, 2017 National Transportation Safety Board 490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2018. Collision Between Freight Train and Charter Motorcoach at High-Profile Highway–Railroad Grade Crossing, Biloxi, Mississippi, March 7,

1. Highway Accident Report NTSB/HAR-18/01. Washington, DC.

Abstract: On March 7, 2017, a 2016 Van Hool motorcoach, operated by ECHO Transportation and occupied by a driver and 49 passengers, was traveling northbound on Main Street in Biloxi, Mississippi. The motorcoach stopped in advance of a highway–railroad grade crossing on Main Street that had a high vertical profile. The crossing warning system was not in active mode when the motorcoach approached, stopped, and then moved onto the railroad tracks. As the driver attempted to drive over the crossing, the frame of the motorcoach came into contact with the pavement, and the vehicle became stuck on the crossing. An eastbound freight train operated by CSX Transportation was approaching the crossing. The grade crossing warning system activated when the train was about 29 seconds away. As soon as he became aware of the approaching train, the motorcoach driver opened the vehicle’s loading door and told the passengers to evacuate. The train engineer put the train into emergency about 502 feet west of the crossing. About 14 seconds later, the train struck the left side of the motorcoach, pushing it 259 feet down the tracks before coming to a stop, with the motorcoach still in contact with the lead locomotive. Four motorcoach passengers died, the driver and 37 passengers sustained injuries, and 8 passengers were uninjured. The investigation focused on the safety issues of high-profile grade crossings and emergency egress and extrication. As a result of this investigation, the National Transportation Safety Board (NTSB) makes new safety recommendations to the Federal Highway Administration, Federal Railroad Administration, Mississippi Department of Transportation, City of Biloxi, American Association of State Highway and Transportation Officials, American Railway Engineering and Maintenance-of-Way Association, Association of American Railroads, American Short Line and Regional Railroad Association, and Class I railroads. The NTSB reiterates and reclassifies one recommendation to the Federal Motor Carrier Safety Administration. The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID HWY17MH010. Recent publications are available in their entirety on the Internet at the NTSB website. Other information about available publications may be obtained from the website or by contacting: National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551.

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2018-101328. For additional assistance, contact: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see NTIS website).

NTSB Highway Accident Report

ii Contents Figures and Tables ....................................................................................................................... iv Acronyms and Abbreviations .......................................................................................................v Executive Summary ..................................................................................................................... vi 1 Factual Information ...................................................................................................................1 1.1 Crash Narrative .........................................................................................................................1 1.2 Injuries ......................................................................................................................................3 1.3 Emergency Response, Evacuation, and Occupant Protection ..................................................6 1.3.1 Initial Response ..............................................................................................................6 1.3.2 Evacuation of Motorcoach Occupants ............................................................................6 1.3.3 Occupant Protection ........................................................................................................7 1.4 Motorcoach ...............................................................................................................................7 1.4.1 Damage ...........................................................................................................................8 1.4.2 Rear Door ........................................................................................................................9 1.4.3 Mechanical Inspection and History ..............................................................................11 1.4.4 Data Recording Systems ...............................................................................................12 1.5 Highway Factors and Railroad Grade Crossing ......................................................................13 1.5.1 Traffic Characteristics ..................................................................................................13 1.5.2 Main Street Configuration ............................................................................................14 1.5.3 Main Street Grade Crossing Signage and Warning Systems........................................14 1.5.4 Main Street Grade Crossing Vertical Profile ................................................................17 1.5.5 Main Street Grade Crossing Maintenance and Incident History ..................................19 1.5.6 Other Grade Crossings in Biloxi...................................................................................21 1.5.7 Postcrash Actions ..........................................................................................................22 1.5.8 National Grade Crossing Inventory ..............................................................................24 1.6 Railroad Operations ................................................................................................................25 1.6.1 Train Operation ..............................................................................................................25 1.6.2 Rail Operation ...............................................................................................................26 1.6.3 Train Crew ....................................................................................................................27 1.6.4 Recorders ......................................................................................................................28 1.7 Motor Carrier Operations ........................................................................................................29 1.7.1 Carrier Training Program .............................................................................................29 1.7.2 State and Federal Oversight ..........................................................................................30 1.7.3 Driver Grade Crossing Guidance ..................................................................................30 1.8 Motorcoach Driver ...................................................................................................................31 1.8.1 Licensing, Experience, and Driving History ................................................................31 1.8.2 Medical Certification, Health, and Toxicology ............................................................32 1.8.3 Precrash Activities ........................................................................................................32 1.8.4 Route Selection .............................................................................................................33 1.8.5 Driver’s Actions at Crossing and Postcrash Sight Distance Observations ....................34 1.9 Weather and Roadway Conditions ..........................................................................................35

NTSB Highway Accident Report

iii 2 Analysis .....................................................................................................................................36 2.1 Introduction .............................................................................................................................36 2.2 Operator Actions .....................................................................................................................37 2.2.1 Motorcoach Driver ........................................................................................................37 2.2.2 Train Crew ....................................................................................................................38 2.3 High-Profile Grade Crossings .................................................................................................38 2.3.1 Signage and Reconstruction Guidelines .......................................................................38 2.3.2 Coordination of Maintenance and Risk Monitoring .....................................................42 2.4 Emergency Egress and Extrication .........................................................................................45 3 Conclusions ...............................................................................................................................49 3.1 Findings...................................................................................................................................49 3.2 Probable Cause........................................................................................................................50 4 Recommendations ....................................................................................................................51 4.1 New Recommendations ..........................................................................................................51 4.2 Recommendation Reiterated and Reclassified in this Report .................................................53 Appendix A: Investigation ..........................................................................................................54 References .....................................................................................................................................55

NTSB Highway Accident Report

iv Figures and Tables Figure 1. Overhead view of crash location and forward view of northbound approach to Main Street grade crossing ...................................................................................................... 2 Figure 2. Motorcoach and train final rest positions ....................................................................... 3 Figure 3. Motorcoach seating chart................................................................................................ 5 Figure 4. Motorcoach postcrash, showing contact damage to the left side ................................... 8 Figure 5. Motorcoach interior, showing the buckling of the floor and the lateral displacement of the seats ...................................................................................................................... 9 Figure 6. Interior of the motorcoach, showing the three assemblies necessary to open the rear door ....................................................................................................................... 11 Figure 7. Diagram of Main Street, grade crossing, and Esters Boulevard north and south of the crossing ................................................................................................................... 15 Figure 8. Photograph showing the northbound approach to the grade crossing and cross-section diagram of the measured vertical profile of the approach’s slope .......... 18 Figure 9. Photograph showing the southbound approach to the grade crossing and cross-section diagram of the measured vertical profile of the approach’s slope .......... 19 Figure 10. Postcrash view of the northbound approach to the Main Street crossing ................... 23 Figure 11. Activities of the motorcoach driver, March 4–7, 2017 ............................................... 33 Figure 12. Three alternative routes proposed for the motorcoach to travel from Hollywood Casino in Bay St. Louis to Boomtown Casino in Biloxi ............................................ 34

Table 1. Injury levels for motorcoach occupants and train crew ................................................... 4 Table 2. Roadway signs on the northbound Main Street approach to the grade crossing ........... 16 Table 3. National summary of high-profile grade crossings and crash information .................... 25 Table 4. Sequence of events near Main Street grade crossing on March 7, 2017, concerning the train’s movement, the motorcoach’s grounding, and the crash ............................... 29

NTSB Highway Accident Report

v Acronyms and Abbreviations AAMVA

American Association of Motor Vehicle Administrators AASHTO

American Association of State Highway and Transportation Officials AREMA

American Railway Engineering and Maintenance-of-Way Association BASICs

Behavior Analysis and Safety Improvement Categories BFD

Biloxi Fire Department BPD

Biloxi Police Department CDL

commercial driver’s license CFR

Code of Federal Regulations CSXT

CSX Transportation DOT

[state] department of transportation FAA

Federal Aviation Administration FHWA

Federal Highway Administration FMCSA

Federal Motor Carrier Safety Administration FRA

Federal Railroad Administration GPS

global positioning system GVWR

gross vehicle weight rating IC

incident commander LGCGC

low ground clearance grade crossing MDOT

Mississippi Department of Transportation MUTCD

Manual on Uniform Traffic Control Devices for Streets and Highways NHTSA

National Highway Traffic Safety Administration NO&M

New Orleans & Mobile (CSXT railroad subdivision) NTSB

National Transportation Safety Board TRB

Transportation Research Board TxDPS

Texas Department of Public Safety US-90

US Route 90 USC

United States Code USDOT

US Department of Transportation

NTSB Highway Accident Report

vi Executive Summary Investigation Synopsis On Tuesday, March 7, 2017, about 2:11 p.m. central standard time, a 2016 Van Hool motorcoach, operated by ECHO Transportation and occupied by a 60-year-old driver and 49 passengers, ranging in age from 50 to 88, was traveling northbound on Main Street in Biloxi, Mississippi, having departed that afternoon from a casino in Bay St. Louis, Mississippi, to travel to a casino in Biloxi. The motorcoach stopped in advance of a highway–railroad grade crossing on Main Street that had a high vertical profile. The grade crossing was marked with (1) a crossbuck, (2) warning lights that would activate at a train’s approach, (3) a gate arm that would lower at a train’s approach, and (4) a low ground clearance grade crossing warning sign with a “LOW GROUND CLEARANCE” plaque below it on the signpost. The crossing warning system was not in active mode when the motorcoach approached, stopped, and then moved onto the railroad tracks. As the driver attempted to drive over the crossing, the frame of the motorcoach came into contact with the pavement, and the vehicle became stuck on the crossing. The driver moved the motorcoach back and forth in an attempt to dislodge it from the crossing but was unsuccessful. As the motorcoach became stuck on the crossing, an eastbound freight train operated by CSX Transportation was approaching the crossing at a recorded speed of 27 mph while continuously sounding its warning horn. The grade crossing warning system activated when the train was about 29 seconds away; first, the warning lights began to flash, and then the gate arm began to descend 3 seconds later. As soon as he became aware of the approaching train, the motorcoach driver opened the vehicle’s loading door and told the passengers to evacuate. Due to their age and limited mobility, the passengers’ evacuation was slow and the aisleway became congested; only six passengers had safely evacuated before the train struck the grounded motorcoach. The train engineer told investigators that he had noticed the motorcoach on the tracks ahead, but he expected it to clear the crossing before the train reached it. Once the engineer realized that the motorcoach might not clear the tracks, he put the train into emergency about 502 feet west of the crossing. About 14 seconds later, by which time the train had decelerated to about 19 mph, it struck the left side of the motorcoach, pushing it 259 feet down the tracks before coming to a stop, with the motorcoach still in contact with the lead locomotive. Four motorcoach passengers died, the driver and 37 passengers sustained injuries, and 8 passengers were uninjured. The train crewmembers were uninjured. Probable Cause The National Transportation Safety Board determines that the probable cause of the Biloxi, Mississippi, crash was the failure of CSX Transportation and the City of Biloxi to coordinate and take action to improve the safety of the Main Street grade crossing, a high vertical profile crossing on which motor vehicles were known to ground frequently; their inaction led to the grounding of the motorcoach that was subsequently struck by the CSX Transportation freight train. Contributing

NTSB Highway Accident Report

vii to the circumstances of the crash was the inadequate guidance from the Federal Highway Administration on how to mitigate the risks posed by grade crossings with high vertical profiles. Safety Issues The crash investigation focused on the following safety issues: • High-profile grade crossings. No current guidelines for high-profile grade crossings (1) describe the conditions under which signage that selectively excludes certain vehicle types from using the crossing should be installed or (2) define when a crossing should be reconstructed (or otherwise have its safety risk mitigated) due to its unsafe vertical profile. Also, railroad companies are not required to coordinate their maintenance plans with local and state highway transportation agencies, and crossing safety risk is not effectively monitored. The report explores approaches to improve grade crossing safety by addressing these deficiencies. • Emergency egress and extrication. The motorcoach was equipped with a secondary door in the rear, which was not used for emergency egress or passenger extrication. Had the rear door been used, it most likely would have expedited the postcrash extrication of the passengers. The report discusses pretrip safety briefings that might be used to enhance passengers’ awareness of the secondary door as an emergency egress point and extrication route. Recommendations As a result of this investigation, the National Transportation Safety Board (NTSB) makes new safety recommendations to the Federal Highway Administration, Federal Railroad Administration, Mississippi Department of Transportation, City of Biloxi, American Association of State Highway and Transportation Officials, American Railway Engineering and Maintenance-of-Way Association, Association of American Railroads, American Short Line and Regional Railroad Association, and Class I railroads. The NTSB reiterates and reclassifies one recommendation to the Federal Motor Carrier Safety Administration.

NTSB Highway Accident Report

1 1 Factual Information 1.1 Crash Narrative On Tuesday, March 7, 2017, about 2:11 p.m. central standard time, a 2016 Van Hool motorcoach, operated by ECHO Transportation and occupied by a 60-year-old driver and 49 passengers, ranging in age from 50 to 88, was traveling northbound on Main Street in Biloxi, Mississippi.1 The motorcoach’s trip was part of a charter tour for senior citizens organized by Diamond Tours. This segment of the tour was taking the passengers from Hollywood Casino in Bay St. Louis, Mississippi, to Boomtown Casino in Biloxi.2 The motorcoach stopped in advance of a highway‒railroad grade crossing that had a high vertical profile.3 This active grade crossing was marked with (1) a crossbuck, (2) warning lights that would activate at a train’s approach, (3) a gate arm that would lower at a train’s approach, and (4) a low ground clearance grade crossing (LGCGC) warning sign with a “LOW GROUND CLEARANCE” plaque below it on the signpost (see figure 1).4 The crossing warning system was not in its active mode when the motorcoach approached the crossing, stopped, and then moved onto the railroad tracks. As the driver attempted to drive across the grade crossing, the vehicle’s frame came into contact with the pavement north of the railroad tracks, and the motorcoach became grounded on the crossing.5 The driver moved the motorcoach back and forth to try to dislodge it, but he was unsuccessful.

1 Unless otherwise indicated, all times cited in the report are central standard time. 2 The trip and the route selection are discussed in section 1.8.4. 3 Such grade crossings are known as “high-profile,” “hump,” or “humped” crossings. 4 According to the Federal Railroad Administration (FRA), an active grade crossing consists of active warning and control devices such as bells, flashing lights, and gate arms that lower and rise, in addition to passive warning devices such as crossbucks. 5 In this report, “grounding” refers to a significant contact between a vehicle frame and the surface of a grade crossing such that it prevents vehicle movement. Other terms describing such contact are “stuck” and “lodged.”

NTSB Highway Accident Report 2 Figure 1. Overhead view of crash location (top) and forward view of northbound approach to Main Street grade crossing (bottom). While the motorcoach was stuck on the crossing, an eastbound freight train operated by CSX Transportation (CSXT)—comprising 3 locomotives, 27 loaded cars, and 25 empty cars— was approaching the crossing at a recorded speed of 27 mph with its horn continuously sounding, its headlights on, and its auxiliary lights flashing.6 The grade crossing warning devices activated when the train was about 29 seconds away; first, the crossing warning lights began flashing, and then the crossing gate arms began to descend 3 seconds later. As soon as he became aware of the approaching train, the motorcoach driver opened the loading door and told the passengers to evacuate. Because of the passengers’ age and limited mobility, the evacuation was slow and the aisleway became congested; only six passengers had safely evacuated before the train struck the grounded motorcoach. 6 The train had left New Orleans, Louisiana, that morning, and its final destination was Waycross, Georgia.

NTSB Highway Accident Report 3 The train engineer later said that he had noticed the motorcoach on the tracks, but he expected it to clear the crossing before the train arrived there. As soon as the engineer realized that the motorcoach was not clearing the tracks, when the train was about 502 feet west of the crossing, he put the train into emergency braking. About 14 seconds later, by which time it had decelerated to about 19 mph, the train struck the left side of the motorcoach, pushing it 259 feet down the tracks before coming to a stop, with the motorcoach still in contact with the lead locomotive (see figure 2).7 Figure 2. Motorcoach and train final rest positions. (Source: Biloxi Police Department) 1.2 Injuries As a result of this crash, 4 motorcoach passengers died, the driver and 21 passengers sustained serious injuries, 16 passengers received minor injuries, and 8 passengers were uninjured. The train engineer and the conductor were also uninjured. Table 1 summarizes the distribution of injury severity. 7 For additional information about the train’s movement and the engineer’s actions, see section 1.6.

NTSB Highway Accident Report

4 Table 1. Injury levels for motorcoach occupants and train crew.a

Fatal Serious Minor None TOTAL

Train crew

--

2 2

Motorcoach driver

1

-- 1 Motorcoach passengers 4 21 16 8 49 TOTAL 4 22 16 10 52 a Although 49 Code of Federal Regulations (CFR) Part 830 pertains to the reporting of aircraft accidents and incidents to the National Transportation Safety Board (NTSB), section 830.2 defines fatal injury as any injury that results in death within 30 days of the accident, and serious injury as any injury that (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date of injury; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. Video from an interior-facing camera on the motorcoach showed that three of the passengers who died were attempting to exit the motorcoach when the train struck it.8 One of those passengers had just stepped down from the loading door, while the other two were in the loading area and were ejected at impact; all three passengers were subsequently struck by the motorcoach and the locomotive. The fourth passenger who died was standing in the rear of the motorcoach, in the aisleway by row 14. He died as a result of cervical vertebrae fractures sustained at impact. The 22 seriously injured motorcoach occupants sustained multiple blunt force injuries, including fractures, head injuries, and internal organ lacerations. The 16 passengers with minor injuries generally sustained contusions and abrasions. Of the eight motorcoach passengers who were uninjured, six had evacuated before the crash. Based on interviews with the surviving passengers and video from the interior-facing onboard camera, at the time of impact, 42 passengers were on the motorcoach; 23 were standing and 19 were seated. One passenger had stepped off the motorcoach just before the train struck it. As indicated in figure 3, the distribution of nonfatal injuries was similar among the seated and standing passengers, but their location within the motorcoach had a much greater effect on the extent of their injuries. The distribution of injury severity shows that most of the passengers—18 of 21—who sustained serious injuries were located in the front half of the motorcoach (row 7 and forward). Of the 20 passengers who were in the rear half of the motorcoach, 1 died, 3 received serious injuries, 14 received minor injuries, and 2 were uninjured.

8 The motorcoach was equipped with Lytx DriveCam, an event-based driver-monitoring video system. For more details, see section 1.4.4.

NTSB Highway Accident Report 5 Figure 3. Motorcoach seating chart, showing the injury classifications and positions of the motorcoach driver and 43 passengers who were on or just outside the vehicle at the time of impact.

NTSB Highway Accident Report

6 1.3 Emergency Response, Evacuation, and Occupant Protection 1.3.1 Initial Response The City of Biloxi emergency communication center received a 911 call about the crash at 2:12 p.m.; the dispatcher immediately notified Biloxi Police Department (BPD) patrol units, the first of which arrived on the scene at 2:13 p.m. The first engine unit from the City of Biloxi Fire Department (BFD) was dispatched at 2:13 p.m.; this unit, which included the fire chief, arrived on the scene at 2:17 p.m. The fire chief assumed the role of incident commander (IC) upon arrival and declared a mass casualty incident. The BFD dispatched to the scene a total of eight engine units, two truck companies, one rescue truck, and one medivac unit. Keesler Air Force Base, located minutes from the crash location, sent two ambulances to the scene, as well as additional physicians to a local hospital to help with incoming trauma patients. American Medical Response and Acadian Ambulance Services, which are the contracted emergency service providers for the area surrounding the crash, dispatched eight ambulances. American Medical Response transported 24 motorcoach occupants to area hospitals, and Acadian Ambulance Services transported 16 occupants. Although three medivac helicopters were dispatched to the scene, only one transported a passenger. The last motorcoach occupant was transported to a local hospital at 3:20 p.m. The City of Biloxi has an emergency management plan based on the national incident management system and incident command system. As part of the plan, the City of Biloxi conducts annual disaster drills with neighboring jurisdictions, city agencies, and Keesler Air Force Base. The last drill before the crash was held on February 16, 2017. 1.3.2 Evacuation of Motorcoach Occupants 1.3.2.1 Preimpact. During postcrash interviews, several passengers reported having been alerted to the train’s approach by the sound of its horn and the activation of the warning bells and lights at the crossing, as well as by the sound of the crossing arm striking the side of the motorcoach.9 Passengers reported that, moments after they informed the motorcoach driver of the approaching train, he opened the loading door and told everyone to evacuate. The driver said that he heard the crossing warning bells after he had opened the loading door to permit passenger evacuation. The driver could not recall how many passengers had exited the motorcoach before the train struck. After the crash, NTSB investigators measured the distance of the bottom step of the loading bay from the ground, using an exemplar motorcoach positioned as close as possible to the location of the crash motorcoach at the time of impact; the height from the ground was 22 inches.10 The distance from the bottom step to the ground and the passengers’ limited mobility (due to age) slowed the evacuation; as a result, many passengers were queued in the aisleway when the crash occurred. Several passengers reported that, having been unable to exit due to the congested aisleway, they moved to the back of the motorcoach to avoid the immediate impact area; others

9 See section 1.6.4 for additional information about the activation times of the grade crossing warning system. 10 In the grounded position, the loading door of the crash-involved motorcoach would have been positioned several inches north of the same door on the exemplar motorcoach, which would have made the distance between the ground and the crash motorcoach’s bottom loading bay step several inches greater. (On a flat surface, the distance from the bottom step of the loading bay to the ground measured 12 inches.)

NTSB Highway Accident Report

7 elected to remain seated and braced for impact. A small group of passengers was standing near the rear door as the train approached; they later told investigators that they had been unaware of the door’s presence. 1.3.2.2 Postimpact. Several passengers reported that, when the motorcoach came to rest, the aisleway was blocked by fallen and injured passengers. First responders initially entered through the loading door and evacuated those passengers who were in the front of the motorcoach. Because multiple injured passengers were lying in the aisleway, blocking access to the rest of the motorcoach, first responders also entered through the rear windows to reach the injured passengers in the rear. First responders extricated these rear passengers or assisted them to exit through the windows; they helped some to climb down ladders placed against the side of the motorcoach. Several passengers had to be placed on backboards before they were evacuated and, due to the limited space available inside the motorcoach, their extrications were challenging. Although the motorcoach was equipped with a secondary door in the rear, first responders were unable to open it. Because of the prolonged extrication process, the IC ordered the removal of the rear door to speed passenger evacuation. Two passengers were ultimately extricated through the rear door opening. (Section 1.4.2 discusses the rear door in additional detail.) 1.3.3 Occupant Protection The motorcoach driver seat and all its passenger seats were equipped with lap/shoulder belts.11 The driver and seven of the passengers reported having used the available lap/shoulder belts during a portion of the crash trip. Only two passengers reported having been belted at the time of the crash.12 The motorcoach driver had given a pretrip safety briefing to the primary group of passengers on the first day of travel—March 5, 2017—when he collected them in Bastrop, Texas. The briefing included a description of the emergency exit windows and an explanation of the use of lap/shoulder belts. The driver did not mention the rear door. Most of the passengers were members of a senior center in Bastrop, but some—friends of senior center members—were from Sealy, Texas. After beginning the trip in Bastrop, the motorcoach stopped in Sealy to pick up these passengers. When collecting the Sealy passengers, the driver did not provide a second pretrip briefing. 1.4 Motorcoach The 56-passenger 2016 Van Hool CX 45 motorcoach was equipped with a Detroit Diesel DD13 500-horsepower engine and an Allison WTB500 automatic transmission. The motorcoach had a gross vehicle weight rating (GVWR) of 54,000 pounds, a wheelbase of 29.5 feet, and an overall length of 45.5 feet. It had 15 rows of passenger seats on the left (driver) side and 13 rows on the right side.

11 Although not a factor in this crash, several seat belt buckles were not functional. Van Hool is working to reengineer the buckle or to find a new seat belt supplier. 12 One of the two belted passengers was seated in the window seat on the right side in row 7 and sustained serious injuries; the other belted passenger was seated in the aisle seat on the right side in row 9 and received minor injuries.

NTSB Highway Accident Report 8 1.4.1 Damage 1.4.1.1 External. The motorcoach sustained significant contact damage on the left side, which began about 16.3 feet from the rear and extended forward about 9.3 feet (see figure 4). The maximum lateral displacement occurred about 22.7 feet from the rear, where the left sidewall intruded 27 inches. This maximum intrusion was in the region of rows 5 through 7. The luggage compartment door just forward of the rear axle was displaced and the compartment door to its left was folded toward the front of the motorcoach. The location of the impact damage on the left side indicated that the front of the motorcoach was about 20.4 feet past the north side of the rail tracks when the locomotive struck it. The front end sustained no crash damage. Figure 4. Motorcoach postcrash, showing contact damage to the left side. On the motorcoach’s right side, the sidewall was bowed out in the area corresponding to the impact on the left side. The maximum lateral displacement occurred about 25.7 feet from the rear of the motorcoach, where the right sidewall bowed outward about 18 inches. 1.4.1.2 Interior. The driver seat was intact, and the steering wheel was undamaged. The front interior of the motorcoach, up to about row 4, was largely undamaged, and the aisleway in this area retained its original width of 17 inches. Extensive interior damage began at row 5 on the left side and extended to slightly beyond row 8 (see figure 5). The area of these four rows showed evidence of intrusion that reduced the overall interior width of the motorcoach, sidewall to sidewall, by 16 inches. The aisle in this area decreased in width from 17 inches to 8 inches. As a result of the impact, the motorcoach floor buckled, starting in the aisleway at row 4. The floor in front of the seats in row 5 on the right side had buckled and partially collapsed, creating an opening in the floor that extended into the row 6 seats on the right side. As a result of this floor collapse, the aisle seat in row 5 on the right side had dropped about 2 inches below the floor level, intruding into the luggage compartment. The upward buckling of the floor in row 5 raised the floor level at this location by about 12 inches.

NTSB Highway Accident Report 9 Figure 5. Motorcoach interior, showing the buckling of the floor and the lateral displacement of the seats. 1.4.1.3 Windows. The motorcoach was equipped with seven windows on each side, four of which on each side were configured as emergency exit windows. Four windows on the left side were displaced, two were partially pushed out of their frames, and one was removed during the extrication process.13 The windshield, which consisted of two panes, had its left pane displaced; the right pane was intact. Two of the seven windows on the right side were missing from their frames; others were intact.14 The motorcoach was equipped with two roof hatches above the aisleway, located above the third and twelfth rows of seats, respectively; the hatches were intact and closed. 1.4.2 Rear Door The motorcoach was equipped with a secondary door in the rear, between the lavatory and the seatback of the last row of seats on the right side. The clearance between the lavatory wall and the back of the seatback was 17 inches. Using an exemplar motorcoach positioned as close as possible to the location of the crash motorcoach at the time of impact, NTSB investigators measured the distance from the motorcoach floor at the rear door to the ground as 4 feet 8 inches. Van Hool originally designed the rear door on this model motorcoach for two potential uses: (1) operation/access for wheelchairs (per the Americans with Disabilities Act) or (2) secondary egress (this use is only possible when the wheelchair restraints are not prohibiting access to the rear door). Although the rear door can be used for either purpose, the purchasing motor carrier determines its configuration. 13 Two of the displaced windows were emergency exit windows, and both of the windows that were partially pushed out of their frames were emergency exit windows. 14 One of the displaced windows was an emergency exit window.

NTSB Highway Accident Report

10 The rear door on the crash motorcoach was not configured for wheelchair access, and ECHO Transportation did not use it as a wheelchair access point. ECHO Transportation told investigators that it did not intend the door to be used for emergency access, because this was not required by US regulations. The door’s design, however, made it a possible secondary egress point. Secondary exit doors for motorcoaches are permitted but not required under the Federal Motor Vehicle Safety Standards. According to the standards, buses with GVWRs greater than 10,000 pounds are required to provide side emergency exit windows and to have optional configurations for other emergency exits in their midportion or rear.15 The standards permit motorcoaches with a rear engine to have at least one emergency roof exit hatch instead of a rear exit door. The crash motorcoach, with its two roof hatches, met the requirements for emergency egress without the rear door. In the European Union, a bus such as the crash motorcoach would be required to have at least two service doors, or one service door and one emergency exit door.16 Van Hool motorcoaches with the same configuration of windows and doors as the crash motorcoach are sold in Europe and are considered to meet European Union requirements. On the crash motorcoach, placards above, on the wall next to, and on the rear door indicated how to unlock the rear door. The wording on the placards is provided below in italics: Above the door: EMERGENCY DOOR RELEASE [turning this valve dumps the air that holds the door pistons in place] On the wall beside the door: DOOR HANDLE FOR EMERGENCY USE ONLY [once removed from this fixture, the door handle can be inserted into the handle placement fixture below to open the rear door] On the door just below the window: REMOVE HANDLE WHEN DOOR IS SECURED [putting the door handle onto the fixture at this location allows the handle to turn and open the rear door] Turning the valve to release the emergency door, obtaining the door handle, and putting the handle into the release fixture (and turning it) opens the rear door. No driver action is required to open the rear door from the inside, but it can be opened only when the motorcoach speed is below 5 mph. Figure 6 shows the rear door and the elements required for its release.

15 The crash motorcoach met the criteria for a commercial vehicle, per 49 CFR 390.5, and for a bus with a designed seating capacity greater than 10 persons, per 49 CFR 571.3. 16 Section 7.6 of Economic Commission for Europe Regulation 107 defines various acceptable exit configurations, based on vehicle type and passenger capacity.

NTSB Highway Accident Report 11 Figure 6. Interior of the motorcoach, showing the three assemblies necessary to open the rear door. According to a passerby who entered the motorcoach after the crash but before the arrival of emergency responders, he attempted to open the rear door from inside the vehicle. He reported taking the handle that he saw mounted on the wall of the lavatory and placing it on the door in an attempt to open it, but he was unsuccessful.17 If the rear door is locked, it cannot be opened from outside the motorcoach. When the first responders attempted to open the rear door from the outside, they found it locked. Once inside the motorcoach, they were unable to locate the emergency door handle and could not open the door.18 1.4.3 Mechanical Inspection and History NTSB investigators performed functional checks of the motorcoach’s steering, electrical, suspension, and braking systems, and they examined its tires and wheels. They found no damage to any steering or electrical system components. The suspension system included (1) a “kneeling system” that allows a driver to lower the vehicle’s front end to facilitate loading/unloading of passengers, and (2) a rear-lift system that enables a driver to increase the height of the rear suspension air springs, elevating the rear of the motorcoach by 4 inches. At the time of the crash, the kneeling system was not engaged, but the rear-lift system was engaged.19 Investigators found no evidence of damage or defects affecting the suspension system. The motorcoach was equipped with pneumatic antilock brakes on all axles. Examination of the brake components, including the linings, showed that they were within specifications. The tread depths on the tires were sufficient to meet minimum requirements, and no noncollision defects were found on any tires or wheels.20 17 The attempt to open the rear door was most likely unsuccessful because the passerby did not release the emergency door valve. 18 First responders later found the handle in debris. 19 Investigators examined whether raising the rear of the motorcoach affected the height of the front of the vehicle but found it unchanged. 20 Title 49 CFR 393.75(b) provides requirements for the minimum tread depths for tires on various axles.

NTSB Highway Accident Report

12 The motorcoach had passed its most recent annual inspection on April 7, 2016. The service records indicated regular maintenance and repair. The motorcoach was not subject to any safety recalls. 1.4.4 Data Recording Systems 1.4.4.1 Global Positioning System. The motorcoach driver used his personal global positioning system (GPS) device—a Garmin DEZL 570MT—for navigation; the device was found in the motorcoach postcrash. Although the GPS device was damaged, its data were retrievable. Data from the GPS showed that the motorcoach reached the stop line of the Main Street grade crossing at 2:11:08 p.m. This time corresponds to about 35 seconds before the crash, based on the clock from the locomotive’s forward-facing camera (see section 1.6.4 for more details on train recorders).21 The GPS recorded three coordinate points at this location—12 and 31 seconds apart—showing the motorcoach arriving at the stop line, being on the tracks, and being about 20 feet north of the tracks.22 The Garmin DEZL 570MT is designed to aid in the navigation of commercial vehicles, such as a motorcoach. A driver can input the dimensions of a vehicle, which allows the system to navigate it away from routes with conflicting limitations, such as height restrictions.23 Although the device can display warning signs that are present in the environment, the system does not avoid routing vehicles over high-profile grade crossings, unless prohibitory signs are present.24 Using the same model Garmin GPS, NTSB investigators inputted the dimensions of the crash motorcoach and tested the device’s navigation by monitoring and documenting the suggested directions while driving from Hollywood Casino in Bay St. Louis to Boomtown Casino in Biloxi. After reaching US Route 90 (US-90), the GPS device suggested a route that included traversing the Main Street grade crossing.25 When approaching the crossing, the device sounded an auditory alert and its screen depicted the railroad tracks and showed an LGCGC warning in the upper right corner. When the warning was tapped, the device screen displayed a banner across its top that read “Risk of Grounding.” NTSB investigators contacted HERE Technologies, which provides Garmin with geospatial mapping data. HERE stated that the Main Street grade crossing has been present in its database since at least August 2013, when the information about the LGCGC warning sign at this

21 Although the GPS clock was not synchronized with the clocks from the locomotive recorders and the recorded location represented a midpoint of the accuracy diameter, NTSB investigators determined that the time of the motorcoach’s approach to the railroad tracks about 35 seconds before the crash was reasonably consistent with data from the train recorders. 22 According to Garmin, its GPS devices are accurate within 10 meters, and possibly within an even narrower range, depending on the number of satellites the device is tracking. If the calculated GPS location is outside the roadway, the reported location typically corrects the vehicle position to the nearest roadway location. 23 The driver reported that he selected the commercial vehicle operation mode and inputted the motorcoach’s dimensions into the GPS device. The device was damaged in the crash, which kept investigators from verifying the mode of operation at the time of the crash. 24 The capability of the GPS to display warning signs that are present in the environment or to restrict navigation over certain grade crossings depends on whether the device is accessing the latest data, such as information that a specific grade crossing has a sign prohibiting transit by certain vehicles. 25 Although the Garmin unit that the NTSB investigators tested was the same model GPS device as the one used by the motorcoach driver, it was running a newer software version. NTSB investigators were unable to roll back the older version of the software onto the test device or to find an identical unit still using the older software.

NTSB Highway Accident Report

13 location was added. In January 2015, HERE added information about this grade crossing’s protected status—the presence of the crossing gates.26 1.4.4.2 Engine Control Module. The motorcoach engine was controlled by a Detroit Diesel Electronic Control IV system, which can store vehicle parameters and record trip activity, including diagnostic information associated with engine or sensor faults. The module can also store last stop events, which are recorded when the vehicle stops and idles for at least 2 minutes or when it stops and the engine powers off. The extracted data from the control module showed that the motorcoach stopped at 2:11:55 p.m., which corresponds to the approximate time the motorcoach came to its final rest. 1.4.4.3 Lytx DriveCam. The motorcoach was also equipped with Lytx DriveCam, a monitoring and recording device that continually tracks driving performance metrics and records pertinent information when triggered by critical events, such as stability control or hard braking.27 The DriveCam was mounted near the midpoint on the left edge of the right windshield pane (near the center of the full windshield); the device included a two-channel image recorder for recording video from forward- and interior-facing cameras. The extracted data showed that the DriveCam system captured crash-relevant information, including 8 seconds of video data from both cameras. The video from the motorcoach’s interior-facing camera shows 8 seconds of preimpact and 4 seconds of postimpact events. The beginning of the video shows the open loading door, and four passengers evacuate through the door before the train strikes the motorcoach. Based on postcrash interviews with motorcoach occupants and autopsy records, three of those passengers evacuated to a safe distance, and one died. The video also shows two passengers attempting to evacuate from the loading door area and their being ejected through the door at impact; both of these passengers died. This video does not show the other three passengers who safely evacuated before the start of the recording. 1.5 Highway Factors and Railroad Grade Crossing 1.5.1 Traffic Characteristics 1.5.1.1 Highway. The Gulf Regional Planning Commission collects traffic volume information for the Main Street crossing about every 3 years; the last collection was completed in 2016. At the request of NTSB investigators, the City of Biloxi conducted a traffic count for the Main Street grade crossing on July 15, 2017. The traffic count indicated daily traffic of 2,117 vehicles, 99 percent of which were cars and similar noncommercial vehicles.28 The speed limit on this section of Main Street was 25 mph.

26 Following the crash, the City of Biloxi installed a sign at the Main Street grade crossing prohibiting certain vehicle types from using that crossing (see section 1.5.7). Once information about the prohibitory sign is in the HERE database, an up-to-date commercial navigation device would not suggest a route using the Main Street grade crossing for the prohibited vehicle types. 27 The threshold for triggering a stability control event is lateral movement of at least 0.4 g (force of gravity); for a hard-braking event, the trigger is a 9-mph deceleration in 1 second. 28 This count was conducted after the City of Biloxi took the postcrash action of placing selective exclusion signs prohibiting certain vehicle types from transiting the crossing (see section 1.5.7).

NTSB Highway Accident Report

14 1.5.1.2 Railroad. The average daily train volume at the Main Street grade crossing was 12.5 trains in 2016; it was 11.5 trains in 2017. The speed limit on this section of the railroad tracks, as established by CSXT, was 45 mph. 1.5.2 Main Street Configuration Main Street is a north–south road that crosses the tracks at railroad milepost 726.6. The grade crossing is bordered to the north and south by Esters Boulevard, two streets of the same name that run parallel to the tracks on both sides. (This report refers to the parallel streets as Esters Boulevard N and Esters Boulevard S, to indicate their positions relative to the tracks.) 1.5.2.1 South of Esters Boulevard S. South of Esters Boulevard S, each direction of travel on Main Street consists of a single 11-foot-wide travel lane, a single 5-foot-wide bicycle lane, and an 8-foot-wide parking lane. The two directions of travel are separated by two 4-inch-wide solid yellow pavement stripes; the bicycle lanes in both directions are separated from both the travel lane and the parking lane by 4-inch-wide solid white stripes. 1.5.2.2 Between Esters Boulevard S and N. Between Esters Boulevard south and north of the tracks, Main Street consists of a 12-foot-wide northbound and a 16-foot-wide southbound lane of travel. The two lanes are delineated by two 4-inch-wide solid yellow pavement stripes.29 1.5.3 Main Street Grade Crossing Signage and Warning Systems The northbound approach to the Main Street grade crossing includes multiple signs and warning systems notifying roadway users of the upcoming grade crossing. The warning features include pavement markings, warning signs, and an active grade crossing warning system. 1.5.3.1 Pavement Markings. The northbound approach to the Main Street grade crossing is marked with a grade crossing pavement symbol, about 155 feet south of the railroad tracks (see figure 7). The southbound approach (north of the tracks) is not marked with a grade crossing pavement symbol. Both the northbound and southbound approaches to the crossing have worn, but visible, 2-foot-wide white stop lines. The line is located about 22.5 and 23 feet, respectively, from the nearest rail track on the northbound and southbound approaches.

29 The solid yellow markings are faded and partially covered by recently applied asphalt.

NTSB Highway Accident Report 15 Figure 7. Diagram of Main Street, grade crossing, and Esters Boulevard north and south of the crossing. 1.5.3.2 Signage. Warning and advisory signs are present on both the northbound and southbound approaches to the crossing. Along the northbound approach, at the time of the crash, multiple signs notified road users of the upcoming grade crossing (see table 2). They included the following: (1) grade crossing advance warning sign, located 382 feet from the tracks; (2) LGCGC warning sign, located 25 feet from the tracks; (3) “LOW GROUND CLEARANCE” plaque, located just below the LGCGC warning sign on the same signpost; (4) “CONSTRUCTION AHEAD” temporary traffic control sign, located 24 feet from the tracks; (5) 15-mph advisory speed limit plaque, located just below the “CONSTRUCTION AHEAD” sign on the same signpost; and (6) grade crossing crossbuck, located 13 feet from the tracks.30 The southbound approach to the crossing contained the same crossing-specific signs.31 30 The “CONSTRUCTION AHEAD” sign indicated road work that started at Esters Boulevard N. At the time of the crash, there was no construction, and all lanes were open to traffic. 31 The southbound approach to the grade crossing had the same signage as the northbound approach, except for the “CONSTRUCTION AHEAD” sign and advisory speed limit plaque. The southbound approach also had a “No Turnaround” plaque below an additional LGCGC warning sign, located about 1,500 feet north of the grade crossing.

NTSB Highway Accident Report 16 Table 2. Roadway signs on the northbound Main Street approach to the grade crossing. Name Design Dimensions Distance to Crossing Grade crossing advance warning 36-inch diameter 382 feet LGCGC warning 30-inch x 30-inch 25 feet “LOW GROUND CLEARANCE” plaque 24-inch x 18-inch 25 feet “CONSTRUCTION AHEAD” temporary traffic control warning 36-inch x 36-inch 24 feet 15-mph advisory speed limit plaque 18-inch x 18-inch 24 feet Grade crossing crossbuck 36-inch x 36-inch 13 feet Esters Boulevard south and north of the grade crossing also had warning signs alerting drivers to the upcoming Main Street grade crossing. Parallel grade crossing and intersection advance warning signs were located at distances 105–170 feet from the grade crossing. 1.5.3.3 Grade Crossing Warning System. The southbound and northbound approaches to the Main Street crossing each have a flashing light signal and an automatic gate assembly. The flashing light signals are mounted on a mast and consist of two sets of 12-inch-diameter red LED lights mounted back-to-back, such that they are visible to traffic on Main Street approaching the crossing from both directions. Two additional sets of 12-inch-diameter red LED lights are mounted back-to-back on the mast, such that they are visible to traffic on Esters Boulevard approaching Main Street from either direction. The automatic gate consists of a drive mechanism, three red lights, and a gate arm marked with reflective red and white tape. In the down position, the gate arm extends across the

NTSB Highway Accident Report

17 approaching traffic lane; the light nearest the arm’s tip is continuously illuminated and the other two lights flash alternately, in unison with the mast-mounted flashing light signal. The flashing light signal and the gate assemblies are located about 13 feet and 13.5 feet from the nearest rail for the northbound and southbound approaches, respectively. An emergency notification sign, providing information about the grade crossing location and the phone number for reporting emergencies to CSXT dispatch, is also on each side of the track. 1.5.4 Main Street Grade Crossing Vertical Profile NTSB investigators measured the vertical grade of the Main Street grade crossing in the northbound direction of travel. South of the railroad tracks, the average slope is +4.2 percent (uphill) with an approximate maximum slope of 7.5 percent, measured about 5.7 feet south of the tracks. North of the railroad tracks, the average slope is -13.3 percent (downhill) with an approximate maximum slope of -24.4 percent, measured about 10.6 feet north of the tracks.32 NTSB investigators also measured the average vertical grades of travel at 30 feet from the nearest rail. At 30 feet from the nearest rail, the road surface is 14.4 inches and 45.4 inches below the track level, south and north of the tracks, respectively. These levels correspond to vertical grades of 4.2 percent south and -13.3 percent north of the tracks. The American Association of State Highway and Transportation Officials (AASHTO) and the Federal Highway Administration (FHWA) have each developed guidance for grade crossing design, including the maximum recommended vertical profile; the guidance is published in AASHTO’s A Policy on Geometric Design of Highways and Streets and the FHWA’s Railroad-Highway Grade Crossing Handbook (AASHTO 2011 and FHWA 2007). Both sources recommend that the crossing surface be level with the top of the rails for at least 2 feet beyond the rails.33 Additionally, both recommend that the road surface be no more than 3 inches higher or lower than the track level at 30 feet from the nearest rail (see figures 8 and 9). Following this guidance would result in a maximum grade of 0.89 percent. The American Railway Engineering and Maintenance-of-Way Association (AREMA), a railway industry group, also provides guidance on the vertical profiles of grade crossings (AREMA 2011). The AREMA guidance matches the AASHTO and FHWA recommendations. Although the Mississippi Department of Transportation (MDOT) provides its own guidance on the design of grade crossings in its Roadway Design Manual (MDOT 2001), since 2010, MDOT has relied on the FHWA guidance for approval of grade crossing projects.34

32 Because the grade crossing’s approach and departure slopes are vertical curves, the grade measurements constantly change over the length of the crossing. The reported average grade measurements were calculated from the difference in vertical total station (a surveying instrument) survey measurements taken at distances of 2 feet and 30 feet from the nearest rail. The maximum reported slope value for each approach was obtained from the steepest total-station survey data segment along the measured profile line. Data points along the profile line were collected at intervals of about 1 foot; reported measurements should therefore be considered approximate values. 33 For the Main Street crossing, at 2 feet south of the railroad tracks, the road surface was 0.1 inch below the track level. At 2 feet north of the tracks, the road surface was 0.5 inch below the track level. 34 At the time of the collision, the MDOT manual recommended that, at 10 feet from the nearest rail, a crossing surface should be no more than 6 inches below the track level or 3 inches above the track level. An MDOT rail engineer told NTSB investigators that the office has relied on FHWA/AASHTO guidance since 2010, when he became an MDOT rail engineer. As of July 2018, MDOT was in the process of updating its grade crossing guidance to match the guidance of the FHWA and AASHTO.

NTSB Highway Accident Report 18 Figure 8. Photograph showing the northbound approach to the grade crossing (top)—what the driver would have seen—and cross-section diagram of the measured vertical profile of the approach’s slope (bottom). The blue line in the diagram represents the maximum elevation difference between the crossing and the approach as recommended by the FHWA and AASHTO, and the gray line represents the actual elevation difference at the grade crossing.

NTSB Highway Accident Report 19 Figure 9. Photograph showing the southbound approach to the grade crossing (top) and cross-section diagram of the measured vertical profile of the approach’s slope (bottom). The blue line in the diagram represents the maximum elevation difference between the crossing and the approach as recommended by the FHWA and AASHTO, and the gray line represents the actual elevation difference at the grade crossing. 1.5.5 Main Street Grade Crossing Maintenance and Incident History 1.5.5.1 Maintenance History. Although the exact date of the initial construction of the Main Street grade crossing is unavailable, City of Biloxi records indicate that the crossing has existed since at least 1870. It was most recently reconstructed in 1977. The reconstruction plans specified a 12.3-percent downgrade slope north of the tracks. At the time of this reconstruction, the American Railroad Engineering Association offered the only source of guidance on grade crossing design.35 35 In 1997, the American Railroad Engineering Association combined with two other engineering associations to form AREMA.

NTSB Highway Accident Report

20 Since the 1977 reconstruction, railroad maintenance has been performed in the area of the grade crossing. In February 2014, CSXT replaced wooden railroad ties along the section of track that included the Main Street crossing. Tie replacement typically results in raising the track by about 1.5 inches.36 MDOT was not informed of this planned maintenance or of the resulting increase in track elevation.37 It would have been standard practice for CSXT to inform the City of Biloxi of the 2014 track maintenance, because it would have affected the grade crossing’s availability for use by highway traffic. However, investigators found no evidence indicating that CSXT informed the city about the nature of the maintenance, specifically, that it would affect the crossing’s vertical profile.38 The City of Biloxi was unable to provide records of Main Street grade crossing maintenance before 2008 because any records of work done before that date were lost in a 2008 flood. CSXT told NTSB investigators that it did not have any Main Street grade crossing maintenance records before January 2012, when it replaced the steel tracks; this track replacement maintenance would not have affected the track elevation. The most recent precrash maintenance on Main Street in the vicinity of the grade crossing occurred in March 2016. This work included milling the pavement of Esters Boulevard north of the rail tracks and the adjacent segment of Main Street, as well as applying a temporary surface on the same sections of the roadway; the closest milling to the rail tracks was about 25 feet away. According to the road repair plans, the resurfacing was not expected to affect the elevation of the roadway surface. NTSB investigators examined the milled and resurfaced section of the road and determined that the transition between the existing asphalt surface and the milled asphalt was smooth; there was no noticeable drop-off between the two road areas. 1.5.5.2 Maintenance Responsibilities. NTSB investigators discussed the responsibilities for grade crossing maintenance with CSXT representatives, as well as with City of Biloxi officials. The CSXT personnel stated that they believed the City of Biloxi was responsible for maintaining the approach to the Main Street grade crossing. Although the City of Biloxi has responsibility for maintenance of local roads, including Main Street, city representatives stated that they believed that only CSXT could conduct maintenance in the immediate vicinity of the tracks and that the city had to seek approval from the railroad before performing any type of work in that area. Mississippi statutory authority grants MDOT a certain level of authority over public roadway/railroad crossings, including the following power: After having made proper investigation, and after notice and hearing, if requested, to abolish any public roadway/railroad crossing heretofore or hereafter established, to vacate and close that part of the roadway on such crossing abolished, and to erect

36 A CSXT engineer described to NTSB highway investigators the process of replacing wooden ties. He stated that tracks are initially elevated by about 2 inches, but that settlement and compaction reduce the elevation by about 0.5 inch. NTSB railroad investigators confirmed the accuracy of this statement. 37 NTSB investigators obtained this information during a conversation with an MDOT rail engineer. 38 The City of Biloxi reported that, as part of the maintenance conducted in February 2014, CSXT lowered the gates at the Main Street grade crossing and other crossings affected by the maintenance. The city publicized the grade crossing closure on its traffic notifications website.

NTSB Highway Accident Report

21 barricades across the roadway in such a manner as to prevent the use of such crossing as a roadway (Miss. Code. Ann. § 65-1-175 [2013]). Additionally, MDOT can require the installation of warning and flashing signs at grade crossings and prescribe a portion of the cost of the installation and maintenance of such signage to railroad carriers and local highway authorities. Further, MDOT’s approval is required for the construction of new, or reconstruction of existing, grade crossings. 1.5.5.3 Crashes and Incidents. According to the grade crossing accident reports provided by the FRA, 18 collisions involving train impacts took place on the Main Street grade crossing between November 1976 and March 2017. Eleven of those collisions involved a train striking a car (or similar noncommercial vehicle), six involved a train striking a commercial vehicle, and one involved a train striking a pedestrian. In addition to the subject (motorcoach) crash, two collisions in this period had fatal outcomes; both involved a car (or similar noncommercial vehicle). Since the February 2014 track maintenance that raised the track elevation, two more crashes, in addition to the subject crash, involved a vehicle—a commercial vehicle in both cases—that was stalled or grounded on the Main Street crossing.39 The last crash before this maintenance occurred in 2003. NTSB investigators examined the CSXT incident tickets, the documented instances of vehicle groundings on the Main Street grade crossing, and the records from various City of Biloxi departments concerning the crossing. These records showed numerous incidents involving a vehicle becoming grounded on the crossing. In addition to the 3 vehicle groundings that resulted in a crash, in the 5-year period before the subject crash, 24 other incidents occurred in which a vehicle was reported as grounded on the crossing; 20 of these incidents involved a truck-tractor combination vehicle.40 In each of the 24 cases, either the vehicle was dislodged before a train approached the crossing or the CSXT train crew was notified early enough to safely decelerate and stop the train before reaching the crossing. Twenty-four of the 27 grounding incidents (including the one resulting in the subject crash) that took place at the crossing in the 5-year period occurred after February 2014, when the last CSXT track maintenance raised the elevation of the railroad tracks. In most of these 27 grounding incidents, both the BPD and CSXT were notified.41 CSXT had records for 25 of these incidents; the City of Biloxi had records for 22. 1.5.6 Other Grade Crossings in Biloxi Biloxi contains about 8.6 miles of railroad track, and 29 grade crossings are within the city limits. Twenty-two of the crossings are in southeastern Biloxi, along 2.6 miles of railroad track. NTSB investigators measured the slopes of all 29 grade crossings in Biloxi and found that all have

39 One of the crashes occurred on August 28, 2014; it involved a truck-tractor combination vehicle and resulted in injury to one railroad employee. The second crash occurred on January 5, 2017; it involved a single-unit truck and resulted in injury to two railroad employees. 40 The other four incidents involved a motorcoach, a truck with an attached horse trailer, an unspecified truck, and an unspecified vehicle. 41 The City of Biloxi Engineering Department had records for only a few of the incidents that the BPD recorded.

NTSB Highway Accident Report

22 a vertical slope (on either the northbound or the southbound approach) greater than the maximum recommended by the FHWA/AASHTO for new and reconstructed grade crossings.42 According to FRA grade crossing accident reports, 190 collisions occurred on grade crossings in Biloxi between June 1975 and March 2017; of these, 172 occurred on crossings other than the Main Street crossing.43 NTSB investigators also examined CSXT incident tickets that recorded vehicle groundings on a grade crossing that did not result in a collision with a train. Between March 2012 and the March 7, 2017, crash date, 15 incidents of vehicle grounding took place on grade crossings in Biloxi other than the Main Street crossing. When the March 7, 2017, crash occurred, both the BFD and the Biloxi Public School District had restrictions on their vehicles’ use of certain grade crossings in the city. One particular BFD vehicle was allowed to use only 3 of the 29 grade crossings in Biloxi; it was prohibited from using the Main Street grade crossing. Additionally, the district’s school buses were prohibited from using two of the other grade crossings in Biloxi.44 1.5.7 Postcrash Actions On March 10, 2017, the City of Biloxi placed three selective exclusion signs bearing the No Trucks icon, in combination with “NO BUSES TRUCKS RVs” plaques, near the Main Street crossing. Two of the exclusion signs were placed on northbound Main Street, 234 feet and 25 feet from the rail tracks, respectively. The third exclusion sign was placed on southbound Main Street, 104 feet from the tracks. (See figure 10 for a view of the new No Trucks icon sign and exclusion plaque located nearest the tracks on the northbound approach to the crossing.) Also, on March 13, the city installed two more LGCGC warning signs, accompanied by “LOW GROUND CLEARANCE” plaques, at the crossing. One was put on the southwest corner of the crossing, 25 feet from the tracks and facing northbound traffic; the other sign was put on the northeast corner, 12 feet from the tracks and facing southbound traffic.

42 (a) The measurements were conducted in the same manner as the measurement for the Main Street grade crossing, as described earlier in this report. (b) MDOT also measured the slopes of these grade crossings at 30 feet from the nearest rail and found them to be outside the FHWA/AASHTO-recommended guidance. Due to differences in the accuracy of the surveying equipment (NTSB investigators used an advanced system), there are slight differences in the recorded slope measurements between MDOT and NTSB calculations. 43 Five collisions occurred while a vehicle was grounded on a grade crossing. 44 (a) According to a BFD directive from 1999, the department’s aerial apparatus vehicle, Aerial-1, was allowed to use only the Oak Street, Caillavet Street, and Reynoir Street grade crossings. (b) Biloxi Public School District school buses were prohibited from using the Querens Avenue and Benachi Avenue grade crossings. After the March 2017 crash, the district added another five grade crossings, including the Main Street crossing, to its list of prohibited crossings.

NTSB Highway Accident Report 23 Figure 10. Postcrash view of the northbound approach to the Main Street crossing, showing the new vehicle exclusion sign and plaque (circled in yellow) posted by the City of Biloxi after the crash. As a result of this crash, the MDOT Rails Division initiated a safety program in April 2017. As part of this program, MDOT met with local municipalities along the 74 miles of CSXT track in Mississippi and identified all grade crossings with vertical profiles exceeding the slope limits recommended in the FHWA/AASHTO design guidance. MDOT offered the local municipalities free access to LGCGC warning signs and accompanying “LOW GROUND CLEARANCE” plaques for installation at those crossings not meeting the design guidelines. As of July 2018, of the 12 entities eligible to receive the signs, 6 had requested them. According to CSXT incident tickets, only one vehicle grounding occurred on the Main Street crossing in the year following the March 2017 crash.45 The City of Biloxi has requested funding from the Gulf Regional Planning Commission to conduct a route planning study for commercial vehicle traffic for the city. The study is designed to identify the optimal routes for commercial vehicle movement through Biloxi, including identifying grade crossings involved in the routing. When the study is complete, the City of Biloxi intends to publicize the commercial vehicle route (or routes) through the installation of advisory signage throughout the city. The city also intends to work with navigational device makers and geospatial mapping developers to electronically disseminate the commercial vehicle routing information for Biloxi. 45 (a) CSXT dispatch received a call about a vehicle—a car—on the tracks; the car had cleared the crossing by the time that CSXT staff arrived. It is unclear whether the vehicle had been grounded or stalled on the tracks. (b) The NTSB received incident reports from CSXT for March 8, 2017, to April 6, 2018.

NTSB Highway Accident Report

24 1.5.8 National Grade Crossing Inventory In 1975, the FRA, in cooperation with the FHWA, National Highway Traffic Safety Administration (NHTSA), Association of American Railroads, and American Short Line and Regional Railroad Association, established a national grade crossing inventory. The inventory contains current and historical records on grade crossings, including the crash history for each listed crossing and whether an LGCGC warning sign is posted at the crossing. The FRA maintains the inventory and updates it with information provided by state departments of transportation (DOT) and railroad companies when they complete the grade crossing inventory form (FRA form 6180.71).46 States and railroad companies are required to complete different sections of the inventory form. State DOTs are responsible for completing information about grade crossing warning devices and signage. The Rail Safety Improvement Act of 2008 (49 United States Code [USC] Section 20160), which had an enforcement date of August 9, 2016, directs that state DOTs shall report to the Secretary of Transportation “current information, including information about warning devices and signage, as specified by the Secretary, concerning each previously unreported public crossing located within its borders.” The act further directs that states shall provide this information within 6 months of opening for a new crossing and once a year for all grade crossings. The railroad companies are responsible for providing details of railroad operations, such as types of trains, speed limits, track characteristics, and types of train detection equipment. To be considered a high-profile grade crossing in the FRA national inventory, (1) the crossing must be posted with an LGCGC warning sign, and (2) the presence of the sign must be recorded on FRA form 6180.71. NTSB investigators obtained grade crossing inventory information for a 5-year period before the Biloxi crash. Table 3 shows the percentages of high-profile grade crossings in the nation and the numbers of crashes that have occurred on those crossings. There has been a large increase in the number of high-profile crossings reported in the national inventory since 2015. The number of reported crossings increased by 113 percent in 2016, and by an additional 216 percent in the first 3 months of 2017. This increase most likely is due to improved recording of the presence of LGCGC warning signs on the grade crossing inventory form—as required by the Rail Safety Improvement Act—rather than from a sudden surge in the installation of the signs. According to FRA personnel, the number of reported high-profile crossings is expected to rise until August 2019, because all previously reported grade crossings are required to update within 3 years of the act’s enforcement date.

46 For a description of the reporting responsibilities concerning grade crossings for state DOTs and railroad companies, see Federal Railroad Administration Guide for Preparing U.S. DOT Crossing Inventory Forms, accessed March 16, 2018.

NTSB Highway Accident Report

25 Table 3. National summary of high-profile grade crossings and crash information. (2017 data are preliminary) Year Total Crossings High-Profile Crossings Percent of High-Profile Crossings Crashes at All Crossings Crashes at High-Profile Crossings (total and percent) 2012 129,661 1,582 1.2% 1,694 35 (2.1%) 2013 130,308 1,618 1.2% 1,756 33 (1.9%) 2014 130,345 1,587 1.2% 1,942 51 (2.6%) 2015 130,971 1,595 1.2% 1,767 44 (2.5%) 2016 131,462 3,400 2.6% 1,724 57 (3.3%) 2017a 131,775 10,740 8.2% 449 45 (10.0%) a Includes data from January 1 through March 31, 2017.

All of the 31 grade crossings that NTSB investigators examined in the Biloxi and Gulfport area exceeded the vertical profile guidance provided by the FHWA and AASHTO, yet, at the time of the crash, only 4 of these 31 crossings were marked with LGCGC warning signs.47 Only one of these four grade crossings appeared in the FRA inventory as a high-profile crossing (this crossing appeared in the inventory accompanied by a check mark indicating that an LGCGC warning sign was present). Neither the Main Street crossing nor the other two crossings posted with LGCGC signs appeared as high-profile crossings in the FRA inventory database. According to MDOT, it has been updating its sections of the crossing inventory forms for all Mississippi grade crossings. MDOT plans to update the state’s grade crossing inventory yearly, during annual railroad track inspections. MDOT is also developing a mobile application to assist rail inspectors in gathering and logging the inventory-related information. 1.6 Railroad Operations 1.6.1 Train Operation The train consisted of 2 locomotives, 27 cars loaded with mixed freight (19 of which carried hazardous materials), and 25 empty cars. The train was 3,164 feet long, and it weighed 3,990 tons. It was equipped with two-way telemetry and a trip optimizer.48 The lead locomotive was equipped with the required headlight, auxiliary lights, and horn warning device; it was additionally instrumented for positive train control, a forward-facing digital video recorder, a locomotive event

47 Investigators examined all 29 grade crossings in Biloxi and 2 in Gulfport. All four grade crossings with an LGCGC warning sign were in Biloxi. 48 (a) Telemetry is the combination of a head-of-train device on the controlling locomotive and an end-of-train device on the train’s rear car that can communicate train-related information to and from the controlling locomotive. (b) A trip optimizer is an intelligent, fuel-saving cruise control system for a locomotive that optimizes fuel consumption.

NTSB Highway Accident Report

26 data recorder, and an alerter.49 Postcrash, an FRA inspector tested the devices on the locomotive and found them operational. 1.6.2 Rail Operation This crash occurred in the CSXT New Orleans & Mobile (NO&M) Subdivision, Atlanta Division. Train movements on the NO&M Subdivision are governed by operating rules, timetable instructions, and signal indications from the traffic control system. Two control points—signal stations that are remotely controlled by a train dispatcher—are near the Main Street grade crossing; the South End Ocean Springs control point is east of the crossing, and the North End Beauvoir control point is west of it. The track configuration in Biloxi consists of a single main track. The maximum authorized train speed on the CSXT NO&M Subdivision is 60 mph for freight trains, with permanent speed restrictions between posted timetable mileposts. The maximum authorized train speed over the Main Street grade crossing is 45 mph. The segment of track preceding the crash location (west to east) is straight for 1 mile before the crossing and for 1,584 feet after the crossing. There is a 0.26-percent descending grade in the train’s direction of travel. No buildings or vegetation obstructed the view for the train crew or the motorcoach driver. NTSB investigators examined the CSXT track inspection records for the previous 3 months and determined that the railroad had completed the required twice-weekly inspections of the tracks and had found no exceptions to the FRA standards.50 The warning system at the Main Street crossing was controlled by a Safetran Grade Crossing Predictor, a monitoring and recording system.51 Data extracted from the recording unit showed that the system detected the train and initiated a warning sequence. As part of this sequence, the system activated the crossing warning bells and flashing lights when the train, at its current speed, was 29 seconds from the crossing; 3 seconds later, the crossing gate arm for the roadway began to descend to a horizontal position.52 Title 49 CFR 234.5 requires a grade crossing warning system to activate at least 20 seconds before the arrival of a train. After the crash, NTSB investigators, with FRA investigators and CSXT staff, conducted operational tests of the warning system, and examined documents, photographs, and data. They found no evidence of problems with the grade crossing warning system.

49 (a) According to 49 USC 20157(i)(3), positive train control is a system designed to prevent train-to-train collisions, over-speed derailments, incursions into established work zone limits, and movement of a train through a switch left in the wrong position. (b) Title 49 CFR Part 229 defines an alerter as a device or system installed in the locomotive cab to promote continuous, active locomotive engineer attentiveness by monitoring certain engineer-induced control activities. 50 The section of the tracks where the crash occurred was considered class 4 track and was maintained to that standard. Class 4 tracks must be inspected at least twice weekly, with at least 1 calendar day between inspections. 51 The Safetran Grade Crossing Predictor model 3000ND2 continually monitors the track approach to railroad grade crossings, computes the arrival time of a detected train, and activates the crossing-protection equipment at a predetermined time before the train’s predicted arrival. 52 Although the time it took for the gate arm to reach the fully horizontal position was not recorded, this movement is typically completed in 10–12 seconds.

NTSB Highway Accident Report

27 1.6.3 Train Crew 1.6.3.1 Experience and History. The train engineer was a 47-year-old male who has been employed in this position by CSXT since 2004. He reported that he was in good health, had good vision and hearing, and was not regularly taking any medications. No postcrash toxicological testing was conducted, because the circumstance of this crash did not meet the requirements of US Department of Transportation (USDOT) regulations (49 CFR 219.201[b]) concerning such testing.53 Cell phone records indicated that the engineer did not use his cell phone during the train’s operation. He reported making about three roundtrips each week along the section of the track where the crash occurred. Based on the engineer’s postcrash interview statements, his work schedule, and his cell phone records, in the 3 nights preceding the crash, he had obtained about 11.5 hours, 5.0 hours, and 8.5 hours (night before the crash) of sleep, respectively. The train conductor was a 37-year-old male who had been hired by CSXT in 2008; he was certified as both a conductor and an engineer. He told investigators that he was in good health, had good vision and hearing, and was not regularly taking any medications. He reported that he usually worked with the same engineer and that he regularly operated on the section of the track where the crash occurred. Cell phone records indicated that the conductor did not use his cell phone during the train’s operation. 1.6.3.2 Crash Trip and Sight Distance Observations. During a postcrash interview, the engineer stated that he had clear signals as he approached the Main Street grade crossing, and he estimated the train speed as 28 mph.54 He said that he monitored up to three crossings ahead but focused his attention on the nearest crossing. He reported that he did not see the motorcoach enter the Main Street grade crossing but first saw it on the railroad tracks about 15 seconds before he activated the train’s emergency brake. He said that he did not immediately react to the motorcoach because he frequently encounters vehicles on grade crossings, and he expected the motorcoach to clear the tracks. The engineer reported putting his hand on the emergency brake moments later. He and the conductor both reported discussing the motorcoach’s presence on the crossing and whether it was going to move off it in time.55 The engineer also stated that he did not want to apply the brakes unnecessarily because he was concerned about the hazardous materials on the train and the potential for a hazardous materials spill in a populated area in case of train derailment. The engineer said that, although he expected the motorcoach to move off the tracks, he told the conductor that he intended to apply the emergency brakes and then did so. Even then, he believed that the motorcoach would clear the crossing.

53 For conditions that require train crews to undergo postcrash toxicological testing, see 49 CFR 219.201. 54 Earlier in the trip, as instructed by a CSXT dispatcher, the engineer had stopped the train due to a report of a vehicle being stuck on a grade crossing about 16 miles west of the Main Street crossing. When the engineer began moving the train, he decided to maintain the lower speed—the speed limit was 45 mph—due to upcoming speed restrictions on a drawbridge about 2 miles east of the Main Street crossing. 55 They told investigators that they saw no indication that the motorcoach was “in distress.”

NTSB Highway Accident Report

28 The engineer reported that, on this section of the railroad, because of the streets that run parallel to the tracks, he encounters vehicles on the tracks on a daily basis. He described these vehicles as waiting on the tracks for traffic to clear. The engineer also reported that, earlier on this same trip, CSXT dispatch had instructed him to stop his train due to a vehicle being stopped on a (different) grade crossing about 16 miles ahead. The conductor estimated that about once a week they heard about or were involved in a situation in which CSXT dispatch instructed a train crew to stop its train due to a possible vehicle on a grade crossing. NTSB investigators conducted sight distance observations to determine the approximate distance at which the train crew could have perceived the motorcoach on the Main Street grade crossing. Because an exemplar motorcoach would be at risk of grounding, investigators instead placed a truck on the tracks, which, because of its higher ground clearance, could more safely represent the crash motorcoach. Then, an exemplar CSXT locomotive, moving about 10–15 mph and operated by an experienced engineer, approached the crossing from the west. The engineer reported being able to perceive the truck at 3,850 feet from the Main Street grade crossing. 1.6.4 Recorders NTSB investigators examined data from the locomotive event data recorder, the digital video recorded by the forward-facing locomotive camera, and the signal stations to determine the actions of the train engineer, the visibility conditions, the timing of the crash, and the timing of the grade crossing warning system activation. Table 4 shows the sequence of the crash events involving these factors.

NTSB Highway Accident Report

29 Table 4. Sequence of events near Main Street grade crossing on March 7, 2017, concerning the train’s movement, the motorcoach’s grounding, and the crash. Time (p.m.) Event Source 2:05:45 – 2:11:28 Speed of the train varies between 27 mph and 29 mph Train event data recorder 2:09:26 – crash Horn activates nearly continuously (with one 2-second break) Train event data recorder ~2:11 Motorcoach arrives on the crossing Driver’s GPS 2:11:14 Warning bells and flashing lights at the crossing activate Warning system recorder 2:11:15 Object is visible at the Main Street crossing Forward-facing locomotive cameraa 2:11:17 Gate arms start to lower Warning system recorder 2:11:21 Object at the Main Street crossing is identifiable as a motorcoach Forward-facing locomotive camera 2:11:28 – crash Motorcoach at the Main Street grade crossing appears stationary Forward-facing locomotive camera 2:11:29 Engineer engages emergency brake (502 feet west of the crossing) Train event data recorder 2:11:43 Crash Forward-facing locomotive camera Train speed is 19 mph at impact Train event data recorder 2:12:00 Train comes to a complete stop, 259 feet east of the crossing Forward-facing locomotive camera a NTSB investigators and party representatives derived the description of the video from the forward-facing locomotive camera, after a frame-by-frame viewing of the recording. See the Onboard Image Recorder (Train) report in the NTSB public docket for this investigation (HWY17MH010) for additional descriptive information on the recording from the locomotive camera. 1.7 Motor Carrier Operations ECHO Tours and Charters, doing business as ECHO Transportation, is domiciled in Dallas, Texas, and began operating as an interstate carrier in 2011. At the time of the crash, the carrier operated 109 vehicles and employed 169 drivers. The carrier’s primary terminal is in Dallas—the motorcoach driver’s home terminal—and it has satellite operations in four other Texas locations. For-hire charter operations represent the largest part of ECHO Transportation’s business. 1.7.1 Carrier Training Program ECHO Transportation employs a safety manager who, with other staff, implements and oversees the carrier’s safety and training programs. According to carrier documentation, all ECHO Transportation drivers receive new driver training, new driver onboard training, continual performance monitoring, and defensive driving training. The new driver training program consists of 9 days of classroom and on-the-road training. Continual performance monitoring is conducted

NTSB Highway Accident Report

30 using Lytx DriveCam. The safety manager monitors DriveCam events and provides coaching to drivers if a recorded event is determined to have presented a safety risk; some recorded events may result in disciplinary action. All drivers also complete defensive driving training every 6 months. The carrier provided NTSB investigators with several written policies, including those addressing seat belt and cell phone use, as well as a policy on proper procedures for transiting railroad crossings. The railroad crossing policy included a step-by-step guide outlining the Federal Motor Carrier Safety Administration (FMCSA) requirements for speed, safe following distance, and operating in adverse weather while traversing grade crossings. The carrier’s policy did not include any guidance pertaining to LGCGC warning signs. 1.7.2 State and Federal Oversight Although the Texas Department of Public Safety (TxDPS) Commercial Vehicle Enforcement Service has authority over intrastate motor carriers, it does not inspect interstate carriers like ECHO Transportation. As such, TxDPS Commercial Vehicle Enforcement did not perform any compliance reviews of ECHO Transportation, but it did conduct regular roadside inspections of the carrier’s vehicles, including three inspections of the motorcoach involved in this crash. None of the three inspections, the most recent of which occurred on January 24, 2017, resulted in violations. The FMCSA conducted two compliance reviews of ECHO Transportation, in April 2012 and September 2014; both resulted in “satisfactory” ratings. The Motor Carrier Management Information System showed that ECHO Transportation had no Behavior Analysis and Safety Improvement Categories (BASICs) in alert status at the time of the crash.56 The records indicated that the carrier had two reportable crashes before the Biloxi grade crossing crash, but neither involved the crash driver.57 As a result of the Biloxi crash, the FMCSA initiated a compliance review of the motor carrier on April 5, 2017. This review identified two noncritical safety violations and resulted in a “satisfactory” rating.58 1.7.3 Driver Grade Crossing Guidance In the Manual on Uniform Traffic Control Devices for Streets and Highways (MUTCD), the FHWA provides guidance on the LGCGC warning sign at grade crossings; however, this guidance is intended for traffic engineers and describes the roadway conditions under which LGCGC signs should be installed. The MUTCD provides no guidance to drivers on such signage (FHWA 2009). Neither the Texas nor the Mississippi commercial motor vehicle drivers’ handbook/manual mentions the LGCGC warning sign (TxDPS 2014 and MDOT 2012). No guidance from the FMCSA or the American Association of Motor Vehicle Administrators (AAMVA) addresses the LGCGC warning sign at grade crossings. These organizations do issue warnings about the dangers of becoming grounded on a grade crossing, and they highlight the risk

56 The FMCSA uses data from roadside inspectionsincluding all safety-based violations, state-reported crashes, and the Federal Motor Carrier Censusto quantify a carrier’s performance in seven BASICs. These BASIC categories are (1) unsafe driving, (2) hours-of-service compliance, (3) driver fitness, (4) controlled substances and alcohol, (5) vehicle maintenance, (6) hazardous materials compliance (if applicable), and (7) crash indicator. A carrier’s rating for each BASIC depends on its number of adverse safety events, the severity of its violations or crashes, and when the adverse safety events occurred (more recent events are weighted more heavily). 57 Neither of the drivers involved in the other two reportable crashes was issued a citation. 58 The two noncritical safety violations were (1) using a driver who has not completed and furnished an employment application and (2) false or inaccurate record-of-duty status report.

NTSB Highway Accident Report

31 of grounding for vehicles with low trailers. For example, AAMVA guidance to commercial drivers (AAMVA 2016, 2-28 to 2-30) states that— Hanging up on a railroad crossing is a dangerous predicament, and is becoming too common as more very low trailers are manufactured. Lowboy trailers, car carriers, moving vans, and possum­belly livestock trailers are particularly susceptible, as are single-axle tractors pulling a long trailer with landing gear which is set to accommodate a tandem-axle tractor. Motorcoaches are not discussed as types of vehicles susceptible to grounding on high-profile grade crossings in any of the guidance material for commercial drivers examined by NTSB investigators. 1.8 Motorcoach Driver 1.8.1 Licensing, Experience, and Driving History The motorcoach driver was a 60-year-old male who obtained his first commercial driver’s license (CDL) in June 2006, when he operated school buses for the Fort Worth Independent School District. In February 2013, he was employed by Gotta Go Trailways, which was later purchased by ECHO Transportation. At the time of the crash, the driver held a Texas class B CDL with passenger and school bus endorsements; the license had no restrictions. The motorcoach driver completed Gotta Go Trailways new-hire training in March 2013. He also completed a recertification class in December 2015, took a driver training class in January 2017, and attended three company safety meetings.59 Between November 2015 and March 2017, the driver had 34 DriveCam events, 27 of which resulted in coaching sessions; none of these events incurred suspension.60 NTSB investigators examined multiple sources to obtain the motorcoach driver’s history of traffic violations, including CDL information systems, Texas Department of Motor Vehicle records, and driver qualification files from previous employers. The records showed that the driver had two speeding violations in personal vehicles since 2015 and a non-USDOT-reportable accident in August 2015.61 Additionally, the driver underwent two roadside safety inspections, one in July 2016 in Peach Springs, Arizona, and the other following the Biloxi crash. Although both inspections resulted in safety violations for the driver, none were considered out-of-service violations. The driver received no citations in connection with this crash.

59 (a) The driver completed a recertification class due to an employment termination in January 2015 that resulted from a non-driving-related incident. The carrier investigated the circumstances of the incident and offered to rehire the driver in September 2015. The recertification class is a shorter version of new-hire training. (b) The topics of company safety meetings vary depending on the current need and may include subjects such as winter driving, hours of service, or customer service. 60 Most of the coaching sessions resulted from DriveCam events showing the driver allowing traffic to shorten his following distance. This driver’s overall number of coaching sessions was similar to those provided to other drivers at the carrier. 61 This event occurred while the driver was operating a commercial vehicle; he made a sharp turn and slightly contacted the fender of a parked vehicle. Because the crash did not result in towing of either vehicle or injuries, it was not required to be reported to the USDOT. The driver’s employer provided the record of this crash.

NTSB Highway Accident Report

32 1.8.2 Medical Certification, Health, and Toxicology The motorcoach driver obtained his most recent precrash CDL medical certificate in January 2017; it was valid for 2 years. On the medical examination report form, the driver indicated that he had not taken any medications in the past 5 years, and he did not report any injuries or medical conditions that could affect his ability to operate a vehicle safely. The results of the examination, which included visual acuity and urinalysis, were within normal limits. NTSB investigators also obtained medical records from the motorcoach driver’s primary care physician. These records did not indicate any significant chronic medical conditions. The driver submitted to a USDOT preemployment drug test before beginning work for ECHO Transportation; the results of the test were negative. The carrier’s records indicated that the driver had not been selected for random drug testing since employment. Postcrash, the carrier requested that the hospital where the driver was taken perform toxicology testing as required by USDOT regulation. The breath test analysis performed at 4:35 p.m.—about 2 hours 20 minutes after the crash—was negative for alcohol. The testing of the driver’s urine, which was collected at 5:10 p.m.—about 3 hours after the crash—was negative for other drugs.62 At the request of NTSB investigators, the Federal Aviation Administration (FAA) Bioaeronautical Sciences Research Laboratory performed additional testing on the driver’s blood sample. It was negative for alcohol and other drugs, including the prescription medications that NTSB investigators found in the motorcoach after the crash.63 1.8.3 Precrash Activities NTSB investigators used information obtained from cell phone records, interviews with the motorcoach driver and passengers, the charter tour plan, and hotel records to reconstruct the driver’s activities in the days before the crash. The motorcoach driver reported obtaining good quality sleep and not taking any sleeping medications. He stated that he typically works during the day and sleeps at night and that he goes to sleep before 10:00 p.m. when working the next day. The driver said that for the 3 nights before the crash, he obtained about 7.5–9.5 hours of sleep each night. On March 5, after having slept for about 9.5 hours, he began driving at 6:45 a.m., when he picked up passengers in Bastrop, Texas; he arrived in Lafayette, Louisiana, about 4:45 p.m. that day. On the following morning of March 6, after obtaining about 7.5 hours of sleep, the driver began driving at 9:00 a.m.; the motorcoach arrived at Hollywood Casino in Bay St. Louis, Mississippi, at 1:30 p.m. On March 7, the day of the crash, after having had a 9-hour opportunity for sleep, the motorcoach driver picked up the passengers from the casino hotel about 1:00 p.m. and began the

62 The tests provide evidence of use of the following 11 substances: amphetamine, methamphetamine, MDMA, MDA, MDEA, tetrahydrocannabinol (the active compound in marijuana), cocaine, codeine, morphine, heroin, and phencyclidine. 63 (a) The laboratory conducted analyses to detect amphetamines, opiates, marijuana, cocaine, PCP, benzodiazepines, barbiturates, antidepressants, antihistamines, and commonly used prescription and over-the-counter drugs. For a comprehensive list of the drugs tested for, see the FAA WebDrugs website, accessed April 13, 2018. (b) NTSB investigators found several prescription medication bottles in the driver’s name in the motorcoach, including vitamin D, etodolac, amoxicillin, ibuprofen, cyclobenzaprine, and meloxicam. These medications were prescribed to be taken as needed.

NTSB Highway Accident Report 33 trip to Boomtown Casino in Biloxi. When the crash occurred, the driver had been on duty and driving for less than 2 hours. Figure 11 shows the driver’s activities for the 3 days before the crash. Figure 11. Activities of the motorcoach driver, March 4–7, 2017. (Driver’s activity on March 4 before 2:00 p.m. is unknown.) 1.8.4 Route Selection When the motorcoach driver left Hollywood Casino in Bay St. Louis on the day of the crash, his vehicle was one of three charter motorcoaches—organized by Diamond Tours—each operated by a different motor carrier. Although the three motorcoaches left locations at different times and traveled separately, because they were all part of the Diamond Tours charter, they all followed the same itinerary. For this part of the charter tour, the established itinerary included directions from Hollywood Casino to Boomtown Casino in Biloxi, which instructed drivers to take Interstate 10, a route that would not have included traversing the grade crossing on Main Street in Biloxi. Before the three motorcoaches departed Bay St. Louis on March 7, the Diamond Tours manager sent a text message to the driver and group leader of each motorcoach, suggesting that they take an alternative, optional, scenic route along US-90; the message included directions and instructions for this optional route.64 The new directions instructed the drivers to exit on Caillavet Street in Biloxi, resulting in a route that did not include traversing the grade crossing on Main Street.65 The crash motorcoach driver, who was operating the ECHO Transportation motorcoach, was not sent these instructions from Diamond Tours; instead, the text message was mistakenly sent twice to the group leader for that motorcoach. The group leader for the ECHO Transportation motorcoach later told investigators that she did not receive the text message. On the morning of March 7, during breakfast at the Hollywood Casino hotel, some of the passengers and the group leader from the ECHO Transportation motorcoach learned about the 64 One passenger on each of the three motorcoaches in the tour was designated as the group leader for that motorcoach. The group leader served as a contact point with Diamond Tours. 65 Like Main Street, Caillavet Street runs north–south in Biloxi. It is located about 0.4 mile west of Main Street. Although Caillavet Street crosses the railroad tracks, the crossing has a considerably lesser slope than the Main Street crossing.

NTSB Highway Accident Report 34 scenic route from passengers from the other two tour motorcoaches comprising the Diamond Tours charter. At the start of the trip from Bay St. Louis, the ECHO Transportation motorcoach driver inputted the address of the Biloxi Boomtown Casino into his GPS device and programmed the device for commercial vehicle operation. Soon after the ECHO Transportation motorcoach left Bay St. Louis, its group leader asked the driver if they could take a scenic route along US-90 to travel to the Boomtown Casino. In response, the driver began driving toward US-90. At that time, his GPS device recalculated its navigational instructions, which now directed the driver to Main Street in Biloxi and across the grade crossing. This GPS-provided scenic route, which the crash driver followed, was different both from the route included in the original Diamond Tours itinerary and from the optional scenic route with specific directions suggested by the Diamond Tours manager in her text message sent on the morning of the crash. (See figure 12 for a map showing the three routes from Bay St. Louis to Biloxi discussed above.) Figure 12. Three alternative routes proposed for the motorcoach to travel from Hollywood Casino in Bay St. Louis to Boomtown Casino in Biloxi. The route in blue is the original planned route from the Diamond Tours itinerary; the route in yellow is the optional scenic route proposed by the Diamond Tours manager on the morning of the crash trip; and the route in red is the one indicated by the motorcoach driver’s personal GPS device. The route in red is the crash route. 1.8.5 Driver’s Actions at Crossing and Postcrash Sight Distance Observations 1.8.5.1 Motorcoach Driver’s Actions. During a postcrash interview, the motorcoach driver stated that, as he approached the Main Street grade crossing, he noticed the LGCGC warning sign; he described it as depicting a truck with a lowboy trailer. The driver said that, as he approached the tracks, he stopped at the stop line, turned on his hazard flashers, raised the rear of the motorcoach, and looked down the tracks in both directions.66 He stated that the grade crossing 66 The driver said that, because of the incline, he decided to raise the rear of the motorcoach to avoid scraping the rear bumper when crossing. As was noted earlier, this motorcoach had a rear-lift system that allowed the driver to raise the height of the rear suspension air springs, elevating the rear of the motorcoach by 4 inches.

NTSB Highway Accident Report

35 warning lights were not flashing and, because he did not see a train, he began to drive across the tracks. The driver reported that he became aware of the steepness of the north side of the grade crossing only after the vehicle had crested the crossing. By that time, the motorcoach had become grounded on the crossing. The driver stated that he attempted to free the motorcoach from the crossing by pulling forward and reversing, but he was not successful. He reported that the passengers then told him that a train was coming, at which point, he opened the loading door and told the group leader that everyone should evacuate the motorcoach. 1.8.5.2 Postcrash Sight Distance Observations. NTSB investigators conducted sight distance observations to assess the motorcoach driver’s description of his actions at the crossing. Driving an exemplar motorcoach, an experienced CDL driver approached the Main Street grade crossing from the south, replicating the crash motorcoach’s northbound path. Moving his vehicle very slowly, the exemplar driver reported his observations about the steepness of the crossing on the north side of the tracks. The exemplar driver said that, while stopped at the stop line, he could not perceive the degree of the slope north of the rail tracks. He reported that, until he had moved the exemplar motorcoach beyond the stop line, it appeared to him that the grade crossing was safely traversable. The exemplar driver also stated that, while accelerating normally from the stop line, a motorcoach driver would find it difficult to perceive the steepness of the north slope in time to prevent the vehicle’s grounding on the crossing. 1.9 Weather and Roadway Conditions Data from the weather station at Keesler Air Force Base in Biloxi, about 2.5 miles from the crash site, indicated that, at 1:58 p.m. on March 7, 2017, the temperature was 72°F, and there was a south wind of 11.5 mph, no precipitation, and visibility of 10 miles. The crash occurred in daylight.

NTSB Highway Accident Report

36 2 Analysis 2.1 Introduction The crash sequence began when a motorcoach carrying passengers to a casino in Biloxi, Mississippi, attempted to travel across a highway‒railroad grade crossing on Main Street in Biloxi and became grounded on the tracks. Within the next minute, a CSXT train approaching the grade crossing from the west struck the motorcoach and pushed it about 259 feet eastward. Four motorcoach passengers died, and the driver and 37 passengers sustained minor-to-serious injuries. The analysis first examines the motorcoach driver’s decision-making that led him to deviate from the originally planned route and attempt to traverse the grade crossing, and then the train crew’s response to the grade crossing hazard and activation of the emergency braking system. The analysis also discusses the following safety issue areas: • High-profile grade crossings, specifically—  Signage and reconstruction guidelines.  Coordination of maintenance activities and monitoring of crossing safety risk. • Emergency egress and extrication. As a result of this investigation, the NTSB established that the following factors did not cause or contribute to the crash: • Motorcoach driver and train crew licensing and experience: The motorcoach driver held a CDL with appropriate endorsements and had more than 10 years of commercial driving experience. The train engineer and conductor each had appropriate certifications and more than 7 years of experience. • Cell phone distraction, fatigue, substance impairment, and medical conditions: Cell phone records gave no indication that the motorcoach driver or the train crewmembers were engaged in texting or cell phone conversation at the time of the crash. Based on interviews, cell phone records, and witness accounts, the investigation found no evidence of fatigue for the motorcoach driver or the train crew. Postcrash toxicology test results revealed no evidence that the motorcoach driver had used alcohol or other drugs before the crash. (Consistent with federal regulations, no toxicological tests were performed on the train crew.) Examination of the motorcoach driver’s available medical records showed no evidence of medical conditions that could have affected his ability to operate the vehicle. • Vehicle condition, railroad track condition, and rail signal system operation: NTSB investigators examined the motorcoach and found no preexisting mechanical conditions that would have contributed to the circumstances of the crash. The investigators also examined the railroad track and signal system and found them to have been functioning as designed at the time of the crash.

NTSB Highway Accident Report

37 • Weather: There was no precipitation at the time of the crash, the road surface was dry, and the visibility was adequate. • Emergency response: First responders provided appropriate and efficient emergency medical services, and they followed appropriate IC handover and communication protocols. Although responders had to cut the rear door from the motorcoach to expedite extrication of the passengers, medical evidence suggests that, in this case, the additional time required to remove the door did not affect the survival of any passengers (see section 2.4 for additional information). The NTSB therefore concludes that none of the following were causal or contributory factors in the crash: (1) motorcoach driver licensing or experience; (2) train engineer or conductor licensing or experience; (3) motorcoach driver cell phone distraction, substance impairment, or medical condition; (4) train engineer or conductor cell phone distraction; (5) mechanical condition of the motorcoach; (6) railroad track condition or signal system operation; or (7) weather. The NTSB further concludes that the emergency response to the crash was timely and effective. 2.2 Operator Actions 2.2.1 Motorcoach Driver Shortly after departing Bay St. Louis, at the suggestion of the onboard tour group leader and as a scenic alternative, the motorcoach driver deviated from the tour’s original planned route to the Boomtown Casino in Biloxi and instead traveled along US-90. The new route was navigated by the driver’s personal GPS, which he had preprogramed for commercial vehicle travel. This GPS-provided route included travel on Biloxi’s Main Street and over the grade crossing where the crash occurred. The manager of Diamond Tours had proposed a different scenic route for this segment of the charter tour, which did not include travel on Main Street or over this grade crossing; however, the motorcoach driver did not receive the text from Diamond Tours that provided the directions for this alternative route. The NTSB concludes that the motorcoach driver’s decisions to take a scenic route and to rely on a portable GPS device programmed for commercial vehicle navigation were reasonable. When interviewed by NTSB investigators, the motorcoach driver stated that he had noticed the LGCGC warning sign that preceded the Main Street grade crossing. In anticipation of a high slope, he raised the rear of the motorcoach to prevent the rear bumper from scraping the crossing. The driver also said that, by the time he could see the steepness of the slope on the north side of the railroad tracks, the motorcoach was already grounded. NTSB investigators confirmed the crash driver’s statement by conducting a postcrash test drive with an exemplar motorcoach driven by an experienced CDL driver. Based on his test drive at the crossing, the exemplar vehicle driver stated that, under normal acceleration, it would have been difficult to perceive the steepness of the north slope in time to prevent the motorcoach from grounding on the crossing. The NTSB concludes that, given that (1) the motorcoach driver most likely could not have perceived the steepness of the northern slope before beginning to traverse the crossing, (2) he took the precaution of raising the rear of the motorcoach to prevent scraping the crossing, and (3) no signage prohibited transiting the crossing in a commercial vehicle, the driver’s decision to travel over the Main Street grade crossing was reasonable.

NTSB Highway Accident Report

38 2.2.2 Train Crew When interviewed by NTSB investigators, the train engineer stated that he monitored up to three grade crossings ahead of his train but focused his attention on the nearest crossing. He reported not seeing the motorcoach enter the Main Street grade crossing but estimated that he first saw it on the tracks about 15 seconds before he applied the train’s emergency brake. At that time, the train was traveling 27–29 mph. After seeing the motorcoach and realizing that it might not move off the tracks before his train arrived at the crossing, the engineer placed his hand on the emergency brake, briefly discussed with the conductor the likelihood of the motorcoach clearing the crossing, and considered the risk of putting the train into emergency, which would include the potential for train derailment and a release of hazardous materials cargo in a populated area. He then activated the emergency brake. The engineer reported that, even then, he still expected the motorcoach to clear the crossing before a collision occurred. The data from the locomotive event data recorder showed that the engineer engaged the emergency brake about 14 seconds before the crash (when the train was about 502 feet west of the crossing). Using the clock time from the motorcoach driver’s personal GPS to establish when the motorcoach reached the Main Street crossing stop line (about 35 seconds before the crash), the NTSB estimated that the train would have been about 1,364 feet from the crossing at that time.67 The sight distance observations conducted by NTSB investigators showed that a vehicle on the Main Street grade crossing could be perceived by a train crew at that distance. However, at that location, a train crew could also see three other grade crossings that preceded the Main Street crossing.68 Train engineers are trained to monitor up to three grade crossings ahead but to focus on the nearest crossing. Engineers and conductors encounter vehicles crossing railroad tracks daily without collision and, based on that experience, they have a reasonable expectation that a vehicle will clear the crossing before their train reaches it. The NTSB concludes that, given the speed of the train, the brief period that the motorcoach spent grounded on the tracks before the crash, the numerous grade crossings in this area, and how frequently the train crew encountered vehicles on crossings that ultimately cleared them safely, the estimated time that the train engineer took to detect the motorcoach on the tracks was reasonable, and his response time before engaging emergency braking was acceptable. 2.3 High-Profile Grade Crossings 2.3.1 Signage and Reconstruction Guidelines 2.3.1.1 LGCGC Warning Signs. AASHTO and the FHWA both provide guidance for the design of new and reconstructed grade crossings, including providing the maximum recommended vertical profile, which is 3 inches above or below track level at 30 feet from the nearest rail. The vertical profile of the Main Street grade crossing was well beyond the maximum recommended

67 The train traveled 502 feet after the emergency brake was engaged, 14 seconds before the crash. At an average speed of 28 mph, the train would travel 862.4 feet in 21 seconds (35 – 14 = 21). Thus, the total distance the train traveled in the 35 seconds before the crash would have been about 1,364.4 feet (502 feet + 862.4 feet). 68 The three other grade crossings are on Magnolia Street, Delauney Street, and Lameuse Street, for a train traveling from west to east toward Main Street.

NTSB Highway Accident Report

39 guidance; at 30 feet north of the rail tracks, Main Street was 45.4 inches below the track level, corresponding to a 13.3-degree slope. The Main Street grade crossing was not unique in this respect; in an area spanning 2.6 miles in Biloxi, there were 22 grade crossings, all of which had vertical profiles beyond the recommended limit. Although a grade crossing that falls outside the recommended parameters for vertical profile can be termed a high-profile crossing, there is no single, comprehensive definition of a high-profile grade crossing. The FRA defines a high-profile grade crossing simply as one that is posted with an LGCGC warning sign that is also noted on the grade crossing inventory form; however, it is highway authorities (state or local) that decide whether to post such a sign, based on the subjective interpretation of a traffic engineer. Moreover, the guidance concerning countermeasures to address the safety risks posed by high-profile grade crossings is limited. Signage is a frequently used countermeasure, and one that was present at the Main Street grade crossing at the time of the crash. Ahead of the crossing, an LGCGC warning sign alerted road users of the crossing’s high vertical profile. The MUTCD provides broad guidance describing the conditions under which an LGCGC warning sign should be installed, as follows: “…if the highway conditions are sufficiently abrupt to create a hang-up situation for long wheelbase vehicles or for trailers with low ground clearance…” (FHWA 2009). The term “sufficiently abrupt” is vague and open to interpretation, which could result in inconsistent installation of warning signs. For example, at the time of the crash, the Lee Street grade crossing in Biloxi was posted with an LGCGC warning sign; however, three other grade crossings in Biloxi and two in the neighboring city of Gulfport with higher vertical profiles than the Lee Street crossing did not have LGCGC warning signs.69 LGCGC warning signs inform road users of a grade crossing’s steeper-than-normal slope. They do not specify the steepness of the slope, nor do they adequately inform road users about exactly what types of vehicles are at risk. At the time of the crash, four grade crossings in the Biloxi and Gulfport areas were posted with LGCGC warning signs. NTSB investigators examined the approach slopes at those crossings and found that the top grades ranged from -11.4 to -21.5 percent.70 These differences in the approach slopes are drastic, and the degree of discrepancy is not effectively conveyed by posting identical LGCGC warning signs at these various locations. The LGCGC warning sign at the Main Street crossing was accompanied by a “LOW GROUND CLEARANCE” plaque at the time of the crash, and, although the motorcoach driver took precautions in response to the warning signage, the vehicle still grounded on the crossing.71 The current design of an LGCGC warning sign does not convey what a driver should do in response to it. Even the driver of a truck with a lowboy trailer—as is pictured in the LGCGC

69 NTSB investigators measured the approach grades of all grade crossings in Biloxi (29 crossings) and Gulfport (2 crossings). In Biloxi, the higher slope on the Lee Street grade crossing measured 11.4 percent; the higher slopes on the Holley Street, Nixon Street, and Benachi Avenue crossings measured 13.7 percent, 17.6 percent, and 16.4 percent, respectively. The higher slope of two grade crossings in Gulfport—Walston Avenue and Gulf Avenue—measured 23.5 percent and 16 percent, respectively. 70 For comparison, according to the FHWA/AASHTO guidance, the maximum acceptable height difference of 3 inches at a distance of 30 feet from the tracks corresponds to a grade of 0.89 percent. 71 At the same time, when approaching the crossing, the GPS device sounded an auditory alert and its screen depicted the railroad tracks and showed an LGCGC warning in the upper right corner. If the warning were tapped, the device screen displayed a banner across its top that read “Risk of Grounding.”

NTSB Highway Accident Report

40 sign—would not know from the sign whether to take another route to avoid the crossing, to cross it slowly, to accelerate quickly over it, etc. Additionally, based on pertinent vehicle dimensions, such as length, ground clearance, and rear overhang, many types of vehicles are at risk of grounding on a high-profile crossing. For instance, motorcoaches, such as the one involved in the Biloxi crash, are at risk for grounding on high-profile grade crossings due the ratio of their length to ground clearance; yet neither AAMVA nor FMCSA guidance mentions motorcoaches as low ground clearance vehicles with a strong potential for grounding. Moreover, the guidance does not specifically discuss the meaning of, and appropriate responses to, LGCGC warning signs. NTSB investigators reviewed the available literature but had difficulty in finding evidence of the effectiveness of LGCGC warning signs, primarily due to their nonspecific purpose and measure of success. Between February 2014, when CSXT performed maintenance that raised the level of the tracks at the Main Street grade crossing, and the March 7, 2017, crash date, 23 incidents were reported of a vehicle grounding at the crossing, 2 of which resulted in collisions. Clearly, the LGCGC warning sign and “LOW GROUND CLEARANCE” plaque, which were present throughout this period, were not effective in preventing long wheelbase vehicles, vehicles with significant rear overhang, and those with low ground clearance from traversing this grade crossing. However, we cannot determine whether the grounding incidents might have been still more frequent had the LGCGC warning signage been absent. The NTSB concludes that, based on the high frequency of grounding incidents at the Main Street grade crossing, which was posted with LGCGC warning signage, and the lack of evidence of the safety benefits provided by LGCGC warning signs, the effectiveness of such signs in promoting safety at grade crossings may be negligible. 2.3.1.2 Grade Crossing Exclusion Signs. Following the crash, the City of Biloxi posted a selective exclusion sign at the Main Street grade crossing, which specifically prohibited access to buses, trucks, and recreational vehicles. Unlike LGCGC warning signs, which provide a generic warning and rely on the driver to determine the appropriate response, an exclusion sign leaves no room for interpretation—drivers can see that the specified vehicle types are prohibited from using the crossing. The MUTCD does not provide any guidance for determining when a jurisdiction should install exclusion signs at grade crossings, although it does provide guidelines for the installation of other types of grade and low clearance warning signs. For example, if a downgrade of a road poses a potential hazard to road users, the MUTCD recommends that a “hill grade” sign be installed to convey specific information about the severity of the grade. If a road crosses under a low overhead structure, the MUTCD recommends that a “low overhead clearance” sign be installed to convey information about maximum vehicle height (FHWA 2009). Grade crossings pose more complex decision-making problems, because the risk of grounding is dependent not only on the approach slope but also on the vehicle’s wheelbase and ground clearance. Traffic engineers could benefit from guidance specifying the conditions under which they should consider the installation of exclusion signs, as well as which vehicle types the signage should exclude. Guidelines or standards for placing an exclusion sign can be based on various

NTSB Highway Accident Report

41 criteria, particularly including (1) the grade crossing’s topographical profile (its slope or curvature) and (2) the frequency of crashes or vehicle groundings taking place on the crossing. Guidance based on a crossing’s topographical profile could be considered proactive, with the possibility of preventing future vehicle groundings. However, given the variability in the topographical profiles of grade crossings and the possible combinations of vehicle types based on their various pertinent dimensions—wheelbase length, ground clearance, rear overhang, etc.—it may be challenging to develop solely topographical standards that apply to all grade crossings and vehicle types. In contrast to topographical standards, guidance based on the frequency of past grounding incidents on a grade crossing might be considered reactive, but such a system has the advantage of using real-world data that are specific to a particular grade crossing. Using both proactive and reactive methods to develop signage standards would combine their advantages. A multipronged approach to developing appropriate standards is used when determining the need for other types of highway safety treatments. For example, the criteria for installing median barriers that prevent or reduce instances of median crossovers and head-on crashes are typically based on the location’s high-risk factors, such as median width and average annual daily traffic. However, some states add a criterion for making the decision—the frequency of median crossovers—regardless of median width or traffic volume. The dual approach of considering both the roadway characteristics and the crash rate allows traffic engineers to address sections of a highway that have a high incidence of crossovers but that do not meet the conventional roadway definition of being at high risk for such events. Similarly, a standard for placing exclusion signs at grade crossings that considers the frequency of vehicle groundings would address those grade crossings that are at high risk for groundings, even if they do not have the topographical features of a typical high-profile crossing. The FHWA can develop such a standard for grade crossing signage and include it as a recommended practice in the MUTCD. However, incorporating new standards into the MUTCD can be a lengthy process. As an interim measure, the FHWA has the option of issuing an official interpretation of a guidance practice that already exists. The interpretations are issued “when unique situations arise for device applications that might require interpretation or clarification of the Manual (FHWA 2009).”72 As such, the guidance practice for installing LGCGC warning signage could include an interpretation specifying other options that traffic engineers might adopt for high-profile grade crossings, such as the use of exclusion signs. The NTSB concludes that traffic engineers would benefit from clear guidance that describes when vehicle exclusion signs should be installed at grade crossings. Therefore, the NTSB recommends that the FHWA issue an interpretation of the guidance practice for LGCGC warning signage in the MUTCD to suggest the use of other signage, such as vehicle exclusion signs, to address safety issues at high-profile grade crossings; and inform the state DOTs of the new interpretation. Additionally, the NTSB recommends that the FHWA develop and establish a guidance practice addressing the circumstances in which vehicle exclusion signs should be installed to restrict access to high-profile grade crossings and the types of vehicles to which the exclusions should apply; and incorporate the guidance practice into the MUTCD.

72 The FHWA official interpretations are included in section 1A.10 of the MUTCD. For additional information, see the FHWA MUTCD website, accessed June 25, 2018.

NTSB Highway Accident Report

42 2.3.1.3 Grade Crossing Reconstruction. AASHTO, the FHWA, and AREMA provide guidance on the maximum acceptable vertical profile for a new or newly reconstructed grade crossing. However, neither highway nor rail guidance documents specify the maximum vertical profile that a grade crossing may reach during its service life before it should be reconstructed. One common consequence of regular railroad maintenance—specifically, the replacement of wooden ties—is to increase the vertical profiles of grade crossings. The effects of such maintenance were evident in the dramatic increase in the frequency of vehicle groundings at the Main Street grade crossing following the February 2014 replacement of wooden railroad ties. The NTSB concludes that, due to the February 2014 track maintenance work, which increased the crossing’s vertical profile and resulted in increased frequency of vehicle groundings, the Main Street grade crossing had been unsafe for certain types of vehicles for several years before the fatal March 2017 crash. Since the crash, the City of Biloxi has installed a selective vehicle exclusion sign and begun plans to develop a commercial vehicle route through Biloxi. According to CSXT, there was only one vehicle grounding at the crossing in the year following the crash. Postcrash, the City of Biloxi considered reconstructing the Main Street grade crossing, but, due to the high cost and the lack of funding, it ultimately determined to proceed with other countermeasures. Although the cost of reconstructing a grade crossing is a critical decision-making factor for local authorities, the lack of guidance or standards for establishing a maximum acceptable vertical profile of an existing grade crossing also presents a challenge when determining whether reconstruction is necessary. Because neither the FHWA nor the FRA provides guidance indicating what the maximum vertical profile of a crossing should be, a jurisdiction’s decision on crossing reconstruction is essentially subjective. The NTSB concludes that traffic engineers would benefit from clear guidance that describes the maximum vertical profile a grade crossing may have before comprehensive risk mitigation options, including crossing reconstruction, should be considered to improve safety. The NTSB recommends that the FHWA, with assistance from the FRA, AASHTO, and AREMA, develop specific criteria to establish when an existing grade crossing should be reconstructed, closed, or otherwise have the risk posed by its unsafe vertical profile comprehensively mitigated; and incorporate the guidance into its Railroad-Highway Grade Crossing Handbook. 2.3.2 Coordination of Maintenance and Risk Monitoring 2.3.2.1 Early Coordination on Maintenance. The Main Street grade crossing had last been reconstructed in 1977. The reconstruction plans specified a downgrade slope of 12.3 percent north of the tracks, which is well beyond the current recommended guidance for maximum slope. Since 1977, CSXT has performed regular maintenance of the tracks, including replacing wooden railroad ties, a procedure that raises the track level by about 1.5 inches each time it is performed. Over the years, this accumulation of track level elevations can substantially raise the railroad track above its original construction level. Moreover, even a single track elevation can have a substantial impact on grade crossing safety. At the Main Street crossing, the wooden railroad ties had last been replaced in February

1. The 23 vehicle groundings that were reported at the crossing in the 3 years after the February

2014 track maintenance—compared to only 3 reported groundings for the previous 2 years—

NTSB Highway Accident Report

43 suggest that the last elevation of the tracks substantially increased the risk of vehicle groundings on the crossing. Railroad maintenance that affects a grade crossing’s vertical profile can have a considerable safety impact on all road users, particularly when it increases the crossing’s vertical profile beyond recommended parameters, as specified by both highway (AASHTO and the FHWA) and railroad (AREMA) organizations. The FRA does not require railroad companies to coordinate with, or even inform, local and state transportation agencies when they conduct maintenance on railroad tracks. MDOT was not informed of the track maintenance that CSXT conducted in February 2014. Although CSXT most likely informed the City of Biloxi that it planned to carry out some railroad work—given that the work required closure of the affected crossings—NTSB investigators uncovered no evidence that CSXT gave the city details about the work being done, or specifically, that it would raise the crossings’ vertical profiles. The Transportation Research Board (TRB) has published research on practices pertaining to the review and implementation of projects between highway agencies and railroad companies, including work on improving and reconstructing grade crossings (TRB 2010). As part of this research, practitioners from more than 50 highway agencies and railroad companies were interviewed, and TRB identified 20 commonly desired practices, including (1) early formal coordination between a railroad company and state and local highway agencies, and (2) periodic and ongoing reviews of the project throughout its development. Although early coordination on grade crossing maintenance projects can be beneficial, the extent to which such coordination about the February 2014 track maintenance might have affected the circumstances of this crash cannot be determined. We do not know whether MDOT or the City of Biloxi might have realized that raising the vertical profile of the Main Street crossing could increase the risk of vehicle grounding, or whether either agency would have elected to take effective countermeasures based on such knowledge. At a minimum, however, with better communication, MDOT and the City of Biloxi would have had the opportunity to consider the potential for increased risk of vehicle groundings on the crossing. By not communicating effectively with MDOT and the city about the crossing maintenance and its consequences, CSXT denied them this opportunity. The NTSB concludes that, had CSXT communicated and coordinated with the City of Biloxi and MDOT about planned railroad projects that might affect the vertical profiles of grade crossings in their jurisdictions, it would have provided them the opportunity to assess and monitor the risks of vehicle groundings and, if necessary, to take proactive action to reduce those risks. Therefore, the NTSB recommends that all Class I railroads implement a process to notify and coordinate with the local and state transportation agencies responsible for highway maintenance at grade crossings as early as possible before conducting any planned maintenance work that has the potential to increase track elevation. 2.3.2.2 Risk Monitoring. There is some confusion as to which entity is responsible for safety associated with grade crossing maintenance. CSXT and the City of Biloxi each claimed that the other party was responsible for maintaining grade crossings. The NTSB examined a 1977 agreement between CSXT and the City of Biloxi, as well as the relevant case law. Although the agreement indicates that the city assumed the entire expense of construction, installation,

NTSB Highway Accident Report

44 maintenance, and operation of any grade crossings in its jurisdiction, including any warning devices, some subsequent case law indicates that a railroad may not contract away its duties and liabilities concerning the safety of public grade crossings. In addition, Mississippi statutes (Miss. Code. Ann. § 65-1-175 [2013]) grant MDOT a certain level of authority over public roadway/railroad crossings, including the power to abolish or close a crossing, require new safety-related signage, or approve the construction of new or existing crossings. It is outside the scope of this investigation to make a definitive determination as to which entity bears the responsibility for maintenance of the Main Street grade crossing; however, both CSXT and the City of Biloxi were aware of the frequency of vehicle groundings in the 3 years following the February 2014 track maintenance that increased the crossing’s vertical profile.73 The NTSB concludes that, although CSXT and the City of Biloxi knew that numerous vehicle groundings had occurred on the Main Street grade crossing after track maintenance was performed in early 2014, neither took action to reduce the safety risk posed by the crossing to both railroad and highway traffic. Many state DOTs have negotiated standard legal agreements with railroad companies regarding grade crossing maintenance and reconstruction. For example, in 1976, the state of Iowa initiated a grade crossing surface repair program with the primary objective of reconstructing all grade crossings and providing subsequent regular maintenance (TRB 2010). Under the program, grade crossings throughout the state are reviewed, scored as to their need for reconstruction (determined by multiple factors, including average annual daily traffic, elevation differential, and approach profile), and then selected for improvement. By agreement, these projects are funded by contributions from state and local governments, as well as from railroad companies. Some states, like Iowa and Washington, have centralized coordination of all highway projects related to rail operations, which allows the state to prioritize projects and ensure consistency in negotiating and establishing agreements with railroad companies. Although Mississippi does not have centralized coordination of highway–railroad projects, MDOT does have limited authority over grade crossings, including the power to close any it deems unsafe. MDOT is divided into six districts that communicate with local municipalities and relay significant safety issues to MDOT management. However, incidents of vehicle groundings on grade crossings are not communicated to MDOT. Given sufficient information, MDOT may be in the best position to provide oversight, facilitate communication, and assist in arbitrating situations when a railroad company and a local authority disagree on maintenance responsibilities. Local municipalities are critical sources of information on the safety of individual grade crossings, including the incidence of vehicle groundings and secondary measures of risk, such as the crossing’s slope and average annual daily traffic of commercial vehicles. However, the local highway transportation departments that communicate with MDOT may not have complete records of all such incidents within their municipalities. For example, although the BPD was aware of nearly all grounding incidents on the Main Street grade crossing, the Biloxi Engineering Department had records for only a fraction of these incidents.

73 As noted earlier, after the February 2014 maintenance, there were 23 incidents of vehicle grounding on the Main Street grade crossing, 2 of which ended in collisions. The BPD was aware of 18 of these incidents, and CSXT had records for 22 of them.

NTSB Highway Accident Report

45 The NTSB concludes that, because MDOT has authority to close grade crossings in the state, increasing the department’s awareness of the safety conditions of grade crossings through enhanced communication with local municipalities might enable it to prioritize improvements to Mississippi grade crossings and assist in improving grade crossing safety. Therefore, the NTSB recommends that MDOT establish communication channels with local municipalities, particularly the City of Biloxi, to monitor the safety of grade crossings, focusing particularly on incidents of vehicle groundings, and, as necessary, assist municipalities in improving the safety of high-risk grade crossings. Additionally, the NTSB recommends that the City of Biloxi implement a program to document incidents of vehicle groundings at grade crossings and to share this information with MDOT. Although various agencies in the City of Biloxi were aware of the incidents of vehicle groundings at the Main Street grade crossing, other, especially smaller, municipalities may not maintain such records. If state DOTs rely solely on local municipalities to monitor the safety of grade crossings, particularly through the evidence of incidents of vehicle groundings, they may be insufficiently informed. CSXT, on the other hand, keeps records of vehicle grounding incidents, a practice typical of railroad companies. Railroad companies are highly incentivized to share information about high-risk grade crossings with agencies able to effect safety improvements. Such grade crossings represent a safety risk not only to highway vehicles but also to trains, because emergency braking, and especially crashes, can cause derailments. Considering that grounding data can be critical in determining the safety of a grade crossing and in predicting the likelihood of future crashes, such grounding incident information should be shared. Therefore, the NTSB concludes that if railroads shared their information on incidents of vehicle groundings on grade crossings with state DOTs, it would enable state authorities to continuously monitor and assess the safety of the grade crossings in their jurisdictions. Therefore, the NTSB recommends that all Class I railroads implement a process to make information about incidents of vehicle groundings at grade crossings that did not result in a crash on their railroad available to the appropriate state departments of transportation. Moreover, to ensure that the railroad industry as a whole is aware of the important safety issues associated with coordinating and communicating with local authorities about both grade crossing risk and maintenance work at crossings, the NTSB further recommends that the Association of American Railroads and the American Short Line and Regional Railroad Association inform their members of the circumstances of the March 7, 2017, Biloxi, Mississippi, grade crossing crash, and emphasize the importance of communication with local and state highway transportation agencies regarding railroad maintenance activities and vehicle grounding incidents on grade crossings. 2.4 Emergency Egress and Extrication Emergency evacuation from the motorcoach occurred both before and after the collision. Based on data from various recorders, the motorcoach was grounded on the crossing for a brief period before the grade crossing warning system activated, which occurred about 29 seconds before the crash. When the passengers noticed the crossing lights and bells activating, and saw the approaching train and heard its horn, they told the driver, who opened the loading door and told them to evacuate. It is unclear when the driver opened the loading door but, based on the onboard video from the motorcoach’s interior-facing camera—which shows about 7 seconds of preimpact

NTSB Highway Accident Report

46 events, an already-open loading door, and passengers evacuating—and postcrash interviews with the passengers, the door was open for more than 8 seconds before the crash. Six passengers safely evacuated before the impact; the evacuation of three of these passengers was captured by the camera, and the other three passengers had safely evacuated before the video began. Two of the passengers who died were attempting to exit the motorcoach at the time of impact, while a third passenger who died had stepped off the vehicle just before the impact. Preimpact evacuation was a safer option than remaining on the motorcoach, but only for those passengers who had sufficient time to reach a safe distance from the crash area before the collision. All the passengers were attempting to evacuate via the loading door, which crowded the aisleway exit path and limited the time available for safe egress by this route. The passengers were mostly members of a senior center, and their limited mobility, as well as the (at least) 22-inch distance from the loading door’s bottom step to the ground (while the motorcoach was stuck on the track), most likely reduced the speed of evacuation through the loading door. None of the passengers who remained on the motorcoach attempted to use the rear door or the emergency windows as means of precrash egress, and it is difficult to determine whether any would have had time to safely evacuate through these alternate egress points before the impact. The time between the driver’s order to evacuate and the train’s impact was brief. The NTSB concludes that, with respect to preimpact evacuation, because of the brief period during which the motorcoach was grounded on the crossing before the train struck it and the limited mobility of many of the passengers, it is unlikely that many more passengers could have safely evacuated before the collision occurred, regardless of which means of egress was used. Although the motorcoach was equipped with a secondary door at the rear, no attempts were made to use the door during the preimpact evacuation. Even had the passengers’ evacuation parameters been optimal—proximity to egress point, good physical condition, sufficient time to reach a safe area, etc.—their ability to open the rear door would depend on their being aware of its existence and their understanding of how to operate it. Some passengers, who were trapped in the rear of the motorcoach because of the overcrowded aisle, were standing near the rear door before the collision, but they told investigators that they had been unaware of its presence. Although it is debatable whether the rear door could have been safely used for egress before the train struck the motorcoach, particularly because its bottom edge was about 4 feet 8 inches above the ground, the door’s potential postcrash usefulness is clear. The train’s impact reduced the aisle width in the middle section of the motorcoach to about 8 inches, and it caused the floor to buckle and tear. Also, some injured passengers were on the floor, which—combined with the reduced aisle width—caused significant aisle congestion and prevented passengers at the rear of the motorcoach from exiting through the loading door. First responders assisted the passengers in the rear to evacuate through the windows but, due to the limited mobility of many of the passengers and the need to extricate some on backboards, evacuation via the windows was challenging. By the time emergency responders were removing occupants from the motorcoach, the rear door was inoperative from inside the motorcoach. Although the rear door was undamaged, its emergency handle had been removed and displaced by a passerby who entered the motorcoach ahead of emergency responders. Eventually, responders cut away the entire rear door to help speed the extrication process. Had the passengers been aware of the presence of the rear door and been

NTSB Highway Accident Report

47 able to open it immediately after the impact, its use most likely would have reduced the evacuation time. Although the rear door’s considerable distance from the ground would have made it challenging for passengers to use it to jump from the motorcoach unaided, the door would have provided responders with an easy extrication access point. However, based on the evidence of the injuries sustained by passengers, it is unlikely that the injury outcomes would have been changed had the first responders been able to evacuate rear passengers sooner. As a result of a 2014 motorcoach crash in Orland, California, in which damage and a postcrash fire made passengers’ egress difficult, contributing to the severity of their injuries (NTSB 2015), the NTSB recommended that NHTSA require new motorcoaches to include a secondary door for use as an emergency exit (Safety Recommendation H-15-13, which is classified “Open—Acceptable Response”). Although the rear door on the Biloxi motorcoach was not designated as an emergency exit, it would have been considered one on some differently configured motorcoaches. The design of this door would have allowed it to be used as a secondary egress point; yet, for the reasons indicated earlier, it was not used for that purpose in this case. As a result of the Orland investigation, the NTSB also recommended that the FMCSA— Require all passenger motor carrier operators to (1) provide passengers with pretrip safety information that includes, at a minimum, a demonstration of the location of all exits, explains how to operate the exits in an emergency, and emphasizes the importance of wearing seat belts, if available; and (2) also place printed instructions in readily accessible locations for each passenger to help reinforce exit operation and seat belt usage. (H-15-14) This recommendation is classified “Open—Acceptable Response.” In its most recent correspondence concerning this recommendation, dated March 2018, the FMCSA stated that, due to the wide variance in vehicles operated by passenger carriers, it does not believe that Safety Recommendation H-15-14 is viable; consequently, it does not plan to implement the necessary rulemaking. However, the FMCSA stated that it will continue to recommend that carriers voluntarily provide safety-related information to passengers. Although the NTSB acknowledges the challenges in implementing this recommendation among the various types of passenger vehicles and operations to which it applies, we reject the FMCSA’s conclusion that the recommendation is not viable. The motorcoach driver in this case did provide a pretrip safety briefing to the initial group of passengers, which included a description of the emergency exit windows; however, he did not mention the rear door as a means of emergency egress.74 ECHO Transportation stated that, because federal regulations do not require the use of a secondary door for emergency egress, it did not train its drivers on how to operate the rear door or inform passengers about the door’s function. Secondary exit doors are permitted under the Federal Motor Vehicle Safety Standards, and they are considered designated emergency exits on certain buses. Van Hool motorcoach models with

74 The driver did not provide any safety briefing to the second group of the passengers that he picked up shortly after the Bastrop loading stop. Also, he gave the briefing only on the first day of the trip, March 5, 2017.

NTSB Highway Accident Report

48 the same configuration of windows and doors as the Biloxi motorcoach are sold in Europe; to meet the European Union requirements, the rear door is considered a designated emergency exit.75 The NTSB concludes that, with respect to postimpact evacuation, although use of the rear door might not have improved the passengers’ injury outcomes, a pretrip safety briefing that included a demonstration of how to operate the rear door might have enabled the passengers to open that door after the impact, expediting the postcrash evacuation and extrication process. As a result, the NTSB reiterates Safety Recommendation H-15-14 to the FMCSA and reclassifies it “Open—Unacceptable Response.”

75 Section 7.6 of Economic Commission for Europe Regulation 107 defines various configurations of acceptable exits according to vehicle type and passenger capacity.

NTSB Highway Accident Report

49 3 Conclusions 3.1 Findings

1. None of the following were causal or contributory factors in the crash: (1) motorcoach

driver licensing or experience; (2) train engineer or conductor licensing or experience; (3) motorcoach driver cell phone distraction, substance impairment, or medical condition; (4) train engineer or conductor cell phone distraction; (5) mechanical condition of the motorcoach; (6) railroad track condition or signal system operation; or (7) weather.

1. The emergency response to the crash was timely and effective.
2. The motorcoach driver’s decisions to take a scenic route and to rely on a portable global

positioning system device programmed for commercial vehicle navigation were reasonable.

1. Given that (1) the motorcoach driver most likely could not have perceived the steepness of

the northern slope before beginning to traverse the crossing, (2) he took the precaution of raising the rear of the motorcoach to prevent scraping the crossing, and (3) no signage prohibited transiting the crossing in a commercial vehicle, the driver’s decision to travel over the Main Street grade crossing was reasonable.

1. Given the speed of the train, the brief period that the motorcoach spent grounded on the

tracks before the crash, the numerous grade crossings in this area, and how frequently the train crew encountered vehicles on crossings that ultimately cleared them safely, the estimated time that the train engineer took to detect the motorcoach on the tracks was reasonable, and his response time before engaging emergency braking was acceptable.

1. Based on the high frequency of grounding incidents at the Main Street grade crossing,

which was posted with low ground clearance grade crossing (LGCGC) warning signage, and the lack of evidence of the safety benefits provided by LGCGC warning signs, the effectiveness of such signs in promoting safety at grade crossings may be negligible.

1. Traffic engineers would benefit from clear guidance that describes when vehicle exclusion

signs should be installed at grade crossings.

1. Due to the February 2014 track maintenance work, which increased the crossing’s vertical

profile and resulted in increased frequency of vehicle groundings, the Main Street grade crossing had been unsafe for certain types of vehicles for several years before the fatal March 2017 crash.

1. Traffic engineers would benefit from clear guidance that describes the maximum vertical

profile a grade crossing may have before comprehensive risk mitigation options, including crossing reconstruction, should be considered to improve safety.

1. Had CSX Transportation communicated and coordinated with the City of Biloxi and the

Mississippi Department of Transportation about planned railroad projects that might affect the vertical profiles of grade crossings in their jurisdictions, it would have provided them

NTSB Highway Accident Report

50 the opportunity to assess and monitor the risks of vehicle groundings and, if necessary, to take proactive action to reduce those risks.

1. Although CSX Transportation and the City of Biloxi knew that numerous vehicle

groundings had occurred on the Main Street grade crossing after track maintenance was performed in early 2014, neither took action to reduce the safety risk posed by the crossing to both railroad and highway traffic.

1. Because the Mississippi Department of Transportation has authority to close grade

crossings in the state, increasing the department’s awareness of the safety conditions of grade crossings through enhanced communication with local municipalities might enable it to prioritize improvements to Mississippi grade crossings and assist in improving grade crossing safety.

1. If railroads shared their information on incidents of vehicle groundings on grade crossings

with state departments of transportation, it would enable state authorities to continuously monitor and assess the safety of the grade crossings in their jurisdictions.

1. With respect to preimpact evacuation, because of the brief period during which the

motorcoach was grounded on the crossing before the train struck it and the limited mobility of many of the passengers, it is unlikely that many more passengers could have safely evacuated before the collision occurred, regardless of which means of egress was used.

1. With respect to postimpact evacuation, although use of the rear door might not have

improved the passengers’ injury outcomes, a pretrip safety briefing that included a demonstration of how to operate the rear door might have enabled the passengers to open that door after the impact, expediting the postcrash evacuation and extrication process. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Biloxi, Mississippi, crash was the failure of CSX Transportation and the City of Biloxi to coordinate and take action to improve the safety of the Main Street grade crossing, a high vertical profile crossing on which motor vehicles were known to ground frequently; their inaction led to the grounding of the motorcoach that was subsequently struck by the CSX Transportation freight train. Contributing to the circumstances of the crash was the inadequate guidance from the Federal Highway Administration on how to mitigate the risks posed by grade crossings with high vertical profiles.

NTSB Highway Accident Report

51 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Highway Administration: Issue an interpretation of the guidance practice for low ground clearance grade crossing warning signage in the Manual on Uniform Traffic Control Devices for Streets and Highways to suggest the use of other signage, such as vehicle exclusion signs, to address safety issues at high-profile grade crossings. Inform the state departments of transportation of the new interpretation. (H-18-23) Develop and establish a guidance practice addressing the circumstances in which vehicle exclusion signs should be installed to restrict access to high-profile grade crossings and the types of vehicles to which the exclusions should apply. Incorporate the guidance practice into the Manual on Uniform Traffic Control Devices for Streets and Highways. (H-18-24) With assistance from the Federal Railroad Administration, American Association of State Highway and Transportation Officials, and American Railway Engineering and Maintenance-of-Way Association, develop specific criteria to establish when an existing grade crossing should be reconstructed, closed, or otherwise have the risk posed by its unsafe vertical profile comprehensively mitigated. Incorporate the guidance into your Railroad-Highway Grade Crossing Handbook. (H-18-25) To the Federal Railroad Administration: Assist the Federal Highway Administration (FHWA) in developing specific criteria to establish when an existing grade crossing should be reconstructed, closed, or otherwise have the risk posed by its unsafe vertical profile comprehensively mitigated, to be incorporated into the FHWA Railroad-Highway Grade Crossing Handbook. (R-18-11) To the Mississippi Department of Transportation: Establish communication channels with local municipalities, particularly the City of Biloxi, to monitor the safety of grade crossings, focusing particularly on incidents of vehicle groundings, and, as necessary, assist municipalities in improving the safety of high-risk grade crossings. (H-18-26)

NTSB Highway Accident Report

52 To the City of Biloxi, Mississippi: Implement a program to document incidents of vehicle groundings at grade crossings and to share this information with the Mississippi Department of Transportation. (H-18-27) To the American Association of State Highway and Transportation Officials: Assist the Federal Highway Administration (FHWA) in developing specific criteria to establish when an existing grade crossing should be reconstructed, closed, or otherwise have the risk posed by its unsafe vertical profile comprehensively mitigated, to be incorporated into the FHWA Railroad-Highway Grade Crossing Handbook. (H-18-28) To the American Railway Engineering and Maintenance-of-Way Association: Assist the Federal Highway Administration (FHWA) in developing specific criteria to establish when an existing grade crossing should be reconstructed, closed, or otherwise have the risk posed by its unsafe vertical profile comprehensively mitigated, to be incorporated into the FHWA Railroad-Highway Grade Crossing Handbook. (R-18-12) To the Association of American Railroads and the American Short Line and Regional Railroad Association: Inform your members of the circumstances of the March 7, 2017, Biloxi, Mississippi, grade crossing crash, and emphasize the importance of communication with local and state highway transportation agencies regarding railroad maintenance activities and vehicle grounding incidents on grade crossings. (R-18-13) To all Class I railroads: Implement a process to notify and coordinate with the local and state transportation agencies responsible for highway maintenance at grade crossings as early as possible before conducting any planned maintenance work that has the potential to increase track elevation. (R-18-14) Implement a process to make information about incidents of vehicle groundings at grade crossings that did not result in a crash on your railroad available to the appropriate state departments of transportation. (R-18-15)

NTSB Highway Accident Report

53 4.2 Recommendation Reiterated and Reclassified in this Report The National Transportation Safety Board also reiterates and reclassifies the following safety recommendation: To the Federal Motor Carrier Safety Administration: Require all passenger motor carrier operators to (1) provide passengers with pretrip safety information that includes, at a minimum, a demonstration of the location of all exits, explains how to operate the exits in an emergency, and emphasizes the importance of wearing seat belts, if available; and (2) also place printed instructions in readily accessible locations for each passenger to help reinforce exit operation and seat belt usage. (H-15-14) This recommendation is reiterated and reclassified “Open—Unacceptable Response” in section 2.4 of this report. BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III

EARL F. WEENER Chairman

Member

T. BELLA DINH-ZARR

Member Adopted: August 7, 2018

NTSB Highway Accident Report

54 Appendix A: Investigation The National Transportation Safety Board (NTSB) received notification of this crash on March 7, 2017, and launched an investigative team to address highway, vehicle, human performance, and survival factors; motor carrier and railroad operations; and onboard recorders. The NTSB team included staff from the Offices of Board Member Robert L. Sumwalt; Highway Safety; Railroad, Pipeline, and Hazardous Materials; Research and Engineering; Safety Recommendations and Communications; and Chief Information Officer. Board Member (now Chairman) Robert L. Sumwalt was the NTSB spokesperson on scene. The Federal Highway Administration, the Federal Railroad Administration, the Federal Motor Carrier Safety Administration, the Mississippi Department of Transportation, the Biloxi Police Department, the Biloxi Department of Engineering, CSX Transportation, TBL Group–ECHO Tours and Charters, and ABC Companies (c/o Van Hool) were parties to the investigation.

NTSB Highway Accident Report

55 References AASHTO (American Association of State Highway and Transportation Officials). 2011. A Policy on Geometric Design of Highways and Streets, 6th edition. Washington, DC: AASHTO. AAMVA (American Association of Motor Vehicle Administrators). 2016. Commercial Driver’s License Manual. Arlington, Virginia: AAMVA. AREMA (American Railway Engineering and Maintenance-of-Way Association). 2011. AREMA Manual for Railway Engineering. Landover, Maryland: AREMA. FHWA (Federal Highway Administration). 2007. Railroad-Highway Grade Crossing Handbook, revised 2nd edition. Washington, DC: FHWA. –––. 2009. Manual on Uniform Traffic Control Devices for Streets and Highways. Washington, DC: FHWA. MDOT (Mississippi Department of Transportation). 2001. Mississippi Roadway Design Manual. Jackson, Mississippi: MDOT. –––. 2012. Mississippi Professional Driver’s Manual for Class A, B & C Commercial Driver License. MDOT. Accessed July 23, 2018, https://driving-tests.org/mississippi/ms-cdl- handbook/.) NTSB (National Transportation Safety Board). 2015. Truck-Tractor Double Trailer Median Crossover Collision With Motorcoach and Postcrash Fire on Interstate 5, Orland, California, April 10, 2014. Highway Accident Report NTSB/HAR-15/01. Washington, DC: NTSB. TRB (Transportation Research Board). 2010. Strategies for Improving the Project Agreement Process Between Highway Agencies and Railroads (SHRP 2). Report S2-R16-RR-1. Washington, DC: TRB. TxDPS (Texas Department of Public Safety). 2014. Texas Commercial Motor Vehicle Drivers Handbook. Austin, Texas: TxDPS. [Note: Handbook indicates that its content was created for and provided to state driver license agencies by the American Association of Motor Vehicle Administrators in 2005.]

FD07491 ｜ 2018_美国_HAR1802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Pickup Truck Centerline Crossover Collision With Medium-Size Bus on US Highway 83, Concan, Texas, March 29, 2017

Highway Accident Report NTSB/HAR-18/02 PB2018-101631

National Transportation Safety Board

NTSB/HAR-18/02 PB2018-101631 Notation 58470 Adopted October 16, 2018

Highway Accident Report Pickup Truck Centerline Crossover Collision With Medium-Size Bus on US Highway 83, Concan, Texas, March 29, 2017

National Transportation Safety Board

490 L’Enfant Plaza SW Washington, DC 20594

National Transportation Safety Board. 2018. Pickup Truck Centerline Crossover Collision With Medium-Size Bus on US Highway 83, Concan, Texas, March 29, 2017. Highway Accident Report NTSB/HAR-18/02. Washington, DC. Abstract: On March 29, 2017, about 12:20 p.m., a 2007 Dodge Ram 3500 pickup truck, occupied by a 20-year-old driver, was traveling north on US Highway 83, near Concan, Texas, when it crossed into the southbound lane and collided with a medium-size bus. The crash occurred near milepost 553.4, near the end of a right-hand curve. The 2004 Ford E350 Turtle Top Van Terra medium-size bus was occupied by a 66-year-old driver and 13 passengers and operated by the First Baptist Church of New Braunfels, Texas. Two people also traveling north in a vehicle directly behind the truck reported its activity to law enforcement and recorded a 14.5-minute cell phone video. The Texas Department of Public Safety reviewed the video and determined that the truck was visible for 12 minutes 48 seconds. In the video, the truck crosses the white edgeline bordering the right side of the roadway 37 times and moves into the grassy area beyond on at least five occasions. For much of the video, the truck straddles the edgeline and rarely travels within the lane markings. In addition, the truck crosses the yellow centerline 19 times and is fully in the opposing lane of travel at least once. As a result of the crash, the bus driver and 12 passengers were fatally injured. The driver of the truck and one bus passenger were seriously injured. The crash investigation focused on the following safety issues: drug-impaired driving and medium-size bus seat belt systems. The NTSB made safety recommendations to the National Highway Traffic Safety Administration (NHTSA), the state of Texas, the Texas Department of Transportation, several medium-size bus manufacturers, and two seating manufacturers. The report also reiterated one recommendation to NHTSA. The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code Section 1154(b). For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident number HWY17MH011. Recent publications are available in their entirety at the NTSB website. Other publications information may be obtained from the website or by contacting: National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551 Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2018-101631. For additional assistance, contact: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see the NTIS website).

NTSB

Highway Accident Report ii Contents Figures and Tables .................................................................................................................... iv Acronyms and Abbreviations .................................................................................................. vi Executive Summary ................................................................................................................ viii 1 Factual Information ................................................................................................................1 1.1 Crash Narrative ......................................................................................................................1 1.1.1 Crash Events ................................................................................................................1 1.1.2 Statements and Video Evidence ..................................................................................4 1.2 Injuries ...................................................................................................................................5 1.3 Emergency Response .............................................................................................................8 1.4 Occupant Restraints ...............................................................................................................8 1.4.1 Bus ...............................................................................................................................8 1.4.2 Truck ..........................................................................................................................10 1.5 Vehicles................................................................................................................................10 1.5.1 Bus .............................................................................................................................10 1.5.2 Truck ..........................................................................................................................12 1.6 Driver Factors ......................................................................................................................13 1.6.1 Bus Driver ..................................................................................................................13 1.6.2 Truck Driver ..............................................................................................................14 1.7 Highway Factors ..................................................................................................................20 1.7.1 Description and Characteristics .................................................................................20 1.7.2 Traffic Volume and Speed .........................................................................................21 1.7.3 Highway Signage and Stopping Sight Distance ........................................................21 1.7.4 Crash History .............................................................................................................22 1.8 Weather and Illumination ....................................................................................................22 2 Analysis ..................................................................................................................................23 2.1 Introduction ..........................................................................................................................23 2.2 Crash Discussion ..................................................................................................................24 2.2.1 Precrash Video Evidence ...........................................................................................24

NTSB

Highway Accident Report iii 2.2.2 Crash Description ......................................................................................................25 2.3 Truck Driver Performance ...................................................................................................26 2.3.1 Distraction ..................................................................................................................26 2.3.2 Fatigue .......................................................................................................................26 2.3.3 Medical Impairment ...................................................................................................27 2.3.4 Alcohol Impairment ...................................................................................................27 2.3.5 Drug Impairment .......................................................................................................27 2.4 Drug-Impaired Driving Countermeasures ...........................................................................29 2.4.1 Detection of Drug-Impaired Drivers .........................................................................29 2.4.2 Texas Impaired Driving Data and Countermeasures .................................................33 2.4.3 National Efforts .........................................................................................................36 2.5 Medium-Size Bus Seat Belt Systems ...................................................................................38 2.5.1 Lap Belt Design and Safety .......................................................................................39 2.5.2 Lap/Shoulder Belt Requirement ................................................................................41 3 Conclusions ............................................................................................................................44 3.1 Findings................................................................................................................................44 3.2 Probable Cause.....................................................................................................................45 4 Recommendations .................................................................................................................46 4.1 New Recommendations .......................................................................................................46 4.2 Previously Issued Recommendation Reiterated in This Report ..........................................47 Board Member Statements ......................................................................................................48 Appendix A: Investigation ......................................................................................................51 Appendix B: Witness Video Still Images ...............................................................................52 Appendix C: Emergency Response Timeline ........................................................................57 Appendix D: Texas Highway Safety Plan Goals and Strategies for “Alcohol and Other Drug” Safety Emphasis Area ........................................................................................58 Appendix E: Texas Highway Safety Plan Impaired Driving Assessment Recommendations .....................................................................................................................59 References ..................................................................................................................................68

NTSB

Highway Accident Report iv Figures and Tables Figure 1. Map showing US-83 crash location and departure locations for truck and bus ............. 1 Figure 2. Vehicles postcrash within southbound lane of US-83, facing north .............................. 2 Figure 3. Crash scene diagram, showing at-rest positions of truck and bus .................................. 3 Figure 4. Bus seating chart with injury and demographic information ......................................... 7 Figure 5. Lap belt assembly in seat 3A, showing traveling retractor with latch and buckle ......... 9 Figure 6. Fourth-row bench seat and closeup view of lap belt anchorage points .......................... 9 Figure 7. Damage to front and driver side of bus ........................................................................ 11 Figure 8. Damage to front and driver side of truck ...................................................................... 12 Figure 9. Marijuana joints (burned and unburned) and rolling papers found in center console of truck ............................................................................................................................. 17 Figure 10. US-83 crash location, showing signage and sight distances ...................................... 21 Figure 11. Still image of truck traveling north in opposing US-83 south lane at time 6:32 of witness video ............................................................................................................................ 25 Figure 12. Diagram showing approximate orientation of truck and bus at point of impact ........ 25 Figure 13. Impaired driving arrests during funded enforcement activities, 2012–2016 .............. 35 Figure 14. Depiction of motion of lap-belted occupant in frontal collision ................................ 40 Figure 15. Bus seating chart showing area of intrusion, shaded, with occupant fatalities depicted in red and seriously injured occupant depicted in gray .................................................. 40 Figure 16. Depiction of motion of lap-belted occupant in frontal collision compared with lap/shoulder-belted occupant ........................................................................................................ 42

NTSB

Highway Accident Report v Table 1. Injury levels for truck driver, bus driver, and bus passengers ......................................... 6 Table 2. Truck driver license history and other interactions with law enforcement, 2013-2017 ..................................................................................................................................... 15 Table 3. Truck driver prescribed medications .............................................................................. 16 Table 4. TxDPS laboratory toxicology results for truck driver, March 29, 2017 ........................ 18 Table 5. Precrash activities of truck driver, March 27–29, 2017 ................................................. 19 Table 6. Texas highway safety plan and SHSP projections for traffic-related and impaired driving fatalities and for traffic-related serious injuries in 2022 .................................................. 34

NTSB

Highway Accident Report vi Acronyms and Abbreviations ACM ARIDE BAC CDL CFR CNS DEC DOT DRE DUID DWI EMS FAA FARS FHWA FMVSS g g/dL GAO GHSA GVWR IACP µg/L µg/mL mg mg/L mmHg ng/mL NHTSA NTSB air bag control module advanced roadside impaired driving enforcement [NHTSA] blood alcohol concentration commercial driver’s license Code of Federal Regulations central nervous system drug evaluation and classification [IACP–NHTSA] US Department of Transportation drug recognition expert [IACP] driving under the influence of drugs driving while intoxicated emergency medical services Federal Aviation Administration Fatality Analysis Reporting System [NHTSA] Federal Highway Administration Federal Motor Vehicle Safety Standard acceleration due to gravity gram per deciliter US Government Accountability Office Governors Highway Safety Association gross vehicle weight rating International Association of Chiefs of Police microgram per liter microgram per milliliter milligram milligram per liter millimeter of mercury nanogram per milliliter National Highway Traffic Safety Administration National Transportation Safety Board

NTSB

Highway Accident Report vii OSA OTC PTSD SFST SHSP THC TxDOT TxDPS US-83 VFD

obstructive sleep apnea over-the-counter posttraumatic stress disorder standardized field sobriety testing [NHTSA] strategic highway safety plan delta-9-carboxy-tetrahydrocannabinol [marijuana] Texas Department of Transportation Texas Department of Public Safety US Highway 83 volunteer fire department

NTSB

Highway Accident Report viii Executive Summary Investigation Synopsis On March 29, 2017, about 12:20 p.m., a 2007 Dodge Ram 3500 pickup truck, occupied by a 20-year-old driver, was traveling north on US Highway 83, near Concan, Texas, when it crossed into the southbound lane and collided with a medium-size bus. The crash occurred near milepost 553.4, near the end of a right-hand curve. The 2004 Ford E350 Turtle Top Van Terra medium-size bus was occupied by a 66-year-old driver and 13 passengers and operated by the First Baptist Church of New Braunfels, Texas. As a result of the crash, the bus driver and 12 passengers were fatally injured. The driver of the truck and one bus passenger were seriously injured. Probable Cause The National Transportation Safety Board determines that the probable cause of the Concan, Texas, crash was the failure of the pickup truck driver to control his vehicle due to impairment stemming from his use of marijuana in combination with misuse of a prescribed medication, clonazepam. Contributing to the severity of the injuries was the insufficient occupant protection provided by the lap belts worn by passengers seated in the rear of the medium-size bus. Safety Issues This crash investigation identified the following safety issues: • Drug-impaired driving: The truck driver’s erratic operation of his vehicle was due to impairment from the combined use of marijuana and a prescription medication. To increase the effectiveness of law enforcement in deterring drug-impaired driving, officers need additional training in the detection of drivers under the influence of drugs and additional tools, such as roadside drug testing devices. The state of Texas has one of the highest rates of fatal crashes involving impaired drivers. Additional efforts are needed at both the state and national levels to identify best practices, effective science-based safety countermeasures, and drug testing protocols to reduce the fatalities, injuries, and crashes caused by drug-impaired drivers. • Medium-size bus seat belt systems: The bus was equipped with lap belts in rows 1–4 behind the driver, though these seat belts are not required by federal regulation. The 12 bus passengers seated in these rows were restrained. Upper body flailing over the lap belts—which concentrated the load in the pelvis and abdomen—exacerbated the injuries to passengers seated outside of the intrusion area. Further contributing to injuries for the four occupants seated in the rear row of bench seats were the narrow lap belt anchorage points, which resulted in additional forces on the pelvis and abdomen. Most medium-size bus manufacturers offer passenger lap/shoulder belts as an option, but they are not required. Because lap/shoulder belts provide a greater level of

NTSB

Highway Accident Report ix protection, bus and seat manufacturers should move toward providing them as standard, rather than optional, equipment for all seating positions on medium-size buses. Additionally, the National Highway Traffic Safety Administration (NHTSA) should amend Federal Motor Vehicle Safety Standard 208 on occupant protection to require lap/shoulder belts for medium-size buses. Recommendations The NTSB makes new safety recommendations to NHTSA, the state of Texas, the Texas Department of Transportation, several medium-size bus manufacturers, and two seat manufacturers. The NTSB also reiterates one safety recommendation to NHTSA.

NTSB

Highway Accident Report 1 1 Factual Information 1.1 Crash Narrative 1.1.1 Crash Events On Wednesday, March 29, 2017, about 12:20 p.m., a 2007 Dodge Ram 3500 pickup truck, driven by a 20-year-old male, was traveling north on US Highway 83 (US-83), near Concan, in Uvalde County, Texas, when it crossed into the southbound lane and collided with a medium-size bus.1 The 2004 Ford E350 Turtle Top Van Terra medium-size bus was transporting 13 parishioners of the New Braunfels First Baptist Church.2 The bus was owned and operated by the church and was being driven by a 66-year-old male. The truck driver had departed Uvalde on the morning of March 29 en route to Leakey.3 The bus was returning to New Braunfels following a 2-day retreat at the Alto Frio Baptist camp and conference center in Leakey (see figure 1).

Figure 1. Map showing US-83 crash location and departure locations for truck and bus.

1 See appendix A. 2 A medium-size bus is typically designated as such because the bus body is built on a medium-duty truck chassis. The weight range for a medium-size bus is 10,001–26,000 pounds gross vehicle weight rating (GVWR). 3 The truck driver stopped at a pharmacy in Uvalde to refill prescription medications. Pharmacy surveillance video footage showed the truck arrive at the drive-thru window at 11:03 a.m. and depart at 11:09 a.m. The driver also made a stop for food before departing for Leakey.

NTSB

Highway Accident Report 2 Near the end of a right-hand curve near milepost 553.4, the truck departed the US-83 north travel lane and crossed into the southbound lane, colliding with the front left of the bus (see figures 2 and 3).4 The bus driver and 12 passengers were fatally injured, and the driver of the truck and one bus passenger were seriously injured.

Figure 2. Vehicles postcrash within southbound lane of US-83, facing north. (Source: TxDPS)

4 The crash occurred about 9.7 miles from the Alto Frio Baptist camp and conference center.

NTSB

Highway Accident Report 3

Figure 3. Crash scene diagram, showing at-rest positions of truck and bus.

NTSB

Highway Accident Report 4 1.1.2 Statements and Video Evidence 1.1.2.1 Truck Driver Statements. After being removed from the truck, the driver provided an initial statement to Texas Department of Public Safety (TxDPS) troopers at the scene. He said that he was returning to Leakey after picking up medication in Uvalde. A trooper asked him if he had taken any of the medication, and he replied that he had taken two Klonopin about an hour previously.5 The driver said that the prescription was for posttraumatic stress disorder (PTSD), and it made him drowsy.6 He also told troopers that he was texting at the time of the crash.7 National Transportation Safety Board (NTSB) investigators and the 38th Judicial District Attorney’s Office also interviewed the driver. He told NTSB investigators that he was checking his phone immediately before the crash, though he added that he was not expecting a call from anyone in particular. He told district attorney investigators that he was checking his phone to see if his girlfriend had texted him. He said that he did not see the oncoming bus until the very last second—and stated that he slammed on the brakes, but the truck did not “stop on a dime.” The driver mentioned to both sets of investigators that his truck had steering problems. During the NTSB interview, he said that the truck “had play in the wheel.” When he spoke with district attorney investigators, he said that the steering box on the truck was going out, and the pitman arm shook. He said that he wanted to get it fixed, but the repair would cost about $1,000.8 1.1.2.2 Witnesses Following Truck. Two people traveling north on US-83 in a vehicle directly behind the truck witnessed it weaving erratically and failing to maintain its lane of travel. At 12:02 p.m., they called the Uvalde Police Department to report the hazard. At 12:07 p.m., they called the Real County Sheriff’s Office. During both recorded phone calls, they voiced concern about the erratic driving. They made numerous statements indicating that the truck was going to cause a head-on collision or some other type of crash. The Uvalde Police Department dispatched a county deputy at 12:04 p.m. in response to the “reckless driver” call, but the deputy was unable to intercept the truck. In addition to reporting the truck to law enforcement, the witnesses recorded a 14-minute 27-second cell phone video.9 TxDPS reviewed the video and determined that the truck was visible for 12 minutes 48 seconds. In the video, the truck crosses the white edgeline bordering the right side of the roadway 37 times and moves into the grassy area beyond the edgeline on at least five occasions. For much of the video, the truck straddles the edgeline and rarely travels within the lane markings.10 In addition, the truck crosses the yellow centerline 19 times and is fully in the opposing lane of travel at least once. The video records several near misses with vehicles in the opposing lane and on the right shoulder. The cell phone stopped recording shortly before the

5 Klonopin is the brand name for the prescription drug clonazepam (see section 1.6.2.2 for additional details). 6 PTSD is a condition that may develop in someone who has seen or lived through a disturbing event. 7 A forensic download of the driver’s cell phone showed no evidence of texting at the time of the crash. 8 NTSB investigators examined the steering components of the truck and found that the steering gear was mechanically functional and free of defects. 9 See appendix B for still images from the witness video. 10 TxDPS concluded that the truck was partially outside of its lane of travel for 8 minutes 34 seconds during the video, which accounts for 67 percent of the time it was visible.

NTSB

Highway Accident Report 5 crash. Both the driver and the passenger witnesses provided speed estimates of 60–80 mph for the truck but added that it slowed as it approached the curve where the crash occurred. Postcrash, the driver witness spoke to the truck driver and told him what he had hit. The truck driver replied that he had been texting before the crash. NTSB investigators studied the witness video to estimate the speed of the truck during the last minute of the video as 69 ±2 mph.11 The posted speed limit on US-83 at the crash location is 70 mph. 1.1.2.3 Witnesses Following Bus. Two people traveling on US-83 south in a vehicle directly behind the bus witnessed the crash. According to the driver of that vehicle, his cruise control was set at 64–65 mph and he was gaining slightly on the bus, which he believed was traveling about 60–62 mph. He estimated that he was 300 feet behind the bus at the time of the crash. The driver did not notice anything unusual about the operation of the bus and noted that it was within its lane. He first noticed the oncoming truck as it rounded the curve. He believed that the truck was in its lane when it first appeared but that it then drifted into the opposing lane. He estimated that two-thirds of the truck occupied the southbound lane when the crash occurred. The witness recalled no illumination of brake lights or evidence of evasive action by the bus driver. He slammed on his brakes as soon as he witnessed the crash and skidded to a stop a short distance from the two vehicles.12 The statement of the passenger witness was consistent with that of the driver. The passenger reported the truck being three-fourths into the southbound lane immediately before the crash. 1.2 Injuries Table 1 provides injury levels for the truck driver, bus driver, and bus passengers. Thirteen bus occupants were fatally injured. The driver of the truck and one bus passenger were seriously injured and were transported to hospitals by medevac helicopters.

11 See the video study in the NTSB public docket for this investigation (HWY17MH011). 12 The crash scene diagram (figure 3) depicts tire marks deposited by the witness vehicle.

NTSB

Highway Accident Report 6 Table 1. Injury levels for truck driver, bus driver, and bus passengers. Injury Severitya Fatal Serious Minor TOTAL Truck driver 0 1 0 1 Bus driver 1 0 0 1 Bus passengers 12 1 0 13 TOTAL 13 2 0 15 a Although 49 Code of Federal Regulations (CFR) Part 830 pertains only to the reporting of aircraft accidents and incidents to the NTSB, section 830.2 defines fatal injury as any injury that results in death within 30 days of the accident, and serious injury as any injury that: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date of injury; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages or nerve, muscle, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface. The bus was equipped with a driver and a passenger seat in the front compartment and four rows of seats in the passenger compartment. Figure 4 shows the bus configuration and the seating location, age and gender, and classification of injuries for each occupant.

NTSB

Highway Accident Report 7

Figure 4. Bus seating chart with injury and demographic information. The bus sustained major front-end damage and intrusion, which extended down the driver side of the bus. Fatal injuries to the driver, the front passenger, and the occupants of the first and second rows on the driver side (within the intrusion zone) consisted of blunt force trauma. Aft of the intrusion zone, the occupants in row 3 and the two left-seated occupants in row 4 sustained fatal injuries to the head, neck, and chest. The occupant in seat 4C sustained fatal injuries to the abdomen, pelvis, and lumbar spine. The sole survivor was seated in the last row, right corner, at a location farthest from the impact (seat 4D). She sustained serious injuries to the pelvis and abdomen, and multiple extremity fractures. According to first responders and witnesses, the occupants of seats 2A and 3A—despite being lap belted—were partially ejected from the bus. The truck driver sustained multiple facial, extremity, and rib fractures.

NTSB

Highway Accident Report 8 1.3 Emergency Response Appendix C presents a timeline of the emergency communications and response, beginning with the initial notification call about 12:20 p.m. and ending with the reopening of US-83 at 12:07 a.m. on March 30. Almost immediately following the crash, an emergency medical services (EMS) ambulance stopped at the scene to render aid.13 A multiagency response consisted of 16 local and state emergency service agencies, which included resources from the Uvalde Volunteer Fire Department (VFD), Utopia VFD, Concan VFD, Reagan Wells VFD, Leakey VFD, TxDPS, Uvalde County Sheriff’s Office, Real County Sheriff’s Office, Garner State Park Police, and Texas Parks and Wildlife Police. While en route to the crash scene, the lead Utopia EMS responder and initial incident commander heard radio traffic from Real County describing the crash as involving multiple fatalities and injuries. The incident commander immediately requested a medevac helicopter. Such requests are commonplace in this area due to the 90-mile distance to the level 1 trauma hospital in San Antonio. Six ambulances and five helicopters were dispatched to the crash scene. The first medevac helicopter landed within 30 minutes of notification. 1.4 Occupant Restraints 1.4.1 Bus The bus was equipped with front driver and passenger air bags, both of which deployed. The driver and front passenger seats were equipped with lap/shoulder belt assemblies. Freedman Seating Company manufactured the 12 rear passenger seats, eight of which were equipped with traveling retractor lap belt assemblies (see figure 5).14 The two-person bench seats in the last row on each side of the bus—which could be folded to allow for the storage of luggage—were equipped with manually adjustable lap belt assemblies (see figure 6).

13 The EMS ambulance was operating in the area and transporting a patient to the Uvalde hospital. 14 A traveling retractor is a belt retractor system that is mobile and travels with the latch side of the belt. The most common belt retractor in passenger cars is mounted to the seat frame and fixed.

NTSB

Highway Accident Report 9

Figure 5. Lap belt assembly in seat 3A, showing traveling retractor with latch and buckle.

Figure 6. Fourth-row bench seat (left) and closeup view of lap belt anchorage points (right). The four lap belts on the bench seats in the back row were bolted to the seat frame and designed with a manual tightening/cinching mechanism. In contrast to the lap belt anchorage points for the first three rows of seats, which were spaced 11.5 inches apart, the lap belt anchorage points for the bench seats were spaced only 6.5 inches apart.15 The 6.5-inch spacing meets the requirements for belt anchorage points under Federal Motor Vehicle Safety Standard (FMVSS) 210.16

15 (a) “Anchorage points” refers to the locations at which the belts are attached to the seat. (b) Freedman Seating informed the NTSB that, as of October 1, 2017, it is not installing lap belt anchors at the 6.5-inch lateral spacing. Freedman has increased the anchorage spacing to 8.5–12.5 inches, for an average of 10.5 inches. 16 FMVSS 210 states that anchorages for an individual seat belt assembly shall be at least 165 millimeters (6.5 inches) apart laterally, measured between the vertical centerlines of the bolt holes.

NTSB

Highway Accident Report 10 According to interviews with first responders, all bus occupants were restrained by the installed seat belt assemblies. Examination of the vehicle interior showed physical evidence of loading, with areas of heat abrasion and cupping on each of the seat belt assemblies inspected.17 Moreover, autopsy reports noted abrasion and contusion to the abdomen and hips of most of the bus occupants. 1.4.2 Truck The truck was equipped with front driver and passenger air bags, both of which deployed. The driver and front passenger lap/shoulder belts were found locked in the stowed position.18 According to first responders and witnesses, the driver was found on the passenger side floorboard of the truck and remained there until extracted by first responders. A dog was reportedly in the cab of the truck and survived the crash. 1.5 Vehicles 1.5.1 Bus 1.5.1.1 General. The bus was configured as a 12-passenger medium-size bus with the installation of a Turtle Top bus body on a 2004 Ford E-350 chassis, which retained the original equipment manufacturer cab and forward seating positions (driver and right-front passenger). The GVWR of the bus was 10,700 pounds. Using certified scales, TxDPS inspectors recorded the total bus weight as 7,650 pounds (excluding the weight of the bus occupants). 1.5.1.2 Damage. The bus sustained an offset frontal impact at the driver side, with direct contact damage overlapping about 37 inches of the vehicle width (figure 7). The damage extended more than 62 inches down the driver side of the bus. An interior inspection of the bus showed that, outside of the intrusion zone—which extended to the second row of seats—the body and floor structure were intact. The third- and fourth-row seats remained attached to the vehicle structure, with no displacement.

17 Cupping occurs when occupant loading curls the seat belt webbing. 18 The seat belt was retracted and locked in its normal position against the B-pillar, indicating that it was not in use at the time of the crash. The seat belt was not cut or damaged.

NTSB

Highway Accident Report 11

Figure 7. Damage to front and driver side of bus. 1.5.1.3 Mechanical Systems. NTSB investigators performed an inspection and functional check of the steering, suspension, braking, and electrical systems, as well as the wheels and tires. The examination revealed no evidence of preexisting defects. 1.5.1.4 Inspection, Maintenance, and Safety Recalls. Maintenance and service records were obtained from the owner of the bus, the First Baptist Church of New Braunfels. The bus was regularly serviced at a Ford dealership. The most recent work order, dated January 30, 2017, showed that the front and rear shock absorbers and a driver window regulator were replaced; and a safety inspection of the tires, brakes, and battery found no defects. State vehicle inspection records showed that the bus was inspected on April 18, 2016, and passed the evaluation criteria. A search of the National Highway Traffic Safety Administration (NHTSA) safety recall database revealed no recalls related to the bus. 1.5.1.5 Event Data Recording. The bus was equipped with an air bag control module (ACM) capable of recording data related to deployment of the frontal air bag supplemental restraint systems. The ACM was removed from the bus and brought to the supplier, Continental Automotive Systems US, Inc., for data recovery. Continental reported that crash data from the ACM accelerometer were available for 210 milliseconds for the longitudinal (length) and lateral (width) axes of the bus. Based on these data, the maximum cumulative change in velocity along the longitudinal axis was 33.2 mph, and the maximum change in velocity along the lateral axis was 12.0 mph. Examination of the data showed that the magnitude of the acceleration and change in velocity was underreported.19 The ACM recorded no precrash data, such as vehicle speed or braking.

19 A review of accelerometer graph data showed that data were clipped at certain times during the crash pulse recording. Continental advised that the ACM has acceleration limits of 61 g (longitudinal) and 30 g (lateral). Data exceeding these limits were not recorded, resulting in an overall underreporting of the acceleration and speed change.

NTSB

Highway Accident Report 12 1.5.2 Truck 1.5.2.1 General. The 2007 Dodge Ram 3500 quad cab pickup truck had four-wheel drive, a six-speed manual transmission, and a seating capacity of six. It was equipped with an 8-foot-long truck bed and dual rear wheels. Its GVWR was 12,200 pounds. Using certified scales, TxDPS inspectors recorded the total truck weight as 7,750 pounds (excluding the weight of the driver). 1.5.2.2 Damage. The truck sustained an offset frontal impact at the driver side, with direct contact damage overlapping about 37 inches of the vehicle width (figure 8). The crash resulted in intrusion into the driver compartment. The steering wheel, instrument panel, and footwell regions were displaced aft into the driver seating position. Postcrash, the distance from the steering wheel to the driver seatback was about 7 inches. The front of the truck was shifted rearward and to the left (toward the driver side). The forward frame rails were shifted more than 40 degrees to the left. The driver door was separated at the upper hinge, and the door frame was collapsed. The driver side rear passenger door was displaced rearward.

Figure 8. Damage to front and driver side of truck. 1.5.2.3 Mechanical Systems. NTSB investigators inspected the truck suspension, braking, and electrical systems, as well as the wheels and tires. The examination revealed no evidence of preexisting defects. The extent of vehicle damage prevented NTSB investigators from performing a functional check of the steering system and several related components. Based on the truck driver’s statement indicating a precrash problem with the steering gear, it was removed and sent to the NTSB materials laboratory. Internal examinations concluded that the steering gear was mechanically functional and free of defects.

NTSB

Highway Accident Report 13 1.5.2.4 Inspection, Maintenance, and Safety Recalls. Two maintenance receipts from mechanical repairs were found in the truck glovebox. On September 21, 2016, a fuel filter and two batteries were replaced. Repair work on December 15, 2016, included replacement of the transfer case shifter bushings; tightening of the steering stabilizer bolts; installation of four-wheel-drive axles on the front differential; and replacement of the brake caliper, bracket, brake pads, and rotor on the right front axle. A review of state vehicle inspection records showed that the truck was inspected on October 6, 2016, and passed the evaluation criteria. A search of the NHTSA safety recall database revealed four open recalls for the truck. Two recalls related to the potential for rupture of the air bag inflator. The air bags deployed normally, without rupture. The other two recalls related to the potential for steering gear components to either loosen or fracture under certain driving conditions. NTSB investigators inspected the steering linkage and related components and found no defects. 1.5.2.5 Event Data Recording. The truck was equipped with an ACM capable of recording data on deployment of the frontal air bag supplemental restraint systems. Both TxDPS and the NTSB attempted to download the module, but no data were available because of a power loss during the collision. 1.6 Driver Factors 1.6.1 Bus Driver 1.6.1.1 Licensing and Experience. The bus driver, a 66-year-old male, held a Texas class A commercial driver’s license (CDL) with passenger, school bus, and double/triple trailer endorsements.20 His driving record showed no violations or prior crashes. According to the driver’s wife, he served as a relief driver for the Comal school district and drove a medium-size bus on weekends for a waterpark in New Braunfels. He was familiar with the church bus involved in the crash and had not mentioned experiencing any mechanical issues. A First Baptist Church representative reported that the driver had taken various church groups to the Alto Frio camp and conference center during the past 3–4 years and was familiar with the route. 1.6.1.2 Health, Medical Certification, and Toxicology. The bus driver’s health, medical certification, and toxicology data are summarized below. • Health: NTSB investigators reviewed records from the bus driver’s primary care providers from July 2013 through February 2017. His medical conditions included type II diabetes, elevated cholesterol, gout, and neck pain—which were being treated and controlled with diet, exercise, and oral medications. Additionally, he had a history of obstructive sleep apnea (OSA), for which he used a continuous positive airway

20 A class A CDL permits the holder to operate a vehicle with a gross combination weight rating exceeding 26,000 pounds.

NTSB

Highway Accident Report 14 pressure device, though his wife reported that he was not comfortable with it. She also reported that he snored at night, but it did not usually cause him to wake. • Medical certification: The driver’s current medical certificate was issued in February

1. He reported taking medications for high blood pressure, high cholesterol, and

gout. Because of his controlled high blood pressure, the certified medical examiner granted him a medical certificate for 1 year.21 • Toxicology: Forensic toxicology testing conducted by the Bexar County medical examiner as part of the driver’s autopsy detected ibuprofen at low levels. Ibuprofen is an over-the-counter (OTC) and prescription nonsedating pain and fever medication. Tests conducted by the Federal Aviation Administration (FAA) Bioaeronautical Sciences Research Laboratory detected no ethanol in the driver’s blood but did detect chlorthalidone and ibuprofen.22 Chlorthalidone is a nonsedating diuretic that had been prescribed to the driver as treatment for high blood pressure. Both medications are generally considered to be nonimpairing. 1.6.1.3 Precrash Activities. NTSB investigators reviewed cell phone records and interviewed the bus driver’s wife, a pastor who arranged the retreat, and camp staff to determine his precrash activities. On each of the 3 nights before the crash, the driver had an opportunity for 7.5 hours of rest. A review of records showed no cell phone activity by the driver during the return trip from the camp to New Braunfels. 1.6.2 Truck Driver 1.6.2.1 Licensing and Experience. The truck driver, a 20-year-old male, held a Texas class C driver’s license, which allowed him to operate noncommercial vehicles. A review of law enforcement and license records showed that, in the 4 years before the crash, he had had at least eight interactions with police while driving (see table 2).

21 See 49 CFR 391.41(b)(6). Stage 1 hypertension corresponds to a systolic blood pressure of 140–159 millimeters of mercury (mmHg) or a diastolic blood pressure of 90–99 mmHg. A driver with blood pressure in this range is at low risk for hypertension-related acute incapacitation and may be medically certified to drive for 1 year. The bus driver’s blood pressure was last recorded as 123/67. 22 Toxicology testing included more than 1,300 substances; see the FAA WebDrugs website for a complete listing, accessed November 6, 2018.

NTSB

Highway Accident Report 15 Table 2. Truck driver license history and other interactions with law enforcement, 2013–2017. Date Law Enforcement Interaction Result 01/24/14 Speeding, no driver’s license Citation 02/15/14 Farm license violation Citation 01/17/15 Property-damage crash in Bexar County, Texas Police officer determined driver to be at fault 10/03/15 Speeding, equipment violations, expired driver’s license Citation (expired license) Warning (other violations) 10/25/15 No license plates, expired driver’s license, no driver’s license in possession, no insurance Citation (expired license) Warning (other violations) 05/17/16 Failure to move over or to slow for certain vehicles, driving with suspended license, no driver’s license in possession, no insurance Citation (driving with suspended license) Warning (other violations) 01/08/17 No/improper mud flap, affixing unauthorized sunscreening device to vehicle Warning (both violations) 01/14/17 No/improper mud flap, affixing unauthorized sunscreening device, noncompliant head lamps, no driver’s license in possession Warning (all violations) On January 17, 2015, while driving a car, the truck driver was involved in a property-damage crash in which he crossed into the opposing traffic lane and struck another vehicle. According to witnesses, he stated that he had been on his phone when he drifted into the other lane. No postcrash toxicology testing was conducted, because the police officer observed no overt symptoms of intoxication.23 The driver was not cited for this crash. On January 8, 2017, the driver was stopped for having no/improper mud flaps and affixing an unauthorized sunscreening device to his vehicle. The police officer noted that the driver appeared to be nervous, so he requested consent to search the truck. The officer found no contraband and released the driver with a warning. The same officer stopped the driver again on January 14 for similar equipment violations and again issued a warning.24

23 The police officer had not received advanced roadside impaired driving enforcement (ARIDE) training or drug recognition expert (DRE) training at the time of the crash investigation. See the IACP webpage on the DEC program and the Sam Houston State University Criminal Justice Center webpage on the DEC program, accessed November 6, 2018. 24 The police officer had not received ARIDE or DRE training.

NTSB

Highway Accident Report 16 1.6.2.2 Health and Prescribed Medication. NTSB investigators reviewed medical records from August 2014 through September 2016. The truck driver was generally found to be in good health during school physical examinations. He was treated for minor illnesses and orthopedic injuries. On September 19, 2016, he was treated for pain following a right lower leg injury. During that visit, he was prescribed tramadol.25 There was no evidence that he had refilled or received a new prescription for tramadol since that date. The truck driver was required to wear corrective lenses while driving. NTSB investigators reviewed his optometry records. On August 24, 2016, an examination documented his uncorrected distance visual acuity as 20/50 right eye and 20/40 left eye. He was prescribed eyeglasses that corrected his distance vision to 20/25 right eye, 20/20 left eye, and 20/20 both eyes. During a postcrash interview, the driver said that he was not wearing his glasses at the time of the crash. According to his medical records, the driver was voluntarily hospitalized for anxiety and depression between September 27 and October 5, 2016. Discharge records documented that he had depression and PTSD. Individuals suffering from PTSD may relive the traumatic event, experience excess arousal to stimulus, and avoid situations that cause symptoms.26 The driver’s most recent identified outpatient psychiatric visit was for followup after the hospitalization, on November 14, 2016. Documentation noted that he was doing well on current medical treatment and was not a danger to himself or others. The examining psychiatrist documented no other medical or psychiatric conditions, or evidence of substance abuse. The patient was to continue the prescribed medications listed in table 3.27 No additional followup visits were made. The driver continued to refill his prescribed medications monthly. NTSB investigators identified no additional psychiatric records. Table 3. Truck driver prescribed medications.

25 Tramadol is an opioid pain medication and Schedule IV controlled substance available by prescription. 26 See the National Institute of Mental Health webpage on PTSD, accessed November 6, 2018. 27 The treating physician documented discussing the benefits and risks of the prescribed medications, including precautions, potential side effects, and adverse reactions. Medication Brand Name Dosage Treatment Clonazepam Klonopin 1 mg 3 times per day PTSD: sedative used to treat seizure and panic disorders Prazosin Minipress 2 mg 2 times per day PTSD: blood pressure medication used also to treat symptoms of PTSD, decrease nightmares Escitalopram Lexapro 20 mg 1 time per day Depression: antidepressant and antianxiety medication Zolpidem Ambien 10 mg 1 time per day at bedtime Insomnia: short-acting sleep aid medication

NTSB

Highway Accident Report 17 Following the crash, four prescription bottles for the medications listed in table 3 were found in the front cab of the truck. The bottles of clonazepam and prazosin were found open and empty, and many loose pills were located throughout the cab. The prescription labels showed that the medications were filled at a pharmacy in Uvalde on the day of the crash. In addition to the prescription bottles, an open box of cold medication (liquid capsules) was found within the truck wreckage.28 Postcrash, the driver told a TxDPS trooper that he had taken two clonazepam pills an hour earlier.29 1.6.2.3 Illicit Drug Possession. During a postcrash inspection of the truck, TxDPS found a metal box containing two unburned marijuana joints, the remains of five partially smoked joints, and a package of rolling papers (see figure 9).30 Also found in the truck were electronic scales, which TxDPS considered to be drug paraphernalia. According to 21 United States Code 812, marijuana is listed as a Schedule I controlled substance.31

Figure 9. Marijuana joints (burned and unburned) and rolling papers found in center console of truck. (Source: TxDPS) 1.6.2.4 Toxicology Results. The TxDPS crime laboratory completed toxicology testing of a blood sample collected from the truck driver at University Hospital in San Antonio at 2:20 p.m. (2 hours postcrash; see table 4).

28 The cold medication contains acetaminophen (pain reliever/fever reducer), dextromethorphan (cough suppressant), and doxylamine succinate (antihistamine). 29 The driver referred to the pills he ingested as “coladapin,” a mispronunciation of the drug Klonopin (brand name for clonazepam). 30 The TxDPS crime laboratory analyzed the plant substance in the two unburned joints and confirmed it to be marijuana. 31 Schedule I drugs, substances, or chemicals are defined as drugs with no currently accepted medical use and a high potential for abuse.

NTSB

Highway Accident Report 18 Table 4. TxDPS laboratory toxicology results for truck driver, March 29, 2017. a TxDPS screening was negative for the following drug classes: amphetamines, barbiturates, carisoprodol/meprobamate, cocaine metabolites, opiates, and phencyclidine. b Fentanyl, which was administered postcrash while the driver was en route to the hospital, was also detected in the blood. The FAA laboratory conducted forensic toxicology testing of the limited remaining blood specimen collected from the driver at 2:20 p.m. on March 29 and of a urine sample collected at 7:42 p.m. (about 7.5 hours postcrash).32 Delta-9-carboxy-tetrahydrocannabinol (THC), the primary active ingredient in marijuana, was detected in the blood at 7.1 nanograms per milliliter (ng/mL). No ethanol was detected in the blood. Numerous drugs—including 7-amino- clonazepam, benzoylecgonine, citalopram, dextromethorphan, dextrorphan, ecgonine methyl ester, hydromorphone, lidocaine, morphine, and norfentanyl—were detected in the urine.33 The potentially driving-impairing drugs confirmed in the blood were THC and clonazepam, descriptions of which follow: • Marijuana (THC): Marijuana is a psychoactive central nervous system (CNS) depressant. THC is the primary active chemical in marijuana. 9-Carboxy- tetrahydrocannabinol is an inactive metabolite in THC.34 Concentrations of the parent drug (THC) and the metabolite are very dependent on the pattern of use as well as dose. Concentrations vary depending on the potency of the marijuana and the way the drug is used. • Clonazepam: Clonazepam is a sedative benzodiazepine used in the treatment of seizure disorders and panic disorder.35

32 Toxicology testing included more than 1,300 substances; see the FAA WebDrugs website for a complete listing, accessed November 6, 2018. 33 (a) 7-amino-clonazepam is the metabolite of clonazepam. (b) Benzoylecgonine and ecgonine methyl ester are metabolites of cocaine. (c) Citalopram is an antidepressant and may be associated with the driver’s prescribed medication escitalopram. (d) Dextromethorphan and its metabolite dextrorphan are cough medications. (e) The remaining four drugs detected in the urine are consistent with medications given during postcrash treatment at the hospital. 34 See the FAA laboratory data sheet on marijuana, accessed November 6, 2018. 35 See the US National Library of Medicine DailyMed sheet on clonazepam, accessed November 6, 2018. Druga,b Blood Test Result Description Delta-9-THC 7.1 ng/mL Primary active chemical in marijuana Clonazepam 0.05 mg/L Sedating benzodiazepine Doxylamine Detected (no quantification) Sedating antihistamine found in OTC and prescription products for cold and allergy

NTSB

Highway Accident Report 19 1.6.2.5 Precrash Activities. Table 5 presents a timeline of the truck driver’s activities on the day of the crash and 2 days prior. Table 5. Precrash activities of truck driver, March 27–29, 2017. Time Activity Source Monday, March 27 5:30 a.m. Awakes NTSB interview 6:23 First interaction with phone (outgoing text) Cell phone data 10:17 Works at Vanderpool ranch clearing land NTSB interview/cell phone data 3:00 p.m. Departs work NTSB interview 4:46 Arrives home Cell phone data 9:48 Last interaction with phone (outgoing text) Cell phone data 10:00 Goes to bed NTSB interview Tuesday, March 28 5:30 a.m. Awakes NTSB interview 6:09 Located in Vanderpool area Cell phone data 12:55 p.m. Located in Helotes area (northwest of San Antonio) Cell phone data 1:52 Located in San Antonio area Cell phone data 4:10 Located in Helotes area Cell phone data 5:18 Located in Medina area Cell phone data 6:34 Last interaction with phone (outgoing text) Cell phone data 10:00 Goes to bed NTSB interview Wednesday, March 29 5:30 a.m. Awakes NTSB interview 6:30–8:00 Departs Medina area Interview/cell phone data 9:25 First interaction with phone (outgoing call) Cell phone data 9:40 Located in Utopia area Cell phone data 9:58 Located in Rio Frio area Cell phone data 10:00 Located in Leakey area Cell phone data 11:03 Visits pharmacy in Uvalde Surveillance video N/A Visits restaurant in Uvalde NTSB interview N/A Drives around Uvalde NTSB interview 12:12 p.m. Located in Concan area Cell phone data 12:20 p.m. Crash Dispatch records

NTSB

Highway Accident Report 20 NTSB investigators examined cell phone data and surveillance video and interviewed the truck driver to determine his activities in the 2.5 days before the crash. On Tuesday, March 28, he went to bed around 10:00 p.m. On the following day—the day of the crash—he departed his residence in Medina between 6:30 and 8:00 a.m. He reached Leakey about 10:00 a.m. and then traveled south to Uvalde. Based on surveillance video footage, the driver visited a Uvalde pharmacy at 11:03 a.m. to pick up four prescriptions. After leaving the pharmacy, he stopped to get food before returning to Leakey. 1.6.2.6 Cell Phone Data. TxDPS troopers recovered the driver’s cell phone at the crash scene. In compliance with a search warrant, TxDPS conducted a forensic download of the phone to analyze its contents. A music application appeared when the phone was first turned on. The last recorded driver-initiated activities were the reading of a text at 11:25 a.m. and accessing music at 11:53 a.m. Further review and testing conducted by the NTSB showed that the driver may have manipulated his phone at 12:14 p.m. or switched to a different application at 12:19 p.m. Additionally, TxDPS recovered text messages, multimedia messages, photographs, videos, call logs, phone activity logs, contact information, and other data items. An examination of the cell phone contents indicated conversations regarding the purchase, sale, and trading of drugs for recreational use. Evidence from the driver’s cell phone also showed that he was misusing prescription medications and had plans to sell the clonazepam that he had picked up on the morning of March 29. 1.7 Highway Factors 1.7.1 Description and Characteristics The crash occurred about 6.5 miles north of Concan, on US-83—which is a two-lane roadway with an 11.5-foot-wide travel lane in each direction. In the vicinity of the crash site, double yellow line pavement striping delineates the travel lanes, indicating that the area is a no passing zone. Raised yellow pavement markers spaced at 42-foot intervals are located between the pavement stripes. The right shoulders are about 8 feet wide, and there are no alert grooves or longitudinal rumble strips and no centerline rumble strips.36 The collision occurred within a 1,432.7-foot radius curve, which is 1,445.4 feet long. The truck was traveling uphill in a northerly direction on an approximate 4 percent grade through the right-hand curve. The bus was traveling downhill in a southerly direction on a 4 percent grade, entering the left-hand curve. The superelevation, or bank, of the curve was 9.5 percent.

36 Other areas along US-83 have both centerline and longitudinal edgeline rumble strips. The Texas Department of Transportation (TxDOT) indicated that rumble strips were not warranted at the crash location because it had no accident history.

NTSB

Highway Accident Report 21 1.7.2 Traffic Volume and Speed The speed limit for US-83 through the curve is 70 mph. A 2014 speed survey conducted by TxDOT at four locations along US-83 showed that the 85th percentile speed ranged from 67 to 71 mph for vehicles traveling north and from 65 to 75 mph for vehicles traveling south.37 In 2016, the average daily traffic count was 2,726 vehicles. 1.7.3 Highway Signage and Stopping Sight Distance About 250 feet south of the crash site, a 60-mph warning sign alerts northbound traffic that the speed limit is reduced to 60 mph 950 feet ahead because of the entrances for Garner State Park. Work zone signs were posted in the area, but a scheduled pavement resealing project did not begin until April–May 2017 (see figure 10).

Figure 10. US-83 crash location, showing signage and sight distances. (Source: TxDPS)

37 The 85th percentile speed refers to the speed at or below which 85 percent of vehicles are traveling. Refer to the highway factors report in the NTSB public docket for this investigation (HWY17MH011) for information on speed survey locations and data.

NTSB

Highway Accident Report 22 On the vertical curve approaching the crash site from the north, TxDOT determined that the maximum sight distance for traffic on US-83 was 1,346 feet. The maximum sight distance for traffic from the south was 615 feet because of the vegetation and cut slope along the east side of the highway. For a 70-mph design speed highway at this location, the required stopping distance is 706 feet.38 Upon evaluating the sight distance at this location with NTSB investigators, TxDOT posted an additional 60-mph advisory speed warning sign in May 2017. 1.7.4 Crash History NTSB investigators evaluated crash history data provided by TxDOT for a 6-mile segment of US-83 (3 miles north and 3 miles south of the crash site) from 2012 to 2016. Of 31 crashes, 22 were property damage only, eight were injury crashes, and one was a run-off-the-road fatal crash. No other fatal head-on collisions occurred during this 5-year period. 1.8 Weather and Illumination Historical data from the weather station at Garner Field airport in Uvalde, about 27 miles south of the crash site, indicate that—on March 29, 2017, at 12:15 p.m.—the weather was clear, the temperature was 76.5°F, and the wind was from the west at 8 mph. According to the National Oceanic and Atmospheric Administration solar calculator, at 12:20 p.m. at the crash location, the sun was at an angle 120° of true north, with a 47° elevation in the sky.

38 The American Association of State Highway and Transportation Officials defines stopping sight distance as the distance required for a vehicle with a driver’s eye height of 3.5 feet to detect a 2-foot-tall object in the lane and brake to a stop on wet pavement. The perception–reaction time is calculated as 2.5 seconds, and the deceleration rate is assumed to be 0.34 g.

NTSB

Highway Accident Report 23 2 Analysis 2.1 Introduction The Concan crash involved a 2007 Dodge Ram 3500 pickup truck and a 2004 Ford E350 medium-size bus. The 20-year-old truck driver, traveling on US-83 north near the end of a right-hand curve, departed the travel lane, crossed the centerline into the southbound lane, and collided with the bus. As a result of the crash, the bus driver and 12 bus passengers were fatally injured. The driver of the truck and one bus passenger were seriously injured. This analysis discusses the dynamics of the crash (section 2.2) and evaluates the following: • Truck driver performance (section 2.3) • Drug-impaired driving countermeasures (section 2.4) • Medium-size bus seat belt systems (section 2.5). Following a comprehensive review of the circumstances that led to the Concan crash, the NTSB established that the following factors did not contribute to the cause of the crash: • Driver qualifications and familiarity with vehicle and roadway: Both drivers were properly licensed and were familiar with their vehicles and the US-83 operating environment. • Medical condition or fatigue of the bus driver: The bus driver had several ailments that were controlled with diet, exercise, and oral medication. He also had a history of OSA, for which he was prescribed a continuous positive airway pressure device that he found to be uncomfortable. Although the driver suffered from OSA, there was no evidence that it impaired his ability to operate the bus at the time of the crash. According to those who accompanied the bus driver to the Alto Frio Baptist camp, he had had an adequate sleep opportunity the night before the crash. Untreated OSA can result in sleep loss, regardless of sleep opportunity, and may cause daytime sleepiness and lapses in attention. Nevertheless, based on statements from witnesses who were traveling behind the bus and had followed it through a series of vertical and horizontal curves, there was no evidence of the driver’s inability to operate the bus. Witnesses stated that the bus traveled at a reasonable speed and stayed within its lane. Based on witness statements and limited line of sight, the intrusion of the truck into the path of the bus allowed no time for the bus driver to take evasive action. • Bus driver cell phone distraction: There was no evidence that the bus driver was distracted by the use of his cell phone at the time of the crash (12:20 p.m.). According to records obtained from his cell phone provider, the last interaction he had with his phone was at 9:05 a.m. on March 29.

NTSB

Highway Accident Report 24 • Bus driver impairment by alcohol or other drugs: Toxicology testing found no evidence that the bus driver was impaired by alcohol or other drugs. • Vehicle mechanical condition: NTSB investigators found no evidence of mechanical problems with the truck or the bus that would have contributed to the crash. Although the truck driver stated that there was “excessive play” in the steering, an examination concluded that the steering gear was mechanically functional and free of defects. • Highway condition: An examination of the highway environment revealed no safety deficiencies that would have contributed to the crash. US-83 has no centerline rumble strips at the crash location, which could have alerted the truck driver that he was crossing into the opposing travel lane. However, review of the 14-minute 27-second video of the truck as it traveled from Uvalde to Leakey revealed numerous centerline rumble strips at other locations—which failed to alert the driver and result in corrective action. • Weather: The weather was clear, there was no sun glare or precipitation at or near the time of the crash, and the roadway was dry. The NTSB, therefore, concludes that none of the following were factors in the crash: (1) bus or truck driver qualifications or familiarity with vehicles and roadway, (2) medical condition or fatigue of the bus driver, (3) bus driver cell phone distraction, (4) bus driver impairment by alcohol or other drugs, (5) mechanical condition of either vehicle, (6) highway condition, or (7) weather. Almost immediately following the crash, medical personnel in an EMS ambulance stopped at the scene to render aid. They reported numerous fatalities and entrapments. A multiagency response consisted of 16 local and state emergency service agencies. The rural location of the crash site required about a 30-minute travel time for the majority of responding agencies. Although extrication of the injured was prolonged due to the extent of intrusion and deformation of the vehicles, the delay did not contribute to the severity of the injuries. The NTSB concludes that considering the rural location of the crash, the emergency response efforts were timely and adequate. 2.2 Crash Discussion 2.2.1 Precrash Video Evidence Witnesses following the truck recorded a 14-minute 27-second video that was reviewed by NTSB investigators. For much of the precrash video, the truck straddles the edgeline and rarely travels within the lane markings. In addition, the truck crosses the yellow centerline 19 times and is fully in the opposing lane of travel at least once (see figure 11). When the truck crosses the edgeline or the centerline of the roadway (even those portions milled with rumble strips), the driver exhibits no quick corrective action. Instead, he either continues his path across the lane markings, straddles the markings for an extended time, or slowly recovers back into the travel lane.

NTSB

Highway Accident Report 25

Figure 11. Still image of truck traveling north in opposing US-83 south lane at time 6:32 of witness video. Video evidence shows the truck driver appearing to make slow steering corrections to avoid other vehicles. A few vehicles traveling in the opposite direction are forced to make avoidance maneuvers, such as driving on the shoulder. 2.2.2 Crash Description Witnesses observed the truck cross up to two-thirds into the southbound travel lane. The tire marks deposited on the roadway and vehicle damage patterns indicated a collinear, offset impact (see figure 12). The relative frontal overlap for both vehicles was about 47 percent. Following the impact, both the truck and the bus rotated counterclockwise, with some southward movement in the bus’s original direction of travel.

Figure 12. Diagram showing approximate orientation of truck and bus at point of impact.

NTSB

Highway Accident Report 26 Based on witness statements and video evidence, coupled with roadway physical evidence and vehicle damage profiles, the NTSB concludes that the truck driver operated his vehicle erratically on US-83 for more than 15 minutes, including extended periods of travel off the right road edgeline and multiple incursions across the highway centerline—which culminated in a head-on crash in the opposing lane of travel. 2.3 Truck Driver Performance NTSB investigators reviewed the human factors that may have caused the truck driver’s sustained erratic driving behavior. Cell phone distraction, fatigue, medical impairment, and impairment by alcohol and other drugs were reviewed, among other factors. 2.3.1 Distraction Immediately following the crash, the truck driver told witnesses that he had been texting, and he later told investigators that he was checking his cell phone to see if anyone had called him. A forensic examination of his phone by TxDPS showed that the last recorded driver-initiated activities were accessing a text at 11:25 a.m. and a music application at 11:53 a.m. (27 minutes precrash). NTSB testing showed that the driver may also have manipulated his phone at 12:14 p.m. or switched to a different application at 12:19 p.m. No forensic evidence indicated that he was in the act of composing a text or placing a call just before the crash. Therefore, the NTSB concludes that it is possible that the truck driver was glancing at or manipulating his cell phone at the time of the crash, but this action would not explain the prolonged and continuous erratic driving behavior seen in the witness video recording leading up to the crash. 2.3.2 Fatigue Based on the truck driver’s statements to NTSB investigators, he usually went to bed at 10:00 p.m. and awoke at 5:30 a.m.—which provides about 7.5 hours of sleep opportunity.39 The driver indicated no difficulty sleeping at night. He took a prescribed sleep medication, zolpidem, to assist in his rest. His driving behavior leading up to the crash was not characteristic of a sleep-deprived motor vehicle operator. Sleep deprivation is generally characterized by noncontinuous lapses in performance, which increase in frequency with sleep loss (Doran, Van Dongen, and Dinges 2001). In addition, sleep-deprived subjects who encounter roadway rumble strips have been found to experience increased alertness, resulting in a temporary reduction in lateral lane deviations (Anund and others 2008). By contrast, the driving behavior of the truck driver suggests a constant state of impairment. During the occasions when the truck crossed the edgeline or centerline of the roadway milled with rumble strips, the driver did not take timely corrective action or temporarily reduce lateral lane deviation, as would be expected from a sleep-deprived driver.

39 A review of cell phone records showed a lack of activity during the times the driver reported that he was asleep.

NTSB

Highway Accident Report 27 Although sleep deprivation does not appear to have contributed to the crash, section 2.3.5, on drug impairment, discusses the sedative effects of marijuana, benzodiazepines, and other drugs that may have contributed to the crash. 2.3.3 Medical Impairment The truck driver had an active diagnosis of depression and PTSD, which were treated with the medications escitalopram, prazosin, and clonazepam. His last documented evaluation for these conditions was on November 14, 2016, when the psychiatrist noted that the driver was doing well on the current medical treatment and was not a danger to himself or others. During postcrash interviews with the driver, he described no current problems with depression or PTSD and made no mention of feeling suicidal. Although the driver was not wearing glasses at the time of the crash, his uncorrected distance visual acuity of 20/50 in the right eye and 20/40 in the left eye would not have caused the sustained reckless driving. 2.3.4 Alcohol Impairment The FAA laboratory conducted forensic toxicology testing of a blood specimen collected from the truck driver at 2:20 p.m. on the day of the crash.40 No ethanol was detected in the sample. Additionally, there was no evidence to suggest that the driver had consumed alcohol before the crash. Based on the review of his sleep opportunity, medical condition, and toxicology results, the NTSB concludes that the truck driver was not sleep deprived, impaired by a medical condition, or impaired by alcohol at the time of the crash. 2.3.5 Drug Impairment 2.3.5.1 Marijuana. During an inspection of the truck following the crash, TxDPS troopers found two unburned marijuana joints, the remains of five partially smoked marijuana joints, and a package of rolling papers. Toxicology testing conducted by both TxDPS and the FAA laboratory detected THC at 7.1 ng/mL in a blood sample collected 2 hours postcrash. As discussed in section 1.6.2.4, THC is the primary potentially impairing psychoactive chemical found in marijuana. Concentrations of THC vary depending on the potency of the marijuana and the way the drug is used; however, peak plasma concentrations of 100–200 ng/mL are routinely encountered shortly after smoking (NHTSA 2004). Plasma concentrations of THC decline rapidly and are often less than 5 ng/mL within 3 hours of ingestion (NHTSA 2004). Although the half-life of THC varies significantly based on frequency of use and body physique, controlled studies demonstrate that detectable THC blood levels decrease by an average of 90.3 percent from their maximum levels within 1.4 hours of last use (Hartman and others 2016).41 It is likely that the driver’s THC

40 Toxicology testing included more than 1,300 substances; see the FAA WebDrugs website for a complete listing, accessed November 6, 2018. 41 Half-life refers to the amount of time it takes the body to eliminate half of the concentration of a substance in the blood—in this case, THC.

NTSB

Highway Accident Report 28 level at the time of the crash was higher than the 7.1 ng/mL detected in his blood 2 hours postcrash. However, NTSB investigators could not determine when he last smoked marijuana, and the exact level of THC in his blood cannot be back-calculated. Marijuana can affect the cognitive and motor skills critical to driving, such as vigilance, drowsiness, time and distance perception, reaction time, lane tracking, and coordination (Capler and others 2017; NHTSA 2017b; Strand, Gjerde, and Morland 2016). Simulator studies of the effects of marijuana on driving have found that drivers with an average THC level of 13 ng/mL demonstrated lane weaving similar to that of drivers impaired by alcohol at a blood alcohol concentration (BAC) of about 0.08 gram per deciliter (g/dL; Hartman and others 2015). 2.3.5.2 Clonazepam. The TxDPS laboratory detected 50 micrograms per liter (µg/L) of clonazepam in the truck driver’s blood collected 2 hours postcrash. Because clonazepam metabolizes relatively slowly in the body (half-life ranges from 19 to 60 hours), the driver’s blood level of 50 µg/L was likely only slightly higher at the time of the crash.42 The prescription drug clonazepam is a potent sedative in the benzodiazepine class. It is commonly used to treat seizure disorders and panic disorder. Benzodiazepines can cause addiction after chronic clinical treatment and are often abused as a recreational drug (Tan, Rudolph, and Luscher 2011). Clonazepam carries the following warning: Since clonazepam produces CNS depression, patients receiving this drug should be cautioned against engaging in hazardous operations requiring mental alertness, such as operating machinery or driving a motor vehicle. They should be warned about the concomitant use of alcohol or other CNS-depressant drugs during clonazepam therapy.43 The most common side effects include dizziness, drowsiness, fatigue, problems with walking and coordination, depression, and problems with memory. As reported by Jones, Holmgren, and Kugelberg (2007), the average blood level of clonazepam found in 164 people arrested for drug-impaired driving was 50 µg/L—equal to the driver’s clonazepam blood level 2 hours postcrash. Epidemiological studies have consistently shown that benzodiazepines, such as clonazepam, are associated with an increased crash risk, with one meta-analysis reporting an increased risk of 1.6–1.8 times that of controls (Dassanayake and others 1998). Simulator studies have noted impaired behavior in drivers shortly after ingestion, with impairment continuing up to 3 weeks with certain types of benzodiazepines (Van Laar, Volkerts, and Van Willigenburg 1992). Among the behaviors noted are increased lane deviations, increased brake reaction times, tracking errors, and collisions. Evidence acquired during the investigation determined that the truck driver routinely misused prescription medication by not taking it as prescribed.44 Postcrash, he told a TxDPS

42 See the FAA laboratory data sheet on clonazepam, accessed November 6, 2018. 43 See the US National Library of Medicine DailyMed sheet on clonazepam, accessed November 6, 2018. 44 “Misuse” applies to taking a medication in a manner or dose other than prescribed, taking someone else’s prescription, or taking a medication to feel euphoria.

NTSB

Highway Accident Report 29 trooper that he had taken two clonazepam pills an hour earlier. (Two pills [2 milligrams] amount to double the prescribed dosage.) The driver admitted that the medication made him drowsy; furthermore, irregular use of clonazepam can increase adverse side effects. Additionally, text messages reviewed by NTSB investigators showed that the driver was trading and selling his prescribed medications. 2.3.5.3 Polysubstance Use. Clonazepam and marijuana (THC) are potent CNS depressants. Each drug enhances the depressant effects of the other and increases the risk of driver impairment.45 The driver’s poor control of his truck for the 15 minutes immediately before the crash provides evidence of significant impairment. His blood tested positive for THC, the active impairing compound in marijuana; and clonazepam was detected 2 hours postcrash at levels consistent with impairment. Additionally, the effects of clonazepam were likely exacerbated by the driver taking double the prescribed dose. Therefore, the NTSB concludes that the failure of the truck driver to maintain control of his vehicle was due to impairment stemming from his use of marijuana in combination with misuse of a prescribed medication, clonazepam. 2.4 Drug-Impaired Driving Countermeasures Drug-impaired driving, also known as driving under the influence of drugs (DUID), refers to the operation of a motor vehicle while under the influence of or impaired by a psychoactive drug (including illicit substances, prescription medications, OTC medications, or a combination of substances and alcohol). Reversing the drug-impaired driving problem is particularly challenging due to the large number of substances with the potential to affect driving and increase crash risk, the variations in how drugs impair driving, the relative lack of information on potentially impairing drugs, and the differences in the ways that drugs can affect the body and behavior. Vigorous enforcement is required to promote deterrence and to prevent crashes due to drug-impaired driving. Sections 2.4.1 through 2.4.3 examine measures to improve the detection of drug-impaired drivers and discuss the need for additional leadership at the local, state, and national levels to appropriately allocate limited resources, develop data-driven strategies, and identify effective countermeasures. 2.4.1 Detection of Drug-Impaired Drivers Traffic law enforcement can influence driving behavior through both general and specific deterrence (NHTSA 2006). Central to the theory of general deterrence are assumptions about how drivers perceive the risk of engaging in prohibited behaviors. If drivers believe that impaired driving is likely to be detected and lead to arrest, many will choose not to drive while impaired. Specific deterrence relates to the individual experiences of those who have committed a crime and the type of punishment levied to discourage future criminal activity. Unfortunately, many drivers do not consider DUID a risk and perceive the likelihood of arrest as low (Holmes, Van Laar, and Robertson 2014). Some drivers assume that there is no accurate means to test for drugs such as marijuana during roadside enforcement stops.

45 See the Lexicomp Online database for clonazepam and THC, accessed November 6, 2018.

NTSB

Highway Accident Report 30 When someone is stopped by law enforcement, it is up to the officer to determine whether the individual is impaired. However, many officers are not sufficiently trained to identify the signs and symptoms of driver impairment when illicit, prescription, or OTC drugs are involved (GAO 2015).46 Compared to identifying drivers operating under the influence of alcohol, identifying drug impairment is much more complicated because of the large number of drugs and their unpredictable effects. Additionally, accurate roadside drug screening devices are not as widely developed or used as roadside test equipment for enforcing alcohol-impaired driving restrictions, such as portable breath test devices. 2.4.1.1 Law Enforcement Training. In the 4 years before the Concan crash, the truck driver interacted with law enforcement a minimum of eight times. In January 2015, he was involved in a police-determined at-fault collision in which he crossed into an opposing lane of traffic and crashed into an oncoming vehicle. In January 2017, he was stopped for equipment violations on two occasions; when the officer observed signs of nervousness, he conducted a consensual search of the truck. No contraband was located, and the driver was released with a warning. Neither the officer investigating the January 2015 collision nor the officer involved in the two January 2017 enforcement stops had advanced training in the recognition of drug-impaired drivers.47 Three tiers of training focus on educating law enforcement officers on the detection of impaired drivers: • The basic training is the standardized field sobriety testing (SFST) protocol, which trains officers to identify and assess drivers suspected of being under the influence of alcohol. Since 2005, all law enforcement officers in Texas receive SFST during their basic academy training (Ennis and others 2015). • The ARIDE (advanced roadside impaired driving enforcement) program, developed by NHTSA, was created to bridge the gap between SFST and a more advanced drug recognition program. This 16-hour curriculum trains officers to observe, identify, and articulate the signs of impairment related to alcohol and other drugs. Between 2009 and 2016, about 10.6 percent of officers nationwide (70,479 of 663,390) received ARIDE training (IACP 2017).48 ARIDE penetration varies considerably, from most officers in some states to only a few in others (GHSA 2017). As of 2016, less than 5 percent of officers in Texas (3,079 of 63,380)—from the 2,690 entities that patrol

46 The US Government Accountability Office (GAO) found that state prosecutors and highway safety officials reported a lack of knowledge among law enforcement officers about drug impairment in drivers. NHTSA, the Governors Highway Safety Association (GHSA), and the International Association of Chiefs of Police (IACP) maintained that the basic training on impaired driving enforcement is insufficient for identifying drivers who may be impaired by drugs. 47 The level of training for law enforcement officers involved in the other interactions was not investigated. 48 Information on the number of officers was obtained from the US Bureau of Labor Statistics employment data for police and sheriff patrol officers.

NTSB

Highway Accident Report 31 the state’s extensive roadway system—have been ARIDE trained (Ennis and others 2015; IACP 2017).49 • The international drug evaluation and classification (DEC) program, developed by the IACP and NHTSA, trains officers to become expert in identifying the signs and symptoms of impairment by various categories of drugs.50 This program includes 72 hours of classroom training and 40–60 hours of field training. Law enforcement officers who complete the DEC program are certified to perform a 12-step evaluation protocol to assess subjects for drug impairment, which includes psychophysical tests and physical examinations. DREs are highly skilled in the detection and identification of drug impairment. Many courts will accept a DRE-trained officer as an expert witness on behalf of the prosecution. Much of the success of a DRE program depends on well-trained officers with strong SFST and ARIDE skills referring potentially impaired drivers for evaluation. As of 2016, about 1.2 percent (8,277 of 663,390) of all officers in the United States were trained as DREs (IACP 2017). The state of Texas offers DRE basic certification training three times a year. As of 2016, 410 officers statewide were certified (0.65 percent of Texas law enforcement officers).51 During calendar year 2016, these 410 officers completed 1,008 DRE evaluations—an average of 2.5 evaluations per certified officer (IACP 2017).52 In 2015, the state evaluated its impaired driving program and found that the distribution of DREs failed to provide adequate statewide coverage (Ennis and others 2015). Only 99 of the state’s 2,690 law enforcement agencies have certified DREs, with over 58 percent of those personnel assigned to city police departments (IACP 2017).

49 In 2016, the state of Texas held 21 ARIDE classes, training 452 officers. By comparison, in 2016, the state of California held 107 classes, training 1,638 officers (IACP 2017). 50 The Los Angeles Police Department originated this program in the early 1970s. A decade later, NHTSA began working with Los Angeles officials to develop DRE protocols, which led to the establishment of an international DEC program. See the IACP webpage on the DEC program, accessed November 6, 2018. 51 In a recent state survey on drug-impaired driving, Texas responded that “Every stakeholder is aware of the need for more DREs. The chief impediment is that there is no police agency in Texas that is not strained to the breaking point for personnel resources. The DRE program training requires massive time away for personnel, the best and most productive personnel.” (Fell, Kubelka, and Treffers 2018). 52 For comparison, Pennsylvania has 179 DREs, who conducted 1,822 evaluations in the same time frame; Oregon: 211 DREs, 1,810 evaluations; Arizona: 294 DREs, 787 evaluations; New Jersey: 426 DREs, 1,589 evaluations; and California: 1,589 DREs, 7,367 evaluations.

NTSB

Highway Accident Report 32 2.4.1.2 Roadside Drug Testing. Several companies offer oral fluid drug screening devices to assist law enforcement in obtaining a preliminary indication of whether a laboratory toxicology test will likely yield a positive result for classes of drugs.53 Point-of-contact drug testing devices can provide objective and scientific evidence similar to breath test devices for alcohol detection. The use of onsite oral fluid screening devices might prompt law enforcement officers to further investigate a driver for drug impairment. Oral fluid devices detect the presence of classes of drugs (such as marijuana, stimulants, amphetamines, and sedatives) rather than specific individual drugs. A positive roadside oral fluid test can be used as evidence to support a request for blood testing to definitively identify potentially impairing drugs. A rapid screening test, followed by timely blood testing, reduces the chance that the intoxicating drug will be lost to the body’s metabolism. Several oral fluid drug screening devices are now available. Field tests have demonstrated that these devices could be a valuable tool for detecting drug use among drivers; however, their overall performance varies based on type of device and drug classes tested for (Kelley-Baker and others 2014; Beirness and Smith 2017; Logan, Mohr, and Talpins 2014).54 NHTSA recently completed research on the accuracy, reliability, sensitivity, and specificity of these devices but has not yet released its results (NHTSA 2017b). To reduce alcohol-impaired driving, NHTSA has established model specifications for testing devices, including evidential breath alcohol measurement devices, screening devices to measure alcohol in bodily fluids, and calibrating units for breath alcohol testers. NHTSA maintains a conforming products list for the devices that meet these specifications.55 Due to the relatively recent availability of oral fluid drug screening devices, no model specifications for roadside drug testing equipment have been developed; and NHTSA offers no best practices guidance. NHTSA-developed specifications and guidance—and the creation of a conforming products list—would hasten the widespread implementation of equipment to improve the detection of drug-impaired drivers. 2.4.1.3 Safety Recommendations. The NTSB concludes that to better detect drivers operating under the influence of drugs, law enforcement officers need advanced training to identify the signs and symptoms of impairment as well as additional tools, such as roadside drug screening devices. After examining available roadside testing equipment, the NTSB concludes that oral fluid drug screening devices can improve the ability of law enforcement officers to detect drug- impaired drivers. Although some states have engaged in pilot programs to test the reliability of roadside oral fluid drug screening devices, widespread implementation of the equipment is unlikely without NHTSA support. Therefore, the NTSB recommends that NHTSA develop and

53 As of April 2018, 10 states—Arizona, California, Colorado, Kansas, Massachusetts, Michigan, Nevada, Oklahoma, Vermont, and Wisconsin—report that they have engaged in pilot programs on the use of oral fluid screening devices to detect drugs during enforcement contacts (Fell, Kubelka, and Treffers 2018). 54 Some of the field studies were funded by the manufacturers of oral fluid drug screening devices. 55 See the NHTSA webpage on alcohol measurement devices and calibration units, accessed November 6, 2018.

NTSB

Highway Accident Report 33 disseminate best practices, identify model specifications, and create a conforming products list for oral fluid drug screening devices. The IACP and NHTSA continue to develop, promote, and evaluate the DEC and ARIDE programs and have been increasing training opportunities across the United States. However, based on a review of data for ARIDE- and DRE-trained officers in Texas, only a small percentage of officers have received advanced training in the detection of drug impairment. The Texas Highway Safety Office, managed by TxDOT, serves as the lead agency for overall program management of the state’s highway safety program. The office assess municipal, county, and statewide needs; awards traffic safety grants to local government agencies; and funds impaired driving programs.56 Thus, the NTSB recommends that TxDOT promote the importance of attending drug-impaired driving enforcement training and increase training access to meet the demands of local and state law enforcement. 2.4.2 Texas Impaired Driving Data and Countermeasures 2.4.2.1 State Impaired Driving Data. Texas is the second most populous and largest state in the contiguous United States. In 2015, the state had 24 million registered vehicles and more than 15.8 million licensed drivers (TxDOT 2017). NTSB investigators reviewed 2015 Fatality Analysis Reporting System (FARS) data in an effort to determine the extent of the drug-impaired driving problem in Texas.57 In 2015, there were 453 fatally injured drivers with a positive drug test result, accounting for 47 percent of all fatally injured drivers with a valid test result.58 In addition, Texas ranks fifth in the nation in the rate of alcohol-related fatalities per vehicle miles traveled. Thirty- eight percent (1,323) of the state’s total traffic fatalities (3,516) involved an alcohol-impaired driver with a BAC of 0.08 g/dL or higher (TxDOT 2017).59 2.4.2.2 State Drug-Impaired Driving Laws. The Texas Penal Code 49.04 defines “driving while intoxicated” as committing an offense if a person is intoxicated while driving a motor vehicle in a public place. State code defines “intoxication” as not having the normal use of mental or physical faculties by reason of the introduction of alcohol, a controlled substance, a drug, a dangerous drug, a combination of two or more of those substances, or any other substance into the body. State highway safety plans address alcohol and other drug countermeasures together, and data are often comingled. 2.4.2.3 State Highway Safety Plans. Each year TxDOT submits a highway safety plan to NHTSA, outlining strategic safety goals, emphasis areas, countermeasure strategies, and performance targets for the coming year. The plan qualifies the state for federal grant money in

56 In fiscal year 2018, TxDOT awarded more than $866,000 for impaired driving training courses. 57 FARS data indicate the presence of drugs; they do not indicate if a driver was impaired by a drug at the time of a crash. 58 See the supplemental data report on drug involvement in fatal crashes (2006–2015) in the NTSB public docket for this investigation (HWY17MH011). 59 It is difficult to determine the number of alcohol-impaired drivers who were also impaired by drugs because of a low testing rate. In Texas, less than 25 percent of all drivers involved in fatal crashes are tested for drugs.

NTSB

Highway Accident Report 34 support of national highway safety goals to reduce motor vehicle-related fatalities (TxDOT 2017). In addition to the annual highway safety plan, TxDOT submits a multiyear strategic highway safety plan (SHSP) to the Federal Highway Administration (FHWA), which establishes statewide goals and objectives. Establishing safety performance targets is a critical and required element of highway safety plans. The FHWA gives states the flexibility to use the target-setting methodology they deem most appropriate—encouraging states to review data sets and trends and to set realistic and attainable goals.60 In the SHSP for 2017–2022, the first sentence acknowledges that “Texas is facing a crisis in road safety.” The SHSP states: “Texas envisions a future with zero traffic fatalities and serious injuries” (TxDOT 2016). Texas planners determined that targets should reflect a realistic assessment of the likely amount of exposure (vehicle travel) and population growth. As such, they set what they considered to be “realistic” performance targets rather than “aspirational” goals. The projected targets in the highway safety plan and the SHSP reflect an increase in the total number of traffic-related fatalities, traffic-related serious injuries, impaired driving fatalities, and rate of alcohol-related driving deaths per vehicle miles traveled (see table 6).61 The SHSP projects that the rate will continue to rise, stating: “Unless significantly more resources are put toward countermeasures, it is unrealistic to believe this plan alone can significantly affect risk.”62 Table 6. Texas highway safety plan and SHSP projections for traffic-related and impaired driving fatalities and for traffic-related serious injuries in 2022. FARS Outcome Data 2015 Total 2022 Projection 2022 Target Traffic-related fatalities 3,516 4,327 4,241 Traffic-related serious injuries 17,096 19,454 19,065 Impaired driving fatalities 1,323 1,653 1,620 Rate of alcohol-related driving fatalities per 100 million vehicle miles traveled 0.51 0.58 0.57

60 See the FHWA webpage on safety performance management, accessed November 6, 2018. 61 The SHSP describes the strategy as realistic and based on the premise that casualties are predominately the result of exposure to risk. Assumptions are that economic conditions will continue to reflect a growing economy, gas prices will not rise significantly, and motor vehicle crashworthiness and safety features will not significantly reduce risk. Targets reflect a 2 percent reduction against the current upward trend projections. 62 NHTSA data for calendar year 2016 show that impaired driving fatalities in Texas increased to 1,438, representing 38 percent of the state’s 3,776 total fatalities. Nationwide, the percentage of alcohol-related driving fatalities is 28 (NHTSA 2017a).

NTSB

Highway Accident Report 35 In examining impaired driving arrests between 2012 and 2016, the state found a steady decline in arrests during grant-funded enforcement activities. Figure 13, extracted from the impaired driving section of the highway safety plan, shows the downward trend in arrests during such enforcement activities (TxDOT 2017). The plan reports that the state “will attempt to reverse this trend creating an increase in impaired driving arrests.”

Figure 13. Impaired driving arrests during funded enforcement activities, 2012–2016. (Source: TxDOT) With the fatality rate and impaired driving fatalities increasing, and the number of impaired driving arrests decreasing, the highway safety plan has established a number of goals and strategies to address the problem of alcohol and other drugs (see appendix D). 2.4.2.4 State Impaired Driving Program Assessment. In 2015, Texas requested NHTSA assistance in assessing its alcohol- and other drug-impaired driving countermeasure program (Ennis and others 2015). The assessment examined program management and strategic planning, prevention, criminal justice, communication, misuse of alcohol and other drugs, and program evaluation. Shortcomings and deficiencies in leadership, resources, and training were identified. Appendix E—which consists of excerpts from the NHTSA-funded highway safety plan— summarizes the 65 recommendations made by the assessment team and the ongoing actions of the Texas impaired driving task force and other stakeholders (TxDOT 2017). 2.4.2.5 Safety Recommendations. The NTSB acknowledges the efforts of strategic planners, Texas law enforcement, advocacy groups, and other stakeholders toward resolving the impaired driving problem. However, based on the SHSP-projected increases in fatalities, injuries, and crashes, additional action is needed. The assessment of the state alcohol- and other drug-impaired driving countermeasure program identified numerous deficiencies (Ennis and others 2015). One recommendation calls for additional engagement by the governor’s office and the state legislature. Leadership from the top and a commitment to safety are needed to reverse the statewide trend of increasing fatalities and injuries due to impaired drivers. The NTSB concludes that the state of Texas needs increased safety-focused leadership at the governor and state legislature level, additional resources, and data-driven strategies to prevent

NTSB

Highway Accident Report 36 tragedies such as the Concan crash and to reduce the number of fatalities and serious injuries caused by alcohol- and other drug-impaired drivers. Using the 2015 impaired driving program assessment as a resource, the NTSB recommends that the state of Texas conduct an executive-level review of its impaired driving program and implement data-driven strategies that result in a downward trend in the number of fatalities, injuries, and crashes involving alcohol- and other drug-impaired drivers. 2.4.3 National Efforts 2.4.3.1 The Problem. Nationwide, the use of legal and illicit drugs is increasing among drivers. FARS identified the presence of drugs in 30 percent of fatally injured drivers with valid drug test results in 2006, in 37 percent in 2009, and in 46 percent in 2015.63 In a 2013–2014 national roadside survey, NHTSA tested more than 9,400 drivers for alcohol and other drugs at 300 locations across the United States (NHTSA 2015). The study focused on drugs with the potential to impair driving skills, including OTC, prescription, and illegal drugs. Potentially impairing drugs were found in 22 percent of all drivers tested.64 In its survey of nighttime weekend drivers, NHTSA found that 15.2 percent of the drivers tested had illegal drugs in their systems, and 7.3 percent had prescription or OTC medications that could impair their driving. The prevalence of drugs in drivers had increased significantly from a similar roadside survey conducted in 2007 (NHTSA 2009). For example, illegal drug use increased from 12.4 percent in 2007 to 15.2 percent in the 2013–2014 survey. Marijuana use increased from 8.6 percent in 2007 to 12.6 percent in 2013.65 2.4.3.2 Drug Toxicology Testing. Postcrash drug toxicology testing is inconsistent among the states. There is currently no national guidance on a minimum set of drugs that should be tested for, recommended methods for drug testing, or reporting thresholds for crash databases. Collecting consistent postcrash drug data will provide policymakers with a better understanding of the prevalence of drug use among drivers, as well as the tools with which to assess the risks associated with various substances. National guidance would provide a more reliable marker of the effectiveness of laws, enforcement, education, and other countermeasures in addressing drug-impaired driving. As a result of the NTSB forum on “reaching zero” crashes from substance-impaired driving, we recommended that NHTSA (NTSB 2013): Develop and disseminate to appropriate state officials a common standard of practice for drug toxicology testing, including (1) the circumstances under which

63 See the supplemental data report on drug involvement in fatal crashes (2006–2015) in the NTSB public docket for this investigation (HWY17MH011). 64 The national roadside survey was a voluntary and anonymous study. Data collectors asked participants for a breath test, an oral fluid sample, and a blood sample. Specimens were tested for 98 illegal, prescription and OTC drugs with the potential to impair driving. 65 The presence of drugs does not necessarily mean that a driver is impaired. The lack of a clear link between impairment and drug concentrations makes it difficult to define impairment. Some drugs or metabolites may be present at low levels or remain in the body for days/weeks without any impairing effects.

NTSB

Highway Accident Report 37 tests should be conducted, (2) a minimum set of drugs for which to test, and (3) cutoff values for reporting the results. (H-12-33) NHTSA has informed the NTSB that it is developing a recommended standard of practice for drug toxicology testing. In 2016, NHTSA provided support for the review and update of a set of recommendations developed by the National Safety Council–Alcohol, Drugs, and Impairment Division for toxicological investigation of drug-impaired driving cases and motor vehicle fatalities (Logan and others 2018). In 2018, NHTSA formed an expert working group focused on toxicology and data collection (see also section 2.4.3.5). Safety Recommendation H-12-33 is classified “Open—Acceptable Response.” 2.4.3.3 GHSA Actions. The GHSA recently updated its guidance to assist states in managing the drug-impaired driving problem (GHSA 2017). The guidance covers laws, enforcement, adjudication, toxicology testing procedures, education, and data collection. A recent GHSA report examines the impact of marijuana and opioid use on driving and crash causation, and recommends state actions to address drug-impaired driving (GHSA 2018). Although the NTSB is pleased with these GHSA initiatives, state actions should be closely monitored to identify the most effective practices and countermeasures. 2.4.3.4 AAA-Sponsored Research. Section 2.3.5 (drug impairment) discusses the dangers of DUID, including the impairing effects of many prescription medications. The AAA Foundation for Traffic Safety, through the Virginia Tech Transportation Institute, sponsored a major research project on drug-impaired driving countermeasures. The project report, Countermeasures Against Prescription and Over-the-Counter Drug-Impaired Driving, is scheduled for release in October 2018. As another resource for states, researchers, and practitioners, the report discusses drug-impaired driving countermeasures in four major areas: pharmacy and medical, data recording and toxicology, law enforcement and judicial, and education and advertising. 2.4.3.5 National Leadership. Many states and local jurisdictions have developed legislation and policy and implemented countermeasures to address the increasing prevalence of drug-impaired driving. Moreover, highway safety organizations such as GHSA and AAA have developed related reports and recommended specific countermeasures. Again, however, it is critical that the effectiveness of state laws and countermeasures be closely monitored to identify and disseminate best practices. In January 2018, NHTSA introduced an initiative to combat drug-impaired driving. Responding to the national opioid epidemic and the decriminalization of marijuana in many states, NHTSA announced that a top priority of the agency was to ensure that “U.S. roads, communities and families are safe from impaired drivers.” A March 2018 call-to-action campaign brought together key stakeholders, safety partners, data and policy experts, law enforcement and criminal justice professionals, toxicologists, and drug experts. Summit participants agreed on the urgent need for a coordinated plan to address the drug-impaired driving problem. NHTSA committed to

NTSB

Highway Accident Report 38 seeking additional input through a series of regional meetings and to working closely with stakeholders in developing an action plan.66 When states develop highway safety plans, they frequently refer to Countermeasures That Work: A Highway Safety Countermeasure Guide for State Highway Safety Offices to address critical safety issues, such as combating impaired driving (NHTSA 2018). Although the guide contains extensive information on countermeasures to reduce alcohol-impaired driving (including prevention, intervention, communication, and outreach campaigns), it includes relatively few science-based safety countermeasures to address drug-impaired driving. Through continued collaboration with stakeholders, NHTSA could provide a valuable resource to states by identifying those countermeasures proven to be the most effective in reducing drug-impaired driving. 2.4.3.5 Safety Recommendations. The NTSB concludes that because the use of legal and illicit drugs by drivers is increasing, national leadership is needed to help prevent drug-impaired driving crashes by identifying best practices, effective science-based safety countermeasures, and drug testing protocols. Therefore, the NTSB recommends that NHTSA evaluate best practices and countermeasures found to be the most effective in reducing fatalities, injuries, and crashes involving drug-impaired drivers and provide additional guidance to the states on drug-impaired driving in Countermeasures That Work: A Highway Safety Countermeasure Guide for State Highway Safety Offices. Because more consistent postcrash data are needed to monitor the effectiveness of laws, enforcement, education, and countermeasures, the NTSB also reiterates Safety Recommendation H-12-33 to NHTSA. 2.5 Medium-Size Bus Seat Belt Systems The Concan crash was a severe offset head-on collision that resulted in fatal injuries to the bus driver and 12 bus passengers. In the course of the collision, the pickup truck overrode the bus, intruding into the driver seating area and the second row of passenger seats. Ultimately, the override resulted in 5 feet of intrusion into the bus on the driver side, severely compromising survival space for the driver, the front passenger, and the first and second row passengers.67 Despite the severity of the crash, one passenger survived. She was seated farthest from the point of impact and away from the intrusion area. In addition, aft of the intrusion zone, the passenger seats remained intact, undamaged, and attached to the vehicle structure—which did not buckle.

66 In August 2018, NHTSA initiated a public affairs safety campaign to combat alcohol- and other drug-impaired driving with the message, “If you feel different, You drive different. Drive high, Get a DUI.” See NHTSA press release dated August 14, 2018, accessed November 6, 2018. 67 The unbelted truck driver survived the crash with serious injuries. The deployment of the air bag, the driver’s age (20 years), and the vehicle crash dynamics—which moved his body toward the passenger side of the truck, away from the collapsing vehicle structure—were all factors in his survival.

NTSB

Highway Accident Report 39 2.5.1 Lap Belt Design and Safety 2.5.1.1 Seat Belt Usage. The bus was equipped with lap/shoulder belts at both the driver and front passenger seats. Although the bus was not required to have passenger restraint systems, it was equipped with traveling retractor lap belts at eight of the 12 rear seats (rows 1–3) and with manually adjustable lap belts at the four seating positions in the last row. All 14 bus occupants were restrained. The vehicle examination revealed physical evidence of loading, with areas of heat abrasion and cupping to all seat belts found in the bus at the time of inspection. Additionally, the autopsy reports noted abrasions and contusions to the abdomen and hips of most bus occupants, which indicates belt usage. 2.5.1.2 Lap Belt Effectiveness. Surviving a severe crash is dependent on maintaining space around the occupant and controlling body motion, such that each person can ride-down crash forces as the vehicle decelerates and avoid injury-causing contact with the structure or other occupants. In this crash, survival space was available for occupants in rows 3 and 4 of the bus. Although the seating positions in these rows were equipped with lap belts to maintain occupants within the seating compartment, the lap belts restrained only the pelvis area and did not limit upper body flailing. The NTSB has a history of studying occupant protection and seat belts in both passenger cars and buses. After investigating 26 frontal crashes of passenger vehicles for a safety study on the use of lap belts versus lap/shoulder belts, the NTSB concluded that the crash performance of lap belts in these cases was very poor (NTSB 1986). Among the 50 persons using a lap-only belt, at least 32 would have fared substantially better had they been wearing lap/shoulder belts. The NTSB further concluded that, in severe crashes, lap belts induce minor-to-fatal head, spine, and abdomen injuries due to upper body flailing. Other passenger car studies have substantiated these conclusions. One study found that— in frontal crashes—lap-belted back seat occupants have a higher torso injury risk than unrestrained occupants (Kahane 1987). A later study concluded that back seat lap belts induce abdominal injuries in all crashes, not just frontal crashes (Cooper and others 1994). Seat belt bruising near the abdominal area, fractures of the lumbar spine, and serious closed head and facial injuries are often the result of an occupant body jackknifing over the lap belt (from the waist) during a collision (Agrawal, Inamadar, and Subrahmanyam 2013). In these conditions, the lap belt applies extreme force to the abdomen along the pelvis. Securing the waist without securing the upper torso leads to increased acceleration of the head and neck, which can cause serious head and neck injuries. Figure 14 depicts the movement of a lap-belted occupant body during a frontal collision.

NTSB

Highway Accident Report 40

Figure 14. Depiction of motion of lap-belted occupant in frontal collision. 2.5.1.3 Lap Belt Design. During postcrash inspection of the bus, NTSB investigators found other issues with the installed lap belts. In row 4, the anchorage points for the lap belts were extremely narrow (6.5 inches; see figure 6). Although FMVSS 210 allows anchorages for a seat belt assembly to be a minimum of 6.5 inches apart laterally, in this crash, the high forces and narrow anchorage points resulted in pelvic and spinal injuries due to the pinching action of the belt webbing during the rapid deceleration. The seat manufacturer, Freedman Seating, informed the NTSB that it has increased the width of lap belt anchorage points to an average of 10.5 inches. 2.5.1.4 Injury Causation. Injuries to the bus driver, the front passenger, and the passengers in the first and second rows of the bus on the driver side consisted of severe blunt force trauma associated with intrusion and significant loss of survival space. Figure 15 depicts the area of intrusion on the bus.

Figure 15. Bus seating chart showing area of intrusion, shaded, with occupant fatalities depicted in red and seriously injured occupant depicted in gray. Outside the intrusion zone, passengers sustained multiple blunt force injuries to the head, neck, abdomen, and pelvis. Multiple passengers had evidence of injuries from upper body flailing and abdominal and pelvic injuries from forward excursion over the lap belts. Additionally, passengers in row 4 had severe lateral abdominal and pelvic injuries, and one passenger’s fatal injuries were in the abdominal and pelvic region. During rapid deceleration, as the passengers

NTSB

Highway Accident Report 41 were displaced forward and the upper body flailed over the lap belt, the narrow anchorage points on the row 4 lap belts caused a pinching/scissoring action of the belt webbing on the abdomen and pelvis, resulting in extensive injury. 2.5.1.5 Safety Recommendations. Based on bus occupant injury patterns, the NTSB concludes that the lap belts provided insufficient protection for the passengers seated in the rear of the bus. The NTSB also concludes that the narrow anchorage points for the lap belts contributed to the severity of injuries to passengers seated in row 4 of the bus. Although Freedman Seating has advised that it no longer manufactures seats with narrow lap belt anchorage points, FMVSS 210 allows seat belt anchorage points to be spaced as close as 6.5 inches apart. Therefore, the NTSB recommends that NHTSA amend FMVSS 210 to increase the minimum anchorage spacing for individual seat belt assemblies, taking into account the dynamic testing of seat belt designs, seat belt fit, and vehicle configuration. 2.5.2 Lap/Shoulder Belt Requirement 2.5.2.1 Federal Motor Vehicle Safety Standards. Federal regulations require that the medium-size bus provide occupant protection for the driver seating position only. Because NHTSA considers medium-size buses to be a separate vehicle class, they are excluded from the rule requiring that all buses meeting the motorcoach, or over-the-road bus, definition be equipped with lap/shoulder belts at the driver and all passenger seating positions by November 2016.68 The rulemaking was based in part on NHTSA estimation of the effectiveness of lap/shoulder belts, which showed that they can reduce the risk of fatal injuries in rollover crashes by as much as 77 percent when installed on motorcoach and other large bus passenger seats. In addition, NHTSA found that lap/shoulder belts provide greater restraint of the upper body and distribute the belt loading over a larger surface area, reducing the risk of injury. Figure 16 depicts the difference between a lap belt and a lap/shoulder belt system when a vehicle is involved in a frontal crash.

68 According to the final rule, an “over-the-road” bus is characterized by an elevated passenger deck located over a baggage compartment. The requirement for all large buses exceeding a GVWR of 26,000 pounds excludes school buses, transit buses, and prison buses. See 78 Federal Register 70415–70474, November 25, 2013.

NTSB

Highway Accident Report 42

Figure 16. Depiction of motion of lap-belted occupant in frontal collision compared with lap/shoulder-belted occupant. The NTSB has investigated several crashes involving medium-size buses and, in many cases, found that a lack of occupant protection contributed to the severity of injuries. Following a seven-fatality medium-size bus rollover crash in Dolan Springs, Arizona, the NTSB recommended that NHTSA—in its rulemaking to improve motorcoach roof strength, occupant protection, and window glazing standards—include all buses with a GVWR above 10,000 pounds, other than school buses. (Safety Recommendation H-10-3; NTSB 2010). However, the 2013 NHTSA rule for occupant protection on motorcoaches does not include all buses with a GVWR above 10,000 pounds. Safety Recommendation H-10-3 is classified “Open— Unacceptable Response.” The Concan crash again highlights the need for lap/shoulder belts on buses. Given the significant increase in the production of medium-size buses over the past decade, NHTSA should take definitive action to improve the safety of this class of vehicle. 2.5.2.2 Medium-Size Bus Manufacturers. Most medium-size bus manufacturers offer passenger lap/shoulder belts as an option. Industry representatives have informed the NTSB that the demand for lap/shoulder belts is increasing, and they are considering installing them as standard equipment on all new buses—even though this is not a requirement. According to data provided by the Mid-Size Bus Manufacturers Association, the annual production of medium-size

NTSB

Highway Accident Report 43 buses has increased from about 10,000 in 2002 to more than 15,000 in 2016.69 In comparison, about 2,141 motorcoaches were produced for the North American market in 2015 (Metro 2018).70 In addition to voluntary, safety-focused action by bus manufacturers, seat manufacturers can play a pivotal role in ensuring that all medium-size buses are equipped with passenger lap/shoulder belts by installing the more robust systems as standard equipment in their seat systems.71 2.5.2.3 Safety Recommendations. The NTSB continues to pursue improved occupant protection strategies for medium-size buses—particularly because their size and weight more closely match the passenger car fleet, making them more likely than large motorcoaches to be subjected to high crash forces. The NTSB concludes that because lap/shoulder belts provide a greater level of occupant protection than lap belts, they should be installed as standard equipment on medium-size buses. FMVSS 208 specifies performance requirements for the protection of vehicle occupants in crashes. Because NHTSA excluded medium-size buses from the requirement for installing passenger lap/shoulder belts, the NTSB recommends that NHTSA amend FMVSS 208 to require lap/shoulder belts for each passenger seating position on all new buses with a GVWR of more than 10,000 pounds but not greater than 26,000 pounds. Furthermore, the NTSB recommends that medium-size bus manufacturers install lap/shoulder belts in all seating positions as standard, rather than optional, equipment in all newly manufactured medium-size buses.72 Additionally, the NTSB recommends that the bus seat manufacturers Freedman Seating Company and HSM Transportation Solutions supply seating systems equipped with lap/shoulder belts as standard, rather than optional, equipment for medium-size buses.

69 The Mid-Size Bus Manufacturers Association represents 80–90 percent of all medium-size bus production in the United States and Canada. See the medium-size bus production and sales supplemental report in the NTSB public docket for this investigation (HWY17MH011). 70 The cost of a new motorcoach is typically $500,000. 71 The Freedman Seating Company and HSM Transportation Solutions supply 90–95 percent of all seating in medium-size buses. 72 Medium-size bus manufacturers include ARBOC Specialty Vehicles, LLC; Coach & Equipment Manufacturing Corporation; REV Group, Inc. (Champion Bus, Inc., and ElDorado); Diamond Coach Corporation; Forest River, Inc. (Elkhart Coach, Glaval Bus, Starcraft Bus, and Turtle Top); Girardin Blue Bird (Micro Bird Inc.); SVO Group, Inc.; and Thomas Built Buses.

NTSB

Highway Accident Report 44 3 Conclusions 3.1 Findings

1. None of the following were factors in the crash: (1) bus or truck driver qualifications or

familiarity with vehicles and roadway, (2) medical condition or fatigue of the bus driver, (3) bus driver cell phone distraction, (4) bus driver impairment by alcohol or other drugs, (5) mechanical condition of either vehicle, (6) highway condition, or (7) weather.

1. Considering the rural location of the crash, the emergency response efforts were timely

and adequate.

1. The truck driver operated his vehicle erratically on US Highway 83 for more than

15 minutes, including extended periods of travel off the right road edgeline and multiple incursions across the highway centerline—which culminated in a head-on crash in the opposing lane of travel.

1. It is possible that the truck driver was glancing at or manipulating his cell phone at the

time of the crash, but this action would not explain the prolonged and continuous erratic driving behavior seen in the witness video recording leading up to the crash.

1. The truck driver was not sleep deprived, impaired by a medical condition, or impaired by

alcohol at the time of the crash.

1. The failure of the truck driver to maintain control of his vehicle was due to impairment

stemming from his use of marijuana in combination with misuse of a prescribed medication, clonazepam.

1. To better detect drivers operating under the influence of drugs, law enforcement officers

need advanced training to identify the signs and symptoms of impairment as well as additional tools, such as roadside drug screening devices.

1. Oral fluid drug screening devices can improve the ability of law enforcement officers to

detect drug-impaired drivers.

1. The state of Texas needs increased safety-focused leadership at the governor and state

legislature level, additional resources, and data-driven strategies to prevent tragedies such as the Concan crash and to reduce the number of fatalities and serious injuries caused by alcohol- and other drug-impaired drivers.

1. Because the use of legal and illicit drugs by drivers is increasing, national leadership is

needed to help prevent drug-impaired driving crashes by identifying best practices, effective science-based safety countermeasures, and drug testing protocols.

1. The lap belts provided insufficient protection for the passengers seated in the rear of the

bus.

NTSB

Highway Accident Report 45

1. The narrow anchorage points for the lap belts contributed to the severity of injuries to

passengers seated in row 4 of the bus.

1. Because lap/shoulder belts provide a greater level of occupant protection than lap belts,

they should be installed as standard equipment on medium-size buses. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Concan, Texas, crash was the failure of the pickup truck driver to control his vehicle due to impairment stemming from his use of marijuana in combination with misuse of a prescribed medication, clonazepam. Contributing to the severity of the injuries was the insufficient occupant protection provided by the lap belts worn by passengers seated in the rear of the medium-size bus.

NTSB

Highway Accident Report 46 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following new safety recommendations. To the National Highway Traffic Safety Administration: Develop and disseminate best practices, identify model specifications, and create a conforming products list for oral fluid drug screening devices. (H-18-56) Evaluate best practices and countermeasures found to be the most effective in reducing fatalities, injuries, and crashes involving drug-impaired drivers and provide additional guidance to the states on drug-impaired driving in Countermeasures That Work: A Highway Safety Countermeasure Guide for State Highway Safety Offices. (H-18-57) Amend Federal Motor Vehicle Safety Standard 210 to increase the minimum anchorage spacing for individual seat belt assemblies, taking into account the dynamic testing of seat belt designs, seat belt fit, and vehicle configuration. (H-18-58) Amend Federal Motor Vehicle Safety Standard 208 to require lap/shoulder belts for each passenger seating position on all new buses with a gross vehicle weight rating of more than 10,000 pounds but not greater than 26,000 pounds. (H-18-59) To the state of Texas: Conduct an executive-level review of your impaired driving program and implement data-driven strategies that result in a downward trend in the number of fatalities, injuries, and crashes involving alcohol- and other drug-impaired drivers. (H-18-60) To the Texas Department of Transportation: Promote the importance of attending drug-impaired driving enforcement training and increase training access to meet the demands of local and state law enforcement. (H-18-61) To medium-size bus manufacturers ARBOC Specialty Vehicles, LLC; Coach & Equipment Manufacturing Corporation; REV Group, Inc.; Diamond Coach Corporation; Forest River, Inc.; Girardin Blue Bird; SVO Group, Inc.; and Thomas Built Buses: Install lap/shoulder belts in all seating positions as standard, rather than optional, equipment in all newly manufactured medium-size buses. (H-18-62)

NTSB

Highway Accident Report 47 To seat manufacturers Freedman Seating Company and HSM Transportation Solutions: Supply seating systems equipped with lap/shoulder belts as standard, rather than optional, equipment for medium-size buses. (H-18-63) 4.2 Previously Issued Recommendation Reiterated in This Report As a result of its investigation, the National Transportation Safety Board reiterates the following safety recommendation. To the National Highway Traffic Safety Administration: Develop and disseminate to appropriate state officials a common standard of practice for drug toxicology testing, including (1) the circumstances under which tests should be conducted, (2) a minimum set of drugs for which to test, and (3) cutoff values for reporting the results. (H-12-33)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member

BRUCE LANDSBERG T. BELLA DINH-ZARR Vice Chairman Member

JENNIFER HOMENDY

Member Adopted: October 16, 2018

Members Weener and Dinh-Zarr filed the following statements.

NTSB

Highway Accident Report 48 Board Member Statements Member Earl. F. Weener, Ph.D. Concurring (October 24, 2018)

I am glad that we are directing attention to the concerning trends of drugged driving crashes in Texas and across the entire nation. While our conversation at the Board Meeting involved the interesting topic of presumptive impairment based on specific level of THC in the blood of a driver, I am less concerned about what science is still learning than with what we already know. Marijuana is one of a host of drugs, including alcohol, that can cause dangerous impairment for drivers. Drug impairment is detected primarily through the observations of police officers who use tools such as DRE evaluations and toxicology tests as additional evidence in the prosecution of impaired drivers. Drug testing is a post‐arrest procedure. By and large, by the time a police officer gives a driver a blood test, sufficient evidence has already been gathered to place the driver under arrest. The results of blood testing may take weeks or months and generally serve to confirm or negate the observations of the arresting officers and other witnesses regarding the driver’s impairment. Saliva testing, were it ever to become admissible and widely used, would be a more immediate test. However, saliva testing is confirmatory, not quantitative. It would also be employed only after a patrol officer detected signs of impairment. As a general proposition for impaired driving enforcement, drug testing is confirmatory information, collected after a police officer has stopped a driver and observed impairment. The presence of impairing substances such as alcohol and other drugs—be they illicit, prescription, or over‐the‐counter—can ultimately be used during the litigation of an impaired driving case in totality with all the other evidence collected, including officers’ observations, to establish guilt. Similarly, a DRE evaluation generally is a post‐arrest process. While specially trained Drug Recognition Experts or DRE officers are valuable tools called in to provide additional supportive observations in impaired driving cases, they typically become involved after another officer has made sufficient observations of impairment to place a driver under arrest. Of note, it is much easier for large local or statewide agencies to divert officers from patrol duties for weeks of training, and this may not be possible for very small agencies found in large states with significant rural populations. The reason I make these clarifications is to emphasize the importance of having a sufficiently large law enforcement presence comprised of officers willing to conduct basic traffic enforcement and ready to detect and arrest impaired drivers. Non‐specialized patrol officers can and do apprehend drugged drivers successfully every day. Officers equipped

NTSB

Highway Accident Report 49 with a thorough understanding of the Standardized Field Sobriety Tests and committed to road safety make a difference. It is also vital to understand that there is no single cure for this problem, and, as staff explained during the Board Meeting, drugged driving is not a problem enforcement alone can resolve. Further, there is no one‐size‐fits-all solution that will succeed equally across the nation. Each state is unique and will face its own obstacles as it works towards the goal of zero fatal crashes. Texas has its own, particular challenges. Moving forward, Texas leaders should consider fundamental questions to address the impaired driving problem holistically. What new issues will the rapid population growth bring? Looking at national averages, does Texas have a high enough patrol officer per citizen ratio? Has Texas addressed the core issue of citizen drug use, particularly considering the laws of some of its closest neighbors? Can more be done to improve post‐crash transport and treatment for better injury outcomes? If DUI arrests are decreasing, why are fatalities increasing? Are officers supported with adequate training and encouraged to make traffic stops? Does Texas do enough to educate its citizens regarding the dangers and consequences of impaired driving? Are there road infrastructure measures specific to crash prevention or mitigation that can be employed? As Texas leaders continue to make strides addressing this statewide danger, they should work with those actively involved in impaired driving enforcement, such as police and prosecutors, to get their valuable input for solutions. Impaired driving, whether from alcohol, other drugs, or a combination of substances, represents a significant and growing public health threat. I commend the Texas highway safety office staff, police, prosecutors, and other safety stakeholders who work on this problem every day. I encourage them to work with their leaders to continue to prioritize this safety issue so events like this tragic crash can be prevented.

Vice Chairman Landsberg and Member Dinh-Zarr joined this statement.

NTSB

Highway Accident Report 50 Notation 58470: Pickup Truck Centerline Crossover Collision with Medium-Size Bus on US Highway 83, Concan, Texas, March 29, 2017 Member T. Bella Dinh-Zarr, Concurring (October 25, 2018) The investigation of this tragic crash, in which 13 persons were killed while returning from a church retreat, brings into sharp relief the ongoing severe problem of traffic crashes on our highways, and especially those caused by drivers impaired by drugs of all types. As we note in this report, reversing the drug-impaired driving problem is particularly challenging due both to the large number of potentially impairing substances, and to the differences in the ways that these substances can affect a person’s behavior. And, drugs are often found in combination with alcohol, making it difficult to discern their separate effects. NHTSA and the states need to improve their practices for testing and reporting the presence of drugs in fatally injured drivers. We must develop processes that enable all positive driver drug test results (and test refusals) to be captured in FARS or another similar national database. But, while there’s much that we don’t know about best practices for deterring drug-impaired drivers, there is also much that we do know. Vigorous and publicized enforcement provides specific deterrence for those who are caught, and the general deterrence that is essential to any long-term solution. Experienced law enforcement officers are able to identify drivers who are impaired, even if they can’t determine what substance is causing the impairment. Judicial mechanisms such as effective prosecutors and DWI drug courts can make a difference. We need to provide greater support for these systems. While law enforcement agencies must constantly balance many important responsibilities, impaired driving and other traffic law enforcement must always be a top priority. Political leaders must give the law enforcement community the resources that it needs. This includes both financial and technical support, along with political permission to make highway safety a recognized priority.

“Texas is facing a crisis in road safety.” These words come from Texas’ 2017-2022 strategic highway safety plan, and our investigation found much to support that statement. Almost 3,800 people died in crashes on Texas’ roads in 2016, a 5 percent increase from the previous year.

Texas’ 2015 impaired driving assessment found shortcomings in leadership, resources, and training in the state’s efforts to address this deadly problem. The assessment led to 65 recommendations for actions by various agencies. However, at least 14 of the recommendations call for legislative action. It appears that they haven’t been addressed. The very first recommendation calls for creating a Governor’s Executive Committee made up of senior level policymakers in the state. However, that recommendation is “not being addressed currently,” according to the Texas Department of Transportation. Road safety must be addressed at the highest level in Texas, by the Governor and by the Texas Legislature’s leadership during its 2019 session. NTSB has recommended that this begin with an executive-level review of impaired driving and the programs currently seeking to address it. That review can begin with the recommendations from the 2015 assessment. Most importantly, however, government and community leaders must clearly demonstrate that preventing impaired driving deaths of Texans is a priority, both through their words and their actions.

Chairman Sumwalt, Vice Chairman Landsberg, and Members Weener and Homendy joined this statement.

NTSB

Highway Accident Report 51 Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified of this crash on March 29, 2017, and an investigative team was dispatched to the scene. Groups were established to investigate human performance, highway, vehicle, and survival factors. The NTSB team included staff from the Office of Research and Engineering. Parties to the investigation were the Texas Department of Public Safety, the Texas Department of Transportation, and Freedman Seating Company.

NTSB

Highway Accident Report 52 Appendix B: Witness Video Still Images A witness traveling in a vehicle behind the pickup truck recorded a 14-minute 27-second video of the erratic driving. National Transportation Safety Board (NTSB) investigators reviewed the video and determined that the truck was visible for 12 minutes 48 seconds of the recording. The still images below (figures B-1 through B-12) were obtained from the cell phone video and offer examples of 12 separate occasions when the truck traveled outside the US Highway 83 north travel lane.

Figure B-1. Still image of truck at time 0:13 of witness video.

Figure B-2. Still image of truck at time 0:48 of witness video.

NTSB

Highway Accident Report 53

Figure B-3. Still image of truck at time 3:24 of witness video.

Figure B-4. Still image of truck at time 3:48 of witness video.

Figure B-5. Still image of truck at time 6:32 of witness video.

NTSB

Highway Accident Report 54

Figure B-6. Still image of truck at time 6:57 of witness video.

Figure B-7. Still image of truck at time 7:17 of witness video.

Figure B-8. Still image of truck at time 10:06 of witness video.

NTSB

Highway Accident Report 55

Figure B-9. Still image of truck at time 10:59 of witness video.

Figure B-10. Still image of truck at time 13:00 of witness video.

Figure B-11. Still image of truck at time 13:36 of witness video.

NTSB

Highway Accident Report 56

Figure B-12. Final still image of truck at time 14:27 of witness video, with truck about 2,300 feet from crash location.

NTSB

Highway Accident Report 57 Appendix C: Emergency Response Timeline Table C-1. Emergency response timeline, March 29–30, 2017. Time Responding Agencya Action 12:19 p.m. (March 29) Real County Sheriff’s Office Receives notification of crash from 911 system 12:20 Frio Canyon EMS Arrives on scene and reports crash to Real County Sheriff’s Office 12:40 Utopia VFD EMS unit 26 arrives on scene 12:48 Concan VFD Rescue 1 arrives on scene 12:49 Utopia VFD Arrives on scene 12:54 Utopia VFD Rescue 1 arrives on scene and begins extrication 12:57 San Antonio medevac helicopter AirLife 5 arrives on scene 1:01 Concan VFD Rescue 2 arrives on scene to assist with extrication 1:01 Reagan Wells VFD Arrives on scene to assist with extrication 1:10 Uvalde VFD Chief arrives on scene and assumes incident command 1:20 Uvalde VFD Engine 2 arrives on scene 1:28 San Antonio medevac helicopter AirLife 5 departs scene with 84-year-old female patient to University Hospital in San Antonio 1:30 San Antonio medevac helicopter AirLife 4 arrives on scene 1:32 Uvalde VFD Rescue 4 arrives on scene with additional extrication tools 1:33 Medevac helicopter service AirEvac 71 arrives on scene 1:50 San Antonio medevac helicopter AirLife 4 departs scene with 20-year-old truck driver to University Hospital in San Antonio 1:57 San Antonio medevac helicopter 84-year-old passenger in AirLife 5 goes into cardiac arrest before 2:02 p.m. arrival at hospital; expires at 2:25 p.m. 1:59 Medevac helicopter service AirEvac 71 departs scene with 64-year-old female patient to Brooks Army Hospital in San Antonio 12:07 a.m. (March 30) TxDPS US-83 reopens to traffic a EMS = emergency medical services; VFD = volunteer fire department; TxDPS = Texas Department of Public Safety.

NTSB

Highway Accident Report 58 Appendix D: Texas Highway Safety Plan Goals and Strategies for “Alcohol and Other Drug” Safety Emphasis Area Table D-1. Texas highway safety plan goals and strategies for alcohol and other drugs. Goals Reduce number of alcohol-impaired and driving under the influence of alcohol- and other drug-related crashes, fatalities, and injuries Reduce number of driving while intoxicated (DWI)-related crashes where the driver is under age 21 Strategies Educate public and stakeholders on use of interlock devices and other alcohol- monitoring technologies for DWI offenders Improve adjudication and processing of DWI cases through improved training for judges, administrative license revocation judges, prosecutors, and probation officers Improve and increase training of law enforcement officers Improve anti-DWI public information and education campaigns, including appropriate bilingual campaigns Improve blood alcohol concentration testing and reporting to state crash records information system Improve DWI processing procedures Improve education programs on alcohol and driving for youth Increase and sustain high visibility enforcement of DWI laws Increase enforcement of DWI laws for minors Increase intervention efforts Increase public education and information, concentrating on youth ages 5–13 and 14–20, including parent education on drinking and driving Increase number of law enforcement task forces and coordinated enforcement campaigns Increase use of warrants for mandatory blood draws Increase training for anti-DWI advocates

NTSB

Highway Accident Report 59 Appendix E: Texas Highway Safety Plan Impaired Driving Assessment Recommendations Table E-1. Program management and strategic planning recommendations.

NTSB

Highway Accident Report 60 Table E-2. Prevention recommendations.

NTSB

Highway Accident Report 61

NTSB

Highway Accident Report 62 Table E-3. Criminal justice recommendations.

NTSB

Highway Accident Report 63

NTSB

Highway Accident Report 64

NTSB

Highway Accident Report 65

Table E-4. Communications program recommendations.

NTSB

Highway Accident Report 66 Table E-5. Alcohol- and other drug-misuse recommendations.

NTSB

Highway Accident Report 67 Table E-6. Program evaluation and data recommendations.

NTSB

Highway Accident Report 68 References Agrawal, A., P. Inamadar, and J. Subrahmanyam. 2013. “Seat Belt Sign and its Significance,” Journal of Family Medicine and Primary Care 2 (3): 288–290. Anund, A., G. Kecklund, A. Vadeby, M. Hjalmdahl, and T. Akerstedt. 2008. “The Alerting Effect of Hitting a Rumble Strip—A Simulator Study With Sleepy Drivers,” Accident Analysis & Prevention 40 (6): 1970–1976. Beirness, D., and D. Smith. 2017. “An Assessment of Oral Fluid Drug Screening Devices,” Canadian Society of Forensic Science Journal 50 (2): 55–63. Capler, R., D. Bilsker, K. Van Pelt, and D. MacPherson. 2017. Cannabis Use and Driving: Evidence Review. Burnaby, British Columbia: Canadian Drug Policy Coalition. Cooper, K., S. Proctor, D. Ragland, and H. Barkan. 1994. “Seat Belt Syndrome: An Examination of Patterns of Injury Associated With Seat Belt Use,” Association for the Advancement of Automotive Medicine, 38th Annual Proceedings, Des Plaines, Illinois. Dassanayake, T., P. Michie, G. Carter, and A. Jones. 1998. “Effects of Benzodiazepines, Antidepressants and Opioids on Driving,” Drug Safety 34 (2): 125–156. Doran, S., H. Van Dongen, and D. Dinges. 2001. “Sustained Attention Performance During Sleep Deprivation: Evidence of State Instability,” Archives Italiennes de Biologie 139 (3): 253– 267. Ennis, D., K. Grube, R. Lillis, M. Stout, and J. Vecchi. 2015. State of Texas Impaired Driving Program Assessment, August 17–August 21, 2015. Austin, Texas: Texas Department of Transportation. Fell, J., J. Kubelka, and R. Treffers. 2018. Advancing Drugged Driving Data at the State Level: State-by-State Assessment. Washington, DC: AAA Foundation for Traffic Safety. GAO (US Government Accountability Office). 2015. Drug-Impaired Driving: Additional Support Needed for Public Awareness Initiatives, GAO-15-293. Washington, DC: GAO. GHSA (Governors Highway Safety Association). 2018. Drug-Impaired Driving: Marijuana and Opioids Raise Critical Issues for States. Washington, DC: GHSA. _____. 2017. Drug-Impaired Driving: A Guide for States. Washington, DC: GHSA. Hartman, R., T. Brown, G. Milavetz, A. Spurgin, D. Gorelick, G. Gaffney, and M. Huestis. 2016. “Effect of Blood Collection Time on Measured Delta 9-Tetrahydrocannabinol Concentrations: Implications for Driving Interpretation and Drug Policy,” Clinical Chemistry 62 (2): 367–377.

NTSB

Highway Accident Report 69 Hartman, R., T. Brown, G. Milavetz, A. Spurgin, R. Pierce, D. Gorelick, G. Gaffney, and M. Huestis. 2015. “Cannabis Effects on Driving Lateral Control With and Without Alcohol,” Drug and Alcohol Dependence 154: 25–37. Holmes, E., W. Van Laar, and R. Robertson. 2014. The Problem of Youth Drugged Driving and Approaches to Prevention: A Systematic Literature Review. Ottawa, Ontario: Canadian Centre on Substance Abuse. IACP (International Association of Chiefs of Police). 2017. 2016 Annual Report of the IACP Drug Evaluation and Classification Program. Alexandria, Virginia: IACP. Jones, A., A. Holmgren, and F. Kugelberg. 2007. “Concentrations of Scheduled Prescription Drugs in Blood of Impaired Drivers: Considerations for Interpreting the Results,” Therapeutic Drug Monitoring 29: 248–260. Kahane, C. 1987. “Fatality Injury Reducing Effectiveness of Lap Belts for Back Seat Occupants,” SAE Transactions 96: 416–423. Warrendale, Pennsylvania: SAE. Kelley-Baker T., C. Moore, J. Lacey, and J. Yao. 2014. “Comparing Drug Detection in Oral Fluid and Blood: Data from a National Sample of Nighttime Drivers,” Traffic Injury Prevention 15 (2): 111–118. Logan, B., A. Orazio, A. Mohr, J. Limoges, A. Miles, C. Scarneo, S. Kerrigan, L. Liddicoat, K. Scott, and M. Huestis. 2018. “Recommendations for Toxicological Investigation of Drug-Impaired Driving and Motor Vehicle Fatalities–2017 Update,” Journal of Analytical Toxicology 42 (2): 63–68. Logan, B., A. Mohr, and S. Talpins. 2014. “Detection and Prevalence of Drug Use in Arrested Drivers Using the Drager Drug Test 5000 and Affiniton DrugWipe Oral Fluid Drug Screening Device,” Journal of Analytical Toxicology 38 (7): 444–450. Metro. 2018. Metro Magazine 2017 Fact Book. Torrance, California: Bobit Business Media. NHTSA (National Highway Traffic Safety Administration). 2018. Countermeasures That Work: A Highway Safety Countermeasure Guide for State Highway Safety Offices, Ninth Edition, DOT-HS-812-478. Washington, DC: NHTSA. _____. 2017a. Alcohol-Impaired Driving Traffic Safety Facts, DOT-HS-812-450. Washington, DC: NHTSA. _____. 2017b. Marijuana-Impaired Driving: A Report to Congress, DOT-HS-812-440. Washington, DC: NHTSA. _____. 2015. Results of the 2013-2014 National Roadside Survey of Alcohol and Drug Use by Drivers, DOT-HS-812-118. Washington, DC: NHTSA. _____. 2009. Results of the 2007 National Roadside Survey of Alcohol and Drug Use by Drivers, DOT-HS-811-175. Washington, DC: NHTSA.

NTSB

Highway Accident Report 70 _____. 2006. Creating Impaired Driving General Deterrence: Eight Case Studies of Sustained, High Visibility, Impaired-Driving Enforcement, DOT-HS-809-950. Washington, DC: NHTSA. _____. 2004. Drugs and Human Performance Fact Sheets, DOT-HS-809-725. Washington, DC: NHTSA. NTSB (National Transportation Safety Board). 2013. Reaching Zero: Actions to Eliminate Alcohol-Impaired Driving, NTSB/SR-13/01. Washington, DC: NTSB. www.ntsb.gov/safety/safety-studies/Pages/SR1301.aspx _____. 2010. Bus Loss of Control and Rollover, Dolan Springs, Arizona, January 30, 2009, NTSB/HAR-10/01. Washington, DC: NTSB. www.ntsb.gov/investigations/AccidentReports/Pages/HAR1001.aspx _____. 1986. Performance of Lap Belts in 26 Frontal Crashes, NTSB/SS-86/03. Washington, DC: NTSB. www.ntsb.gov/safety/safety-studies/Pages/SS8603.aspx Strand, M., H. Gjerde, and J. Morland. 2016. “Driving Under the Influence of Non-Alcohol Drugs: An Update, Part II: Experimental Studies,” Forensic Science Review 28 (2). Tan, K., U. Rudolph, and C. Luscher. 2011. “Hooked on Benzodiazepines: GABA Receptor Types and Addiction,” Trends Neurosciences 34 (4): 188–197. TxDOT (Texas Department of Transportation). 2017. Fiscal Year 2018 Highway Safety Plan. Austin, Texas: TxDOT. _____. 2016. Texas Strategic Highway Safety Plan 2017–2022. Austin, Texas: TxDOT. Van Laar, M., E. Volkerts, and A. Van Willigenburg. 1992. “Therapeutic Effects and Effects on Actual Driving Performance of Chronically Administered Buspirone and Diazepam in Anxious Outpatients,” Journal of Clinical Psychopharmacology 12 (2): 86–95.

FD07492 ｜ 2018_美国_HAR1803.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Motorcoach Run-Off-the-Road and Overturn US Highway 83 Laredo, Texas May 14, 2016

Accident Report NTSB/HAR-18/03 PB2019-100083

National Transportation Safety Board

NTSB/HAR-18/03 PB2019-100083 Notation 57900 Adopted November 7, 2018

Highway Accident Report

Motorcoach Run-Off-the-Road and Overturn US Highway 83 Laredo, Texas May 14, 2016

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2018. Motorcoach Run-Off-the-Road and Overturn, US Highway 83, Laredo, Texas, May 14, 2016. Highway Accident Report NTSB/HAR-18/03. Washington, DC.

Abstract: On Saturday, May 14, 2016, shortly before 11:24 a.m., central daylight time, a 1998 Van Hool 49-passenger motorcoach, operated by OGA Charters LLC of San Juan, Texas, was traveling northbound on US Highway 83 near Laredo, Texas. The motorcoach entered a horizontal curve to the right, and, as it moved through the curve, it drifted from its lane to the left. After the motorcoach drifted left, the driver steered to the right and applied the brakes, which resulted in the vehicle’s loss of control, so that it slid and yawed clockwise. The motorcoach departed the right, or east, side of the highway and, after entering the earthen right-of-way, overturned onto its left side. Nine passengers died, 36 passengers experienced minor-to-serious injuries, and the motorcoach driver and trip coordinator were treated for minor injuries. The injury severity for five passengers could not be determined. The investigation focused on the following safety issues: inadequate federal oversight and guidance for commercial drivers with diabetes treated without insulin; inaccurate and incomplete highway maintenance recordkeeping by the Texas Department of Transportation (TxDOT); need for improved training for TxDOT maintenance workers; need for increased motorcoach crashworthiness through improvements to window glazing and retention; driver fatigue resulting from poor safety management by OGA Charters and inadequate federal safety ratings for passenger motor carriers with repetitive safety violations in the area of driver performance. As a result of this investigation, the National Transportation Safety Board (NTSB) makes new safety recommendations to Federal Motor Carrier Safety Administration (FMCSA) and TxDOT. The NTSB also reiterates two recommendations to the FMCSA and one recommendation to the National Highway Traffic Safety Administration. The NTSB is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident HWY16MH011. Recent publications are available in their entirety on the Internet at the NTSB website. Other information about available publications may be obtained from the website or by contacting: National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551.

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2019-100083. For additional assistance, contact: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see NTIS website).

NTSB Highway Accident Report i Contents Figures and Tables ....................................................................................................................... iii Acronyms and Abbreviations ..................................................................................................... iv Executive Summary ..................................................................................................................... vi 1 Factual Information ....................................................................................................................1 1.1 Crash Narrative ..........................................................................................................................1 1.2 Injuries .......................................................................................................................................4 1.3 Emergency Response .................................................................................................................4 1.4 Driver Information .....................................................................................................................5 1.4.1 Certification, License, and Driving History ....................................................................5 1.4.2 Employment Background ................................................................................................6 1.4.3 Precrash Activities ...........................................................................................................6 1.4.4 Medical History and Toxicology .....................................................................................8 1.5 Vehicle Information .................................................................................................................10 1.5.1. General ..........................................................................................................................10 1.5.2 Postcrash Inspections .....................................................................................................10 1.5.3 Exterior Damage ............................................................................................................12 1.5.4 Interior Configuration and Damage ...............................................................................13 1.6 Highway Information ...............................................................................................................14 1.6.1 General ...........................................................................................................................14 1.6.2 Speed Limit and Crash History ......................................................................................17 1.6.3 Wet Weather Crashes ....................................................................................................18 1.6.4 Roadway Maintenance ...................................................................................................18 1.6.5 Pavement Evaluation .....................................................................................................20 1.6.6 Pavement Core Samples ................................................................................................22 1.7 Motor Carrier Operations and Regulatory Oversight ..............................................................25 1.7.1 Company History ...........................................................................................................25 1.7.2 Company Operation and Safety Culture ........................................................................26 1.7.3 TxDPS Commercial Vehicle Enforcement Oversight ...................................................26 1.7.4 FMCSA Oversight .........................................................................................................26 1.7.5 Driver’s Logbook and Hours of Service ........................................................................28 1.8 Weather ....................................................................................................................................30 1.9 Vehicle Dynamics Simulation Study .......................................................................................30 2 Analysis ......................................................................................................................................32 2.1 Introduction ..............................................................................................................................32 2.2 Driver’s Loss of Control and Crash Sequence .........................................................................33 2.3 Driver Factors ..........................................................................................................................34 2.3.1 Diabetes .........................................................................................................................34 2.3.2 Fatigue ...........................................................................................................................37

NTSB Highway Accident Report ii 2.4 Highway Maintenance .............................................................................................................38 2.4.1 TxDOT Daily Activity Reports .....................................................................................39 2.4.2 Surface Friction and Pavement Milling .........................................................................40 2.5 Motorcoach Occupant Protection ............................................................................................43 2.5.1 Seat Belts .......................................................................................................................43 2.5.2 Window Glazing ............................................................................................................44 2.6 Motor Carrier Operations .........................................................................................................45 2.6.1 OGA Charters Oversight of its Drivers .........................................................................45 2.6.2 FMCSA Oversight of OGA Charters ............................................................................46 3 Conclusions ................................................................................................................................49 3.1 Findings....................................................................................................................................49 3.2 Probable Cause.........................................................................................................................51 4 Recommendations .....................................................................................................................52 4.1 New Recommendations ...........................................................................................................52 4.2 Recommendations Reiterated in this Report............................................................................53 Appendix A: Investigation ..........................................................................................................54 Appendix B: Skid Numbers for Northbound US-83 .................................................................55 Appendix C: Turner-Fairbank Pavement Friction Testing Summary Report ......................61 References .....................................................................................................................................75

NTSB Highway Accident Report iii Figures and Tables Figure 1. Route map for OGA Charters motorcoach for May 14, 2016, trip .................................1 Figure 2. Approach to crash site on US-83, Laredo, Texas ............................................................2 Figure 3. View of front left of motorcoach at its approximate final rest position ..........................3 Figure 4. View of left side of motorcoach after the vehicle was uprighted from its final rest position .............................................................................................................................................3 Figure 5. Driver’s work/sleep history and cell phone use in the days preceding the crash ............8 Figure 6. View of motorcoach’s left side, showing missing window panes and impact damage to the front and rear of the vehicle .................................................................................................12 Figure 7. View of motorcoach’s right side, showing intact window panes and minimal vehicle damage ...........................................................................................................................................13 Figure 8. Crash scene diagram ......................................................................................................15 Figure 9. Northbound view of US-83, showing the degraded condition of lane striping within the curve .........................................................................................................................................17 Figure 10. Locations on US-83 where the pavement core samples were obtained ......................23 Figure 11. Cross section views of pavement core samples 1B (left) and 5B (right), showing the 2-3-millimeter-thick top layer of asphalt emulsion ..................................................................24 Figure 12. Postcrash view of US-83 northbound travel lane. The slick-appearing surface and increased reflectivity contrasts with the paved shoulder on the right ............................................24 Figure 13. View of US-83 northbound travel lane shortly after the crash, showing gouges and continuous longitudinal grooves in the pavement surface .............................................................42 Figure 14. Views of the northbound US-83 lane looking south ...................................................42 Table 1. Injuries...............................................................................................................................4 Table 2. Vehicle tire information ..................................................................................................10 Table 3. TxDOT’s rating evaluation of the friction levels (skid numbers) for the lane miles it maintained in fiscal year 2015 .......................................................................................................21 Table 4. Driver’s on- and off-duty hours for May 12–14, 2016 ...................................................29 Table B-1. Skid numbers for northbound travel lane of US-83 in right wheel path .....................55 Table B-2. Skid numbers for northbound travel lane of US-83 in left wheel path .......................57 Table B-3. Skid numbers for northbound travel lane of US-83 between wheel paths ..................59

NTSB Highway Accident Report iv Acronyms and Abbreviations AASHTO American Association of State Highway and Transportation Officials ABS antilock braking system AME aviation medical examiner ASTM American Society for Testing and Materials International BASIC behavior analysis safety improvement category [FMCSA] BMI

body mass index CBP

US Customs and Border Protection CDC Centers for Disease Control and Prevention CDL commercial driver’s license CFR

Code of Federal Regulations CME certified medical examiner CSMS Carrier Safety Measurement System [FMCSA] DAR daily activity report [TxDOT] DOT US Department of Transportation EMS emergency medical service EMT emergency medical technician FAA Federal Aviation Administration FHWA Federal Highway Administration FMCSA Federal Motor Carrier Safety Administration FMCSRs Federal Motor Carrier Safety Regulations GVWR gross vehicle weight rating ISD

Independent School District kg/m2 kilograms per square meter MAP-21 Moving Ahead for Progress in the 21st Century Act mg/dl milligrams per deciliter MM

mile marker

NTSB Highway Accident Report v NHTSA National Highway Traffic Safety Administration NPRM notice of proposed rulemaking NTSB National Transportation Safety Board NVIC Navigation and Vessel Inspection Circular PMS pavement management system PSAP [Webb County] Public Service Answering Point psi

pounds per square inch RM

mile marker (alternative abbreviation) SFD

safety fitness determination [FMCSA] TFHRC Turner-Fairbank Highway Research Center [FHWA] TxDOT Texas Department of Transportation TxDPS Texas Department of Public Safety US-83 US Highway 83

NTSB Highway Accident Report vi Executive Summary Investigation Synopsis On Saturday, May 14, 2016, shortly before 11:24 a.m., central daylight time, a 1998 Van Hool 49-passenger motorcoach, operated by OGA Charters LLC of San Juan, Texas, was traveling northbound on US Highway 83 near Laredo, Texas. The motorcoach entered a horizontal curve to the right, and, as it moved through the curve, it drifted from its lane to the left. After the motorcoach drifted left, the driver steered to the right and applied the brakes, which resulted in the vehicle’s loss of control, so that it slid and yawed clockwise. The motorcoach departed the right, or east, side of the highway and, after entering the earthen right-of-way, overturned onto its left side. Nine passengers died, 36 passengers experienced minor-to-serious injuries, and the motorcoach driver and trip coordinator were treated for minor injuries. The injury severity for five passengers could not be determined. Probable Cause The National Transportation Safety Board determines that the probable cause of the Laredo, Texas, crash was the driver’s failure to maintain the motorcoach fully within the northbound travel lane, due to a combination of fatigue from an acute sleep deficit and blurred distance vision due to hyperglycemia resulting from poorly controlled diabetes; then, as the motorcoach drifted left from the travel lane, the driver abruptly steered to the right and braked, causing the vehicle to leave the highway and roll over. Contributing to the driver’s inability to regain control of the motorcoach was the low friction value of the wet pavement and the inoperable antilock braking system. Contributing to the severity of the passenger injuries was the failure of the left side passenger windows to keep passengers within the motorcoach. Safety Issues The crash investigation focused on the following safety issues: • Inadequate federal oversight and guidance for commercial drivers with diabetes treated without insulin. • Inaccurate and incomplete highway maintenance recordkeeping by the Texas Department of Transportation (TxDOT), leading to deficiencies in conducting safety-critical highway maintenance. • Need for improved training for TxDOT maintenance workers to ensure that roadway maintenance operations result in acceptable levels of surface friction. • Need for increased motorcoach crashworthiness through improvements to window glazing and retention.

NTSB Highway Accident Report vii • Driver fatigue resulting from poor safety management by OGA Charters and inadequate federal safety ratings for passenger motor carriers with repetitive safety violations in the area of driver performance. Recommendations As a result of this investigation, the National Transportation Safety Board (NTSB) makes new safety recommendations to the Federal Motor Carrier Safety Administration (FMCSA) and TxDOT. The NTSB also reiterates two recommendations to the FMCSA and one recommendation to the National Highway Traffic Safety Administration.

NTSB Highway Accident Report 1 1 Factual Information 1.1 Crash Narrative Shortly before 11:24 a.m., central daylight time, on May 14, 2016, a 1998 Van Hool 49-passenger motorcoach, operated by OGA Charters LLC of San Juan, Texas (OGA Charters), was traveling northbound on US Highway 83 (US-83) near the city of Laredo, in Webb County, Texas.1 (See figure 1.) The motorcoach, occupied by the driver, a trip coordinator, and 50 passengers, was en route from Brownsville, Texas, to the Kickapoo Lucky Eagle Casino Hotel in Eagle Pass, Texas.2 During the trip, rain showers were encountered, and the pavement was wet.

Figure 1. Route map for OGA Charters motorcoach for May 14, 2016, trip.

1 Unless otherwise specified, all times in this report are central daylight time. 2 In addition to its 49 passenger seats, the motorcoach had a jump seat in the loading door area. The tour coordinator did not have a seat available to her; during the trip, she stood in the vehicle’s center aisle.

NTSB Highway Accident Report 2 In the vicinity of mile marker (MM) 670.7, the northbound motorcoach entered a horizontal curve to the right. Roadway evidence and postcrash simulations (discussed in section 1.9) suggest that, while in the curve, the motorcoach drifted out of its lane to the left, and the driver made sudden steering and braking input to correct the drift. During a postcrash interview, the motorcoach driver said that he recalled applying the brakes and feeling the bus slide before going off the road. Near the end of the curve, the motorcoach departed the right, or east, side of the highway. The vehicle overturned 90 degrees onto its left side. The motorcoach continued to yaw clockwise and came to rest with its front end partially on the eastern edge of the northbound roadway. (See figures 2, 3, and 4.)

Figure 2. Approach to crash site on US-83, Laredo, Texas.

NTSB Highway Accident Report 3

Figure 3. View of front left of motorcoach at its approximate final rest position. The left side of the vehicle has been partially raised and supported to facilitate extrication of the occupants. (Source: Texas Department of Public Safety)

Figure 4. View of left side of motorcoach after the vehicle was uprighted from its final rest position. (Source: Texas Department of Public Safety)

NTSB Highway Accident Report 4 1.2 Injuries Nine passengers died as a result of this crash. Of those nine passengers, seven died at the crash scene, one died after being transported to the hospital, and one died in the hospital 6 days after the crash. Autopsy reports from the Webb County medical examiner show that eight deaths were caused by multiple blunt force injuries, and one death resulted from a neck fracture. Thirty-six passengers suffered injuries of varying degrees; serious injuries included internal blunt force trauma, rib fractures, and extremity fractures. Medical records and related injury information for five passengers could not be obtained due to incomplete personal information. The driver and trip coordinator had minor injuries. Occupants were transported to three local hospitals for treatment. (See table 1.) Table 1. Injuries. Injury Severitya Fatal Serious Minor Unknown TOTAL Motorcoach driver 0 0 1 0 1 Motorcoach trip coordinator 0 0 1 0 1 Motorcoach passengers 9 20 16 5 50 TOTAL 9 20 18 5 52 a Although 49 Code of Federal Regulations (CFR) Part 830 pertains to the reporting of aircraft accidents and incidents to the National Transportation Safety Boad (NTSB), section 830.2 defines fatal injury as any injury that results in death within 30 days of the accident, and serious injury as any injury that: (1) requires hospitalization for more than 48 hours, commencing within 7 days from the date of injury; (2) results in a fracture of any bone (except simple fractures of fingers, toes, or nose); (3) causes severe hemorrhages, nerve, or tendon damage; (4) involves any internal organ; or (5) involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. 1.3 Emergency Response The crash location was under the jurisdiction of the Texas Department of Public Safety (TxDPS), and officers from the Laredo office were responsible for the primary response to the crash. However, two agents from US Customs and Border Protection (CBP) were the initial first responders. The CBP agents had been on patrol in the area when they encountered the crash shortly after it occurred. TxDPS dispatch records documented two phone calls from CBP agents reporting the crash; one was made at 11:24 a.m. and a second at 11:25 a.m. The TxDPS dispatcher and the Webb County Public Service Answering Point (PSAP) received three additional calls about the crash between 11:26 a.m. and 11:28 a.m. A Webb County sheriff’s deputy, who had originally been dispatched to another collision before the crash, was in the vicinity and was redirected to the motorcoach crash. The deputy, with another nearby CBP agent, arrived within 10 minutes of the crash. Both officers were trained emergency medical technicians (EMTs), and they began assisting the injured. The Webb County PSAP dispatched emergency medical services (EMS) and fire/rescue services. Angel Care Ambulance was the contracted EMS provider, and its units were en route by 11:27 a.m. The Webb County Fire Department had fire/rescue jurisdiction, and its first units were en route by 11:30 a.m. TxDPS officers were en route to the crash by 11:31 a.m. After the first four officers arrived, additional CBP agents who were nearby also responded. The CBP agents and the Webb County sheriff’s deputy performed initial triage and evacuation

NTSB Highway Accident Report 5 activities while medical assistance was en route. Civilian personnel working near the crash also helped. The sheriff’s deputy worked part time at Angel Care, and he communicated pertinent injury information to Angel Care by telephone. Mutual aid EMS and fire/rescue services were assigned by 11:30 a.m. Angel Care also contacted neighboring jurisdictions for mutual aid EMS support. Mutual aid services responding included agencies from the neighboring LaSalle and Dimmit Counties, including Bronze Star Ambulance, Cotulla Fire and EMS, and Camino Real Ambulance, as well as the City of Laredo Fire Department and EMS. Air evacuation services were requested, but at 11:47 a.m., and again at 12:35 p.m., the Webb County PSAP was advised that weather conditions precluded airborne evacuation. Because of the severity of the crash, the CBP dispatched additional agents to assist with the injured, secure the scene, and provide traffic control. The CBP had been operating a traffic checkpoint on US-83, about 10 miles south of the crash. About 11:43 a.m. the CBP closed the checkpoint, freeing additional CBP agents to assist with the crash. At that same time, agents set up traffic control at the intersection of US-83 and State Highway 44, restricting northbound traffic on US-83 to emergency vehicles only. A CBP supervisor also responded to the crash and assumed incident command. He initiated a mass casualty incident, which brought aid from all local jurisdictions. In all, 25 CBP agents, 6 of whom were EMTs, assisted with the crash. Once Webb County Fire Department personnel arrived, the CBP transferred incident command duties to them. The CBP agents departed the scene about 20 minutes later. The TxDPS dispatcher logged the arrival of its first officer at the crash site at 11:54 a.m. At 11:59 a.m., the dispatcher was notified that the crash involved severely injured passengers, some of whom were trapped in and under the motorcoach, and that some might have been fatally injured. The Webb County medical examiner’s office was notified at 12:02 p.m. The first fire/rescue units were reported on the scene at 12:05 p.m., and by 12:14 p.m., three ambulances were on scene and an additional nine were reported to be en route. A telescopic handler to lift the motorcoach and assist with extricating trapped passengers was brought on scene by about 12:14 p.m., and fire/rescue responders took control of the rescue operations.3 Postcrash interviews with first responders and passengers indicated that some passengers had been partially or fully ejected out of the motorcoach’s left side windows and that some were trapped under the left side of the vehicle.4 Forty-four passengers were transported by seven EMS agencies to three hospitals. Patient care reports logged the arrival times of patients at the hospitals as between 12:54 p.m. and 2:55 p.m. 1.4 Driver Information 1.4.1 Certification, License, and Driving History The 29-year-old motorcoach driver held a Texas class A commercial driver’s license (CDL) with endorsements allowing him to engage in operations involving passenger

3 A telescopic handler, also referred to as a telehandler, teleporter, or boom lift, is a machine that shares characteristics with a heavy-duty forklift. These machines are intended for outdoor use and are widely used in agriculture and industry. 4 The exact number of partially ejected, ejected, and trapped passengers could not be determined.

NTSB Highway Accident Report 6 transportation, school buses, cargo tanks, and double or triple trailers.5 The driver’s license included a restriction requiring that he wear corrective lenses while operating a vehicle. (He was wearing glasses at the time of the crash.) The license was issued in August 2015 and would expire in February 2021. His most recent medical certificate was issued in February 2016 and would expire in February 2017. The driver first obtained a Texas CDL in 2010, following successful completion of a 6-week CDL course at South Texas College in McAllen, Texas. At the end of the course, the driver was qualified for a class A CDL with endorsements for both cargo tank and double or triple trailer operations. After obtaining his CDL, the driver trained at a trucking company to become an over-the-road freight driver; however, he reported that, during this training, he found that he did not enjoy that type of work and left after only a couple of days. Later in 2010, he began employment as a driver for the Valley View Independent School District (ISD) in Pharr, Texas. While employed there, he received additional training and obtained endorsements for school bus and passenger operations. NTSB investigators examined the driver’s Commercial Driver’s License Information System record, which showed no convictions for traffic violations or crashes. During an interview with investigators, the driver stated that, in October 2015, he had been issued a citation in Georgia for an improper lane change. (No record of the citation was found.) 1.4.2 Employment Background The driver began working as a commercial bus driver in 2010, operating school buses and motorcoaches for the Valley View ISD. In 2012, the driver left the Valley View ISD and began driving school buses for the McAllen ISD. Beginning in March 2015, in addition to his full-time employment as a school bus driver, he began working as an occasional driver for two Texas charter bus companies—Santa Rosa Express, located in McAllen, and the carrier he was driving for when the crash occurred, OGA Charters, located in San Juan. In April 2015, the driver also started driving on an as-needed basis for Escamilla Tour Bus, located in McAllen. 1.4.3 Precrash Activities NTSB investigators determined the motorcoach driver’s activities for the 5 days preceding the crash using information from a postcrash interview, as well as his personal cell phone records, employment records, and hours-of-service logs. The driver’s primary employment involved driving a school bus for the McAllen ISD, where he typically worked a split shift. His morning shift was from 6:00 a.m. to 9:00 a.m. and his afternoon shift was from 3:00 p.m. to 6:00 p.m. In the week before the crash, the driver worked this schedule Monday through Thursday. On Friday, May 13, the day before the crash, the driver took the day off from his school bus driving job and chose instead to drive a chartered trip for OGA Charters. The driver went on duty that morning at 3:45 a.m. and an hour later picked up passengers in Weslaco, Texas. The trip destination was an amusement park in San Antonio, Texas, a distance of about 248 miles. After dropping off the passengers at the amusement park, the driver parked the motorcoach on the

5 A Texas class A commercial driver’s license is required to operate vehicles with a gross combination weight rating of 26,001 pounds or more, including a towed vehicle heavier than 10,000 pounds.

NTSB Highway Accident Report 7 premises and remained onboard the vehicle, going off duty at 10:30 a.m. The driver told investigators that he kept the bus running so that the air conditioner would stay on, and he lay down across seats at the back of the vehicle to rest and sleep. The driver said he thought he fell asleep sometime between 10:30 a.m. and 11:00 a.m. and remained asleep until 5:00 p.m., when he woke up and got something to eat. The driver’s cell phone records indicate that during the time that he reported that he had been asleep or resting, he used his cell phone on five separate occasions, making his first call at 11:24 a.m. and receiving the fifth call at 4:53 p.m.6 The driver made three additional phone calls before going back on duty at 6:15 p.m., at which time he loaded the passengers and began the trip back to Weslaco. The driver dropped the passengers off in Weslaco at 10:30 p.m., drove back to his residence—where he kept the OGA Charters motorcoach—and went off duty an hour later at 11:30 p.m. On Saturday, May 14, the day of the crash, the driver made two brief calls on his cell phone, one at 12:07 a.m. and another at 12:27 a.m. before going to sleep. The driver reported that he woke up at 2:30 a.m. (to take medication) and prepared for the day, during which he would be driving another trip for OGA Charters. He went on duty at 3:30 a.m., when he left his residence en route to Brownsville, Texas, to pick up passengers. After driving about 54 miles, he arrived in Brownsville at 5:00 a.m. and picked up the majority of his passengers. The destination for the chartered trip was the Kickapoo Lucky Eagle Casino Hotel in Eagle Pass, Texas, about 330 miles northwest of Brownsville. After departing Brownsville, the driver traveled west and made several brief stops to pick up additional passengers in the Harlingen and McAllen areas. The final passengers were picked up in Palmview, Texas, after which the motorcoach was filled to capacity, including one passenger occupying the jump seat at the front of the motorcoach. The tour coordinator did not have a seat available to her; during the trip, she led the passengers in games and activities while standing in the vehicle’s center aisle. Following the final pickup stop in Palmview, the driver continued driving for 82 miles before stopping in Zapata, Texas, at 9:00 a.m. In Zapata, the driver allowed passengers to leave the vehicle, so they could eat and use the restroom while he refueled the bus. The motorcoach departed Zapata at 9:30 a.m. and continued northbound on US-83. It was stopped at a CBP checkpoint on US-83 near the intersection with State Highway 44. CBP agents boarded the bus and verified passengers’ residency information before allowing the driver to continue the trip. After departing the CBP checkpoint, the motorcoach traveled an additional 10 miles north on US-83; the crash occurred a short time later, just before 11:24 a.m. Cell phone records indicate that the driver sent four text messages between 10:30 a.m. and 10:42 a.m., but he was not using a cell phone at the time of the crash. (See figure 5 for a chart that summarizes the driver’s on-duty time, sleep opportunities, and cell phone usage from May 9 until the crash on May 14.)

6 (a) NTSB investigators found that the driver had used two different cell phones during the precrash period. (b) Between the two calls cited, the driver also made one call at 12:43 p.m., made another at 2:46 p.m., and received a call at 3:49 p.m.

NTSB Highway Accident Report 8

Figure 5. Driver’s work/sleep history and cell phone use in the days preceding the crash. 1.4.4 Medical History and Toxicology The driver’s medical history was examined using information from his two most recent CDL medical certification exams, postcrash emergency care records, and postcrash toxicology results. An NTSB medical investigator also reviewed records maintained by the driver’s primary care physician from January 2014 through February 2016. Information from the driver’s February 24, 2016, commercial driver medical exam showed the 29-year-old driver’s height to be 69 inches (5 feet 9 inches) and his weight to be 233 pounds, resulting in a body mass index (BMI) of 34 kilograms per square meter (kg/m2).7 The driver self-reported that he had hypertension and type 2 diabetes and was taking lisinopril and dapagliflozin for those conditions. The certified medical examiner (CME) noted that hypertension and diabetes had been diagnosed in 2015. The driver’s blood pressure was 138/80, his pulse was 72, and the record indicated that an “FBS” was measured at 95.8 The driver’s urine dip test had specific gravity of 1.015, was negative for blood and protein, and was positive for “500” glucose.9 His corrected vision in each eye was reported as 20/20; his uncorrected vision was not reported.10 No abnormalities were noted on the physical exam, and the driver was certified for 1 year with a requirement that he wear corrective lenses when driving. The results from the driver’s earlier August 27, 2015, medical examination differed in some ways from the February 2016 exam results. During the 2015 exam, the driver reported having hypertension and type 2 diabetes treated with lisinopril and a combination product containing

7 BMI is calculated by dividing the weight of the person by the square of their body surface area. BMI results between 25 and 30 indicate that the person is overweight; results above 30 indicate obesity. BMI is universally expressed in units of kg/m². 8 The report was unclear whether “FBS” was intended to indicate “fasting blood sugar” or “fingerstick blood sugar.” No units or other descriptors were given, but blood glucose is typically measured in milligrams per deciliter (mg/dl) in the United States. Normal fasting numbers are considered between 70 and 99 mg/dl. Fasting levels above 126 mg/dl indicate diabetes. 9 (a) Specific gravity is a measure of the concentration of the urine. (b) Normal urine results are negative for blood, protein, and glucose. No glucose units were given in this result, but they are typically provided in mg/dl. Glucose begins to spill into urine when blood glucose levels are above about 180 mg/dl. Use of dapagliflozin may increase urine glucose. 10 Medical information concerning the driver’s vision was limited because he obtained vision care in Mexico.

NTSB Highway Accident Report 9 metformin and saxagliptin. During this examination, his height was recorded as 68 inches (5 feet 8 inches) and his weight was recorded as 268 pounds, resulting in a BMI of 36.3 kg/m2. The driver’s urine dip test had a specific gravity of greater than or equal to 1.030, and his urine was negative for blood, protein, and glucose. The physician who performed the exam noted “Hgb A1C 10.2 percent.”11 His corrected vision in each eye was reported as 20/20; his uncorrected vision was not reported. No abnormalities were noted on the physical exam, and the driver was certified for 6 months with a requirement that he use corrective lenses when driving. About 3 hours after the Laredo crash, the driver arrived at the hospital. His urinalysis demonstrated a specific gravity of 1.005 and was positive for 4+ glucose and 3+ ketones.12 A blood sample drawn at 3:13 p.m. had a blood glucose of 373 mg/dl; the remainder of his blood count and chemistries were normal.13 According to a note in the hospital lab records, this blood glucose value was considered critically high, and lab personnel verbally reported it to emergency department personnel. However, nothing in the emergency department records indicated any action taken by the treating providers to address the driver’s glucose level. The emergency physician who was treating the driver gave a final diagnosis of multiple contusions and discharged him from the emergency department later that day. An initial clinical screen of the driver’s urine by the hospital was negative for amphetamines, barbiturates, benzodiazepines, cannabinoids, cocaine, methadone, opiates, and phencyclidine. The results of toxicology testing of the driver’s urine, performed in compliance with Federal Motor Carrier Safety Administration (FMCSA) postcrash drug test requirements, were negative.14 Remaining samples of the driver’s blood and urine were provided to the Federal Aviation Administration (FAA) Bioaeronautical Sciences Research Laboratory for toxicology testing. The results were negative for alcohol and other drugs.15 Clinical testing of the blood revealed 2 mg/dl of acetone. Clinical testing of the urine revealed 5,247 mg/dl of glucose, 12 mg/dl of acetone, and the presence of salicylate.16 The hemoglobin A1C was measured at 12.7 percent.17

11 “Hgb A1C” is medical shorthand for hemoglobin A1C. The level of 10.2 percent indicates poor diabetes control with average glucose about 250–270 mg/dl. The source of this information is unclear from the exam form. 12 Glucose and ketones are typical findings from dip urine results. These results are categorized as 0 (normal), trace, and 1+ to 4+ in reference to the degree of color change. 13 Normal random glucose values range between 70 and 150 mg/dl. 14 Testing was conducted through Genesis Drug Testing, located in Laredo. The testing was limited to identifying urinary metabolites of amphetamine, methamphetamine, cocaine, codeine, morphine, heroin, phencyclidine, methylenedioxymethamphetamine, methylenedioxyamphetamine, methylenedioxyethylamphetamine, and tetrahydrocannabinol. 15 Toxicological testing included more than 1,300 substances; see the FAA WebDrugs website for a complete listing, accessed July 5, 2018. 16 Acetone is a byproduct of the metabolic distortion caused by uncontrolled diabetes. Salicylate is a metabolite of aspirin, an over-the-counter anti-inflammatory drug used to treat fever, pain, or inflammation that also has platelet-inhibiting effects, for which it may be used to prevent recurrent heart attacks. 17 This level of hemoglobin A1C (12.7 percent) indicates that the driver’s blood glucose had averaged about 318 mg/dl over the preceding several weeks (Nathan and others 2008).

NTSB Highway Accident Report 10 1.5 Vehicle Information 1.5.1. General The 49-passenger 1998 Van Hool model T2140 motorcoach was manufactured in October 1997 and was equipped with a Detroit Diesel Corporation Series 60 six-cylinder electronically controlled diesel engine and an Allison B500 six-speed automatic transmission. Engine management functions were performed by a Detroit Diesel Electronic Controls Series III engine control module. The motorcoach was also equipped with a WABCO 2P/1E antilock braking system (ABS) designed to control a combination of disc and drum-type brakes. As manufactured, the motorcoach was 40 feet long and had a gross vehicle weight rating (GVWR) of 45,650 pounds.18 The motorcoach was equipped with 315/80R22.5 tires mounted on 22.5 X 8.25 steel wheels. The brakes on the first and third axles were pneumatically operated disc brakes; the second axle was equipped with pneumatic drum brakes.19 The odometer reading at the time of the crash was 919,354 miles. The motorcoach’s most recent annual inspection occurred on February 4, 2016.20 1.5.2 Postcrash Inspections Following the crash, investigators examined the tires on the motorcoach and found no evidence of tire failure. All tires were found to be inflated. According to federal regulations, the minimum tread depth for tires on the motorcoach steer axle is 4/32 inch; for tires on the remaining two axles, the minimum depth is 2/32 inch.21 Table 2 provides the inflation values and minimum tire tread depths recorded by investigators during the postcrash inspection. Table 2. Vehicle tire information. Tire Location Pressure (pounds per square inch [psi]) Average Tread Depth Axle I (steer axle) – left side 108 psi 20/32 inch Axle I (steer axle) – right side 108 psi 19/32 inch Axle II – left side (inboard) 110 psi 16/32 inch Axle II – left side (outboard) 106 psi 16/32 inch Axle II – right side (inboard) 120 psi 8/32 inch

18 The GVWR is the total maximum weight that a vehicle is designed to carry when loaded, including the weight of the vehicle itself plus fuel, passengers, and cargo. 19 The first or front axle is also referred to as the steer axle. It relays driver steering inputs to the wheels. The second axle is referred to as the drive axle, and it connects engine power to the wheels. The third axle is referred to as the tag axle and is used to support a portion of the vehicle’s weight. 20 Title 49 CFR 396.17 specifies that every commercial motor vehicle shall be inspected at least once during each 12-month period and that all vehicle parts and accessories must meet the minimum requirements in appendix G of the section’s subchapter. 21 Title 49 CFR 393.75 specifies that tread depth shall be measured in a major groove at any location on the tire and not where tie bars, humps, or fillets are located.

NTSB Highway Accident Report 11 Tire Location Pressure (pounds per square inch [psi]) Average Tread Depth Axle II – right side (outboard) 102 psi 7/32 inch Axle III – left side 96 psi 6/32 inch Axle III – right side 100 psi 5/32 inch Excluding the inboard tire on the dual wheel assembly for axle II, all of the tire positions on the left side of the motorcoach were found to have dirt and vegetation embedded between the tire bead and outboard wheel flange. Additionally, excluding those tires on the right side of axle I, all tire treads exhibited patches of roadway abrasion. The motorcoach was equipped with type 24 long-stroke brake chambers actuating the disc brakes on axle I, type 36 brake chambers for both the service and parking brakes on axle II’s drum brakes, and type 20 brake chambers for the disc brakes on axle III. The brake discs, drums, and brake linings on all axles were visually inspected. Investigators measured the brake linings, and all were found to exceed minimum thickness requirements.22 Engine damage from the crash required that postcrash testing of the brake system use an external source of air. Pressurized air regulated to 95 psi was applied to the vehicle’s air brake system to verify that check valves within the system were working as designed. The testing found that the audible and visual warnings for low air pressure were operational on both the primary and secondary air systems. To evaluate the vehicle’s brake adjustments, pressure for the external air source was reset to 90 psi, and measurements were taken at each brake assembly. The brake stroke adjustment for the left drum brake on axle II was found to be 2.5 inches, while the stroke on the right brake was measured at 3 inches. Both brakes were out of adjustment and exceeded the maximum stroke limit of 2.25 inches.23 Although at the time of the motorcoach’s manufacture, an ABS was not required equipment, the motorcoach was equipped with an optional Wabco ABS and had sensors and modulators at all six wheel positions.24 During the postcrash inspection, the ABS was found to be nonoperational due to broken and disconnected wires, as well as a missing ABS sensor on the left side of axle II. The broken ABS wiring at the axle’s end showed signs of corrosion, and it was covered with road grime, as would be expected for a condition existing over a prolonged period. When the vehicle’s required annual inspection took place on February 4, 2016, the inspection requirements addressed only the functionality of a vehicle’s basic brake system and not the operability of its ABS, if so equipped. However, on July 22, 2016, the inspection requirements were revised so that, among other things, if a commercial motor vehicle that was required to be equipped with ABS had missing or inoperative ABS components, the vehicle would not pass its

22 Title 49 CFR 393.47(d)(2) prescribes a 0.25-inch minimum lining thickness for brakes on air-braked nonsteering axles, and a 0.0625-inch minimum lining thickness for brakes on an air-braked front steering axle. 23 Based on the April 1, 2016, Commercial Vehicle Safety Alliance North American Standard Out-of-Service Criteria for clamp-type pneumatic brakes, the brakes were out of adjustment. 24 Had the motorcoach been manufactured after March 1, 1998, it would have been required to be equipped with ABS (63 Federal Register 24454). Final assembly of this motorcoach occurred on October 10, 1997.

NTSB Highway Accident Report 12 annual inspection and would not be permitted to continue to operate (81 Federal Register 47722‒ 47732). 1.5.3 Exterior Damage Exterior damage was observed primarily along the motorcoach’s left side. Parallel scrapes and scratches extended the entire length of the left side, and various body panel seams and openings had grass and soil embedded in them. There was a small area of impact damage on an access door forward of the front wheel opening. The left rear corner of the vehicle also had impact damage. The damage was concentrated at the lower portion of the corner and extended up to the area of the rearmost passenger window. The left side of the motorcoach had one multipane driver’s window adjacent to the driver’s seating position and five passenger windows. The upper pane of the driver’s window was broken, and the remaining panes of the driver’s window were soiled with mud and dirt. The forwardmost passenger window was 78 inches wide and tapered in height; it measured 44 inches high at the front and 36 inches high at the rear. Passenger windows two through four were the same size, measuring 74.5 inches wide and 32 inches high. The rearmost passenger window was 44 inches wide and 32 inches high. The glazing for all five passenger windows on the left side was broken and missing. Additionally, the window retention frame for passenger window two was displaced at the bottom, having a 2-inch-wide opening between the frame and the vehicle body. The frame for passenger window three was completely missing. Passenger windows two through five were configured for use as emergency exits. (See figure 6 for a postcrash view of the left side of the motorcoach.)

Figure 6. View of motorcoach’s left side, showing missing window panes and impact damage to the front and rear of the vehicle.

NTSB Highway Accident Report 13 Five passenger windows, similar to those on the left side, were located along the right side of the motorcoach; windows two through five were configured as emergency exits. The glazing for the five passenger windows on the right side was intact, and those windows designed to be used as emergency exits were functional. The right side and front of the motorcoach showed no signs of impact damage. The three laminated glass panes comprising the front windshield were missing. The passenger loading door area was intact and did not have significant damage. (See figure 7 for a postcrash view of the right side of the motorcoach.)

Figure 7. View of motorcoach’s right side, showing intact window panes and minimal vehicle damage. 1.5.4 Interior Configuration and Damage The motorcoach was configured with 13 rows of passenger seats on the driver’s, or left, side of the vehicle and 11 rows on the right side. In addition to the 49 passenger seats, a folding jump seat was mounted adjacent to the passenger stairwell. Including the driver’s seat, seven seat positions were fitted with lap belts. These positions were as follows: the jump seat, the four seats in row one, and a single seat positioned in the last row at the end of the center aisle, in the vehicle’s rearmost row.25 Overhead luggage bins equipped with passenger control units, which were

25 The vehicle manufacturer installed lap belts at each of these seating positions because the absence of a seat in front of these locations made the occupant more vulnerable in the event of a crash. When this motorcoach was manufactured in 1998 (final assembly in October 1997), US motorcoaches were not required to be equipped with passenger seat belts. However, Van Hool chose to follow European standards in its motorcoach manufactures. European directive 90/629/EEC, which became effective July 1, 1992, mandated the installation of lap seat belts on motorcoaches for “exposed” seating positions only. As indicated above, under this directive, an exposed seating position is essentially one with nothing in front of the seat.

NTSB Highway Accident Report 14 designed to provide individual control of lighting and ventilation, ran the length of the passenger compartment above both rows of seats. With the exception of the three seats in the last row, the passenger seats consisted of double seat assemblies, each incorporating two 16-inch-long by 18-inch-wide cushions. The seatbacks were 30.5 inches tall and 16 inches wide at their widest points. Individual armrests were located at the outside and center of each seat assembly. On the right side of the vehicle, the center armrests at rows two and nine were broken off and the center armrest at row eight was missing. Several aisle-side armrests on both the left and right sides were deformed and displaced about 1 to 3 inches toward the left side of the motorcoach. The overhead luggage bins on the right side had pulled away from the support frame adjacent to the passenger windows. The displacement extended from the front of the vehicle to about row eight. Several of the overhead passenger control units on the left side were displaced, and they hung by electrical wires from their mounting locations. 1.6 Highway Information 1.6.1 General The crash occurred about 45 miles north of Laredo, in the northbound travel lane of US-83 near MM 670.7. At this location, US-83, as oriented from the motorcoach’s direction of travel, has a compound curve to the right, and the road configuration changes from two travel lanes in each direction to a multilane, channelized road with a painted center median that is delineated from the travel lanes by yellow-painted lines.26 The loss-of-control event that preceded the motorcoach crash originated in the curve. The 2-degree horizontal curve is about 881 feet long and has a super-elevation of about 4 percent.27 The crest of the vertical curve is near the midpoint of the horizontal curve. Three private driveways are located within the curve along the east side of the roadway, and a single driveway to a gas and oil facility is located near the midpoint of the curve on the west side. (See figure 8 for a diagram of the crash scene curve.)

26 A compound curve consists of horizontal and vertical elements. 27 (a) The 2-degree curve has a radius of about 2,925 feet. (b) The super-elevation or cross slope of a roadway is used to help offset the centripetal forces that develop as a vehicle travels around a curve. In addition to providing a level of motorist comfort, super-elevation increases the potential speed at which a horizontal curve may be traversed.

NTSB Highway Accident Report 15

Figure 8. Crash scene diagram.

NTSB Highway Accident Report 16 At the beginning of the right horizontal curve, northbound US-83 consists of a 12-foot-wide travel lane and a 12-foot-wide left turn lane. A 5-foot-wide paved shoulder is located adjacent to the travel lane. Southbound US-83 consists of a single tapered travel lane bordered by a 5-foot-wide paved shoulder.28 To facilitate access to the gas and oil facility’s driveway on the west side of the highway, a northbound left turn lane was added in March 2013.29 The cross section for US-83 changes immediately north of the curve’s midpoint, and the travel lanes are channelized by an approximately 14-foot-wide painted median.30 A single travel lane is used for northbound traffic, while the southbound portion of the highway includes a 12-foot-wide travel lane and a 12-foot-wide right turn lane. The 5-foot-wide paved shoulders continue along this section of highway. As with the previously described northbound left turn lane, the southbound right turn lane was added to accommodate traffic access to the gas and oil facility’s driveway on the west side of the highway. On each approach to the curve where the crash occurred, the northbound and southbound travel lanes are separated by a combination of painted lines and rumble strips. The grooved rumble strips are about 16 inches wide and are milled to a depth of about 0.5 inch. Yellow 6-inch-wide lane lines are painted along each side of the rumble strips.31 The travel lanes on the approaches, as well as within the curve, are delineated from the paved shoulders by 6-inch-wide painted white edge lines adjacent to milled rumble strips. Within the curve, the turn lanes are delineated from the painted center median by 6-inch-wide painted lines. At the time of the crash, the double 6-inch-wide yellow lines that separate the northbound travel lane from the center median were worn and faded. Beginning at about the curve midpoint, the white edge line intended to separate the northbound travel lane from the paved shoulder was so faded as to be not visible. (See figure 9.)

28 The lane tapered from 24 feet to 12 feet wide. The tapering was part of a 2014 roadway modification to facilitate the movement of commercial vehicles from the adjacent property. 29 The work was documented in TxDOT Minute Order Number 113363, which was approved on November 15, 2012, by the Texas Transportation Commission. The work had an estimated cost of $2.2 million. 30 According to the American Association of State Highway and Transportation Officials (AASHTO) A Policy on Geometric Design of Highways and Streets, “channelization” is the separation or regulation of conflicting traffic movements into definite paths of travel by traffic islands or pavement marking to facilitate the safe and orderly movements of both vehicles and pedestrians (AASHTO 2011). 31 The centerline rumble strips did not continue into the curved section of the highway.

NTSB Highway Accident Report 17

Figure 9. Northbound view of US-83, showing the degraded condition of lane striping within the curve. 1.6.2 Speed Limit and Crash History The posted speed limit for US-83 in the area of the crash is 75 mph.32 The nearest speed limit sign to the crash site for northbound traffic is about 8 miles south of the site. No warning signs or advisory plaques indicate a speed reduction within the curve.33 For 2010–2015 on US-83 near the crash location, a total of 50 crashes occurred, 3 of which resulted in a vehicle occupant death.34 The crash reports for these fatal crashes showed that one each occurred in 2011, 2012, and 2015. The mile markers where the crashes occurred were identified as 676.1, 668.7, and 673.0, respectively. (The subject crash occurred at MM 670.7.) None of the fatal crashes occurred during wet pavement surface conditions.

32 Two informal speed surveys, one conducted on May 21, 2016, and the other on June 25, 2016, found that the 85th percentile speed for this location was about 75–77 mph. 33 Chapter 2C of the Manual on Uniform Traffic Control Devices for Streets and Highways specifies how warning signs and advisory speed plaques should be placed and used. Warning sign usage includes situations to alert road users to conditions that might call for a reduction of speed. The manual also states that, in addition to warning signs, an advisory speed plaque shall be used where an engineering study indicates a need to advise road users of the advisory speed for other roadway conditions (Federal Highway Administration [FHWA] 2009, Section 2C.08 Advisory Speed Plaque). 34 Centering upon the crash location of MM 670.7, NTSB investigators obtained from the Texas Department of Transportation (TxDOT) a list of reportable crashes occurring within 5 miles in each direction on US-83.

NTSB Highway Accident Report 18 1.6.3 Wet Weather Crashes TxDOT monitors and evaluates Texas roadways to ensure that surface conditions allow for safe operation by motorists; this includes operating vehicles on roadways during wet weather. The agency uses its Wet Surface Crash Reduction Program Guidelines, which are implemented and maintained by the TxDOT Construction Division’s Materials and Pavements Section. The guidelines specify that, for a segment of rural roadway to be identified as a wet surface crash location, the minimum threshold is for three or more wet surface crashes to occur on it within the most recent complete calendar year. The 2016 District Rural Wet Surface Crash Reduction Program Location Report for the Laredo District identified the crash location on US-83 as a wet surface crash location, referencing six wet pavement crashes. Three of the wet weather crashes referenced in the 2016 report occurred in November 2015 and originated in the northbound part of the US-83 curve where the motorcoach crash took place. Another wet weather crash originating in the northbound curve occurred on May 18, 2016—4 days after the motorcoach crash. All four of these wet weather crashes involved truck-tractors in combination with semitrailers, and all resulted in vehicles’ jackknifing.35 Each crash involved only the combination vehicle and did not result in injuries or fatalities. In three of the crash reports, the investigating officer listed “unsafe speed” as a contributing factor; in two of those crashes, the driver was cited for unsafe speed. The report for the fourth wet weather crash listed “other (explain in narrative)” and “faulty evasive action” as contributing factors. The officer’s narrative of the crash described the road surface as being wet because of rainfall and oily due to the heavy oilfield traffic. The report also listed “unsafe speed” as a factor that might have contributed. No citations were issued for this crash. 1.6.4 Roadway Maintenance At the request of NTSB investigators, TxDOT personnel provided the daily activity reports (DARs) used by the department to document the maintenance activities on US-83 in the area of the crash. These reports are intended to capture, on a daily basis, the type of work being performed, the personnel involved, the equipment and materials used, and the location where the work is performed. Sixteen DARs were received. They covered the period from September 28 through November 5, 2015. The DARs showed that several maintenance activities had taken place to address pavement surface issues in this area of US-83. The TxDOT DAR for October 21, 2015, indicated that a “full-width” chip seal had been applied to US-83.36 Chip sealing is a common pavement maintenance practice in which a thin layer of heated asphalt emulsion is sprayed on the road surface, followed by the spreading of small pieces of aggregate (known as “chips”). The chips are then compacted for maximum adherence to the asphalt, and any excess aggregate is swept from the road surface.

35 A jackknife is a spinout event involving an articulated vehicle, such as a truck-tractor in combination with a semitrailer. As the spinout progresses, the front portion of the articulated vehicle becomes perpendicular to the trailing or towed section. 36 In this context, the term “full width” refers to the application of asphalt followed by aggregate over the entire width of any lane (or lanes) to which the chip seal is applied. It does not refer to an application covering the full width of the highway.

NTSB Highway Accident Report 19 The DAR for October 21, 2015, did not state whether the chip seal was applied to the full width of the northbound travel lane, the southbound travel lane, or both lanes. The DAR indicated that about 1,518 gallons of asphalt emulsion and 96 tons of aggregate were applied in the areas from MM 664 to MM 698, a distance of 34 miles. Based on their own recollections, TxDOT personnel told NTSB investigators that the chip seal was applied in the northbound travel lane near MM 670.7 (in the vicinity of the crash); however, the DAR does not indicate any more specific location information than within the 34-mile-long section. The following bullets summarize the pavement maintenance activities that took place in the crash area before the May 14, 2016, crash, as reported to NTSB investigators by TxDOT maintenance personnel: • On August 5, 2011, a TxDOT contractor began a countywide 1.5-inch overlay project for the north- and southbound travel lanes of US-83 within Webb County. TxDOT accepted the work as completed on January 10, 2012. • In November 2012, an oil company contractor began work on US-83 to add turn lanes and driveways to permit access to the company’s property adjacent to the highway. The pavement edge along the west side was extended outward by 15 feet to provide space for the turn lanes, and the grade and super-elevation of the extension were matched to the existing surface conditions. No changes were made to the pavement overlay of the north- and southbound travel lanes. • On October 1, 2015, TxDOT maintenance crews began work in the southbound travel lane to address cracking and minor rutting.37 No maintenance work was performed in the northbound travel lane. • On October 21, 2015 (as noted above), TxDOT maintenance crews applied a chip seal—as a preventive measure to extend the life of the pavement surface—to the northbound travel lane. TxDOT subsequently reported that the aggregate did not adhere properly to the top layer of asphalt emulsion on the roadway and became displaced from the road surface. • On October 26, 2015, to address the low-friction issues caused by the failed chip seal operation of October 21, TxDOT maintenance crews began milling operations to provide texture and increased surface friction in the northbound travel lane. The operation removed about 0.25 inch of pavement from the road surface. No additional precrash surface treatments were performed after the October 26, 2015, milling operations. Another chip seal project had been scheduled to take place on April 25, 2016, to remedy the failed October 21, 2015, chip seal operation. However, on April 21, 2016, TxDOT’s contractor reported that the aggregate for the chip seal project was not available for delivery and would be delayed. The contractor provided TxDOT with a tentative project start date of June 6, 2016.

37 Rutting occurs when depressions or grooves are worn into the road by tire travel. Ruts form through the deformation of the asphalt pavement.

NTSB Highway Accident Report 20 On May 18, 2016—4 days after the May 14, 2016, crash—TxDOT began a 1,030-foot-long pavement milling project to add texture to the pavement surface to restore skid resistance. The project encompassed the entire length of the horizontal curve at the motorcoach crash location, and it was conducted to address safety concerns related to low pavement friction.38 The milling was completed on May 20, 2016. TxDOT reported that it experienced equipment problems during this postcrash milling operation, which left gouges and continuous longitudinal grooves in the pavement. These results were contrary to specifications in TxDOT’s Planing and Texturing Pavement Specifications, which states that the “Surface should be free from gouges, continuous longitudinal grooves, ridges, oil films, and other imperfections of workmanship” (TxDOT 2004, p. 377). On May 27, 2016, the contractor for the chip seal operation notified TxDOT that its material supplier was again unable to deliver the aggregate and asked for a further delay, with a tentative project start date of no later than September 5, 2016.39 1.6.5 Pavement Evaluation Several days after the crash, at the request of the NTSB, personnel from the TxDOT Maintenance Division’s Pavements Preservation Branch performed a series of skid resistance tests to determine the pavement friction in the northbound travel lane of US-83. The tests were performed along the entire length of the crash curve, including the crash location. Following the methods established by ASTM International (ASTM) Standard E-274, testing was performed using a trailer-mounted friction-testing device towed behind a vehicle.40 Detailed results from the skid testing can be found in appendix B of this report. Table 3 is a summary of the skid numbers that TxDOT provided to the NTSB as related to the 66,615 lane miles it maintained in fiscal year 2015. Skid numbers represent the frictional properties of the pavement and are used to evaluate the pavement’s skid resistance relative to other pavements and/or to evaluate changes in a pavement’s skid resistance over time. The higher the skid numbers, the higher the friction level of the tested pavement. TxDOT uses a five-color code to categorize skid numbers, with the “Blue” category containing the lane miles having the highest friction levels and the “Red” category those with the lowest friction levels.

38 TxDOT personnel reported that the milling was initiated because of the low skid numbers obtained from their postcrash skid testing and because of two recent crashes; the one involving the motorcoach on May 14 and another involving a combination vehicle on May 18. Overall, the milling was intended to improve the pavement’s friction. 39 After the May 2016 crash, personnel from the TxDOT Laredo District notified the NTSB of their intent to begin the chip seal operation on August 17, 2016. However, wet weather delayed the operation until August 23, 2016. The project was completed 4 days later, on August 27, 2016. 40 (a) ASTM is a not-for-profit organization that provides a forum for the development and publication of over 12,000 technical standards encompassing a diverse range of materials, products, processes, systems, and services. (b) The standard test for skid resistance of paved surfaces with a full-scale tire uses a measurement representing the steady-state friction force on a locked test wheel as it is dragged over a wetted pavement surface under constant load and at a constant speed while its major plane is parallel to its direction of motion and perpendicular to the pavement.

NTSB Highway Accident Report 21 Table 3. TxDOT’s rating evaluation of the friction levels (skid numbers) for the lane miles it maintained in fiscal year 2015. (The evaluation was based on skid resistance tests performed at 50 mph using a smooth tire under wet pavement conditions.) Category Friction Range (Skid Numbers) Total Maintained Lane Miles in Category % of Total Maintained Lane Miles in Category Blue 38–99 32,293 48.5 Green 31–37 12,007 18.0 Yellow 24–30 11,140 16.7 Orange 16–23 7,987 12.0 Red 1–15 3,188 4.8 Total 66,615 100.0 In fiscal year 2015, of the 66,615 lane miles evaluated, 3,188 lane miles (4.8 percent) maintained by TxDOT had skid numbers in the 1–15 range, placing them in the lowest friction, or Red, category. TxDOT’s postcrash skid resistance tests near the crash site (resistance tests performed at 50 mph using a smooth tire under wet pavement conditions) resulted in skid numbers as low as 5.4, indicating that some pavement friction levels in the vicinity of the crash site were near the bottom of this lowest category. In addition to performing the skid resistance tests, TxDOT personnel evaluated the road surface using a transverse beam sensor. The transverse beam profile test measured the cross slope and rut depth in the northbound travel lane of US-83 near the crash.41 The measurements began at MM 672, and data were collected northward from that point.42 The test results revealed that the cross slope (or super-elevation rate) was about 4.3 percent at its maximum point along the horizontal curve. The rut depths in the right and left wheel paths of the northbound travel lane varied from 0.15 to 0.25 inches and from 0.10 to 0.27 inches, respectively. Postcrash, NTSB investigators performed a series of locked-wheel skid tests using a car.43 The tests were conducted on both wet and dry surface conditions within the northbound travel lane

41 The transverse beam profile test consists of a five-sensor system attached to the front of a vehicle that makes measurements with ultrasonic sensor technology to collect cross slope and pavement rutting data. 42 The crash location was at MM 670.7. For roadways oriented north–south, mile markers decrease in value in the northbound direction. In this instance, the measurements began 1.3 miles south of the crash location and continued north to the curve where the crash occurred. 43 See NTSB docket item for this investigation, “Technical Reconstruction Group Attachment—Locked Wheel Skid Test Data.” The NTSB used a Stalker ATS II RADAR system and associated software manufactured by Applied Concepts, Inc., to document the locked-wheel skid tests. Output data from the test run included time, velocity, acceleration, and distance, which were then analyzed to calculate the deceleration (drag) factor. The test vehicle was a midsize four-door sedan with its ABS disengaged.

NTSB Highway Accident Report 22 of US-83. The skid test data were used to calculate an average deceleration factor that was later used to analyze vehicle crash dynamics.44 1.6.6 Pavement Core Samples 1.6.6.1 Core Sample Information. At the request of the NTSB, on May 17, 2016, TxDOT drilled and obtained ten pavement cores from the travel lanes and paved median of US-83 near the crash location. The NTSB took possession of all ten core samples and provided five to the Federal Highway Administration (FHWA) Turner-Fairbank Highway Research Center (TFHRC) for testing and analysis. The TFHRC tested the following pavement core samples, the locations of which can be seen in figure 10: • Core sample 1B: Taken from the northbound travel lanes, about 431 feet south of the motorcoach’s final rest location. (TFHRC indicated that this sample came from the left wheel path.) • Core sample 2B: Taken from the southbound travel lanes, about 431 feet south of the motorcoach’s final rest location. • Core sample 3B: Taken from the painted median, about 431 feet south of the motorcoach’s final rest location. • Core sample 4B: Taken from the northbound travel lanes, about 3,108 feet south of the motorcoach’s final rest location. (TFHRC indicated that this sample came from the right wheel path.) • Core sample 5B: Taken from the northbound travel lanes, about 718 feet south of the motorcoach’s final rest location. (TFHRC indicated that this sample came from the right wheel path.)

44 See NTSB docket item for this investigation, “Vehicle Dynamics Study.”

NTSB Highway Accident Report 23

Figure 10. Locations on US-83 where the pavement core samples were obtained. (Source: Google Earth modified) 1.6.6.2 TFHRC Evaluation of Pavement Core Samples. TFHRC performed several types of tests on the core samples. (For the TFHRC testing summary report, see appendix C.) Based on forensic analysis of the core samples from the milled area of the northbound travel lane of US-83, the TFHRC concluded that the primary factor most likely contributing to the low pavement friction was the absence of adequate aggregate particles in the wearing course of the pavement, compounded by tack coat content that created a slick asphalt surface.45 (See figure 11 for cross section images of two of the core samples, showing how little aggregate was in the top pavement layer, and figure 12 for an image of the slick-appearing surface of the roadway.)

45 (a) “Tack coat” is a thin bituminous liquid asphalt, emulsion, or cutback layer. (b) The “wearing course” is the uppermost layer of the roadway, which is in direct contact with traffic loads.

NTSB Highway Accident Report 24

Figure 11. Cross section views of pavement core samples 1B (left) and 5B (right), showing the 2–3-millimeter-thick top layer of asphalt emulsion. The area above the yellow line in each photograph is the surface of the roadway; when compared to the material below the line, little aggregate can be seen in this top layer.

Figure 12. Postcrash view of US-83 northbound travel lane. The slick-appearing surface and increased reflectivity contrasts with the paved shoulder on the right. (Source: TxDPS)

NTSB Highway Accident Report 25 Aggregate typically comprises 80–90 percent of the bituminous mixture used as the wearing course for highway pavement (Prowell, Zhang, and Brown 2005). Assuming that a pavement wearing course is designed and constructed properly, asphalt pavements have low friction mainly due to the type of aggregate used. In this case, however, the TFHRC’s analysis of core samples 1B and 5B led it to conclude that the low pavement friction near the crash site resulted from the absence of essential elements in the wearing course. In other words, there was not enough aggregate in the wearing course to provide adequate pavement friction. The TFHRC concluded that the presence of the 2–3-millimeter-thick asphalt layer at the top of samples 1B and 5B, and the limestone relics associated with the binder-rich thin top layer, were consistent with two possible scenarios. In one scenario, the milling operation that TxDOT performed on October 26, 2015, which reportedly removed about 0.25 inch of the pavement top overlay, did not significantly remove the asphalt emulsion that was applied during the failed chip seal job 5 days earlier. The other scenario was that an asphalt tack coat had been applied after the October 26, 2015, milling operation. During the on-scene investigation, TxDOT stated that the pavement’s slick appearance and the reduced pavement friction at the crash location were the result of asphalt bleeding.46 However, the chemical analysis performed by the TFHRC found that the asphalt-rich surface layer of the pavement from which core samples 1B, 4B, and 5B were taken had been treated with an asphalt emulsion containing styrene butadiene rubber polymer, which would be typical of a tack coat used with chip seal operations and is consistent with the construction history reported by TxDOT. The TFHRC chemistry laboratory report concluded that there was no evidence to support the theory that the excess asphalt on the pavement surface was the result of asphalt bleeding. 1.7 Motor Carrier Operations and Regulatory Oversight 1.7.1 Company History OGA Charters began operating in 2009, and it entered the FMCSA’s new entrant program on January 12, 2009.47 The company successfully completed a safety audit and exited the new entrant program on July 12, 2010. The carrier was registered as a “for-hire” carrier of passengers, with its principal place of business in San Juan, Texas. OGA Charters reported its commercial mileage for 2014 as 40,000 miles. The carrier engaged in both intrastate and interstate trips. At the time of the crash, the carrier operated two motorcoaches, employed two part-time drivers (one was the crash driver), and had one additional employee responsible for cleaning the motorcoaches. The company did not have an in-house maintenance facility; instead, it outsourced maintenance and repairs to businesses in the United States and Mexico. Between July 26, 2012, and December 15, 2015, the carrier had been subject to seven roadside inspections, six of which included the motorcoach involved in the crash. Three of the

46 Asphalt bleeding (also called flushing) is a process by which excess asphalt rises to the pavement surface. 47 OGA Charters ceased doing business after this crash.

NTSB Highway Accident Report 26 inspections resulted in the vehicle being placed out of service for brake system defects. Two of the seven inspections found driver logbook violations.48 1.7.2 Company Operation and Safety Culture Following the crash, investigators examined the carrier’s operations. OGA Charters did not provide any training to new employees, and it had no safety training, manuals, or other programs to educate drivers. Other than a drug and alcohol testing policy, which is specifically required by regulation, OGA Charters had no policies on cell phone use, fatigue management, or any other safety-related procedures. With respect to hiring, the owner stated that he did not advertise or post job openings; he only hired drivers who were recommended to him. He reported that he used the “DOT [US Department of Transportation] preemployment” process for new hires, but the carrier had no written policies or guidelines concerning this process. The owner stated that he was responsible for recordkeeping and that he did not routinely audit drivers’ hours of service. He stated he had been having issues with the crash driver not turning in his records-of-duty status as required, and he did not realize until the postcrash investigation that this driver had been scheduled to drive in excess of his allowable hours of service, as was discovered during the investigation (hours of service are detailed in section 1.7.5). 1.7.3 TxDPS Commercial Vehicle Enforcement Oversight Title 37, part 1, chapter 4, of the Texas Administrative Code establishes the authority for the TxDPS to enforce the Federal Motor Carrier Safety Regulations (FMCSRs) as adopted by the state. By code, all intrastate carriers must comply with state and local laws, as well as with the rules governing licensing, vehicle safety, and driver safety. Texas does not have a program requiring annual compliance reviews of carriers involved in intrastate operations, and TxDPS Commercial Vehicle Enforcement officers had never conducted a review of OGA Charters. However, because the crash occurred during an intrastate trip, TxDPS officers performed a postcrash inspection of the crash vehicle and driver, which resulted in the vehicle being placed out of service for brake defects (two brakes were out of adjustment) and the driver being placed out of service for falsifying his logbooks. 1.7.4 FMCSA Oversight The FMCSA mission is to reduce crashes, injuries, and fatalities involving large trucks and buses. The FMCSA uses a combination of programs, reviews, and inspections to provide oversight of commercial motor vehicle operations. 1.7.4.1 FMCSA Compliance Reviews. A compliance review is an onsite examination of a motor carrier’s operations to determine its compliance with the FMCSRs and to evaluate its safety culture. Upon completion of a compliance review, the FMCSA rates the carrier as being “satisfactory,” “conditional,” or “unsatisfactory” in five safety areas, which, when combined, result in an overall rating of the company’s compliance with the FMCSRs. The compliance review

48 The driver violations found in the two inspections did not involve the crash motorcoach driver.

NTSB Highway Accident Report 27 program is intended to improve the safety of commercial vehicle operations through heightened awareness of safety regulations and enforcement. Before the crash, the FMCSA had performed two compliance reviews of OGA Charters— one on September 2, 2010, and the other on May 1, 2014. Both reviews resulted in satisfactory safety fitness ratings.49 Despite resulting in a satisfactory rating, the September 2, 2010, compliance review found several violations regarding the use and oversight of OGA Charters drivers. These violations included the following: • Section 382.301–Using a driver before the return of a negative preemployment drug and alcohol test. • Section 395.8‒Failing to require records-of-duty status in the prescribed form and manner. • Section 395.8–Carrier failed to obtain from driver, used for the first time or intermittently, a signed statement giving the total time on duty during the preceding 7 days and time at which last relieved from duty. The compliance review performed on May 1, 2014, also resulted in a satisfactory rating. During the review, however, the FMCSA found five violations regarding the use and oversight of the company’s drivers, one of which was a repeat violation of Section 395.8. Additionally, OGA Charters had vehicle oversight violations for the following: • Section 396.3(b)(2)‒Failure to have a means of indicating the nature and due date of various inspection and maintenance operations to be performed. • Section 396.9(d)(3)–Failure to maintain complete roadside inspection forms for 12 months from the date of inspection at the carrier’s primary place of business. As a result of the 2014 compliance review, the FMCSA made specific recommendations to OGA Charters to improve its driver oversight. These recommendations were as follows: • Develop a policy requiring a driver to report available hours during a “check-in call.” • Develop a policy to require drivers to comply with the hours-of-service regulations and turn in records-of-duty status and supporting documentation within 13 days of completing trips. • Establish a policy stating that drivers are required to check with their supervisor to report “fit-for-duty” status before starting a job and require that drivers who are ill or whose abilities or alertness is impaired be prohibited from taking safety-sensitive assignments.

49 A satisfactory rating indicates that a motor carrier has in place functioning and adequate safety management controls to meet the safety fitness standard prescribed in section 385.5 of the FMCSRs.

NTSB Highway Accident Report 28 The OGA Charters owner did not implement the FMCSA recommendations and, at the time of the crash, none of the policies had been developed or established. The FMCSA took no further action with respect to its recommendations to OGA Charters. Following the crash, the FMCSA performed a compliance review of the carrier and found multiple violations, including deficiencies in recordkeeping, driver oversight, and vehicle maintenance. Additionally, the postcrash review listed violations for the driver’s falsification of his logbook. The FMCSA examined the carrier’s accident information, and those results, combined with the logbook violations, resulted in the carrier’s previous satisfactory rating being downgraded to conditional.50 1.7.4.2 Compliance, Safety, Accountability Program. The FMCSA uses the Compliance, Safety, Accountability program to monitor carrier safety. A key component of the program is the Carrier Safety Measurement System (CSMS), which analyzes all safety-based violations from inspections and crash data to determine a motor carrier’s on-road performance and potential crash risk. Thresholds for safety measurement system scores are determined through a mathematical formula that includes vehicle miles driven, number of vehicles and drivers in the fleet, and time since a violation. The CSMS uses the following seven behavioral analysis safety improvement categories (BASICs): unsafe driving, hours-of-service compliance, driver fitness, controlled substances and alcohol, vehicle maintenance, improper loading/cargo securement, and crash indicator.51 Each BASIC has a threshold that triggers an intervention by the FMCSA, including warning letters or more extensive scrutiny, such as targeted roadside inspections and focused investigations.52 OGA Charters had one BASIC alert for hours of service. 1.7.5 Driver’s Logbook and Hours of Service While investigating the crash, TxDPS officers recovered two loose-leaf logbook pages belonging to the driver. The entries on the first page showed the driver as off duty from May 6 to May 13; information on the second page, dated May 14, showed that he was tracking his hours during the trip to Eagle Pass, Texas. Later, the driver told TxDPS officers that, on May 13, he had driven the motorcoach on an OGA Charters trip to San Antonio, Texas, and that he was employed full-time as a school bus driver for the McAllen ISD.

50 A conditional rating indicates that a motor carrier does not have adequate safety management controls in place to ensure compliance with the safety fitness standard that could result in occurrences listed in the FMCSRs Rules and Notices Section 385.5 (a) through (k). 51 Hours-of-service compliance applies to the operation of commercial motor vehicles by drivers who are ill, fatigued, or noncompliant with regulations. Example violations for this BASIC include exceeding hours of service, maintaining an incomplete or inaccurate logbook, and operating a commercial motor vehicle while ill or fatigued (49 CFR Parts 392 and 395). For more information, see the FMCSA Compliance, Safety, Accountability website, accessed September 24, 2018. 52 To determine alert status, carriers are compared to a peer group of other carriers with similar numbers of inspections using a percentile rating of 0–100, with the 100th percentile indicating the worst performance. For carriers with safety issues across multiple BASICs, the FMCSA will continue to conduct onsite comprehensive compliance reviews. The FMCSA intervention threshold for passenger carriers for unsafe driving, hours-of-service compliance, and crash indicator is 50 percent. For driver fitness, controlled substances and alcohol, and vehicle maintenance, the threshold is 65 percent. See the FMCSA Compliance, Safety, Accountability website, accessed September 24, 2018.

NTSB Highway Accident Report 29 Because the driver was employed by more than one motor carrier, he was required to submit a copy of his record-of-duty status to OGA Charters, as specified in 49 CFR 395.8. This record should have reflected the hours he had accrued while working as a school bus driver.53 The responsibility to ensure that a driver complies with hours-of-service requirements extends to the motor carrier. Title 49 CFR 395.8 requires that, when using a driver intermittently, the motor carrier shall obtain a signed statement from the driver providing the total time on duty during the immediately preceding 7 days. In this case, neither the driver nor the motor carrier followed the regulation. Additionally, the chartered trip required the driver to complete a logbook entry for his time on May 13. The driver acknowledged that he had falsified a logbook page for OGA Charters, omitting the information about his hours as a school bus driver and his chartered trip the day before the crash. The driver provided the NTSB with the logbook page that he had completed for the trip on May 13. An evaluation of the page, as well as of his reported schedule at McAllen ISD, revealed that, because he had not had 8 consecutive hours of time off duty, when the crash occurred, the driver both had exceeded his maximum driving hours and was driving beyond his maximum allowable time on duty.54 Table 4 summarizes the driver’s on-duty hours, off-duty hours, and cumulative hours since his last required 8-consecutive-hour-long rest break from the morning of May 12 till the time of the crash on May 14. Table 4. Driver’s on- and off-duty hours for May 12–14, 2016. Date Time On-Duty Hours Off- Duty Hours Hours Since Required Rest Break Source May 12, 2016 6:00 a.m. to 9:00 a.m. 3 0 0 McAllen ISD payroll 9:00 a.m. to 3:00 p.m. 0 6 3 3:00 p.m. to 6:00 p.m. 3 0 12 6:00 p.m. to 7:30 p.m. 0 1.5 13.5 Driver’s interview 7:30 p.m. to 9:00 p.m. 1.5 0 15

9:00 p.m. to 3:45 a.m. 0 6.75 21.75 May 13, 2016 3:45 a.m. to 10:30 a.m. 6.75 0 28.5 10:30 a.m. to 6:15 p.m. 0 7.75 35.25 Driver’s logbook/interview 6:15 p.m. to 11:30 p.m. 5.25 0 40.5 11:30 p.m. to 3:30 a.m. 0 4 44.5 May 14, 2016 3:30 a.m. to 11:26 a.m. 8 0 52.5

53 The driver was not required to complete logbook entries while working for the McAllen ISD, but he was required to account for, and self-report, the hours to OGA Charters for determination of his hours-of-service status. 54 The crash occurred during an intrastate trip, and the driver’s hours of service were regulated by Title 37, Part 1, Chapter 4, Subchapter B, Rule §4.12(2) of the Texas Transportation Code.

NTSB Highway Accident Report 30 1.8 Weather On the trip to Eagle Pass, the driver encountered rain of varying intensity, and he reported light rain at the time of the crash. Based on data from multiple sources, including airports, military installations, and satellite data, thunderstorms and rain showers began shortly before 1:00 a.m. and continued until about 3:30 p.m. that afternoon. The data also showed that, near the time of the crash, several large cumulonimbus cloud systems extended over the route traveled by the motorcoach.55 The crash site was indicated as having experienced light rainfall. At the time of the crash, the most intense portion of the storm was about 3 miles north of the crash location. 1.9 Vehicle Dynamics Simulation Study To better understand the vehicle loss-of-control event and the subsequent roadway departure and crash, the NTSB performed a vehicle dynamics simulation study.56 The study employed an iterative approach in which steering and braking were varied to evaluate the vehicle response. Three-dimensional survey data of the crash environment were entered into the simulations, and the collected physical evidence was compared with the simulation results.57 These survey data included tire marks and other physical evidence indicating the path of the motorcoach from just before it departed the right side of roadway to its final rest point. The data allowed for reconstruction of the rotation and sideslip of the motorcoach from the time it left the roadway approximately to the point of rollover. The study assessed the performance of the motorcoach through the curve and evaluated how simulated events involving braking, steering, and lane position matched the available physical evidence. The simulation results identified two possible scenarios that were consistent with the physical evidence. The first was steering overcorrection. This scenario most likely would have occurred in response to the motorcoach drifting out of its lane toward the center median, or possibly in response to the vehicle sliding toward the middle of the roadway as a result of braking. The second scenario involved premature wheel lockup, resulting from the inoperability of the ABS. The simulations indicated that premature rear-wheel lockup in combination with slight increases of steering to the right in the curve could result in the motorcoach rapidly rotating and steering off the inside of the curve, if the driver did not intervene to prevent it from leaving the road by counter-steering. The simulations of this scenario also indicated that the driver could have controlled the vehicle by rapidly counter-steering. Possible factors contributing to the loss of control identified in the study included the low friction conditions in the curve, speed, tread differences between the front and rear tires, and the nonfunctioning ABS. The simulations found that the motorcoach could have safely negotiated the curve at a speed of 75 mph (the posted speed limit). The simulations further indicated that if the friction had not been sufficient for the motorcoach to have safely negotiated the curve, the vehicle would have gone off the outside of the curve to the left side or continued along the tangent of the curve, rather

55 A cumulonimbus cloud is a dense towering vertical cloud associated with thunderstorms and atmospheric instability. These clouds can produce lightning and severe weather. 56 See NTSB docket item for this investigation, “Vehicle Dynamics Study.” 57 The software used in the simulation study was the PC-Crash vehicle dynamics software. PC-Crash is a commercially available software that models three-dimensional motions of trucks and motorcoaches.

NTSB Highway Accident Report 31 than going off the inside of the curve, to the right, as it did in this crash. Although the simulations showed that there was sufficient friction to negotiate the curve, they also revealed that the wet road surface, in combination with tread differences between the front and rear tires, would have made the motorcoach less stable and more prone to spinning out in the event of inappropriate steering and/or braking in the curve by the driver. These results meant that, for the driver to have safely negotiated the curve, he would have had to have minimized his steering and braking as he negotiated the curve and to have avoided situations that required significant steering or braking.

NTSB Highway Accident Report 32 2 Analysis 2.1 Introduction The crash occurred when an OGA Charters motorcoach, traveling northbound on US-83 near Laredo, departed the roadway to the right and rolled onto its left side. Nine passengers died, and 36 passengers received minor-to-serious injuries. The severity of injury for five passengers was undetermined, and both the bus driver and trip coordinator received minor injuries. The analysis portion of this investigative report first discusses those factors that could be excluded as not causing the crash or contributing to the severity of its outcome. Then, it addresses the motorcoach driver’s loss of control and the crash sequence, as well as how the driver’s poorly treated diabetes and sleep-deficit-related fatigue affected his performance (sections 2.2 and 2.3), before providing a detailed discussion of the safety issue areas. The following safety issues are discussed: • Inadequate federal oversight and guidance for commercial drivers with diabetes treated without insulin (section 2.3.1). • Inaccurate and incomplete highway maintenance recordkeeping by TxDOT, leading to deficiencies in conducting safety-critical highway maintenance (section 2.4.1). • Need for improved training for TxDOT maintenance workers to ensure that roadway maintenance operations result in acceptable levels of surface friction (section 2.4.2). • Need for increased motorcoach crashworthiness through improvements to window glazing and retention (section 2.5). • Driver fatigue resulting from poor safety management by OGA Charters and inadequate federal safety ratings for passenger motor carriers with repetitive driver violations in the area of driver performance (sections 2.3.2 and 2.6). As a result of this investigation, the NTSB established that the following factors did not cause or contribute to the crash: • Motorcoach driver licensing and qualifications: The driver held a current CDL, which included an endorsement for the transportation of passengers. In addition to driving motorcoaches part-time for various employers, he was employed full-time as a school bus driver. • Substance impairment and cell phone distraction: Following the crash, the motorcoach driver was tested for alcohol and other drugs, and all test results were negative. Additionally, the driver’s cell phone records were evaluated, and the records showed that he was not using a cell phone immediately before the crash. • Roadway geometry and posted speed limit for US-83: The horizontal curve along US-83 where the crash occurred has a super-elevation of about 4 percent, a design that facilitates traversing the curve at the posted 75-mph speed limit. Additionally,

NTSB Highway Accident Report 33 postcrash simulations showed that the motorcoach could have successfully navigated this curve at highway speeds. • Emergency response: Because the crash location was relatively remote, the TxDPS, the agency that had primary jurisdiction, arrived at the scene about 30 minutes after the first 911 calls were received. However, because CBP officers were patrolling near the crash scene, emergency responders were on the scene almost immediately. Two of the four law enforcement officers who were first to arrive at the scene had EMT training, allowing them to perform initial triage and evacuation assistance. By the time the first fire/rescue units arrived, the CBP had established incident command and initiated a mass casualty incident. One of the first law enforcement officers to arrive also worked part-time at Angel Care, a local ambulance service, which allowed him to communicate pertinent injury information to ambulance supervisors while the fire/rescue units were still en route. Seven EMS agencies responded to the crash and transported 44 victims to local hospitals for treatment. In summary, despite the remote location of the crash, law enforcement and incident command were timely and effective, due in part to the proximity of nearby CBP agents. Therefore, the NTSB concludes that none of the following were factors in the crash: (1) driver licensing or qualifications, (2) alcohol or other drug use by the motorcoach driver, (3) driver cell phone distraction, and (4) roadway geometry or the posted speed limit for US-83 at the curved segment where the crash occurred. The NTSB further concludes that the emergency response was timely and effective. With respect to vehicle condition, the postcrash inspection of the motorcoach found no tire or wheel deficiencies, the vehicle was equipped with the appropriate size and load range of tires, and tire inflation pressures and tread depths were within reasonable operating ranges. Although the electronic control of the ABS was inoperable, the foundation components of the air brake system were functional and undamaged, and the brake disc rotors and pads were within specified wear limits. The steering wheel, steering column, steering gear box, steering linkage, and suspension system were undamaged and functional. 2.2 Driver’s Loss of Control and Crash Sequence Both the simulation study and conventional critical speed computations showed that the motorcoach could have safely negotiated the curve while traveling at the 75-mph speed limit, even with the low friction of the pavement (Dickerson and others 1995).58 Additionally, the physical evidence indicated that the vehicle’s departure from the roadway was not due to excessive speed. Had the driver entered the righthand curve of US-83 at a speed exceeding the limits of the available friction, the motorcoach would have been unable to continue along the curved path of the roadway and would have tended to move toward the outside of the curve on the roadway’s west side; it would not have departed the roadway’s east side, as occurred in the crash. Had the driver initiated a continuous hard brake application, resulting in a skid, the motorcoach would have continued

58 Critical speed is the point at which a vehicle enters the limit of tire-to-road surface adhesion in a turn. Lateral force applied to the tires in a turn exceeds the tire’s ability to generate an equally opposing force.

NTSB Highway Accident Report 34 along its original path and moved toward the outside of the curve rather than departing the inside (east side) of the curve, as it did in this crash. The results of the simulations indicated that the loss of control was consistent with a crash scenario in which the motorcoach entered the curve and began to drift or move to the left out of the northbound lane, with the driver responding by steering and braking, causing the vehicle to leave the roadway. This type of crash scenario is consistent with the driver’s diminished perception of the roadway environment and the changes in the pavement markings within the curve, which would have increased the driver’s risk of departing his travel lane in the curve. In this case, the pavement’s reduced friction, due to its wet surface and condition (see section 2.4.2), increased the risk of the motorcoach spinning out if the driver made significant braking or steering inputs while traversing the curve. The motorcoach’s inoperable ABS compounded the problem of vehicle control. The absence of an ABS could have significantly increased the risk that the driver would lose control while braking in the curve. In a crash of this type, the low pavement friction, combined with the lack of ABS, could cause the brakes to lock up and the motorcoach to slide, potentially leading to driver overcorrection or premature rear wheel lockup. The driver’s recollection that he thought the motorcoach began to slide after he braked is consistent with the wheels locking up as result of the nonfunctioning ABS. Based on the evaluation of the driver’s condition, the crash scene environment, the roadway geometry, and the results from computer simulations, the NTSB concludes that the motorcoach initially moved to the left as it entered the curve, and the driver steered to the right and braked, causing the motorcoach to depart the east side of the highway and roll over. The NTSB further concludes that the pavement’s reduced friction, combined with the motorcoach’s inoperable ABS, contributed to the driver’s inability to regain control of the vehicle. All new commercial vehicles manufactured since March 1, 1998, are required to be equipped with an ABS. Until July 2016, the annual vehicle inspection did not include a vehicle’s ABS and its operability. As of July 2016, the annual inspections have included the ABS for those vehicles that are required to be equipped with ABS. However, some vehicles, like the motorcoach in this crash, were equipped with an ABS before March 1, 1998, when it became required equipment. For such vehicles, the annual inspection did not, and does not, include the ABS because it is not required equipment. 2.3 Driver Factors 2.3.1 Diabetes 2.3.1.1 Driver’s Diabetes Management. The driver’s blood glucose, measured hours after the crash, demonstrated severe hyperglycemia; his blood glucose was 373 mg/dl, while a normal random glucose result is about 60–140 mg/dl.59 In addition, his hemoglobin A1C was 12.7 percent, which indicated that his blood glucose over the preceding weeks had averaged about 318 mg/dl (Nathan and others 2008). These levels are indicative of uncontrolled diabetes; having

59 Hyperglycemia is the medical term for a high blood sugar (glucose) level.

NTSB Highway Accident Report 35 a hemoglobin A1C below 7 percent is considered diabetes in “good” control. Events that create stress, such as being involved in a motor vehicle crash, may lead to release of cortisol and other fight-or-flight hormones that could result in an increase in blood sugar. However, the demonstrated extent of elevation in both the measured blood glucose and the hemoglobin A1C for the motorcoach driver postcrash was such that the NTSB concludes that the motorcoach driver’s blood sugar was significantly elevated at the time of the crash due to poorly controlled diabetes. Hyperglycemia causes a variety of symptoms, including increased urine production, increased hunger and thirst, and blurred vision (Laffel and Svoren 2016). The glucose is distributed throughout the body’s fluids, including into the eyes. As a result, the shape of the eyeball changes, and vision is affected. There are case reports of farsighted individuals whose vision improves with hyperglycemia (Golay, Ferrini, and Tagan 2013). However, blood glucose elevations to about 290 mg/dl have been demonstrated to make a person more nearsighted (myopic) by about two diopters (Furushima, Imaizumi, and Nakatsuka 1999). The muscles of the eye cannot compensate for such significant effects, so blurred vision ensues. The NTSB concludes that the motorcoach driver’s poorly controlled diabetes and resulting hyperglycemia most likely led to blurred vision at the time of the crash. As discussed earlier in the report, the highway environment changed as the driver entered the curve where the crash occurred. Once the motorcoach was within the curve, the two through lanes were configured to include both a separate turn lane and the painted center median. The lane markings delineating these different configurations had degraded significantly and were, at some locations, entirely absent. Additionally, maintenance work performed before the crash made the wet surface of the northbound travel lane highly reflective, making it increasingly difficult for a driver to discern the markings. As a result, the NTSB concludes that the roadway cues available to enable the motorcoach driver to properly position his vehicle within the northbound driving lane of the highway were degraded, and the visual difficulties were compounded by the driver’s likely blurred vision resulting from his poorly controlled diabetes. 2.3.1.2 Federal Oversight of Drivers with Diabetes. Guidelines exist for health care providers treating patients with type 2 diabetes. According the 2016 Standards of Medical Care in Diabetes from the American Diabetes Association, recommended treatment goals for type 2 diabetes include a hemoglobin A1C of 7.0 percent or less, with measurements taken at least twice a year for patients reaching their targets and at least four times a year for patients not reaching their targets. The occurrence of episodes of symptomatic and asymptomatic hypoglycemia should be discussed at every visit. In the long term, poorly controlled diabetes causes permanent damage to the backs of the eyes (retinopathy), kidneys (nephropathy), and nerves (neuropathy). The abovementioned guidelines also state that patients with type 2 diabetes should have an initial comprehensive eye examination conducted by an ophthalmologist or optometrist shortly after the diagnosis of diabetes. If there is no evidence of retinopathy for one or more eye exams, then conducting such exams at 2-year intervals may be considered. In addition, all patients should be screened for

NTSB Highway Accident Report 36 diabetic peripheral neuropathy when a diagnosis of type 2 diabetes is made, and at least annually thereafter, using simple clinical tests (American Diabetes Association 2016).60 Although these diabetes treatment guidelines exist, the level of adherence to the recommended practices is low. According to the Centers for Disease Control and Prevention (CDC), in 2010 (the most recent data available), although almost 90 percent of adults with diabetes in the United States had visited a doctor at least once for their diabetes in the preceding year, less than 70 percent had had two hemoglobin A1C tests (or a foot exam) and less than 65 percent had had a dilated eye exam (CDC 2014[a] through [d]). Thus, the fact that a patient is receiving care for diabetes does not mean that the recommended treatments are being applied. Because safe vehicle operation relies on a driver’s sensory processing—especially of the senses of sight, sound, and touch—degradation of these inputs increases a driver’s crash risk. The NTSB concludes that the fact that a driver with diabetes receives professional medical care does not guarantee that the disease is sufficiently controlled to enable the driver to operate a vehicle safely. In other modes of transportation, specific standards address the medical certification of workers with type 2 diabetes. Merchant mariners who have diabetes controlled with oral medication are subject to medical review beyond their periodic physical examinations. Navigation and Vessel Inspection Circular (NVIC) 04-2008 details the recommended additional evaluation, which includes— Internal Medicine consultation documenting interval history, blood pressure and weight, evaluation of fasting plasma glucose; and, two current hemoglobin A1C’s (<8.0%) separated by at least 90 days, the most recent no more than 90 days old, ophthalmology consultation… (US Department of Homeland Security 2016). In aviation, based on 14 CFR 67.113(a), pilots with diabetes that requires insulin, or any other hypoglycemic drug, for control are disqualified from flight. However, the FAA may issue such a pilot a special medical certificate, provided that the pilot is being treated and meets specified standards. For pilots being treated with oral medications, an aviation medical examiner (AME) can reissue a medical certificate if the pilot provides specific information from his treating physician regarding current glycemic control, episodes of hypoglycemia (low blood sugar), and the presence or absence of long-term cardiovascular, neurologic, ophthalmologic, or renal complications. If the pilot’s most recent hemoglobin A1C is higher than 9.0 percent or if there have been episodes of hypoglycemia or evidence of complications, the AME cannot issue a certificate, and higher-level review must occur (FAA 2015). These more rigorous controls on the medical certification of marine and aviation operators with diabetes are safeguards that could be applied to commercial highway operators. The NTSB concludes that, had current medical standards for merchant mariners and aviation pilots been applied to the Laredo motorcoach driver, they might have prevented him from receiving a medical certificate until his diabetes was adequately controlled.

60 Diabetic peripheral neuropathy is a type of nerve damage that can occur in persons with diabetes. High blood sugar can injure nerves throughout the body. Diabetic neuropathy most often damages nerves in the legs and feet, causing discomfort and of the loss of ability to feel pain. Comprehensive foot exams conducted by medical professionals are recommended for patients with diabetes.

NTSB Highway Accident Report 37 In contrast to authorities in other modes of transport, the FMCSA places on the CME all decision-making responsibility for drivers with non-insulin-treated diabetes; moreover, the FMCSA does not provide CMEs with sufficient thresholds for diabetic control. Instead, the FMCSA relies on the CME’s clinical judgment and provides no guidance regarding the need to obtain laboratory information, acceptable standards for glucose control, or specialty evaluation, such as by an ophthalmologist. The only recommendation from the FMCSA to CMEs concerning drivers with non-insulin-treated diabetes is that they limit the medical certification of such drivers to 1 year rather than 2 years (FMCSA 2014). In 2006 and again in 2011, the FMCSA formed expert panels to evaluate the issue of diabetes and commercial driver safety. The reports from both panels indicated a small, but measurable, increase in the risk of motor vehicle collisions for drivers with diabetes. Both panels, however, focused on the risks posed by hypoglycemia (low blood sugar) rather than on those posed by hyperglycemia or on the safety consequences of renal, neurologic, or ophthalmologic complications resulting from long-term, poorly controlled diabetes (FMCSA 2007 and 2011). Further, the panels’ reports contain no specific guidelines for CMEs to use when certifying drivers with diabetes to limit the risks posed by hyperglycemia. The FMCSA has chosen to include among its CMEs any health care provider licensed to perform physical exams. In most states, this includes chiropractors; in some states, it also includes physical therapists. These two types of providers, in particular, have no training or experience in providing medical care to patients who require prescription medication for diabetes. Some other CMEs that are acceptable to the FMCSA do not routinely provide primary care for patients with diabetes and may have imperfect knowledge of treatment guidelines, little experience in evaluating the quality of glucose control, and limited ability to evaluate patients for diabetic complications. The NTSB concludes that not all CMEs recognized by the FMCSA have the knowledge, skills, and experience to adequately assess the potential safety implications of poorly controlled diabetes for the drivers they examine, based solely on their clinical judgment. Therefore, the NTSB recommends that the FMCSA develop and publish explicit guidance for CMEs to use when making medical certification decisions regarding drivers with diabetes who are not treated with insulin. At a minimum, this guidance should recommend that every certification examination of a non-insulin-treated driver with diabetes document the results of a recent hemoglobin A1C test, any symptomatic hypoglycemia episodes, and detailed findings from periodic evaluations for diabetic complications, including retinopathy, neuropathy, and nephropathy; and provide CMEs with explicit certification criteria, including certification time limits and disqualifying results. 2.3.2 Fatigue For most of the week preceding the crash, the driver’s activities were routine, as he took his regular morning and afternoon shifts driving a school bus. However, 2 days before the crash, on Thursday, May 12, after completing his afternoon shift, the driver picked up a motorcoach from OGA Charters and brought it back to his residence. The driver reportedly went to bed at 10:30 p.m., but cell phone records show that he used his phone at 11:21 p.m. that night. In the early morning of Friday, May 13, the driver left his home to drive a chartered trip for OGA Charters. The driver went on duty that morning at 3:45 a.m. After picking up passengers

NTSB Highway Accident Report 38 in Weslaco, he drove about 248 miles to his destination in San Antonio; after dropping off his passengers, he went off duty at 10:30 a.m. The driver said he remained on the motorcoach to rest, but instead of sleeping continuously, he used his cell phone on five occasions between 11:24 a.m. and 4:53 p.m. Cell phone records showed that the time between each of these calls was less than 1 hour; indicating that during the approximately 5.5 hours that the driver was reportedly resting, he had little or no opportunity for uninterrupted sleep. About 5:00 p.m., the driver left the bus to get something to eat, and then he went back on duty at 6:15 p.m. The driver loaded his passengers, departed San Antonio, and dropped the passengers off in Weslaco at 10:30 p.m. From there, he drove the motorcoach back to his residence and went off duty at 11:30 p.m. The driver’s total time in either on-duty status or driving that day totaled 13 hours 15 minutes. On Saturday, May 14, the day of the crash, the driver made two brief calls, at 12:07 a.m. and 12:27 a.m. He reported that then, after having slept for no more than about 2 hours, he woke up at 2:30 a.m. and prepared for driving another charter trip for OGA Charters. An hour later, the driver left his residence and traveled to Brownsville to pick up passengers. Once all the passengers had been loaded, he began driving to the casino in Eagle Pass. Before the crash, the driver made two stops, one in Zapata for fuel and one at a CBP checkpoint about 10 miles south of the crash location. Some moments before 11:24 a.m., with the driver having been awake for about 9 hours, the motorcoach drifted left from the northbound travel lane of US-83, and the driver reacted with abrupt steering input and braking, resulting in the loss of control and the crash. The NTSB concludes that, in the 2 days before the crash, the driver’s total opportunity for sleep, apart from short naps while waiting on the motorcoach, was about 6 hours. Moreover, the NTSB concludes that on the night before the crash, the motorcoach driver had a sleep opportunity of only about 2 hours. Research has shown that sleep deprivation, from either acute sleep loss over a short period or chronic partial sleep loss over multiple days, is associated with delayed reaction time and lapses in attention (Goel and others 2009). Additionally, a recent study showed that driver crash risk nearly doubles from one night of sleep of a duration less than 6 hours; moreover, as the sleep duration declines, the risk progressively worsens (Tefft 2016).61 The NTSB concludes that the driver’s failure to maintain the motorcoach within the northbound travel lane was due, in part, to fatigue from an acute sleep deficit in the days preceding the crash. 2.4 Highway Maintenance The crash event began in a curved section of US-83 near MM 670.7. Since August 2011, this portion of the highway had been subject to various maintenance activities, including a pavement overlay operation, a project to widen and restripe the curve to accommodate the installation of turn lanes and driveways, a chip sealing project that was unsuccessful, and a

61 Specifically, the study stated, “Drivers who had slept for less than 4 hours, 4–5 hours, 5–6 hours, and 6–7 hours in the past 24 hours had an estimated 11.5, 4.3, 1.9, and 1.3 times the crash rate, respectively, of drivers who had slept for 7 hours or more in the past 24 hours.”

NTSB Highway Accident Report 39 pavement milling effort that was intended to improve the inadequate surface friction that resulted from the failed chip sealing project.62 2.4.1 TxDOT Daily Activity Reports With respect to the chip sealing project conducted in the northbound travel lane on October 21, 2015, TxDOT’s DAR dated for that day indicates that a full-width chip seal was applied on US-83; however, the report does not specifically state whether the application was made to the full width of the northbound travel lane, of the southbound travel lane, or of both lanes. The DAR also lists the work as having been performed within a 34-mile-long segment of the highway between MMs 664 and 698. The crash occurred in the vicinity of MM 670.7, and TxDOT told the NTSB that the chip seal had been applied to this location on US-83; however, nothing in the DAR for October 21, 2015, specifically verified this statement. The NTSB examined another DAR seeking confirmation of maintenance work performed after the October 21 chip seal operation. According to TxDOT, the chip seal project was not successful, and the aggregate applied to the roadway during the operation was displaced shortly after the application, which reduced the pavement’s surface friction. To address this problem, on October 26, TxDOT had the highway surface milled in an attempt to improve its friction characteristics. The DAR for October 26 stated that the milling and planing work occurred as scheduled, but the location recorded on the report did not identify the area of MM 670.7.63 Moreover, the DAR did not provide information to show whether the work was performed in the northbound travel lane, the southbound travel lane, or both lanes. Throughout this investigation, the NTSB routinely encountered inaccuracies in the recordkeeping and information provided by TxDOT concerning maintenance work.64 When asked by NTSB investigators about specific maintenance activities, TxDOT personnel did not refer to DARs or other records but instead gave answers based on their own recollections of events, including on such specific facts as when, where, and how maintenance was performed. The NTSB concludes that, because the information in the TxDOT’s DARs was vague and inaccurate, agency personnel had to rely on institutional knowledge rather than reports to recall details of the maintenance operations conducted on US-83, which resulted in uncertainty about when, where, and how safety-critical work was performed. In addition to making it difficult to determine whether work has been done in a specific location, uncertainty about maintenance activities can have more far-ranging consequences to a state’s highway maintenance program. Concerning pavement management systems (PMS), 23 CFR 500.106 states—

62 A successful chip sealing project was completed in August 2016, about 3 months after the crash. 63 Despite the lack of verification in the DARs, the analysis of the core samples of the roadway near MM 670.7 obtained by the NTSB confirmed that both the chip seal and milling operations had occurred at the location. 64 See appendix A of the docket item for this project titled “Highway Factors Group Chairman’s Memorandum of Analysis.” The appendix details the communications between NTSB investigators and TxDOT personnel concerning this investigation and the many instances of confusion and correction by TxDOT concerning its highway maintenance activities.

NTSB Highway Accident Report 40 An effective PMS for Federal-aid highways is a systematic process that provides information for use in implementing cost-effective pavement reconstruction, rehabilitation, and preventative maintenance programs and that results in pavements designed to accommodate current and forecasted traffic in a safe, durable, and cost-effective manner. Although maintenance recordkeeping is not a PMS element, there is a crucial connection between asset management and pavement management. Without accurate records of previous roadway maintenance, a state department of transportation cannot fully account for its assets and may not be able to accurately forecast performance targeting within its PMS. The FHWA has offered National Highway Institute training courses and peer exchanges in the interest of disseminating best practices for PMSs. Because of the connection between asset management and pavement management, the FHWA anticipates providing updates to the states for developing improved asset management practices (National Highway Institute 2018). During the NTSB’s investigation of a September 15, 2015, crash in Houston, Texas, in which a school bus collided with and overrode a bridge rail, and then fell onto the road below, investigators uncovered instances of inadequate recordkeeping related to highway maintenance by TxDOT (NTSB 2016a) similar to those found during the Laredo investigation. During the Houston investigation, TxDOT determined through a forensic examination that a previous severe impact had occurred at the bridge rail in the same location as the school bus crash. However, TxDOT could not determine when the previous impact had occurred, could not account for the repair process used to rebuild the bridge railing, and had no information regarding what entity had performed the repair because the agency did not keep maintenance records documenting bridge railing improvements and repairs. As a result of the Houston crash, the TxDOT Bridge Division evaluated its recordkeeping processes and implemented improvements. These improvements included deploying new inspection software for collecting bridge inspection data and establishing procedures to make use of the new software’s capabilities for collecting and documenting bridge railing improvement projects. Despite the department’s efforts to improve the documentation of bridge rail work, based on the Laredo crash investigation, the NTSB concludes that TxDOT’s maintenance recordkeeping continues to be inadequate and does not accurately capture and record maintenance operations vital to roadway safety. Therefore, the NTSB recommends that TxDOT evaluate its processes for collecting and recording maintenance information through its DARs to ensure that the reports accurately and completely reflect the location and details of the work performed. Further, the NTSB recommends that TxDOT revise its processes for collecting and recording maintenance information through its DARs based on the results of the evaluation conducted in response to Safety Recommendation H-18-52 to ensure that the information contained in the DARs is accurate, complete, and sufficiently detailed to represent the full extent of maintenance activities. 2.4.2 Surface Friction and Pavement Milling After the crash, TxDOT performed a series of surface friction tests along US-83. The tests within the curved section of the highway where the crash event began were performed with both smooth and ribbed test tires, in compliance with ASTM Standard E-274. Using a skid number range of 1–99 for tests with a smooth tire at 50 mph in wet conditions, in the vicinity of the crash, skid numbers were as low as 5.4. According to the summary report produced by the TFHRC for

NTSB Highway Accident Report 41 the NTSB, the skid number results in the vicinity of the crash would be considered extremely low by agencies that evaluate the friction characteristics of their highways.65 The test results showed that some friction levels along US-83 were in the lowest of TxDOT’s five friction categories. According to the TFHRC report, factors that influence pavement friction fall into the following four categories: • Pavement surface characteristics, • Vehicle operational parameters, • Tire properties, and • Environmental factors. Pavement surface characteristics that influence pavement friction include microtexture, which corresponds to wavelengths of texture less than 0.5 millimeter, and macrotexture, which corresponds to wavelengths of texture between 0.5 and 50 millimeters, with the most significant wavelengths below 10 millimeters (AASHTO 2008). The ribbed tire friction test is generally considered insensitive to macrotexture, while the smooth tire test is considered sensitive to both microtexture and macrotexture. Results of smooth tire tests that are significantly below the corresponding ribbed tire test results, as was the case in the Laredo crash location, indicate both low microtexture and low macrotexture (Wambold, Henry, and Blackburn 1984). On October 21, 2015, about 7 months before the crash, TxDOT had attempted to apply a chip seal on US-83. The project was not successful, and the aggregate that was applied to the top layer of pavement during the operation became displaced from the highway. Then, to address the low surface friction resulting from the loss of aggregate, TxDOT milled the northbound travel lane on October 26, 2015. However, the milling operation was also unsuccessful, and it left gouges and continuous longitudinal grooves in the pavement. (See figure 13.)

65 For example, although it uses different criteria than TxDOT for friction levels, the Washington State Department of Transportation specifies a minimum skid number value of 30.0.

NTSB Highway Accident Report 42

Figure 13. View of US-83 northbound travel lane shortly after the crash, showing gouges and continuous longitudinal grooves in the pavement surface. The problems with the pavement texture in the crash area are particularly apparent when comparing the pavement immediately postcrash to the pavement as it was after successful maintenance operations—including chip sealing—were conducted in August 2016, about 3 months after the crash, as indicated in figure 14. After the successful work, the texture of the roadway surface was uniform, it no longer appeared slick, and the grooves and gouges were gone.

Figure 14. Views of the northbound US-83 lane looking south. The photo on the left shows the northbound travel lane as it appeared in May 2016. The photo on the right shows the northbound travel lane as it appeared in August 2016, after the completion of the successful chip seal operation.

NTSB Highway Accident Report 43 The TFHRC report to the NTSB concluded that the results of the milling operation on October 26, 2015, produced results that did not conform to TxDOT standard specifications for planing and texturing as detailed in the TxDOT Planing and Texturing Pavement Specifications. It is unclear how the longitudinal grooves in the pavement surface were made, but the report theorized that they could have been produced by a milling head with misaligned teeth. The NTSB concludes that the pavement milling operation performed on US-83 by the TxDOT maintenance crew on October 26, 2015, was inadequate and did not conform to the agency’s own specifications. Additional TFHRC analysis of the pavement in the vicinity of the crash determined that the milling performed on October 26, 2015, did not provide adequate macrotexture and friction. Further, the TFHRC stated that pavement core samples 1B and 5B, which were taken from the milled area, had a 2–3-millimeter-thick asphalt-rich layer at their tops.66 Finding such an asphalt-rich layer on the top of a pavement is consistent with the failed chip seal operation on October 21, 2015, in which sufficient aggregate was not retained. Further, the presence of this asphalt-rich layer demonstrates that the milling operation conducted 5 days later did not adequately remove the slick top layer of asphalt emulsion placed during the failed chip seal operation. The NTSB concludes that the asphalt-rich layer observed on the surfaces of pavement core samples 1B and 5B from the crash area contributed to the low surface friction values of the pavement. Therefore, the NTSB recommends that TxDOT assess, and modify as necessary, the training provided to its maintenance personnel to ensure that the results of milling operations conform to its Planing and Texturing Pavement Specifications. Because the milling did not adequately remove the asphalt emulsion placed as part of the failed chip seal operation, the NTSB also recommends that TxDOT train its maintenance personnel to evaluate milling operations so that the resulting pavement surface provides acceptable levels of friction. 2.5 Motorcoach Occupant Protection 2.5.1 Seat Belts At the time of the crash, the 1998 Van Hool motorcoach was nearly 20 years old. Evaluation of the passenger-carrying and occupant safety aspects of the motorcoach revealed a vehicle that was outdated and worn; some of the interior furnishings, such as the armrests, exhibited precrash damage. However, features vital to passenger safety, such as seat securement to the floor and proper functioning of emergency exits, were operational. In addition, the motorcoach had been designed based on European standards in place at the time of manufacture, which required seat belts for the exposed seating positions (those without a seatback in front of them).67 Although five passenger seats and the jump seat were equipped with lap belts, there was no clear evidence that they were used. Since this vehicle was manufactured, motorcoach seat belt technology and regulations have evolved substantially. The NTSB’s 1999 special investigation report on Bus Crashworthiness Issues concluded that retaining occupants within their seating compartments would reduce injury

66 A surface layer of asphalt of 1 millimeter or more in depth will effectively negate the influence of pavement macrotexture. 67 The European standard that Van Hool followed was directive 90/629/EEC, which became effective July 1, 1992.

NTSB Highway Accident Report 44 risk (NTSB 1999b). The National Highway Traffic Safety Administration (NHTSA) 2007 Motorcoach Safety Plan and the DOT 2009 Departmental Motorcoach Safety Action Plan also reported safety benefits associated with passenger restraints in motorcoaches. Then, in November 2013, after completing a notice of proposed rulemaking (NPRM) process, NHTSA announced a final rule regarding seat belts on motorcoaches. The final rule amended 49 CFR 571.208 and fulfilled a statutory provision of the Motorcoach Enhanced Safety Act, which was part of the Moving Ahead for Progress in the 21st Century Act (MAP-21).68 The amendment, which became effective in November 2016, revised Federal Motor Vehicle Safety Standard 208 to require lap/shoulder belts on all driver and passenger seats for new over-the-road buses with GVWRs greater than 26,000 pounds and for all new motorcoaches, regardless of weight. However, the amendment did not require existing motorcoaches, such as the crash motorcoach, to be retrofitted and equipped with seat belts.69 2.5.2 Window Glazing During the crash sequence, the motorcoach yawed clockwise, rolled onto its left side, and came to rest with its front end partially on the easternmost edge of the road and its middle and rear on the eastern shoulder and ground (to the right of the northbound lanes). At some point during this sequence, the motorcoach’s left side window glazing failed, and some passengers were ejected. Evaluation of the medical records, autopsy reports, and other crash evidence indicates that a significant number of the seriously injured passengers were partially ejected, and it is likely that all of those passengers who died were either partially or fully ejected. Further, all the passengers who died suffered crushing injuries to the chest or head or both. These injury patterns, as well as the locations of the deceased at the crash scene—they were found under the left side of the vehicle—suggest that those who were fatally injured were ejected through the left side window glazing. The exact mechanisms for ejection could not be determined, but the following are possible scenarios: • The window glazing might have been compromised by the initial impact with the ground or by subsequent impacts, as the left side of the vehicle slid across the ground. • As the motorcoach rolled to the left, passengers might have fallen toward the windows and struck the glazing with sufficient force to break it. • Passengers seated next to windows might have had other passengers fall onto them, pushing them into the windows, causing the windows to break. Because lap/shoulder belts are now required on newly manufactured motorcoaches, and because many bus manufacturers had elected to install passenger lap/shoulder belts before the requirement went into effect in November 2016, some motorcoaches are already equipped with passenger restraints. Had the Laredo motorcoach been equipped with such restraints, and had the passengers used them, the movement of passengers into the windows during the crash sequence

68 For additional information on this legislation, see MAP-21 webpage, accessed June 7, 2018. 69 NHTSA examined the feasibility of retrofitting existing motorcoaches with lap/shoulder belts and determined that the cost and engineering expertise needed to conduct a retrofitting operation that would be sufficiently robust to make such belts adequate safety features would be beyond the means of many bus owners (for-hire operators), many of which are small businesses. Determining that satisfactory retrofitting operations would not be technically practicable at a reasonable cost, NHTSA decided not to pursue a retrofit requirement (NHTSA 2016).

NTSB Highway Accident Report 45 would have been curtailed. The NTSB concludes that, had the Laredo motorcoach passengers been restrained by seat belts, the potential for window breakage would have been reduced, but the flailing of the occupants nearest the windows and the contact with the ground would still have provided significant potential for window breakage. Advanced window glazing is less likely to break in a crash. NHTSA has conducted research on advanced window glazing with the objective of retaining the windows and preventing occupant ejections. The NTSB has supported this work and, in its 1999 special investigation report on Bus Crashworthiness Issues, made the following safety recommendation to NHTSA (NTSB 1999b): Expand your research on current advanced glazing to include its applicability to motorcoach occupant ejection prevention, and revise window glazing requirements for newly manufactured motorcoaches based on the results of this research. (H-99-49) The recommendation is currently “Open—Unacceptable Response.” On May 6, 2016, NHTSA issued an NPRM titled “Federal Motor Vehicle Safety Standards; Bus Emergency Exits and Window Retention and Release, Anti-Ejection Glazing for Bus Portals.” The NPRM established NHTSA’s intent to require advanced window glazing in high-occupancy buses (motorcoaches) and non-over-the-road buses with GVWRs greater than 26,000 pounds. The proposed standard would specify impactor testing of glazing materials and apply performance requirements for windows or glass panels on the sides, rear, and roof of the bus, to mitigate ejection and ensure that emergency exits remain operable. The NTSB concludes that the severity of the injuries experienced by those passengers who were ejected through the windows might have been mitigated by the effects of the use of seats belts to reduce the uncontrolled movement of passengers during the crash sequence, coupled with advanced window glazing to lessen the potential for ejections. The NTSB further concludes that the effectiveness of motorcoach occupant protection would be improved by passenger lap/shoulder belts and advanced window glazing because these safety features reduce the potential for belted passengers to fall across the vehicle during a rollover and to break out windows. Given the likely reduction in ejections during rollover crashes that could result when motorcoaches equipped with passenger seat belts are also furnished with advanced window glazing, the NTSB reiterates Safety Recommendation H-99-49 to NHTSA. 2.6 Motor Carrier Operations 2.6.1 OGA Charters Oversight of its Drivers At the time of the crash, the motor carrier OGA Charters had been in operation for 7 years. Throughout this period, the carrier had no safeguards in place to promote safety or mitigate risks. The carrier did not have any written policies or procedures for drivers to follow, and it did not have a company handbook. The carrier’s oversight of its drivers was minimal. Following the crash, the carrier reported that no one at OGA Charters verified the drivers’ records-of-duty status for accuracy, nor were the records audited to ensure driver compliance with hours-of-service

NTSB Highway Accident Report 46 requirements. The carrier owner made all decisions regarding company drivers on a case-by-case basis. OGA Charters lacked any systematic approach to maintaining safety, and the carrier provided only the minimum safety management required by the FMCSA to retain its operating authority. The NTSB concludes that, throughout its operational history, the motor carrier OGA Charters failed to provide adequate oversight of its drivers. 2.6.2 FMCSA Oversight of OGA Charters 2.6.2.1 Compliance Reviews. Before the crash, the carrier had been subject to two FMCSA compliance reviews (in 2010 and 2014) and seven roadside inspections. Both compliance reviews resulted in satisfactory ratings, but they also uncovered numerous driver and vehicle violations. Three of the roadside inspections resulted in the vehicle being placed out of service for brake system defects, and two of the inspections found that a company driver had logbook violations. Additionally, at the time of the crash, the carrier had an alert in the hours-of-service BASIC. Following both compliance reviews, the FMCSA provided OGA Charters with specific recommendations and guidance on how the carrier could comply with regulations. The owner of OGA Charters failed to implement any of the recommended improvement actions. For example, although the owner was responsible for the carrier’s recordkeeping, he did not routinely perform audits of drivers’ hours of service. He told NTSB investigators that he had been having problems with getting the crash driver to turn in his record-of-duty status, as required. Although the owner was aware of the crash driver’s failures to provide his record-of-duty status as required, he allowed the driver unrestricted access to the motorcoach and afforded him the opportunity to drive with little or no supervision. After the crash, investigators asked the owner to provide a detailed account of the crash driver’s duty status for the days preceding the crash. The owner told investigators that it was not until he was responding to this request that he realized the driver had been scheduled to drive in excess of the allowable hours of service. The FMCSA postcrash compliance review found that the crash driver had falsified his logbook entries by indicating in the log that he was off duty the day before the crash.70 The NTSB concludes that, despite precrash compliance reviews that provided OGA Charters with specific recommendations from the FMCSA on how to comply with regulations and thereby improve safety, the carrier failed to take any action to improve the oversight of its drivers and ensure safe motorcoach operations through compliance with federal safety regulations. 2.6.2.2 FMCSA Safety Fitness Rating. The FMCSA postcrash compliance review of OGA Charters resulted in a conditional rating for the carrier. Given the carrier owner’s previous lack of compliance with federal safety regulations, the numerous and repeated violations involving driver oversight found in the postcrash review were entirely predictable. The NTSB has been and remains concerned that the FMCSA is routinely issuing satisfactory and conditional safety ratings to motor carriers, such as OGA Charters, with significant violations of regulations that are intended to ensure driver and vehicle safety.

70 The driver later reported he had not been off duty; he had actually driven the motorcoach on a charter trip to San Antonio for OGA Charters.

NTSB Highway Accident Report 47 Two key factors in safe motor carrier operations are the operational status of the vehicles (in this instance, the motorcoach) and the performance of the drivers. Increasing the weight of performance data for vehicle and driver factors in compliance reviews is important because such deficiencies are directly related to crashes. In its special investigation report on Selective Motorcoach Issues, the NTSB recommended that the DOT (NTSB 1999a)— Change the safety fitness rating methodology so that adverse vehicle or driver performance-based data alone are sufficient to result in an overall unsatisfactory rating for the carrier. (H-99-6) Safety Recommendation H-99-6 is classified “Open—Unacceptable Response.” When a compliance review identifies critical violations directly linked to a crash—such as driver hours of service—the FMCSA should either require the carrier to demonstrate a commitment to mitigating safety risks or put the carrier out of service. As a result of the investigation of a New York City motorcoach crash in March 2011, the NTSB made the following recommendation to the FMCSA (NTSB 2012): Include safety measurement system rating scores in the methodology used to determine a carrier’s fitness to operate in the safety fitness rating rulemaking for the new Compliance, Safety, Accountability initiative. (H-12-17) Safety Recommendation H-12-17 is classified “Open—Unacceptable Response.” The NTSB urged the FMCSA to move forward expeditiously on finalizing the safety fitness determination (SFD) process to help remove unsafe motor carriers and their drivers from the nation’s highways. Making CSMS scores an integral part of the SFD would provide a procedure by which the FMCSA could more directly and quickly shut down unsafe carriers. Because driver violations have been shown to be a clear indicator of crash risk, the SFD could address deficiencies in the current compliance review process by basing a motor carrier’s safety rating on violations of important safety-based regulations (as found in roadside inspections), which would help to keep unsafe carriers from continuing to operate. On January 21, 2016, the FMCSA published an NPRM to update the safety fitness rating methodology by integrating on-road safety inspection data with the results of carrier investigations and crash reports. The proposed SFD rule would facilitate updating a motor carrier’s overall safety fitness on a monthly basis. It would replace the current three-tiered system that provides rankings of “satisfactory,” “conditional,” or “unsatisfactory” with a single determination of “fit” or “unfit;” an “unfit” rating would require the carrier to improve its performance or cease operations. However, the NTSB is concerned that the language in the proposed rule, as written, does not fully address the intent of Safety Recommendation H-99-6, because the rating process may not appropriately value vehicle and driver factors in compliance review ratings. On March 23, 2017, the FMCSA withdrew its NPRM, citing a need to receive a Correlation Study from the National Academies of Science to enable it to determine what corrective actions are advisable, as well as the need to complete additional analysis before determining whether further rulemaking action is necessary to revise the SFD process. The NTSB is disappointed that the January 2016 NPRM has been withdrawn, further delaying improvement of the SFD process.

NTSB Highway Accident Report 48 In its report of a 2014 multivehicle collision on Interstate 88 near Naperville, Illinois, the NTSB determined that the delay in enacting SFD rulemaking has prevented the FMCSA from obtaining the additional tools it needs to more effectively address the safety risks posed by high-risk carriers (NTSB 2016b). As a result of the Naperville investigation, the NTSB reiterated Safety Recommendation H-12-17. In its report of a 2016 motorcoach crash in Livingston, California, in which a fatigued motorcoach driver allowed his vehicle to depart from its travel lane and collide with a signpost, causing the death of four passengers, the NTSB found that contributing to the cause of the crash were the failure of the motor carrier to follow adequate safety practices and the FMCSA’s lack of oversight, which allowed the company to continue operations despite known safety issues (NTSB 2017). The safety issues addressed in the Livingston crash included the inadequate federal safety ratings for passenger motor carriers with repetitive driver and vehicle violations. The NTSB reiterated Safety Recommendations H-99-6 and H-12-17 to address this unresolved safety issue. Had the FMCSA changed its safety fitness rating methodology to give appropriate weight to vehicle- and driver performance-based data, as the NTSB has repeatedly recommended, it would have had additional evidence before the Laredo crash that OGA Charters was a habitually unsafe carrier. The NTSB concludes that an improved safety fitness rating methodology would enable the FMCSA to better identify habitually unsafe carriers. Moreover, because of the inaccuracy of the compliance review safety ratings the FMCSA assigned to OGA Charters, the NTSB concludes that the Laredo crash further demonstrates the need for the FMCSA to implement an SFD methodology to expedite the process of shutting down unsafe carriers. The NTSB remains concerned about the delay in rulemaking and again reiterates Safety Recommendations H-99-6 and H-12-17 to the FMCSA.

NTSB Highway Accident Report 49 3 Conclusions 3.1 Findings

1. None of the following were factors in the crash: (1) driver licensing or qualifications,

(2) alcohol or other drug use by the motorcoach driver, (3) driver cell phone distraction, and (4) roadway geometry or the posted speed limit for US Highway 83 at the curved segment where the crash occurred.

1. The emergency response was timely and effective.
2. The motorcoach initially moved to the left as it entered the curve, and the driver steered to the

right and braked, causing the motorcoach to depart the east side of the highway and roll over.

1. The pavement’s reduced friction, combined with the motorcoach’s inoperable antilock braking

system, contributed to the driver’s inability to regain control of the vehicle.

1. The motorcoach driver’s blood sugar was significantly elevated at the time of the crash due to

poorly controlled diabetes.

1. The motorcoach driver’s poorly controlled diabetes and resulting hyperglycemia most likely

led to blurred vision at the time of the crash.

1. The roadway cues available to enable the motorcoach driver to properly position his vehicle

within the northbound driving lane of the highway were degraded, and the visual difficulties were compounded by the driver’s likely blurred vision resulting from his poorly controlled diabetes.

1. The fact that a driver with diabetes receives professional medical care does not guarantee that

the disease is sufficiently controlled to enable the driver to operate a vehicle safely.

1. Had current medical standards for merchant mariners and aviation pilots been applied to the

Laredo motorcoach driver, they might have prevented him from receiving a medical certificate until his diabetes was adequately controlled.

1. Not all certified medical examiners recognized by the Federal Motor Carrier Safety

Administration have the knowledge, skills, and experience to adequately assess the potential safety implications of poorly controlled diabetes for the drivers they examine, based solely on their clinical judgment.

1. In the 2 days before the crash, the driver’s total opportunity for sleep, apart from short naps

while waiting on the motorcoach, was about 6 hours.

1. On the night before the crash, the motorcoach driver had a sleep opportunity of only about

2 hours.

NTSB Highway Accident Report 50

1. The driver’s failure to maintain the motorcoach within the northbound travel lane was due, in

part, to fatigue from an acute sleep deficit in the days preceding the crash.

1. Because the information in the Texas Department of Transportation’s daily activity reports

was vague and inaccurate, agency personnel had to rely on institutional knowledge rather than reports to recall details of the maintenance operations conducted on US Highway 83, which resulted in uncertainty about when, where, and how safety-critical work was performed.

1. The Texas Department of Transportation’s maintenance recordkeeping continues to be

inadequate and does not accurately capture and record maintenance operations vital to roadway safety.

1. The pavement milling operation performed on US Highway 83 by the Texas Department of

Transportation maintenance crew on October 26, 2015, was inadequate and did not conform to the agency’s own specifications.

1. The asphalt-rich layer observed on the surfaces of pavement core samples 1B and 5B from the

crash area contributed to the low surface friction values of the pavement.

1. Had the Laredo motorcoach passengers been restrained by seat belts, the potential for window

breakage would have been reduced, but the flailing of the occupants nearest the windows and the contact with the ground would still have provided significant potential for window breakage.

1. The severity of the injuries experienced by those passengers who were ejected through the

windows might have been mitigated by the effects of the use of seats belts to reduce the uncontrolled movement of passengers during the crash sequence, coupled with advanced window glazing to lessen the potential for ejections.

1. The effectiveness of motorcoach occupant protection would be improved by passenger

lap/shoulder belts and advanced window glazing because these safety features reduce the potential for belted passengers to fall across the vehicle during a rollover and to break out windows.

1. Throughout its operational history, the motor carrier OGA Charters LLC failed to provide

adequate oversight of its drivers.

1. Despite precrash compliance reviews that provided OGA Charters LLC with specific

recommendations from the Federal Motor Carrier Safety Administration on how to comply with regulations and thereby improve safety, the carrier failed to take any action to improve the oversight of its drivers and ensure safe motorcoach operations through compliance with federal safety regulations.

1. An improved safety fitness rating methodology would enable the Federal Motor Carrier Safety

Administration to better identify habitually unsafe carriers.

1. The Laredo crash further demonstrates the need for the Federal Motor Carrier Safety

Administration to implement a safety fitness determination methodology to expedite the process of shutting down unsafe carriers.

NTSB Highway Accident Report 51 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the Laredo, Texas, crash was the driver’s failure to maintain the motorcoach fully within the northbound travel lane, due to a combination of fatigue from an acute sleep deficit and blurred distance vision due to hyperglycemia resulting from poorly controlled diabetes; then, as the motorcoach drifted left from the travel lane, the driver abruptly steered to the right and braked, causing the vehicle to leave the highway and roll over. Contributing to the driver’s inability to regain control of the motorcoach was the low friction value of the wet pavement and the inoperable antilock braking system. Contributing to the severity of the passenger injuries was the failure of the left side passenger windows to keep passengers within the motorcoach.

NTSB Highway Accident Report 52 4 Recommendations 4.1 New Recommendations As a result of its investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Motor Carrier Safety Administration: Develop and publish explicit guidance for certified medical examiners (CMEs) to use when making medical certification decisions regarding drivers with diabetes who are not treated with insulin. At a minimum, this guidance should recommend that every certification examination of a non-insulin-treated driver with diabetes document the results of a recent hemoglobin A1C test, any symptomatic hypoglycemia episodes, and detailed findings from periodic evaluations for diabetic complications, including retinopathy, neuropathy, and nephropathy; and provide CMEs with explicit certification criteria, including certification time limits and disqualifying results. (H-18-51) To the Texas Department of Transportation: Evaluate your processes for collecting and recording maintenance information through your daily activity reports to ensure that the reports accurately and completely reflect the location and details of the work performed. (H-18-52) Revise your processes for collecting and recording maintenance information through your daily activity reports (DARs) based on the results of the evaluation conducted in response to Safety Recommendation H-18-52 to ensure that the information contained in the DARs is accurate, complete, and sufficiently detailed to represent the full extent of maintenance activities. (H-18-53) Assess, and modify as necessary, the training provided to your maintenance personnel to ensure that the results of milling operations conform to your Planing and Texturing Pavement Specifications. (H-18-54) Train your maintenance personnel to evaluate milling operations so that the resulting pavement surface provides acceptable levels of friction. (H-18-55)

NTSB Highway Accident Report 53 4.2 Recommendations Reiterated in This Report The National Transportation Safety Board also reiterates the following safety recommendations: To the Federal Motor Carrier Safety Administration: Change the safety fitness rating methodology so that adverse vehicle or driver performance-based data alone are sufficient to result in an overall unsatisfactory rating for the carrier. (H-99-6) Include safety measurement system rating scores in the methodology used to determine a carrier’s fitness to operate in the safety fitness rating rulemaking for the new Compliance, Safety, Accountability initiative. (H-12-17) To the National Highway Traffic Safety Administration: Expand your research on current advanced glazing to include its applicability to motorcoach occupant ejection prevention, and revise window glazing requirements for newly manufactured motorcoaches based on the results of this research. (H-99-49) BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III

EARL F. WEENER Chairman

Member BRUCE LANDSBERG

T. BELLA DINH-ZARR Vice Chairman

Member

JENNIFER HOMENDY

Member Adopted: November 7, 2018

NTSB Highway Accident Report 54 Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified of the Laredo, Texas, crash on May 14, 2016, and dispatched an investigative team to the site. The NTSB established groups to investigate human performance; motor carrier operations; and highway, survival, and vehicle factors. Parties to the investigation were the Federal Highway Administration, the Federal Motor Carrier Safety Administration, the Texas Department of Public Safety, the Texas Department of Transportation, and ABC Companies.

NTSB Highway Accident Report 55 Appendix B: Skid Numbers for Northbound US-83 Table B-1. Skid numbers for northbound travel lane of US-83 in right wheel path. (The gray-shaded area provides the skid numbers in the vicinity of the crash [near MM 670.7])

Stationing* (miles) Skid Number 50 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Ribbed Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Dry Testing) 0.000 (RM 672)** 47.5 51.5

50.4

1. 050
2. 4
3. 4

47.9

1. 100
2. 3
3. 9

48.5

1. 150
2. 0
3. 9

50.9

1. 200
2. 7
3. 4

47.8

1. 250
2. 6
3. 9

49.7

1. 300
2. 8
3. 0

48.8

1. 350
2. 6
3. 7

46.8

1. 400
2. 9
3. 7

54.0

1. 450
2. 0
3. 8

53.3

1. 500
2. 8
3. 1

50.8

1. 550
2. 1
3. 2

45.2

1. 600
2. 8
3. 9

46.9

1. 650
2. 1
3. 4

45.2

1. 700
2. 6
3. 1

45.3

1. 750
2. 3
3. 6

41.3

1. 800
2. 1
3. 4
4. 0
5. 2
6. 850
7. 4
8. 3

15.7

1. 900
2. 3
3. 3
4. 2
5. 8
6. 950
7. 4
8. 9

19.8

1. 000 (RM 671)
2. 9
3. 9
4. 3
5. 6
6. 050
7. 7
8. 6

20.4

1. 100
2. 6
3. 0
4. 2
5. 8
6. 150
7. 6
8. 1

20.4

1. 200
2. 0
3. 6
4. 4
5. 6
6. 250
7. 9
8. 4

17.7

1. 300 (RM 670.7)
2. 9
3. 4
4. 0
5. 3
6. 350
7. 8
8. 4

14.2

1. 400
2. 1
3. 9
4. 7
5. 1
6. 450
7. 7
8. 0

32.3

NTSB Highway Accident Report 56 1.500 42.0 29.2

48.4

1. 550
2. 2
3. 6

45.6

1. 600
2. 2
3. 9

16.2

1. 650
2. 2
3. 7

46.5

1. 700
2. 9
3. 4

40.5

1. 750
2. 4
3. 0

55.9

1. 800
2. 2
3. 8

52.3

1. 850
2. 5
3. 4

36.5

1. 900
2. 2
3. 5

49.9

1. 950
2. 9

42.8

1. 000 (RM 670)

1. 8

1. 050

1. 2

• Stationing 0.000 started at MM 672.

** “RM” refers to mile marker. NTSB Highway Accident Report 57 Table B-2. Skid numbers for northbound travel lane of US-83 in left wheel path. (The gray-shaded area provides the skid numbers in the vicinity of the crash [near MM 670.7])

Stationing (miles) Skid Number 50 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Ribbed Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Dry Testing) 0.000 (RM 672) 53.0 69.2

50.9

1. 050
2. 9
3. 3

50.8

1. 100
2. 5
3. 6

49.8

1. 150
2. 7
3. 9

52.6

1. 200
2. 5
3. 3

49.8

1. 250
2. 8
3. 2

48.8

1. 300
2. 9
3. 3

50.5

1. 350
2. 2
3. 0

48.7

1. 400
2. 2
3. 4

52.9

1. 450
2. 9
3. 7

54.3

1. 500
2. 3
3. 1

54.7

1. 550
2. 4
3. 5

51.7

1. 600
2. 1
3. 2

48.7

1. 650
2. 9
3. 9

50.6

1. 700
2. 0
3. 8

49.2

1. 750
2. 2
3. 3

52.9

1. 800
2. 5
3. 8
4. 4
5. 8
6. 850
7. 9
8. 9

48.2

1. 900
2. 2
3. 2
4. 1
5. 0
6. 950
7. 5
8. 7

23.3

1. 000 (RM 671)
2. 9
3. 7
4. 5
5. 7
6. 050
7. 8
8. 1

21.4

1. 100
2. 9
3. 6
4. 0
5. 0
6. 150
7. 6
8. 3

19.5

1. 200
2. 8
3. 1
4. 2
5. 9
6. 250
7. 8
8. 7

18.5

1. 300 (RM 670.7)
2. 7
3. 3
4. 1
5. 1
6. 350
7. 4
8. 7

14.1

1. 400
2. 6
3. 2
4. 3
5. 9
6. 450
7. 5
8. 4

29.4

1. 500
2. 1
3. 8

36.7

1. 550
2. 4
3. 6

44.7

1. 600
2. 4
3. 3

18.3

1. 650
2. 3
3. 9

44.8

NTSB Highway Accident Report 58 1.700 23.3 9.4

24.8

1. 750
2. 5
3. 6

52.9

1. 800
2. 9
3. 6

54.5

1. 850
2. 1
3. 5

42.1

1. 900
2. 8
3. 8

55.4

1. 950
2. 3
3. 1

59.3

1. 000 (RM 670)
2. 3

30.9

1. 050
2. 2

NTSB Highway Accident Report 59 Table B-3. Skid numbers for northbound travel lane of US-83 between wheel paths. (The gray-shaded area provides the skid numbers in the vicinity of the crash [near MM 670.7])

Stationing (miles) Skid Number 50 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Wet Testing) Skid Number 40 mph using Ribbed Tire (Wet Testing) Skid Number 40 mph using Smooth Tire (Dry Testing)

0.000 (RM 672)

1. 6

56.5

0.050

1. 9

57.6

0.100

1. 4

55.0

0.150

1. 8

58.1

0.200

1. 2

53.8

0.250

1. 4

54.9

0.300

1. 1

56.5

0.350

1. 1

56.9

0.400

1. 1

55.7

0.450

1. 5

49.8

0.500

1. 0

57.4

1. 550
2. 5
3. 4

57.1

1. 600
2. 1
3. 0

59.1

1. 650
2. 8
3. 7

54.1

1. 700
2. 1
3. 4

49.3

1. 750
2. 2
3. 0

52.8

1. 800
2. 8
3. 7
4. 9
5. 9
6. 850
7. 3
8. 6

19.1

1. 900
2. 7
3. 5
4. 1
5. 5
6. 950
7. 7
8. 1

22.3

1. 000 (RM 671)
2. 2
3. 2
4. 8
5. 3
6. 050
7. 6
8. 1

58.8

1. 100
2. 6
3. 6
4. 1
5. 4
6. 150
7. 1
8. 3

49.4

1. 200
2. 9
3. 3
4. 0
5. 7
6. 250
7. 1
8. 9

21.0

1. 300 (RM 670.7)
2. 9
3. 9
4. 6
5. 5
6. 350
7. 8
8. 8

21.3

1. 400
2. 8
3. 5
4. 5
5. 0
6. 450
7. 0
8. 7

49.3

1. 500
2. 8
3. 7

53.3

1. 550
2. 1
3. 7

51.6

1. 600
2. 0
3. 6

32.5

1. 650
2. 4
3. 4

53.9

NTSB Highway Accident Report 60 1.700 53.9 35.3

63.1

1. 750
2. 5
3. 4

65.9

1. 800
2. 2
3. 7

64.8

1. 850
2. 3
3. 9

60.8

1. 900
2. 9
3. 0

65.2

1. 950
2. 8

60.3

1. 000 (RM 670)
2. 0
3. 3

1. 050

NTSB Highway Accident Report 61 Appendix C: Turner-Fairbank Pavement Friction Testing Summary Report

NTSB Highway Accident Report 62

NTSB Highway Accident Report 63

NTSB Highway Accident Report 64

NTSB Highway Accident Report 65

NTSB Highway Accident Report 66

NTSB Highway Accident Report 67

NTSB Highway Accident Report 68

NTSB Highway Accident Report 69

NTSB Highway Accident Report 70

NTSB Highway Accident Report 71

NTSB Highway Accident Report 72

NTSB Highway Accident Report 73

NTSB Highway Accident Report 74

NTSB Highway Accident Report 75 References AASHTO (American Association of State Highway and Transportation Officials). 2008. Guide for Pavement Friction, 1st ed. Washington, DC: AASHTO. _____. 2011. A Policy on Geometric Design of Highways and Streets, 6th ed. Washington, DC: AASHTO. American Diabetes Association. 2016. Diabetes Care: Journal of Clinical and Applied Research and Education. “Standards of Medical Care in Diabetes—2016.” Volume 39, Supplement 1, January 2016. http://care.diabetesjournals.org/highwire/filestream/5646/fie ld_highwire_adjunct_files/0/2016-Standards-of-Care.pdf, accessed October 24, 2018. CDC (Centers for Disease Control and Prevention). 2014(a). Age-Adjusted Percentage of Adults Aged 18 Years or Older with Diagnosed Diabetes Visiting a Doctor for Diabetes at Least Once in the Last Year, United States, 1994–2010. https://www.cdc.gov/diabetes/statistics/preventive/fx_dr_visit.htm, accessed October 24, 2018. _____. 2014(b). Age-Adjusted Percentage of Adults Aged 18 Years or Older with Diagnosed Diabetes Having Two or More A1c Tests in the Last Year, United States, 2000–2010. https://www.cdc.gov/diabetes/statistics/preventive/fY_ac1test.htm, accessed October 24, 2018. _____. 2014(c). Age-Adjusted Percentage of Adults Aged 18 Years or Older with Diagnosed Diabetes Receiving a Foot Exam in the Last Year, United States, 1994–2010. https://www.cdc.gov/diabetes/statistics/preventive/fx_foot.htm, accessed October 24, 2018. _____. 2014(d). Age-Adjusted Percentage of Adults Aged 18 Years or Older with Diagnosed Diabetes Receiving a Dilated Eye Exam in the Last Year, United States, 1994–2010. https://www.cdc.gov/diabetes/statistics/preventive/fx_eye.htm, accessed October 24, 2018. Dickerson, Charles P., Mark W. Arndt, Stephen M. Arndt, and Gregory A. Mowry. 1995. Society of Automotive Engineers, International, Evaluation of Vehicle Velocity Predictions Using the Critical Speed Formula. Technical Publication – 950137. Warrendale, Pennsylvania: SAE. FAA (Federal Aviation Administration). 2015. Guide for Aviation Medical Examiners. Special Issuances AME Assisted–All Classes-Diabetes Mellitus–Type II, Medication Controlled (Not Insulin). http://www.faa.gov/about/office_org/headquarters_offices/avs/offices/aam/ ame/guide/special_iss/all_classes/diabetes/, accessed October 24, 2018.

NTSB Highway Accident Report 76 FHWA (Federal Highway Administration). 2009. Manual on Uniform Traffic Control Devices for Streets and Highways. Washington, DC: FHWA. FMCSA (Federal Motor Carrier Safety Administration). 2007. Expert Panel Commentary and Recommendations Diabetes and Commercial Driver Safety. Presented to the Federal Motor Carrier Safety Administration, September 8, 2006 (Expedited Review). Washington, DC: FMCSA. (Panel members Patricia A. Daly, MD; Luciano Kolodny, MD; and Daniel L. Lorber, MD.) _____2011. FMCSA Evidence Report—2010 Update: Diabetes and Commercial Motor Vehicle Driver Safety. https://rosap.ntl.bts.gov/view/dot/24062, accessed October 24, 2018. _____. 2014. Frequently Asked Questions: May a driver who has non-insulin treated diabetes mellitus (treated with oral medication) be certified for 2 years? https://www.fmcsa.dot.gov/faq/may-driver-who-has-non-insulin-treated-diabetes- mellitus-treated-oral-medication-be-certifi, accessed October 24, 2018. Furushima, Masatoshi, Masamoto Imaizumi, and Kazuo Nakatsuka. 1999. “Changes in Refraction Caused by Induction of Acute Hyperglycemia in Healthy Volunteers.” Jpn J Ophthalmol. 43:398–403. Goel, Namni, Hengyi Rao, Jeffrey S. Durmer, and David F. Dinges. 2009. Neurocognitive Consequences of Sleep Deprivation. New York, NY: Thieme Medical Publishers, Inc. Golay, Michel, Walter Ferrini, and Damien Tagan. 2013. Refractory Changes in Hyperosmolar Diabetic Decompensation: When Hyperglycaemia Improves Vision. BMJ Case Report 2013; published online May 29, 2013. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3 669880/, accessed October 24, 2018. Laffel, L., and B. Svoren. 2016 (accessed). “Epidemiology, Presentation, and Diagnosis of Type 2 Diabetes Mellitus in Children and Adolescents.” In UpToDate: Waltham, Massachusetts. Nathan, David, M., Judith Kuenen, Rikke Borg, Hui Zheng, David Schoenfeld, and Robert J. Heine. 2008. “Translating the A1c Assay Into Estimated Average Glucose Values.” Diabetes Care. 31:1473‒1478. Arlington, Virginia: American Diabetes Association. National Highway Institute. 2018. Course listings on website. https://www.nhi.fhwa.dot.gov/home.aspx, accessed October 24, 2018. NHTSA (National Highway Traffic Safety Administration). 2016. Retrofit Assessment for Existing Motorcoaches, A Report to Congress. DOT HS 812 242. Washington, DC: NHTSA. NTSB (National Transportation Safety Board). 1999a. Selective Motorcoach Issues. Highway Special Investigation Report NTSB/SIR-99/01. Washington, DC: NTSB. _____. 1999b. Bus Crashworthiness Issues. Highway Special Investigation Report NTSB/SIR- 99/04. Washington, DC: NTSB.

NTSB Highway Accident Report 77 _____. 2012. Motorcoach Run-Off-the-Road and Collision With Vertical Highway Signpost, Interstate 95 Southbound, New York City, New York, March 12, 2011. Highway Accident Report NTSB/HAR-12/01. Washington, DC: NTSB. _____. 2016a. Passenger Vehicle/School Bus Collision and Roadway Departure, Houston, Texas, September 15, 2015. NTSB/HAB-16/05. Washington, DC: NTSB. _____. 2016b. Commercial Truck Collision with Stopped Vehicles on Interstate 88, Naperville, Illinois, January 27, 2014. Highway Accident Summary Report NTSB/HAR-16/01/SUM. Washington, DC: NTSB. _____. 2017. Motorcoach Run-Off-the-Road and Collision With Vertical Highway Signpost, State Route 99, Livingston, California, August 2, 2016. Highway Accident Report NTSB/HAR-17/03. Washington, DC: NTSB. Prowell, Brian, Jingna Zhang, and E. Ray Brown. 2005. Aggregate Properties and the Performance of Superpave-Designed Hot Asphalt Mix. National Cooperative Highway Research Report 539. Washington, DC: Transportation Research Board. Tefft, Brian, D. 2016. Acute Sleep Deprivation and Risk of Motor Vehicle Crash Involvement. Washington, DC: AAA Foundation for Traffic Safety. TxDOT (Texas Department of Transportation). 2004. Standard Specifications Book, Planing and Texturing Pavement Specifications (Item 354). Austin, Texas: TxDOT. Wambold, J. C., J. J. Henry, and R. R. Blackburn. 1984. Pavement Surface Texture Significance and Measurement, Report No. FHWA-RD-84-092. Washington, DC: FHWA. US Department of Homeland Security. 2016. United States Coast Guard Medical and Physical Evaluation Guidelines for Merchant Mariner Credentials. NVIC 04-08, COMDTPUB 16700.4.

FD07493 ｜ 2018_美国_HZM1902.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Air Products and Chemicals, Inc. Tube Trailer Module Hydrogen Release and Subsequent Fire Diamond Bar, California February 11, 2018

Incident Report NTSB/HZM-19/02 PB2019-101398

National Transportation Safety Board

NTSB/HZM-19/02 PB2019-101398 Notation 59258 Adopted October 10, 2019

Hazardous Materials Incident Report Air Products and Chemicals, Inc. Tube Trailer Module Hydrogen Release and Subsequent Fire Diamond Bar, California February 11, 2018

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2019. Air Products and Chemicals, Inc. Tube Trailer Module Hydrogen Release and Subsequent Fire, Diamond Bar, California, February 11, 2018. Hazardous Materials Incident Report NTSB/HZM-19/02. Washington, DC: NTSB

Abstract: On February 11, 2018, at 1:15 p.m. Pacific standard time, a release of compressed hydrogen and subsequent fire occurred during the transportation of an Air Products and Chemicals, Inc. 2014 Mack CXU613 truck tractor in combination with a 2015 Cheetah Chassis Corporation chassis, with a mounted CT-250 tube trailer module. The tube trailer module contained 25 non-US Department of Transportation specification fully wrapped carbon filler reinforced aluminum-lined cylinders, 24 of which were fully loaded with 240 kilograms of compressed hydrogen. The module caught fire on Golden Springs Drive in Diamond Bar, California. Pressure relief devices, which actuate on 12 of the cylinders, released about 120 kilograms of hydrogen that was likely consumed in the fire. Los Angeles County Fire Department estimated about 1,400 to 2,000 people were evacuated from the adjacent business district and a nearby residential area. Equipment damages were estimated at $175,000. As a result of this investigation, the National Transportation Safety Board is making safety recommendations to the Pipeline and Hazardous Materials Safety Administration; the US Department of Energy, Pacific Northwest National Laboratory; and the Compressed Gas Association.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974, to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person” (Title 49 Code of Federal Regulations section 831.4). Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report (Title 49 United States Code section 1154(b)).

For more detailed background information on this report, visit the NTSB investigations website and search for NTSB accident ID HMD18LR001. Recent publications are available in their entirety on the NTSB website. Other information about available publications also may be obtained from the website or by contacting— National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page, using product number PB2019-101398. For additional assistance, contact— National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 NTIS website

NTSB Hazardous Materials Incident Report i Contents

Figures ............................................................................................................................................ ii Table .............................................................................................................................................. iii Acronyms and Abbreviations ..................................................................................................... iv Executive Summary ..................................................................................................................... vi

1. The Incident ................................................................................................................................1
2. 1 Events Preceding the Incident ....................................................................................................1
3. 2 Motor Carrier .............................................................................................................................2
4. 3 Air Products Driver ....................................................................................................................2
5. 4 Tube Trailer Module ..................................................................................................................3
6. 5 Pressure Relief Devices .............................................................................................................4
7. 6 Hazardous Materials Information ..............................................................................................8
8. 7 Emergency Response .................................................................................................................8
9. 8 Previous NTSB Findings and Safety Recommendation ............................................................9
10. Safety Issues ..............................................................................................................................11
11. 1 Emergency Responder Awareness ...........................................................................................11
12. 2 Tube Trailer Module Damages ................................................................................................15
13. 2.1 Trailer and Frame ..........................................................................................................15
14. 2.2 Composite Cylinders .....................................................................................................16
15. 2.3 Pressure Relief Devices and Vent Line Assemblies ......................................................17
16. 3 Tube Trailer Requalification and Inspection ............................................................................24
17. 4 Hydrogen Tube Trailer Component Design Criteria ...............................................................28
18. 4.1 PRD Vent Systems ........................................................................................................28
19. 4.2 Pressure Relief Devices .................................................................................................29
20. Postaccident Actions ................................................................................................................31
21. 1 FIBA Technologies Technicians..............................................................................................31
22. 2 Atlas Machining and Welding Technicians .............................................................................32
23. Conclusions ...............................................................................................................................33
24. 1 Findings....................................................................................................................................33
25. 2 Probable Cause .......................................................................................................................34
26. Safety Recommendations ........................................................................................................35

Appendix. Investigation ...............................................................................................................37

NTSB

Hazardous Materials Incident Report

ii

Figures Figure 1. Aerial view of the incident location, Diamond Bar, California...................................... 1 Figure 2. Sherwood valve type 3132SB PRD. ............................................................................... 5 Figure 3. Cylinder fittings arrangement for rear heads. ................................................................. 6 Figure 4. Hydrogen tube trailer module PRD vent lines and tubing bulkhead. ............................. 7 Figure 5. Air Products tube trailer module 430003, exterior right side, March 12, 2018. ........... 15 Figure 6. Module number 430003 rear view with the area of greatest thermal damage circled, March 12, 2018. ............................................................................................................................ 16 Figure 7. Cylinders 21 through 25 thermal damage with protective fiberglass and epoxy coating burned away, March 14, 2018....................................................................................................... 17 Figure 8. Magnified view of cylinder No. 11 PRD rupture disk (magnification of 20X). .......... 19 Figure 10. Comparison of No. 14 vent line (left) with No. 4 vent line (right). ........................... 21 Figure 11. Cylinder No. 14 PRD adaptor fitting with damaged male threads. ............................ 22 Figure 12. Cylinder No. 14 PRD assembly, adaptor, and Tescom valve. .................................... 22 Figure 13. Comparison of fuse metal residues from PRD No. 14 (left), PRD No. 19 (center), and PRD No. 7 (right). ......................................................................................................................... 23 Figure 14. Comparison of old and new PRD markings. .............................................................. 30

NTSB

Hazardous Materials Incident Report

iii

Table Table. Tube trailer module inspection summary. ......................................................................... 18

NTSB

Hazardous Materials Incident Report

iv

Acronyms and Abbreviations Air Products

Air Products and Chemicals, Inc. Atlas

Atlas Machining and Welding, Inc. BASIC

Behavior Analysis and Improvement Categories CDL

Commercial Driver’s License CFFC

carbon fiber reinforced aluminum-lined cylinders CFR

Code of Federal Regulations CGA

Compressed Gas Association DOE

US Department of Energy DOT

US Department of Transportation ERG

Emergency Response Guidebook FCEV

fuel cell electric vehicle FIBA

FIBA Technologies, Incorporated FMCSA

Federal Motor Carrier Safety Administration kg

kilograms LACoFD

Los Angeles County Fire Department NFPA

National Fire Protection Association NREL

National Renewable Energy Laboratory NTSB

National Transportation Safety Board PHMSA

Pipeline and Hazardous Materials Safety Administration PRD

pressure relief devices psi

pounds per square inch psig

pounds per square inch, gauge RSPA

Research and Special Programs Administration

NTSB

Hazardous Materials Incident Report

v

SCI/Worthington Structural Composite Industries, subsidiary of Worthington Industries Sherwood Sherwood Valve, LLC UN United Nations

NTSB

Hazardous Materials Incident Report

vi

Executive Summary On February 11, 2018, at 1:15 p.m. Pacific standard time, a release of compressed hydrogen and subsequent fire occurred during the transportation of an Air Products and Chemicals, Inc. 2014 Mack CXU613 truck tractor in combination with a 2015 Cheetah Chassis Corporation chassis, with a mounted CT-250 tube trailer module. The tube trailer module contained 25 non-US Department of Transportation specification fully wrapped carbon fiber reinforced aluminum-lined cylinders, 24 of which were fully loaded with 240 kilograms of compressed hydrogen.1 The module caught fire on Golden Springs Drive in Diamond Bar, California. Pressure relief devices, which actuated on 12 of the cylinders, released about 120 kilograms of hydrogen that was likely consumed in the fire. The Los Angeles County Fire Department estimated about 1,400 to 2,000 people were evacuated from the adjacent business district and a nearby residential area. Equipment damages were estimated at $175,000. The postincident inspection found that an incorrect pressure relief device in cylinder No. 14 actuated during normal conditions to transportation. The force of high-pressure hydrogen releasing from the cylinder caused the pressure relief device vent tubing to eject from its fitting and allowed a hydrogen field fire to develop inside of the module. The vent tubing was designed to direct pressure relief gases in a safe direction up and away from the module, but because separated tubing directed gas into the interior of the module, the resulting fire impinged on adjacent cylinders. The fire damaged 21 of the cylinders and resulted in six additional pressure relief device vent tubes being ejected from improperly secured compression fittings, which vented more gas into the interior of the module. Prior to the incident in December 2017, the tube trailer module gas cylinders had been subjected to a required 5-year requalification inspection and pressure test. Testing facility technicians installed four incorrect pressure relief devices that were designed to activate at almost one-half the required operating pressure of 10,000 pounds per square inch. The incorrect pressure relief devices shipped from the manufacturer were inadvertently commingled in the facility’s inventory and went unnoticed by the inspector. Additionally, the pressure relief device vent tubing attached by compression fittings to seven of the module’s cylinders had not been sufficiently secured when manufactured. Although the vent tubing could have been secured at the time of the requalification inspection, technicians did not inspect the fittings for securement. The National Transportation Safety Board initiated this investigation to evaluate the safety of mobile hydrogen tube trailer modules used as fueling stations for hydrogen fuel cell electric vehicles. Automakers expect to make thousands of additional fuel cell electric vehicles available to California consumers, and the state is working to ensure that hydrogen is easily available to drivers. As of April 25, 2018, the California Fuel Cell Partnership reported that the state had 36 open retail and nonretail hydrogen fueling stations, with another 28 stations in various stages of construction and planning.

1 Cylinders used in the tube trailer were manufactured and operated under the terms of US Department of Transportation special permit DOT-SP 14576, which sets forth alternative requirements, or variances, to the requirements in the Hazardous Materials Regulations.

NTSB

Hazardous Materials Incident Report

vii

This report focuses on the following safety issues: • Emergency responder awareness: The Los Angeles County Fire Department emergency responders lacked familiarity with hydrogen tube trailer modules. Emergency responders did not immediately recognize the presence of hazardous materials, had difficulty estimating the likelihood for severe outcomes, and had not received guidance about appropriate mitigating actions needed to reduce the potential for catastrophic gas cylinder failures. • Tube trailer requalification and inspection requirements: The carrier and the requalification inspector missed opportunities to prevent this incident. The carrier failed to conduct external fittings acceptance inspections at the time it received the tube trailer module from the manufacturer, and the requalification facility personnel did not check pressure relief device compatibility and vent line securement as they inspected and tested the tube trailer module cylinders 6 weeks before the incident. The Pipeline and Hazardous Materials Safety Administration special permits and existing regulatory requirements pertinent to qualification and maintenance of cylinders do not require operators and requalification inspectors to verify that the correct pressure relief device model was installed and that venting equipment has been properly assembled and secured before placing the equipment in service. • Hydrogen tube trailer component design criteria: The lack of pressure relief device vent system design requirements that consider factors such as the force of venting gas and materials of construction may leave vent systems for cylinders and tube trailers vulnerable to unexpected failure during an incident. Furthermore, the appearance of the pressure relief devices appropriate for the cylinders involved in this incident are easily confused with similar pressure relief devices with incorrect operating pressure. Seven incorrect pressure relief devices shipped from the manufacturer became commingled into the requalification facility’s supply and were inadvertently installed on tube trailer modules, including the incorrect device that actuated during normal transportation and began the sequence of events that led to the fire. The National Transportation Safety Board determines that the probable cause of the February 11, 2018, tube trailer module fire in Diamond Bar, California, was the requalification technician’s installation of an incorrectly rated pressure relief device in cylinder No. 14, which actuated during normal transportation and released high-pressure hydrogen, and the tube trailer module assembly contractor’s failure to sufficiently tighten compression fittings on the pressure relief device vent lines that disassembled under the pressure of escaping gas allowing a fire to develop inside the module and impinge on adjacent cylinders. Contributing to the incident was a lack of a requirement for requalification inspectors to verify the pressure relief device pressure rating and to inspect for vent line assembly securement.

NTSB

Hazardous Materials Incident Report

1

• The Incident

On February 11, 2018, at 1:15 p.m. Pacific standard time, a release of compressed hydrogen and subsequent fire occurred during the transportation of an Air Products and Chemicals, Inc. (Air Products) 2014 Mack CXU613 truck tractor in combination with a 2015 Cheetah Chassis Corporation chassis, with a mounted CT-250 tube trailer module. The tube trailer module contained 25 non-US Department of Transportation (DOT) specification fully wrapped carbon fiber reinforced aluminum-lined cylinders (CFFC), 24 of which were fully loaded with 240 kilograms (kg) of compressed hydrogen. The module caught fire on Golden Springs Drive in Diamond Bar, California. (See figure 1.) Pressure relief devices (PRD), which actuated on 12 of the cylinders, released about 120 kg of hydrogen that was likely consumed in the fire. The Los Angeles County Fire Department estimated about 1,400 to 2,000 people were evacuated from the adjacent business district and a nearby residential area. Equipment damages were estimated at $175,000. Figure 1. Aerial view of the incident location, Diamond Bar, California. 1.1 Events Preceding the Incident The Air Products driver reported to duty at the Santa Fe Springs terminal on February 11, 2018, at 4:45 a.m. After delivering a similar tube trailer module that morning, the driver picked up the incident tube trailer module from the Air Products Wilmington, California, hydrogen filling station and conducted a pretrip inspection. The driver connected the module to the filling

NTSB

Hazardous Materials Incident Report

2

stanchion and found that although the cylinders were pressurized to 7,855 pounds per square inch, gauge (psig) (temperature-corrected loading pressure), the pressure had reduced to 7,300 psig with cooling. The driver advised the Air Products dispatcher the module was already full and then proceeded with his trip to deliver it to the South Coast Air Quality Management District headquarters fuel cell electric vehicle (FCEV) fueling station in Diamond Bar. About 1:15 p.m., the incident occurred after the driver came to a stop at a traffic signal on Golden Springs Drive at Brea Canyon Road, near his destination. The driver was unaware of any unusual occurrences during the module movement from Wilmington to Diamond Bar that might have precipitated the incident. The driver told National Transportation Safety Board (NTSB) investigators that when he stopped, he heard a loud pop and saw flames coming from the front of the module. He immediately exited his vehicle and told others in the area to evacuate. 1.2 Motor Carrier Air Products is headquartered in Allentown, Pennsylvania, and has been in the business of transporting industrial gases and cryogenic liquids to customers worldwide for about 75 years. Air Products is registered with the Federal Motor Carrier Safety Administration (FMCSA) as a private motor carrier of liquids, chemicals, and compressed gases and has been issued US DOT No. 101263. The company only transports its own hazardous material products. The FMCSA conducted its most recent compliance review of Air Products on May 10, 2010, resulting in a satisfactory rating for the carrier.2 At the time of this incident, Air Products had no alerts in any of the FMCSA Behavior Analysis and Improvement Categories (BASIC).3 1.3 Air Products Driver At the time of the incident, the driver held a valid California Class A Commercial Driver’s License (CDL). The driver had an endorsement for hauling double and triple trailers, a combination endorsement for tanks and hazardous materials, and had no CDL restrictions. According to the driver’s qualification file, the driver had a medical certificate that was valid until July 22, 2018.4 The driver was not subject to postaccident substance and alcohol testing requirements since there was no collision with injury, death, or disabling damage to the vehicle. Air Products required their drivers to use an automatic onboard recording device to record the driver’s hours of service. The driver’s records showed no violations of the hours of service regulations for the 7 days prior to the incident.

2 For further information, see the Motor Carrier Factors factual report and Air Products Motor Carrier Management Information System report in the docket for this incident. 3 The FMCSA BASIC Categories consist of unsafe driving, hours of service, driver fitness, controlled substances and alcohol, vehicle maintenance, hazardous materials, and crash indicators. 4 See Title 49 Code of Federal Regulations (CFR) 391.51 for information about general requirements for driver qualification files.

NTSB

Hazardous Materials Incident Report

3

1. 4 Tube Trailer Module

Air Products tube trailer module number 430003, was a 2015 Cheetah Chassis Corporation 24-feet drop frame container chassis, on which was mounted a Structural Composite Industries, subsidiary of Worthington Industries (SCI/Worthington) model CT-250 composite gas cylinder module. The CT-250 tube trailer module consisted of 25 horizontal neck-mounted Worthington Type 3 model ALT1015 carbon fiber composite cylinders arranged in a 5 x 5 array.5 Each cylinder contained 10 kg of hydrogen when full. The entire module had a hydrogen capacity of 250 kg. Design criteria and operational requirements under special permit DOT-SP 14576 include but are not limited to: • Service pressure limited to 7,500 psig at 70℉. • Test pressure of 12,500 psig. • Minimum cylinder burst pressure of 25,500 psig, or a safety factor of 3.4. • Cylinder service life is limited to 15 years. • Each cylinder must be requalified once every 5 years by a qualified person holding a valid DOT requalification identification number using a hydraulic or pneumatic pressure proof test. • Cylinders must be manifolded in accordance with the requirements of Title 49 Code of Federal Regulations (CFR) 173.301(g). • All cylinders must be operated and maintained in accordance with the Structural Composites Industries Cylinder Component Operations Manual. Each “Hazmat employee,” as defined in 49 CFR 171.8, who performs a function subject to this special permit must receive training on the requirements and conditions of this special permit in addition to the training required by 49 CFR 172.700 through 172.704. SCI/Worthington advertises that its Type 3-cylinder features include light weight, no gas permeation, impact and heat tolerance, and a designed leak-before-burst fatigue failure mode. ALT1015 cylinders are constructed with a seamless 6021 aluminum liner surrounded by 23 layers of carbon fiber reinforcement wrapped in either a circumferential or helical continuous filament winding pattern. The composite fiber wrap constitutes the predominant pressure bearing element. The exterior layers of fiberglass and white exterior epoxy provide added abrasion and damage protection. The tube trailer cylinders had been in service for 5 years, and the cylinders had 10 years of remaining authorized service life.

5 Pressure vessels for compressed natural gas and hydrogen fuel tanks are classified in four categories by the CSA/ANSI NGV2 standard for compressed natural gas vehicle fuel containers. Type 3 cylinders are seamless and gas-tight metal-lined cylinders with full exterior composite reinforcement.

NTSB

Hazardous Materials Incident Report

4

Air Products contracted FIBA Technologies, Incorporated (FIBA) to inspect and requalify tube trailer module number 430003 on December 29, 2017. The module was subjected to 22 hydrogen fill-and-discharge cycles and deliveries after the requalification inspection. The incident occurred during the module’s 23rd postrequalification delivery. 1.5 Pressure Relief Devices Title 49 CFR 173.301(f) requires that cylinders offered for transportation be equipped with one or more PRDs sized and selected as to type, location, and quantity, and tested in accordance with the Compressed Gas Association (CGA) S-1.1 and CGA Pamphlet S-7.6 The PRD must be capable of preventing rupture of the normally filled cylinder under fire conditions. In accordance with 49 CFR 173.301(g) and Table 3 CGA S-1.1, the PRDs are required at both ends of horizontally mounted cylinders. The gas cylinders used in incident tube trailer module number 430003 were equipped with PRDs at each end, giving a total of 50 PRDs installed on the module. In accordance with the trailer and composite cylinder design, the PRDs were CG-5 type devices (combination rupture disk/fusible plug).7 The cylinder manufacturer’s drawings call for Sherwood Valve, LLC (Sherwood) model 3132SB9-95 PRDs with a set pressure of 10,000 psig. These PRDs contain a copper rupture disk that is directly exposed to the internal cylinder pressure and is situated immediately upstream of a fusible metal plug in the discharge port.8 The design intends for the fusible metal plug to weaken from thermal exposure before the rupture disk bursts from overpressure. (See figure 2.) The CG-5 type devices require a combination of both high pressure and high temperature (212℉) to first melt the fusible metal, after which the device affords the same overpressure protection as does a type CG-1 rupture disk. The rupture disk is reinforced against rupturing by the fusible metal, and the fusible metal is reinforced against extrusion by the rupture disk. The advantage of using a CG-5 type device to protect cylinders used for flammable gases is it may provide a few minutes of extra time for personnel to evacuate a cylinder exposed to fire before its rupture disk activates, leading to greater potential for injury.

6 Compressed Gas Association, Pressure Relief Device Standards Part 1-Cylinders for Compressed Gases. CGA S-1.1, 14th edition (Chantilly, Virginia: Compressed Gas Association, 2011). 7 Pressure relief device types are described by CGA S-1.1. 8 The fusible metal is a eutectic mixture of lead, tin, and bismuth in nearly equal proportions.

NTSB

Hazardous Materials Incident Report

5

Figure 2. Sherwood valve type 3132SB PRD. Type 3132SB PRDs are available in a range of pressures. Lower-pressure devices, such as the model 3132SBF9-55 nickel disk variant with a burst pressure of 5,833 psi, are typically used for cylinders containing compressed natural gas. The 10,000 psi PRDs are used in hydrogen carbon fiber composite cylinder service. The incident module PRDs were contained in an assembly that consisted of a brass-threaded adaptor, brass-body PRD, stainless-steel straight fitting, and stainless-steel elbow. (See figure 3.) The 50 front and rear cylinder heads were each equipped with a PRD assembly and vent line. The rear heads were also fitted with Tescom shutoff valves to control discharge and filling, and tubing associated with the module’s manifold system.

NTSB

Hazardous Materials Incident Report

6

Figure 3. Cylinder fittings arrangement for rear heads. The PRD vent line compression fitting is attached to the Parker elbow. Title 49 CFR 173.301(g) and CGA S-1.1 (Table 3), require the PRDs to be arranged to discharge upward and unobstructed to the open air to prevent any impingement of escaping gas upon the containers or personnel. This is accomplished on the CT-250 tube trailer modules by fixing 0.5-inch outside diameter stainless steel tubing to each of the PRD discharge ports that are designed to direct any pressure-relieved gases upward and away from the module. Under normal transportation conditions, the vent tubing is under atmospheric pressure and would only convey gas if a rupture disc were to actuate. As shown in figure 4, the vent tubing downstream of each front and rear PRD assembly had a 90° bend and extended upward to a transverse horizontal bulkhead at the highest point on the module frame.

NTSB

Hazardous Materials Incident Report

7

Figure 4. Hydrogen tube trailer module PRD vent lines and tubing bulkhead. Between January 30, 2015, and May 29, 2015, Atlas Machining and Welding, Inc. (Atlas) of Northampton, Pennsylvania, under contract with Air Products, assembled PRD vent tubing and high-pressure tubing and fittings on 12 CT-250 hydrogen tube trailer modules. Atlas completed the incident module number 430003 on February 15, 2015. The discharge side of the Parker elbow is a compression fitting in which the nut and ferrule must be tightened sufficiently in accordance with the manufacturer’s nut rotation specification to compress and engage the vent line tubing wall.9 A properly tightened fitting will swage and bite the ferrules into the tubing, narrowing the tubing diameter at that point to secure it in place. Before the incident, Air Products provided Atlas written assembly instructions that included details for proper compression fitting securement.

9 A ferrule is defined as a ring or cap usually of metal put around a slender shaft (such as a cane or a tool handle) to strengthen it or prevent splitting.

NTSB

Hazardous Materials Incident Report

8

1. 6 Hazardous Materials Information
2. 6.1 Safety Information

The incident tube trailer module was loaded with compressed hydrogen, which is a Division 2.1 flammable gas. Tube trailers are used to transport bulk quantities of compressed hydrogen gas. Because hydrogen gas has a low energy content at atmospheric pressure, commercially useful quantities must be compressed and transported at high pressure. Hydrogen is a colorless and odorless gas that is 14 times lighter than air. It is extremely flammable, may form explosive mixtures in air, burns with an invisible flame, and may ignite if a cylinder valve is opened to the air. Upon exposure to intense heat or flame, gas cylinders can vent rapidly or rupture violently. 1.7 Emergency Response The primary emergency response organizations were the Los Angeles County Fire Department (LACoFD), Los Angeles County Sheriff’s Department, and Air Products. The California Highway Patrol, California Office of Emergency Management, City of Diamond Bar, and the American Red Cross were also involved in the response. Firefighters’ initial actions were to take up positions within feet of the burning trailer and to douse the fire and cool cylinders with water hoses. The incident commander told NTSB investigators that his decision to launch an offensive attack on the fire was made to prevent loss of life should the cylinders catastrophically fail because he recognized there was little chance of a timely evacuation in the highly congested area. Firefighters later established monitor nozzles to cool the hydrogen cylinders from a safer distance.10 Soon after first responders arrived, one of the PRDs actuated. The most intense gas venting lasted for about 30 to 45 minutes. With a reduction in venting intensity, responders believed the risk of catastrophic cylinder failure had diminished. The Air Products truck driver remained on the scene to further inform emergency responders about the contents of the tube trailer module until the company’s Santa Fe Springs site manager and a vehicle response and recovery team arrived almost 1 hour after the incident began. The Air Products site manager encouraged the incident commander to continue the cylinder cooling efforts with water spray to prevent the fire from involving additional cylinders. The LACoFD incident commander consulted the DOT Emergency Response Guidebook (ERG) Guide 115, which recommended a 1-mile isolation distance.11 The incident was managed with a 150-foot exclusion zone and 400–500-foot distance to the command post. Although

10 A monitor nozzle is a high-capacity water jet used for fighting fire from a distance. Monitor nozzles may be mounted on top of fire engines and can be operated manually or remotely. 11 US Department of Transportation, Emergency Response Guidebook, 11th edition (Washington, DC: US Department of Transportation, 2016).

NTSB

Hazardous Materials Incident Report

9

expanding the evacuation zone was a major goal of the response, the ERG-recommended protective distance was not practical given traffic congestion in the area. After a 30-minute cycle of water spray cooling followed by thermal imaging inspection, firefighters detected a persistent heat signature in the module that kept this process continuing throughout the evening. Air Products technicians were unable to access the module until 10:00 p.m., about 9 hours after the incident began. Between 11:00 p.m. and 3:00 a.m., the Air Products terminal manager and vehicle recovery team began a controlled venting procedure for the remaining hydrogen cylinders. To accelerate the process, the Air Products team checked pressure in the remaining cylinders and vented them simultaneously. About 3:30 a.m., the scene was secured, and Air Products towed the empty tube trailer module to its Santa Fe Springs, California, terminal for storage. 1.8 Previous NTSB Findings and Safety Recommendation On May 1, 2001, a tractor, in combination with a tube trailer of horizontally mounted cylinders filled with compressed hydrogen, struck a pickup truck on U.S. Highway 75, 2 miles south of Ramona, Oklahoma. The tractor-semitrailer overturned and damaged some of the cylinders, valves, piping, and fittings, releasing and igniting hydrogen that burned the rear of the semitrailer. The emergency responders used the ERG as their first reference and referred to the guide for hydrogen. However, the guide did not provide complete information about the unique properties of hydrogen, specifically that hydrogen burns with an invisible or almost invisible flame. The guide also contained generic information about chemical properties, such as vapors sinking to the ground, which did not apply to hydrogen. The NTSB issued the following safety recommendation to the Research and Special Programs Administration (RSPA):12 H-02-25: Revise the information about hydrogen in the North American Emergency Response Guidebook so that it specifically identifies the unique chemical and flammability properties of hydrogen. (Closed—Acceptable Action) On September 4, 2004, RSPA published the 2004 revision to the ERG which incorporated specific information about the unique chemical and flammability properties of hydrogen.13 The information was on Guide 115, since Hydrogen, compressed (ID No. 1049) was assigned to Guide 115. The information appeared in two sections of Guide 115, as follows:

1. Under POTENTIAL HAZARDS, in the section on FIRE OR EXPLOSION, the caution

statement stated: “Vapors from liquefied gas are initially heavier than air and spread along ground. CAUTION: Hydrogen (UN1049), Deuterium (UN1957) and Methane (UN1971) are lighter than air and will rise. Hydrogen and Deuterium fires are difficult to detect since they burn

12 As part of a DOT reorganization on November 30, 2004, RSPA was disbanded, and responsibilities for the safety of the transportation of hazardous materials were transferred to the newly created Pipeline and Hazardous Materials Safety Administration (PHMSA). 13 US Department of Transportation, Emergency Response Guidebook, 2004 edition (Washington, DC: US Department of Transportation, 2004).

NTSB

Hazardous Materials Incident Report

10

with an invisible flame. Use an alternate method of detection (thermal camera, broom handle, etc.)” 2. Under EMERGENCY RESPONSE, in the section on FIRE, the caution statement stated: “DO NOT EXTINGUISH A LEAKING GAS FIRE UNLESS LEAK CAN BE STOPPED. CAUTION: Hydrogen (UN1049) and Deuterium (UN1957) burn with an invisible flame.” Based on the information added to the 2004 ERG about the difficulty of detecting and extinguishing hydrogen-fueled fires, on April 1, 2005, the NTSB classified Safety Recommendation H-02-25 “Closed—Acceptable Action.”

NTSB

Hazardous Materials Incident Report

11

• Safety Issues

1. 1 Emergency Responder Awareness

The initial incident commander told NTSB investigators that firefighters did not realize they were responding to a hydrogen fire until after they arrived. He said that their first indication of hazardous materials was a placard marked United Nations (UN) number 1049, which they observed as the fire engine approached the burning tube trailer. Although the tube trailer module was correctly placarded and marked “hydrogen compressed” on all four sides, its general appearance within a square cabinet enclosure did not provide the visual clues the first responders usually expected to see for tube trailers transporting high-pressure gases, such as an exposed bundle of long gas cylinders mounted on a chassis within open framework. It was not until firefighters arrived on scene and from very close distance that they saw the placard and the burning trailer containing “individual hydrogen tanks.” They had first received erroneous reports about an exploding gasoline station fire, followed by a report of a tanker truck fire, and finally a tube trailer. These reports added to initial confusion about the hazards the emergency responders faced. On March 28, 2018, the LACoFD published a Canyon IC training video that summarizes lessons learned from the emergency response to this incident.14 The video addresses several safety issues the first responders confronted, including: • Confusing hazard communications and difficulty recognizing the presence of hazardous materials • Lack of familiarity with hydrogen fueling infrastructure • Difficulty estimating the likelihood for severe outcomes, injury, and damage • Lack of familiarity with appropriate response actions for mitigating the potential of catastrophic cylinder failure The video includes statements made by the responding firefighters, some of whom expressed similar concerns to the NTSB investigators. The firefighters pointed to the need for greater awareness and training resources for jurisdictions that are experiencing an increased use of FCEVs and bulk hydrogen fuel shipments. First responders received erroneous reports about the type of emergency. Thus, the firefighters were unaware of the hydrogen fire until they were very close to the fire, putting firefighters at risk. In addition, they lacked familiarity with this type of hydrogen tube trailer module and the appropriate response to the hydrogen fire. Therefore, the NTSB concludes that greater first responder training and awareness about hydrogen tube trailer modules transported 14 Los Angeles County Fire Department, Canyon IC (Los Angeles: Los Angeles County Fire Department, 2018). (See website at https://vimeo.com/262314786).

NTSB

Hazardous Materials Incident Report

12

within their jurisdiction could have helped the first responders to initially respond to this incident more effectively, efficiently, and safely. At the time of this incident, there were at least three resources available to the emergency response community for guidance in handling compressed hydrogen incidents. The Pacific Northwest National Laboratory, US Department of Energy (DOE), partnered with the California Fuel Cell Partnership to produce an emergency responder training program that is available from its website https://h2tools.org.15 In addition to providing guidance for responding to vehicle crashes involving hydrogen fuel cell vehicles, the program describes the potential hazards associated with hydrogen transport vehicles and tactics for mitigating hydrogen release incidents. As noted above, hydrogen burns with an invisible or almost invisible flame. The program advises first responders: • Listen for venting gas and watch for thermal waves that could signal hydrogen flames. • When available use a thermal imaging camera if no flame is visible. • Be aware that ignited hydrogen in an existing, carbon-based fire will most likely be visible due to the other products of combustion. • Eliminate all potential ignition sources, and do not touch or walk through the product. • Allow a hydrogen-fed fire to burn, if safe to do so, and protect adjacent exposures. • Do not spray water into the pressure relief vent, as this could prevent it from working properly. On October 9, 2018, the California Fuel Cell Partnership and Air Products provided LACoFD membership an in-person updated presentation of its responder training program. The California Fuel Cell Partnership is also considering adding content to the program such as tank testing, nonvehicle applications, vehicle extrication techniques, and information about bulk hydrogen shipping. In addition, the training program is being transitioned to the American Institute of Chemical Engineers Center for Hydrogen Safety. This is an international nonprofit corporate membership organization that promotes the safe operation, handling, and use of hydrogen and hydrogen systems across all installations and applications. Similar to the DOE program, the International Association of Fire Chiefs Fusion Center provides a hydrogen response online training course that is focused on providing basic education about alternative fuels.16 The course has four modules that test student’s knowledge of hydrogen use, chemical and physical characteristics, and suggested emergency response tactics and

15 Pacific Northwest National Laboratory, National Hydrogen and Fuel Cells Emergency Response Training (Richland, Washington: US Department of Energy, Pacific Northwest National Laboratory, 2015). 16 See the International Association of Fire Chiefs website at https://www.iafc.org/events/event/2018/12/31/self- paced/hydrogen-response-considerations-online. (Accessed August 22, 2019.)

NTSB

Hazardous Materials Incident Report

13

strategies. However, the course does not contain descriptions of tube trailer modules that double as both compressed hydrogen transport vehicles and fueling stations, nor does the course provide recommended firefighting tactics for mitigating hazards associated with fires, hydrogen releases, and vehicle accidents. The NTSB concludes that although there is ample generic hazard information for compressed hydrogen and vehicle fuel systems, the available guidance lacks critical hazard recognition and firefighting information specific to FCEV fueling infrastructure and containers currently used for the bulk transportation of compressed hydrogen. The DOE Pacific Northwest National Laboratory Hydrogen Tools Portal contains a comprehensive collection of hydrogen safety training materials for first responders and provides a single repository of credible and reliable information intended to eliminate duplicative efforts among various training programs. Therefore, the NTSB recommends that DOE Pacific Northwest National Laboratory revise its hydrogen emergency responder training programs to include readily accessible specific information and guidance on hazard recognition and firefighting relative to tube trailers and FCEV fueling infrastructure. The DOT ERG is intended for use by first responders during the initial phase of a transportation incident involving hazardous materials.17 Among the recommendations for hydrogen (UN 1049) contained in Guide 115 are the following: • Cylinders exposed to fire may vent and release flammable gas through pressure relief devices. • Containers may explode when heated; ruptured cylinders may rocket. • Fight fire from maximum distance or use unmanned hose holders or monitor nozzles. • Cool containers with flooding quantities of water until well after fire is out. • Withdraw immediately in case of rising sound from venting safety devices or discoloration of tank. • For a fire involving a tank truck, isolate for 1 mile in all directions; also consider initial evacuation of at least 1 mile in all directions. The LACoFD used the ERG as its primary reference material in response to this incident. However, the information provided in Guide 115 is a generic description of a variety of gases and cryogenic liquids that may not be directly pertinent to such an incident as occurred in Diamond Bar, California. As part of an ongoing effort to address shortcomings in emergency response guidance for hydrogen, the National Fire Protection Association (NFPA) 2 Task Force on Emergency Response on October 1, 2018, provided a submission to the Pipeline and

17 US Department of Transportation, Emergency Response Guidebook, 11th edition (Washington, DC: US Department of Transportation, 2016).

NTSB

Hazardous Materials Incident Report

14

Hazardous Materials Safety Administration (PHMSA) for proposed revisions to the 2020 ERG.18 The NFPA task force stated that while the amounts of fuel on the vehicles described in this submission (and the fact that hydrogen is being used to propel the vehicle) do not fall under the jurisdiction of the ERG, the NFPA stated there is a need for an informational product about such vehicles to avoid potentially unnecessary actions and evacuations around a hydrogen-fueled vehicle incident. The proposed NFPA 2 task force guidance contains visual descriptions of the hydrogen fueling system components typically found in light and medium duty vehicles, buses, and trucks. The proposed guidance also contains a description of safety features, handling precautions, and advice for rescue and extraction. Also, on October 1, 2018, to provide emergency responders with the most up-to-date guidance pertinent to hydrogen transportation, the CGA provided a submission to PHMSA with the following suggested revisions to the 2020 ERG: • Modify Guide 115 to remove Hydrogen (UN 1049); Hydrogen, refrigerated liquid (UN 1966); and Deuterium (UN 1957) from its scope; and • Create a new guide with the guide number to be determined, for Hydrogen (UN 1049); Hydrogen, refrigerated liquid (UN 1966); and Deuterium (UN 1957) to address their unique emergency response requirements. One concern the CGA cited was adjusting the evacuation distances recommended for large spills and fires that are based on analysis of incidents and models dealing with blast overpressure, thermal radiation, and other effects. The CGA proposal points out that the existing ERG Guide 115 that groups hydrogen with other flammable gases recommends evacuation and isolation distances well in excess of applicable hazard distances for hydrogen and can pose an unnecessary burden on emergency responders and evacuees as well as additional hazards to those being unnecessarily evacuated. The proposed new guide recommends that small fires be allowed to burn out if the source of hydrogen cannot be stopped. The CGA points out that attempting to extinguish a fire without stopping the source of releasing gas could create a more hazardous condition. The proposed new guidance also calls attention to cylinder vent pipes as safety devices and recommends not spraying water directly on vent outlets because plugging the vent system could lead to overpressurization and container rupture. Therefore, the NTSB concludes that the generic guidance for flammable gases contained in the ERG Guide 115, does not adequately describe unique hazards associated with compressed hydrogen or best response actions for public safety personnel. Therefore, the NTSB recommends that PHMSA revise its ERG to include information about hazards and protective actions specific to hydrogen, and to provide guidance on how to manage incidents involving FCEVs and hydrogen fueling infrastructure.

18 (a) PHMSA, nonrulemaking docket PHMSA-2018-0055-0001. (b) The NFPA 2 ER Task Force members include fire personnel and individuals from industrial gas companies, all of whom use and are familiar with the ERG.

NTSB

Hazardous Materials Incident Report

15

1. 2 Tube Trailer Module Damages

This section describes evidence relating to the origin of the fire and factors influencing the propagation and severity of the incident. 2.2.1 Trailer and Frame Investigators observed thermal damage on the exterior upper-right rear of the trailer door and upper-right side of the CT-250 module structure. (See figure 5.) This damage ranged from discoloration of the paint to areas where the paint was completely burned off the exterior.

Figure 5. Air Products tube trailer module 430003, exterior right side, March 12, 2018. The right-rear door handle hasp was bent upward, and the door panel was bowed outward. The frame of the door panel also buckled outward about 1.5 inches. The bow in the right-rear door was centered opposite the position of cylinder No. 14. The trailer frame and appurtenances were not damaged in the incident.

NTSB

Hazardous Materials Incident Report

16

1. 2.2 Composite Cylinders

Thermal damage was concentrated in the upper right interior of the tube stack and is summarized in the Table. Investigators observed no cylinder cuts and no abrasions. Damage was limited to the exposure of heat and flame. (See figure 6.)

Figure 6. Module number 430003 rear view with the area of greatest thermal damage circled, March 12, 2018. Following visual examination, the tube trailer module was released to the cylinder manufacturer, SCI/Worthington for disassembly, detailed cylinder inspection, and residual strength testing of two heat-damaged cylinders. SCI/Worthington technicians classified each of the 25 cylinders based on the extent of thermal damage. This examination found that four of the cylinders were visually undamaged and exhibited no discoloration but some soot accumulation. The remaining 21 cylinders sustained heat damage sufficient to require them to be removed from service.19 Five cylinders sustained heat discoloration, blistered cylinder paint, and melted labeling. Five cylinders sustained scorching and surface burns. Eleven cylinders exhibited severe thermal damage in which layers of carbon composite fiber burned away. (See figure 7.) Although the severely damaged cylinders had most of the paint and fiberglass protective wrap burned away, investigators observed no evidence of cylinder pressure containment failure.

19 Under DOT special permit DOT-SP 14576 and CGA Standard C-6.4, composite cylinders with indications of extreme heat damage are considered to have Level 3 (rejectable) damage and must be condemned. The SCI/Worthington product group manager told NTSB investigators that industry practice is to classify as Level 3 damage any CFFC cylinder that exhibits heat marking or discoloration because the severity of underlying damage is often unknown without destructive examination.

NTSB

Hazardous Materials Incident Report

17

Figure 7. Cylinders 21 through 25 thermal damage with protective fiberglass and epoxy coating burned away, March 14, 2018. SCI/Worthington technicians noted that the cylinder in position 24 exhibited the most severe fire damage, with its outermost carbon fiber layers that were wrapped in the hoop orientation burned away in three locations. The underlying carbon fiber composite layers wrapped in the helical orientation were exposed. SCI/Worthington burst tested this cylinder, finding that the cylinder wall failed at 24,600 psig, whereas the minimum burst pressure permitted in a DOT-SP 14576 test for a new and undamaged cylinder is 25,500 psig. On May 9, 2018, technicians selected a second, lesser-damaged cylinder for burst testing in position 16 to simulate a scenario where a cylinder with unrepairable damage might be improperly returned to service or might not have been properly inspected following an incident. To simulate use of the cylinder for its remaining service life, cylinder 16 was pressure cycled 3,650 times before burst testing. The cylinder did not leak during the testing. The burst pressure for the cylinder was 21,500 psig, whereas the design criteria under DOT-SP 14576 would allow a minimum burst pressure of 22,950 psig for an undamaged cylinder that experienced its full-service life. Postincident destructive testing determined that burst pressures for fire-damaged cylinders were below the minimum requirements for new and used cylinders. Therefore, the NTSB concludes that none of the incident tube trailer cylinders lost mechanical integrity, and they did not contribute to the cause or perpetuation of the incident. 2.2.3 Pressure Relief Devices and Vent Line Assemblies The inspection found 12 rear PRDs had actuated during this incident and had fully released the contents of 12 cylinders, or a total of 120 kg of hydrogen. (See table.)

NTSB

Hazardous Materials Incident Report

18

Table. Tube trailer module inspection summary.

Incorrect PRD = 4

Severe burning damage, composite caught fire20 PRD actuated = 1221

Scorching, surface burns Vent line ejected = 7

Heat discoloration, blistered paint, melted label Severe fire damage = 11

No discoloration, some soot accumulation

Four of the 50 PRD assemblies for the cylinders contained the incorrect type CGA-5 Sherwood model 3132SBF9-55 PRD, with nickel rupture disk and a set pressure of 5,833 psig. One incorrect PRD affixed to the front of cylinder 4 was known to have actuated on February 4, 2018, thus rendering cylinder No. 4 out of service at the time of the incident.22 Two of the incorrect PRDs had been installed in cylinder No. 11, but the cylinder sustained mild fire exposure and neither PRD had actuated. The final incorrect PRD installed in the rear of cylinder

20 The SCI/Worthington classification of heat damage severity is consistent with the NTSB investigator’s visual observations. See Engineering Report No. 2996.18. 21 There were 12 PRDs that actuated during the February 11, 2018, incident, and one PRD that actuated during the February 4, 2018, incident, which was still installed in the unused cylinder No. 4. 22 The technician isolated cylinder 4 from the module’s manifold system and scheduled the module for later inspection. Therefore, Air Products was not aware incorrect PRDs had been installed in the module prior to the Diamond Bar incident.

NTSB

Hazardous Materials Incident Report

19

No. 14 was missing its burst disk and copper retaining washer, and the fusible metal plug had been ejected from the discharge port. The rupture disk contained in the rear incorrect PRD for cylinder No. 11, which was outside of the area of greatest thermal exposure, had a concave shape with a deflection toward the discharge port. A radial crack had formed on the rupture disk surface and the concavity of the center of the disk suggests the disk was subjected to high pressure during its 6 weeks in service. The cylinder manufacturer specifications call for the cylinders to be equipped with a PRD rated at 10,000 psi. Additionally, the disk should have been fabricated from material other than nickel because the Sherwood type 3132SB technical information states that nickel PRDs and fittings must not be used in hydrogen service. Metallurgical analysis of rupture disks following other PRD failures have shown that hydrogen embrittlement of nickel disks has led to stress cracks and premature failures.23 Figure 8 shows a magnified view of the fracture area on the surface of the cylinder No. 11 PRD rupture disk, which reveals a rough textured area primarily below the fracture that is circumferentially continuous and indicative of tensile stretching. The cylinder No. 11 rupture disk fracture mode was a ductile overstress fracture, suggesting that it likely would have actuated within a short time given additional use and pressure cycling.24

Figure 8. Magnified view of cylinder No. 11 PRD rupture disk (magnification of 20X). Scribe marks were etched into the disk during the postincident laboratory examination. A similar overstress fracture probably occurred with the incorrect cylinder No. 14 PRD, since the disk was exposed to 22 hydrogen fill-and-discharge cycles exceeding its design

23 National Renewable Energy Laboratory, Pressure Relief Devices for High-Pressure Gaseous Storage Systems: Applicability to Hydrogen Technology. Technical Report NREL/TP-5400-60175 (Golden, Colorado: US Department of Energy, National Renewable Energy Laboratory, 2013). 24 When stress is placed on a metallic component to a level greater than the material can resist, then failure of the component occurs by overstress. If the material is ductile, then it may exhibit a large amount of deformation before rupture occurs.

NTSB

Hazardous Materials Incident Report

20

pressure between the time the PRD was installed on December 29, 2017, and the time of the incident. The 5,833 psig-rated PRD did not immediately activate when the trailer was put into service due to reinforcement provided to the rupture disk portion of the PRD from the fusible metal located downstream behind the disk. Therefore, the NTSB concludes that the hydrogen release most likely initiated because a PRD with the wrong pressure rating was installed on cylinder No. 14 and actuated under normal working pressure loads. Following the incident, Air Products technicians found the cylinder No. 14 PRD assembly laying in the bottom pan of the tube trailer module underneath the rack of cylinders. Under the thrust force and pressure of gas flowing from the actuated PRD, the cylinder No. 14 vent line was ejected from the PRD assembly fitting and was bowed outward and partially wrapped around a handrail. (See figure 9.) The separated vent line allowed the escaping high-pressure hydrogen to be directed to the interior of the cabinet rather than upward and outside of the cabinet as intended by the design. The hydrogen could have been ignited by the shock wave from the sudden release and/or impact between the dislodged vent tubing, handhold bar, and the rear door of the trailer.

Figure 9. No. 14 vent line displacement. The vent line was bent outward from the cylinder and against the handhold rail. March 12, 2018.

NTSB

Hazardous Materials Incident Report

21

The nut-and-fitting ferrules were missing from the vent line that should have swaged the tubing if the compression fitting had been sufficiently tightened. (See figure 10.) When the vent tubing is initially assembled with the fitting, it is supposed to be checked with a No-Go gap gauge to ensure that the nut has compressed the ferrules, narrowing the tubing diameter enough to lock the ferrules in place. This compression secures the fitting against gas leakage and retains the tubing in place.

Figure 10. Comparison of No. 14 vent line (left) with No. 4 vent line (right). The nut and the ferrule for coupling to the Parker elbow is missing from the No. 14 vent line. As the fire impinged on other cylinders, the heat actuated the 11 adjacent rear PRDs. An additional six vent lines were ejected from their elbow fittings thus directing more burning hydrogen into the interior of the module’s cabinet and escalating the severity of the cylinder damages. Vent tubing affixed to only five of the affected cylinders functioned as designed. The cylinder No. 14 adaptor fitting remained fastened to the Tescom shutoff valve; however, its downstream “male” threads were damaged, and the corresponding PRD body “female” threads were flattened from forced separation of the two pieces. (See figure 11.)

NTSB

Hazardous Materials Incident Report

22

Figure 11. Cylinder No. 14 PRD adaptor fitting with damaged male threads. The cylinder No. 14 PRD assembly fitting separation occurred after the vent line was ejected as high-pressure venting gas jetted from the open 90° elbow with downward perpendicular thrust. (See figure 12.)

Figure 12. Cylinder No. 14 PRD assembly, adaptor, and Tescom valve. Hydrogen gas vented from the vent line compression fitting. The venting gas imparted force against the PRD assembly adaptor attachment point, stripping its brass threads and causing the assembly to drop to the bottom pan of the trailer where it was not directly exposed to the subsequent fire. This was evident from the relatively clean state of the PRD assembly and the lack of indication that the fusible metal had melted. A short soot

NTSB

Hazardous Materials Incident Report

23

trail on one corner of the PRD body hex flat suggests the hydrogen ignition may have occurred during its separation from the adaptor fitting. This evidence suggests the severe fire damage to cylinder No. 14 and the surrounding cylinders and PRDs occurred after the cylinder No. 14 PRD assembly separated from its adaptor fitting. Therefore, the NTSB concludes that the hydrogen ignited during the forced separation of the cylinder No. 14 PRD assembly from the cylinder. The resistance of the fusible metal plug to being extruded from the PRD discharge port is dependent on heat exposure, as the material melts at a temperature of 212℉. However, the Sherwood Valve vice president and general manager told NTSB investigators that in a situation where the rupture disk has failed, the fusible metal plug alone under nonfire conditions would not resist pressure of 7,500 psi for long because the highly ductile fusible metal would soon extrude from the discharge port allowing the cylinder contents to vent. NTSB investigators compared fusible metal residues in the discharge ports of the PRDs from cylinder Nos. 4, 14, and 19 (located directly above cylinder No. 14 in the tube trailer) with the unaffected and intact PRD from cylinder No. 7. Some fragmented fusible metal material and residue was observed adhering to the cylinder No. 14 PRD discharge port interior grooved surfaces. Optical microscope images revealed the fusible metal residue microstructure away from the thread roots in the discharge port of the cylinder No. 14 PRD appeared very different to the melted and resolidified fusible metal residues found in the cylinders Nos. 4 and 19 and the unaffected fusible metal in the cylinder No. 7 PRD. (See figure 13.)

Figure 13. Comparison of fuse metal residues from PRD No. 14 (left), PRD No. 19 (center), and PRD No. 7 (right).

NTSB

Hazardous Materials Incident Report

24

The teardrop and rounded shapes of melted and resolidified fusible metal residue in the cylinder No. 19 PRD that sustained heat exposure during the module fire were also different from the fusible metal residue adhering to the discharge port groves in the cylinder No. 14 PRD. The shape and microstructure differences of fusible metal residue from the cylinder No. 19 PRD suggests it was heated and flowed from the discharge port, while in cylinder No. 14, the fusible metal appears to have been mechanically expelled from the discharge port under pressure alone. Therefore, the NTSB concludes that although the other cylinder PRDs in the tube trailer module were actuated because of fire exposure, the cylinder No. 14 PRD actuated before the fire began. 2.3 Tube Trailer Requalification and Inspection As required by the DOT special permit conditions, on December 29, 2017, the tube trailer was subjected to a 5-year requalification inspection 6 weeks before the Diamond Bar incident. Air Products contracted with FIBA to perform the requalification inspection. The FIBA chief technical officer and the Adelanto, California, facility manager told NTSB investigators that Air Products brought tube trailer module No. 430003 to the facility about 3 weeks prior to its requalification inspection. FIBA considered CT-250 modules a “delicate” item, therefore the facility manager and one other technician were the only personnel assigned to work on the units. The technician performed all the tubing, fitting, and valve disassembly and reassembly work, while the facility manager checked his work and conducted the internal visual inspections. The technician removed all fittings and valves from the cylinders to facilitate the internal inspections. The technician began the inspection process by purging the cylinders with nitrogen. Next, the technician disconnected the 0.5-inch vent line nut couplings to the PRD assemblies and swiveled the tubing out of the way. The facility manager said that he had instructed the technician to notify him if any of the compression fitting ferrules were not properly swaged into the tubing. The facility manager said he was not aware of any loose couplings and none of the ferrules slid from the tubing. Loose couplings or ferrules would have indicated they had not been swaged onto the tubing walls. The facility manager added that if he had been informed of any loose fittings, he would have checked the ferrules and replaced the fittings and tubing as necessary. The FIBA shop had a Swagelok No-Go gap gauge that fits between the nut and the fitting shoulder if the fitting has not been sufficiently tightened. The facility manager referenced an instructional video for assembling the fittings on the Swagelok website and understood that the gauge is compatible with Parker fittings that were used on the module. These instructions state that the nut should be finger tightened, further tool tightened 1 1/4 turn, and then the fitting gauged to confirm tightness. According to the facility manager, reassembling a properly assembled compression fitting does not require tightening and gauging beyond a snug fit. Once a compression fitting is properly tightened to correct specifications and checked with a gap gauge, the ferrules would have been permanently swaged onto the tubing. Thus, the technicians determined there was no need to check with the gap gauge when reassembling the fittings on the incident module.

NTSB

Hazardous Materials Incident Report

25

However, because the tubing on the ejected vent lines had not been swaged, it should have been obvious to the FIBA technician during disassembly that these fittings were loosely attached. If the compression fitting had been properly installed during initial assembly, the ferrules would have been permanently swaged onto the tubing and the fitting should not have disassembled during venting. Verifying vent tube securement was not specifically listed among the items the facility manager initialed on the FIBA Trailer Shipping Final Inspection Report. The fittings must be disassembled to perform the internal visual cylinder inspections and would not have required much effort to verify each fitting had been completely secured. A properly assembled vent line would have vented the gas relieved through the PRD harmlessly upward and away from other cylinders, even if it had ignited. Therefore, the NTSB concludes that had the requalification personnel inspected each vent line compression fitting for tightness, the propagation of the fire to the adjacent hydrogen cylinders may have been avoided. The NTSB investigators also requested that Atlas provide its quality assurance and inspection records for the February 2015 assembly of the tube trailer module. The records did not reflect details of any compression fitting inspection or disassembly to confirm proper tubing securement and that all of the ferrules had been installed on each vent line. On February 22, 2018, Air Products visited the Atlas facility in Northampton, Pennsylvania, to audit the module construction process and to discuss the Diamond Bar incident. The audit found that on three modules under assembly, about 50 percent of the PRD vent fittings were not sufficiently tightened. Air Products representatives found that while Atlas did possess a No-Go gap gauge, it had not been used for the assembly of the modules under construction. The vent line tubing attached to the PRDs of seven cylinders had been ejected from their respective fittings and the tubing had not been swaged to lock ferrules onto the tubing. Therefore, the NTSB concludes that the vent line compression fittings that disassembled during venting were not properly installed at the time the tube trailer module was fabricated and should have been noticed and repaired during the requalification inspection. As part of the December 2017 requalification inspection, the FIBA technician removed the PRD assemblies from the Tescom valves, which control the flow of gas into and out of the cylinders. The technician changed the Tescom valve O-rings and checked the valve seats for wear and evidence of gas pass-by, finding no exceptions. Next, internal visual inspections for each cylinder were undertaken from each end of the open cylinders. The technician shined a flashlight in one end of the cylinder while the facility manager visually inspected the cylinder from the opposite opening. Had any suspicious features been noted, FIBA personnel could have inserted a borescope into the cylinders for a more detailed visual inspection, but the borescope inspection for module number 430003 was deemed unnecessary. The visual inspections checked for buckling, bulges, cracks, or splits in the aluminum liner. The technician and facility manager noted no exceptions. Prior to the Diamond Bar incident, Air Products had directed FIBA to replace all PRDs during normal requalification inspections. Air Products decided that it would add the PRD change-out to the requalification work because (1) the PRDs experience numerous pressure cycles over a 5-year requalification cycle and (2) the PRD assembly must be removed from the

NTSB

Hazardous Materials Incident Report

26

cylinders to facilitate internal cylinder visual inspections, and since there is a compression washer between the parts, installing a new part would improve leak-tightness. FIBA obtained its inventory of new PRDs for the hydrogen tube trailer modules directly from Air Products.25 When FIBA received delivery of the PRDs, the facility manager stored them in his office until needed. The only equipment FIBA has worked on requiring the 3132SB9-95 PRDs are the Air Products CT-250 hydrogen tube trailer modules. FIBA had not performed any requalification work on other cylinders that would have required the use of Sherwood Valve model 3132SBF9- 55 PRDs with a rated actuation pressure of 5,833 psi. Therefore, FIBA did not intentionally maintain any inventory of that model PRD. During the tube trailer module number 430003 requalification inspection, the technician replaced the front and rear PRD assemblies with new Sherwood Valve PRDs that were supposed to be part number 3132SB9-95 rupture disk/fusible metal plug combination, rated at 10,000 psi and 212℉. Following reassembly, the pressure proof test involved filling each cylinder with nitrogen to a pressure of 9,375 psig (1.25 times the working pressure) for 10 minutes. The cylinder passes the test if the pressure does not drop more than 5 percent of the original test pressure. The technician and facility manager noted no pressure test exceptions. At the time of this requalification inspection, FIBA’s procedure was to conduct pressure proof tests with the new PRDs installed, and thus they were exposed to a pressure cycle of 1.25 times the working pressure. The facility manager initialed each of the line-items in the Trailer Shipping Final Inspection Report to indicate he had checked the work. Although the facility manager initialed line number 58(a) on the inspection report, “verify PRV [sic.] psig matches schematic,” he told NTSB investigators that he did not check the PRD markings to verify their pressure ratings. The facility manager explained that he assumed that Air Products shipped the correct parts to FIBA. Once the module was reassembled with new PRDs, the FIBA technician affixed qualification stickers to the cylinders and test plate to the module. The trailer was returned to Air Products pressured with about 20 psig of nitrogen. Air Products retrieved the trailer shortly after the FIBA requalification tests were complete. The FIBA trailer inspection report incorrectly stated that the facility manager verified the PRD pressure matched the manufacturer’s requirement. PHMSA’s special permit and regulatory controls include requirements for a cylinder’s pressure retaining components but not the condition of safety devices and appurtenances such as the PRD and vent. Thus, PHMSA lacks the authority to intervene in cases such as this where a testing facility falsely reports conducting a safety inspection. The PRD and vent tubing may never be used during the normal course of a module’s service life, therefore it is essential that they function at the intended pressure and that the gas is vented in a harmless direction to prevent an incident from escalating or causing injury and property damage. Therefore, the NTSB concludes that the lack of a PHMSA special permit and regulatory requirements for verifying that PRDs used on cylinders actuate at the correct

25 Air Products ordered the PRDs from Sherwood Valve and then forwarded the shipment to FIBA.

NTSB

Hazardous Materials Incident Report

27

pressure and that venting equipment has been properly assembled and secured increases the risk of uncontrolled fires on flammable gas tube trailers. Among the requirements of DOT-SP 14576 is the requirement that cylinders be manifolded to the requirements of 49 CFR 173.301(g). This regulation requires PRDs for manifolded horizontal cylinders transporting flammable gases to be arranged to discharge upward to prevent escaping gas from contacting personnel or any adjacent cylinders. Additionally, the special permit requires that all cylinders must be operated and maintained in accordance with the Structural Composites Industries Cylinder Component Operations Manual, and those who perform inspection and testing of cylinders subject to this special permit must comply with 49 CFR 180.205(b) and with all the terms and conditions of the special permit. However, none of the terms of the special permit, the federal regulations, and the industry specifications require periodic inspections to ensure that PRD venting equipment is secured and functional. The tube trailer module had unintended PRD actuations twice: February 4, 2018, and February 11, 2018. In the first instance, the relieved gas vented upward and away from the cylinders during the night while the module was parked at a hydrogen fueling facility and was not immediately noticed. The responding technician discovered that cylinder No. 4 had vented and found no evidence of either fire or vent tube separation. If the vent line had not separated during the February 11 incident, the venting hydrogen from one cylinder (No. 14) would have been harmlessly vented above and away from the trailer even if the hydrogen gas had ignited. Air Products conducted a full tube trailer module and fleet inspection following the incident and found that half of their PRD vent line compression fittings were not assembled with sufficient tightness. During these inspections, Air Products reassembled the compression fittings and verified tightness with No-Go gap gauging. Air Products has implemented procedures to inspect the assembly of the fittings and the PRDs of new tube trailer modules prior to putting them into service. However, the PRD compatibility checks, and the vent line securement may be overlooked by other fleet owners because of the lack of inspection requirements in the DOT special permits and the Hazardous Materials Regulations. In 2013, the National Renewable Energy Laboratory (NREL) published a report examining mechanisms of high-pressure hydrogen storage system PRD failure incidents and the applicable codes and standards that have been developed to minimize the risk of such failures.26 Among the documented incidents involving hydrogen tube trailers was an event in 2009 in which a PRD rupture disk failed prematurely at 5,200 psig while filling a tube trailer with hydrogen to 6,000 psig. The vent line attached to the PRD was not sufficiently anchored, and it bent outward violently from the thrust of the release, causing significant damage to nearby system components. There were no personnel in the immediate area when the disk failed. Although the PRD was rated at 10,000 psig, metallurgical analysis showed the rupture disk was composed of nickel, and hydrogen embrittlement in the disk led to stress cracks and eventual failure. The Diamond Bar, California, incident and the events cited in the NREL report, can be prevented by

26 National Renewable Energy Laboratory, Pressure Relief Devices for High-Pressure Gaseous Storage Systems: Applicability to Hydrogen Technology, Task number HT12.72.10 (Golden, Colorado: US Department of Energy, National Renewable Energy Laboratory, 2013).

NTSB

Hazardous Materials Incident Report

28

ensuring that the correct PRD has been installed in equipment and that the vent assembly has been adequately secured. Therefore, the NTSB recommends that PHMSA revise all hazardous materials special permits for transporting gases in manifolded horizontal cylinders to require that requalification inspections include verifying that PRDs of the correct pressure rating are used and that PRD venting equipment is inspected and tested to ensure that it can withstand forces generated by PRD actuation. Furthermore, because special permits are issued for nonspecification cylinders and there are other DOT-specification horizontally mounted cylinders with similar PRDs and venting equipment, the NTSB also recommends that PHMSA revise 49 CFR Part 180, subpart C, “Requirements for Requalification of Specification Cylinders,” to ensure that inspectors requalifying cylinders verify that PRDs of the correct pressure rating are used and that PRD venting equipment is inspected and tested to ensure that it can withstand forces generated by PRD actuation. 2.4 Hydrogen Tube Trailer Component Design Criteria 2.4.1 PRD Vent Systems CGA standard G-5.5, which is for hydrogen vent systems used in gaseous and liquid hydrogen systems and excludes applicability to PRDs for cylinders and tube trailers regulated by the US DOT, recommends that the discharges of gaseous hydrogen through PRD activation be directed through an engineered vent system.27 According to the standard, the force of the venting gas shall be taken into consideration on the design and anchoring of the vent system components. Consideration for the system’s design pressure should include such factors as the flow capacity of the vent system, the effect of deflagrating or detonating hydrogen-air mixtures within the vent, and supersonic flow effects. The standard also recommends against the use of low melting point materials for vent systems, such as aluminum, copper, brass, and bronze, which can weaken and fail when exposed to external fires. In contrast, DOT-SP 14576 and 49 CFR 173.301(g) provide no design criteria to ensure that PRD venting hardware used in horizontally mounted cylinders and tube trailers are properly designed, constructed, and maintained such that they will function as intended when PRDs activate. Instead, the federal regulations only specify the desired outcome in that escaping gas must be arranged to discharge upward to prevent it from contacting personnel or adjacent cylinders. The NTSB concludes that although the PRD vent tubing that separated in module number 430003 likely did so because of incomplete assembly of the compression fitting, the lack of vent system design requirements that consider factors such as the force of venting gas and construction material may leave vent systems for cylinders and tube trailers vulnerable to unexpected failure during an incident. The vent installation design should consider the characteristics of the discharge piping and pipe supports. Reactive force from an actuated PRD imposed on either the valve or the outlet piping can be transmitted to the valve inlet and associated piping. This force could cause extensive damage if the discharge piping is not sufficiently supported. This issue may be applicable to other hazardous material gases transported in horizontally mounted cylinder tube trailers as well. Therefore, NTSB recommends

27 Compressed Gas Association, Hydrogen Vent Systems. CGA G-5.5, 3rd edition (Chantilly, Virginia: Compressed Gas Association, 2014). This standard is not incorporated by reference in the Hazardous Materials Regulations. The publication presents guidelines for the design, installation, and maintenance of hydrogen vent systems at stationary facilities.

NTSB

Hazardous Materials Incident Report

29

that PHMSA work with the CGA to develop design guidelines for tube trailer PRD vent systems. The NTSB further recommends that the CGA work with PHMSA to develop design guidelines for tube trailer PRD vent systems. 2.4.2 Pressure Relief Devices The NTSB investigators found that the Sherwood Valve model 3132SBF9-55 (5,833 psi) PRD and the 3132SB9-95 (10,000 psi) PRD are visually identical, except for a small font laser etching that indicated the model number and intended operating pressure. This incident was not the only occasion in which the misidentification of PRD models resulted in incorrect PRDs being installed in hydrogen tube trailer modules. In 2015, Air Products reported premature actuation of four PRDs affixed to SCI/Worthington model ALT-1015 cylinders. Multiple cylinders Air Products purchased from SCI/Worthington in 2012-2013 had incorrect 5,833 psi PRDs installed during assembly instead of the specified 10,000 psi PRD. The issue was not discovered until several cylinders vented at service pressure. The venting was determined to be caused by the incorrect 5,833 psi PRDs. Worthington’s internal investigation report concluded that the 5,833 psi PRDs were incorrectly installed at its manufacturing facility and that the pressure rating was not verified on installation. Worthington also found that multiple PRDs with nearly identical appearance and marked with no part number were stored adjacent to one another, which allowed for possible commingling at the valving workstation. As a corrective measure in August 2015, SCI/Worthington instituted a just-in-time production system to ensure no excess components remain from one shift to the next. SCI/Worthington further revised its work instructions and retrained operators to verify the PRD pressure rating prior to its installation. In addition to the four incorrect PRDs that investigators found installed on the incident tube trailer module number 430003, the FIBA facility manager told investigators that after the February 11 incident he discovered three more 5,833 psi PRDs at the facility in Adelanto, California. Two of these PRDs were found commingled in a bag of new 10,000 psi PRDs shipped from Air Products. One 5,833 psi PRD had already been installed in a tube trailer. This mistake was found during the inspection process (it had not yet been pressurized). Also, after the incident and during the Air Products inspection of another tube trailer module, one 10,000 psi PRD was found without any external pressure etching on its housing, however markings on the rupture disk surface found that it had been manufactured with the proper 10,000 psi-rated disk. Because Air Products had never purchased any 5,833 psi PRDs, they likely became commingled at the Sherwood Valve facility with the Air Products order for 10,000 psi PRDs. The identification requirements outlined in CGA standards for PRDs list the safeguards and the guidelines to avoid jeopardizing PRD performance by improper service practices.28 While the CGA suggests that PRDs that are replaceable should also be marked with the rated burst pressure and yield temperature as applicable, the PRDs involved in this incident were laser-etched with this information in a small font on one hex flat. Although the requalification technician probably believed that he was installing the correct PRDs, the PRD’s identification

28 CGA S-1.1 (2011), Paragraph 7, Identification Requirements.

NTSB

Hazardous Materials Incident Report

30

with a small font on one hex would not have been sufficient to alert him of his error. Therefore, the NTSB concludes that the lack of noticeable marking or other visual indicators, unique design features, and unique model numbering to readily identify PRDs intended for different applications, made them easy to confuse and did not avert the requalification technician from installing four wrong PRDs on the incident tube trailer module. Since this incident, the PRDs manufactured for Air Products now have larger-font pressure ratings engraved on multiple locations such that the number is visible regardless of the PRD body orientation. Further, Air Products has requested future 10,000 psi PRDs to be fabricated from stainless steel, which is silver in color and visually different from the gold-colored brass PRD body used for a 5,833 psi PRD. Air Products successfully subjected the alternative PRD design to bonfire testing as required by the conditions of DOT-SP 14576, and is seeking PHMSA approval to switch to the stainless steel version for greater identification and robustness.29 Figure 14 shows the new PRD design compared to the previous design, including improved markings to eliminate confusion between the PRD models and ensure that the devices are selected for the appropriate service criteria.

Figure 14. Comparison of old and new PRD markings.

29 DOT-SP 14576 condition 7a references DOT-CFFC Basic Requirements, Fifth Revision (March 2007). Among these requirements is a bonfire test of two cylinders in which the cylinders are exposed to fire until fully vented. The cylinders must remain intact and gas must be vented predominantly through the PRD.

NTSB

Hazardous Materials Incident Report

31

• Postaccident Actions

1. 1 FIBA Technologies Technicians

The FIBA procedure for pneumatic pressure proof testing for DOT special permit cylinders requires for the technician to have had at least 2 years of experience in conducting inspections or be supervised by a person with 2 years of experience. According to the FIBA facility manager, the technician had about 3 years of experience working at FIBA. The facility manager would periodically provide guidance and instruction to the technician as necessary. The facility manager held his current position at FIBA since October 2017. He worked at the facility since 1989 and his knowledge and skills had been derived from on-the-job learning. He had not attended any formal training pertinent to cylinder qualification procedures. However, his personnel record documented that he received hazardous materials employee function-specific training in January 2016. Air Products consulted with FIBA to develop the following postaccident changes to inspection and qualification procedures for its hydrogen tube trailer modules. These practices were included in a jointly written Air Products-FIBA updated cylinder inspection and qualification procedure and were reviewed with the facility manager. • The FIBA facility manager now checks to make sure each PRD is the correct part, even though this step was already reflected on FIBA’s written checklist. As an added quality assurance measure, the FIBA facility manager marks each PRD currently in storage with a marker pen to signify their pressure ratings have been verified. In addition, each PRD is visually checked as they are installed in the cylinders. • FIBA is double checking that the ferrules are correctly swaged into the vent line tubing and that sufficient amount of tubing extends beyond the crimped ferrules into the PRD body seat. • If the tubing does not match up with the PRD assembly easily and without placing bending stress on the fitting, FIBA will fabricate a new vent line from stock stainless steel tubing. • All fittings are torque checked and marked with paint to avoid errors in omission. • Cylinder pressure tests will be conducted with no PRDs installed to avoid placing overpressure on the devices (1.25 times the working pressure). The pressure-proof test is now done with the PRD removed and blanked off so that the disks are not exposed to elevated pressure that could induce premature failure during normal operation. NTSB

Hazardous Materials Incident Report

32

• Air Products has provided FIBA with stainless steel PRD adaptor fittings to replace the brass ones to avoid frequently observed thread damage. 3.2 Atlas Machining and Welding Technicians The Air Products procedure for assembling tube trailer modules states that all personnel involved in the installation of compression fittings must be trained in the installation and inspection of the fittings, and the training shall be documented in the employee’s file. The Atlas president and chief operating officer told NTSB investigators that the assembly technician has received 28 years of “on-the-job” training with Atlas for installing tube trailer piping, manifolds, and fittings. The available documentation did not indicate whether the assembly technician had been trained on the provisions of DOT special permits. As a result of this incident, Air Products revised and reviewed with Atlas in detail the assembly and retest procedures that include additional inspections and instructions. The assembly instructions include the following details for compression fittings: • Compression fittings must be hand tightened, marked, and then further tightened 1 1/4 turns in accordance with manufacturer’s recommendations. The No-Go gap gauge shall be used as a check to verify that the fitting has been properly tightened. • At the initial make-up all fittings must be disassembled and visually inspected to ensure the proper tubing insertion and that all ferrules are installed. • After reassembly, the applicable manufacturer’s No-Go gap gauge shall be used as a check to verify that each fitting has been properly tightened. • For high pressure (that is, greater than 150 psig) or flammable materials at any pressure, 5 percent of the fittings in a system are to be reexamined by disassembly to confirm proper tubing insertion and that all ferrules are installed. A written report of the inspection shall be maintained with quality assurance records. • When accepting delivery of new modules, Air Products shall perform random checks by disassembly.

NTSB

Hazardous Materials Incident Report

33

• Conclusions

1. 1 Findings

• Greater first responder training and awareness about hydrogen tube trailer modules

transported within their jurisdiction could have helped the first responders to initially respond to this incident more effectively, efficiently, and safely.

• Although there is ample generic hazard information for compressed hydrogen and vehicle

fuel systems, the available guidance lacks critical hazard recognition and firefighting information specific to fuel cell electric vehicle fueling infrastructure and containers currently used for the bulk transportation of compressed hydrogen.

• The generic guidance for flammable gases contained in the Emergency Response

Guidebook, Guide 115, does not adequately describe unique hazards associated with compressed hydrogen or best response actions for public safety personnel.

• None of the incident tube trailer cylinders lost mechanical integrity, and they did not

contribute to the cause or perpetuation of the incident.

• The hydrogen release most likely initiated because a pressure relief device with the

wrong pressure rating was installed on cylinder No. 14 and actuated under normal working pressure loads.

• The hydrogen ignited during the forced separation of the cylinder No. 14 pressure relief

device assembly from the cylinder.

• Although the other cylinder pressure relief devices in the tube trailer module were

actuated because of fire exposure, the cylinder No. 14 pressure relief device actuated before the fire began.

• Had the requalification personnel inspected each vent line compression fitting for

tightness, the propagation of the fire to the adjacent hydrogen cylinders may have been avoided.

• The vent line compression fittings that disassembled during venting were not properly

installed at the time the tube trailer module was fabricated and should have been noticed and repaired during the requalification inspection.

• The lack of a Pipeline and Hazardous Materials Safety Administration special permit and

regulatory requirements for verifying that pressure relief devices used on cylinders actuate at the correct pressure and venting equipment has been properly assembled and secured increases the risk of uncontrolled fires on flammable gas tube trailers. NTSB

Hazardous Materials Incident Report

34

• The lack of vent system design requirements that consider factors such as the force of

venting gas and construction material may leave vent systems for cylinders and tube trailers vulnerable to unexpected failure during an incident.

• The lack of noticeable marking or other visual indicators, unique design features, and

unique model numbering to readily identify pressure relief devices intended for different applications, made them easy to confuse and did not avert the requalification technician from installing four wrong pressure relief devices on the incident tube trailer module. 4.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the February 11, 2018, tube trailer module fire in Diamond Bar, California, was the requalification technician’s installation of an incorrectly rated pressure relief device in cylinder No. 14, which actuated during normal transportation and released high-pressure hydrogen, and the tube trailer module assembly contractor’s failure to sufficiently tighten compression fittings on the pressure relief device vent lines that disassembled under the pressure of escaping gas allowing a fire to develop inside the module and impinge on adjacent cylinders. Contributing to the incident was a lack of a requirement for requalification inspectors to verify the pressure relief device pressure rating and to inspect for vent line assembly securement. NTSB

Hazardous Materials Incident Report

35

• Safety Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Pipeline and Hazardous Materials Safety Administration: Revise your Emergency Response Guidebook to include information about hazards and protective actions specific to hydrogen, and to provide guidance on how to manage incidents involving fuel cell electric vehicles and hydrogen fueling infrastructure. (H-19-18) Revise all hazardous materials special permits for transporting gases in manifolded horizontal cylinders to require that requalification inspections include verifying that pressure relief devices of the correct pressure rating are used and that pressure relief device venting equipment is inspected and tested to ensure that it can withstand forces generated by pressure relief device actuation. (H-19-19) Revise Title 49 Code of Federal Regulations Part 180, subpart C, “Requirements for Requalification of Specification Cylinders,” to ensure that inspectors requalifying cylinders verify that pressure relief devices with the correct pressure rating are used and that pressure relief device venting equipment is inspected and tested to ensure that it can withstand forces generated by pressure relief device actuation. (H-19-20) Work with the Compressed Gas Association to develop design guidelines for tube trailer pressure relief device vent systems. (H-19-21) To the US Department of Energy, Pacific Northwest National Laboratory: Revise your hydrogen emergency responder training programs to include readily accessible specific information and guidance on hazard recognition and firefighting relative to tube trailers and fuel cell electric vehicle fueling infrastructure. (H-19-22) To the Compressed Gas Association: Work with the Pipeline and Hazardous Materials Safety Administration to develop design guidelines for tube trailer pressure relief device vent systems. (H-19-23) NTSB

Hazardous Materials Incident Report

36

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

JENNIFER HOMENDY Chairman

Member

BRUCE LANDSBERG

Vice Chairman

Date: October 10, 2019

NTSB

Hazardous Materials Incident Report

37

Appendix. Investigation The National Transportation Safety Board (NTSB) was notified on February 11, 2018, of the incident in which a fire occurred on a hydrogen tube trailer while in transportation within a business district of Diamond Bar, California. The NTSB was initially informed that the fire initiated from gas cylinder valve and fitting leakage. None of the gas cylinders were breached. Several days later, the carrier, Air Products and Chemicals, Inc., inspected the trailer and found that a cylinder testing contractor had installed improperly rated pressure relief devices in several cylinders during a recent requalification inspection and that improperly secured vent tubes became disassembled and directed burning hydrogen into the interior of the trailer module. On February 22, 2018, the NTSB initiated a formal investigation into the incident and began collecting information about the tube trailer from Air Products and Chemicals, Inc. and from the Pipeline and Hazardous Materials Safety Administration. On March 12, 2018, the NTSB launched two accident investigators to collect evidence from the tube trailer wreckage that was stored at the Air Products terminal in Santa Fe Springs, California, and from the gas cylinder requalification facility in Adelanto, California. Investigators also visited the incident scene and a hydrogen fuel cell vehicle fueling facility in Diamond Bar, California, and the Air Products tube trailer module loading facility in Long Beach, California. Following the on-scene investigation, investigators traveled to the Sherwood Valve, LLC pressure relief device manufacturing facility located in Valley View, Ohio, to review their manufacturing and shipping processes. Parties to the investigation included Air Products and Chemicals, Inc., Sherwood Valve, LLC, and the Pipeline and Hazardous Materials Safety Administration.

FD07494 ｜ 2018_美国_MAB1806.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/06 National Transportation Safety Board Marine Accident Brief Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway Accident no. DCA16FM055 Vessel name Aframax River Accident type Allision and fire Location Deer Park, Texas, 29° 44.90 N, 95° 05.97 W Date September 6, 2016 Time About 0005 central daylight time (coordinated universal time – 5 hours) Injuries Minor burns to the two onboard pilots Property damage $1.5 million est. Environmental damage Release of 88,000 gallons of low-sulfur marine gas oil Weather Partly cloudy, visibility of 8 miles*, winds southeast at 4 knots, air temperature 86°F Waterway information Houston Ship Channel near the Intercontinental Terminals Company (ITC) facility. The terminal has five deep-draft tanker berths and ten barge docks located on the south side of the channel at the mouth of Tucker Bayou. On September 6, 2016, about 0005 local time, the tanker Aframax River allided with two mooring dolphins in the Houston Ship Channel (HSC) near Deer Park, Texas. The allision punctured the ship’s hull plating, and about 88,000 gallons of low-sulfur marine gas oil spilled into the water. The oil ignited and burned for about 45 minutes. The two onboard pilots sustained minor burns, and the property damage exceeded $1.5 million.

Aframax River anchored on the Delaware River before the accident. (Photo by John Curdy) *All miles in this report are nautical miles (1.15 statute miles).

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

2

NTSB/MAB-18/06 Background The Aframax River, a Panama-flag, double-hull crude-oil tanker, was built in 2002 by Imabari Shipbuilding Saijo Dockyard in Saijo, Japan. Originally named the Singapore River and classified by Nippon Kaiji Kyokai (ClassNK), the vessel was purchased by Aframax River Marine Co. in Athens, Greece, and renamed in November 2011. The new owner continued to classify the vessel with ClassNK. Executive Ship Management PTE in Singapore provided the crew and technical management of the vessel. Accident Events The Aframax River had arrived at the Houston Fuel Oil (HFO) facility 2 days before the accident with a cargo of Marlim crude oil and was moored starboard side to at berth no. 3. On September 5, 2016, about 2130, the vessel had completed discharging the cargo; soon thereafter, the crew commenced preparations to sail outbound with the ship in a ballast condition. The crewmembers completed their departure checklist, which included mechanical testing of the steering and main propulsion systems. All tests were satisfactorily completed from both the bridge and engine room, and no problems were recorded in the bridge or engine log books.

Section of the Houston Ship Channel where the Aframax River allision occurred (red triangle overlaid on NOAA chart 11325, Houston Ship Channel). At 2306, two pilots from the Houston Pilots Association boarded the fully ballasted Aframax River at the HFO dock. Two pilots were required for the transit to mitigate fatigue and provide assistance to each other as needed; the conning pilot provided direction during maneuvering while the second pilot monitored the situation. Both pilots, the ship’s master, and the bridge crew held a predeparture conference on the navigational bridge, including a review of the ship’s pilot/master information exchange card. Following the conference, the crew conducted tests

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

3

NTSB/MAB-18/06 of the navigation and communication equipment (such as checking in with tugboats and vessel crew assigned to lookout duties); everything was satisfactory. At 2335, the main propulsion engine was ready for maneuvering and was placed in stand-by. The engine control system remained in bridge-control during maneuvering. At 2336, the conning pilot ordered the mooring lines let go and then ordered dead-slow-ahead on the main engine. About 15 seconds later he ordered all stop; about 30 seconds thereafter, dead-slow astern; and then again, all stop. The engine responded as expected. At 2342, with the tugboat Jess Newton made up alongside the tanker’s port quarter and the tugboat Gasparilla alongside its port bow, the Aframax River was pulled away from the dock. The conning pilot and the master were positioned on the starboard bridge wing while the second pilot observed from the bridge and port bridge wing. The third officer was positioned at the engine order telegraph (EOT) executing the pilot’s orders; a helmsman was at the wheel; and the chief officer, the bosun, and two lookouts were on the bow. The voyage plan included bringing the ship to a safe location in the middle of the channel and, with the assistance of the two tugboats, turning the ship about 90 degrees to starboard for the outbound transit. At 2359, the conning pilot ordered dead-slow-astern propulsion (30 rpm). The third officer acknowledged the engine order and used the EOT to initiate the astern propulsion; he observed the ship’s rpm indicator reach 30 rpm, confirmed the completion of the order to the bridge team, and continued with his navigational duties. At 0002 on September 6, the second engineer who was monitoring the engine tachometer in the engine control room (ECR) called the bridge to check the bridge’s rpm indicator. He said that the ECR’s rpm indicator was showing 80 rpm even though the ECR’s EOT showed the bridge command input of dead slow astern―which should have been only 30 rpm. The third officer replied that the bridge rpm indicator was also showing 80 rpm, and he informed the bridge team of this fact as well. On hearing this information, the conning pilot immediately ordered “all stop.” The third officer acknowledged the order and placed the EOT in the stop position, but all on the bridge noticed that the rpm indicator was still showing 80 rpm and that the vessel’s astern movement was increasing. At 0003, to counteract the ship’s astern speed, the conning pilot ordered dead slow ahead, but the astern movement continued. At 0004, the conning pilot ordered slow-ahead propulsion, then half ahead, and then full ahead, but the ship’s astern movement was not slowing, and the engine was not responding. The conning pilot also issued commands to the two harbor tugboats to help reduce the tanker’s astern movement, but they had little success. Realizing that there was imminent risk of striking the nearby docks or any of the four tankers moored at the Intercontinental Terminals Company (ITC) facility, the conning pilot ordered the tugboats to use all available means to counter the ship’s astern movement. The mate on the Jess Newton relayed back to the pilot via VHF radio the approximate distance to the two ITC mooring dolphins directly behind the ship. Aframax River was now moving at about 3.5 knots, still in an astern direction. The conning pilot ordered the Jess Newton to go full ahead, but the mate replied that he could not do so at that time because the first of the two dolphins was about to pass between the tugboat and the tanker. The mate stated he never saw a change in the propeller wash from the Aframax River, an indication that the propeller did not engage in a forward direction. The conning pilot ordered both anchors released. The master was relaying via phone to the chief engineer in the ECR that the main engine was not responding to any bridge EOT commands.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

4

NTSB/MAB-18/06 At 0005, the chief engineer took control of the main engine and pressed the emergency stop button in the ECR; he told investigators that once he did so, the engine tachometer started to decrease from 80 rpm. When an allision with the mooring dolphins was imminent, the master ordered the deck crew to stand clear of the stern of the vessel and brace for impact. At 0005, the port side of the Aframax River struck the first ITC dolphin, no. 78A, at 3.2 knots. Within seconds of that impact, the tanker’s port quarter struck the second ITC dolphin, no. 78B. The second allision tore an approximately 30-foot-long opening on the ship’s port quarter hull plating at frame 26, about 8 feet above the waterline near the centerline of the no. 2 fuel oil tank. Marine gas oil (MGO) immediately began pouring out of the hull opening. As the tanker continued aft, its hull plating was further cut and deformed inward by contact with the mooring dolphins. The friction and the cutting of the hull plating generated heat, which ignited the MGO and triggered a large fire with thick, black, bellowing smoke that engulfed the ship’s port quarter and the adjacent main deck, all the way up and past the port bridge wing. The general alarm was sounded.

Aframax River after the allision with dolphin no. 78B. Tractor tugboat David B is in the foreground rendering assistance. (Image courtesy of ITC City Dock security video) The chief officer on the bow ran back to the fire control muster station. All crew were accounted for, and four teams were assigned to fight the fire. The conning pilot immediately notified Coast Guard Houston/Galveston’s Vessel Traffic Services (VTS) to alert nearby vessels of the fire and fuel in the water, and he informed VTS that the tanker had lost main propulsion. The second pilot requested that VTS contact local fire boats for assistance. The fire on the water’s surface extended to the bow of harbor tugboat Jess Newton, which was secured to the tanker’s port quarter. The tugboat’s deckhand closed all doors and activated the fire sprinkler system. The heat of the fire melted and parted the line at the ship’s chock. The Jess Newton crew repositioned the tugboat just forward of the Aframax River’s superstructure and applied full-ahead propulsion to move the tanker farther from the ITC terminal.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

5

NTSB/MAB-18/06 The ship’s crewmembers donned their firefighting gear and reported to their four assigned fire stations. As an additional firefighting measure, the chief officer with the approval of the master began to press up the no. 1 port and starboard ballast tanks that were already 90-percent full. Consequently, ballast water started to flow out onto and down the main deck, providing a 15―18-inch-deep water blanket that ran aft across the entire cargo deck (the tanker was trimmed by the stern) and overboard via the scuppers. Boat crews from Coast Guard Station Houston and Station Galveston and personnel from the Harris County Sheriff’s Office marine division responded to the emergency. At 0008, the Coast Guard closed the Houston Ship Channel and established an approximately 2-mile-long safety zone. At 0009, tractor tugboat David B arrived on scene and was positioned just forward of the Aframax River’s starboard-side superstructure. Several other tugboats and fire boats also eventually arrived and assisted. Despite the serious danger to life and property, the vessels remained alongside the Aframax River, maneuvering the disabled ship away from the other tankers and adjacent chemical facilities. The second pilot, who was coordinating the firefighting effort, told investigators, “The harbor tugs, the guys on the boats . . . deserve a medal of meritorious service or whatever might be available. They did an outstanding job.” The conning pilot helped maneuver the tanker to the middle of the channel to prevent the flames from spreading further. Applying their firefighting training, the crews battled the flames and eventually extinguished the fire about 0118. A one-mile stretch of the Houston Ship Channel remained closed for 14 hours. The Aframax River crew conducted soundings on all of the tanks to determine the extent of damage to the hull. As a result of the breach in the no. 2 fuel oil tank, about 88,000 gallons of MGO spilled into the waterway. The fire severely damaged the portside lifeboat and davit system, two liferafts, the port crane at frame 27, and an embarkation ladder. Damage extended about 100 feet along the portside hull between frames 24 and 41. Several of the tugboats involved in the response effort also sustained damage to their equipment.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

6

NTSB/MAB-18/06

Fire damage to Aframax River’s portside bridge wing (where the conning pilot was standing when the fire erupted), lifeboat, and main deck.

The impact with the ITC mooring dolphins caused a 30-foot-long fore and aft cut in the shell plating on Aframax River’s port quarter. Overall impact damage extended about 100 feet in length.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

7

NTSB/MAB-18/06 Analysis Investigators and shipping company representatives focused their efforts on identifying the potential sources that caused the engine to ramp up to 80 rpm and not respond to EOT command inputs from the bridge. After interviewing the pilots and the ship and tugboat crews, it became apparent that the engine’s governor and printed circuit board, which control the engine speed, may have played a role in the accident. The Diesel United - Sulzer Type 7RTAC2 is a single-acting, slow-speed, two-stroke, reversible marine diesel engine. The engine was directly connected to the propeller, and the engine was designed to come to a complete stop when changing propeller direction from astern to ahead. In the presence of investigators and ClassNK surveyors, technicians from Diesel United, Ltd. inspected and tested the mechanical components of the governor input, fuel control linkage, and other related components. All items were determined to be in good working order.

Front and back of the main engine governor actuator and mechanical fuel linkage. Technicians from Nabtesco Marine Control Systems Company (the manufacturer of the main engine control system and governor) troubleshot the system and tried to identify the fault. In the presence of Coast Guard personnel and a marine surveyor from ClassNK, the technicians examined the system’s electrical and mechanical components and conducted tests from both the bridge and the ECR. No failures or causes were identified during the test. The technicians concluded that the governor actuator system had encountered a momentary abnormality, one which they could not replicate. Nabtesco technicians replaced the governor actuator pictured above. As a precautionary measure, they also replaced the printed circuit board in the ECR, which mechanically supports and electrically connects the governor motor actuator to the bridge’s EOT command inputs. The technicians then carried out a series of calibration and simulation tests, as well as started and stopped the main engine ahead and astern several times, confirming that the system was functioning as designed. The ClassNK surveyor concluded in his report: The main engine started without any delay, ahead and astern, on the command input from the EOTs. The main engine rpm was in accordance with design, dead slow 30 rpm, and slow 38 rpm. This surveyor believes the main engine is ready to answer all orders.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

8

NTSB/MAB-18/06 According to the manufacturer’s technicians, the governor’s actuator system experienced a momentary abnormality. Investigators believe that the abnormality likely resulted from an electrical and/or mechanical failure of the system, which led to loss of engine control while the vessel was engaged in astern propulsion. Further, due to the oil spill that resulted from this accident, investigators also reviewed ship design standards pertaining to fuel oil tank protection. The International Maritime Organization’s Regulation 12A (an amendment to MARPOL Annex I) applies to all vessels delivered on or after August 1, 2010, and requires that individual fuel oil tanks aboard ships with a fuel oil capacity of less than 500 cubic meters be located at least 760 mm inboard of the molded line of the hull plating, thus helping prevent tank breaches and oil spills in case of collision or grounding. However, because the Aframax River was delivered in May 2002, Regulation 12A did not apply to its construction. If the Aframax River had been built after the new standards took effect, fuel would not have spilled in this accident because the maximum inward deformation of the hull plating at the damaged fuel tank was only about 300 mm. The actions of the Aframax River crew, the tugboat crews, and the pilots successfully prevented the spread of fire to other vessels and structures. Probable Cause The National Transportation Safety Board determines that the probable cause of the Aframax River’s allision with mooring dolphins and the subsequent fire in the waterway was a momentary abnormality of the tanker’s main engine governor actuator system in responding to command inputs from the bridge.

Allision of Tanker Aframax River with Mooring Dolphins, and Subsequent Fire in Waterway

9

NTSB/MAB-18/06 Vessel Particulars Vessel Aframax River Owner/operator Aframax River Marine Co./ Executive Ship Management PTE LTD Port of registry Panama Flag Panama Type Crude oil tanker Year built 2002 Official/IMO number 9259173 Classification society Nippon Kaiji Kyokai (ClassNK) Construction Steel Length 810 ft (246.8 m) Draft 28.2 ft (8.6 m) Beam/width 137.8 ft (42 m) Gross tonnage 57,943 tons Engine power; manufacturer 17,403 PS (12,800 kW) Diesel United - Sulzer Type 7RTAC2 Persons on board 25 crew, 2 pilots NTSB investigators worked closely with our counterparts from Coast Guard Sector Houston/Galveston Investigations Division throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA16FM055. Issued: February 22, 2018

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 of the United States Code, Section 1131(b)(1). This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 of the Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 of the United States Code, Section 1154(b).

FD07495 ｜ 2018_美国_MAB1807.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/07

National Transportation Safety Board Marine Accident Brief Fire on board Vehicle Carrier Honor About 0300 local time on February 24, 2017, the US-flagged roll-on/roll-off (ro-ro) vehicle carrier Honor was en route from Southampton, England, to Baltimore, Maryland, when a fire broke out in the upper vehicle deck. The fire was extinguished by the crew using the vessel’s CO2 fixed firefighting system. One injury was attributed to the firefighting efforts. The accident resulted in extensive damage, amounting to more than $700,000, to the Honor’s hold as well its cargo of about 5,000 vehicles. No pollution resulted from the accident.

Honor under way prior to the accident. (Photo courtesy of Erwin Willemse) All miles in this report are nautical miles (1.15 statute miles). Accident no. DCA17RM007 Vessel names Honor Accident type Fire Location Westbound traffic separation scheme in the English Channel, about 55 miles southwest of the Isle of Wight, United Kingdom, 50° 01.7’ N, 002° 35.7’ W Date February 24, 2017 Time 0302 Greenwich mean time (coordinated universal time) Injuries 1 Damage $699,414 est. for vessel damage Environmental damage None Weather Visibility unrestricted at night, winds northeast at 30 knots Waterway information The English Channel is one of the busiest waterways in the world, providing access to some of western Europe’s largest ports.

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 2 The Honor, a 623-foot-long car and truck carrier, operated between various ports in the United States and Europe carrying cargo of new production vehicles, military vehicles, and personally owned vehicles for military and government personnel, as well as household goods shipments for military and government personnel. The vessel had 13 vehicle decks connected throughout by ramps. The upper deck, which was aft of the Honor’s crew accommodation spaces, was known as the “garage deck” and used for car stowage. The vehicle decks were protected by a low-pressure CO2 single-tank fixed firefighting system that was divided into five zones designated A–E.

Simplified diagram of Honor’s cargo decks and zones for CO2 fixed firefighting system. About 2030 on February 23, the Honor departed the dock after conducting cargo operations at Southampton, United Kingdom. By 2230, the pilot had disembarked, and the vessel had begun its intended transit to Baltimore, Maryland, a voyage of more than 3,500 miles. The engineers readied the engine room for the sea voyage and then left it in its normal unmanned state while under way at night. The Honor entered the English Channel and made its way westbound toward the Off Casquets Traffic Separation Scheme north of Cherbourg, France. During this time, the car carrier experienced near-gale force winds (Beaufort scale force 7) from the northeast. The second mate took over the bridge watch at midnight, along with an able-bodied seaman (AB) whose duties included lookout and helm.

About 0302 the next day, a pre-warning alarm on the fire detection panel sounded on the bridge. The alarm indicated that the problem was on the garage deck, so the second mate sent the AB aft to investigate. While the AB was on his way to the garage, the pre-warning alarm became a full alarm. The AB opened the door and inspected the space, radioing back to the second mate that there was smoke in the garage. The second mate called the master and chief mate to inform them of the alarm and smoke. A few seconds later, the AB reported to the bridge that there was also fire, which the second mate relayed to the master and chief mate. The AB told the bridge that there was too much smoke to access the space from the mid-section of the garage forward and that he was going to attempt to approach the fire from the aft entrance of the space. The master and chief mate met at the entrance to the forward door to the garage. Upon opening the door, they could see thick white smoke farther back in the compartment. The master instructed the chief mate to start donning firefighting equipment, and then the master proceeded to the bridge. An emergency gear locker was only a few feet away from the forward door to the garage where they had just observed the fire.

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 3 Once on the bridge, the master instructed the second mate to sound the general alarm. The master then began reducing the vessel’s speed while maneuvering the ship to the north, out of the traffic scheme, and away from vessel traffic. At 0311, according to the master’s statement and the ship’s log, the general alarm was sounded. The master made an announcement to all hands, alerting them about the fire in the garage deck and instructing them to muster at emergency stations. The master ordered the second mate to head aft, dress out in firefighting gear with the chief mate, and attempt entry into the garage with dry chemical fire extinguishers. During this time, the third mate arrived on the bridge to assist the master. The chief mate, after twice attempting to enter the space, reported to the master that the space was inaccessible due to thick black smoke. Consequently, the master asked for the second mate to return to the bridge and sent the third mate down to assist the chief mate. According to the master, all crewmembers had been mustered, accounted for, and dispersed to their fire teams or other emergency stations by about 0320. The engine room was manned by the chief engineer, first assistant engineer, and an oiler who were standing by with the fire pump running. The master updated the chief engineer over the phone about the fire and told him to go up to the CO2 room in preparation for release of the firefighting agent into the affected space. At 0325, the chief mate reported visible flames outside the garage, both on the deck above and at the aft end of the space. The crew had run out at least four firefighting hoses and commenced spraying water on the outside bulkheads and overhead of the garage for boundary cooling and to knock down the visible flames. By 0328, all the ventilation to the area had been secured and confirmed closed. The master instructed the second mate, who had returned to the bridge, to contact “Jobourg Traffic” (the controlling traffic service for this section of the English Channel) on VHF radio to report the vessel’s condition and inform them about the fire. A recounting of the event by crewmembers and analysis of the Honor’s voyage data recorder (VDR) and electronic chart display and information system (ECDIS) documented that the ship had maneuvered out of the traffic scheme and slowed down to bare steerageway to be clear of other vessels and to allow the crew to focus on fighting the fire. At 0334, the second mate switched the status of the vessel on the bridge’s automatic identification system (AIS) to “not under command” so that any approaching vessels would be aware that the Honor had a problem. He then broadcast this status over the VHF radio. The deck lights were also energized, affording the crew better lighting during the emergency. As the master prepared to give the order to release CO2, the crew continued to boundary cool the area, and another round of checks was made about the perimeter to ensure all ventilation was secured. At 0336, another muster was taken to confirm that no one was in the affected space or any space where the CO2 would be discharged. At 0339, the master instructed the chief engineer to release CO2. After the release, the chief mate, the third mate, and an oiler inspected the surrounding areas for visible smoke, hot spots, or other signs of fire, while the rest of the crew continued to actively monitor and cool the adjacent bulkheads and decks. When external signs indicated that the fire was out, the chief mate and chief engineer donned self-contained breathing apparatuses

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 4 (SCBAs) and protective equipment and then inspected the affected areas. They used a thermal imaging device to further ensure that the fire was out. The Honor had no CO2 remaining after the discharge. The master contacted the United Kingdom’s Maritime and Coastguard Agency (MCA) to report the event and to request to return to Southampton. After the master was given permission to proceed back to Southampton, he reported to the MCA that no additional underway assistance was needed.

The English Channel. The red “star” shows the Honor’s location when the fire started. (National Geospatial-Intelligence Agency chart 36005) About 1200 on February 24, the Honor was approximately 7 miles southwest of the southern tip of the Isle of Wight in a holding track when local coast guard and fire officials boarded the vessel via helicopter for inspection prior to the vessel being permitted to enter the port. After the inspection, the Honor was granted permission and proceeded to Southampton, where it was moored to a pier at 2100. Throughout the entire transit from the accident site to the pier, the garage deck was continuously monitored by crewmembers with thermal detection equipment, and hoses were run out and at the ready. Upon arrival at a lay pier in Southampton, local fire and port authority personnel boarded the Honor to assess and inspect the vessel. A determination was made to vent the affected space while the vessel was at an anchorage. The Honor departed the dock early on 27 February and proceed to the Southampton anchorage, whereupon it anchored about 0400 awaiting an approved venting plan. Once the plan was approved, the vessel was vented before returning to the berth for the investigation.

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 5 During the firefighting efforts, one crewmember suffered a leg injury. Once in Southampton, the crewmember was seen at a medical facility and, due to his injury, was discharged from the vessel and returned to the United States. Analysis Investigators examined the garage deck postaccident when the space was brightly lit. Cars were stowed close together with multiple lashings. During the fire, thick black smoke reduced visibility to nothing. With no visibility, the way in which the cars were stowed and lashed would have made it virtually impossible for crewmembers to make their way through the space, especially while suited out in bulky firefighting gear and carrying equipment such as portable extinguishers or fully charged hoses. The crew’s timely and effective use of the CO2 fixed firefighting system, along with boundary cooling, likely prevented the spread of the fire and minimized the damage.

At top, damaged cars on the garage deck. At bottom from left to right, damage to the top deck above the garage and the exterior bulkhead on the port side of the garage while looking aft. Fire investigators examined the affected spaces and identified the likely origin to be about frame 40 port side on the garage deck (see illustration on page 2). There was substantial damage to the deck from frames 22 to 46, and several of the vehicles on this deck were destroyed by fire. These vehicles were all personally owned cars and sport utility vehicles that were being shipped back to the United States. In addition, several new vehicles (that were being shipped to US car

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 6 dealerships) located on the deck below (deck 1) sustained fire-related damage. A ventilation duct located at frame 40 port side allowed flaming debris to fall on to the vehicles below. Sixteen of the personally owned vehicles sustained fire damage significant enough to warrant further examination. On May 15, 2017, fire investigators recovered and performed an initial visual examination of the vehicles along with a damaged section of the vessel’s wiring. Evidence of interest removed from several vehicles, along with the damaged wiring, was taken to a third-party laboratory for examination. A joint forensic examination of the evidence was conducted in September 2017. Investigators found that there were three vehicles that were subject to open recalls for fires; however, following an analysis of the debris, none of the recall items were determined to be the cause of the fire. Rather, investigators identified the likely cause of the fire was a fault in the starter motor solenoid in one of the personally owned vehicles in shipment. Preliminary testing of this scenario confirmed that a fault within the solenoid could cause ignition of the insulation and covering on the adjacent wiring. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire on board the vehicle carrier Honor was a fault in the starter motor solenoid in one of the personally owned vehicles being transported in the vessel’s cargo space.

Fire on board Vehicle Carrier Honor

NTSB/MAB-18/07 7 Vessel Particulars Vessel Honor Owner/operator Fidelio Limited Partnership/Tote Services, Inc. Port of registry Wilmington, Delaware Flag United States Type Roll-on roll-off vehicle carrier Year built 1996 Official number 1175822 IMO number 9126297 Classification Society American Bureau of Shipping (ABS) Construction Steel Length 623.5 ft (190.1 m) Draft 33.4 ft (10.2 m) Beam/width 105.8 ft (32.3 m) Gross and/or ITC tonnage 49,814 gross tons Engine power; manufacturer 17,500 hp (13,050 kW) Diesel United-Sulzer engine Persons on board 21 NTSB investigators worked closely with our counterparts from Coast Guard Activities Europe throughout this investigation. For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA17RM007. Issued: March 6, 2017

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under 49 United States Code 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 United States Code, Section 1154(b).

FD07496 ｜ 2018_美国_MAB1808.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/08 National Transportation Safety Board Marine Accident Brief Fire aboard Vehicle Carrier Alliance St. Louis Accident no. DCA17FM005 Vessel name Alliance St. Louis Accident type Fire Location Gulf of Mexico, about 190 miles south of New Orleans, Louisiana 26° 35’ N, 089° 23.9’ W Date January 16, 2017 Time About 0252 central standard time (coordinated universal time – 6 hours) Injuries None reported Property damage

$3,750,000 est.

Environmental damage None reported Weather Partly cloudy, visibility 8 miles; winds southeast at 4 knots, air temperature 65°F; calm seas Waterway information Open waters of the Gulf of Mexico along the outer continental shelf, water depth about 7,000 ft. On January 16, 2017, at 0252, the vehicle carrier Alliance St. Louis was under way from Port Arthur, Texas, to Jacksonville, Florida, when a pipe plug on the fuel pump for the main engine’s no. 6 cylinder came loose, resulting in fuel spray onto the engine’s hot exhaust gas pipe manifold. The atomized fuel quickly ignited. The fire was contained to the main engine room and extinguished by the CO2 fixed fire-suppression system. No injuries were reported; property damage exceeded $3,750,000.

Alliance St. Louis pierside in Port Arthur, Texas, undergoing repair after the fire.

• Unless otherwise noted, all miles in this report are nautical miles (1.15 statute miles).

Fire aboard Vehicle Carrier Alliance St. Louis

2 NTSB/MAB-18/08 Background The Alliance St. Louis, a US-flag roll-on/roll-off vehicle carrier, was built in 2005 by Daewoo Shipbuilding & Marine Engineering Co. Ltd in Geoje, South Korea. Originally named the Haul Paris, flagged in Norway and classified by Det Norske Veritas, the vessel was purchased by Farrell Lines, a subsidiary of Maersk Line, and reflagged in the United States in February 2008. At the time of the accident, the Alliance St. Louis provided services to the US government and commercial customers; the vessel also participated in the Maritime Security Program and the Voluntary Intermodal Sealift Agreement. Accident Events On January 15, 2017, the day before the accident, the partially loaded Alliance St. Louis departed Port Arthur at 0442, bound for Jacksonville. About 1500, the second assistant engineer on duty set the engine room to unmanned mode, as was typically done at the end of each work day. The second assistant engineer conducted a routine round of the engine room at 2200 and again at 2300 before going to bed. This was the last time the crew entered the engine room that night. The second assistant engineer told investigators that he did not see or hear anything unusual in the main engine, and no alarms were recorded that evening in the alarm history log in the control room.

Accident location of Alliance St. Louis, marked by a red triangle, about 190 miles south of New Orleans. (Background by Google Earth) Early in the morning on January 16, the Alliance St. Louis was making 15.7 knots on a course of 114 degrees. At 0252, the main engine’s low fuel oil inlet pressure alarm sounded; shortly thereafter, the engine room all call/general alarm activated on the bridge and in the engineering officers’ staterooms. Shortly thereafter, the vessel’s fire-detection system activated, alerting the New Orleans Baton Rouge Louisiana Gulf of Mexico Florida N

~ 100 nm

Fire aboard Vehicle Carrier Alliance St. Louis

3 NTSB/MAB-18/08 bridge crew to a fire in the incinerator space and main engine room. Seconds later, the ship lost main electrical services, including power to the main propulsion and steering systems. The emergency diesel generator automatically started and came online as designed, providing power to essential equipment and the steering system. Vessel traffic in the area was minimal; the closest vessel was about 20 miles away, and the closest oil gas platform was 31 miles away. The bridge crew activated the general alarm on the bridge and crewmembers reported to their emergency stations. The chief mate and the chief engineer went to investigate the spaces in question, while two fire teams prepared the firefighting gear. The chief mate reported thick black smoke exiting from the ventilation louvres located on the back side of the ship’s funnel and the incinerator room filling with smoke. In accordance with the emergency plan and station bill assignments, the crewmembers closed the engine room ventilation dampers and control stops to prevent the spread of smoke and reduce the supply of oxygen. They also shut the fuel and lube oil quick-closing valves to cut off potential fuel sources to the fire. The master notified the Coast Guard and the ship operating company. The chief engineer tried to activate the hyper-mist fixed fire-suppression system in the area of the fire (there was a nozzle located above the no. 3 generator), but the control panel on deck A did not have power. The chief engineer then made his way aft to the steering gear room (where the hyper-mist high-pressure pump and actuating valves were located) to try to start the system locally, but the system was also without power. The chief engineer and the first assistant engineer decided to enter the space to determine the location of the fire and try to restore power to the main bus to energize the hyper-mist system, which was the vessel’s first line of fire-extinguishing capability and protection for the engine room and machinery spaces. Fire team no. 1 donned firefighting suits and self-contained breathing apparatuses (SCBAs), and stood by with a charged fire hose. About 0311, the chief engineer and the first assistant engineer tried to enter the after part of the engine room through the door from the steering gear room. However, thick, black, bellowing smoke limited the visibility and prevented entry. The chief engineer and the first assistant engineer then decided to enter the engine room through deck no. 4’s portside entrance. They successfully entered the space and were able to make their way forward past the main engine to the engine control room. There, they checked the engine control room for fire, found several of the main bus breakers tripped, and left. On their way out, they saw that the overhead crane and main shipboard power electrical cables were on fire. The chief engineer and the first assistant engineer tried to extinguish the cable fire with a portable extinguisher, but they were unsuccessful. At 0325, the first assistant engineer’s SCBA was running low on air, so he and the chief engineer exited the engine room where they had entered. The chief engineer then re-entered the engine room by himself. This time he did what he called a “feel-over” of the main engine to see if it was hotter than usual. Satisfied that the main engine was not on fire, the chief engineer exited the engine room. The master, in discussion with the chief mate and the chief engineer, decided to extinguish the fire using the engine room’s CO2 fixed fire-suppression system. The chief mate fully accounted for the crew outside of the emergency gear locker and, at 0335, the master authorized releasing CO2 into the engine room for 2 minutes. The master and the chief engineer monitored the engine room’s ambient air temperatures on a computer in the ship’s office and saw the temperatures decrease initially, then rise again.

Fire aboard Vehicle Carrier Alliance St. Louis

4 NTSB/MAB-18/08 At 0424 and again at 0444, the crew released CO2 into the engine room, each time accounting for all persons ahead of time. After the third release, the engine room temperatures decreased and then stabilized. The crew continued to monitor the fire boundaries, taking bulkhead and deck temperatures with a non-contact infrared gun-style thermometer, and had hoses prepared if needed. About 8,000 pounds of the 40,000-pound-capacity CO2 fixed fire-suppression system was released into the main engine room. The machinery space dampers, vents, and hatches remained closed for more than 26 hours. During this time, the emergency generator provided limited power to the vessel; no potable water, sewage, or HVAC was available. About 1030 the following day, January 17, a salvage master and fire team with Ardent Marine arrived via the salvage tugboat Crosby Endeavor. At 1300, the fire team’s chief, lead firefighter, and the Alliance St. Louis chief engineer entered the engine room with SCBAs and a thermal-imaging camera. The fire team determined there were no hot areas or concerns of a re-flash, and they reported the fire to be extinguished. The engineering crew discovered that the fire damaged the main shipboard power cables (between the electrical generators and the main switchboard) that ran overhead along the port side of the engine room, resulting in the vessel losing the capability of all three diesel generators to provide power to the main bus. About noon on January 18, the chief engineer, in collaboration with his engineering staff, was able to restore electrical power to vital house services, including the potable-water and sewage-treatment plant, by using temporary cables. Under the salvage master’s supervision, the Crosby Endeavor towed the Alliance St. Louis back to Port Arthur, where the vessel underwent repairs. No pollution or injuries were reported. The Alliance St. Louis master conducted drug tests on the entire crew within the required 32-hour time frame; all results were negative. Regarding the 2-hour-window testing requirement for alcohol, the master told investigators that the crew was still engaged in firefighting activities 2 hours after the fire started; however, alcohol breath testing on most of the crew was conducted within 8 hours. All results were negative. Investigators―together with manufacturer technicians, crewmembers, and operating company representatives―conducted a postaccident inspection of the machinery spaces, fire control station, CO2 room, and cargo bays aboard the Alliance St. Louis. The areas appeared to be well-maintained and in good order, and systems operated as designed. Investigators also reviewed available documentation, certificates, and records pertaining to the main engine, CO2 system, and other involved systems. In addition, investigators examined the DOOSAN–MAN B&W 2-stroke, slow-speed diesel engine, type 7S60MC. The main focus was on the no. 6 cylinder’s head/injector area, which was suspected as the fuel source for the fire. Examination of this area revealed that an aft pipe plug from the cylinder’s fuel pump top cover was missing. The photograph below shows the concentrated thermal damage (highlighted by the red dotted line) near the no. 6 cylinder. Thermal damage extended forward to cylinder no. 5 and aft to cylinder no. 7. Most of the fire damage was located on the engine room’s 1st platform level and along the overhead and included charred paint, melted gauge faces, and melted aluminum components. On the engine room floor level, a stain from a liquid spill was found. This general

Fire aboard Vehicle Carrier Alliance St. Louis

5 NTSB/MAB-18/08 area was also heavily covered in soot and coated with an oily residue (see NTSB’s fire factual report for a detailed description of the fire damage).1

View of the entire cylinder head bank, showing concentrated thermal damage and staining centered around the no. 6 cylinder.

Thermal damage, including charred paint, melted gauge faces, and melted aluminum components. The main engine had seven in-line cylinders that used both heavy fuel oil and ultra-low-sulfur fuel oil, also called marine gas oil (MGO). Use of ultra-low-sulfur fuel oil is required in the North American Emission Control Area. The Alliance St. Louis was operating on

1 NTSB Office of Research and Engineering, Fire Investigation Factual Report No. 17-057, July 12, 2017.

Fire aboard Vehicle Carrier Alliance St. Louis

6 NTSB/MAB-18/08 MGO for more than 22 hours when the first fire-detection alarm sounded on the bridge. The auto-ignition temperature for MGO is 495 degrees F (257 degrees C). When MGO contacts a heated surface that is significantly above 495 degrees F, ignition can be instantaneous. The engine was arranged and designed so that both the heavy fuel oil and the MGO could be used with the one fuel pump per cylinder. Each fuel pump consisted of a cast-iron pump housing with a top cover. Fuel to all cylinder fuel pumps was supplied from a lower-pressure fuel oil-circulating pump to a flanged connection on the front of each fuel pump housing. Inside the pump housing was a pump barrel that delivered fuel at high pressure to the fuel valve at 300–380 bars (4,350–5,510 psi). The fuel pump top cover and centrally placed barrel and plunger assembly were attached to the top of the pump housings by eight threaded studs and fixing nuts. A puncture valve was located inside the top cover. The pump was activated by the engine’s fuel cam. The puncture valve was a device that, when activated, stopped fuel injection and returns excess fuel through passages back to the pump housing. There were four passages running vertically through the top covers and into the pump housing. Two of the passages were for inserting a special tool to the top of the barrel for measuring fuel pump timing and were ruled out as a factor in this accident. The other two passages returned fuel oil back to the fuel pump housing when the puncture valve was activated. Pressures inside these two passages were 7–8 bars (101–116 psi) during pump operation. The passages were designed to be closed by 10-mm pipe plugs. During the postaccident examination, the chief engineer discovered the fuel pump’s displaced aft pipe plug in the engine’s catch-all area (an area around the base of the no. 6 cylinder). Investigators compared the aft pipe plug to an unused pipe plug and found them to be identical. None of the threads on the aft pipe plug were found to be damaged, nor was the plug itself deformed. A review of maintenance records indicated that the crew last removed cylinder no. 6’s top cover from its pump housing on June 23, 2016, for technicians ashore to overhaul valves. The individual who performed the task was not on board; however, several engineering crewmembers described to investigators how they normally inspected and cleaned the top covers in connection with the valve overhauls. Several engineering crewmembers stated that, as part of the overhaul performed in June and as a standard practice on board, they removed the two pipe plugs to clean and inspect the oil passages. When reinstalling the pipe plugs the crew would usually apply a threadlock adhesive around the threads and tighten the pipe plugs by “feel” into the top cover with a metric hex key. The first assistant engineer stated that the crew followed the manufacturer’s procedures for the top cover overhaul and showed investigators copies of the procedures in the workshop.2 The procedures did not specifically mention the pipe plugs or depict the fuel oil passages in a diagram of the top cover. However, the instruction manual did list, in the general tool section,

2 Instruction Book for DOOSAN–MAN B&W 2-stroke, slow-speed diesel engine, type 7S60MC, section 900-1, Checking and Maintenance Schedules, and section 909-3.3, Overhaul of Top Cover Complete.

Fire aboard Vehicle Carrier Alliance St. Louis

7 NTSB/MAB-18/08 standards for tightening torques. Per the manual, the aft pipe plug on the no. 6 cylinder fuel pump top cover should have been torqued to 50–60 newton meters.3 Analysis The pipe plug was likely not sufficiently torqued into the top cover during the last inspection because the crew did not recognize this as a crucial step in maintaining the reliability of the fuel oil system. The instruction book’s section Overhaul of Top Cover Complete contributed to the crew’s lack of awareness about this hazardous situation because it did not depict the fuel oil return passages or describe the purpose of the pipe plugs. The engineers on board the Alliance St. Louis had never previously experienced a situation where a pipe plug vibrated out of a pump’s top cover. The aft pipe plug on the no. 6 cylinder fuel pump top cover likely loosened over time due to normal main engine vibration, fuel oil pressure acting on the plug, and switching of fuels. The missing pipe plug would have provided a path for MGO to spray out of the top cover at an approximate pressure of 7–8 bars (101–116 psi). Several engineering crewmembers stated in their interviews that they had experienced an increased number of fuel oil system leaks and seepages from gaskets, flanges, seals, o-rings, and other fittings due to thermal expansion or contraction of the components and material when changing from heated heavy fuel oil to ambient and sometimes cooled MGO.

Fuel pump housing and top cover for the no. 6 cylinder, with missing pipe plug. The lower-right image shows the dislodged pipe plug (left) next to a new unused plug.

3 Instruction Book for DOOSAN–MAN B&W 2-stroke, slow-speed diesel engine, type 7S60MC, section 913-4, Standard Tightening Torques.

Fire aboard Vehicle Carrier Alliance St. Louis

8 NTSB/MAB-18/08 Spray shields are used to prevent fuel sprays and leaks from contacting hot surfaces and other sources of ignition. The last step of the top cover overhaul procedures stated, “mount the protective cap (spray shield) over the puncture valve, three drain oil pipes, return oil pipe, air pipe and safety system on the top cover.” There were openings for screwing spray shields to the top covers. However, none of the ship’s spray shields were screwed to their top cover. The spray shield on the no. 6 cylinder’s top cover was found hanging off the air pipe next to the pump housing during the postaccident inspection. It was likely knocked off the top cover by the pipe plug and spraying MGO because it was not properly secured with two screws. A properly secured spray shield (per the manufacturer’s instruction manual) would have kept the MGO from spraying directly into the air and contacting the no. 6 cylinder exhaust gas pipe/receiver. Instead, the MGO would have sprayed into the shield and run down the fuel pump housing to the decks below where there were fewer, if any, potential sources of ignition.

Inboard view of the no. 6 cylinder fuel pump and top cover postaccident, with the spray shield slightly elevated to illustrate alignment of fastener holes. From the cylinder head exhaust valves, combustion gas is led through pipes to the manifold where varying pressures and temperatures are equalized before going to the turbocharger. An exhaust gas pipe from each cylinder connects to the exhaust gas manifold, which is wrapped with insulation and covered by galvanized steel plating. Investigators found gaps in the lagging (insulation) and steel plating at every cylinder’s exhaust gas pipe/manifold interface. At the no. 6 exhaust gas manifold, the gap was approximately half an inch around most of the exhaust pipe where it joined to the manifold. As part of their daily rounds, the engineering crew recorded exhaust gas temperatures at noon. On January 15, 2017, the exhaust gas temperature at the no. 6 cylinder was recorded as 579 degrees F, approximately 85 degrees F above the auto-ignition temperature for MGO. The range of low to high exhaust gas temperatures at the seven exhaust gas pipes was 559 to 619 degrees F. The main engine was performing as expected for the 85-percent load at

Fire aboard Vehicle Carrier Alliance St. Louis

9 NTSB/MAB-18/08 which it was running on January 15, 2017; there was nothing unusual about the exhaust temperatures recorded. The distance from the exhaust gas pipe/manifold interface to the overhead was about 6 feet. It is likely that a sudden and intense fire ensued when MGO contacted this unprotected surface. Based on fire damage, flames and intense heat burned the overhead above the no. 6 cylinder. From there, flames, smoke, and hot gas spread horizontally in all directions toward the bulkheads. The crew’s timely and effective use of the CO2 fixed fire-suppression system likely prevented the spread of the fire and minimized the extent of damage to the engine space. Probable Cause The National Transportation Safety Board determines that the probable cause of the engine room fire aboard the Alliance St. Louis was improper tightening of a pipe plug on the top cover of the no. 6 cylinder fuel pump housing, which resulted in a high-pressure release of marine gas oil. Contributing to the fire was the improper attachment of a fuel spray shield to the top cover, which allowed fuel to spray directly onto the cylinder’s hot exhaust pipe and ignite.

Fire aboard Vehicle Carrier Alliance St. Louis

10 NTSB/MAB-18/08 Vessel Particulars Vessel Alliance St. Louis Owner/operator Wilmington Trust Company/Farrell Lines, a subsidiary of Maersk Line, Ltd Port of registry Norfolk Flag United States Type Roll-on/roll-off vehicle carrier Year built 2005 Official/IMO number 9285500 Classification society Lloyd’s Register of Shipping Construction Steel Length 635.8 ft (193.8 m) Draft 29.8 ft (9.1 m) Beam/width 105.6 ft (32.2 m) Gross tonnage 57,280 Engine power; manufacturer 19,460 BHP (14,511 kW) Doosan-MAN B&W 7S60MC marine diesel engine Persons on board 20 crew NTSB investigators worked closely with our counterparts from Coast Guard Marine Safety Unit Port Arthur Investigations Division throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA17FM005. Issued: March 29, 2018

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 United States Code, Section 1131(b)(1). This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, Section 1154(b).

FD07497 ｜ 2018_美国_MAB1816.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/16 National Transportation Safety Board Marine Accident Brief Fire aboard Sailing Vessel Best Revenge 5 Accident no. DCA17FM021 Vessel name Best Revenge 5 Accident type Fire Location Falmouth Inner Harbor; Falmouth, Massachusetts 41°32.80’ N, 70°36.19’ W Date July 11, 2017 Time 0130 eastern daylight time (coordinated universal time – 4 hours) Injuries One crewmember suffered second and third-degree burns Property damage $1,508,000 est. Environmental damage Oil sheen observed but contained by floating boom Weather Overcast, visibility 10 miles, winds southwest at 5 knots, air temperature 68°F, water temperature about 72°F Waterway information The Falmouth Inner Harbor is a sheltered basin approximately 0.7 miles long and less than 0.1 miles wide, dredged to about 6 feet deep. Several marinas and small-craft anchorages line the harbor. At about 0130 on July 11, 2017, the uninspected sailing vessel Best Revenge 5 caught fire while docked at a marina pier in Falmouth Inner Harbor in Falmouth, Massachusetts. The vessel’s two crewmembers escaped the burning vessel and attempted to fight the fire but could not contain it, and local firefighters later extinguished it. One crewmember sustained second- and third-degree burns to the arms, hands, and feet. An oil sheen was observed in the immediate vicinity of the vessel after the fire but was contained by a floating boom. Damage to the Best Revenge 5 (which was declared a constructive total loss), to a vessel docked next to it, and to the pier totaled an estimated $1,508,000.

Best Revenge 5 prior to the accident. (Photo courtesy of Sailing Directions®) *Unless otherwise noted, in this report all miles are nautical miles (1.15 statute miles).

Fire aboard Sailing Vessel Best Revenge 5

2 NTSB/MAB-18/16

The location in Falmouth Inner Harbor, Massachusetts, where the Best Revenge 5 caught fire while docked at the pier. (Background maps from NOAA ENC® Viewer) The Best Revenge 5 was a 58-foot-long catamaran sailboat built in 2003 by Alliaura Marine in France to an Alliaura Privilege 585 design. It had a single mast and, when not under sail, was propelled by two diesel engines. Electrical power was supplied by two diesel-fueled generators located in the aft section of the port and starboard hulls. A small rigid-hull inflatable boat powered by a gasoline outboard engine was carried on the vessel’s stern. The accommodation spaces included a crew double-berth stateroom and four double-berth staterooms for up to eight guests; a seating and eating area called the “salon,” and the galley for cooking. These areas were accessed through a sliding glass door aft of the salon. Also aft of the salon were the vessel’s wheel and engine controls in the open cockpit. A permanent crew of two—a captain and a first mate/chef— lived aboard the vessel and each had over a decade of experience on the boat. Flagged under the British Virgin Islands, the Best Revenge 5 operated as both an uninspected passenger vessel and a recreational (uninspected) sailing vessel. Normally, in the winter it operated in Caribbean waters, carrying up to eight passengers on chartered sailing voyages from the British Virgin Islands; in the summer it would sail privately out of New England waters. However, in June 2017, the catamaran operated out of Bermuda, hosting spectators for the America’s Cup sailing races. While there, the vessel was struck by lightning, which damaged several navigational components. No other damage was found when the captain examined the vessel, including an inspection of the grounding plates below the hull. The damaged navigation equipment was replaced by a technician soon afterward and the captain did not note any issues following the repairs.

Fire aboard Sailing Vessel Best Revenge 5

3 NTSB/MAB-18/16

An annotated schematic of the Best Revenge 5 identifies various accommodation spaces and where the fire likely originated in the lavatory on the port side. (Image courtesy of Sailing Directions®) At the completion of the America’s Cup races, the Best Revenge 5 sailed to New England to commence its summer cruising routine. On the night of the accident, the vessel was docked at MacDougalls’ Cape Cod Marine Services, Inc. in Falmouth, Massachusetts, where it had been docking for several years. The pier system at the marina had a T-shaped platform with perpendicular docks alongside the center dock. The Best Revenge 5 was tied alone, portside-to the channel side of the 30-meter-long end dock, which was about 115 meters from shore. A small-stepped gangway was rigged near the stern for embarking and debarking the vessel. Only the two crewmembers were on board. The captain stated that residential-type, battery-powered smoke detectors were fitted in all staterooms. The vessel was connected to external electrical power through a pair of cables fed from shore power pedestals on the pier to the aft port side.1 One cord was connected to an outlet on a pedestal located adjacent to the boat’s guest lavatory, while the other ran to a pedestal further down the pier. Near the pedestals were freshwater supply stations equipped with garden-style type hoses. Accident Events At about 0130 on July 11, the crew was asleep in the stateroom when the captain awoke to the smell of smoke. The captain went to investigate, climbing through a hatch above the head in the stateroom and out onto the forward weather deck. Looking aft through windows into the salon, he saw that the space was full of smoke and that there was “a red glow towards the lower part of the port side of the salon.” He returned to the stateroom and woke up the first mate, instructing her to evacuate the vessel and to warn the person living aboard a boat docked nearby about the fire. After re-exiting through the hatch, the captain was neither able to reach the gangway aft due to the fire nor able to jump down onto the pier due to the distance, so he dove into the water from the bow and swam to the pier.

1 Marinas have shore power pedestals located on piers to allow docked vessels to utilize shoreside electrically generated power while moored. The pedestals include an alternating current (AC) receptacle to which the vessel connects through an electrical cable for a secure waterproof connection.

Fire aboard Sailing Vessel Best Revenge 5

4 NTSB/MAB-18/16

Best Revenge 5 docked at the pier end at MacDougalls’ marina. On the opposite sides of the dock were the sailboat Something About Mary, the yacht Trickster, and the vessel where the owner was alerted by the first mate. (Background from Google Earth) Awakened by the captain, the first mate exited the stateroom aft to the salon and found it completely engulfed in smoke, which was obscuring her visibility. The first mate stated that she could smell melting fiberglass but did not see flames. She continued aft with her hands extended in front of her until she reached the aft sliding glass door. After opening the door, she continued to the gangway and then down onto the pier. The first mate ran to the nearby vessel to wake up the owner and tell him to call the fire department. She then proceeded back toward the Best Revenge 5. The first mate told investigators that, as she approached the catamaran, she could see that the exterior of the boat was burning near the electrical power pedestal on the pier. The pedestal itself, she said, was also “smoldering, burning, and charred.” At that point she grabbed a garden hose from further down the dock and began spraying fresh water on the fire; however, the flames continued to spread towards the stern. About this time, a portlight that was above the area of the flames fell inward into the fire and the hole in the port side of the Best Revenge 5 began to widen. While the first mate was attempting to fight the fire, the captain had been assisting the owner of the nearby boat in moving his vessel away from the area. Once the boat was moved, the captain joined the first mate near the Best Revenge 5 in fighting the fire using the garden hose. He stated that the fire was around the aft guest lavatory located on the lower interior level of the port hull. At some point during the next several minutes, they heard a “whoosh” and then witnessed flames “[shooting] forcefully out” from the salon into the cockpit (through the sliding glass door) and from the hole in the side of the vessel.

Fire aboard Sailing Vessel Best Revenge 5

5 NTSB/MAB-18/16 Best Revenge 5 on fire at the dock. (Photo courtesy of Satellite News Service; screen shot from video courtesy of Gayle Kiley via Cape Cod Times) The captain determined that the risk to remain on the pier was too great; therefore, both crewmembers retreated toward the shore, where police, firefighters, and emergency medical technicians (EMTs) were beginning to arrive. The crewmembers were examined by EMTs and taken to a local hospital. The first mate was later helicoptered to a hospital in Boston for treatment of second- and third-degree burns on her arms and hands along with second-degree burns on her feet. The incident report from the Falmouth Fire Rescue Department noted that the fire was reported by phone at 0143 and firefighters arrived by 0148 to find the catamaran “fully involved” with the “vessel sail and mast also…burning.” The report stated that two additional vessels were docked parallel to the burning boat about 3–5 feet away and were “without direct flame impingement but exposed to radiant heat.” While firefighters prepared to attack the fire, the vessel’s mast collapsed onto its starboard side. Firefighting efforts eventually included assistance from other fire departments nearby and four hose lines drawing water from the harbor. Diesel fuel from the 350 gallons on board was observed leaking from the vessel’s port side around 0430. To contain the oil spill, absorbent pads and a containment boom were placed around the sheen area. The fire was reported extinguished at 0647. The Best Revenge 5 was declared a constructive total loss, the dock was damaged in the area of the fire, and exterior equipment on the two adjacent docked vessels sustained some melting and warping damage, according to the fire department report. The following day, on July 12, the Best Revenge 5 was dewatered, lifted onto a barge, and towed to the Port of New Bedford, Massachusetts. The total damage was estimated at $1,385,000 for the Best Revenge 5; $48,000 for the adjacent vessel Something About Mary; and $75,000 for the dock.

Fire aboard Sailing Vessel Best Revenge 5

6 NTSB/MAB-18/16 Analysis The captain of the Best Revenge 5 told investigators that he was initially awakened by the smell of smoke in the crew stateroom, not from an installed smoke alarm. He also stated that he saw the glow of a fire by the stairs below the salon in the port hull, in an area known as the companionway. From his viewing position forward on the vessel’s centerline, his line-of-site indicated that the glow could have been emanating from the guest aft lavatory. However, he did not view what was burning and could not provide the ignition source.

Best Revenge 5 partially submerged at dock postaccident. (Photo courtesy of Coast Guard) An examination of the vessel was first conducted on July 14, 2017, by fire investigators representing various interested parties. Because the vessel was partially submerged from firefighting efforts, the fire department could not complete a fire origin and cause investigation. A second multiparty examination of the vessel was conducted on August 9 and 10, 2017, by fire investigators, representatives of involved vessels and the marina, the Coast Guard, and the National Transportation Safety Board. At that time, a fire origin and cause examination was conducted with the Best Revenge 5 out of the water and on a barge in New Bedford. The investigation was led by S-E-A, a contractor, whose overall procedures and ongoing steps related to debris removal, examination, and testing (that is, an x-ray of the shore pedestal) was agreed upon by on-scene parties. The investigation attempted to determine several factors about the accident: the fire’s origin, the available combustible materials and fuel, the status of electrical components and breakers, potential ignition sources, and ultimately the cause of the fire. S-E-A’s examination report stated that “no manufacturing or design defects associated with the vessel” were found.2 The report included an

2 “Vessel Fire Examination Origin and Cause Analysis,” Best Revenge 5, S-E-A Matter No. 07.079002, October 3, 2017.

Fire aboard Sailing Vessel Best Revenge 5

7 NTSB/MAB-18/16 electrical evaluation with an x-ray image of the shore power pedestal remains, which showed arcing and shorting. The evaluation noted that, after the fire, marina personnel reported that the circuit breaker powering the dock pedestal from shore was in the “tripped” position (electrically disconnected as a protection measure) and that the two shore power circuit breakers on board the Best Revenge 5 (fed by cables from the pedestal) were undamaged and tripped to the “off” position as well. They concluded that the vessel “may have been [electrically] powered at the time of the fire.” The S-E-A report concluded that the fire’s origin, ignition sources, and available fuels were as follows: … the fire originated on the port side of the vessel; specifically, in the area between the port side lavatory, aft stateroom closet, and port side hull, in the area of the shore power pedestal. The only potential ignition sources identified within the area of origin were the shore power pedestal, electrical conductors/ components in the lavatory, aft-port stateroom closet, and area above the aft port lavatory/shower area. The only fuels identified were the fiberglass hull, insulation, and ordinary combustibles within the area of origin. The report noted that both equipment and conductors that may have been affected by the lightning strike (which occurred a month earlier in Bermuda) were “located in the general origin area of the fire.” The report concluded that— without more specific information regarding post-strike repairs—equipment or conductor failure “due to lightning damage cannot be eliminated as a possible cause of the fire.” Similarly, the shore power pedestal “cannot be eliminated as a cause of the fire” due to several missing components that were unable to be examined. Ultimately, a specific cause of the fire could not be identified “due to multiple ignition scenarios that cannot be eliminated.” Lavatory where fire likely originated next to portside companionway between guest staterooms while looking aft to stateroom.

Fire aboard Sailing Vessel Best Revenge 5

8 NTSB/MAB-18/16 If the shore power pedestal was the source of the fire, it would have had to first have an electrical fault resulting in ignition of the pedestal’s wire insulation and plastic casing. The ensuing pedestal fire would have had to reach a sufficient intensity to ignite the vessel’s paint, fiberglass, and resin on the portside hull through direct flame impingement or radiant heat. Burn marks on the dock around the power pedestal, however, did not indicate that the pedestal was fully engulfed in fire on all sides. Additionally, the damaged remnants of the power pedestal indicated an uneven burn with the areas farthest away from the boat less affected by the fire. Therefore, considering the size of the fire that would have been required to ignite the adjacent vessel, the burn pattern around the pedestal, and the asymmetric pedestal remains, along with witness statements, it is less likely that the fire damage to the dock and pedestal was the result of a fire originating within the pedestal but rather more likely from the radiant heat from a fire located on the vessel. Probable Cause The National Transportation Safety Board determines that the probable cause of the fire aboard the uninspected sailing vessel Best Revenge 5 and on its pier was an electrical fault in an accommodation space on the vessel.

At top, the hole resulting from the fire on the port side at the aft guest lavatory. At bottom, the shore power pedestal, cable, and portions of the dock planking where the pedestal caught fire, which was re-created for examination.

Fire aboard Sailing Vessel Best Revenge 5

9 NTSB/MAB-18/16 Vessel Particulars Vessel Best Revenge 5 Owners BestRev LTD Managing Owner N/A Port of registry Road Harbor, BVI Flag Virgin Islands, British Type Sailing vessel (uninspected) Year built 2003 Official number (Foreign) / Primary VIN 736695 / 736695 IMO number NA Construction Fiberglass-reinforced plastic Length (overall) 58 ft (17.7 m) Draft (design) 6 ft (1.8 m) Beam (maximum) 30 ft (9.1 m) Gross tonnage (GRT / ITC) NA / NA Engine power; manufacturer 2 x 152 hp (113 kW) Yanmar diesel engines Persons on board 2 NTSB investigators worked closely with our counterparts from Coast Guard Sector Southeastern New England throughout this investigation. For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA17FM021. Issued: June 28, 2018 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 United States Code, Section 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, Section 1154(b).

FD07498 ｜ 2018_美国_MAB1817.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/17

National Transportation Safety Board Marine Accident Brief Allision of James H Hunter Tow with Dock and Fire Boat About 2250 on June 6, 2017, the towing vessel James H Hunter was pushing three gravel and sand barges upstream in the Cumberland River through the city of Nashville, Tennessee, when two barges broke from the tow; hit the bank; and then allided with a floating dock underneath a pedestrian bridge, a fire boat moored at the dock, and a bridge pier.1 The fire boat broke free of its moorings as the barges pushed the dock downriver. There were no injuries or reports of pollution. The fire boat sustained damage in the form of dents and scrapes to its hull, and the dock sustained damage estimated to be about $300,000. Damage to the barges was reported to be superficial.

James H Hunter after the accident in the Cumberland River.

1 In this report, all miles are statute miles. Accident no. DCA17FM015 Vessel names James H Hunter (and barges PBM 403, PB 2013, and PBM 141) and Nashville Fire Boat No. 9 Accident type Allision Location Cumberland River, mile marker 191.1; Nashville, Tennessee; 36° 9.7’ N, 86° 46.3’ W Date June 6, 2017 Time 2250 central daylight time (coordinated universal time – 5 hours) Injuries None Property damage $300,000 est. Environmental damage None Weather Partly cloudy, visibility 10 miles, wind 8 mph from the north-northeast, air temperature 65°F Waterway information Cumberland River, downtown Nashville. Minimum channel depths are maintained by the US Army Corps of Engineers. The river had a projected navigational depth of 9 feet at a normal pool reading of 16.8 feet. At the time of the accident, the river gage was 26 feet, corresponding to a navigational depth of about 18.2 feet.

Allision of James H Hunter Tow with Dock and Fire Boat 2 NTSB/MAB-18/17 The James H Hunter —a 3,600-horsepower, twin-kort nozzle towboat—was built in 2007 at Quality Shipyards, LLC, in Houma, Louisiana. It was operated by Hunter Marine Transport, which was purchased by Hines Furlong Line in January 2018. Accident Events About 1740 on June 6, 2017, the James H Hunter, with nine crewmembers on board, departed the Hunter Marine fleeting facility at mile marker (mm) 176 in the Cumberland River with six barges for delivery at various facilities upriver, including the Cherokee Marine Terminal and the Pine Bluff Materials (PBM) fleeting facility. The Cumberland River was at a high-water stage with the water level at the Nashville Cumberland River (NAST1) gage, located at mm 191.1, at about 26 feet; the captain of the James H Hunter estimated the current to be about 5 mph.

Chart no. 26 with red triangle indicating the accident location. (US Army Corps of Engineers) After the vessel dropped off three barges at the Cherokee Marine Terminal at mm 189.5, the remaining three barges, carrying cargo of gravel and sand, were arranged in a single string with the James H Hunter faced up (connected) to barge PBM 403, barge PB 2013 in the middle, and barge PBM 141 at the head of the tow. The James H Hunter and PBM 403 were connected by face wires from two boat winches, one each on the boat’s port and starboard side forward. PBM 403 was connected to PB 2013 by a steel fore-and-aft wire arrangement (the steering coupling) on both

Allision of James H Hunter Tow with Dock and Fire Boat 3 NTSB/MAB-18/17 the port side and starboard side.2 PB 2013 and PBM 141 were connected by a similar wire arrangement. The barges were 195 feet long, and the overall length of the towboat and barges was about 714 feet with a maximum beam of 35 feet. The deepest draft of the loaded barges was about 12 feet. The barges were evenly loaded, with their decks at similar heights above the water. The James H Hunter departed the Cherokee Marine Terminal about 2200 to continue upstream to drop the three barges at the PBM fleeting facility at mm 192.8, some 3 miles away. After about a 15-minute wait for the CSX Railroad drawbridge to open at mm 190.4, the captain, who was operating the vessel at the time, continued through the city of Nashville. Meanwhile, the towing vessel Charlie Everhart, located at mm 191, was faced up to the Spirit barge, which was secured along the left descending bank. Due to the high-water conditions, the Charlie Everhart was tending the barge, which was to be used as a riverfront stage for the Country Music Association festival from June 8 to 11. About 2242, the pilot of the James H Hunter arrived in the wheelhouse to relieve the captain for his scheduled watch.3 The captain and the pilot worked a watch rotation of 6 hours on/6 hours off (the captain worked 0500 to 1100 and 1700 to 2300; the pilot worked 1100 to 1700 and 2300 to 0500). The captain recalled being relieved from watch about the same time as they passed the Charlie Everhart and the Spirit barge, about 2247. He noted the head of the tow might have been going under the John Seigenthaler Pedestrian Bridge at the time.4 After being relieved, the captain remained in the wheelhouse with the pilot. The pilot took the conn of the James H Hunter and reduced the speed to pass the Charlie Everhart and the Spirit barge. Upstream from the bridge and ahead of the tow, there was a bend in the river (about 30 degrees) around mm 191.2 to the left (port). About 2249, the head of the tow started to fall off (to starboard) as it neared the bend. The pilot counteracted by putting the steering rudders to port. Seconds later, the pilot and the captain noticed that the port steering coupling between PBM 403 (the face-up barge) and PB 2013 (the middle barge) parted. The captain immediately notified the deck crew by radio that the barges were coming loose and put the vessel in astern propulsion; it was stopped about 2251. The pilot notified nearby vessels of the breakaway barges by VHF radio.

Simplified diagram of the single-string tow arrangement of the James H Hunter (green rectangle) and the three barges (purple rectangles). An X marks the approximate location of each coupling. The red circle shows the location of the port steering coupling that parted. A witness who was standing on the pedestrian bridge provided mobile phone video to investigators showing the barges after the port steering coupling parted. PBM 403 was under the bridge, still connected to the James H Hunter, which was on the downriver side of the bridge. PBM 403 and PB 2013 were connected only by the starboard steering coupling as the barges

2 The steering coupling connects the first two barges ahead of the towboat and takes the most stress when the boat is steered. 3 Pilot is a term used aboard towing vessels on inland waterways for a person, other than the captain, who navigates the vessel. 4 The John Seigenthaler Pedestrian Bridge was formerly known as the Shelby Street Pedestrian Bridge and the Sparkman Street Bridge and was renamed in April 2014 by the city of Nashville (ordinance no. BL2014-695).

Allision of James H Hunter Tow with Dock and Fire Boat 4 NTSB/MAB-18/17 headed toward the left descending bank and a floating dock on that side of the bank. PB 2013 and PBM 141 (the head barge) contacted the bank and the starboard coupling between them broke, leaving them connected only by the port coupling. PB 2013 and PBM 141 ended up perpendicular to the bank and began to top over on each other after contacting the bank. Then, about 2252, the two barges struck the dock and the port side of a fire boat moored there, knocking the dock and the fire boat loose before drifting and striking the upriver pier of the bridge on the left descending bank. The fire boat continued downriver, and the dock drifted about 84 feet downriver before coming to rest on the shoreline.

The three barges, fire boat, and pedestrian bridge pier about 2254. (Image taken from witness video) The James H Hunter and the three barges drifted downriver with the middle and head barge topped around toward the left descending bank pedestrian bridge pier. About that time, the Charlie Everhart crewmembers unfaced (disconnected) their vessel from the Spirit barge and went to the fire boat, where they secured it to their starboard side. The Charlie Everhart then went to the starboard side of the James H Hunter and put two crewmembers on PBM 403 to help the James H Hunter crew secure PB 2013 back to PBM 403. The towing vessel Charles B Holman, which was about 1 mile upriver working at the PBM fleeting facility, headed to the accident location after hearing the radio call. About 2259, the Charles B Holman crew secured PBM 141, released the coupling connecting it to PB 2013, and took PBM 141 upriver to the PBM fleeting facility.

Allision of James H Hunter Tow with Dock and Fire Boat 5 NTSB/MAB-18/17

James H Hunter (faced up to PBM 403), Charlie Everhart, and Charles B Holman (faced up to PBM 141). (Image taken from witness video) After the two remaining barges were made up about 2310, the James H Hunter continued upriver to the PBM fleeting facility to drop off the barges. The Charlie Everhart took the fire boat across the river to a dock on the right descending bank to await fire department personnel, who then took possession of the fire boat. The James H Hunter captain and the pilot were tested for drugs and alcohol, and the results were negative. Two deckhands involved in responding to the accident were tested for drugs, and the results were negative. The pilot and the captain held valid master credentials for towing vessels upon western rivers. When the captain and the pilot were interviewed by investigators after the accident, the pilot stated that he started to lose the head of the tow and adjusted the rudders to counteract the set. The captain stated that “the pilot steered a little hard and broke one side” of the coupling and that overcorrecting while operating in high water moving at about 5 mph put too much stress on the coupling. Both the captain and the pilot stated that they had not operated tows above mm 187, which includes the accident location, in their current positions on the vessel. Analysis The captain and the pilot of the James H Hunter were both aware of the high-water conditions on the Cumberland River, which produced stronger-than-normal currents that they were proceeding against as the James H Hunter moved upriver. They were, however, not familiar with that area of the river (above mm 187). After the vessel dropped off three barges at the Cherokee Marine Terminal, the remaining three barges were arranged in a single string with single coupling arrangements securing them in place. The single coupling arrangement could have been due to the short distance between the Cherokee Marine Terminal and the PBM fleeting facility (about 3 miles).

Allision of James H Hunter Tow with Dock and Fire Boat 6 NTSB/MAB-18/17 As the James H Hunter approached the bend upriver from the pedestrian bridge, the pilot put the steering rudders to port just after the head of the tow started to fall off in an attempt to counteract the set. The pilot did not recall how much rudder was used, and there were no systems on board that recorded this operator input. The captain stated that overcorrecting (the rudders) with high water put too much stress on the coupling. Considering the length of the tow and the effect of the current against the side of the tow (underwater profile), a large rudder input could have put excessive load on the single steering coupling, exceeding its breaking load limits. As seen in this case, the single steering coupling on the port side (the side that had the force of the current acting on it) was the first point of failure. Investigators visually examined the wire rigging that was recovered. The appearance of fractured strands indicated the wires had fractured while in tension. There was no physical evidence of damage to any of the ratchets or deck fittings. Investigators requested certificates and maintenance records for the wires; however, investigators were informed that the wires did not belong to the operator and were portable, meaning that they were transferred among the various fleeting facilities along the river. At the time of the allision, the operator did not have any specific policies or procedures for high-water conditions. The current operator of the James H Hunter, Hines Furlong Line, informed investigators that it has developed navigation risk assessments and bridge transit procedures, including an assessment of barge wiring; crews are now expected to double up rigging at the couplings, even for short trips. Probable Cause The National Transportation Safety Board determines that the probable cause of the allision of the James H Hunter tow with the dock and fire boat was the practice of using single barge couplings in high-water conditions, which resulted in the parting of a steering coupling after rudder input to counteract the strong current.

Precautions to Consider During High-Water Conditions In high-water conditions, which often include strong currents, precautions should be taken to mitigate the risk of losing the tow. Examples of mitigating measures include doubling up on couplings and/or reducing the length of the tow.

Allision of James H Hunter Tow with Dock and Fire Boat 7 NTSB/MAB-18/17 Vessel Particulars Vessel James H Hunter Nashville Fire Boat #9 Owner/operator Hunter Marine Transport City of Nashville Fire Department Port of registry Nashville, Tennessee Nashville, Tennessee Flag United States United States Type Uninspected towing vessel Firefighting and response vessel Year built 2007 2004 Official number (US) 1199294 N/A IMO number N/A N/A Classification society N/A N/A Construction Welded steel Welded aluminum Length 124 ft (37.8 m) 43.1 ft (13.1 m) Draft 10.6 ft (3.2m) 3.0 ft (0.9 m) Beam/width 34 ft (10.4 m) 14.3 ft (4.4 m) Gross tonnage (GRT) 535 N/A Engine power/ manufacturer Twin 1,800-hp/Caterpillar 3516 (3,600 hp, 2685 kw) 2 X 580 hp Cummins QSM11/Hamilton twin jet 322 Persons on board 9 0 NTSB investigators worked closely with our counterparts from Coast Guard Marine Safety Detachment Nashville throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA17FM015. Issued: July 12, 2018 The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 United States Code, 1131. This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, 1154(b).

FD07499 ｜ 2018_美国_MAB1825.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/25 National Transportation Safety Board Marine Accident Brief Engine Room Fire aboard Towing Vessel George King Accident type Fire/explosion No. DCA18FM012 Vessel name George King Location Lower Mississippi River, at mile 393.6, near St. Joseph, Louisiana, 31° 53.95’ N, 091° 12.17’ W Date January 24, 2018 Time About 2041 central standard time (coordinated universal time – 6 hours) Injuries None reported Property damage

$500,000 est.

Environmental damage None reported Weather Clear, visibility of 10 miles*, winds light from the north, air temperature 59°F Waterway information The Lower Mississippi River near mile 393 is about 1 mile wide. The charted water depth in the channel is 24.9 feet. About 2041 local time on January 24, 2018, the towing vessel George King was pushing 30 empty barges upbound on the Lower Mississippi River at mile 393.6 when a fire began in the engine room and quickly spread. The crew abandoned the vessel after unsuccessfully trying to extinguish the fire. No pollution or injuries were reported. The estimated property damage exceeded $500,000.

George King under way prior to the fire.

• All miles in this report are statute miles.

Engine Room Fire aboard Towing Vessel George King

2 NTSB/MAB-18/25 Background The George King was a twin-propeller towing vessel powered by two General Motors 16-645E7B diesel engines, each capable of producing 6,140 horsepower. The vessel was built in 1976 by St. Louis Ship and originally named the Joe P. Gills. It was owned by Marquette Transportation and homeported in St. Louis, Missouri. The George King’s engine room was located aft of the galley and contained the two main propulsion engines, two generators, and all other associated equipment, including the vessel’s electrically driven fire pump. The space had two levels: an upper level, which was also the main deck of the George King, and a lower level, where the main engines and reduction gears for the shafts were located. Typical of inland river towing vessel designs, the George King had several windows located along the port and starboard bulkheads of the engine room upper level. In addition, double doors were located on the port and starboard side of the main deck for access into the engine room. While under way, the windows and doors were routinely left open for additional ventilation of the engine room. In accordance with applicable regulations, a halon fixed firefighting system was installed, in lieu of a large semi-portable fire extinguisher, to suppress and extinguish a fire in the engine room. Halon is a liquefied, compressed gas that stops the spread of fire by chemically disrupting the combustion process. Along with two external activation stations located on the port and starboard sides aft of the engine room double doors, the system could be activated directly from the rudder room where the halon bottles, a time delay, a pressure switch, and a stop valve were located. Eleven nozzles distributed the halon in the engine room, and a siren was installed to warn personnel in the space that the system had been activated. Accident Events On January 24, the George King was proceeding upbound on the Mississippi River pushing 30 empty dry cargo barges en route to Wickliffe, Kentucky. Nine crewmembers were on board, including a captain, pilot, first mate, mate, senior deckhand, chief engineer, cook, and two deckhands. That evening, the chief engineer was conducting rounds of the engine room, and the captain was at the helm in the pilothouse. Between 1800 and 1830, the chief engineer entered the engine room to conduct a round. He noted nothing abnormal. About 2000, he conducted another round of the engine room and again noted nothing abnormal. About 2030, the captain observed a flash that originated from behind him as he faced forward. When he turned around, he saw flames coming from the port exhaust stack. He sounded the general alarm and notified the crew by radio that a fire was in progress in the engine room. The captain started to maneuver the tow toward the left descending bank and made distress calls.1

1 The banks of western rivers are named left and right based on the direction as viewed from a vessel traveling downstream. To avoid confusion, commercial river traffic often calls the left bank the “left descending bank” and the right bank the “right descending bank.” (Source: US Coast Guard)

Engine Room Fire aboard Towing Vessel George King

3 NTSB/MAB-18/25

Accident location. (Background by Google Earth Pro) Upon hearing the general alarm, the chief engineer went to the muster station in the galley, where he met the other crewmembers. While the chief engineer was there, he opened the engine room door to assess the situation. From this position at the forward part of the engine room, he observed that the top of the port engine was completely engulfed in flames. He secured the door to prevent the fire from spreading into the galley. Two teams were assembled to fight the fire while the remainder of the crew, excluding the captain, abandoned the towing vessel by boarding the empty barges. One fire team consisted of the first mate and a deckhand, who went to the port side and deployed a fire hose. The second team consisted of the chief engineer and a senior deckhand, who went to the starboard side of the vessel to start the fire pump and deploy the starboard-side fire hose. Due to the intensity of the fire, the teams were unable to enter the space to spray water directly at the source. Consequently, the teams sprayed water through open windows, which they stated was ineffective against the fire. While fighting the fire, the chief engineer, who was standing outside the engine room, was knocked down by an explosion. He was not injured. The first mate notified the captain that the firefighting efforts were not effective and requested permission to shut off the fuel to the engines. In response, the captain directed the chief engineer to activate the emergency fuel oil shutoff valve located on the starboard side of the vessel, which he did. The engines and the generator stopped shortly thereafter.

Engine Room Fire aboard Towing Vessel George King

4 NTSB/MAB-18/25 The George King’s electrically driven fire pump stopped when the generator shut down, and thus the fire hoses lost water pressure. Therefore, the captain directed that the vessel’s halon fixed firefighting system be activated to extinguish the fire. The chief engineer tried to reach the port halon activation station located on the aft section of the house. This required him to walk past the engine room doors. However, the flames erupting from the broken engine room windows and open double doors prevented him from proceeding down the port side of the vessel. At the same time, the senior deckhand with another deckhand proceeded down the starboard side of the vessel, closing the engine room windows to ensure that the halon, when released, was contained within the engine room. After the deckhands closed all of the starboard-side windows, they met the chief engineer, who asked them if “they got it.” They answered “yes.” The chief engineer told investigators that his question was intended to confirm that the deckhands had activated the halon system from the starboard side, but the deckhands thought he was asking them if they had closed the windows. In the confusion, the halon system was never activated. After directing the halon system to be activated, the captain ordered the remainder of the vessel’s crew to abandon ship to the barges to wait for assistance. Because the intensity of the fire decreased after the George King was abandoned, the captain thought that the halon system had operated properly. The towing vessel Michael Reeves was the first assist vessel to arrive on scene and made fast (connected) to the George King’s tow to help control it in the river. The towing vessel St. Bartholomew arrived next. The crews of the St. Bartholomew and the George King attempted to extinguish the fire using the St. Bartholomew’s fire hoses, but all efforts were abandoned when smoke was seen exiting from the port fuel tank hatch. The fire burned itself out the next day. Halon activation station

Engine Room Fire aboard Towing Vessel George King

5 NTSB/MAB-18/25

George King still burning about 0749 on the day after the fire started. (Photo by US Coast Guard) The George King was extensively damaged by the fire, but the main structure of the vessel and the main propulsion system remained intact. The fire, as witnessed by the chief engineer and other crewmembers, was initially located on top of the forward section of the port main propulsion engine. During a postaccident examination of the port engine, investigators discovered that the entire lube oil strainer housing, located just forward of the engine and constructed of aluminum, was gone. In addition, internal parts of the strainer, not made of aluminum, were found on the deck plates forward of the engine, as well as in the bilge located below the location of the strainer. The lube oil strainer on the starboard main engine remained intact. After the fire, a commercial forensic science and engineering firm contracted by the vessel owner conducted an examination of the George King to ascertain the source of the fire. The examiners determined that, given the rapid growth of the fire and the captain’s observation of flames in the port stack, the initial fuel for the fire was “almost certainly a spraying liquid fuel.” Based on this determination, they examined the fuel and lube oil systems and concluded that the port main engine lube oil strainer was the likely area of origin for the fire. Analysis When the captain first saw flames, they were coming from the port stack. Upon opening the door from the galley to the engine room, the chief engineer saw flames engulfing the forward section of the port engine. After the fire, the port lube oil strainer housing was completely gone, suggesting that the strainer was subjected to heat greater than 1,221 degrees F, the melting point of aluminum. This evidence supports the fire examiners’ determination that the fire originated in that general area.

Engine Room Fire aboard Towing Vessel George King

6 NTSB/MAB-18/25

Port main propulsion engine, looking forward. (Photo courtesy of Rob Harshman Forensic Science & Engineering, LLC) Because the lube oil system was a pressurized system, a small leak in the strainer’s housing or at the covers for the strainers could have caused escaping oil to atomize. Atomized oil is susceptible to ignition and flashover if there is a viable heat source located nearby, and there were a number of hot surfaces within the George King’s engine room. It is likely that atomized lube oil spraying from the port strainer was ignited after making contact with a hot surface near the strainer housing, which progressed into a continuous burning fire after an initial flashover. This scenario coincides with the statements of the captain, which identified a flash followed by flames coming from the engine room exhaust vents on the port stack.

Remains of the port lube oil strainer. (Photo courtesy of Rob Harshman Forensic Science & Engineering, LLC)

Engine Room Fire aboard Towing Vessel George King

7 NTSB/MAB-18/25 According to logs reviewed by investigators and interviews of the crewmembers, the towing vessel’s crew participated in regular drills. However, the George King did not have firefighting personal protective equipment for crewmembers, nor was such equipment required by regulation. Fighting a fire without protective equipment significantly decreases the ability of fire teams to close in on and extinguish a fire or secure spaces to prevent the fire from spreading. As a result, the fire teams on the George King could only place a hose through engine room windows as their sole means to try to control and extinguish the fire. The chief engineer, while fighting the fire, was knocked down by a pressure wave possibly caused by a rupture in a pressurized air cylinder in the engine room. Although he was not injured by the pressure wave, the situation demonstrates the risks to crews when fighting engine room fires. Because of the risks associated with engine room fires, the effectiveness of fixed firefighting systems is critical. The crew did not activate the halon system because of the inability of the chief engineer to reach the halon activation station on the port side and a misunderstanding between crewmembers regarding activation from the starboard side. Had the system been activated, its effectiveness would have been limited because the portside doors to the engine room were open and several engine room windows were broken. In addition, engine room inlet and exhaust vents were fitted with fixed louvers that were not able to be closed. These openings would have allowed a significant amount of the discharging halon to escape the space instead of being contained in large enough volume to extinguish the fire. Additionally, these openings allowed for continued air draft to the fire, allowing it to spread. Probable Cause The National Transportation Safety Board determines that the probable cause of the engine room fire aboard the towing vessel George King was the ignition of oil spraying from the pressurized lube oil strainer on the port main diesel engine. Contributing to the severity of the fire was the fixed-open engine room ventilation system and the inability of the crew to close all engine room windows and doors, which allowed the fire to spread and would have limited the effectiveness of the halon fixed firefighting system had it been activated.

Engine Room Fire aboard Towing Vessel George King

8 NTSB/MAB-18/25 Vessel Particulars Vessel George King Owner/operator Marquette Transportation Company, LLC Port of registry St. Louis, Missouri Flag United States Type Towing vessel Year built 1976 Official/IMO number 576107 Classification society N/A Construction Steel Length 138 ft (42.06 m) Draft 11 ft (3.35 m) Beam/width 44 ft (13.41 m) Gross tonnage 580 Engine power; manufacturer 2 X GM-16-645E7B-1042-EMD diesel engines, 12,280 hp (9,157 kW) Persons on board 9 NTSB investigators worked closely with our counterparts from Coast Guard Marine Safety Detachment Vicksburg throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA18FM012. Issued: November 7, 2018

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 of the United States Code, Section 1131(b)(1). This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 of the Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 of the United States Code, Section 1154(b).

FD07500 ｜ 2018_美国_MAB1828.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/MAB-18/28 National Transportation Safety Board Marine Accident Brief Engine Room Fire aboard Towing Vessel J.W. Herron Accident type Fire/Explosion No. DCA18FM008 Vessel name J.W. Herron Location Big Bayou Canot, Twelvemile Island, near Mobile, Alabama 30°47.46’ N, 087°59.55’ W Date December 13, 2017 Time 1340 central standard time (coordinated universal time – 6 hours) Injuries None reported Property damage $1.5 million est. Environmental damage None reported Weather Clear, visibility 10 miles, winds south-southeast 8 knots with gusts to 17 knots, air temperature 54°F, water temperature about 63°F Waterway information Big Bayou Canot flows around Twelvemile Island opposite of the main navigation channel of Mobile River at mile 7. The bayou is 7–15 feet deep and approximately 500 feet wide at the accident site. About 1340 local time on December 13, 2017, the towing vessel J.W. Herron was shifting barges on Big Bayou Canot near Twelvemile Island, approximately 8 miles north of Mobile, Alabama, when a fire began in the lower engine room and quickly spread.1 After the crew of three partially secured the engines and fuel supply, heavy smoke and fire prevented them from attempting to extinguish the fire, forcing an immediate evacuation of the vessel to the barges. No pollution or injuries were reported. The estimated damage to the vessel was $1.5 million.

J.W. Herron under way prior to fire. (Photo by Draye, MarineTraffic.com)

1 All miles in this report are statute miles.

Engine Room Fire aboard Towing Vessel J.W. Herron

2 NTSB/MAB-18/28

Location of accident where fire erupted in engine room of J.W. Herron following towboat’s departure from dock. (Map data by Google Maps; satellite image by Google Earth Pro) Background The J.W. Herron was an 88-foot-long, twin-propeller towing vessel powered by two mechanically controlled EMD 645 twelve-cylinder diesel engines producing 3,000 total horsepower. The vessel was repowered in the late 1990s before the current owner purchased it in 2011. Originally named the Tunica, the vessel was built in 1967 by Wagren Steel Co. with GM 567 BC-type engines producing 2,400 total horsepower. The transmission was a Falk LST-type consisting of a reduction gear with an integral pneumatically operated clutch. The towboat was fitted with twin rudders (one aft of each propeller) and flanking rudders, all operated electromechanically through sticks in the wheelhouse. The J.W. Herron was constructed of welded steel with three levels above the lower engine room and hull spaces. The engine room, located aft of the galley and accommodation spaces, contained the two main propulsion engines, two generators, and all other associated equipment, including the fire pump. The space had two levels: an upper level, which was also the main deck, and a lower level, where the main engines, clutches, and reduction gears for the shafts were located. The interior accommodation spaces and wheelhouse were finished with wood and plywood. The J.W. Herron was typically scheduled for line hauls of six hopper barges on 30-day roundtrips from Mobile, Alabama, to Houston, Texas, through the Intracoastal Waterway. After

Engine Room Fire aboard Towing Vessel J.W. Herron

3 NTSB/MAB-18/28 returning to Three Mile Dry Dock and Repair in Mobile, the vessel underwent maintenance on December 10 and 11. The vessel was assigned to barge shift work there over the next few days and afterward scheduled to head to Houston on December 14.

Simplified profile of J.W. Herron (not drawn to scale). Accident Events About 1030 on December 13, the J.W. Herron departed Three Mile Dry Dock and Repair. The crew—who consisted of the captain, the engineer, and a deckhand—began shifting barges in Mobile Harbor to assemble a tow for staging at Twelvemile Island, approximately 5 miles north via the Mobile River.2 The tow consisted of seven empty hopper barges (each 200 feet long and 35 feet wide), a small deck barge, and a 45-foot-long shift boat named Dana Jean; it was configured three long on the port and center strings, with the starboard string comprising a single hopper barge at the head and the small deck barge aft, while the Dana Jean was being towed behind the J.W. Herron. After the tow was built, the crew began the transit upriver about 1140. According to the captain, the weather was good, with a light 8-mph wind from the south. He said that he had both propulsion engines at 600 rpm ahead for a corresponding speed of approximately 6 mph. Automatic identification system (AIS) data confirms the transit speed was just over 5 mph until the tow reached the staging area in Big Bayou Canot, on the east side of Twelvemile Island, about 1310. During the 1.5-hour transit, the engineer stated that the temperatures of the engine room machinery were “just fine” when he checked them. He looked at water and bearing temperatures and pressures for water, oil, the air blower, and the air clutch for both the port and starboard propulsion systems. On arrival at Twelvemile Island, the captain landed the aft end of the tow on the east side of the bayou. The engineer and deckhand left the J.W. Herron and positioned themselves on the aft center barge with handheld VHF radios. By 1330, they had tied lines to the trees on the bank and relocated the Dana Jean to the starboard side of the J.W. Herron with the small towboat’s engines running in neutral. Next, the crew unfaced (untied) the towboat from the aft center barge, so that the captain could reposition the J.W. Herron to push the front of the tow into the bank and then the starboard head barge could be tied to the trees. To position the vessel, the captain stated that he “walked” the

2 Staging in the towing industry refers to the activity of securing barges for short-term storage, which involves parking or shifting the barges.

Engine Room Fire aboard Towing Vessel J.W. Herron

4 NTSB/MAB-18/28 towboat from the back of the tow by putting the port propeller in reverse and leaving the starboard propeller in forward. Once clear of the port string, he placed both engines in forward and moved toward the port head barge (facing north). Next, the captain spun the J.W. Herron clockwise by moving the starboard engine to neutral and then to reverse. With the vessel positioned to push the tow into the bank, he returned the starboard engine to forward and, with both engines, pushed the tow at an idle speed of approximately 345 rpm. However, noticing that the tow was not moving toward the bank as expected, the captain increased the throttle of both engines to approximately 500 rpm. He then looked aft and saw no propeller wash from the starboard side. The captain thought that there might have been a problem with the control system to the engines, as he later stated, but did not hear anything unusual at the time. Meanwhile, the engineer and deckhand were making their way forward to the head of the tow to tie off the starboard head barge. The captain attempted to radio the engineer to inform him of the issue, but the engineer’s radio had a dead battery. About 1340, the deckhand and engineer noticed “dark black” smoke emanating from the area of the stack fan outlet (not the engine exhaust) on the port side and then from the portside engine room door. The captain saw the engineer pointing, yelling, and next running across the barges toward the J.W. Herron. After the captain met the deckhand and engineer at the starboard tow knee, the captain and engineer proceeded down the starboard side of the towboat’s main deck to access the engine room. According to the engineer, the engine room was filled with black smoke, but while looking through the forwardmost engine room window (of four windows) he saw a “glow” emanating from the back of the port engine, between the engine and the gearbox. The captain, who was a bit farther aft than the engineer, also saw thick black smoke, but he stated that he could not see anything through the window.

Images from captain’s camera phone capture evolution of fire aboard J.W. Herron, 9 minutes after smoke was first noticed through when fire department began firefighting with water cannons.

Engine Room Fire aboard Towing Vessel J.W. Herron

5 NTSB/MAB-18/28 The captain stated that all four engine room windows and the double doors on the main deck on both the port and starboard sides of the engine room were open. With the towboat positioned starboard-to the wind direction, he noticed that the smoke was blowing out of the port windows and door as it traveled through the engine room. The captain instructed the engineer to board the Dana Jean with the deckhand and move it away from the burning J.W. Herron. He then pulled the remote emergency fuel shutoffs for the starboard generator and starboard propulsion engine, which were located above the forwardmost engine room window. However, after he proceeded around the forward side of the wheelhouse, he was unable to reach the shutdowns for the port generator and propulsion engine due to the smoke. According to the captain, approximately 4,000 gallons of no. 2 diesel oil and approximately 200 gallons of lube oil were in the vessel’s tanks. On returning to the wheelhouse, the captain noticed that the fire alarm (heat sensor) for the engine room was flashing and buzzing, but he did not see any other locations indicated. He put the port engine in neutral and called the vessel company. As he was preparing to call the US Coast Guard, he was forced from the wheelhouse, around 1349. The captain then evacuated the towboat, headed down the barges, and met the engineer and deckhand aboard the Dana Jean. The vessel’s AIS, located in the wheelhouse, stopped transmitting at 1415. Two local fire department vessels arrived on scene around 1510, at which time the captain described the fire as past its apex and winding down, with a small fire in the engine room and another below the wheelhouse. Fire department personnel did not communicate with the captain but began fighting the fire with water cannons. About 1630 (before the fire was completely extinguished), the J.W. Herron crew departed the scene to complete drug and alcohol testing. Another Three Mile towboat, the Tommy Jack, which had transited upriver to assist the crew of the J.W. Herron, towed the vessel back to the dock. The J.W. Herron’s hull was not breeched during the fire, and the main structure and main propulsion system remained intact, despite the extensive fire damage throughout the vessel. There was no report of fuel or oil spilled.

J.W. Herron post-fire at Three Mile Dry Dock and Repair.

Engine Room Fire aboard Towing Vessel J.W. Herron

6 NTSB/MAB-18/28 Other Information Propulsion system The captain told investigators that when he lost starboard propulsion he initially thought there was a problem with the control system. The towboat had pneumatic controls for engine speed (throttle) and direction. In neutral, the engine output shaft would turn; when the throttle was pushed forward, a pneumatic signal would engage the clutch by admitting air to a rubber tire that inflated, squeezing on a drum, and driving the propeller shaft; and to reverse propulsion, the clutch had mechanically engaged pinions. The captain stated that after the fire, he suspected the cause was a slipping clutch that overheated. He said that low clutch air pressure would result in partial tire inflation, causing the clutch tire to spin against the drum pads. If the condition persisted, the aluminum in the clutch assembly would heat and ignite the rubber tire, whose embers may then ignite oil in the bilge or combustibles in the engine room. In the case of the J.W. Herron, the captain stated that the ignitable fuel may have been oil in the bilge or the engine lube oil in the lines running just above the clutch (the engineer stated that the bilge was pumped out 3 days before the accident but sometimes in the past it contained some fuel and lube oil). Based on the captain’s experience, slipping clutches first produced a “white” smoke, which turned into “black” smoke when the rubber tire burned. Although the engineer stated that he did not know the cause of the fire, he suggested that it might have been a lack of oil in the engine’s gear-driven air blower or the heat of a slipping clutch. The vessel did not have an alarm alerting the crew to low air pressure to the clutch; however, the engineer checked the clutch pressure during the transit and stated that it was normal, as were the oil pressures and other machinery temperatures. He did not recall any fuel leaks from the engines under typical operation, but he had previously seen engine vibrations loosen copper tubing flare fittings, which would then weep oil. He resolved the leaking fittings by tightening them while under way. According to the engineer, a 3/8-inch copper tubing with flare fittings was supplying lube oil to the air blowers above the clutch; the operating pressure in the line was approximately 18 pounds and the engine sump held approximately 80 gallons of oil. Investigators confirmed that the oil supply line constructed of steel ran inside the valve covers down the starboard side of the engine, transitioned to copper tubing upon exiting the valve covers, and remained copper to the blowers. The fittings and tubes appeared to be intact post-fire but were not pressure-tested. In the past, the engineer had attempted to replace the copper tubing with steel per the engine manual, but he could not find the part in steel. Above the clutch were also twin 1.5-inch stainless steel-braided rubber hoses, held in place with double hose clamps, that vented the engine crankcase to the air blowers. After the fire, these hoses were missing. Starboard main engine (looking aft).

Engine Room Fire aboard Towing Vessel J.W. Herron

7 NTSB/MAB-18/28 Machinery maintenance The J.W. Herron was owned by Graestone Logistics and leased under a bareboat charter arrangement by Four Rivers Towing, both of Murray, Kentucky. Three Mile Dry Dock and Repair, where the J.W. Herron regularly operated, performed the maintenance work on towboats owned by Graestone and operated by Four Rivers, who supplied the crew and was responsible for maintenance. The accident captain was both the owner of the operating company and a co-owner of Three Mile. According to the accident captain, maintenance on machinery was conducted “in house.” His company operated four boats with clutch and gear systems similar to the J.W. Herron’s. For overhauls of the Falk reduction gears and air clutches, he hired an expert from a gear repair company to oversee repairs in a supervisory role. Maintenance records, which were kept on board the vessel only, were destroyed in the fire. The engineer recalled that 3 years before the fire the engines were overhauled, and the captain and engineer revealed that either the port- or starboard-side clutch was renewed. The captain stated that there was no upcoming maintenance scheduled for the gears or clutches and that the lifespan for the clutch tire was typically 5 to 7 years and the tires were about 3 years old. Both crewmembers told investigators that gears and clutches were inspected visually over the years, which included recording clearance measurements. The engineer said that about every 60 days he changed lube oil filters for the reduction gears, and about every 3 months he removed the clutch covers to check the air pressure to the clutch as well as the clearances between the clutch and the drum. When asked if they had a planned maintenance system, the engineer said they conducted more “routine maintenance” for overhauls, which they determined by the service life hours, unless inspections indicated an earlier period. Condition of engine and transmission The captain of the towboat who regularly navigated the J.W. Herron from Mobile to Houston stated that he was not aware of any previous issues with the engine or clutch. Interviews of the accident captain and engineer revealed that the towboat had two incidents related to the clutch within a few weeks of the fire. The first was around November 20, when the starboard engine quickly increased in rpms while operating in shallow water. Following the incident, the engineer inspected the clutch and checked clearances and found them to be satisfactory, so no parts were replaced. The second incident, around December 9, occurred when the starboard propeller hit a log and, as the engineer told the captain, they “smoked a clutch tire.” An inspection similar to the prior incident’s was conducted December 10 and 11; the components and clearances were again deemed satisfactory, so no parts were replaced. Fire investigation report A day after the fire, a commercial forensic science firm contracted by the vessel’s insurer conducted an examination of the J.W. Herron to ascertain the source of the fire. The firm’s report classified the fire as accidental and noted that fire patterns indicated that damage to the starboard engine was more extensive than to the port engine, whose valve covers remained intact while the starboard’s were melted. The clutch tires for each engine were found to be equally damaged. A vacuum canister for the engine’s crankcase oil, which was located above the clutch tire area, had connecting hoses burned away at both engines. The firm concluded that the fire occurred near the aft end of the starboard engine, likely from a ruptured hose on the vacuum canister that would have

Engine Room Fire aboard Towing Vessel J.W. Herron

8 NTSB/MAB-18/28 sprayed lube oil throughout the engine compartment and onto hot engine surfaces and the clutch tire, thus igniting the oil. Once the oil ignited, the fire would have spread by burning combustible materials as well as diesel fuel and lube oil systems in the engine compartment, before reaching the upper level via direct flame impingement and conduction. The report also noted that heat buildup from the slipping clutch, which was described by the captain, rendered the clutch tire a potential ignition source.

Fire damage of engine room’s upper level (looking forward). Fire equipment, detection, and drills The crew did not discuss starting the electrically driven fire pump or taking other actions to combat the fire. Although hoses were located on each side of the main deck and the fire pump system valves were lined up to operate, the hazards and limited visibility caused by the thick black smoke prevented the crew from reaching the remote start-switch for the pump, which was directly above the exterior starboard-side engine room door. The engine room was not fitted with a fixed fire-suppression system, nor was it required to be. Instead, a large, semi-portable CO2 fire extinguisher was located on the aft port side of the lower engine room, along with handheld CO2 extinguishers on both the upper and lower levels of the engine room. There was no self-contained breathing apparatus (SCBA) on board the vessel for the crew to enter dangerous atmospheres. Engine shutdowns and remote fuel supply shutoffs for the propulsion and generator diesel engines were located on the port and starboard sides at the forwardmost engine room window. The captain succeeded in pulling the starboard set, but not the port set due to the smoke. The crew stated that the vessel’s fire detection system was functioning and gave both audible and visual indications at the time of the fire. There were two heat sensors in the engine room, one on each level, and others throughout the vessel.

Engine Room Fire aboard Towing Vessel J.W. Herron

9 NTSB/MAB-18/28 The captain said fire drills were conducted about once a month. Although documentation of the drills for the J.W. Herron was lost in the fire, he did provide documentation for company fire drill scenarios, accompanying crew sign-in sheets, and general shipboard “Fire Safety Instruction and Orientation.” Engine room ventilation Typical of inland river towing vessel designs, the J.W. Herron had four residential-type (not marine-grade weathertight) vertically opening windows located along the port and starboard bulkheads on the upper level of the engine room. In addition, for exterior access into the engine room there were double doors located on the port and starboard sides of the main deck, and for access from interior spaces there were three steel dog-type doors. The exterior windows and doors were routinely left open for ventilation of the engine room, whereas the interior doors were typically closed. The crew was unable to secure the two sets of supply and exhaust fans providing engine room ventilation as they were controlled from within the engine room, so they remained running during the fire. Additionally, the exhaust ventilation outlets for the engine room located on the aft side of the stacks had fixed louvers and thereby could not be closed. Personnel The accident captain was not the regular captain of the J.W. Herron, but captained towboats for barge shifts in the Mobile area two to three times a month. He stated that he had been running towboats on the rivers for more than 49 years, was a licensed pilot for more than 45 years, and had been captain for nearly 40 years. He held a current Coast Guard credential as master of towing on Western Rivers. The engineer was not credentialed, nor was he required to be. He had worked 28 years for various inland river companies, including as a chief engineer for the last 9 years, six of which were as engineer on the J.W. Herron. He stated that typically he made engine room rounds about every 2.5 hours while under way, including at night, and slept 1.5 to 2 hours between rounds. Drug and alcohol tests administered to the crew resulted in the engineer testing positive for methamphetamine. An NTSB medical evaluation determined that the engineer’s results showed that at some point during the several hours to days prior to the test, the engineer had used methamphetamine, for which the engineer did not provide a valid prescription. However, the Aft side of J.W. Herron stacks, with engine room exhaust vents, post-fire.

Engine Room Fire aboard Towing Vessel J.W. Herron

10 NTSB/MAB-18/28 evaluation noted that urine testing cannot determine precisely when a person used the drug, the timing of impairment from its use, or the degree of impairment. Analysis Although there was no evidence of the engineer, who tested positive for methamphetamine, being impaired in behavior or decision-making ability on the morning of the accident, any drug use by a crewmember poses a safety hazard while on board a vessel. When the captain first saw flames, they were coming from the aft side of the starboard stack, from the engine room exhaust ventilation louvers, indicating a fire in the starboard side of the engine room. Following the accident, the captain suspected that the initiating event was a slipping clutch, as evidenced by the loss of propulsion on the starboard engine before the fire. The clutch slipping was a potential source of ignition rather than a fuel source. The forensic fire report, which indicated that the fire was hottest near the aft portion of the starboard engine, stated that the likely initiating event was the heat of the slipping clutch or a hot engine surface that ignited lube oil from a ruptured hose on the vacuum canister. Investigators also found that copper tubing with flare fittings that carried pressurized lube oil to the engine blowers ran in the same area of the vacuum canister hoses above the clutches and therefore could have been a potential fuel source. As the engineer pointed out, the flare fittings had wept in the past from engine vibration. Because the crew was not able to reach the emergency engine shutdown, lube oil pressurized from a running engine would have fed the fire until the sump emptied or the engine stopped.

Aft side of starboard engine (viewed from above), with oil canister, remnants of clutch tire, and copper tubing identified. Red circles indicate areas where 1.5-inch stainless steel-braided rubber hoses were missing. Although the captain was in the wheelhouse when smoke was first noticed, the crew was on the barges. During the few minutes taken to re-board the vessel and begin firefighting, the crew could not start the fire pump, shut the starboard engine fuel supply valves, stop the starboard

Engine Room Fire aboard Towing Vessel J.W. Herron

11 NTSB/MAB-18/28 engine, or secure the ventilation, as these areas were overcome by smoke. The speed of which the fire grew to encompass the engine room and the location of primary fire equipment within that same space together eliminated the opportunity for the crew to effectively fight the fire; thus, immediate evacuation from the vessel was reasonable. Had the crew been able to reach the port engine shutdowns, the additional diesel fuel in the day tank would not have been available to fuel the fire. In addition, the engine room supply and exhaust fans remained in operation during the fire because they were controlled from the engine room and thereby could not be shut down. Nevertheless, if they had been secured, the engine room inlet and exhaust vents would still not have been able to be shut because they were fitted with fixed louvers. At the time of the fire, both the port- and starboard-side doors to the engine room were open, as were the engine room windows, although this practice risks expanding engine room fires. However, even if the crew could shut the engine room windows, given that they were not marine grade the windows would have likely cracked or blown out in the fire. The inability to secure all ventilation allowed for a continued oxygen supply to the fire, hastening its growth and spread. Furthermore, the small confines of the engine room space and the location of fire equipment within that same space demonstrated a risk to crews fighting engine room fires. Even if the crew could have reached the start button for the fire pump (located in the engine room), their sole means to try to control and extinguish the fire would have been to place a hose through an engine room window or door. On smaller vessels such as tows, the risk to crews fighting engine room fires has led to the development of designs that incorporate both a means for securing ventilation to the engine room and a fire suppression system, such as a fixed CO2 system, to extinguish the fire without requiring crews to enter the space. Probable Cause The National Transportation Safety Board determines that the probable cause of the engine room fire aboard the towing vessel J.W. Herron was leaking lube oil from a propulsion diesel engine hose or tubing fitting that was ignited off an exposed hot engine surface or slipping clutch. Contributing to the severity of the fire was the location of the emergency engine shutdowns and fuel supply shutoffs near the exterior engine room doors, which proved to be inaccessible. Contributing to the spread of the fire was the inability to secure ventilation to the engine room.

Accessing Remote Engine Room Shutdowns The location of remote emergency shutdowns to the engine room—quick-closing valves for fuel and lube oil systems, remote stops for ventilation fans, and engine stops—as well as fire pump start controls may not be accessible during a fire. Therefore, the accessibility of these shutdowns and controls should be evaluated during fire-response planning. Alternative remote emergency shutdown locations, such as the wheelhouse, should be considered for redundancy.

Engine Room Fire aboard Towing Vessel J.W. Herron

12 NTSB/MAB-18/28 Vessel Particulars Vessel J.W. Herron Owner/operator Graestone Logistics, LLC / Four Rivers Towing, LLC Port of registry Paducah, Kentucky Flag United States Type Towing vessel Year built 1967 Official (U.S.)/IMO number 507640 Classification Society N/A Construction Steel Length 88 ft (26.8 m) Draft 9.1 ft (2.8 m) Beam/width 34 ft (10.4 m) Gross tonnage (US) 345 Engine power; manufacturer 2 x 1,500 hp (1,119 kW), total 3,000 hp (2,237 kW); GM 12-645 EMD diesel engines Persons on board 3 NTSB investigators worked closely with our counterparts from Coast Guard Sector Mobile throughout this investigation.

For more details about this accident, visit www.ntsb.gov and search for NTSB accident ID DCA18FM008. Issued: December 20, 2018

The NTSB has authority to investigate and establish the probable cause of any major marine casualty or any marine casualty involving both public and nonpublic vessels under Title 49 United States Code, Section 1131(b)(1). This report is based on factual information either gathered by NTSB investigators or provided by the Coast Guard from its informal investigation of the accident. The NTSB does not assign fault or blame for a marine casualty; rather, as specified by NTSB regulation, “[NTSB] investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by conducting investigations and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, Section 1154(b).

FD07501 ｜ 2018_美国_MAR1801.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Fire aboard Roll-on/Roll-off Passenger Vessel Caribbean Fantasy Atlantic Ocean, 2 Miles Northwest of San Juan, Puerto Rico August 17, 2016

Marine Accident Report NTSB/MAR-18/01 PB2018-101068

National Transportation Safety Board

NTSB/MAR-18/01 PB2018-101068 Notation 57951 Adopted June 5, 2018

Marine Accident Report Fire aboard Roll-on/Roll-off Passenger Vessel Caribbean Fantasy Atlantic Ocean, 2 Miles Northwest of San Juan, Puerto Rico August 17, 2016

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board.

1. Fire aboard Roll-on/Roll-off Passenger

Vessel Caribbean Fantasy, Atlantic Ocean, 2 Miles Northwest of San Juan, Puerto Rico, August 17, 2016. Marine Accident Report NTSB/MAR-18/01. Washington, DC.

Abstract: This report discusses the August 17, 2016, fire aboard the roll-on/roll-off passenger vessel Caribbean Fantasy. The fire began in the main engine room when fuel spraying from a leaking flange came in contact with a hot surface on the port main propulsion engine. The fire could not be contained, so the master ordered the ship to be abandoned. US Coast Guard and other first responder vessels and aircraft, along with good Samaritan vessels, helped transport passengers and crew to the port of San Juan, Puerto Rico. Several injuries, none life-threatening, occurred during firefighting and abandonment efforts. The burning vessel drifted in the wind and grounded on the sandy bottom just outside the port. Three days later, the vessel was towed into the harbor, where shore-based firefighters extinguished the last of the fire. The accident resulted in an estimated $20 million in damage to the Caribbean Fantasy, which was eventually scrapped in lieu of repairs.

The report identifies the following safety issues: machinery maintenance practices, fuel and lube oil quick-closing valves, fire protection, crew training on and familiarity with emergency systems and procedures, implementation of the company’s safety management system, and oversight by the flag state and the flag state’s recognized organization.

As a result of this investigation, the National Transportation Safety Board makes new safety recommendations to the US Coast Guard, Baja Ferries S.A. de C.V., RINA Services S.p.A, the International Association of Classification Societies (IACS), and the Panama Maritime Authority. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations section 831.4. Assignment of fault or legal liability is not relevant to the NTSB statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code section 1154(b).

For more detailed background information on this report, visit the NTSB investigations web page and search for NTSB accident number DCA16FM052. Recent publications are available in their entirety at the NTSB website. Other information about publications may be obtained from the website or by contacting: National Transportation Safety Board, Records Management Division, CIO-40, 490 L’Enfant Plaza SW, Washington, DC 20594, (800) 877-6799 or (202) 314-6551.

Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service, at the National Technical Reports Library search page (this product number is PB2018-101068). For additional assistance, contact: National Technical Information Service, 5301 Shawnee Road, Alexandria, VA 22312, (800) 553-6847 or (703) 605-6000 (see the NTIS website).

NTSB Marine Accident Report iii

Contents Figures .............................................................................................................................................v Tables ............................................................................................................................................ vi Acronyms and Abbreviations .................................................................................................... vii Executive Summary .......................................................................................................................x 1 The Accident .............................................................................................................................1 1.1 The Caribbean Fantasy ............................................................................................................1 1.2 Pre-Accident Events .................................................................................................................1 1.3 Accident Events ........................................................................................................................2 1.3.1 Fuel Leak and Fire .........................................................................................................2 1.3.2 Abandonment and On-Scene Rescue Operations ..........................................................9 1.3.3 Shoreside Rescue Operations .......................................................................................22 1.4 Background ............................................................................................................................23 1.4.1 The Vessel ....................................................................................................................23 1.4.2 Shipboard Organization ...............................................................................................24 1.4.3 Emergency Plan and Station Bill .................................................................................25 1.5 Injuries ....................................................................................................................................27 1.6 Damage ...................................................................................................................................28 1.7 Engineering Factors ................................................................................................................28 1.7.1 Main Propulsion Engines .............................................................................................28 1.7.2 End Flange on Port Main Engine Fuel System ............................................................28 1.7.3 Fuel Lines and Splash Guards......................................................................................30 1.7.4 Quick-Closing Valves ..................................................................................................31 1.7.5 Ventilation Dampers ....................................................................................................33 1.7.6 Firefighting and Fire Prevention Systems and Equipment ..........................................33 1.7.7 Voyage Data Recorder .................................................................................................35 1.8 Survival Factors ......................................................................................................................36 1.8.1 Lifeboats ......................................................................................................................36 1.8.2 Marine Evacuation Systems and Liferafts ...................................................................40 1.9 Personnel ................................................................................................................................44 1.9.1 Crew Recruitment and Manning ..................................................................................44 1.9.2 Experience and Training of Key Personnel .................................................................45 1.9.3 Toxicological Testing ..................................................................................................47 1.10 Work/Rest ...............................................................................................................................47 1.11 Language ................................................................................................................................48 1.11.1 Regulations and Policy Requirements .........................................................................48 1.11.2 Working Language.......................................................................................................48 1.11.3 Placards and Documentation........................................................................................49 1.12 Shipboard Training .................................................................................................................50 1.12.1 Safety Training.............................................................................................................50 1.12.2 Lifeboat and Marine Evacuation System Training ......................................................51 1.12.3 Drills ............................................................................................................................52 1.13 Safety Management and Port State Control ...........................................................................53

NTSB Marine Accident Report iv

1. 13.1 General Overview ........................................................................................................53
2. 13.2 Caribbean Fantasy Port State Control Record ............................................................54
3. 14 Waterway Information ...........................................................................................................58
4. 15 Weather Information ..............................................................................................................58

2 Analysis ...................................................................................................................................59 2.1 Exclusions ..............................................................................................................................59 2.2 Fire ..........................................................................................................................................59 2.3 Firefighting Systems ...............................................................................................................61 2.4 Abandonment .........................................................................................................................62 2.5 Mass Rescue Operations ........................................................................................................64 2.6 Safety Oversight .....................................................................................................................65 3 Conclusions .............................................................................................................................69 3.1 Findings ..................................................................................................................................69 3.2 Probable Cause .......................................................................................................................70 4 Recommendations ..................................................................................................................71 Appendixes....................................................................................................................................73

NTSB Marine Accident Report v

Figures Figure 1. Ro/Ro passenger vessel Caribbean Fantasy .................................................................. 1 Figure 2. General arrangement drawing for deck 2 engineering spaces ...................................... 4 Figure 3. Automatic identification system track of the Caribbean Fantasy .................................. 6 Figure 4. CO2 system activation station postaccident .................................................................... 8 Figure 5. Drawing of the port and starboard MESs ..................................................................... 11 Figure 6. Port side of Caribbean Fantasy on the day after the accident. ....................................... 13 Figure 7. Lifeboat no. 1 in the water and unable to open the release hooks .................................. 14 Figure 8. US Coast Guard fast-response cutter Joseph Tezanos (WPC 1118) ................................. 16 Figure 9. Liferaft at the starboard-side MES platform ................................................................. 17 Figure 10. Caribbean Fantasy during the final stage of abandonment ....................................... 18 Figure 11. Coast Guard small boat pulling the starboard-side MES platform ............................. 20 Figure 12. Paint blistering at the waterline; large pieces of paint missing .................................. 21 Figure 13. Passengers and crew from lifeboat no. 2 disembarking at Pier 6 ............................... 23 Figure 14. Profile of Caribbean Fantasy showing garages and fire zones. ................................. 24 Figure 15. Fuel supply line end flange on the port main engine .................................................. 29 Figure 16. Fuel supply line end flange and gasket material, left, and blanking plate, right. ....... 30 Figure 17. Portside lube oil storage tank quick-closing valve ..................................................... 31 Figure 18. Starboard heavy fuel oil storage tank quick-closing valve ......................................... 32 Figure 19. Water-mist system nozzle after the fire. ..................................................................... 34 Figure 20. Lifeboat no. 2 on the pier; lifeboat no. 3 suspended from the davit ........................... 36 Figure 21. Caribbean Fantasy starboard side .............................................................................. 36 Figure 22. U-hook with recovery pin positions; lifeboat no. 3 aft hook ...................................... 39 Figure 23. MES stowage box components................................................................................... 41 Figure 24. Portside liferaft containers and storage racks ............................................................. 42 Figure 25. Starboard-side MES deployed at about a 54-degree angle ......................................... 43 Figure 26. Inflated liferafts without passengers ........................................................................... 44 Figure 27. Emergency instruction sign; lifejacket donning instruction sign ............................... 50

NTSB Marine Accident Report vi

Tables Table 1. Vessel Information. ........................................................................................................ 73

NTSB Marine Accident Report vii

Acronyms and Abbreviations AB able-bodied seaman AIS automatic identification system APT annual performance test ATON aids to navigation BV Bureau Veritas CBP Customs and Border Protection CEO chief executive officer CFR Code of Federal Regulations CO2 carbon dioxide COTP captain of the port CPR cardiopulmonary resuscitation CSNCOE Cruise Ship National Center of Expertise DPA designated person ashore ECR engine control room EEBD emergency escape breathing device EOC emergency operations center EMS emergency medical services FURA Fuerzas Unidas de Rápida Acción (United Forces of Rapid Action) GMDSS global maritime distress and safety system GPS global positioning system GRP glass-fiber-reinforced plastic hp horsepower IACS International Association of Classification Societies ICAO International Civil Aviation Organization ICOC initial certificate of compliance

NTSB Marine Accident Report viii

ILO International Labour Organization IMO International Maritime Organization ISM Code International Safety Management Code JIS Japanese Industrial Standards kW kilowatt MES marine evacuation system MGO marine gas oil MHZ main horizontal zone MLC Maritime Labour Convention MRO mass rescue operation MSC Marine Safety Center MSD marine sanitation device MVZ main vertical zone NTSB National Transportation Safety Board OEM original equipment manufacturer OSC on-scene coordinator PA system public address system PET polyethylene terephthalate PFD personal flotation device PREMA Puerto Rico Emergency Management Agency PSC port state control PSCO port state control officer PVSS passenger vessel safety specialist QCV quick-closing valve RCU release control unit Ro/Ro roll-on/roll-off

NTSB Marine Accident Report ix

RO recognized organization SAR search and rescue SCBA self-contained breathing apparatus SMS safety management system SOLAS International Convention for the Safety of Life at Sea STCW Code Seafarers’ Training, Certification and Watchkeeping Code VAC volts AC VDR voyage data recorder VHF very high frequency

NTSB Marine Accident Report x

Executive Summary About 0725 on August 17, 2016, a fire broke out in the main engine room of the roll-on/roll-off (Ro/Ro) passenger vessel Caribbean Fantasy when fuel spraying from a leaking flange came in contact with a hot surface on the port main propulsion engine. The fire could not be contained, so the master ordered the ship to be abandoned. US Coast Guard and other first responder vessels and aircraft, along with good Samaritan vessels, helped transport all 511 passengers and crew to the port of San Juan, Puerto Rico. Several injuries, none life-threatening, occurred during firefighting and abandonment efforts. The burning vessel drifted in the wind and grounded on the sandy bottom outside the port. Three days later, the vessel was towed into the harbor, where shore-based firefighters extinguished the last of the fire. The accident resulted in an estimated $20 million in damage to the Caribbean Fantasy, which was eventually scrapped in lieu of repairs. The National Transportation Safety Board determines that the probable cause of the fire aboard the roll-on/roll-off passenger vessel Caribbean Fantasy was Baja Ferries’ poor safety culture and ineffective implementation of their safety management system on board the vessel, where poor maintenance practices led to an uncontained fuel spray from a blank flange at the end of the port main engine fuel supply line onto the hot exhaust manifold of the engine. Contributing to the rapid spread of the fire were fuel and lube oil quick-closing valves that were intentionally blocked open, fixed firefighting systems that were ineffective, and a structural fire boundary that failed. Contributing to the fire and the prolonged abandonment effort was the failure of the Panama Maritime Authority and the recognized organization, RINA Services, to ensure Baja Ferries’ safety management system was functional. Safety issues identified in this accident include the following: • machinery maintenance practices • fuel and lube oil quick-closing valves • fire protection • crew training on and familiarity with emergency systems and procedures • implementation of the company’s safety management system • oversight by the flag state and the flag state’s recognized organization As a result of this investigation, the National Transportation Safety Board makes new recommendations to the US Coast Guard, Baja Ferries S.A. de C.V., RINA Services S.p.A, the International Association of Classification Societies (IACS), and the Panama Maritime Authority.

NTSB Marine Accident Report 1

1 The Accident 1.1 The Caribbean Fantasy The Panama-flagged Caribbean Fantasy was a 614-foot-long roll-on/roll-off (Ro/Ro) passenger vessel that provided ferry service between Santo Domingo, Dominican Republic, and San Juan and Mayaguez, Puerto Rico. The vessel had three decks—designated garages A, B, and C from bottom to top—for carrying vehicles, as well as passenger accommodation spaces located above the garages. The Caribbean Fantasy was certificated to carry 1,030 passengers and had lifesaving appliances (lifeboats and liferafts) for 1,150.

Figure 1. Ro/Ro passenger vessel Caribbean Fantasy. (Photo by Baja Ferries) 1.2 Pre-Accident Events From March 26 to July 3, 2016, the Caribbean Fantasy completed a shipyard period in Menzel Bourguiba, Tunisia.1 Along with other repairs, extensive maintenance was performed on the vessel’s main propulsion engines, and all lifeboat release hooks were replaced in compliance with revised regulations under the International Convention for the Safety of Life at Sea (SOLAS).2 The hooks, which were installed on each of the vessel’s three lifeboats, attached the boats to the falls (wire ropes) on the gravity davits. The hooks for each boat were designed to be released via a mechanism inside the boat once it was lowered to the water. At the completion of the shipyard period, the Caribbean Fantasy departed the facility without conducting sea trials or testing of major systems to ensure proper operation. After leaving the shipyard, the Caribbean Fantasy transited to Gibraltar (British Overseas Territory), arriving on the evening of July 5. While in Gibraltar, the vessel experienced two full blackouts, including loss of propulsion and loss of primary electrical power. The blackouts occurred when the chief engineer stopped all three online diesel generators in response to fire

1 Menzel Bourguiba is in the governate of Bizerte on the northeast coast of Tunisia. The capital of the governate is the city of Bizerte. Various documents generated while the Caribbean Fantasy was in the shipyard list “Bizerte” as the location of the vessel. 2 The SOLAS Convention is generally regarded as the most important of all international treaties concerning the safety of merchant ships. The main objective of the convention is to specify minimum standards for the construction, equipment, and operation of ships, compatible with their safety. Flag states are responsible for ensuring that ships under their flag comply with its requirements. The first version of the SOLAS Convention was adopted in 1914 in response to the Titanic disaster. The current version in force is the 1974 Convention, as amended on numerous occasions. Source: International Maritime Organization (IMO), International Convention for the Safety of Life at Sea (SOLAS), 1974, http://www.imo.org/en/About/Conventions/ListOfConventions/Pages/International-Convention-for- the-Safety-of-Life-at-Sea-(SOLAS),-1974.aspx.

NTSB Marine Accident Report 2

alarms and smoke in the auxiliary engine room, the location of the generators. Upon investigation, the engineers discovered that cooling water was leaking into the generators’ crankcases due to a failure of O-rings. After the first blackout, the Gibraltar Maritime Administration initiated a port state control inspection of the Caribbean Fantasy. On July 8, 2016, the port state control officer issued three major deficiencies and detained the vessel in port, the Caribbean Fantasy’s third detention in 3 years. Detention is one of the most serious actions that port state control authorities may take to ensure that a foreign vessel’s operational condition or crew meets applicable international conventions and will not present a danger to the vessel, its crew, the port, or cause harm to the marine environment. Detentions are rare. Between 2014 and 2016, the US Coast Guard conducted nearly 28,000 SOLAS safety inspections yet detained only 448 vessels, a detention rate of 1.6 percent.3 Multiple detentions of the same vessel are rarer still. (See section 1.13 for more information on port state control actions involving the Caribbean Fantasy.) A shore-based team of technicians repaired the no. 1 and no. 2 generators (the no. 3 generator was put out of commission), other deficiencies were addressed, and the Caribbean Fantasy was released by the Gibraltar Maritime Administration on July 14. A week later, on July 21, the Caribbean Fantasy stopped at a shipyard in Cádiz, Spain, to complete repairs to the bearings on the vessel’s port main propulsion engine. The Caribbean Fantasy departed Cádiz on July 27 and crossed the Atlantic Ocean, arriving in Santo Domingo on August 5. Fifty-nine hotel crew who had been off the vessel during the shipyard period in Tunisia joined the vessel on August 5 and 6. The master and a second engineer also joined the vessel at that time. While in Santo Domingo, the crew prepared for a US Coast Guard port state control inspection. The vessel then sailed for San Juan on August 8, where it arrived the following morning. The port state control inspection was completed on August 9 with a satisfactory result. Upon completion, the Caribbean Fantasy resumed regular service between the Dominican Republic and Puerto Rico. 1.3 Accident Events 1.3.1 Fuel Leak and Fire One week later, the Caribbean Fantasy departed Santo Domingo for an overnight passage to San Juan. This was to be the third voyage to San Juan since the vessel returned to service. There were 124 crewmembers, 387 passengers, and 7 dogs on board.4 The vessel was also carrying 58 containers and 36 cars as cargo. The crossing between the Dominican Republic and Puerto Rico was uneventful. Crewmembers reported nothing unusual with the vessel or its machinery. In the morning on August 17, the Caribbean Fantasy approached the pilot station at the entrance to the port of San Juan for a scheduled boarding of the harbor pilot at 0730. The ship’s master arrived on the bridge at 0644 and received an update on the upcoming arrival from the second officer who was on watch. Shortly thereafter, the staff captain and the safety officer arrived on the bridge. At 0715, the ship’s autopilot was disengaged, and the helmsman took the wheel while the vessel was on a heading of 100 degrees at a speed of 17.4 knots.

3 Coast Guard, Port State Control in the United States 2016 Annual Report, Washington DC: Department of Homeland Security, 2017. 4 Originally, there were 388 passengers on board, but one was disembarked from the ship for medical reasons just as the vessel was getting under way from Santo Domingo.

NTSB Marine Accident Report 3

Below in the main engine room, a third engineer, a motorman, and a wiper were on watch and preparing for the arrival in San Juan.5 Just before 0700, the chief engineer entered the main engine room, conducted a routine round of the space, and recorded the fuel levels of the main engine service tanks in advance of the arrival. The main engines and generators were using marine gas oil (MGO), a low-sulfur version of diesel fuel, having transitioned from heavy fuel oil (HFO) 7 hours earlier.6 About 0720, the motorman and the wiper noticed the smell of fuel in the main engine room. Upon investigation, the motorman saw MGO leaking from the aft end of the port main engine. He immediately notified the chief engineer, who was at the forward end of the main engine room. The chief engineer, motorman, and wiper investigated further and found fuel discharging from an end flange on the port main engine fuel supply line, located on the aft outboard side of the engine. The chief engineer proceeded to the engine control room (ECR) and, at 0723, called the bridge to inform the master of the leak. The chief engineer told the master that repairing the leak required shutting down the fuel system and isolating the fuel supply line, which would also shut down the port main engine propulsion. After receiving the call from the chief engineer, the master told the bridge watch, “Reduce the speed.” At that moment, the ship was altering course to starboard toward the pilot station at a speed of 17.3 knots. With the permission of the master, the chief engineer took control of the main propulsion in the ECR. He reduced the load on the main engines by decreasing the pitch angle of the controllable-pitch propellers in preparation for stopping one or both engines. He then left the ECR and returned with the motorman to the location of the fuel leak. There they discovered an increased amount of fuel spraying from the fuel end flange in the direction of the engine’s exhaust manifold casing and turbocharger. Reducing the load on the engines had decreased fuel consumption and thereby increased the fuel supply line pressure, which in turn had increased the fuel spray. The chief engineer told investigators that he was about a meter away from the flange when the fuel spray ignited. A large plume of fire, heat, and smoke forced the chief engineer, motorman, and wiper to exit the area. The chief engineer and motorman returned to the ECR. The wiper attempted to go to the ECR, but the smoke and heat prevented him from doing so. Instead, he exited the space into the auxiliary engine room. He then proceeded aft and climbed a stairway to garage B on deck 3. Although the “engine room fire contingency plan” in the Caribbean Fantasy’s safety management system (SMS) included the step “[machinery space] evacuated and personnel mustered,” no procedure or location was provided for the muster of evacuated personnel. Other documents reviewed by investigators, such as the emergency plan and station bill, likewise contained no procedures for a muster.7 Thus, after exiting the engine room, the wiper remained in garage B.

5 A motorman is an unlicensed member of the engine department whose principal duties are to maintain and operate machinery as directed by the engineering officers. A motorman possesses at least one year of experience in the engine room. A wiper is an entry-level member of the engine department whose principal duties are to ensure the cleanliness of engineering spaces and assist more senior members of the department as directed. 6 Marine engines and fuel systems are designed to use varying grades of fuel. The type of fuel being used most often depends on the regulations for the waters in which the vessel is operating. MGO burns cleaner than HFO and complies with the requirements of the US Caribbean Emission Control Area. 7 The emergency plan and station bill provided emergency duties and survival craft assignments for the crew. See section 1.4.3 for more information about the Caribbean Fantasy’s emergency plan and station bill.

NTSB Marine Accident Report 4

Figure 2. Excerpt from general arrangement drawing for deck 2 engineering spaces in Caribbean Fantasy. Boundaries for main vertical zones are noted in red. Garage B was located directly above the spaces shown in the drawing. Meanwhile, the third engineer on watch in the ECR heard an explosion, looked out the window into the main engine room, and saw the fire. He called the bridge to notify the watch team of the fire and depressed the fuel supply and boost pump stop buttons on the control console. The third engineer then pulled both propulsion levers to zero pitch from the console in the ECR. Soon thereafter, the chief engineer entered the ECR. From the ECR, the chief engineer manually activated the HPN Nebula high-pressure water-mist fixed firefighting system over the port and starboard main engines by depressing the push buttons for zones no. 1 (starboard machinery) and no. 2 (portside machinery), as labeled on the control panel.8 The chief engineer told investigators that he knew the system was activated because a green indicator light for the service pump illuminated on the control panel. This light signified that the high-pressure pump motor controller was energized, but there was no means in the ECR to verify system pressure or that the pump was running. Heavy black smoke prevented the chief engineer from visually verifying that the system was operating as designed. A deck cadet standing a training watch on the bridge answered the call from the third engineer at 0725.9 The cadet then announced to the bridge team, “Fire in the engine room.” Immediately thereafter, numerous audible alarms sounded on the bridge. Although the vessel’s emergency plan and station bill assigned the staff captain to the bridge in an emergency, the master asked the staff captain to go below to check on the situation. Both the staff captain and the safety officer departed the bridge.

8 See section 1.7.6 for more information about the HPN Nebula system. 9 A cadet is an officer in training. Most often, cadets are students at maritime academies who are detailed to operational vessels for a period of time to gain experience at sea as part of their learning curriculum.

NTSB Marine Accident Report 5

The Caribbean Fantasy was 2 miles from the entrance of San Juan harbor, with the pilot boat approaching to embark the pilot. The second officer informed the pilot boat by radio of the engine casualty and that the vessel would require two tugboats. The pilot did not board the vessel, but the boat remained on scene relaying information to other vessels and ashore. At 0727, the master gave the order to announce “Mr. Skylight” over the ship’s public address (PA) system. The codeword “Mr. Skylight” alerted the crew to the fire and activated the ship’s firefighting and response teams. (Passenger ships commonly use coded announcements to avoid panicking or concerning the passengers while allowing specific crewmembers to be activated to respond to a situation.) The announcement included the instruction “staging area garage A.” To the crew responding, this meant that all fire and response teams would stage themselves in garage A (deck 2) to await further instructions from the ship’s safety officer. Garage A was the lowest of all the vehicle decks, forward of the main engine room and separated by a main vertical zone (MVZ) bulkhead. Shortly thereafter, the master ordered the helmsman to steer hard to port from a heading of 120 degrees to turn the ship away from the harbor entrance. This action was intended to keep the vessel from running aground in the shoal water surrounding the port’s shipping channel. The Caribbean Fantasy’s speed was 10 knots but slowing due to the loss of propulsion. At 0729, the master was informed by phone that the engine room was being evacuated. In response, he ordered the ECR to activate “hi-fog,” referring to the water-mist fixed firefighting system.10 Right after the call, the master informed the San Juan pilot station via very high frequency (VHF) radio of the fire in the engine room and that he was preparing for an evacuation of the passengers. While the master was on the radio, the second officer (on watch) used the ship’s internal radio to inform the safety officer that they needed to know when all persons were evacuated from the engine room in preparation for using the CO2 fixed firefighting system. During this time, the smoke, heat, and flames continued to increase in the main engine room. In the ECR, the chief engineer, third engineer, and motorman were unable to account for the wiper who had exited the engine room via the auxiliary engine room. Consequently, the third engineer attempted to re-enter the main engine room to look for the wiper. Upon entry, he called out to the wiper, but the smoke was too thick to see anything, and he was driven back out of the space. He returned to the ECR. The chief engineer then took an emergency escape breathing device (EEBD) and attempted to find the wiper. He re-entered the main engine room but was also driven back by the heat.

10 HI-FOG is the name of a specific brand of water-mist fixed fire-protection system, patented and produced by the Marioff Corporation, that is used on ships in both machinery and accommodation spaces (source: www.marioff.com, accessed June 2017). The crew of the Caribbean Fantasy referred to their water-mist system as “hi-fog,” although the Marioff system did not exist on board. The water-mist system on the Caribbean Fantasy was the HPN Nebula system. See section 1.7.6 for more information on the HPN Nebula system.

NTSB Marine Accident Report 6

Figure 3. Automatic identification system (AIS) track of the Caribbean Fantasy and timeline of events.11 (Background by Google Earth) About the same time, the staff captain arrived in the main engine room as directed by the master. He was there for only a few seconds before retreating to the ECR. The staff captain recalled to investigators that, looking through the ECR window to the main engine room, the fire was “very violent,” and the flames were touching the overhead. The staff captain said that he informed the master by radio that there was a “big fire” in the engine room and he recommended that CO2 be released. However, the chief engineer recommended not to release CO2 because he was still unable to account for the wiper. The staff captain departed the ECR and went to the CO2 station in garage B aft on the port side to await further instructions. Members of the fire response teams, which were organized into a quick-response team, two firefighting squads, and a boundary cooling team, began to arrive at the staging area in garage A, where they met the safety officer. The safety officer, as the designated on-scene commander, directed fire squad no. 1 to open watertight door no. 3, which separated the garage from the main engine room. Upon opening the door, a significant amount of smoke began to enter garage A. Consequently, the safety officer ordered the fire squad to close the door and pull back. Recognizing that it was not possible to fight the fire from garage A, she ordered the fire response teams to move to garage B directly above. When they arrived at garage B, it was also beginning to fill with smoke, so the safety officer established garage C forward as the staging area for the fire teams. From garage C, the safety officer directed fire squad no. 2 to conduct boundary cooling

11 AIS is a maritime navigation safety communications system. At 2- to 12‑second intervals on a moving vessel, the AIS automatically transmits vessel information, including the vessel’s name, type, position, course, speed, navigational status, and other safety‑related information, to appropriately equipped shore stations, other vessels, and aircraft. The rate at which the AIS information is updated depends on vessel speed and whether the vessel is changing course. AIS also automatically receives information from similarly equipped vessels.

NTSB Marine Accident Report 7

one deck below in garage B. However, according to fire squad members who were interviewed after the accident, their fire hoses were never charged. The safety officer attempted to radio the chief engineer to confirm that the engine room was evacuated but could not get a response. Concerned about this, she donned a self-contained breathing apparatus (SCBA) and, together with fire squad no. 1, proceeded aft toward a portside stairway that led to the engine room. She told investigators that they were not able to make it to the engine room because of the smoke and heat. The chief engineer, motorman, and third engineer evacuated the ECR by way of the portside stairway adjacent to and forward of the ECR. The third engineer stated that he was the last person to evacuate the ECR and that he was overcome by the smoke and heat. At the top of the stairway, on a platform that led out to garage B, the chief engineer went to the emergency shutdown panel and opened its pneumatic valve. This action should have shut the eight ventilation dampers and the eight fuel and lube oil quick-closing valves (QCVs). The ventilation dampers, when closed, were designed to prevent the spread of smoke, reduce the supply of oxygen to the fire, and prevent the CO2 firefighting agent (when released) from escaping the space. The QCVs, when closed, were designed to seal the main engine space and cut off the fuel and lube oil tanks. After activating the pneumatic valve, the chief engineer continued up the stairs and escaped to garage C. Once in garage C, the chief engineer was able to obtain an SCBA from fire squad no. 1. With that, he tried to re-enter the engine room, by way of the same stairway, to confirm that everyone was out of the space, including the wiper. But he was not able to make it down the stairs because of the smoke and heat intensity. While on the stairway, he opened the refilling valve for the air reservoir for the QCVs and ventilation shutdowns as an assurance that there would be adequate air supply for everything to close. He then exited to garage B. The wiper was found in garage B several minutes later. After sighting the wiper, the chief engineer reported to the bridge that all persons were out of the engine room. For about 2 minutes, communications continued between the bridge, the safety officer, and the staff captain regarding confirmation of the engine room evacuation and the closing of fire dampers. At 0734, the master informed the passenger reception desk about the fire in the engine room. He requested that the hotel crew start to gather all passengers to bring them to their muster stations, and he told the crew that he would make an announcement. Two minutes later, a VHF broadcast was made from the Caribbean Fantasy informing all ships in the local area that the vessel was not under command.12 At that time, the vessel was drifting at a speed of 1.5 knots and was 1.5 miles north of the entrance to San Juan harbor. Upon confirming that the engine room was evacuated and all persons in the space were accounted for, the master gave the order to release CO2. The staff captain complied by operating the two valves needed to activate the system. At 0737, the staff captain informed the bridge by radio that CO2 had been released. The staff captain remained at the CO2 station and was joined by the chief engineer shortly thereafter. The staff captain verified that he heard the CO2 bottles discharge, and he and the chief engineer noted frost on the valves and piping (a common indicator of movement of gas through discharge lines). They then departed the CO2 station.

12 Not under command is defined in the International Regulations for Preventing Collisions at Sea, 1972 (72 COLREGS), as “a vessel which through some exceptional circumstance is unable to maneuver as required by the regulations and is therefore unable to keep out of the way of another vessel.”

NTSB Marine Accident Report 8

Figure 4. CO2 system activation station postaccident. Both actuation valves are in the open position. Both the safety officer and staff captain communicated to the bridge that there was a high concentration of smoke building in both garages B and C. At 0738, the safety officer announced to the command center that she had relocated the staging area to garage C forward due to the smoke and directed the fire squads and boundary cooling team to that location. At 0740, the bridge command center requested that boundary cooling be conducted in garage B directly above the engine room. The staff captain replied that there was “too much smoke in garage B and C” and requested to open the forward main ramp/door to clear the smoke out. The master denied this request as he did not want to add wind and air to the car deck. None of the boundary cooling team members had SCBAs or fire-protective equipment, and thus they were unable to access the area in garage B above the engine room. Concerned about the smoke in the garages, the master directed the activation of the drencher system for garage B at 0742. The staff captain went to the drencher room on deck 5, where he met the first engineer. The staff captain told investigators that he activated the system by opening the valves for all of garages A and B. The first engineer, who was assigned to activate the system by the emergency plan and station bill, also told investigators that he opened the valves, including the valves for garage C.

NTSB Marine Accident Report 9

At 0745, one long signal was automatically sounded on the ship’s general alarm by the fire detection system.13 Investigators could not determine if this alarm was broadcast throughout the ship or only to specific spaces. For the next 5 minutes, multiple radio calls to the bridge from various personnel and teams throughout the ship were unanswered or not acknowledged. The second officer who was off watch radioed the bridge to report heavy smoke on deck 5 aft, the safety officer relayed information that there was smoke in garage B and that there was oil coming from the port side bunker station on that same deck, and the medical team checked in. The calls were recorded on the Caribbean Fantasy’s voyage data recorder (VDR), but there was no response from the bridge to any of the calls.14 At the time the radio calls went unanswered, the master, second officer (on watch), and cadet were occupied with communications with the Coast Guard and announcements to the passengers. The master ordered a PA system announcement to inform the passengers of the fire and to direct them to follow the instructions of the crew. At 0746, the announcement was made in English by the deck cadet, using a prewritten script, to all areas of the vessel. Immediately following this announcement, the second officer (on watch) made an announcement in Spanish. The announcement followed a different prewritten script that stated the fire was not under control and, “it has been decide [sic] to abandon the vessel.” It further directed all crew to their survival craft embarkation stations. When the master was interviewed by investigators after the accident, he stated that he ordered only the announcement that was made in English and not the announcement in Spanish. He further stated that, because he did not speak Spanish, he would not have understood the second announcement. Upon hearing the announcement from the bridge to abandon the vessel, the fire teams evacuated the staging area and proceeded to their respective survival craft embarkation stations. No active firefighting or boundary cooling was attempted by the crew during the accident. 1.3.2 Abandonment and On-Scene Rescue Operations Coast Guard Sector San Juan had been monitoring VHF radio traffic and, after hearing the Caribbean Fantasy’s announcement that it was not under command, contacted the vessel at

1. The second officer (on watch) replied that there was a fire in the engine room, that CO2

had been released, and that the vessel was not under command just north of the entrance to San Juan harbor. About 3 minutes later, the second officer told the Coast Guard that the crew was going to make an “announcement for evacuation; we need assistance immediately.” In response, Sector San Juan dispatched Coast Guard small boats to proceed to the scene. Having heard the radio traffic, multiple towing vessels and other good Samaritan vessels also began moving from the harbor out to the Caribbean Fantasy’s location.

13 The ship’s fire detection system was wired to the ship’s general alarm system. When alarms from the fire detection system went unacknowledged or unsilenced for more than 2 minutes, the general alarm system was activated. During the accident, there were six instances (0745, 0810, 0845, 0854, 0919 and 1015) of one prolonged signal of the general alarm with no evidence that the signal was intentionally sounded by the crew. The only intentional sounding of the alarm was at 0758 by the deck cadet. 14 VDRs maintain continuous, sequential records of data relating to a ship’s equipment and its command and control and capture bridge audio from certain areas in the pilothouse and on the bridge wings. SOLAS regulation requires all passenger ships and all cargo ships of 3,000 or more gross tons (International Tonnage Convention), built on or after July 1, 2002, to carry VDRs.

NTSB Marine Accident Report 10

About this time, the chief of Sector San Juan’s Response Department was on the bridge of the Coast Guard fast response cutter Joseph Tezanos (WPC 1118) in port in San Juan. The Joseph Tezanos was a new cutter that had recently arrived in its homeport. It was not yet fully commissioned on the day of the accident, and the crew was preparing for a final readiness inspection intended to prove that both the vessel and its crew were fit for service. There was a need for a cutter on scene at the Caribbean Fantasy accident site to coordinate and communicate with all the assets responding, but the nearest commissioned cutter was under way and unable to respond in a timely manner. Therefore, the Response Department chief asked the commanding officer of the Joseph Tezanos if he and the crew were ready for this tasking. The response was affirmative. At 0747, the Coast Guard radioed the Caribbean Fantasy and asked how many people were on board. The response from the ship was that there were “five one two” passengers and crew on board. (There were, in fact, 511 people on board after a passenger had disembarked the night before.) The Coast Guard then asked if the Caribbean Fantasy had any personal flotation devices (PFDs) and liferafts on board and, if so, what color the PFDs and rafts were. The bridge crew replied that the ship did have them. The number of lifeboats on board was also communicated to the Coast Guard, who again requested the color of the liferafts. Communications continued between the Caribbean Fantasy bridge and the Coast Guard as they sorted out confusion regarding the number and capacities of lifeboats and liferafts on board. The Coast Guard asked if the liferafts were filled. The second officer (on watch) responded that the master had not yet ordered abandon ship and that the passengers were at their evacuation stations. At 0749, the safety officer, speaking through an SCBA, reported to the bridge that there was a “big explosion” in garage B. The master requested to know if the drencher was working. The staff captain, who was still moving about the ship, replied that he had started the pump but could not verify that it was working. The safety officer then reported that there was “nothing coming in garage B.” About 3 minutes later, the chief engineer radioed the master and stated that the drencher system was working. At 0754, the master ordered the Caribbean Fantasy crew to deploy the ship’s marine evacuation systems (MESs). As designed, an MES and associated liferaft containers are deployed in an emergency, with passengers and crew sliding down the MES’s 83.7-foot-long (25.5-meter-long) inflatable slide to an inflated platform floating on the water. All liferaft containers are connected together by retrieving lines and the first container is connected to the MES floating platform by a retrieving line. The liferaft containers are launched one at a time from the ship, and the rafts do not automatically inflate upon entering the water. Instead, crewmembers assigned to the platform are expected to pull the first liferaft container to the platform using the retrieving line and inflate the raft at the platform. The second liferaft is then launched, pulled to the platform, and inflated. Passengers then board the two liferafts until at capacity, after which the liferafts are cut away and crewmembers pull the next two liferaft containers to the floating platform. Boarding continues until the evacuation is complete.15 The system is designed for all assigned people to be transferred from the ship to inflated liferafts within 30 minutes.

15 VIKING LIFE-SAVING EQUIPMENT A/S, Manual, VIKING Marine Evacuation System, M/V Caribbean Fantasy, 1999.

NTSB Marine Accident Report 11

Figure 5. Overhead drawing of the port and starboard MESs, with names of the main system components. Note: although the illustration shows two fast rescue boats (labeled as “MOB boat”), the Caribbean Fantasy was equipped with only one. (Source: Manual, VIKING Marine Evacuation System, M/V Caribbean Fantasy, 1999) At 0756, Coast Guard Sector San Juan issued an urgent Pan-Pan message to all vessels on VHF radio channel 16 about the Caribbean Fantasy engine room fire.16 The message requested that mariners assist if possible and make reports to Sector San Juan. On board the Caribbean Fantasy, at 0756, the bridge was informed by phone that all passengers and crew had been evacuated from the ship’s internal spaces. However, about a minute later, the safety officer radioed the bridge and requested that one long signal be sounded on the ship’s alarm system because there were still people on deck 5. This signal, according to the ship’s emergency plan and station bill, was the “prepare for abandon ship signal” and directed all persons on board to go to their survival craft embarkation stations where, upon verbal command from the master, the abandonment of the ship would take place. The second officer (on watch) directed the deck cadet to sound the signal, which was recorded by the Caribbean Fantasy’s VDR at 0758. The first Coast Guard small boat (CG 45751) arrived on scene about a minute after the signal was sounded. About the same time, the bridge was attempting to reach both the port and starboard MES operators by radio to give them instructions to prepare each for deployment. These multiple calls went unanswered. Therefore, the second officer (on watch) radioed the third officer and directed

16 Pan-Pan is a VHF radio transmission indicating that there is an urgent situation but no immediate danger to a person's life or to the vessel. The vessel or station transmitting the message begins by saying “Pan-pan, Pan-pan, Pan- Pan” and follows with the urgent message.

NTSB Marine Accident Report 12

him to go and prepare the portside MES. When later interviewed by investigators, the safety officer and staff captain stated that they also went to the MES stations to help with launching preparation. The Caribbean Fantasy had one fast rescue boat stowed on the port side of the ship that was designated for use in emergencies, such as a man overboard or an oil spill. According to the operating instructions for the MES, the fast rescue boat was tasked with keeping the launching area clear of any obstructions, hauling liferaft containers to the floating platform, and hauling inflated and fully embarked liferafts away from the platform. However, there were no instructions found in the Caribbean Fantasy’s emergency plan and station bill for use of the fast rescue boat during abandonment. Instead, there were instructions for lifeboat no. 3 to be positioned in the vicinity of the MES to assist in marshalling liferafts. At 0802, the second officer (on watch) announced that the portside MES was on the water and asked the master if the crew should launch the fast rescue boat to provide assistance to the rafts and the MES platform. The master declined and stated that they would ask the Coast Guard to assist. When investigators asked the master why he did not order the fast rescue boat lowered, the master stated that the reason was the presence of Coast Guard response vessels and that he needed to keep the crew that normally operated the fast rescue boat on board to continue helping with the emergency. The master radioed the Coast Guard small boat to request assistance with gathering the liferafts and bringing them to the MES on the port side. The boat crew responded that they would stand by on the port side of the ship. The master then ordered the launch of all 12 liferafts from the portside rack. About the same time, a second Coast Guard small boat (CG 33139) reported that it was on scene. In the midst of radio communications with the Coast Guard small boat, the master announced, “Stop the drencher.” The drencher had been in operation for about 20 minutes. When investigators later asked the master why he ordered the drencher to be stopped, he recalled that the vessel was starting to list to port. He said he was concerned about the amount of water on the car decks and its effect on the ship’s stability. The wind at the time was on the starboard beam of the ship, which induced a heel to port. As a result, the water from the drencher pooled on the port side of the garages. At 0803, the ship was about 2 miles north-northwest of the entrance to San Juan harbor on a northerly heading and drifting to the west-southwest at about 1 knot. The master stated that his original intention was to use the portside MES for the evacuation. Given the ship’s heading, which put the wind and seas on the starboard side, the lee (calmest sea conditions) was on the port side. However, the staff captain reported that smoke was blowing onto the portside MES station, which he considered to be a risk if persons were to evacuate to that side. Additionally, there was a problem with the MES: the slide angle was too steep (“near vertical,” according to the staff captain) for passengers and crew to slide down. Based on the staff captain’s report, at 0804, the second officer (on watch) asked the safety officer to prepare the starboard-side MES. Accordingly, the safety officer ordered all MES preparation teams to that MES. The bridge also ordered the liferaft preparation teams to release the rafts on the port and starboard side. When interviewed, the staff captain told investigators that he activated the remote releases for the liferafts on the port side of the ship before proceeding to the starboard side. However, only 1 of the 12 liferafts dropped from the port rack to the water. Another crewmember told investigators that he was the one who had released one of the portside raft cannisters into the water. About this time, more Coast Guard small boats were deployed from Sector San Juan to the scene (CG 33114 and CG 33137).

NTSB Marine Accident Report 13

Figure 6. Port side of Caribbean Fantasy on the day after the accident. Note the angle of the MES and the single liferaft container floating in the water. At 0808, the master ordered the embarkation of lifeboat no. 2. According to crewmembers interviewed, once lifeboat no. 2 was lowered to the embarkation deck, there was a gap between the lifeboat and the ship’s side because the ship was listing about 4 degrees. This gap was too wide to embark passengers, so the crew hoisted the boat back up and adjusted the forward and aft bowsing/tricing gear to the correct length and tension of the gear. (Bowsing/tricing gear is designed to pull in and hold the boat against the side of the ship at the embarkation deck for conditions of ship movement or list.) While this was taking place, the master directed crew and passengers at the embarkation station for lifeboat no. 2 to go to the embarkation station for lifeboat no. 1 and board that lifeboat. When lifeboat no. 2 was lowered back to the embarkation deck, the gap was closed. Once the problem with the gap was resolved, the master was informed that the boat’s commander (the third officer) and first engineer were missing. (Both had moved to lifeboat no. 1 as directed by the master while the gap at the lifeboat no. 2 embarkation station was corrected.) In response, the master directed the chief engineer via the ship’s internal radio to have someone from the engine crew go to lifeboat no. 2; he did not receive a reply. The second officer (on watch) then called the third officer, who was now on the starboard side, and directed him back to lifeboat no. 2. Recognizing at 0812 that liferafts had not yet been released on the starboard side, the cadet requested by radio for the MES preparation and launching team to release the liferafts from the starboard side.

NTSB Marine Accident Report 14

The master then ordered the crew to prepare lifeboat no. 3. Upon hearing the order, the second officer (on watch) asked who should command lifeboat no. 3, because he was the assigned commander. In response, the master ordered the second officer (off watch) to take lifeboat no. 3. The second officer (on watch) stated over the radio that he would then take lifeboat no. 1. At 0818, the staff captain at the starboard-side MES station reported to the bridge that the “line is broken,” referring to the MES’s bowsing line. The bowsing line was a rope that ran from the MES platform to a winch on the ship. It was designed to adjust tension on the slide and platform, thereby enabling the system to be in the best position for use. Although directed to command lifeboat no. 3, the second officer (off watch) boarded and took command of lifeboat no. 1, the boat he was originally assigned to. At 0819, the bridge was informed that lifeboat no. 1 was ready to be lowered with 100 people on board. The master gave the order to do so. At 0823, the master asked the safety officer by radio if the fire was under control. He received a response that the garages were still full of smoke. Upon receiving the report, the master called Coast Guard Sector San Juan and stated “I’m sending all the passenger[s] on the evacuation now by the lifeboats. I cannot control the fire.” Two minutes later, the commander of lifeboat no. 1, which was now in the water, reported that he was unable to release the hooks that connected the boat to the davit falls (wire ropes). The master replied, “The release works; you don’t know how it works, but it works.” The lifeboat no. 1 commander was then given instructions over the radio to break the clear plastic cover on the hooks’ release mechanisms, which was an override procedure for the hooks’ hydrostatic interlock systems. About 0829, the crew in lifeboat no. 1 was still attempting to open the release hooks when an unidentified person either jumped or fell in the water. Video taken from a passenger’s mobile phone captured a second person jumping in the water from the lifeboat. The master requested assistance in rescuing the people, and both were rescued by a nearby Coast Guard small boat.

Figure 7. Lifeboat no. 1 in the water and unable to open the release hooks, about

1. (Photo provided to Coast Guard by a Caribbean Fantasy passenger)

NTSB Marine Accident Report 15

The lifeboat no. 1 crew eventually freed the boat from the hooks by removing each lifting eye from the closed hook by hand. The crew then attempted to clear the boat away from the ship, but, according to the first engineer who was on board, the engine started but did not have any thrust. The lifeboat was also taking on water, so one of the arriving tugboats, the Diane Moran, transferred the passengers and crew to the deck of the tugboat. The empty lifeboat no. 1 was later towed into San Juan harbor by the Coast Guard. At 0837, the master gave orders to lower lifeboat no. 2. According to the commander of the boat, once lifeboat no. 2 was in the water, he was unable to open the hooks using the release handle, so the crew had to manually remove each lifting eye from the closed hook by hand. When clear of the blocks and the ship, lifeboat no. 2 was escorted under its own power by a Coast Guard small boat into the port of San Juan. The commander estimated he had 105 passengers on board, together with 4 crew. Passengers and crew lined up on deck 7 aft of lifeboat no. 3 as it was prepared for embarkation. However, embarkation of the boat was delayed because there was no commander for the boat. Consequently, the master ordered the second officer (on watch) to go to lifeboat no. 3. From then on, only the master and the cadet remained on the bridge. At 0847, the master ordered lifeboat no. 3 to be lowered when ready. About 6 minutes later, when the boat was in the water, the boat commander reported that the crew was unable to open the release hooks. In response, the master ordered the commander to try to release the hooks manually. At 0854, the commander informed the master he could not manually release the hooks, and, after all attempts to release the hooks failed, the commander reported that the boat was getting damaged from waves pushing it against the Caribbean Fantasy’s side. While lifeboat no. 3 continued to lay against the side of the ship, the master turned his attention to the starboard MES, ordering all 11 starboard-side liferafts inflated. He then ordered the staff captain to assign a crewmember to go down the slide and work on gathering the rafts around the platform. The staff captain responded that the slide was not opening as it should and, if anyone was sent down, an accident could result. The master told the staff captain that from his view on the starboard bridge wing the slide looked fine and that the staff captain should send a crewmember down. About this time, more response vessels began arriving on scene, including a boat from Customs and Border Protection (CBP), two police boats, a fire department boat, five tugboats, a Marine Spill Response Corporation boat, a second pilot boat, and several good Samaritan vessels. In addition to the Coast Guard small boats, a 55-foot-long aids to navigation (ATON) boat, CG 55115, proceeded to the accident site.17 Two Coast Guard MH-65 helicopters and a Fuerzas Unidas de Rápida Acción (United Forces of Rapid Action―FURA) Bell 429 helicopter also responded to the scene.

17 ATON boats are industrial platforms used by the Coast Guard to maintain the buoys, day boards, ranges, and other fixed aids along US waterways. Source: Coast Guard, Coast Guard Compass, “Coast Guard Boats,” August 19,2017, http://coastguard.dodlive.mil/2017/08/coast-guard-boats/.

NTSB Marine Accident Report 16

Meanwhile, the Joseph Tezanos had received approval and tasking from Coast Guard Sector San Juan to respond to the accident and for the commanding officer to assume duties as on-scene coordinator (OSC) for the search and rescue (SAR) operation.18 The cutter arrived on scene at 0850, according to the vessel’s log. Although the crew also logged that the commanding officer assumed duties as OSC, neither the cutter nor Sector San Juan formally conveyed this to the Caribbean Fantasy’s master or other vessels in the area. The commanding officer later stated that he believed that the vessels and aircraft on site understood that the Joseph Tezanos was coordinating the rescue efforts. The Joseph Tezanos commanding officer assigned dedicated personnel to handle radio traffic on the internal Coast Guard frequency, various VHF radio channels, and a radio channel for aircraft. He also established a 15-minute communications schedule with the Sector San Juan command center using a Coast Guard cell phone, and he assigned an individual to record the event using the vessel’s surveillance camera system. The command center also monitored all radio communications between the OSC and SAR assets. Using VHF channel 16, the Joseph Tezanos crew communicated with the master and other crewmembers of the Caribbean Fantasy in English while communicating with some of the other response vessels in Spanish. The cutter commanding officer told investigators that he had suitable communications with the Coast Guard vessels, tugboats, and pilot boats on scene. However, communications with the San Juan fire department boat and the San Juan police department boat were intermittent.

Figure 8. US Coast Guard fast response cutter Joseph Tezanos (WPC 1118) on the day of the accident. (Photo by Coast Guard)

18 The OSC is a person designated to coordinate SAR operations in a specified area. The OSC should be the most capable person available, taking into consideration SAR training, communications capabilities, and the length of time that the unit the OSC is aboard can stay in the search area. Source: IMO, International Aeronautical and Maritime Search and Rescue (IAMSAR) Manual, Resolution A.894(2), November 29, 1999.

NTSB Marine Accident Report 17

Aboard the Caribbean Fantasy, the starboard-side MES had been deployed, but no passengers had yet descended to the platform and embarked the liferafts. The master once again ordered the staff captain, who was near the starboard-side MES landing (the location where people would board the slide), to send a crewmember to the floating platform to pull in liferafts. This was necessary before any passengers started down the slide. A crewmember went down the slide and, once he was on the platform, attempted to pull the liferafts alongside. When integrated with the MES, the liferafts should have remained in their containers when they were released to the water. The rafts that had dropped from the starboard side had inflated, however, and it was difficult to pull the rafts to the platform by hand in the winds and seas. Consequently, the master made multiple requests for the Coast Guard to position the rafts at the platform using their boats. The deck cadet also requested that all vessels near the Caribbean Fantasy pick up any liferafts and bring them to the platform for the embarkation of passengers. According to Coast Guard records, the first report of people going down the starboard-side slide was at 0853. However, at 0906, the master observed that there were not enough rafts at the MES platform. He ordered the staff captain to hold off on sending any passengers down and to send only crew down to help pull the liferafts to the platform. By 0912, liferafts had been pulled alongside the MES platform, but the large openings in the raft canopies that allowed for mass boarding were facing away from the platform. With the smaller opening facing the platform, the loading process was slowed. The master contacted the Coast Guard by radio and requested assistance with the raft alignment. After some confusion due to the master’s accent and use of unfamiliar terminology, the OSC responded that assistance would be provided to help turn the liferafts.

Figure 9. Liferaft at the starboard-side MES platform with the main access opening facing away from the platform, about 0923. (Photo by Coast Guard) About 2 minutes later, the master ordered the staff captain to send the maximum number of people to the liferafts via the starboard MES. He then radioed the Coast Guard and requested emergency assistance to lifeboat no. 3, stating that there were “close to 100 pax” (passengers) inside the boat and that the release hooks could not be opened. As a result, the lifeboat was hitting the ship’s side and taking on water. The OSC responded that a 33-foot-long small boat was being sent to lifeboat no. 3.

NTSB Marine Accident Report 18

About 0916, the crew hoisted lifeboat no. 3 back out of the water. During the hoist, the winch tripped off line, leaving the boat suspended about 6 feet above the water. (The prime mover for the winch was designed to lift the lifeboat with a crew of six only and not a fully loaded lifeboat.19) With the boat hanging at the ship’s side and unable to be lowered, none of the Coast Guard small boats were able to be effectively positioned to remove people from the lifeboat. The master, who was monitoring this from the starboard-side bridge wing, requested assistance from the Coast Guard ATON boat, which had a higher freeboard (nearly 6 feet). The OSC responded by directing the ATON boat to lifeboat no. 3. About 1000, the ATON boat began extracting people from the lifeboat, a process that was slowed by the height of the lifeboat and the motion of the vessels in the seas. The lifeboat commander told investigators that as the passengers were transferred to the Coast Guard vessel, he had to convince some passengers who were beginning to panic not to jump into the water. The transfer of all passengers and crew from lifeboat no. 3 took about an hour and a half to complete.

Figure 10. Caribbean Fantasy, about 1015, during the final stage of abandonment, with its starboard anchor down. (Photo by Coast Guard) Evacuation of the remaining passengers by MES continued as vessels in the area brought liferafts to the platform. At 0923, the master reported to the Coast Guard that one of the liferafts that was filled with people was let go from the platform and was drifting away from the ship toward the shore line. The OSC responded by sending a small boat to recover the raft.

19 Schat-Harding, Installation, Operation and Maintenance Manual, VIP Davits/W-winches, ed. 971117, page 6.

NTSB Marine Accident Report 19

From then on, each liferaft was filled at the platform one at a time. When a liferaft was full, it was towed away from the ship by a Coast Guard small boat. Once a raft was clear of the platform, the passengers and crew were transferred to another vessel. The passengers and crew were then taken to the port of San Juan. At San Juan’s pier 6, the receiving area designated by the Coast Guard mass rescue operation (MRO) plan, the passengers were accounted for, triaged, and processed by CBP. Fifteen minutes after its arrival on scene, the FURA helicopter had begun ferrying shore-based firefighters, Puerto Rico police rescue personnel, and Puerto Rico Emergency Management Agency (PREMA) personnel out to the Caribbean Fantasy and deploying them on board. By about 0925, a total of 14 persons were landed on board with SCBAs and personal protective equipment. The master later informed investigators that he did not authorize, nor was he aware of, the landing of shore-based firefighters and first responders on board. Coast Guard Sector San Juan command center personnel were also unaware of the three shore-based fire teams on board. According to the Coast Guard captain of the port (COTP), he learned of this only after speaking to the fire chief when they were at the San Juan pier 6 receiving site. Once on board, the shore-based teams staged themselves near the emergency diesel generator room on the starboard side of the ship on deck 7 forward. According to one of the firefighters, on at least two occasions the firefighters made attempts to gain access to the engine room. The chief engineer was asked to accompany the firefighters because he was most familiar with the location of the fire and how to get around the ship. On the first access attempt, a firefighter reported seeing fire on the way down to the engine room. Given the poor visibility, the exact location where the fire was sighted could not be confirmed. During the second access attempt, the firefighter explained that they were able to make it down about two decks via a stairway near the galley on deck 5 but were then forced back because of the smoke and heat. At 0948, the OSC asked the master how many persons remained on board. He replied that he did not have a complete count, but about 70 people remained, including crewmembers. He requested assistance in getting the two nearby liferafts to the platform and stated that, once delivered, he could have everybody off in 5 minutes. The master also requested that a vessel pull the MES platform forward (toward the Caribbean Fantasy bow) to make a better angle for the slide, noting that there were injuries because of the existing steep angle. About 1009, a Coast Guard small boat attached a line from its bow to the MES platform. Operating in astern propulsion, the small boat pulled the platform forward as requested by the master. About 2 minutes later, upon seeing an improvement in the angle of the slide, the master ordered the staff captain to send the remaining passengers and crew down.

NTSB Marine Accident Report 20

Figure 11. Bow of Coast Guard small boat, about 1012, as it began to pull the starboard-side MES platform forward, with another small boat holding a liferaft to the platform. Two evacuees with lifejackets are on the slide, while many others are looking over the ship’s side from the deck above the MES embarkation landing. (Photo by Coast Guard) The Caribbean Fantasy was still adrift and setting in a southwesterly direction. Recognizing that the vessel was nearing shoal water, the tugboat Diane Moran made up to a mooring line from the ship in an attempt to hold the vessel. However, the captain of the Diane Moran expressed concern about towing the ship ahead and the effect it would have on the angle of the MES slides and platform; if he pulled the ship ahead, the MES platforms would move aft. At 1012, he recommended to the OSC that the Caribbean Fantasy drop anchor. The OSC relayed this recommendation to the master, who in turn ordered the starboard anchor dropped and held to six shackles in the water.20 The ship continued to drift, however, and its stern grounded on a sandy bottom about 1021. About the same time as the anchor was dropped, a Coast Guard MH-65 helicopter, which had been flying a pattern around the ship on guard for persons in the water, was directed by Sector San Juan to evacuate as many people as possible from the ship via hoist operations. The helicopter came into a hover over the designated hoist area on the Caribbean Fantasy and lowered a rescue swimmer to the deck. The rescue swimmer then directed the evacuation of predominantly elderly and disabled passengers to the helicopter via basket hoist. When the helicopter was at full capacity with four passengers, it departed with the rescue swimmer to take the passengers to Isla Grande airport, about 4 miles away. Another Coast Guard helicopter then arrived to continue hoist operations. A total of eight persons and one dog were retrieved by Coast Guard helicopters. Four dogs were also taken off the ship by the FURA helicopter. (The remaining two dogs were unaccounted for and were later found deceased on board the ship.) At 1023, the master made three attempts to hail the “Coast Guard commander” on VHF channel 16. After each call, the Coast Guard cutter crew responded, “cutter Joseph Tezanos.” After the third response from the cutter, the master then asked, “are you the Coast Guard commander?” The response was “Yes, we are the Coast Guard cutter located off the starboard side of your ship.”

20 One shackle is 90 feet (27.4 meters).

NTSB Marine Accident Report 21

This was the first time that the master understood that the Joseph Tezanos commanding officer was the OSC. The master later told investigators that he recalled hearing “Joseph Tezanos” over the radio before this exchange but thought the communications were referring to someone’s name and not the OSC’s vessel. The fire continued to burn on the Caribbean Fantasy throughout the abandonment of the ship. The intense heat generated by the fire caused paint on both sides of the ship to blister and eventually burn off, falling into the water. On the starboard side of the ship, this included paint above the waterline, forward of the MES, and adjacent to the engine casings extending from the engine room to the stacks. Although close to the MES, none of the pieces of paint that fell came into contact with the slide, platform, or any of the liferafts.

Figure 12. On the left, at 0853, paint is starting to blister at the waterline. On the right, at 1049, large pieces of paint are missing from the ship’s side starting at the waterline and extending to the stack. (Photos by Coast Guard) About 1030, the master informed the OSC that the last of the passengers had abandoned the ship. He then coordinated with the safety officer and staff captain to release the crew from their stations. This included the crewmembers manning the starboard-side MES. The remaining persons arriving at the MES platform were picked up directly by Coast Guard, CBP, and good Samaritan vessels and brought to pier 6. Video taken from the Joseph Tezanos showed the last person coming down the slide at 1104. At 1119, the master informed the OSC that there were 6 people remaining on board. (The transfer of people from lifeboat no. 3 was ongoing, with the last person transferred to the ATON boat about 1130.) The emergency plan called for pursers and assistant pursers assigned to each muster station to conduct a “roll call” of passengers and crew. However, the hotel director told investigators that the roll call of passengers did not take place because passengers were ordered to embark survival craft shortly after receiving the order to proceed to their muster stations. Although there was no full accounting of passengers and crew, the master stated that he was confident no one remained on board because the crew had conducted several sweeps of the accommodation and public spaces. Once the starboard MES was no longer manned, the platform and slide drifted away from the ship, which allowed a tugboat and firefighting vessel to spray the ship’s side to cool the burning areas.

NTSB Marine Accident Report 22

Only five crewmembers remained on board the Caribbean Fantasy: the master, the staff captain, the safety officer, the chief engineer, and the chief electrician. The OSC requested that all remaining persons leave the ship, but the master responded that shore-based firefighters were still on board and that they had requested that the chief engineer and chief electrician remain behind to help with firefighting efforts. The master stated that it was his wish to remain on board with the shore-based firefighters and his crew accompanying them. At 1150, the master replied to the OSC that he would try to reach the firefighters to direct them to leave the ship, but they were down in the engine room. The master was able to contact the chief engineer and firefighters, and he ordered them to the helicopter deck. Once there, he reported to the OSC that he had all remaining crew and that they were ready to depart the vessel. About 1224, the FURA helicopter landed on deck and picked up the remaining five crew, leaving the shore-based firefighters behind. After transporting the crew to the airport, the helicopter returned to the Caribbean Fantasy to pick up the shore-based firefighters, making two separate trips. All persons were off the ship just before 1300. At 1320, the OSC established a 1,000-foot security zone around the Caribbean Fantasy to prevent unauthorized vessels or aircraft from approaching the vessel. At 1422, the Coast Guard cutter Richard Dixon arrived on scene and its commanding officer assumed the role of OSC from the Joseph Tezanos’ commanding officer. The commanding officer of the Joseph Tezanos stated to investigators that he had never participated in an MRO exercise, nor had he experienced a SAR case of this nature previously. The Coast Guard crewmember on the Joseph Tezanos that was assigned VHF radio channel 16 also indicated that he had no formal training related to the MRO or the lifesaving systems such as the MES on board the Caribbean Fantasy. The Caribbean Fantasy remained aground outside the port of San Juan for 3 days, and the fire continued. On August 20, the vessel was towed into the port, where the fire was extinguished by marine salvage and firefighting crews. 1.3.3 Shoreside Rescue Operations In fiscal year 2002, the US Congress authorized the Coast Guard to create permanent positions in the agency to develop and maintain an MRO program. The program, now called the Passenger Vessel Safety Program, requires the Coast Guard to plan and prepare for MRO events and includes periodic exercises incorporating the agency’s many federal, state, and local emergency response partners. Each of the Coast Guard districts has an individual passenger vessel safety specialist (PVSS) assigned to execute the elements of the program. Although a sector is subordinate to a district, Coast Guard Sector San Juan has its own PVSS assigned due to the significant number of large passenger vessels that operate in that command’s area of responsibility, which includes a large portion of the eastern Caribbean and the US Virgin Islands. Sector San Juan’s PVSS maintained and regularly exercised the elements of the unit’s MRO plan, and the plan was last revised in January 2016. When the PVSS was informed of the fire on board the Caribbean Fantasy, he proceeded to the Sector San Juan command center to assist. Upon arrival, he spoke with the commanding officer, the chief of the Preventions Department, and other senior command representatives about the landing site for the passengers and crew to be taken ashore. Earlier in the year, San Juan’s PVSS had held an MRO planning meeting with emergency response personnel in the San Juan area, and the attendees at that meeting had agreed that Pier 6 in the port of San Juan was the preferred landing spot for survivors during an actual MRO. Pier 6 was chosen because it was lower

NTSB Marine Accident Report 23

than most of the other nearby locations and had a floating dock that was accessible by small rescue vessels with low freeboard. After discussing the landing site with Sector San Juan leadership, the PVSS proceeded from the command center to Pier 6, which was approximately 1 mile from the unit, assumed the role as landing site manager, and began to coordinate with other emergency responders to clear access routes and assist with the setup of staging areas to accommodate the survivors. Other organizations responding shoreside included the CBP; FURA; and the City of San Juan’s emergency operations center (EOC), emergency medical services (EMS), police, and fire department. The various organizations established an incident command post and reception facility on Pier 6 to manage the response. A triage station was also set up on the pier to assess each passenger’s medical condition. When passengers began arriving ashore, EMS transport units took individuals needing medical treatment beyond first aid to one of nine medical facilities in the area.

Figure 13. Passengers and crew from Caribbean Fantasy lifeboat no. 2 disembarking at Pier 6, port of San Juan, about 1015. (Photo by Coast Guard) 1.4 Background 1.4.1 The Vessel Caribbean Fantasy was built by Mitsubishi Heavy Industries in Kobe, Japan, and completed in 1989. Originally named the Victory, the vessel sailed with the Higashi Nippon Ferry services in Japan from 1989 to 1998 and with the Grandi Navi Veloci services in Italy from 1998 to 2008. The vessel was purchased in early 2008 by Baja Ferries S.A. de C.V., renamed the Chihuahua Star, and put into service in the Gulf of California under the flag of Mexico. In the spring of 2011, the company began the process of shifting the operations of the vessel from Mexico to scheduled runs between the ports of San Juan and Mayaguez, Puerto Rico, and Santo Domingo, Dominican Republic, under a time charter agreement with America Cruise Ferries, Inc. On October 21, 2011, the company officially changed the name of the vessel to

NTSB Marine Accident Report 24

Caribbean Fantasy and changed the flag to Panama. Although marketed as a cruise ferry, the company had no affiliation or membership with any cruise industry trade groups. The ship’s propulsion system consisted of two 14,400 hp (10,738 kW) medium-speed diesel engines driving two controllable-pitch propellers. The Caribbean Fantasy had three diesel electric generators that powered the vessel’s various equipment and electrical systems. The Caribbean Fantasy was subdivided into five main vertical zones (MVZs) that provided both watertight integrity and thermal containment. The thermal containment divisions were rated at “A-60” class, which indicated that they were designed to limit the transmission of heat, flames, and smoke to an adjacent or overhead area for a period of 60 minutes. The ship also had two main horizontal zones (MHZs) subdividing the garage decks, with A-60 insulation in between. Six watertight doors provided access between the MVZs.

Figure 14. Profile of Caribbean Fantasy showing garages and fire zones. 1.4.2 Shipboard Organization Deck Department. The Caribbean Fantasy’s deck department organization followed cruise industry practices. The ship’s master was overall in command, with the staff captain as second in command. The staff captain was responsible for the deck department and all deck operations, including safety. The staff captain did not occupy a watchkeeping position and was typically on the bridge for arrivals, departures, emergencies, or at any time as determined by the master. The safety officer reported to the staff captain and was responsible for all crew safety training, maintenance and inspection of safety equipment (excluding fixed firefighting systems), and compliance with the ship’s emergency plan and station bill. The ship had three watchkeeping officers (two second officers and one third officer) each of whom worked one of the traditional watchkeeping periods of 8−12 (AM and PM), 12−4, or 4−8. In addition to their watchkeeping duties, the watchkeeping officers had maintenance and inspection duties. The senior deck rating, the bosun, reported to the staff captain and supervised all deck maintenance activities. The deck department was responsible for the maintenance and upkeep of the ship’s hull and superstructure, crew emergency duty training and compliance, lifesaving and firefighting equipment maintenance, and operational readiness. Engine Department. The chief engineer reported to the master and was responsible for the engineering spaces and machinery. He was also responsible for monitoring the condition of fixed and mobile firefighting systems and appliances and ensuring that they were in constant readiness. The first engineer was subordinate to the chief engineer and was responsible for the

NTSB Marine Accident Report 25

maintenance of the main engines and auxiliary equipment. He did not stand a watch but oversaw all maintenance and repair activities with the engines. There were three watchkeeping engineers (a second engineer and two third engineers), and each worked the traditional 8–12, 12–4, and 4–8 watch schedule in parallel with bridge personnel. Normally, two motormen were also assigned to each watch and carried out routine inspections, maintenance, and rounds in the engine spaces. However, just prior to the accident, one of the six motormen signed off the ship and his position on the 4–8 watch was filled by a wiper. The remainder of the engine department staff were dayworkers who did not stand watch. Hotel Department. The largest department on the ship was the hotel department, which was under the supervision of the hotel director. The hotel director reported to the master and was responsible for all hotel operations, such as passenger comfort and accommodations, food and beverage preparation and delivery, bar and galley spaces, passenger entertainment, and onboard revenue. During an emergency, the hotel director and his staff were responsible for the evacuation, mustering, and accountability of the passengers. 1.4.3 Emergency Plan and Station Bill The emergency plan and station bill provided all crewmembers with their emergency duties and survival craft assignments. It outlined the ship’s emergency signals and specific teams that were designated to respond to emergencies such as a fire, man overboard, oil spill, security incident, medical emergency, general emergency, or abandonment. Investigators found two different versions of the emergency plan and station bill on board the Caribbean Fantasy following the accident. A plan found posted in the engine control room was stamped “approved” by the vessel’s classification society, RINA Services S.p.A, and dated February 2, 2016.21 Another plan found on the bridge was stamped “provisionally approved” and dated July 3, 2016 (the date that the vessel left the Tunisian shipyard). The two plans differed significantly, with variations in survival craft assignments, code words and signals, and emergency duties of crewmembers. For example, the code for a fire emergency in the February plan was “red-red-red,” while the code for the same emergency on the July plan was “Mr. Skylight.” Prior to 2016, the Caribbean Fantasy had used an emergency plan and station bill for an extended period of time, and the crew was familiar with this plan. According to statements by crewmembers and company representatives, the plan that was introduced on February 2, 2016, implemented several changes to the previous plan and required training and familiarization with the crew. However, soon after the February plan was approved, most of the hotel crew left the ship when the Caribbean Fantasy entered the Tunisian shipyard. The crew rejoined the ship less than a week before the US Coast Guard port state control inspection, and thus they had little time to become familiar with and train on the February plan. Therefore, in order to successfully complete the inspection, the decision was made to revert back to the former plan that the crew was familiar with. The former plan was reinstated with the approval of the July 3 emergency plan and station bill and was in effect during the accident voyage.

21 Classification societies are nongovernmental organizations that establish and maintain standards for shipbuilding and operations. They may also be delegated by a flag state to perform certain flag-state vessel inspection and certification functions. A classification society carrying out responsibilities on behalf of the flag state is known as a recognized organization.

NTSB Marine Accident Report 26

The RINA head office had only a record of the February 2 emergency plan and station bill. When interviewed by investigators, RINA representatives stated that the July 3 emergency plan and station bill was approved locally by the classification society’s surveyor in Tunisia, and no further submission of documentation was required. RINA representatives told investigators that the classification society approved only the format of the emergency plan and station bill and not its specific contents. Unless otherwise stated, references to the emergency plan and station bill in this report are from the July 3 plan. Command and Control. The emergency plan and station bill for the Caribbean Fantasy established the duties for various personnel on the bridge during an emergency. During such an event, the bridge was designated as the command center and organized to manage tasks and activities during the response. The master, in overall command, was responsible for overseeing the safety of navigation, operation of the vessel, and the emergency response. He was also in charge of announcements to passengers. The staff captain was responsible for managing the actual emergency while in communication with the on-scene commander—the safety officer—and other emergency teams. According to the emergency plan and station bill, the first officer was responsible for the ship’s intact and damage stability condition and the use of the bilge and ballast system. During the accident voyage, no first officer was assigned to the ship, and thus one of two second officers was assigned these responsibilities. The other second officer was tasked with relieving the watchkeeping officer on duty and overseeing emergency communications and operation of the ship’s global maritime distress and safety system (GMDSS) equipment. In addition to these four deck officers, a deck rating was assigned to the bridge as helmsman. Fire Response Teams. As the on-scene commander, the safety officer was responsible for the organization, deployment, and accountability of the fire response teams. The four teams of crewmembers were assigned specific tasking and equipment for fire response. The teams were organized as follows: • Quick-response team consisting of the on-scene commander and three crewmembers. • Fire squad no. 1 consisting of seven crewmembers, four with SCBAs and firefighter’s outfits, specializing in firefighting in accommodation spaces. • Fire squad no. 2 consisting of six crewmembers, four with SCBAs and firefighter’s outfits, specializing in firefighting in engine spaces. Four members of this squad were from the engine department. • Boundary cooling team consisting of five crewmembers, none of which had SCBAs or firefighter’s outfits. Engine Control Room Team. According to the emergency plan and station bill, the ECR team was to be led by the chief engineer and manned by seven people responsible for managing all aspects of machinery and propulsion systems, emergency systems and fixed firefighting systems in machinery spaces, and communications with the command and control team. The chief engineer was responsible for maintaining accountability of personnel in machinery and technical spaces, activating the ship’s CO2 fixed firefighting system, and communications with the bridge. The first engineer reported to the chief engineer and was responsible for the activation of both the water-mist and drencher fixed firefighting systems. A third engineer and motorman were assigned to relieve the engineer and motorman on duty in the ECR. The chief electrician and first electrician

NTSB Marine Accident Report 27

managed electrical distribution from the main switchboard and the emergency diesel generator. The air conditioning engineer was responsible for isolating ventilation in various spaces as directed by the command and control team. This included the operation and shutdown of various fans and fire dampers throughout the vessel. The ECR was in the main engine room and was not separated from that space by any fire protection boundaries. The emergency plan and station bill and supplementing emergency organization instructions did not identify a secondary area for the ECR team to assemble in the event of a fire in the main engine room. Evacuation Control Team. The evacuation control team was responsible for managing the evacuation of passengers and crew from accommodation spaces, confirming that all accommodation spaces were evacuated, guiding the passengers to their respective muster stations, providing crowd control, and accounting for all on board. The team was led by the hotel director. The chief purser assisted the hotel director by managing the passenger reception area and the manifest of all passengers and crew. Each hotel department head or manager on board the ship reported to the hotel director when their respective zone had been searched and cleared: the chief housekeeper was responsible for all passenger cabins; the bar manager was responsible for all public areas; the dining room manager was responsible for all restaurant and buffet areas; and the executive chef was responsible for all galleys and crew mess rooms. Each team leader had a checklist to keep track of spaces that were reported clear and informed the hotel director of the evacuation progress. The hotel director, in turn, would communicate this progress to the command center on the bridge. Lifeboats and Liferafts. Upon the order to abandon the ship, each of the deck watchkeeping officers was assigned to command one of the ship’s three lifeboats, with an engineering officer also assigned to each boat. Other officers and crew were assigned duties in a lifeboat or liferaft. The master was assigned to command liferaft no. 24, notionally the last liferaft to be launched and occupied in a ship abandonment. 1.5 Injuries The Caribbean Fantasy’s charterer could not provide the Coast Guard with an accurate total number of crew and passengers who required medical treatment beyond first aid, as only the individuals taken to two of the nine hospitals that treated passengers were tracked by name. Records provided by America Cruise Ferries stated that 50 people were treated at the various hospitals. According to computer-aided dispatch records provided to investigators, a total of 49 passengers and crew were transported to local area hospitals. Records stated that patients were treated for knee, ankle, and leg injuries; hypertension; high blood pressure; fainting; body aches; breathing difficulties; vomiting; dehydration; and conditions related to pregnancy.

Based on the dispatch records and other documents obtained by the National Transportation Safety Board (NTSB), only six injuries were considered serious according to International Civil Aviation Organization (ICAO) criteria.22 These included ankle injuries incurred while sliding down the MES and one case of smoke inhalation.

22 The NTSB uses the ICAO injury criteria in all of its accident reports, regardless of transportation mode. A serious injury is a non-fatal injury that requires hospitalization for more than 48 hours, commencing within 7 days

NTSB Marine Accident Report 28

1. 6

Damage

The damage to the Caribbean Fantasy was estimated at $20.1 million, according to a survey conducted by Braemar Technical Services, Inc.23 Engine room machinery and equipment, steel plating and structures, and cargo sustained heat and smoke damage. Fixed firefighting systems were damaged due to heat. Engine room spaces, cargo decks, and accommodation spaces were affected by soot. Additionally, lifesaving appliances were damaged during deployment and postaccident handling. In lieu of making repairs, Baja Ferries elected to scrap the vessel. 1.7 Engineering Factors 1.7.1 Main Propulsion Engines The Caribbean Fantasy’s main propulsion was provided by two medium-speed Mitsubishi MAN B&W 8L58/64 diesel engines. The engines were constructed and installed at Mitsubishi Heavy Industries in Kobe, Japan, under a license agreement with MAN B&W Diesel AG (now MAN Diesel & Turbo SE). Each four-stroke, in-line (single-bank), non-reversing engine had eight cylinders and was capable of producing 14,203 horsepower (10,591 kW). Each engine was connected via a Vulkan coupling to a single helical reduction gear and then via a shaft to a four-bladed, 20.8-foot- (6.37-meter-) diameter controllable-pitch propeller.24 The vessel’s service speed was 22 knots, with a maximum speed of 24.5 knots at 413 rpm and a controllable pitch angle of 35 degrees ahead. The Caribbean Fantasy had engine propulsion control stations on the bridge and in the ECR. This arrangement enabled operators to transfer control of engine speed and direction of thrust between the bridge and the ECR. Maneuvering lever commands and associated rpm and speed tables were found on metal placards near the engine control stations on both the bridge and in the ECR. 1.7.2 End Flange on Port Main Engine Fuel System The end flange on the port main engine fuel system supply line where the leak was reported to have occurred was closed off using a blanking plate and four threaded bolts and nuts, with gasket material between the flange and plate.25 During postaccident examination, the end flange, gasket, and blanking plate were found heavily sooted and covered with fuel. In the vicinity of the end flange, an area of clean burn was found on the turbocharger exhaust duct. Investigators reviewed corrective and preventative maintenance records and engine log book entries, but found no record of when the blanking plate, gasket material, and fasteners for the end flange were last repaired or replaced. The blanking plate was not produced by the original equipment manufacturer (OEM). Had it been provided by the OEM, it would have been fabricated to a design or quality standard (for example, Japanese Industrial Standards [JIS] or ASTM

from the date the injury was received; results in a fracture of any bone; causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third-degree burns, or any burn affecting more than 5 percent of the body surface. 23 Braemar Technical Services Inc., “Caribbean Fantasy” Advice No. 3 Summary, January 18, 2017. 24 Vulkan is the name brand of marine drivetrain couplings manufactured by VULKAN Kupplungs- und Getriebebau Bernhard Hackforth GmbH & Co. KG. 25 A blanking plate is a circular metal plate that is fitted in a piping system between two flanges or on an end flange. When installed with a gasket, the plate prevents the passage of fluid past a flange.

NTSB Marine Accident Report 29

International standards). The plate’s diameter did not match the flange, and it did not have a raised face. Further, the blanking plate had eight unused fastener holes in addition to the four that were used to secure it to the flange.

Figure 15. Postaccident photo of the fuel supply line end flange on the port main engine. A similar end flange for the fuel return line is below the supply end flange. The OEM’s specification for the gasket material to be used with the end flange and blanking plate was a joint sheet made from a non-asbestos fiber mixed with a heat- and chemical-resistant nitrile butyl rubber binder. After the accident, the gasket material from the Caribbean Fantasy’s end flange was recovered and analyzed by the NTSB materials laboratory and a third-party laboratory. A spectral analysis found that the material was a strong match to polydimethylsiloxane, also known as silicone rubber. Silicone rubber has a low resistance to breakdown by fuel. Gasket material from the starboard main engine fuel system was also analyzed and determined to be nitrile rubber, which has a higher resistance to breakdown by fuel. There was no inspection of or lifecycle management for the gasket material for any of the main engine fuel supply and return lines. Gaskets were being replaced only after failure. (Maintenance records showed that the starboard fuel supply end flange gasket had been replaced on August 11 as a result of a discovered leak. The replacement gasket for the starboard end flange was hand-cut by the motorman performing the repair.)

NTSB Marine Accident Report 30

Figure 16. Fuel supply line end flange and gasket material, left, and blanking plate, right. 1.7.3 Fuel Lines and Splash Guards SOLAS regulation requires that fuel be “screened or otherwise suitably protected to avoid oil spray or oil leakage onto possible ignition sources.”26 The purpose of the regulation is to prevent the ignition of combustible materials or flammable liquids. MAN Diesel & Turbo developed and distributed a customer information letter, CUS 321, in February 2013, titled Splash Guard, Instruction for correcting guarding. The letter informed owners of the SOLAS requirement and offered solution packages from MAN-approved providers. The customer information letter was sent on March 11, 2013, via mail to Baja Ferries in Mexico. Several engineering crewmembers told investigators that the fuel supply end flange was wrapped with SOLAS-approved spray tape. The multilayer adhesive tape composed of aluminum, glasscloth, and a polyethylene terephthalate (PET) liner was designed to mitigate the risk of fuel spray on surface temperatures greater than 428 degrees F (220 degrees C). Investigators reviewed several manufacturers’ instructions for installing anti-spray tape, and in each case the manufacturer recommended at least two layers of tape around the surface to be protected. However, during the postaccident examination of the Caribbean Fantasy’s engine room, investigators discovered several places where only one layer of tape was fitted around the fuel flanges and connections and at least one flange where no tape was installed. Photo evidence indicates that there was only one layer of tape on the fuel supply end flange where the fire started.

26 IMO, SOLAS Chapter II-2, Regulation 4, Probability of Ignition.

NTSB Marine Accident Report 31

1. 7.4 Quick-Closing Valves

Fuel and lube oil QCVs are positive shutoff valves on fuel and lube oil system tanks designed to isolate the tanks in the event of an emergency. For the safety of the crew and the vessel, these valves can be remotely operated in situations where local operation is impossible or impracticable due to a hazardous situation. In some circumstances, QCVs may be the only means of shutting off the fuel to a flammable-liquid fire. Proper routine maintenance and, in some cases, approved modifications or replacement of components may be necessary to ensure reliability of the remote operation and closure of the valves. On January 31, 2011, the Coast Guard issued a Marine Safety Alert after port state control officers discovered many QCVs that were intentionally modified and poorly maintained, which prevented the valves from operating as designed during an emergency.27 After the Caribbean Fantasy had been detained in Gibraltar in early July 2016, a RINA surveyor conducted a “Port State Control Preventive Assessment” to verify the deficiencies recorded. In the surveyor’s report, a photograph of the portside lube oil storage tank QCV shows a bolt and nut lodged in the valve mechanism, which would have prevented the valve from operating as designed. No deficiencies relating to QCVs were recorded in the narrative section of the RINA report form.28

Figure 17. Enlargement from photograph of the portside lube oil storage tank QCV in RINA Port State Control Preventive Assessment report.

27 US Coast Guard, Inspection of Fuel Oil Quick-Closing Valves, Marine Safety Alert 01-11, January 31, 2011. 28 RINA, Port State Control Preventive Assessment, RINA no. 7647, File no. 16/XA/695/01.

NTSB Marine Accident Report 32

Operation of QCVs were spot-checked during the Coast Guard port state control inspection on August 9, 2016, in San Juan. No deficiencies were noted. The port state control officers allowed the ship’s crew to demonstrate the QCVs’ operation using shipboard procedures. The port state control officers and the ship’s crew told investigators that a bolt and nut were placed between the valve stems to keep the vital systems online and avoid a blackout during the inspection. Investigators were not able to find the shipboard procedure for the testing and inspection of the QCVs. After the accident, investigators discovered that all eight fuel and lube oil QCVs were blocked open with a bolt and nut, which rendered the valves unable to isolate fuel and lube oil from the main engine room during the fire.

Figure 18. Postaccident photo of Caribbean Fantasy’s starboard heavy fuel oil (HFO) storage tank QCV that was blocked open with a bolt and nut. Figure 18 above shows the starboard heavy fuel oil (HFO) storage tank QCV that was blocked open with a bolt and nut. The bolt is under compression in the photograph. Red paint (the same color as the valve body), dust, dirt, and rust were present on the nut and bolt threads. The presence of soot in this area was minimal.

NTSB Marine Accident Report 33

After the accident, the parties to the investigation and the chief engineer evaluated the port lube oil storage tank QCV. The chief engineer removed the bolt and nut blocking the valve open, and the valve stem moved in the downward direction about 2 inches, closing the valve. Under the SOLAS regulation, vessel owners and operators are required to have a maintenance plan in place for fuel supply emergency shutdown equipment. Further, this emergency shutdown equipment should be kept in good order to ensure readiness for immediate use during a fire. Investigators requested maintenance records from the owner and operator to determine the last maintenance or functional tests performed on the eight QCVs. No corrective or preventative maintenance records were on board the vessel, and the QCVs were not specifically listed as part of the monthly, quarterly, semiannual, or annual maintenance checks. 1.7.5 Ventilation Dampers Four dampers were installed in the ventilation on each side of the Caribbean Fantasy’s main engine room. As he evacuated the ECR, the chief engineer actuated the ventilation shutdown pneumatic valve. Despite the closure, photographs and video of the Caribbean Fantasy during the accident show smoke exiting from the stacks. 1.7.6 Firefighting and Fire Prevention Systems and Equipment Carbon Dioxide Fixed Firefighting System. The CO2 fixed firefighting system for the main engine room and auxiliary engine room was designed by Minimax and was required by SOLAS regulation. CO2 systems extinguish a fire by starving it of oxygen. The CO2 room was located on the port aft corner of garage B on deck 3, with a ladder and hatch to deck 4. (During the postaccident examination, this hatch was inoperable from deck 4 and was found to be strapped closed from inside the CO2 room.) The system contained a total of 110 60-liter (45-kilogram) CO2 cylinders. After the accident, all of the bottles in the CO2 room were weighed and determined to be empty of gas. Water-Mist Fixed Firefighting System. The HPN Nebula water-mist fixed firefighting system, manufactured by Ciodue Acqua S.r.l., was installed in various machinery spaces on the Caribbean Fantasy in 2005 as required by SOLAS regulation. This type of system is designed to suppress a fire in a localized area through a high-speed mist containing small droplets with a very large total water surface area, providing efficient cooling of the fire. The speed of the droplets enables the mist to penetrate combustion-related gases and reach the source of the fire and heat. The HPN Nebula system was an open-nozzle, dry-pipe (supply pipes normally empty when not in operation) system, which could be activated either manually or automatically. It was manually activated by pressing a button for the affected area on the system panel in the ECR, at the system skid in the air conditioning machinery room forward of the engine room, or at one of three remote activation panels: one located outside the engine workshop, another in the auxiliary engine room, and the third at the entrance to the engine room in garage A. The system was automatically activated when the water-mist control panel received a fire alarm (either smoke or heat) in an area protected by water-mist. The control panel also illuminated visual indicators and sounded audible alarms to signal that the system had been activated. Water-mist application nozzles were installed over the main engines (4 nozzles per engine), diesel generators (2 nozzles per generator), fuel purifiers and boilers (3 nozzles), and fuel booster pumps (1 nozzle per pump). When the system was activated, freshwater from the no. 8 port and starboard tanks flowed to selected nozzles. The system was also attached to the fire main, which could supply seawater when manually aligned.

NTSB Marine Accident Report 34

Figure 19. Water-mist system nozzle after the fire. The chief engineer stated during his interview that he manually actuated the water-mist system by pushing the buttons located on the control panel in the ECR. Several smoke detectors alarmed during the event, which also would have activated the system, but the closed fire detection loop responsible for the automatic release of the system was in “fault” and inoperative at the time of the fire. According to the pressure gauges on the system skid, the water-mist system activated for both main propulsion engines, a fuel booster pump, and the no. 2 and no. 3 diesel generators. These activations were verified by VDR data. The chief engineer stated in his interview that the panel in the ECR was in manual mode before the fire. This could not be confirmed as the switch position was unmarked on the panel. Water Drencher System. A water drencher system (also known as a deluge system), required by SOLAS regulation, was installed on all three garage decks of the Caribbean Fantasy, with a total of 1,165 removable nozzles. Drencher systems are used for special hazards where rapid fire spread is a concern, as they provide a simultaneous application of water over the entire hazard area. The system on board the Caribbean Fantasy required manual activation at a station located on deck 5 near the engine casing port side. An audible alarm sounded when the system was actuated. It was a dry system, and, when activated, freshwater from the no. 8 port and starboard tanks flowed to nozzles in selected zones. The drencher system was also attached to the fire main, which could supply seawater when manually aligned.

NTSB Marine Accident Report 35

Per the emergency plan and station bill, the first engineer was assigned the task of activating the drencher system. He told investigators that during the fire he opened the system valves for all three garages. Investigators found that the drencher system actuation valves for all zones in garage A and garage B were open. Valves for all zones in garage C, except for one, were closed. The no. 8 port and starboard freshwater tanks that supplied the system had been filled with water when the ship was last in port at San Juan. The tanks were sounded postaccident and found to be nearly empty. Other Firefighting Systems and Equipment. A Minimax water sprinkler system was installed in all accommodation areas (corridors, cabins, offices, store, paint locker, and public areas), the CO2 station, and in all stairwells. Along with the sprinklers in the CO2 room, several sprinkler heads were found actuated in various areas of the ship during the postaccident examination. Fireman’s outfits and SCBAs were found scattered throughout various parts of the ship. Several firefighting hoses were found deployed but showed no signs that they had been charged. The safety officer told investigators that she ordered both fire squads to boundary cool in garage B but had them evacuate to garage C because of the high concentration of smoke in garage B. The abandon-ship order came before any firefighting or boundary-cooling efforts commenced. A-60 Bulkheads and Decks. Per International Maritime Organization (IMO) regulations, A-60 divisions are to be insulated with approved non-combustible materials such that the average temperature of the unexposed side will not rise more than 284 degrees F (140 degrees C) above the normal temperature nor will the temperature at any one-point rise more than 356 degrees F (180 degrees C) within 60 minutes. The construction must be capable of preventing the passage of smoke and flames. Although the deck separating the main engine room from garage B on the Caribbean Fantasy was a main vertical zone with A-60 rated insulation, the fire was not contained in the engine room. The fire spread to garage B above, and vehicles in the garage caught fire. 1.7.7 Voyage Data Recorder The Caribbean Fantasy was equipped with a VDR, as required by SOLAS regulation, produced by Consilium Marine and Safety AB and installed by the manufacturer in 2012. SOLAS regulation requires an annual performance test (APT) for VDRs by an approved testing or servicing facility to verify the accuracy, duration, and recoverability of recorded data. Consilium performed APTs on the system annually starting in 2013. The most recent APT was conducted on February 7, 2016. Over 24 hours of bridge audio, radar, and navigational and engineering parametric data were recovered from the VDR capsule. The entire accident voyage and abandonment were recorded. The Consilium VDR recorded the radar video image once every 15 seconds; other parameters were recorded in text files, 60 seconds in duration. The VDR stopped recording at 1350 on August 17.

NTSB Marine Accident Report 36

1. 8

Survival Factors 1.8.1 Lifeboats Schat-Harding AS designed and manufactured the lifeboats and davits supplied to the Caribbean Fantasy. Lifeboats no. 1 and no. 2, located on the starboard and port side of the vessel, respectively, were a partially enclosed lifeboat design constructed of glass-fiber-reinforced plastic (GRP), with a capacity of 150 persons. Lifeboat no. 3, located on the starboard side, was a fully enclosed lifeboat design constructed of GRP, with a capacity of 70 persons.

Figure 20. Photo left is Caribbean Fantasy lifeboat no. 2 on the pier in San Juan after the accident. Photo right is lifeboat no. 3 suspended from the davit falls on Caribbean Fantasy after the accident. Each of the Caribbean Fantasy lifeboats was launched using a gravity davit. The davits and embarkation areas for lifeboats no. 1 and no. 3 were located in the starboard-side muster station A on deck 7. The davit and embarkation area for lifeboat no. 2 were located in the portside muster station B, also on deck 7. Unlike lifeboats no. 1 and 2, lifeboat no. 3 was embarked from a platform on deck 7 while the boat was in the stowed position.

Figure 21. Caribbean Fantasy starboard side (Photo by Coast Guard)

NTSB Marine Accident Report 37

As noted previously in this report, all lifeboat release hooks had been replaced during the shipyard maintenance period in Tunisia. The new hooks were “U-Hook” release systems designed and installed by Bianchi & Cecchi Service Inc. (BC Service). The hooks were replaced to comply with a recently implemented SOLAS regulation that was enacted to reduce the number of accidental releases of lifeboats.29 Each U-Hook included a “recovery pin” that prevented the hook from inadvertently releasing when the boat was hoisted after inspections and drills. The previous hook arrangements did not include this design feature. As the recognized organization (RO) designated by the flag state of Panama, RINA was responsible for ensuring that the Caribbean Fantasy complied with SOLAS and other regulations. On June 22, 2016, the three lifeboats were examined and tested. A surveyor employed by the shipyard and authorized to carry out the exams on behalf of RINA documented his findings in a service report for each lifeboat. The reports noted that the examinations and operational tests were conducted in compliance with SOLAS regulation and included an operational test of all the lifeboat hook releases, running the lifeboat engines for 3 minutes, and making sure each lifeboat bilge pump operated. Based on the results, RINA approved the use of the U-hooks and issued the vessel its passenger vessel safety certificate. Investigators reviewed lifeboat documentation on the Caribbean Fantasy. The hook manual provided by the manufacturer to the ship included guidance to visually check to confirm that the recovery pins were in their stored position when preparing to lower the lifeboat. However, the procedure found in the vessel’s Shipboard Emergency Organization manual and SOLAS Training Manual did not contain a step to ensure that the recovery pins for the lifeboat hooks were in their stored position. According to the U-hook manual, there were three methods for opening the release hooks: • Normal Procedure. As the lifeboat “touches down and becomes waterborne,” a hydrostatic interlock on each hook opens, and an indicator on the release control unit (RCU) moves from green (closed) to red (open). The lifeboat commander then removes the safety pin from the RCU and lifts and rotates the release handle until it stops in the open position, releasing the hooks. • Hydrostatic Interlock Manual Override Procedure. If the normal procedure does not work and the lifeboat is in the water, the crew breaks a clear plastic cover on the RCU with the safety pin and then uses it to move the hydrostatic interlock indicator from the green to the red position to disengage the hydrostatic interlock. While holding the indicator in the red position, the lifeboat commander then lifts and rotates the release handle until it stops in the open position, releasing the hooks. This operation required two trained crewmembers, one to operate the release handle and another to hold the interlock in the red position. • Emergency Manual Release Procedure. If the hydrostatic interlock override procedure does not release the hooks, crewmembers position themselves at each hook and wait for the lifeboat commander’s order to use wrenches to open the hooks. (The wrenches should be stowed at the forward and aft hatches of the boat.) While the release handle is in the

29 In May 2011, the IMO amended the SOLAS regulations for lifeboat release and retrieval systems based on a review of casualties that occurred during drills and inspections. Deaths and injuries had occurred when lifeboat hooks accidentally released during raising and lowering operations, dropping the boats with crewmembers embarked.

NTSB Marine Accident Report 38

open position, the wrenches are then used by trained crewmembers to rotate the manual release stud on the hook mechanism. This must be done simultaneously. If the procedures in the manual did not work, the crew could lift the gate, designed to keep the hook from releasing prematurely when the falls become slack, and then manually maneuver the lifting ring on the falls out from under the hook. This process was dangerous and a last resort as it involved risk of injury to persons manning the hooks. During the accident, none of the three lifeboat crews could release the hooks from their falls when the boats first entered the water. The crews in lifeboats no. 1 and no. 2 were only successful when they attempted the last-resort procedure for releasing the hooks. The crew in lifeboat no. 3 was never able to release the hooks, and the boat was eventually hoisted out of the water to avoid further damage from wave action that caused it to repeatedly hit the side of the Caribbean Fantasy. On August 24, 2016, investigators examined the Caribbean Fantasy lifeboats. Lifeboats no. 1 and no. 2 had been lifted out of the water by a crane and placed on the pier, and thus investigators could not document their immediate postaccident condition. During the examination, investigators evaluated the function of the release hooks, noting that the clear plastic covers for the hydrostatic interlock overrides were still intact on both lifeboats. Investigators used the release handle inside lifeboat no. 2 in an attempt to open the boat’s hooks. The two hooks did not open. Investigators then attempted to use the manual release wrench on the hooks for both lifeboats no. 1 and no. 2. Only one of the four hooks released; the forward hook on lifeboat no. 1 opened with difficulty. The Caribbean Fantasy entered the port of San Juan with lifeboat no. 3 hanging by its falls at the ship’s side. When investigators examined the lifeboat after the accident, they found the safety pin for the release handle inserted in the RCU, and the clear plastic cover for the interlock override was intact. A successful release test was conducted dockside by dropping the boat onto truck tires after operating the release handle. Before the test, the team examined the release hooks and found the recovery pins in the position for recovering the lifeboat―inserted through the hook mechanism to lock it closed and prevent it from accidentally opening during hoisting. (When a lifeboat is not being hoisted, recovery pins should be in the stowed position—in a holder mounted on the side of the hook—in preparation for immediate lowering and launching of lifeboats in an emergency.) According to the commander of lifeboat no. 3, the pins were put in the recovery position prior to the attempted hoist of the lifeboat back to the embarkation deck. It could not be determined if the pins were in the stowed or recovery position prior to the boat being lowered.

NTSB Marine Accident Report 39

Figure 22. At left, the U-hook with recovery pin in stowed and inserted positions. (Source: U-Hook 3 – 6 – 10 – 15 ton Operation and Maintenance Manual) At right, Caribbean Fantasy lifeboat no. 3 aft hook with the recovery pin inserted in the hook mechanism. All lifeboat manuals on board the Caribbean Fantasy contained instructions for operating the previous release hooks that had been replaced in the shipyard. SOLAS requires posters or signs containing the relevant instructions and procedures for operating the hooks to be placed in the vicinity of survival craft launching controls. Investigators found posted instructions in lifeboat no. 3 that explained how to release the newly installed U-hooks. However, instruction sheets in lifeboats no. 1 and no. 2 were for the previously removed release hooks. On September 16, 2016, a service team of four representatives from BC Service (the U-Hook manufacturer), accompanied by a representative from the Coast Guard Cruise Ship National Center of Expertise (CSNCOE), examined the hooks installed on lifeboats no. 1 and no. 2. The Coast Guard asked the BC Service representatives to examine the hooks to help investigators determine why they did not release on the day of the accident and why investigators were unable to open the hooks during their initial examination on August 24. The service team first examined the RCU for lifeboat no. 2. The team concluded the RCU mechanism was functional. However, when they then examined the hooks and tried to open them using the RCU, the hooks did not open. The team observed that the hooks had been moved inward, “most likely when the lifeboats were incorrectly moved by shore side cranes from the water to the pier” after the accident. Once the BC Service team moved the hooks into their original positions, the hooks opened by using the RCU. The team found lifeboat no. 1 in the same condition. After adjustment, the hooks opened using the RCU. The lifeboats had been lifted out of the water after the accident using slings attached to a single lifting point. To prevent damage to the boats or slings, the manufacturer’s lifting instructions for single point lifts required a spreader bar or slings longer than 1.5 times the length of the boat. The BC Service team’s report concluded that the damage sustained to the lifeboat hooks was consistent with damage resulting from a crane using a single-point lift and short slings. The BC Service report also stated that the hydrostatic interlock moved freely for lifeboat no. 2 and a

NTSB Marine Accident Report 40

Teleflex cable was found damaged on the no. 1 lifeboat.30 (The vendor suggested that the damage to the cable may have been caused by previous attempts to open the hooks while in the wrong position.) BC Service representatives found no problems with the releasing system for lifeboat no. 3; the hook release system worked as designed. BC Service noted that there were no reports of problems or any service requests made from the Caribbean Fantasy after the installation and testing of the hooks were completed in Tunisia in May 2016. In addition to problems with the release hooks, the lifeboat no. 1 commander told investigators that the engine was never able to start, and seawater entered from a crack that opened on the port side from hitting the ship’s side when the lifeboat was unable to be released from the falls. On October 12, 2016, at the request of the Coast Guard, a representative from Schat-Harding (now acquired by Palfinger Marine) examined the lifeboats accompanied by a member of the CSNCOE. He also conducted a document check of lifeboat examination records and guidance. His findings stated: • Hook damage may have occurred after the accident. There is evidence that the hook systems of lifeboats no. 1 and no. 2 suffered damage caused by the improper lifting of the lifeboats by means of a shore crane with a single lifting point. • The aft release cables installed on lifeboats no. 1 and no. 2 were longer than prescribed. This fact may have prevented hook release once waterborne. The excessive length increased the resistance in the push-pull cables. • There was evidence that the lifeboat no. 1 engine had been under repair at the time of the incident. Bolts surrounding the engine compartment had been removed, brackets holding cables and tubes were unfastened, the end cover was missing, and the coolant tank was empty. • The lifeboat no. 1 drain plug was missing and could not be located. If the drain plug had been in place, even in the open position, it would have prevented water from entering the vessel. A floater valve would have prevented water intrusion. The drain plug was designed to keep the floater ball in place. • Lifeboats no. 1, no. 2, and no. 3 incurred GRP, hand rail, and hatch damage that included fractures and laminate shearing. 1.8.2 Marine Evacuation Systems and Liferafts VIKING LIFE-SAVING EQUIPMENT A/S designed and manufactured the MESs and liferafts supplied to the Caribbean Fantasy. Each MES was deployed by pulling a release handle on the system’s stowage box at the landing. This action inflated the slide and the floating platform. The operator was then to use the bowsing line and winch to position the platform.

30 Teleflex is the name brand of a control cable manufacturer. The cables have a stationary outer sheath surrounding a moveable inner cable. The inner cable transfers mechanical force from an actuator, such as a lever, to a moveable terminal connection such as a throttle or, in the case of the Caribbean Fantasy lifeboats, the hook release.

NTSB Marine Accident Report 41

Figure 23. MES stowage box components similar to those on board the Caribbean Fantasy. (Source: Caribbean Fantasy MES Training and Operations Manual) The liferafts were integrated with the MESs and were installed on the port and starboard sides of the vessel in reclining racks on deck 7, one deck above the MES equipment. The liferaft containers could be released remotely by activating a Hammar release pump mechanism from a box adjacent to the MES landing on deck 5. According to the MES Training and Operations Manual, liferaft containers were to be launched one at a time, starting with liferaft no. 1, when the platform crew was ready to haul the container to the platform and inflate the liferaft. If the remote Hammar release failed, there was another Hammar release mechanism at the liferaft rack. The liferaft containers could also be manually released using a release bar at the rack or by individually releasing each container at the securing link. In addition to the retrieving line used to pull the liferaft containers alongside the MES platform, each liferaft container also had a painter line connected to the ship. The purpose of the painter was to automatically inflate the liferaft in the event that the ship sank. When the liferaft containers were released in conjunction with an MES deployment, the Hammar mechanism cut the sea painter to prevent the liferafts from prematurely inflating. The Caribbean Fantasy received 14 new liferafts while in the shipyard in Tunisia. All starboard-side liferafts were replaced with rafts inspected for service in June 2016, except for liferaft no. 21 inspected in May 2016. Portside rafts 2, 4, and 6 were replaced with new rafts inspected in June 2016. Because of travel warnings for Tunisia, authorized VIKING technicians did not travel to the shipyard to install the new rafts and integrate them into the MES system. Instead, shipyard employees who were authorized to carry out the work by the classification society installed the raft containers on the racks. VIKING was not consulted in this arrangement. The portside liferafts that had not been replaced were due for inspection in August 2016. On August 10, 2016, the Panama Maritime Authority issued a letter authorizing a 3-month extension of the inspection deadline for those portside rafts until November 18, 2016.

NTSB Marine Accident Report 42

Figure 24. Postaccident photo of the portside liferaft containers and storage racks on board the Caribbean Fantasy. During the accident, the safety officer deployed the portside MES with assistance of an able-bodied seaman (AB) assigned as the starboard-side MES slide controller. Neither the safety officer nor the AB was assigned to the portside MES team per the emergency plan and station bill, but the safety officer later told investigators that she was near the portside MES when the order came to deploy the system and knew that the crewmembers assigned to the MES were still engaged in lifeboat-launching operations. Once inflation of the MES began, she and the AB left for the starboard-side MES. The staff captain told investigators that he arrived at the portside MES as it inflated. Seeing that the slide was at a steep angle to the water, the staff captain added additional nitrogen to the slide and platform using the MES’s spare refilling valve. The slide alignment did not improve. The staff captain told investigators that he did not use the bowsing line to attempt to position the MES. The portside MES was not used. During his interview with investigators, the staff captain said that the starboard-side MES deployed as designed, but the crew could not use the bowsing line because it had parted (investigators were not able to determine how or when the line parted). He said that the crew added nitrogen from the spare refilling valve to overcome the effects of the wind, which were causing the slide to collapse, and sent passengers down the slide even though the slide deployed with a steep angle. Investigators determined that the MES slide angle was about 54 degrees to the waterline after it inflated. For safe use of the system, the manufacturer’s recommended angle was 30–35 degrees. Eventually, a Coast Guard small boat used a line attached from the MES platform to the bow of the boat to pull the platform forward and improve the alignment of the slide.

NTSB Marine Accident Report 43

Figure 25. Caribbean Fantasy starboard-side MES deployed at about a 54-degree angle to the waterline, about 0923 on the morning of the accident. (Photo by US Coast Guard) A crewmember told investigators that the automatic liferaft container release at the starboard-side MES landing did not work, so he proceeded to the liferaft container racks and released the first two containers using the local Hammar release pump. The staff captain manually released the rest of the containers, one after the other, shortly thereafter. The liferafts were designed to be inflated by crewmembers once they were pulled alongside the MES platform, but some of the starboard-side liferafts inflated early. A crewmember said he saw four rafts inflate before being pulled to the platform, and a passenger took a photograph showing four empty inflated liferafts with lines still connected to the ship. At the time this took place, the Caribbean Fantasy was drifting in a sideways motion at about 1 to 2 knots with the wind on its starboard side.

NTSB Marine Accident Report 44

Figure 26. Inflated liferafts without passengers, about 0844 on the morning of the accident. (Caribbean Fantasy passenger photo provided by Coast Guard) A team of six VIKING employees conducted a postaccident examination of the MES and assessed why the port and starboard MES slides buckled during the abandonment. The team evaluated nine failure modes, including improper bowsing line operation, failure of the nitrogen gas to inflate the slide properly, and the failure of the system to hold the gas. Although the team could not identify a root cause for the failure of the MESs, they identified nitrogen valves that were leaking during inflation due to leaking gaskets, two of the eight relief valves that had opening pressures slightly below the acceptable limit, and that the crew had not handled the bowsing winches correctly. It was noted in the team’s report that the system and its components were left exposed to the weather for about a month after the accident and before the team was able to carry out the examination. The VIKING team could not determine why some of the liferafts were “floating around, not connected with the connection lines.” The team noted that the rafts were not installed by an authorized VIKING service technician and offered two possible causes: the rafts were not connected correctly during installation or there was “incorrect handling by the crew during evacuation.” 1.9 Personnel 1.9.1 Crew Recruitment and Manning Baja Ferries utilized third-party crewing agencies for the recruitment and manning of the Caribbean Fantasy’s deck and engineering personnel, while the hotel staff were provided by America Cruise Ferries as the charterer of the vessel. Deck officers were recruited by Ship Supply of Florida Inc., and engineering officers were recruited by Midocean (IOM) Limited, which was a division of the Döhle Group. According to the Caribbean Fantasy’s designated person ashore

NTSB Marine Accident Report 45

(DPA), both agencies conducted recruitment, first-level vetting and processing (including background checks), and verification of required certifications for crewmembers. The DPA stated to investigators that follow-on vetting, management, and overall evaluations of the crew were conducted by the ship’s master and the technical manager. Additionally, promotions were sometimes given on board through consultation between the respective department head, the master, and the company. Personnel were supplied by the crewing agencies under short-term contracts. Deck and engineering officers worked an average of 4 months on with 2 months off, while hotel staff typically worked 6–9 months on with 2 months off. Due to a recent switch to Midocean from another crewing agency, the engineering officers had been on board for only a short time. The chief engineer, first engineer, and third engineer had worked on the vessel for only 1 month. The remaining officers had less than 1 week on board. 1.9.2 Experience and Training of Key Personnel This section of the report provides information related to the personnel on the vessel who played a significant role in the accident sequence or the analysis. Master. The master of the Caribbean Fantasy was a French national and was 62 years of age at the time of the accident. His primary language was French, and he demonstrated conversational proficiency in English. He did not speak or understand Spanish. He held a valid certificate of competency as master of unlimited-tonnage vessels, issued by France and endorsed by Panama. The master stated that he also held a marine engineering certificate of competency, which was a national requirement. The master had been sailing since 1974, with 20 years’ experience as master on car ferries and seagoing tugboats. The master was recruited directly by Baja Ferries but hired through Ship Supply of Florida. At the time of the accident, he was on his second contract as master of the Caribbean Fantasy. His first contract was during the shipyard period in Tunisia, joining the vessel in March 2016 and overlapping with the master on board at the time. After the shipyard period, the master signed off before the vessel crossed the Atlantic Ocean back to Santo Domingo. He returned to the ship on August 5; the master he relieved remained on board until after the Coast Guard port state control inspection was completed.31 Staff Captain. The staff captain was a Greek national and was 56 years of age at the time of the accident. His primary language was Greek, and he demonstrated conversational proficiency in English. He did not speak or understand Spanish. The staff captain held a valid certificate of competency as master of unlimited-tonnage vessels, issued by Greece and endorsed by Panama. He told investigators that he had 15 years of experience, mostly on passenger vessels, including time sailing as master on high-speed passenger ferries between the Greek islands. He joined the Caribbean Fantasy on June 1, 2016, and was on his second contract with the ship as staff captain. Safety Officer. The safety officer was a Panamanian national and was 34 years old at the time of the accident. Spanish was her primary language, and she demonstrated conversational proficiency in English. The safety officer held a valid certificate of competency as chief mate of unlimited-tonnage vessels, issued by Panama. She told investigators that she had about 9 years of seagoing experience on cargo vessels. She had sailed as third mate, second mate, and safety officer on board the Caribbean Fantasy in the 3 years leading up to the accident. She began her most

31 There was no record in the ship’s official logbook of when the master took command of the vessel. According to the crew list submitted to investigators, his sign-on date was August 5, 2016, and he was listed as master at that time.

NTSB Marine Accident Report 46

recent contract on October 31, 2015, as second officer, and she was promoted to safety officer on June 10, 2016. This promotion was a transition from a standard watchkeeping role to a senior leadership role. Second Officer (On Watch). The second officer on watch at the time of the accident was a Panamanian national and was 27 years of age. His primary language was Spanish, and he demonstrated conversational proficiency in English. He held a valid certificate of competency as chief mate of unlimited-tonnage vessels, issued by Panama. He was sailing on a 3-month contract at the time of the accident, which had begun on May 8, 2016. It appeared that this contract had been extended, but the crew certificates list had not been updated with a date beyond August 9, 2016. Second Officer (Off Watch). The second officer who was not on watch at the time of the accident was a Ukrainian national and was 54 years of age. His primary language was Ukrainian, and he demonstrated conversational proficiency in English. He held a valid certificate of competency as chief mate of unlimited-tonnage vessels, issued by Ukraine and endorsed by Panama. He was sailing on a 4-month contract that had begun on August 13, 2016, just 4 days before the accident. He had no prior experience on the Caribbean Fantasy. Deck Cadet. The deck cadet was a French national and was 21 years of age at the time of the accident. His primary language was French, and he demonstrated conversational proficiency in English. According to interview testimony, he also spoke some Spanish. He did not hold a merchant marine certificate of competency. He was on a 3-month contract and had been on the Caribbean Fantasy since July 1, 2016. This was his second contract on the ship. As a cadet, he spent time in both the deck and engine departments. Chief Engineer. The chief engineer was a Polish national and was 49 years of age at the time of the accident. His primary language was Polish, and he demonstrated conversational proficiency in English. He did not speak or understand Spanish. He held a valid certificate of competency as chief engineer “on ships by main propulsion machinery of 3,000 kW and more,” (indicating an unlimited certificate) issued by Poland and endorsed by Panama. He had been sailing for about 26 years, with 5 years’ experience as chief engineer. He joined the Caribbean Fantasy on July 17, 2016, during the Cádiz, Spain, shipyard period. He immediately took over the position upon joining the vessel because the previous chief engineer had been terminated. Another chief engineer with previous experience on the Caribbean Fantasy was brought back to the ship to assist the new chief engineer with familiarization and handover. The chief engineer with previous experience remained on board until after the Coast Guard port state control inspection was completed on August 9, 2016. First Engineer. The first engineer was a Polish national and was 28 years old at the time of the accident. His primary language was Polish, and he demonstrated conversational proficiency in English. He held a valid certificate of competency as chief engineer “on ships by main propulsion machinery of “3,000 kW and more,” issued by Poland and endorsed by Panama. He had 6 years of experience at sea working on oil and gas pipeline diving vessels and accommodation ships. He had been a second engineer on other ships before joining the Caribbean Fantasy. He joined the Caribbean Fantasy on July 26, 2016, under his first contract with the vessel. As first engineer, he was the direct supervisor for all engineers, motormen, and wipers. Third Engineer (On Watch). The third engineer on watch at the time of the accident was a Slovakian national and was 33 years of age. His primary language was Slovak, and he

NTSB Marine Accident Report 47

demonstrated conversational proficiency in English. He held a valid certificate of competency as engineer officer in charge of watch “on ships by main propulsion machinery of 750 kW and more,” issued by Poland and endorsed by Panama. He told investigators that before joining the Caribbean Fantasy he had worked on a bulk carrier for about 4 months as third engineer and about 11 months as an engine cadet. He was on his first contract on the Caribbean Fantasy and had been on board since July 17, 2016. Hotel Director. The hotel director was a Croatian national and was 56 years of age at the time of the accident. His primary language was Croatian, and he demonstrated conversational proficiency in English. He told investigators that he could also speak Spanish. He had been employed in hotel departments on cruise ships and ferries for about 17 years. The hotel director had been working various contracts on the Caribbean Fantasy since 2011 and had been on his current contract since June 16, 2016. Other positions. Deck and engine crew in safety-critical positions had completed required training in crisis management and human behavior, basic safety training, and security training. Hotel crew were not required to have a certificate of competency; however, most were required to have specific training necessary to fulfill their emergency duties as personnel designated on muster lists to assist passengers in emergency situations, shipboard familiarization training, and safety training for personnel providing direct service to passengers in passenger spaces. 1.9.3 Toxicological Testing Baja Ferries, at the request of the Coast Guard, conducted drug tests on nine crewmembers who were either on duty or in critical positions at the time of the accident: the master, staff captain, chief engineer, bridge officer of the watch, engine officer of the watch, motorman on watch, wiper on watch, deck cadet, and helmsman on watch. However, testing was not completed during the 32-hour maximum time window following an accident, as required by Title 46 Code of Federal Regulations (CFR) as well as the company’s SMS policy. These tests took place on August 20, 2016. All persons tested negative for the following substances: amphetamines, cannabinoids, cocaine, opiates, and propoxyphene. Alcohol testing, also required by Title 46 CFR and the SMS, was not conducted on any member of the crew. Per the federal regulation, alcohol testing must be conducted within 2 hours of the accident unless precluded by safety concerns and must be completed as soon as the safety concerns are addressed, up to 8 hours afterward. Although all crew and passengers had abandoned the ship within about 6 hours of the start of the fire, Baja Ferries reported that alcohol tests were not conducted “because of the evacuation and abandonment operation.” 1.10 Work/Rest The company’s SMS stated, “Owners and Captains shall take steps to ensure that officers are adequately rested before they go on watch. It is essential, as a safety measure apart from other considerations, that their efficiency as watchkeeping officers is not impaired by fatigue or others.” The Seafarers’ Training, Certification, and Watchkeeping (STCW) Code and the International Labour Organization (ILO) Maritime Labour Convention (MLC) state that officers in charge of a navigational watch and any rated person forming part of this watch must receive a minimum of 10 hours of rest in any 24-hour period. The STCW Code requires that mariners have 77 hours off duty in any 7-day period—the equivalent of a 91-hour maximum work week. Further, the STCW

NTSB Marine Accident Report 48

Code requires that if rest periods are broken up within a 24-hour period, at least one of the rest periods must be no less than 6 consecutive hours. According to the record of seafarers’ scheduled working arrangements for the Caribbean Fantasy in the month of August, all non-watchstanding engineering staff were scheduled to work 13 hours per day, Sunday through Saturday—a total of 91 hours per week. Similar details regarding the deck officers’ schedules, including seafarers’ scheduled working arrangements, were found posted on the bridge. These had not been updated since July 2016 and did not fully reflect deck personnel who were on board at the time. Additionally, the schedule and working arrangement was signed by a master who was not on board during the accident voyage. Crewmembers stated in interviews that they had time off while in port in Santo Domingo. However, watch schedules posted on the bridge did not indicate this time off. Though requested, the company did not provide work/rest logs for the crew. According to the chief engineer, work and rest hours were tracked on a computer program that was managed by the storekeeper. He could not remember if there was a procedure in the SMS that specifically addressed work and rest. Investigators did not receive a procedure from the company when it was requested following the accident. 1.11 Language 1.11.1 Regulations and Policy Requirements SOLAS regulation requires that a working language be established and recorded in the ship’s logbook to ensure effective crew performance in safety matters. Crewmembers are required to understand and, where appropriate, give orders and instruction and to report back in that language. The Baja Ferries’ SMS established English as the working language for the Caribbean Fantasy and stated that “all crew members must be able to communicate between each other, read, hear and understand [International Safety Management (ISM)] instructions.” The SMS further required masters and chief engineers on company vessels to ensure that manuals were written in a language they could understand. The IMO has also issued language recommendations specifically for handling passengers on board Ro/Ro passenger vessels. Maritime Safety Committee Circular 681 states: Posted or other printed information, as well as announcements, should be in languages likely to be understood by all persons of nationalities normally using the service . . . Crew members who are assigned to direct and assist passengers in an emergency should be able to communicate with passengers in the language or languages appropriate to the principal nationalities of passengers carried on the particular route. 1.11.2 Working Language 1.11.2.1 Internal Bridge team. According to both the master and the deck cadet, three languages were spoken on the bridge of the Caribbean Fantasy: English, Spanish, and French. The cadet explained that the only time languages other than English were spoken on the bridge was when the discussion related to personal matters. However, according to the vessel’s VDR audio, all three languages were being spoken on the bridge during the accident sequence.

NTSB Marine Accident Report 49

Passenger announcements. During the accident, the master directed the cadet to make the initial announcement in English, which he did. The second officer then made an announcement in Spanish. The master’s intended announcement, given by the cadet, directed passengers to follow the instructions of the crew. However, the second officer’s Spanish announcement stated that the fire was out of control and that a decision was made to abandon ship. Because the master did not speak Spanish, he did not realize that the abandon-ship announcement was being made at that time. Overall Crew Proficiency. According to the DPA, the company was having problems with crewmembers, primarily the hotel staff, not “communicating sufficiently in English.” Officers and crew were not required to complete an English-language proficiency exam, although several had records of these exams and scores in their STCW documentation found in onboard records. The DPA stated that this was because they had started having crewmembers take an English proficiency test administered by a United Kingdom-based language training provider. He told investigators that he believed crewmembers were expected to pass the test with at least a 70 percent score, though no documentation was found to support this statement. Some of the officers and crewmembers who had a record of a passed English proficiency exam stated during on-scene interviews that they could not speak English and required a translator. Each individual crewmember’s ability to speak English beyond conversational proficiency could not be determined. 1.11.2.2 External Using VHF channel 16, the OSC aboard the Coast Guard cutter Joseph Tezanos communicated with the master of the Caribbean Fantasy in English, while communicating with some of the other response vessels in Spanish. At one point, as recorded on the Caribbean Fantasy’s VDR, the master said over the radio, “please speak English!” as he did not understand what was being said and did not know who was speaking to whom. The cadet stated in his interview that he attempted to assist the master with communications because internal and external communications were on two different VHF channels and “it was not easy to revert.” 1.11.3 Placards and Documentation Most of the crew and passengers spoke Spanish, yet instructions for emergency equipment and procedures were primarily in English. Moreover, upon examination of the vessel, investigators found multiple cases of drawings, instructions, placards, and emergency equipment manuals in other languages. Ship drawings were in Japanese and engineering drawings were in both Italian and Japanese. The operating instructions for the old lifeboat release hooks that had recently been replaced were still posted at the hook-release locations in lifeboats no. 1 and no. 2. and were written in English and Italian. The water-mist fixed firefighting system manual, as well as operating instructions in the CO2 room, was printed in English and Italian. The SOLAS training manual aboard the vessel was from previous ownership; the content had not been updated when the ship changed hands to Baja Ferries ownership (although it had a new stamp and a title change to “Caribbean Fantasy”), and the languages were also in English and Italian. Additionally, some of the English-language instructions were poorly translated from Italian, with incomplete sentences or incorrect sentence structure. Furthermore, instructions for passengers were in languages unfamiliar to the predominantly Spanish-speaking travelers and were obsolete. For example, passenger emergency instructions in case of fire shown on a placard on the back of a deck 6 cabin door were in English and Italian and conflicted with the approved emergency plan and station bill. The signal for a major

NTSB Marine Accident Report 50

fire on the placard was “two long blasts followed by the alarm bells,” whereas the emergency plan and station bill had no specific signal to inform passengers of a fire. In another example, lifejacket donning instructions found posted on board were in Japanese and English and provided directions for lifejackets no longer in use aboard the Caribbean Fantasy.

Figure 27. Left: Emergency instruction sign in English and Italian on the back of a deck 6 cabin door. Note the masking tape covering the outer edges of the emergency instructions. Right: Lifejacket donning instruction sign in English and Japanese found on deck 6 near fire locker no. 2. The instructions were for lifejacket types not carried on board at the time of the accident. 1.12 Shipboard Training Training records and logs were maintained on the Caribbean Fantasy safety officer’s computer. Although the computer was recovered from the accident site, NTSB investigators were not able to access the computer due to a disk-read error. According to Baja Ferries, these records were maintained only on board and not sent or tracked ashore. Therefore, information regarding shipboard training was gathered from crew interviews and “SOLAS and STCW Certification Records” binders recovered from the safety officer’s office. 1.12.1 Safety Training Safety training on board the ship was carried out by the safety officer, primarily during “induction” training for new and rejoining crewmembers. The training included a pre-departure phase and five underway phases. The pre-departure phase was held prior to getting under way from the port of embarkation and covered emergency duties, alarms, lifejacket use, emergency stations, opening and closing of fire and watertight doors, and how to raise an alarm. Underway phase 1 training encompassed firefighting familiarization training; phase 2 covered lifesaving appliances and equipment familiarization; phase 3 reviewed company policies and procedures; phase 4 involved lifeboat exercises and first aid/CPR training; and phase 5 finished the program with survival and shipboard health. Records of attendance were maintained by the safety officer in a binder. Rejoining crewmembers would have to retake the induction training on an annual basis. For lifesaving equipment, the training required a demonstration of a liferaft (using a training raft), a guide through a stowed lifeboat, and an exercise in a lifeboat during a drill.

NTSB Marine Accident Report 51

The Baja Ferries SMS provided an additional checklist to track vessel familiarization tasks for newly employed and rejoining crewmembers. For deck and engineering officers, the familiarization was to be completed within a specified duration. There were tasks to be familiar with prior to taking a navigational or engineering watch, other higher-priority tasks to be familiar with within 1 week, and lower-priority tasks to be familiar with within 1 month. The second officer (off watch), who had joined the ship 4 days prior to the accident, stated that he did not have familiarization training upon reporting. He stated that he did not attend any crew musters or fire drills during his time on the vessel. The familiarization checklist for this second officer was not found in the binder that held all crew familiarization records. 1.12.2 Lifeboat and Marine Evacuation System Training Each of the three lifeboat commanders had successfully completed a course of training in the Proficiency in Survival Craft and Rescue Boats as required by the STCW Code. The safety officer told investigators that she instructed the boat commanders on how to carry out their roles and provided them with the lifeboat manual for their lifeboat. The second officer (off watch), who commanded lifeboat no. 1 during the accident, stated that he had not received training for the lifeboats on board the Caribbean Fantasy, nor had he reviewed the lifeboat manual. According to the third officer, who was the commander of lifeboat no. 2 at the time of the accident, there was no training on how to operate the new release hooks. He stated that he had read the manual. He also said that the manual explained that when the lifeboat touched the water, the hooks should have released automatically. Investigators found that, contrary to the third officer’s statement, there was no automatic means to release the lifeboats once in the water. No record of training was found in logs and training records, and crewmembers interviewed on-scene confirmed that they had not completed any training related to the manufacturer’s procedures for opening the newly installed lifeboat hooks. During the port state control drill held on August 9, 2016, the crew of lifeboat no. 2, the only lifeboat launched during the drill, was only able to manually release the hooks by opening the gate and removing the lifting ring out from under the closed hook from outside the lifeboat in calm waters. SOLAS regulation requires crew involved in deploying an MES to have participated in the actual deployment of an MES every 2 years. However, none of the Caribbean Fantasy crew other than the staff captain had ever deployed an MES or witnessed an MES deployment. The staff captain’s training record included a document signed by a VIKING service manager attesting to receiving “instruction in handling and deployment of a VIKING Evacuation Slide” with rafts on June 5, 2014, more than 2 years before the accident. The safety officer, who deployed the port MES and was responsible for training the crew on the system, said she had never seen one deploy until the day of the accident. Her only MES training had been to watch an instructional video shown to Caribbean Fantasy crew during recurrent MES training. The third officer, who launched the starboard-side MES, did not have any information in his company training record to document a previous deployment of an MES. The AB who released the first two liferafts from the starboard side told investigators he had never seen an MES deploy. The safety officer explained that she was responsible for training all crewmembers in their emergency roles and verifying that training required by the STCW Code had been completed when they reported on board. For the MES requirements, she used the instructional video to train the crew in how to deploy and use the system. The training video was not filmed on board the

NTSB Marine Accident Report 52

Caribbean Fantasy and did not include narration explaining each aspect of the operation of the MES and liferafts. The video included short segments covering the entire MES evolution, beginning with the MES deployment and continuing through each stage up to and including the towing of inflated liferafts filled with passengers away from the vessel. The video showed close- up views of the bowsing line winch in operation and a view of the MES but did not demonstrate how to use the winch to position the MES platform with the bowsing line. The training video, guided by the safety officer, was last shown to the crew on August 4, 2016. On October 21, 2015, the Caribbean Fantasy was detained by the US Coast Guard in San Juan for failing to meet minimum safety standards. One of the deficiencies listed on the Port State Control Report of Inspection was “The ship’s crew could not provide documentation that any crewmembers were participating in MES deployments, and when questioned during drills, crew reported never having participated in a deployment.” Coast Guard Sector San Juan cleared this deficiency on November 23, 2015, after RINA informed port state control inspectors that “training for MES party member has been carried out with means of audio video aids.” 1.12.3 Drills Because the voyage between Santo Domingo and San Juan was scheduled to be less than 24 hours, there was no SOLAS requirement to have newly embarked passengers muster at their assigned emergency locations. However, prior to getting under way from Santo Domingo, the hotel crew conducted a safety briefing for the passengers, in accordance with SOLAS regulations, using a prerecorded announcement. Crewmembers and some passengers interviewed stated that the briefing took place outside the reception area on deck 5 and included instructions on what to do and where to go in the event of an emergency, followed by a lifejacket demonstration. Crew drills were required to take place no less than weekly based on SOLAS regulations. Weekly drills were conducted on board the Caribbean Fantasy; however, investigators were unable to verify crewmember attendance. Attendance checklists were printed from the safety officer’s computer using the emergency plan database and, according to her, attendance records were maintained in that database. It was not possible to recover these records from the safety officer’s computer. The last general drill, which included fire and abandon ship, was conducted on August 9, 2016. This drill was observed by the Coast Guard during the port state control inspection and documented in the issued certificate of compliance. Before that, a general fire and abandon-ship drill was documented on July 2, 2016. On a July 2016 schedule spreadsheet titled “Monthly Drills and Training Return,” which was maintained by the safety officer and sent to the company, an X was marked in the date boxes for July 3, 9, 17, 24, and 31 for weekly drills. The official logbook and the spreadsheet matched, with the exception of 1-day discrepancies for the July 3 and July 17 drills, which were recorded 1 day earlier in the logbook. The August 2016 schedule found on the bridge after the accident had drills scheduled for August 5 and 12. The safety officer stated that these drills had been completed, though there were no logbook entries indicating they had taken place. The last drill recorded in the official logbook prior to July was March 16, 2016. During the time the Caribbean Fantasy was in the shipyard in Tunisia (March 26–July 3, 2016), no drills were held. The ship was not operational and only about 14 crewmembers were on board.

NTSB Marine Accident Report 53

In addition to general drills for fire, general emergency, and abandon ship, more limited drills were also carried out and recorded for specific emergency systems, such as the MES. Attendance was documented by a signature next to each attending crewmember’s name on paper records kept in the safety officer’s office. The last record of attendance for the MES deployment video was on March 1, 2016, although there was a logbook entry for August 4. According to the logbook, a liferaft training drill was carried out on August 7. The last record of individual lifeboat crew drills was dated January 2, 2016. Fire squad drills were also carried out for those assigned to firefighting positions. The last record of these drills was July 25, 2016, for a drill involving fire squads no. 1 and no. 2 and the boundary cooling and SCBA bottle-filling teams. There was no record of attendance for this drill. Investigators found no lesson plan or record of drill details for any of the individual drills conducted. According to SOLAS regulation, details of drills for abandon ship, fire, and other lifesaving appliances and onboard training must be recorded. 1.13 Safety Management and Port State Control 1.13.1 General Overview Responsibility for the safe operation of a vessel lies with the owner, operator, and crew of a vessel. The International Safety Management (ISM) Code was developed to provide a standard for the safe management and operation of ships and for pollution prevention, and under the code companies that own or operate vessels subject to the SOLAS convention must develop, implement, and maintain an SMS.32 Although ultimate responsibility for the safe operation of the vessel lies with the owner, operator, and crew of the vessel, the ISM Code includes responsibilities for the flag state—the nation where the vessel is registered—to verify and certify that a company and vessel are complying with the provisions of the code, as well as other national and international laws and regulations. Flag states or their designated ROs verify compliance with the ISM Code by determining: 1) the conformity of the SMS with the requirements of the ISM Code, and 2) that the SMS ensures compliance with mandatory rules and regulations, and that other applicable codes, guidelines and standards recommended by the flag, classification societies and maritime industry organizations are taken into account.33 Classification societies are commonly delegated this responsibility as ROs.

32 IMO, “International Management Code for the Safe Operation of Ships and for Pollution Prevention – International Safety Management (ISM) Code,” IMO Resolution A741(18), adopted November 4, 1993. 33 IMO, “Revised Guidelines on the Implementation of the International Safety Management (ISM) Code by Administrations,” IMO Assembly Resolution A.1071(28), adopted December 4, 2013.

NTSB Marine Accident Report 54

The flag state issues a document of compliance to the company operating a vessel or vessels once it has verified that the company has an SMS that meets the intent of the code. Once a document of compliance has been issued, the flag state may then issue a safety management certificate to a vessel operated by the company after verifying, through audits and surveys, that the company and its shipboard management operate the vessel in accordance with the approved SMS. The port state control (PSC) program grew out of the need of maritime nations to ensure that foreign vessels traveling in their waters were safe, properly outfitted, and under the control of skilled mariners. It is the final element in the maritime safety regime, ensuring that other entities with the primary responsibility for compliance—owners, operators, vessel crews, and flag states— have carried out their respective obligations. PSC officers (PSCOs) perform examinations of a vessel’s hull, vital equipment, and elements of the SMS to ensure substantial compliance with applicable international laws and domestic regulations. They examine crew certificates and related documentation to ensure that each individual has the appropriate training and competencies to serve in their respective positions on board. In addition, PSCOs observe the crew during an emergency drill, such as a firefighting and an abandon-ship exercise, to further validate the competencies of the individuals who are assigned safety-critical functions on board. If a vessel and/or its crewmembers who are assigned to safety-sensitive positions are found to be non-compliant or substandard, the PSCO may take a variety of actions to ensure that the condition or conditions are rectified. These actions include the stoppage of all cargo operations, formally detaining the vessel under the appropriate authority, or, in more severe situations, ordering the vessel’s departure from port and banning it from future transits upon the waters subject to that nation’s authority. Under US law, a foreign-flagged passenger vessel intending to embark or disembark passengers in a US port must obtain a certificate of compliance. To obtain this certificate, the owner must complete several steps, beginning with the submission to the Coast Guard of vessel plans that address structural fire protection, fire control, and means of escape. These plans are reviewed for compliance with applicable requirements. Once this plan review process is complete, local PSCO personnel conduct an onboard examination of the vessel to validate the accuracy of the drawings and plans, assess the overall condition of the vessel and its equipment, and ensure that crewmembers in safety-critical positions possess the minimum skill and proficiency to perform their duties. This process is known as an initial certificate of compliance (ICOC) plan review and examination, and it is more comprehensive than a fundamental PSC examination that is performed on foreign-flagged cargo or other vessel types. Once the foreign-flagged passenger vessel has successfully completed the ICOC, the local Coast Guard COTP will issue a certificate of compliance to the vessel, effective for 1 year, allowing passenger operations to begin. After the ICOC, the vessel is subject to periodic examinations where PSCOs confirm that the vessel remains in substantial compliance with applicable laws and regulations. 1.13.2 Caribbean Fantasy Port State Control Record On January 4, 2011, the Caribbean Fantasy’s classification society, at the time Bureau Veritas (BV), submitted plans to the Coast Guard’s Marine Safety Center (MSC) to begin the ICOC formal review process in anticipation of the vessel’s transfer to Santo Domingo/San Juan service. On February 9, BV requested that Sector San Juan personnel attend a test deployment of the vessel’s MES and schedule the ship’s ICOC examination in early March. Because the plan

NTSB Marine Accident Report 55

review process had not yet been completed by the MSC, Sector San Juan personnel declined to attend the test deployment of the MES or schedule the examination. As the initial plan review process continued into March, the vessel had yet to receive an ICOC or any other approval from the Coast Guard that was needed to operate in US waters. On March 9, Coast Guard personnel at Sector San Juan learned that the Caribbean Fantasy was intending to enter the port of Mayaguez and at that time issued a COTP order directing the vessel to remain no less than 12 nautical miles offshore until the agency had received a nontank vessel response plan.34 On March 11, Sector San Juan personnel rescinded the initial COTP order and issued a new COTP order. The order allowed the vessel to enter the port but prohibited it from engaging in passenger or cargo operations until the appropriate examinations were completed and documents were provided indicating that it was in substantial compliance with applicable treaties and regulations for the particular service. On March 15, 2011, a Coast Guard Sector San Juan PSCO conducted a PSC examination and determined that the vessel met the minimum requirements to operate as a cargo vessel. The following day, the COTP order was amended to allow the Caribbean Fantasy to perform cargo operations, but the vessel was still prohibited from carrying passengers or hazardous materials. On March 18, 2011, the vessel was expelled from the port of Mayaguez due to issues with its marine sanitation device (MSD). In response, the operating company proposed temporary measures, such as the retention of sewage on board and disposal ashore, as well as permanent repairs to the MSD, and this was accepted by the Coast Guard. The vessel was allowed to return to US waters and resume cargo operations. In May 2011, the MSC completed the ICOC plan review process. The review identified numerous areas where structural fire protection was inadequate and would need to be either installed or upgraded. Between May 10 and May 13, Sector San Juan PSC personnel visited the vessel multiple times to perform the ICOC examination. The team validated that the plans submitted to and approved by the MSC were accurate, ensured all structural fire protection concerns raised by the MSC were addressed, assessed the overall condition of the vessel and its equipment, and ensured that the crewmembers in safety-critical positions possessed the minimum skill and proficiency to perform their duties. At this point during the examination, the PSC team provided a 174-item worklist to the vessel and did not issue an ICOC. Approximately 80 of the worklist items were corrected or cleared when the team departed the vessel, and the remaining items were outstanding. Among the worklist items, the PSC team noted that the fixed firefighting drencher system for garages A, B, and C failed during tests, with multiple pipe bursts and discharge nozzles that were clogged due to rust and corrosion. The vessel was prohibited from conducting further cargo operations until the system was repaired and functioned as originally designed. The Sector San Juan PSC team returned to the vessel on May 16 and again on May 19 to continue the ICOC and attempt to clear worklist items. They found that the vessel was still not in substantial compliance with the applicable regulations. The garage drencher system was retested on both days and failed. The Coast Guard issued a letter to a company representative that noted the three failures

34 The Nontank Vessel Response Plans and Other Response Plan Requirements final rule, which was published in the Federal Register on September 30, 2013, requires vessel owners or operators of nontank vessels 400 gross tons and above to prepare and submit oil spill response plans for vessels operating on the navigable waters of the United States. Source: Coast Guard, Clarification of Implementation Date and Notice of Arrival Requirements for Nontank Vessel Response Plan Final Rule, Marine Safety Information Bulletin 38-13, October 25, 2013.

NTSB Marine Accident Report 56

of the drencher system and urged the company to “make any and all necessary repairs.” That letter also warned the company that if the system failed again during future testing, the vessel would be formally detained. The Coast Guard PSC team visited the vessel on May 26 and returned on May 30, 2011, and at the end of that examination determined that the Caribbean Fantasy was in substantial compliance. The Coast Guard issued the ICOC, allowing the vessel to begin carrying passengers for hire. After consultation with the Seventh Coast Guard District, Sector San Juan placed the vessel on a quarterly re-examination schedule to ensure the vessel remained in compliance. In March 2014, the Caribbean Fantasy experienced a fire in its transitional power battery bank, causing significant damage to the space where the equipment was installed. The transitional battery bank was designed to supply electrical power to all the vessel’s vital loads from the time the main generators were stopped or failed during an emergency until the vessel’s emergency generator was brought on line. The Caribbean Fantasy was provided with special dispensation from the flag state of Panama that allowed it to continue operations until June 5, 2014, at which time the vessel was to proceed to dry dock for repair. From July 17 to 18, 2014, Coast Guard PSCOs performed a post dry-docking examination and renewed the vessel’s certificate of compliance for a 1-year period. The team discovered 17 deficiencies during the examination. Two of those deficiencies were related to the emergency power source and the transitional source of emergency power, which were not powering all the required vital systems that the power sources were required to supply. On August 20, 2014, Coast Guard PSCOs boarded the vessel to follow up on outstanding items from the July 2014 examination and found two serious deficiencies that warranted formal detention of the vessel. Specifically, they found that the vessel’s transitional source of emergency power was still not fully functional, and the automatic sprinkler system was not capable of being discharged because the tank that held firefighting water was not pressurized. The vessel’s crew rectified both conditions that day and a PSCO returned to the vessel to verify the repairs. The Caribbean Fantasy was subsequently cleared to resume operations. As a result of this detention, on December 5, 2014, RINA, which had replaced BV as the vessel’s classification society in 2012, placed the vessel on an unscheduled survey scheme. According to RINA representatives, the program required that a RINA surveyor perform an unscheduled survey on the vessel each quarter, and these surveys had the same scope as a regular annual survey. On January 21, 2015, Coast Guard PSCOs boarded the vessel to complete a quarterly examination and found three deficiencies, one of which noted concerns with the vessel’s VDR. The VDR displayed multiple error codes, including a failure to synchronize with one of the vessel’s global positioning system (GPS) receivers. On October 21, 2015, while performing a quarterly examination, Coast Guard PSCOs found 21 deficiencies, three of which were serious enough to substantiate a formal detention of the vessel for a second time. A significant amount of oil in the vessel’s bilge and on deck surfaces in the engine room presented a fire hazard. The Sector San Juan Marine Inspection Training Officer told investigators that the PSC team found all the deck plates slippery and coated with oil. The bilges in the engine room had a layer of oil estimated at 1 inch thick on the surface of the water. The PSCO also discovered that the second engineer was not properly certificated to serve on board the vessel and the third engineer’s certificate of competency was missing an endorsement by Panama. Among the 18 lesser deficiencies recorded during this PSC examination, the PSCOs

NTSB Marine Accident Report 57

determined that the “general lack of upkeep and maintenance of the vessel” was enough objective evidence to conclude that the SMS was not fully implemented. Accordingly, the Coast Guard issued a requirement for the vessel to undergo an external ISM audit. The following day, PSCOs returned to the Caribbean Fantasy to verify that the three significant deficiencies that warranted the vessel’s detention were rectified and to begin clearing other deficiencies. The COTP and his deputy commander also visited the vessel to see it firsthand. According to the COTP, the vessel was a concern for the command. PSCOs subsequently cleared the three significant deficiencies, and the vessel was allowed to resume operations. A surveyor from RINA was also on board the vessel on October 22 to perform a survey following up on the findings of the Coast Guard. At that time, the RINA surveyor issued multiple recommendations of class and submitted an International Association of Classification Societies (IACS) procedural report, form 17, “reporting on deficiencies possibly affecting the implementation of the ISM code on board during surveys.” The RINA surveyor that issued the report was the same individual that had performed audits of the SMS on board the vessel on April 12, 2014, and September 13, 2014, and had issued the vessel its safety management certificate. Additionally, the same individual had performed the initial audit of the SMS at the Baja Ferries company headquarters on December 18, 2014, and issued a full-term ISM Code document of compliance.35 Per IACS requirements, the surveyor’s report, once completed, should have been submitted to the responsible department at RINA for review. The responsible department was required to judge whether the reported deficiencies were affecting the implementation of the ISM Code on board. If the responsible department judged that the reported deficiencies were not affecting the implementation of the ISM Code, the report was to be filed. However, if the reported deficiencies were judged to be affecting the implementation of the ISM Code, the report was to be sent to the flag administration of the vessel, and the RO who audited the SMS system (in this case RINA) was required to review the report and decide what action, if any, was to be taken. When investigators asked RINA representatives to provide information related to the outcome of this report submission, they indicated that the principal surveyor in the RINA Fort Lauderdale office had performed an additional external ISM Code audit on the vessel, and the organization continued with the unscheduled survey scheme that the vessel had been subjected to since December of 2014. Senior RINA officials from the Fort Lauderdale office met with the chief executive officer (CEO) of Baja Ferries and the DPA afterward to discuss the need for improvement on the vessel. During the July 2016 port call in Gibraltar, local PSCOs examined the vessel based on the reported blackout. PSCOs visited the vessel on July 6 and returned on July 8 for a more detailed examination. During that second examination, PSCOs discovered three deficiencies, one of which warranted the vessel’s detention. The Caribbean Fantasy’s nos. 1, 2, and 3 diesel generators were not operational, and the vessel’s only source of electrical power was its emergency generator. The diesel generator breakdowns were due to failed O-rings allowing water to leak by into the prime mover crankcases. The other deficiencies noted were a seawater feed pump that was not operational, and that overall engine room cleanliness was insufficient. This was the vessel’s third formal detention for non-compliance in 3 consecutive years. Gibraltar Maritime Authority PSCOs carried out a follow-up examination on July 14 and released the vessel from detention.

35 RINA had issued Baja Ferries an interim document of compliance in April 2014.

NTSB Marine Accident Report 58

Just prior to the accident, on August 9, 2016, Coast Guard Sector San Juan PSCOs performed a certificate of compliance renewal examination of the vessel. The PSCOs reported seven deficiencies, three of which remained outstanding at the time of the accident, according to both Coast Guard and RINA documentation. Two of those deficiencies were firefighting related: dampers in two ventilation ducts in the vehicle spaces were not shutting properly and a section of the overhead on garage deck B was missing A-60 insulation. Another deficiency noted that a 120 VAC electrical outlet in a crewmember’s cabin was not properly installed and had been modified for service as a 240 VAC outlet. At the completion of the examination, the Caribbean Fantasy was issued a certificate that was valid for 1 year. Because the vessel’s cargo loading ramp was located on the starboard side of the vessel, the Caribbean Fantasy always moored with its starboard side to the pier. This mooring arrangement and the existing safety protocol found in both IMO guidance, as well as the Coast Guard’s Marine Safety Manual, prohibited the Coast Guard Sector San Juan PSCOs from requiring the vessel’s crew to demonstrate the launching and in-water operation of lifeboats no. 1 and no. 3 on the starboard side during PSC examinations where an abandon-ship drill was performed. All abandon-ship drills conducted during examinations by the Coast Guard Sector San Juan PSCOs were performed using the port lifeboat no. 2 and its assigned crew. Entries in the Caribbean Fantasy’s official logbook indicated that quarterly launching and in-water operations of lifeboats no. 1 and no. 3, as required by SOLAS regulations, had last been conducted in October

1. Reports to the company during the months of January, February, and March 2016 informed

the vessel’s management of the problem with putting the starboard-side boats in the water, and the last report noted that this would be done in the shipyard period. Although there was evidence of the starboard-side lifeboats being launched during the shipyard period, the launching was not done with the assigned crew. 1.14 Waterway Information The waters north of San Juan are unprotected open ocean. The climate is tropical marine with plentiful sunshine (only 5 days a year entirely without sunshine, on average), although there is an average of 255 days a year with measurable precipitation in the port of San Juan. The currents in this area are influenced by the direction and strength of the winds. The prevailing east trade winds generally cause a west drift.36 The water depth at the location where the fire started on the Caribbean Fantasy was about 900 feet. The depth decreases sharply approaching the coast of Puerto Rico. The depth at the grounding site was about 22 feet. The seabed at the grounding site consisted of sand and shells.37 1.15 Weather Information The accident occurred during daylight hours in clear visibility. At 0730, about the time the fire broke out in the engine room, a weather buoy located 1.7 miles east of the San Juan harbor entrance recorded winds from 083 degrees true at 13 knots, with gusts to 17 knots, and an air temperature of 83.7 degrees F. At 0800, the wave height was recorded at 4 feet with a period of 6.1 seconds and a mean wave direction from 054 degrees true. Conditions as recorded at the buoy remained consistent throughout the duration of the abandonment.

36 Climate information from National Oceanic and Atmospheric Administration (NOAA), Coast Pilot 5, 45th Edition, Washington DC: Department of Commerce, 2017. 37 Depth and seabed information from NOAA Chart 25668.

NTSB Marine Accident Report 59

2 Analysis 2.1 Exclusions There were no reported problems with the Caribbean Fantasy’s main electrical system, its emergency diesel generator, or its steering systems. The ship’s deck and engine officers were properly licensed and certificated for the capacity in which they were working. The weather conditions at the time of the accident were favorable and were not determined to be causal to the accident. Thus, the NTSB concludes that electrical and steering systems, crew licensing and certification, and weather were not causal factors in the accident. Because alcohol testing of the crew was not conducted and drug testing was not completed within the 32-hour maximum time window required by Title 46 CFR and the company’s SMS policy, evidence was insufficient to determine whether alcohol or other drug use played a role in this accident. 2.2 Fire According to statements from the chief engineer, motorman, and wiper, a fuel leak developed at an end flange on the fuel supply line for the port main engine. The leaking fuel sprayed onto the exhaust manifold and turbo chargers, igniting the fuel. Postaccident examination of the flange, which was covered in fuel and soot, was consistent with the crewmembers’ report of the location of the fuel leak and origin of the fire. Additionally, the area of clean burn found on the turbocharger exhaust duct is indicative of a pressurized fuel-fed fire. MGO, which was the fuel used in the engine at the time of the accident, has a flashpoint of 140 degrees F (60 degrees C) and an average autoignition temperature of 428 degrees F (220 degrees C).38 The average temperature of the exhaust manifold was 896–932 degrees F (480–500 degrees C) according to the engine manufacturer. Thus, the temperature of the turbocharger exhaust manifold was sufficiently high to ignite the fuel being sprayed from the fuel supply end flange. The NTSB concludes that the fire on the port main propulsion engine started when fuel spraying from a leaking blank flange at the end of the engine’s fuel supply line came into contact with the hot exhaust manifold and ignited. Investigators examined the end flange for the fuel supply line on the port main engine to determine the source of the leak. The blanking plate and gasket were recovered and examined in the NTSB laboratory. The gasket broke off in several pieces when the fuel pipe flange was disassembled. The gasket material was rigid and brittle, and the exposed interior edges were heavily deteriorated. The manufacturer’s specification for the gasket material to be used in the port main engine fuel system was a joint sheet made from a non-asbestos fiber mixed with a heat- and chemical-resistant nitrile rubber binder. Laboratory analysis of the gasket material determined that it was likely composed of silicone rubber, a compound that breaks down when exposed to fuel. The NTSB concludes that use of improper gasket material on the pressurized fuel supply end flange for the port main engine resulted in a breakdown of the gasket material and the eventual fuel spray that led to the fire.

38 The standard flashpoint of a combustible liquid is determined experimentally under laboratory conditions. The actual flashpoint can be reduced as much as 100 degrees F (38 degrees C) when the combustible liquid is splashed or aerosolized.

NTSB Marine Accident Report 60

In addition to the faulty gasket material, the blanking plate that was installed on the flange was neither produced by the original equipment manufacturer nor fabricated to a design or quality standard. The blanking plate was not dimensionally accurate compared to the end flange, did not have a raised face, and did not meet the engine manufacturer’s specifications. A blanking plate constructed to the manufacturer’s specification would have ensured the proper compression of the gasket and an effective seal. The NTSB concludes that the nonstandard blanking plate used on the end flange of the port main engine fuel supply system potentially exacerbated the leak that led to the fire. Crewmembers attempted to secure the fuel source to the fire by shutting QCVs for the fuel and lube oil systems. However, all eight fuel and lube oil system QCVs were found blocked open following the accident. The condition of the blocking devices suggests that they had been in place for an extended period of time. For example, the nut and bolt used to block open the starboard HFO storage tank QCV had accumulated dust and dirt, as well as paint that matched the paint used on the valve. Further, the RINA Port State Control Preventive Assessment conducted on July 14, 2016 (a month before the accident), included photographic evidence of the port lube oil storage tank QCV with a blocking device in place. Postaccident examination of the port lube oil storage tank revealed the blocking device was in the same position as the photograph from July 14. During the August 9, 2016, port state control inspection, Coast Guard officers witnessed the blocking devices being used on the vessel’s QCVs but were told they were only there to facilitate testing. Although the crew stated that the devices were only in place for inspection purposes, the condition of the devices and the fact they were found in place after the accident indicate otherwise. The NTSB concludes that bolts inserted by Caribbean Fantasy engineering personnel into the QCVs to prevent their closing were permanently in place for use during routine operations. Blocking QCVs open is a safety hazard that should never be permitted. Per the 2011 Coast Guard safety alert, “Blocking or disabling these valves is unacceptable under any circumstance. It is absolutely critical that they operate correctly, are maintained, and ready for use at all times.” Even if blocking devices are only put in place to facilitate testing of QCVs, use of the devices during examinations, inspections, and surveys does not fully test the QCV functionality because it does not verify that valve closure fully isolates associated systems. The NTSB concludes that testing during recent class surveys and port state control examinations did not adequately test the full functionality of the QCVs. The NTSB recommends that RINA Services require operators to perform full function tests of QCVs during surveys, ensuring that associated systems shutdown as designed and intended. Further, the NTSB recommends that IACS encourage all member organizations to require operators to perform full function tests of QCVs during surveys, ensuring that associated systems shut down as designed and intended. Additionally, the NTSB recommends that the Coast Guard require operators to perform full function tests of QCVs during inspections and examinations, ensuring that the associated systems shut down as designed and intended. During the postaccident examination of the main engine room, investigators discovered several areas of inadequate installation of spray tape on port and starboard main engine fuel piping flanges and connections. Measures covered in the MAN Diesel & Turbo customer information letter about proper guarding against splashes and sprays were not employed. Spray tape manufacturer’s guidance to use multiple layers of tape to prevent fuel spray onto a hot surface were likewise not used. Investigators determined that only one layer of tape was used around the port fuel supply end flange where the fire started.

NTSB Marine Accident Report 61

Based on the improper installation of the spray tape, use of incompatible gasket material and a nonstandard flange blanking plate, and the blocking open of quick-closing valves, the NTSB concludes that a lack of adherence to manufacturer’s guidance and proper machinery maintenance procedures contributed to the fire aboard the Caribbean Fantasy. 2.3 Firefighting Systems At the outbreak of the fire, the chief engineer activated the engine room water-mist fixed firefighting system. Water-mist systems are designed to suppress fires in a localized area; the system pumps are not rated to supply pressure to multiple locations at the same time. VDR data showed and postaccident examination confirmed that the water-mist system section valves in five different locations were activated simultaneously, and it is unlikely that the water-mist system pumps could have kept up with the multiple actuations. Both the water-mist system and the drencher system were configured to use freshwater from the no. 8 port and starboard tanks, although both systems could be aligned to the fire main (seawater) system. When the drencher system was activated, the water supply to the water-mist system was likely reduced. Both freshwater tanks were empty when sounded by salvage teams after the accident. There is no evidence that the water-mist suppressed or contained the fire based on statements from the chief engineer and staff captain indicating that the fire continued to grow after the system was activated. The NTSB concludes that the water-mist fixed firefighting system did not suppress the fire likely due to the simultaneous activation of multiple coverage zones and a reduced water supply as a result of drencher system activation. Therefore, the NTSB recommends that the company perform a worst-case scenario risk assessment for all active water-based fire-suppression systems on its vessels to evaluate whether the existing freshwater supply is sufficient. There is no indication that the CO2 system, once released, suppressed or contained the fire. Based on photographic and video evidence of smoke rising from the Caribbean Fantasy’s stacks after the chief engineer had actuated the ventilation damper closing valve, it is likely that some ventilation dampers did not close or did not seal tightly, allowing oxygen to continue to feed the fire while CO2 escaped the space. The NTSB concludes that the CO2 fixed firefighting system did not extinguish the fire due to ventilation dampers that failed to properly close. The deck between the main engine room and garage B was protected by A-60-rated insulation, which is designed to limit the transmission of heat to an adjacent or overhead area for a period of 60 minutes. However, there was a report of an explosion in garage B 30 minutes after the fire started, indicating that the A-60 fire protection was compromised. A-60 boundary design criteria are based on standardized test fires in a laboratory setting and may not be representative of fire conditions in a fuel-fed machinery space fire. Because the QCVs were manually blocked open, the valves did not operate as designed, which prevented crew from cutting off the fuel source to the fire. The NTSB concludes that the uninterrupted flow of fuel to the fire from the blocked-open QCVs allowed the fire to exceed the design criteria of the structural fire protection for the engine room, and as a result the fire spread to the garage deck above.

NTSB Marine Accident Report 62

1. 4

Abandonment About 58 minutes after the fire started, the master announced to the Coast Guard that the fire could not be controlled and the Caribbean Fantasy was being abandoned. According to the master, the following factors, taken together, necessitated the abandonment: • Fire, smoke, and explosions were reported in the engine room and the garages, and the fires were not under control; • the CO2 fixed firefighting system had been deployed in the engine room; • there was no indication or confirmation of the operability of the water-mist system in the engine room; • the vessel was listing to port about 4 degrees, and further use of the drencher system would have increased the list; • there was smoke intrusion into the accommodation areas; and • operating on emergency electrical power, the vessel had no operational hotel support systems such as potable water, toilets, galley equipment, or air conditioning. When interviewed, the master stated that he was aware of the nearby SAR and response assets available from the port of San Juan and that there was an active Coast Guard base in the port. Although the postaccident condition of the vessel indicates that it may have been possible for passengers to remain safely on board on open decks, the master felt it was safer to have all persons abandon the vessel considering the ship’s geographical location. All passengers and crew were brought ashore, and there were only a small number of injuries. The NTSB concludes that the decision to abandon the Caribbean Fantasy was reasonable given the availability of nearby response resources, the proximity to a large port, and the uncertainty of the effects on the vessel from the fire. Although all passengers ultimately got off the vessel and were transported ashore, there were numerous problems, such as difficulties with launching the lifeboats, deploying the MES, and generally following established emergency procedures, that slowed the process and added confusion. The commanders for all lifeboats reported that during the abandonment they were unable to open the release hooks. When the lifeboats were lowered to the water, the hydrostatic interlocks should have disengaged, allowing the hooks to open when the lifeboat commander rotated the release handle. Failing that, the crew could have broken the clear plastic cover on the RCU, manually disengaged the hydrostatic interlock, and opened the hooks using the release handle. The operations manual provided a final option of opening the hooks by means of designated wrenches. Evidence indicates that back-up options were not attempted on any of the boats, and lifeboats no.1 and no. 2 were released only after the crew employed a dangerous manual method of releasing the lifting ring from each hook. Evidence from lifeboat no. 3 indicates that the safety pin in the RCU was not removed and recovery pins in the hooks were in the inserted position, both of which would have prevented the boat’s release. Investigators and the hook manufacturer examined the hooks after the accident and concluded that they were functional at the time of the accident. The lifeboat no. 1 commander told investigators that he had not received familiarization training for the lifeboats on board the Caribbean Fantasy, and the lifeboat no. 2 commander stated that he received no training on the new release hooks. Based on the evidence that the lifeboat no. 3 hooks were not operated per the operations manual during the accident, it is likely that the lifeboat no. 3 commander was also not trained in their use. Familiarization would have been necessary

NTSB Marine Accident Report 63

based on the installation of the new hooks and their additional safety features. Further, contrary to SOLAS regulation, lifeboats no. 1 and no. 3 had not been launched and maneuvered in the water by their assigned operating crew in the 3-month period before the accident. The last time the starboard-side boats were launched was in March 2016 during shipyard maintenance, before the new hooks were installed. The inability of each of the lifeboat crews to open the release hooks significantly delayed or prevented the launching of the boats and required the assistance of multiple response vessels to recover passengers and crew. The inability to quickly release the lifeboats from the hooks significantly increased the risk to the passengers and crews of the lifeboats. During the delay in releasing lifeboat no. 1, two people either jumped or fell into the water and had to be rescued by a Coast Guard small boat. Lifeboat no. 3, meanwhile, repeatedly struck the side of the ship before it could be hoisted back out of the water. As it was being hoisted, the winch tripped off line, leaving the boat suspended about 6 feet above the water. Passengers were then forced to transfer from the elevated lifeboat to a Coast Guard ATON boat. As the passengers were transferring, the lifeboat commander had to convince passengers not to jump into the water, as some of them were beginning to panic. The transfer of passengers was a risky undertaking, though it was likely the only option for getting the passengers to safety. The NTSB concludes that crewmembers assigned to safety-critical roles on the lifeboats were not proficient with the procedures for opening the lifeboat release hooks, which delayed the abandonment and put lives at risk. Investigators identified numerous issues related to the launching of the MESs on board Caribbean Fantasy. The process for using an MES includes first inflating the slide, followed by using the bowsing line to properly position the slide to ensure a proper angle to the vessel. The first liferaft container is then launched and pulled to the platform by crewmembers, where the raft is inflated in preparation for boarding. The second liferaft can then be launched and prepared in the same manner. After the rafts are filled to capacity and released, follow-on liferafts are launched, inflated, and loaded. During the accident, liferafts for the starboard MES inflated before they were brought alongside the floating platform, which made retrieval by the Caribbean Fantasy crew difficult and required the assistance of Coast Guard and other response vessels. The liferaft containers were manually launched from the stowage racks at nearly the same time. Due to the manual launch, painter lines remained attached to each of the containers. As the Caribbean Fantasy and the liferaft containers drifted apart in the winds and seas, it is likely that the painter lines came under tension, which triggered the automatic inflation of the rafts before the crew could pull them to the MES platform. The NTSB concludes that the crew did not follow the manufacturer’s procedures when launching the starboard MES liferafts, which resulted in the premature inflation of the liferafts. Per the manufacturer’s guidance, the MES slide should be at an angle of 30–35 degrees to the waterline when deployed. When the starboard-side MES on the Caribbean Fantasy was deployed, the angle to the waterline was about 54 degrees. Despite the extreme slope, passengers and crew were sent down the MES slide. Evacuees descended down the slide faster than intended before slowing abruptly as the chute turned toward the floating platform. Three passengers and two crewmembers suffered ankle injuries before the slide angle was corrected using the Coast Guard response boat. The NTSB concludes that the five ankle injuries resulted from using the MES deployed at a steeper angle than designed. Per SOLAS regulations, MESs are required to be deployed on board each vessel every 5 years for testing and training purposes. Additionally, each crewmember assigned to MES duties is required to participate in the deployment of a system every 2 years (but in no case longer than

NTSB Marine Accident Report 64

3 years). Of the crewmembers responsible for the deployment of the MESs on Caribbean Fantasy, only one had witnessed a deployment of an MES prior to the accident. The safety officer—the person tasked with training and familiarizing the crew with the ship’s MES—had not witnessed or participated in a deployment. In October 2015, the Coast Guard detained the Caribbean Fantasy in part because “the ship’s crew could not provide documentation that any crewmembers were participating in MES deployments, and when questioned during crew drills, crew reported never having participated in a deployment.” The deficiency was cleared by RINA in November 2015 with a statement that “training for MES party member has been carried out with means of audio video aids. The proper familiarization for the MES deployment has been verified during our attendance by direct interview to MES party members about deployment procedure iwo the [Life Saving Appliance] equipment.” Investigators reviewed the video used for MES training on board the Caribbean Fantasy. The video, which had no audio, was designed to be instructor-led; however, the safety officer who led the training had not received any training beyond watching the video herself. Given the difficulties discovered in the deployment of the MES during the accident, the NTSB concludes that the crew assigned to deploy the MES and liferafts were not adequately trained, which delayed the abandonment. Based on the identified training deficiencies of the lifeboat crews and MES teams, the NTSB recommends that the company review its lifesaving appliance training program, including recordkeeping procedures, and revise the program to ensure that crewmembers have proficiency with onboard systems. PA system announcements informing the passengers about the fire provided two different orders in two different languages in quick succession. The significant variation in the announcements—only one of which directed preparations to abandon ship—went unnoticed by the bridge team. Also, neither of these announcements were coordinated with signals from the ship’s alarm bell and whistle. Thus, the response to the accident was almost immediately thrown into confusion. That confusion continued throughout the accident events. Some crewmembers were unsure of whether to go to their emergency stations or directly to their assigned survival craft. Others were untrained for their responsibilities when they arrived at their assigned stations. For passenger ships, SOLAS regulation requires that all survival craft needed in a full abandonment be launched with their full complement of persons and equipment within a period of 30 minutes from the time the abandon-ship signal is given. The Spanish-language announcement to abandon the Caribbean Fantasy was made at 0747. The last person removed from lifeboat no. 3 that was suspended from the side of the vessel was about 1130, 3 hours and 43 minutes after the abandon-ship order was given. According to the passenger ship safety certificate, the number of passengers and crew that the ship was permitted to carry was 1,150. At the time of the accident, the vessel was at almost half that capacity. As noted above, the abandonment was delayed by the crew’s lack of training on the lifesaving equipment and unfamiliarity with the abandonment process. Although all passengers survived the accident, the NTSB concludes that the abandonment process on board the Caribbean Fantasy was disorganized and inefficient. Had the circumstances been different—further from port, in inclement weather, or at nighttime—and had there been less time to leave the vessel, the result could have been catastrophic. 2.5 Mass Rescue Operations Despite communications difficulties experienced during the rescue, all individuals on board were brought ashore, and there were only a small number of injuries. Given the chaotic abandonment process on board the ship, the safe recovery of the passengers and crew is proof alone that the MRO was successful. Sufficient response vessels and aircraft responded to the scene, an on-scene coordinator directed the actions of most response assets, a shoreside receiving area

NTSB Marine Accident Report 65

for the management and care of the survivors was established, and most importantly, all passengers and crew were evacuated from the vessel. The NTSB concludes that the mass rescue operation was effective. When investigators analyzed the multiple aspects of the response that resulted in the success of the MRO, two key factors stood out. First, at the time of the accident, the Caribbean Fantasy was in close proximity to the entrance of the port of San Juan. Coast Guard Sector San Juan and subordinate Coast Guard commands such as the small boat station and the cutter Joseph Tezanos were located either in the port or nearby. Many of the other organizations that responded to the vessel’s call for assistance, including CBP, PREMA, and the City of San Juan’s EOC, EMS, police, and fire department, were also located in the area and had sufficient staffing and response assets available. Additionally, many of the good Samaritan and commercial vessels that assisted were either based in the port or operating just offshore. Second, the development, design, and functional exercises of the various elements of Coast Guard Sector San Juan’s MRO plan, led by the unit’s PVSS and other command personnel, proved significant to the outcome. The written plan addressed all aspects of a response to a large-scale incident by multiple agencies. Just as important, the Coast Guard personnel responsible for managing the plan performed frequent training exercises, above and beyond agency requirements, to educate and better prepare other federal, state, and local response organizations, as well as local maritime stakeholders, for an actual event. As noted, Coast Guard Sector San Juan is unique in that it has a dedicated PVSS; all other PVSSs are assigned at the district level. The NTSB concludes that the presence of a PVSS at Coast Guard Sector San Juan, who had trained and worked with local officials, contributed to the success of the Caribbean Fantasy MRO. The NTSB recommends that the Coast Guard evaluate the feasibility of creating a PVSS billet at each sector that has the potential for a SAR activity characterized by the need for immediate assistance to a large number of persons in distress, and staff sector-level billets, as appropriate, based on the findings of that evaluation. 2.6 Safety Oversight To meet the intent of the ISM Code, a company must have a well-constructed SMS that is implemented at all levels of the organization. Successful implementation of an SMS requires a genuine commitment and a proactive effort from top managers. During postaccident interviews, the CEO and other top managers at Baja Ferries spoke about their personal commitment to safety and the company’s safety-oriented culture; however, investigators did not find substantial evidence to validate those claims. The CEO had no direct involvement with the daily operations of the Caribbean Fantasy, vessel manning, or crew training. Despite the company having a total fleet of just four passenger vessels, the CEO last visited the Caribbean Fantasy in early 2015, over a year before the accident. He also indicated that he did not review the minutes of the safety meetings conducted on board the vessel by any of its masters and that he did not attend the last external ISM audit of the company headquarters performed by the classification society. Investigators identified instances where the CEO held meetings with senior company staff, the Coast Guard, RINA, and the flag state to discuss safety and the need for operational improvement on board the Caribbean Fantasy. But these meetings were predominately a management reaction to an adverse event such as a port state control examination that resulted in multiple deficiencies or a formal detention of the vessel.

NTSB Marine Accident Report 66

The CEO stated that he met 4–6 times a year with the company’s DPA. The DPA, per the ISM Code, is the individual ashore who is charged with ensuring the safe operation of each vessel and serves as the primary communication link between vessel personnel and senior company management. This level of interaction between these two critical safety positions, given the vessel’s historically poor compliance record leading up to the accident, was inadequate. Safety must not only be a priority for the company, but it also must be a priority on board each vessel operated by the company. One of the most fundamental performance measures used to evaluate the effective implementation of an SMS is the vessel’s compliance record with applicable procedures, regulations, and requirements. Although the DPA performed internal audits and RINA performed external audits of the SMS, investigators found little evidence that those audit findings were successfully used for continuous improvement. For example, on at least two separate occasions, port state control authorities deemed the vessel’s engine room to be a fire risk because of poor housekeeping. During the ICOC inspection, the Caribbean Fantasy’s drencher system was significantly degraded, delaying certification, while in a later port state control inspection, the vessel’s sprinkler system was found to be unable to discharge. Engineering equipment was lacking in maintenance, in need of repair, or requiring service during port state control inspections, classification surveys, and the postaccident examination. Shortcomings were captured on audit forms, with the root causes identified and corrective actions to be implemented, yet the shortcomings were often repeated. Port state control officers from the US and Gibraltar found substandard conditions that warranted three formal detentions of the vessel in the years immediately preceding the fire. The ISM Code also requires that the company ensure that vessels are manned with qualified individuals who are trained in the performance of their duties relating to safety and response to emergency situations. During the Caribbean Fantasy fire and the subsequent abandon-ship event, there were multiple instances where crew serving in safety-critical positions did not perform as expected by the vessel’s emergency plan and station bill. The ISM Code required the operating company to “establish and maintain procedures to control all documents and data which are relevant to the SMS.” It further stated that the company should ensure that “valid documents are available at all relevant locations; changes to documents are reviewed and approved by authorized personnel; and obsolete documents are promptly removed.” The Baja Ferries SMS stated, “The Company has supplied all the safety and environmental protection documentation required for correct operation of the office and the managed ships,” and provided procedures for annual checks for “availability, condition and validity.” Yet during the investigation, numerous documents for shipboard operations and emergency procedures were found to be obsolete or unusable in the working language of the ship. For example, there were two significantly different versions of the emergency plan and station bill posted on the ship, both of which were approved by RINA; instructions for the operation of the water-mist and CO2 systems were in Italian and poorly translated English; and instructions for operating the release hooks in lifeboats no. 1 and no. 2 were for hooks that had been replaced. Many of these documents were hold-overs from previous vessel owners that had not been verified or updated. Baja Ferries’ company policy, set in accordance with SOLAS regulations and stated in the SMS, established English as the working language for the Caribbean Fantasy. However, during interviews, the DPA, the master, and the safety officer stated that English proficiency was an issue. Further, the safety officer told investigators that she had to conduct training in both English and Spanish due to a lack of proficiency among crewmembers and that she had to reassign some

NTSB Marine Accident Report 67

emergency duties due to language issues. The safety officer also noted in an interview that sometimes she would not know if the crewmembers could speak English prior to attending familiarization and other initial onboard training. Baja Ferries’ SMS assigned responsibility for safety training to the safety officer. The SMS also provided checklists to document the training and familiarization of newly reported personnel. Investigators found that completion of this training was poorly documented, if completed at all. A lack of training was evident in the response to the accident. Crewmembers in many safety-critical positions did not have the necessary training or familiarization to carry out their emergency duties. The second officer (off watch) had been on board the ship for 4 days, was not aware of his emergency position on the bridge, had not completed basic familiarization training or emergency drills, and was unfamiliar with the operation of the lifeboat he was assigned to command. None of the officers assigned to command lifeboats knew how to operate the release hooks once the boats were in the water. Additionally, investigators determined that the starboard-side lifeboats had not been operated in the water since October 2015, which denied the crews of these boats the opportunity to train and become familiar with their operation. Crewmembers assigned to deploy the MES were unfamiliar with the launching sequence for liferaft containers. Only one crewmember had observed an actual deployment of an MES, which was not conducted on board the vessel. The ship operator did not take adequate measures, including training and familiarization of individual crewmembers, to ensure the competency of the ship’s crew for their emergency duties. Regarding engineering practices, the company’s SMS required machinery spaces to be “kept clean, tidy and leak free,” yet port state control officers found the spaces unsafe due to poor housekeeping and oil on the decks and in the bilges. The SMS also stated that “sources of ignition must be protected from contact with fuel or lubricating oil,” but investigators found fuel and lube oil flanges throughout the engineering spaces that were not protected from splash or spray in accordance with the IMO and manufacturer’s guidance. Despite recurring visits by shoreside staff (DPA and technical manager) during the shipyard period, recent PSC examinations, and specific SMS guidance to the chief engineer and all engineering officers to ensure the safe and efficient operation of the engineering plant, safety devices were deliberately disabled—fuel and lube oil QCVs were blocked open. Additionally, very few maintenance actions were documented, though required by the SMS, since the shipyard period began in March 2016. Although the company’s written SMS met the objectives of the ISM Code, the NTSB concludes that Baja Ferries failed to successfully implement its SMS, both ashore and on board the Caribbean Fantasy. Therefore, NTSB recommends that the company provide formal and recurrent training to shoreside management and senior shipboard officers on the ISM Code to ensure that all senior leaders are fully knowledgeable about the policies and procedures in the SMS. The preamble to the ISM Code states “the cornerstone of good safety management is commitment from the top.” Yet the lack of engagement by Baja Ferries’ CEO and company management’s reactive vice proactive approach to issues identified on the Caribbean Fantasy before the accident demonstrate that this commitment was lacking. Furthermore, the failure of Baja Ferries to ensure that the vessel was properly maintained and manned with an adequately trained crew, its failure to successfully implement the SMS, and its acceptance of unsafe practices such as blocking open QCVs suggests that an unsafe mindset was pervasive throughout the company. The NTSB concludes that Baja Ferries possessed a poor organizational safety culture,

NTSB Marine Accident Report 68

as evidenced by management’s lack of commitment to core safety programs and its disconnect from the training, maintenance, and operations on board the Caribbean Fantasy. Although the owner and operator have the ultimate responsibility for the overall condition and safe operation of a vessel, the flag state and the classification society/recognized organization also assume an oversight responsibility. Because conditions on vessels are dynamic in nature, it would be inappropriate to suggest that a single instance of deficient performance on board the Caribbean Fantasy during a port state control examination would support the conclusion that additional preventative action was warranted on behalf of either the flag state of Panama or the classification society RINA Services. However, the Caribbean Fantasy had a history of poor performance, including three detentions by two different port state control authorities, that should have prompted both Panama and RINA to implement increasingly more assertive actions to correct deficiencies. Although the classification society implemented a heightened monitoring and unscheduled survey program in December 2014, this action had little effect in resolving the conditions on board the Caribbean Fantasy. In October 2015, a RINA surveyor examined the vessel, issued multiple recommendations of class, and submitted an IACS procedural report 17 on deficiencies possibly affecting the implementation of the ISM Code. After the Caribbean Fantasy’s detention in Gibraltar in July 2016, a RINA surveyor photo-documented a deliberately disabled QCV, which was found in the same condition after the accident. QCV blocking devices had clearly been in place for an extended period of time and should have raised concern with the classification society. Despite reports from surveys and port state control inspections, no additional actions were taken by Panama or RINA other than to continue unscheduled surveys. Noting a pattern of unsafe operations, Panama could have exercised its authority as flag state to impose sanctions on the owner for repeated non-compliance or remove the vessel from registry, at least temporarily terminating operations. RINA, acting under the delegated authority of Panama, could have suspended or withdrawn the classification certificates it issued to the vessel, which would have also resulted in a stoppage of operations. At the time of the fire, neither Panama nor RINA had taken any steps to escalate the consequences for the owner’s failure to maintain the vessel in a state of compliance. The NTSB concludes that the recognized organization, RINA Services, failed to meet its responsibilities, on behalf of the Panama Maritime Authority, to ensure that the Caribbean Fantasy met and remained in compliance with international and statutory requirements. Therefore, the NTSB recommends that the classification society RINA Services review the performance of auditors who conducted either ISM Code document of compliance audits at Baja Ferries S.A. de C.V. or safety management certificate audits on the Caribbean Fantasy to ensure that their individual actions met the intent of RINA Service’s rules and guidance. Furthermore, the NTSB recommends that the Panama Maritime Authority review the performance of RINA Services, acting on behalf of the flag-state administration, to determine whether the classification society is meeting IMO guidelines. Finally, the NTSB recommends that the Panama Maritime Authority review actions taken as the flag state of the Caribbean Fantasy and revise procedures to ensure future actions meet the intent of IMO guidelines.

NTSB Marine Accident Report 69

3 Conclusions 3.1 Findings

1. Electrical and steering systems, crew licensing and certification, and weather were not

causal factors in the accident.

1. The fire on the port main propulsion engine started when fuel spraying from a leaking

blank flange at the end of the engine’s fuel supply line came into contact with the hot exhaust manifold and ignited.

1. Use of improper gasket material on the pressurized fuel supply end flange for the port

main engine resulted in a breakdown of the gasket material and the eventual fuel spray that led to the fire.

1. The nonstandard blanking plate used on the end flange of the port main engine fuel

supply system potentially exacerbated the leak that led to the fire.

1. Bolts inserted by Caribbean Fantasy engineering personnel into the quick-closing

valves to prevent their closing were permanently in place for use during routine operations.

1. Testing during recent class surveys and port state control examinations did not

adequately test the full functionality of the quick-closing valves.

1. Lack of adherence to manufacturer’s guidance and proper machinery maintenance

procedures contributed to the fire aboard the Caribbean Fantasy.

1. The water-mist fixed firefighting system did not suppress the fire likely due to the

simultaneous activation of multiple coverage zones and a reduced water supply as a result of drencher system activation.

1. The carbon dioxide fixed firefighting system did not extinguish the fire due to

ventilation dampers that failed to properly close.

1. The uninterrupted flow of fuel to the fire from the blocked-open quick-closing valves

allowed the fire to exceed the design criteria of the structural fire protection for the engine room, and as a result the fire spread to the garage deck above.

1. The decision to abandon the Caribbean Fantasy was reasonable given the availability

of nearby response resources, the proximity to a large port, and the uncertainty of the effects on the vessel from the fire.

1. The abandonment process on board the Caribbean Fantasy was disorganized and

inefficient.

1. Crewmembers assigned to safety-critical roles on the lifeboats were not proficient with

the procedures for opening the lifeboat release hooks, which delayed the abandonment and put lives at risk.

NTSB Marine Accident Report 70

• The crew assigned to deploy the marine evacuation system and liferafts were not

adequately trained, which delayed the abandonment.

• The crew did not follow the manufacturer’s procedures when launching the starboard

marine evacuation system liferafts, which resulted in the premature inflation of the liferafts.

• The five ankle injuries resulted from using the marine evacuation system deployed at a

steeper angle than designed.

• The mass rescue operation was effective.
• The presence of a passenger vessel safety specialist at Coast Guard Sector San Juan,

who had trained and worked with local officials, contributed to the success of the Caribbean Fantasy mass rescue operation.

• The company failed to successfully implement its safety management system, both

ashore and on board the Caribbean Fantasy.

• Baja Ferries possessed a poor organizational safety culture, as evidenced by

management’s lack of commitment to core safety programs and its disconnect from the training, maintenance, and operations on board the Caribbean Fantasy.

• The recognized organization, RINA Services, failed to meet its responsibilities, on

behalf of the Panama Maritime Authority, to ensure that the Caribbean Fantasy met and remained in compliance with international and statutory requirements. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the fire aboard the roll-on/roll-off passenger vessel Caribbean Fantasy was Baja Ferries’ poor safety culture and ineffective implementation of their safety management system on board the vessel, where poor maintenance practices led to an uncontained fuel spray from a blank flange at the end of the port main engine fuel supply line onto the hot exhaust manifold of the engine. Contributing to the rapid spread of the fire were fuel and lube oil quick-closing valves that were intentionally blocked open, fixed firefighting systems that were ineffective, and a structural fire boundary that failed. Contributing to the fire and the prolonged abandonment effort was the failure of the Panama Maritime Authority and the recognized organization, RINA Services, to ensure Baja Ferries’ safety management system was functional. NTSB Marine Accident Report 71

4 Recommendations As a result of its investigation, the National Transportation Safety Board makes the following safety recommendations: To the US Coast Guard: Require operators to perform full function tests of quick-closing valves during inspections and examinations, ensuring that the associated systems shut down as designed and intended. (M-18-1) Evaluate the feasibility of creating a passenger vessel safety specialist billet at each sector that has the potential for a search and rescue activity characterized by the need for immediate assistance to a large number of persons in distress, and staff sector-level billets, as appropriate, based on the findings of that evaluation. (M-18-2) To Baja Ferries S.A. de C.V.: Perform a worst-case scenario risk assessment for all active water-based fire suppression systems on your vessels to evaluate whether the existing freshwater supply is sufficient. (M-18-3) Review your lifesaving appliance training program, including recordkeeping procedures, and revise the program to ensure that crewmembers have proficiency with onboard systems. (M-18-4) Provide formal and recurrent training to shoreside management and senior shipboard officers on the International Safety Management (ISM) Code to ensure that all senior leaders are fully knowledgeable about the policies and procedures in the safety management system. (M-18-5) To RINA Services S.p.A: Require operators to perform full function tests of quick-closing valves during surveys, ensuring that associated systems shut down as designed and intended. (M-18-6) Review the performance of auditors who conducted either International Safety Management Code document of compliance audits at Baja Ferries S.A. de C.V. or safety management certificate audits on the Caribbean Fantasy to ensure that their individual actions met the intent of RINA Service’s rules and guidance. (M-18-7) To the International Association of Classification Societies: Encourage all member organizations to require operators to perform full function tests of quick-closing valves during surveys, ensuring that associated systems shut down as designed and intended. (M-18-8)

NTSB Marine Accident Report 72

To the Panama Maritime Authority: Review the performance of RINA Services, acting on behalf of the flag-state administration, to determine whether the classification society is meeting International Maritime Organization guidelines. (M-18-9) Review actions taken as the flag state of the Caribbean Fantasy and revise procedures to ensure future actions meet the intent of International Maritime Organization guidelines. (M-18-10)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III T. BELLA DINH-ZARR Chairman Member

EARL F. WEENER

Member

Adopted: June 5, 2018

NTSB Marine Accident Report 73

Appendixes Appendix A – Investigation Information The Coast Guard was the lead federal agency in this investigation. The NTSB launched a team of investigators to the accident scene August 18–26, 2016. While on scene, investigators interviewed crewmembers and passengers from the Caribbean Fantasy, as well as first responders from the port of San Juan. In addition, investigators documented the vessel’s characteristics and damage, gathered documentation, and retrieved and reviewed recorded data from the vessel’s VDR and other information systems. Investigators returned to San Juan September 14–16 to participate in the post-casualty examination and surveys of lifesaving systems and the ship’s machinery and accommodation spaces. On March 20, 2017, the Coast Guard conducted a 9-day district formal hearing into the accident. During the hearing, held in San Juan, Coast Guard and NTSB investigators questioned crewmembers, company management, classification society representatives, and Coast Guard personnel. Appendix B – Vessel Information Table 1. Vessel Information. Vessel Caribbean Fantasy Owner/Operator Baja Ferries S.A. de C.V. Port of registry Panama City Flag Panama Type Roll-on/roll off passenger vessel Year built 1989 IMO number 8814263 Classification society RINA Services Construction Steel Length 613.9 ft (187.1 m) Draft 22 ft (6.7 m) Beam/width 88.7 ft (27 m) Tonnage 28,112 gross tons Engine power; manufacturer Two 14,400 hp (10,738 kW) Mitsubishi MAN B&W 8L58/64 diesel engines Persons on board 511 (387 passengers, 124 crew)

NTSB Marine Accident Report 74

References Braemar Technical Services Inc. 2017. “Caribbean Fantasy” Advice No. 3 Summary. Coast Guard. 2011. Inspection of Fuel Oil Quick-Closing Valves, Marine Safety Alert 01-11, Washington, DC: Department of Homeland Security. Coast Guard, 2013. Clarification of Implementation Date and Notice of Arrival Requirements for Nontank Vessel Response Plan Final Rule. Marine Safety Information Bulletin 38-13. Washington, DC: Department of Homeland Security. Coast Guard. 2015. Navigation Rules: International―Inland. Washington, DC: Department of Homeland Security. Coast Guard. 2017. “Coast Guard Boats.” Coast Guard Compass. http://coastguard.dodlive.mil/2017/08/coast-guard-boats/. Coast Guard. 2017. Port State Control in the United States 2016 Annual Report. Washington, DC: Department of Homeland Security. IMO. 1974, as amended. International Convention for the Safety of Life at Sea. London, IMO. IMO. 1993. International Management Code for the Safe Operation of Ships and for Pollution Prevention – International Safety Management (ISM) Code. London: IMO. IMO. 1995. Guidelines for Passenger Safety Instruction on Ro-Ro Passenger Ships. Maritime Safety Circular 681, London: IMO. IMO/ICAO. 1999. International Aeronautical and Maritime Search and Rescue (IAMSAR) Manual. London: IMO Publishing. IMO. 2013. Revised Guidelines on the Implementation of the International Safety Management (ISM) Code by Administrations. IMO Resolution A.1071(28), London: IMO. National Oceanic and Atmospheric Administration. 2017. Coast Pilot 5, 45th Edition, Washington DC: Department of Commerce. RINA Services. 2016. Port State Control Preventive Assessment, RINA no. 7647, File no. 16/XA/695/01. Schat-Harding. 1997. Installation, Operation and Maintenance Manual, VIP Davits/W-winches. ed. 971117 VIKING LIFE-SAVING EQUIPMENT A/S. 1999. Manual, VIKING Marine Evacuation System, M/V Caribbean Fantasy

FD07502 ｜ 2018_美国_MAR1802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Fire On Board US Small Passenger Vessel Island Lady Pithlachascotee River Near Port Richey, Florida January 14, 2018

Accident Report NTSB/MAR-18/02 PB2019-100203

National Transportation Safety Board

NTSB/MAR-18/02 PB2019-100203 Notation 58698 Adopted December 11, 2018

Marine Accident Report Fire On Board US Small Passenger Vessel Island Lady Pithlachascotee River Near Port Richey, Florida January 14, 2018

National Transportation Safety Board

490 L’Enfant Plaza, SW Washington, DC 20594

National Transportation Safety Board. 2018. Fire On Board US Small Passenger Vessel Island Lady, Pithlachascotee River Near Port Richey, Florida, January 14, 2018. Report NTSB/MAR-18/02. Washington, DC. Abstract: This report discusses the fire that destroyed the small passenger vessel Island Lady on January 14, 2018, at the mouth of the Pithlachascotee River near Port Richey, Florida. The vessel, with 53 people on board, was on a scheduled transit to an offshore casino boat, the Tropical Breeze I, located about 9 miles offshore in the Gulf of Mexico. Shortly before 1600, the Island Lady captain received a high-temperature alarm for the port engine’s jacket-water system. He notified the vessel’s operating company, Tropical Breeze Casino Cruz, and turned the Island Lady around to return to the dock. During the return trip, smoke began filling the lazarette, main deck spaces, and engine room. The captain deliberately beached the vessel close to shore in shallow water. All passengers, crewmembers, and company employees evacuated the vessel by entering the water and wading/crawling ashore. The Port Richey Police Department, Pasco County Sheriff’s Office, Port Richey Fire Department, and US Coast Guard responded to the fire. The Florida Fish and Wildlife Conservation Commission, Tarpon Springs Police Department, Dunedin Police Department, and Pinellas County emergency services also provided aid. Fifteen people were injured and transported to local hospitals; one of them, a female passenger, died in the hospital hours after the fire. Drug and alcohol testing was conducted on the crewmembers; all results were negative. No pollution was reported. Damage was estimated to be less than $500,000; therefore, a major marine casualty was not declared. The NTSB investigated the accident under Title 49 United States Code 1131 (a)(1)(f)(ii) as an accident of recurring character because of a similar fire on board another of the operating company’s vessels, the Express Shuttle II, in 2004. From its investigation of this accident, the NTSB identified safety issues in the following areas: • Lack of company guidance regarding engine high-temperature alarms • Lack of fire detection in unmanned spaces with exhaust tubing • Insufficient preventive maintenance • Insufficient crew training and documentation • Inappropriate material and design of fuel tank level-indicator system On the basis of its findings, the NTSB makes safety recommendations to Tropical Breeze Casino Cruz, LLC and the US Coast Guard. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. Title 49 United States Code, Section 1154(b). For more detailed background information on this report, visit www.ntsb.gov and search for NTSB accident ID DCA18FM010. Recent publications are also available in their entirety on this website. Other information about available publications also may be obtained from the website or by contacting: National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551 Copies of NTSB publications may be downloaded at no cost from the National Technical Information Service’s National Technical Reports Library at https://ntrl.ntis.gov/NTRL/. This product may be accessed using product number PB2019-100203. For additional assistance, contact: National Technical Information Service (www.ntis.gov) 5301 Shawnee Rd., Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000

iii Contents Table of Figures............................................................................................................................. v Acronyms and Abbreviations ..................................................................................................... vi Executive Summary .................................................................................................................... vii

1. Factual Information .................................................................................................................. 1
2. 1 Background .......................................................................................................................... 1
3. 2 Accident Narrative ............................................................................................................... 3
4. 3 Evacuation ............................................................................................................................ 7
5. 4 Shoreside Emergency Response ........................................................................................... 8
6. 5 Injuries .................................................................................................................................. 9
7. 6 Toxicological Testing ........................................................................................................... 9
8. 7 Damage ............................................................................................................................... 10
9. 8 Meteorological Information ................................................................................................ 12
10. 9 Personnel Information ......................................................................................................... 13

Captain ................................................................................................................................ 13 Senior Deckhand ................................................................................................................. 13 Deckhand 1 ......................................................................................................................... 13 Deckhand (New-Hire) ......................................................................................................... 14 Deckhand (Pre-Hire) .......................................................................................................... 14 1.10 Personnel Training ........................................................................................................... 14 Regulatory Training Requirements .................................................................................... 14 Company-Based Training ................................................................................................... 15 1.11 Vessel Information ............................................................................................................ 15 Construction and Equipment .............................................................................................. 15 Certification ........................................................................................................................ 17 Propulsion System .............................................................................................................. 17 Cooling System .................................................................................................................. 18 Electrical System ................................................................................................................ 21 Fuel System ........................................................................................................................ 21 Fire Detection System ........................................................................................................ 22 Fire Suppression System .................................................................................................... 24 Firefighting Equipment ....................................................................................................... 25 Lifesaving Equipment ......................................................................................................... 25 Inspection History .............................................................................................................. 25 1.12 Reported Incidents ............................................................................................................ 26 1.13 Waterway Information ..................................................................................................... 26 1.14 Company Information ....................................................................................................... 26 Day-to-Day Operations ...................................................................................................... 26 Port Captain ........................................................................................................................ 27 Engineer .............................................................................................................................. 27 Other Company Vessels ..................................................................................................... 27 Vessel Maintenance ............................................................................................................ 28 1.15 Previous Fire and NTSB Safety Recommendations Involving Company Vessel ............ 36

iv

1. Analysis .................................................................................................................................... 40
2. 1 Exclusions .......................................................................................................................... 40
3. 2 Cause of the Fire ................................................................................................................. 40
4. 3 Insufficient Preventive Maintenance .................................................................................. 41
5. 4 Crew Emergency Response, Training, and Documentation ............................................... 44
6. 5 Lack of Fire Detection in Unmanned Spaces with Exhaust Tubing .................................. 46
7. 6 Inappropriate Material and Design of Fuel Tank Level-Indicator System......................... 47
8. Conclusions .............................................................................................................................. 48
9. 1 Findings .............................................................................................................................. 48
10. 2 Probable Cause ................................................................................................................... 49
11. Recommendations ................................................................................................................... 50
12. 1 New Recommendations ...................................................................................................... 50
13. 2 Previously Issued Recommendation Reiterated in this Report .......................................... 50

Appendix A, Investigation ........................................................................................................... 52 Appendix B, Table of Vessel Fires .............................................................................................. 53

v

Table of Figures Figure 1. The Island Lady before the accident ................................................................................ 1 Figure 2. Satellite image of the accident area .................................................................................. 2 Figure 3. Close-up of the accident waterway .................................................................................. 4 Figure 4. The Island Lady’s top and main decks ............................................................................. 5 Figure 5. Still image from home surveillance video footage .......................................................... 6 Figure 6. Passengers and crew evacuating the Island Lady ............................................................ 8 Figure 7. Post-fire wreckage of the Island Lady seen from above ............................................... 10 Figure 8. Looking toward the Island Lady’s destroyed bow ......................................................... 10 Figure 9. Port and starboard engines at storage facility after removal from the Island Lady ....... 11 Figure 10. Close-up of postaccident crack in the block between cylinders 4 and 5 ..................... 12 Figure 11. Layout of the Island Lady’s lower level ...................................................................... 16 Figure 12. The Island Lady’s starboard engine in May 2017 ....................................................... 18 Figure 13. A new raw-water pump housing and new rubber impeller ......................................... 19 Figure 14. Simplified diagram of the engine cooling water system ............................................. 20 Figure 15. Engine exhaust tubes transiting through lazarette spaces ............................................ 21 Figure 16. The Island Lady’s fuel tank drain valve and plastic tubing to fuel-level indicator ..... 22 Figure 17. Drawing of the fire detection system layout ................................................................ 23 Figure 18. Components of the Island Lady’s fixed fire suppression system ............................... 24 Figure 19. Casino boat Tropical Breeze I ..................................................................................... 28 Figure 20. Blank (sample) daily checklist for the Island Lady engine room ...................................... 29 Figure 21. Monthly maintenance report for the Island Lady, October 2017 ...................................... 31 Figure 22. Water leaking from the Island Lady’s raw-water pump before replacement .............. 32 Figure 23. Raw-water pump housing and impeller from the Island Lady .................................... 33 Figure 24. New raw-water pump impeller installed in its pump housing ..................................... 34 Figure 25. Removed pistons from the Island Lady’s starboard engine ........................................ 35 Figure 26. Stern of Island Lady while in drydock April 2017 ...................................................... 36

vi

Acronyms and Abbreviations CFR

Code of Federal Regulations CO2

carbon dioxide COI

certificate of inspection GPS

global positioning system MISLE Marine Information for Safety and Law Enforcement (Coast Guard database) MSIB Marine Safety Information Bulletin NVIC Navigation and Vessel Inspection Circular OCMI Officer in Charge, Marine Inspection SMS safety management system VHF very high frequency

vii

Executive Summary About 1600 on the afternoon of January 14, 2018, a fire broke out in an unmanned space on the small passenger vessel Island Lady near Port Richey, Florida, during a scheduled transit to a casino boat located about 9 miles offshore in the Gulf of Mexico. Fifty-three people were on board the Island Lady. After receiving a high-temperature alarm on the port engine, the captain turned the Island Lady around to return to the dock. During the return trip, smoke began filling the lazarette, main deck, and engine room. The captain deliberately beached the vessel in shallow water near shore to evacuate the passengers. All crewmembers, employees, and passengers evacuated the vessel by entering the water and wading/crawling ashore. Fifteen people were injured and transported to local hospitals; one passenger died in the hospital several hours after the fire. The Island Lady, valued at $450,000, was declared a constructive total loss. The National Transportation Safety Board (NTSB) determines that the probable cause of the fire on board small passenger vessel Island Lady was Tropical Breeze Casino Cruz’s ineffective preventive maintenance program and insufficient guidance regarding the response to engine high-temperature conditions, which resulted in the captain’s continued operation of an engine that was overheating due to a cooling water pump failure, leading to ignition of the exhaust tubing and surrounding structure. Contributing to the spread of the fire was the lack of fire detection in the vessel’s lazarette, which was not required by regulations and which allowed the fire to take hold unbeknownst to the crew. The NTSB identified the following safety issues: Lack of company guidance regarding engine high-temperature alarms: After the captain received a high-temperature alarm for the port engine’s jacket-water system, he did not shut down the engine but instead left it idling. Doing so allowed the overheating engine to continue to generate excessive heat, which in turn affected the exhaust tubes and ignited their surrounding structures. Tropical Breeze Casino Cruz did not provide specific guidance to its vessel captains about how to respond to high-temperature alarms. Lack of fire detection in unmanned spaces with exhaust tubing: Although federal regulations require small passenger vessels to have fire detection and suppression systems in spaces containing propulsion machinery (such as engine rooms), the regulations do not require such systems in unmanned spaces with engine exhaust tubing. The fire on board the Island Lady most likely started in the lazarette―an unmanned space aft of the engine room―through which the exhaust tubes led toward the vessel’s stern. Because there was no fire in the engine room initially, activating the vessel’s fixed fire suppression system for that space would have served no purpose; further, activation would have caused the vessel to needlessly lose all available propulsion during the emergency. Insufficient preventive maintenance: Although Tropical Breeze Casino Cruz stated that it implemented a preventive maintenance program after a previous fire on board a company vessel (the Express Shuttle II) in response to an NTSB safety recommendation, the quality of the program was insufficient. The US Coast Guard does not require small passenger vessels to have preventive maintenance programs and, importantly, even when such programs are voluntarily in place (such as in this case), the Coast Guard provides no enforcement oversight.

viii

Insufficient crew training and documentation: The investigation revealed that the Island Lady crewmembers lacked sufficient understanding of firefighting principles and that their training drills were infrequent or not completed. In addition, records pertaining to crew training drills and daily maintenance checklists were kept only on board the vessel and were lost in the fire; no duplicate records were kept ashore. Inappropriate material and design of fuel tank level-indicator system: Counter to Title 46 Code of Federal Regulations 182.440 (a)(7), the Island Lady’s fuel tanks were equipped with plastic hoses used as fuel level indicators; further, the system did not have automatic shutoff valves. As a result, during the fire, the plastic material melted and the release of diesel fuel exacerbated the fire. Based on this investigation, the NTSB makes new safety recommendations to Tropical Breeze Casino Cruz and the US Coast Guard and also reiterates existing recommendations to the Coast Guard.

1

• Factual Information

1. 1 Background

The 72-foot-long small passenger vessel Island Lady (figure 1) was owned by A.B.K. Enterprises and operated by Tropical Breeze Casino Cruz, LLC.1 The vessel operated out of a shoreside facility in Port Richey, located on the Pithlachascotee River in Pasco County, Florida (figure 2). The Island Lady shuttled passengers and company employees to and from the company’s casino boat, the Tropical Breeze I (see figure 19), which, when in passenger service conducting gambling operations, was positioned 9 nautical miles offshore in the Gulf of Mexico. Figure 1. The Island Lady before the accident. (Undated photo provided by previous owner)

1 At the time of the accident, the Island Lady was operated by Tropical Breeze Casino Cruz, LLC. The operating company had previously been in business under other names: Port Richey Casino, SunCruz, and Paradise of Port Richey.

2

At the time of the accident, the state of Florida did not permit land-based casino gambling other than on Native American reservations, but did permit day cruises offering customers the opportunity to gamble offshore.2 On Florida’s west coast, casino vessels would operate at least 9 nautical miles out into the Gulf of Mexico, beyond the Natural Resource Boundary. On Florida’s east coast, casino vessels were permitted to operate in the Atlantic Ocean beyond the Three-Nautical-Mile Line (the outer limit of Florida’s jurisdiction).3

Figure 2. Satellite image of the accident area. A red triangle marks the approximate location where the captain beached the Island Lady and fire consumed the vessel. (Background by Google Earth; inset by World Atlas) The Island Lady, which was advertised as a “hi-speed water taxi,” typically made three daily roundtrips to the Tropical Breeze I; the transit between shore and the casino boat took about 45 minutes. The Tropical Breeze I departed the dock in the morning, depending on the tide; spent the day beyond the Nine-Nautical-Mile line; and, once all passengers had disembarked for the evening, returned to the dock sometime after midnight, depending on the tide. (For more detail about the trip schedules, see section “1.14 Company Information; Day-to-Day Operations.”)

2 According to the online American Casino Guide, in 2018, two Florida casino boat operators provided offshore gambling in three locations: Tropical Breeze Casino Cruz in Port Richey, and Victory Casino Cruises in Cape Canaveral and Jacksonville. 3 In accordance with the Submerged Lands Act of 1953, the state waters of most coastal states extend 3 nautical miles from the coastline, as do those on Florida’s east coast. For historical reasons, however, the state waters on Florida’s west coast extend 9 nautical miles (10.376 statute miles, or about 3 “leagues”) into the Gulf of Mexico. Port Richey Gulf of Mexico Pithlachascotee River N

~ 1 nm Dock

3

1. 2 Accident Narrative

On January 14, 2018, the day of the accident, the 1100 morning shuttle had been canceled due to a low passenger count. Before the subsequent 1530 departure, the captain arrived at the marina where the Island Lady was docked (referred to as “the sticks”). This was the location where the Island Lady was berthed each evening and received fuel twice a week. The captain told investigators that he estimated that about 750 gallons of fuel were on board the Island Lady on the day of the accident. He said the starboard engine started normally but that the port engine did not because of a loose wire connection on the starting batteries. He tightened the electrical connection on the battery post, and then the port engine started. After checking all engine monitoring gauges and the engine cooling water inlet sea strainers and confirming that everything seemed normal, he motored the vessel from the sticks to the passenger boarding dock about 500 feet away. Shortly thereafter, passengers and company employees were allowed to board. About 1530, the Island Lady departed the dock with 36 passengers. The crew consisted of the captain and three deckhands (one senior deckhand, one deckhand [deckhand 1], and one “new-hire” in-training deckhand). In addition, two “pre-hire” employees (a deckhand and a member of the waitstaff department) were on board the Island Lady to become familiarized with operations. Eleven other employees, all employed by Tropical Breeze Casino Cruz, were being transported to work on board the casino boat. The senior deckhand was scheduled to transfer to and work on board the Tropical Breeze I on arrival; the new-hire deckhand was assigned to tend bar on board the Island Lady; and deckhand 1 was scheduled to work on board the Island Lady through the rest of the evening. Deckhand 1 told investigators that he made the safety announcement on the day of the accident, while the vessel was outbound.4 The Island Lady transited through the harbor at slow speed, as that section of the waterway was designated as a no-wake zone (figure 3). A nearby resident’s video surveillance camera, mounted on the second story of the home and aimed toward the northwest, recorded footage of the vessel seen through an opening between two waterfront houses (refer to upcoming figure 5) as the Island Lady was in the final section of the waterway’s “S-turn.” At this time, about 1545, the vessel appeared to be operating normally with no visible indications of smoke or fire; shortly thereafter, the Island Lady transited away from the camera’s view for about 6 minutes. After passing through the S-turn, the captain increased the Island Lady’s speed and brought the vessel “up on plane.” About 15 seconds after the speed increase, a high-temperature alarm activated for the port engine’s jacket-water system. The captain said he looked at the closed-circuit television screen for the engine room and thought he saw a bit of steam in the camera view. The Island Lady was equipped with a fire detection system in the engine room, with a 190°F heat sensor mounted above each of the two propulsion engines. The control panel for the fire detection system was located in the wheelhouse, to the right of the wheel, and was designed to sound a beeping signal and illuminate an indicator light when activated. However, the captain told investigators that he did not hear an alarm from the fire detection system leading up to or during the fire.

4 Federal regulations at Title 46 Code of Federal Regulations (CFR) 185.506 require that, before getting under way on a voyage or as soon as practicable thereafter, the captain will ensure that “suitable public announcements are made informing all passengers” where emergency exits and lifejackets are located and how lifejackets should be donned.

4

Figure 3. Close-up of the accident waterway, with an overlaid yellow trackline of the vessel’s approximate route and labels marking key points in the transit. (Background by Google Earth) About 1551, the Island Lady reappeared in the footage recorded by the shoreside video surveillance camera. Light gray steam/smoke was now emanating from the vessel’s stern area. The captain took the port engine out of gear, shifted it to neutral, and reduced the speed to idle. He left the starboard engine in forward gear and reduced its speed to idle. The video surveillance camera captured the speed reduction. The captain radioed the captain on board the Tropical Breeze I and also telephoned a company representative (a person the company referred to as the “port captain”), informing them both that an engine was overheating and that he was returning the vessel to the dock. The port captain, who held a merchant mariner credential as master, told him to put the engine in reverse to clear any debris in case the vessel’s seawater inlet was obstructed.5 The Island Lady had two decks for passengers: The top deck, which had outdoor passenger seating and also included the wheelhouse; and the enclosed main deck with indoor passenger seating, a bar area, and restrooms (figure 4). The captain told the crewmembers to get all the passengers to the top deck. He then directed the senior deckhand and deckhand 1 to go below and check the engine room. Deckhand 1 descended to the enclosed main deck where the two access hatches to the engine room were located (recessed in the deck). The forward hatch was located in the center of the main deck, and the aft hatch was located just forward of the bar.

5 The port captain was credentialed as master of self-propelled vessels, not including auxiliary sail, of less than 100-gross-register tons upon near coastal waters and had previously operated the Island Lady. N

~ 500 yards

5

Figure 4. Top: The Island Lady’s top deck. Bottom: The Island Lady’s main deck. (Not to scale; images from Tropical Breeze Casino Cruz’s Employee Emergency and Safety Manual.) Deckhand 1 told investigators that when he opened the forward hatch, steam or “transparent smoke” emanated from the engine room. He shut the hatch and instructed nearby passengers to take the stairways to the top deck. He then returned to the wheelhouse and told the captain that he believed the engine was overheating. About 1552, the shoreside video surveillance camera recorded the vessel stopping its forward motion and slowly beginning to turn toward shore. Several people were seen assembling on the top deck.

6

The captain assigned an employee (a casino worker) to steer the vessel while he left the wheelhouse and went below to assess the situation. He approached the forward hatch to the engine room and felt it for heat with his hand before opening it slightly. He noticed steam coming out of the hatch. He instructed the new-hire deckhand to open the aft hatch to the engine room; a smaller amount of steam or white smoke rose from this hatch. The captain instructed the new-hire deckhand to open the doors leading into the enclosed main deck to air out the steam and smoke. The new-hire deckhand opened two doors. The captain then climbed down the aft hatch into the engine room. He did not see any smoke or fire but saw about a 3-foot by 3-foot wet area on the port bulkhead outboard of the port engine. In a postaccident interview, the captain said that he “figured a line just blew off or something.” He left the engine room via the forward hatch and returned to the wheelhouse. He believed, based on the color and smell, that steam was filling the engine room; he said there was no smell of smoke. He told investigators that he instructed the deckhands to close the engine room hatches but said he was not sure if this order was carried out. About 1553, the Island Lady was returning toward the harbor at a speed of about 8 knots. The captain was using the starboard engine for propulsion; the port engine remained in neutral, running at idle speed. The smoke was increasing, turning thicker and also brown/gray in color. After the vessel turned back toward the harbor and transited toward the east, the north winds blew the thickening smoke across the vessel’s beam, and the smoke billowed off the starboard side. As a result, the crewmembers were unable to pinpoint the precise location from where the smoke emanated. The shoreside video surveillance camera recorded the billowing smoke as well as flames emanating from the port exhaust opening on the stern (figure 5). At this point, no other flames were visible.

Figure 5. Still image from home surveillance video footage, with the stern of the Island Lady visible between two houses. Fire emanating from the port side of the stern is circled in yellow. (Video footage provided by witness)

7

The captain directed the senior deckhand to retrieve a fire extinguisher and look around the engine room. He also told deckhand 1 and the new-hire deckhand to follow the senior deckhand down below and assist with backup fire extinguishers. The senior deckhand retrieved a fire extinguisher and entered the engine room via the forward hatch on the main deck. As soon as he opened the hatch, he saw steam or light smoke coming out. He said that when he walked aft through the engine room toward the lazarette, he encountered smoke, which kept getting thicker.6 He tied a bandana around his face and prepared to use the fire extinguisher but was overcome by the smoke, which he said was becoming black. He yelled up to the other crewmembers to get the passengers off the boat, handed up the unused fire extinguisher, and exited the engine room via the aft hatch. He told investigators that he was not sure if the hatches were closed behind him. After leaving the engine room, the senior deckhand walked to the stern and saw flames near the lifejacket storage area and “a big cloud of smoke” emanating from either the “side vents or the exhaust” on the stern. He ran up to the wheelhouse and informed the captain that conditions had worsened and that he needed to shut down the engine. As soon as the captain heard this update, he turned the wheel hard to port toward shore and gave as much power as possible from both engines. He managed to beach the Island Lady in shallow water about 150 feet from shore (see figure 6). The captain said he was lucky to get the vessel turned around and beached before the smoke “overwhelmed the engines and caused them both to shut down.” Once the Island Lady was beached, the captain returned to the enclosed main deck, which was completely filled with black smoke. He closed the portside door that had been opened when smoke was filling the space. 1.3 Evacuation Once the vessel was beached, the deckhands began assisting the passengers in moving toward the bow and preparing to jump into the water. According to witness videos, the smoke increased after the Island Lady was beached, but no flames were yet visible on deck. Many people were seen assembled on the top deck and at the bow of the main deck. None of the crewmembers recalled hearing announcements on the public-address system; they believed that orders were communicated by yelling instructions. About 35 seconds after the captain beached the vessel, the first person jumped off the bow into the water. It is likely that this person was deckhand 1. He said in a postaccident interview that, because he saw that many people were frantic, he jumped off the bow to show them that the water was shallow and that the bottom was soft (several employees and passengers confirmed to investigators that the water depth by the bow was about waist-high; a bit deeper on the sides). Deckhand 1 then began helping people off the vessel. The passengers ranged in age from 18 to 76; half of them were age 60 or older. About 2.5 minutes after the vessel was beached, a deckhand removed the passenger-loading door on the port side of the bow to make it easier for people to exit. About 3 minutes and 20 seconds after the beaching, flames appeared in the aft part of the main deck. Within only about 30 seconds after that, the fire spread and engulfed the entire main deck. At 1604, dispatchers with Pasco County emergency services received the first 911 call about the accident―a resident reported a vessel on fire and people in the water.

6 A vessel’s lazarette is its aftermost compartment below the main deck, typically accessed by a deck hatch.

8

Figure 6. Passengers and crew evacuating the Island Lady. (Photo provided by Christine Robson) After exiting the burning vessel, passengers and crew waded and/or crawled ashore. Many recalled that the bottom was muddy (“quicksand-like”), which made walking difficult. Nearby residents who witnessed the fire assisted in getting the passengers out of the water. Once ashore, the group assembled in residential garages, where homeowners and neighbors supplied blankets, towels, and dry clothes. The senior deckhand and the captain conducted a sweep of the Island Lady to ensure that they were the last people to exit the burning vessel. In postaccident interviews, crewmembers said that the entire event took place too quickly for lifejackets to be distributed. 1.4 Shoreside Emergency Response After the initial 911 call at 1604, Pasco County emergency services dispatchers received two additional calls in quick succession, with both callers stating that they believed all people on board the vessel had been evacuated. A total of nine calls were made to emergency services about the emergency. Two patrol officers and a detective from the Port Richey Police Department were the first responders to arrive on scene about 1615. Pasco County Fire Department units began arriving about

1. Additional fire, medical, and police units from Pasco County―including marine and air

9

units―were dispatched to the scene. Fireboats pumped water onto remaining hot spots on the Island Lady. The Florida Fish and Wildlife Conservation Commission, the Coast Guard, the Tarpon Springs Police Department, the Dunedin Police Department, and Pinellas County emergency services also responded. 1.5 Injuries Fifteen passengers and company employees received medical treatment for injuries such as fractured bones; sprains; back, neck, hip, and shoulder pain; respiratory injuries; and smoke inhalation. According to initial dispatch logs, 11 of the injuries required basic life support and 4 required advanced life support; no life-threatening injuries were reported at first. However, after coming ashore, a female passenger said that her tongue was swelling. She took a 50-mg tablet of diphenhydramine, an antihistamine commonly marketed as Benadryl. The decision was made to transport her to a local hospital. In the ambulance, medical personnel gave her another 50 mg of the antihistamine and also provided intravenous fluids and oxygen. The affected passenger arrived at the hospital at 1705. She told the hospital staff that she had previously experienced a similar reaction to an unrelated stressful situation. Despite the hospital staff’s efforts, her condition worsened. At 2242, nearly 7 hours after the accident, the passenger was pronounced dead. The cause of death was reported as angioedema, which is swelling of deeper skin layers, such as the dermis and subcutaneous tissue. Type of Injury Crew Passengers / Employees Total Fatal 0 1 1 Serious 0 4 4 Minor 0 10 10 None 5 33 38 Total 5 48 53 NOTE: Title 49 CFR 830.2 defines a fatal injury as any injury that results in death within 30 days of an accident. It defines serious injury as that which requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; results in a fracture of any bone (except simple fractures of fingers, toes, or nose); causes severe hemorrhages, nerve, muscle, or tendon damage; involves any internal organ; or involves second- or third- degree burns, or any burn affecting more than 5 percent of the body surface. Table 1. Injuries sustained in the Island Lady fire. 1.6 Toxicological Testing After the accident, the crewmembers submitted to drug and alcohol testing.7 All results were negative.

7 The Coast Guard requires toxicological testing after a serious marine incident, defined at Title 46 CFR 4.03-2 as (a) a marine casualty or accident that results in any of the following: (1) one or more deaths, (2) injury that requires medical treatment beyond first aid and renders the individual unfit to perform routine duties, (3) property damage exceeding $100,000, (4) actual or constructive total loss of an inspected vessel, or (5) actual or constructive total loss of any uninspected vessel that exceeds 100 gross tons; (b) discharge of 10,000 or more gallons of oil into US waters; or (c) release of a reportable substance into the environment of the United States. Because the Island Lady fire resulted in one death, the total loss of the vessel, and property damage exceeding $100,000, the accident qualified as a serious marine incident.

10

1. 7 Damage

The Island Lady, insured for $450,000, was declared a constructive total loss, as everything above the waterline was destroyed (figures 7 and 8). The only remains were the two fire-damaged engines, two damaged generators, remnants of various piping systems and valves, railings around the vessel, deck chairs, and three cylindrical fuel tanks.

Figure 7. Remnants of the Island Lady seen from above. (Photo by Titan Marine & Environmental)

Figure 8. Looking toward the Island Lady’s destroyed bow.

11

In February 2018, a salvage team recovered the remnants of the Island Lady. The components were transported to a secure facility, where investigators examined them in May 2018 (figure 9). After examining the salvaged engines, investigators determined that almost all of the aluminum, bronze, copper, and brass engine components―which included the heat exchanger body, aftercooler housings, front gear covers, flywheel hosing, raw-water pump housings, base and valve covers, oil pans, and other smaller housings―were missing due to the extreme heat generated during the fire.

Figure 9. Port and starboard engines at storage facility after removal from the Island Lady. A service technician and a service manager from Ring Power―an authorized service company for Caterpillar―disassembled the port engine. A crack was discovered between the 4th and 5th cylinder on the port engine’s inboard side (figure 10). The crack was visible starting at the

12

no. 5 cylinder’s liner through the cooling water passage and about 8 inches down the side of the block.8

Figure 10. Close-up of postaccident crack in the block between cylinders 4 and 5 on the Island Lady’s port main engine. 1.8 Meteorological Information Weather data on the day of the accident, recorded at Tampa International Airport (26 miles southeast of Port Richey), showed partly cloudy skies, 10-mile visibility, north-northeast winds at 11.5 mph, and an air temperature of about 61F. The sea temperature was about 56F, according to data recorded by a responding Coast Guard vessel during the fire.

8 An engine block is a casing that contains the internal engine components such as pistons, cylinders, intake, exhaust, and cooling passages, as well as the crankcase.

13

1. 9 Personnel Information

Small passenger vessels carrying more than six passengers for hire may not operate without a valid certificate of inspection (COI), which is issued by the Coast Guard Officer in Charge, Marine Inspection (OCMI) for a given marine inspection zone―in this case, Sector St. Petersburg, Florida. The COI stipulates a number of operating requirements, including minimum crew size and qualifications. When determining the number and competencies of crewmembers, the OCMI considers, among other things, the size of the vessel, its route, the type and horsepower of the vessel’s propulsion machinery, the number of passengers the vessel will carry, the type and location of lifesaving equipment installed on the vessel, and the hazards associated with the route and service. According to its COI, the Island Lady was required to carry a crew of three, consisting of one captain and two deckhands. Captain The captain, age 37, had worked on various boats since he was 15 years old, starting on mullet boats and then shrimp boats for about 15 years. He then obtained his merchant mariner credential (as master of self-propelled vessels, not including auxiliary sail, of less than 100-gross-register tons upon near coastal waters) and started running boats professionally. He told investigators that he had been employed by Tropical Breeze Casino Cruz for almost 2 years, during which time he served as captain on both the Island Lady and the Tropical Breeze I (he said he worked 4 days on the Island Lady and 3 days on the Tropical Breeze I each work week). The captain said he had completed basic firefighting training before obtaining his mariner credential at sea school. According to timesheets provided by the company, in the days before the accident, the captain worked 8 hours on January 10, 8.5 hours on January 11, and 8 hours on January 13 (the day before the accident). He had no reported work hours on January 12 because no shuttle trips were scheduled that day. On the morning of the fire, the captain reported to work at 1000. Senior Deckhand The senior deckhand (also referred to as the senior mate), age 30, had worked for Tropical Breeze Casino Cruz previously and, about a year before the accident, reestablished employment. He did not hold and was not required by federal regulations to hold any Coast Guard credentials. He had no formal maritime training; his most recent job was as a sign-holder in front of stores, after working in a warehouse for about 4 years. He told investigators that his job duties on board the vessels included cleaning, maintenance, handling lines, stocking supplies, and working as security. As senior deckhand, he was given on-the-job training at drills for emergency situations. According to timesheets provided by the company, the senior deckhand had not worked on board the Island Lady since January 6, about a week before the accident. Deckhand 1 Deckhand 1, age 24, had been rehired by Tropical Breeze Casino Cruz about a week before the accident; he last worked for the company about a year earlier. Before his employment with Tropical Breeze Casino Cruz, he had worked at a grocery store, an internet security company, and a recording studio. He did not hold nor was he required by federal regulations to hold any Coast Guard credentials. He stated that he had received no formal maritime training before joining the company and that he trained as a deckhand on the job. Deckhand 1 told investigators that he was unaware of the location of the fuel shutoffs and had no knowledge of or familiarity with the

14

onboard fixed fire suppression system. According to timesheets provided by the company, on the day of the accident, deckhand 1 reported to work at 1400. On January 8, he had worked 2 hours; on January 10, he had worked 7.5 hours. Deckhand (New-Hire) The new-hire deckhand, age 29, had worked for Tropical Breeze Casino Cruz for about 5 and a half months. He did not hold nor was he required by federal regulations to hold any Coast Guard credentials. He had no formal maritime training; his most recent job was with a cleaning company. On the day of the accident, the new-hire deckhand was tending bar when the Island Lady left the dock. According to timesheets provided by the company, he reported for work at 1400. On January 10 he had worked 7.5 hours; on January 11 he had worked 5.5 hours; and on the day before the accident, he had worked 7.5 hours. Deckhand (Pre-Hire) The pre-hire deckhand, age 35, had joined the Island Lady only a few minutes before departure for his first trip on the vessel. About 10 years earlier, he had worked on board the casino boat Royal Casino I for about 8 months, starting as deckhand, then senior deckhand, and then working his way up to overnight engineer. He did not hold nor was he required by federal regulations to hold any Coast Guard credentials. He had no formal maritime training; his most recent job was in construction. 1.10 Personnel Training Regulatory Training Requirements To be certified as the captain of a small passenger vessel, an individual must serve for at least 1 year on the type of vessel for which he or she is seeking a mariner credential and must pass an examination. To pass this test, an individual must demonstrate knowledge in a number of subjects, including, but not limited to, piloting, shiphandling, watchkeeping, first aid, fire prevention and firefighting, and emergency procedures. After passing the test, a captain is not required to undergo periodic training or to be tested on subject-matter knowledge, except as a participant in drills conducted by the Coast Guard as part of its annual inspections. Federal regulations do not require deckhands on small passenger vessels to hold merchant mariner credentials or to possess formal qualifications for their positions. Regarding emergency duties such as firefighting, abandoning ship, and rescuing people in the water, Title 46 CFR 185.420 stipulates the following, in part: The owner, charterer, captain or managing operator shall instruct each crewmember, upon first being employed and prior to getting underway for the first time on a particular vessel and at least once every three months, as to the duties the crewmember is expected to perform in an emergency . . . In addition, vessel captains are required to conduct emergency drills, as stipulated by Title 46 CFR 185.520: The master shall conduct sufficient drills and give sufficient instructions to make sure that all crewmembers are familiar with their duties during emergencies that necessitate abandoning ship or the recovery of persons who have fallen overboard.

15

Title 46 CFR 185.524 requires captains of small passenger vessels to conduct sufficient fire drills to make sure that each crewmember is familiar with his or her duties in case of a fire. In addition, Title 46 CFR 185.520(f) and 185.524(d) require that vessel operators also log or otherwise document abandon-ship, man-overboard, and fire drills for Coast Guard review on request. The records must include the date of the drill and a general description of the drill scenario and the training topics it addressed. The Island Lady captain said the emergency drills were documented in a logbook that stayed on board the vessel and that the fire destroyed the logbook. Company-Based Training The Island Lady deckhands told investigators that all their maritime training had been obtained on the job, including initial orientation where they learned about their duties and responsibilities. The company gave them a 19-page handbook titled Shuttle Procedures that listed procedures for transferring passengers at sea. The deckhands also received a 37-page handbook titled Employee Emergency and Safety Manual with instructions about fire (explaining various types of fire), heavy weather operations, man-overboard and abandon-ship emergencies, bomb threats, collisions, and hijackings. The employee manual also explained drug-testing procedures. In the event of a fire or smoke condition, the manual directed the captain to sound the vessel’s alarm, activate the automatic distress device, and set the vessel on a course to limit the effect of the wind on the fire. Afterwards, the captain was to announce the location of the smoke/fire and direct the crew to report there, and to direct other personnel to assist the passengers to the designated muster area. The manual contained a set of instructions for engineers, but an engineer was not on board the vessel at the time of the fire, nor was one required. The manual did not instruct or guide the crew regarding responses to engine alarms or failures. The captain told investigators that the most recent crew drill took place in mid-December 2017, about a month before the fire, in which the senior deckhand participated. He said this drill consisted of a man-overboard exercise, a simulated fire in the engine room, and an abandon-ship exercise. He and the senior deckhand ran the fire pump for 5 minutes and charged the two firehoses. They also handled the portable fire extinguishers but did not activate them. There were no records of any other drills in 2017. The company provided an Island Lady logbook dated November 13, 2015 through December 18, 2016. In the 13 months of available records, the company logged three fire drills (April 10, 2016, September 7, 2016, and November 5, 2016) and two man-overboard drills (June 21, 2016, and November 5, 2016). 1.11 Vessel Information Construction and Equipment The double-deck, single-hull Island Lady was built in 1994 by Lydia Yachts of Stuart Inc. in Stuart, Florida.9 The vessel’s hull was cold-molded construction, consisting of wood frames sheathed with epoxy-laminated plywood and covered with fiberglass. The vessel was originally outfitted with three engines and three propellers. About a year later, the original owner removed

9 The Island Lady was designated as a Subchapter T small passenger vessel under Title 46 CFR Part 175. This subchapter applies to vessels of less than 100 gross tons that carry 150 or fewer passengers, or has overnight accommodations for 49 or fewer passengers, and that (1) carry more than 6 passengers, including at least 1 for hire; (2) are chartered with a crew provided or specified by the owner or the owner’s representative and carry more than 6 passengers; (3) are chartered with no crew provided or specified by the owner or the owner’s representative and carry more than 12 passengers; or (4) if a submersible vessel carries at least 1 passenger for hire; or (5) is a ferry carrying more than 6 passengers.

16

the center engine (a Volvo Penta TAMD61A) and its propeller shaft and replaced the remaining two engines (Detroit 8V92TI diesels) with Caterpillar 3406E engines. For more than 20 years, the vessel operated as a whale-watching vessel in Boothbay Harbor, Maine. A.B.K. Enterprises purchased the Island Lady in November 2015 after having leased the vessel during one or two winter seasons (when the vessel was not used in Maine). Vessel particulars were as follows: Length: 72 feet Beam: 21 feet Draft: 4.5 feet Gross tonnage: 65 Crew: 3 minimum (1 captain, 2 deckhands) Passenger capacity: 149 Propulsion: Twin 800-horsepower Caterpillar model 3406E turbocharged diesel engines, two propellers, two rudders The enclosed wheelhouse was located on the forward top deck (refer to figure 4) with the open deck for passengers located behind it. The lower-level main deck contained the foredeck, an enclosed space for passengers, a bar area, and the aft deck. Four hinged doors provided egress from the enclosed passenger area, in accordance with regulations.10 Exits on the main deck led to the stern and bow. A stairway on the stern led to the upper deck and a vertical ladder on the bow connected the wheelhouse and the bow. Watertight bulkheads subdivided the below-deck area into compartments that contained the fuel tanks, engines, generators, water and waste tanks, fire suppression apparatus, and other equipment. The engine room had two small access hatches from the main deck, one between the generators and one over the engines. Each of the other below-deck compartments also had an access hatch (figure 11).

Figure 11. Layout of the Island Lady’s lower level.

10 According to Title 46 CFR 177.500(a), “each space accessible to passengers or used by the crew on a regular basis must have at least two means of escape, one of which must not be a watertight door.” In certain circumstances, one means of escape suffices, such as from deck areas smaller than 322 square feet (Title 46 CFR 177.500[o]).

17

The captain told investigators that the Island Lady’s navigation equipment included an autopilot, a radar with 24-mile range, global positioning system (GPS) instruments, a depth-meter, a fish-finder, and a compass. The vessel was also equipped with two very-high-frequency (VHF) radios, a cellular telephone, and a public-address system. Certification The Island Lady was certificated and inspected as a small passenger vessel per regulations at Title 46 CFR Part 175–185. The vessel’s COI, valid for 5 years, was issued on March 21, 2017, after the vessel had been inspected for certification. After the vessel’s last drydock examination on April 3, 2017, its COI was amended to reflect the date of the examination.11 Sector St. Petersburg was the local Coast Guard office in charge of inspecting the Island Lady. The COI permitted the Island Lady to operate on lakes, bays, and sounds, plus limited coastwise routes and in partially protected waters off the west Florida coast between the Fenholloway River (Stake Point) to the north and Everglades City (Lopez River) to the south, not more than 20 miles from a harbor of safe refuge. The COI allowed the Island Lady’s passengers to transfer only to and from the Tropical Breeze I in specific locations, using the shuttle vessel’s midship portside transfer station. Transfers were not allowed when the sea state exceeded 2 feet. The Island Lady’s maximum capacity was 152 people, consisting of 149 passengers and 3 crewmembers. The COI permitted the vessel to carry adult passengers only and required the embarkation doors to be closed while passengers were on board. Propulsion System The Island Lady was powered by two Caterpillar 6-cylinder, 800-horsepower model 3406E diesel engines (figure 12). Each engine was equipped with an aftercooler, had a single turbocharger on the aft end, and was coupled to a shaft and a four-bladed propeller by an electrohydraulic transmission. Vessel operators controlled the engines’ forward and astern speeds by moving levers on the wheelhouse console. The Caterpillar engine manual contained a section explaining the gauges and indicators for the engines. The manual stated that a “warning” lamp alerted the operator of engine problems. The following were examples of problems: low oil pressure, high coolant temperature, low coolant level, and high inlet air temperature. The manual provided guidance to the operator for each of the alarm conditions. If an alarm activated for low engine oil pressure, the operator was advised to remove the load, reduce engine speed to low idle, and shut down the engine. For a high jacket-water temperature alarm, the following procedure was to be carried out: reduce load and engine speed, inspect the cooling system for leaks, and determine if the engine needed to be shut down immediately or if it could be cooled by reducing the load.

11 See section “1.11 Vessel Information; Inspection History” for further details on the April 3, 2017 inspection.

18

Figure 12. The Island Lady’s starboard engine in May 2017. (Photo provided by the Coast Guard) Cooling System Each engine was directly cooled by a closed-type jacket-water system via cooling passages in the engine block. An engine-driven raw-water pump (figure 13) drew seawater for cooling by way of a through-hull inlet pipe. An inline sea strainer prevented debris from entering into the pump casing. The gear-driven raw-water pump impeller was constructed of rubber and fitted onto a splined shaft that rotated at a speed proportional to the engine rpm. According to Caterpillar specifications for the 3406E engine, the nominal operating temperature of the jacket-water system was 192F. The setpoint for the high-temperature alarm was 217F after a 30-second delay.

19

Figure 13. Upper left: Housing for raw-water pump. Center: New rubber impeller. The raw-water pump first discharged into an aftercooler, which cooled the intake air entering the engine from the turbocharger. From the aftercooler, seawater flowed to a heat exchanger that cooled the engine jacket-water and then flowed to the transmission cooler (also known as a reduction gear cooler). The seawater then flowed into a spray ring in the exhaust tubing that sprayed water directly into the 8-inch-diameter exhaust tubes (wet-exhaust system).12 A drawing of the system (figure 14) shows the flow of cooling water through the engine.

12 According to Caterpillar, initial exhaust temperatures on an operating engine are about 750°F at full power and about 450°F at idle. In a wet-exhaust system, water-cooled inboard engines inject cooling water into the engine exhaust; this process cools the exhaust gases substantially and also muffles engine noise. The mix of water and gas then exits out of the tube and into the waterway. Because of the substantially reduced exhaust temperatures, exhaust tubing does not have to be constructed of noncombustible material.

20

Figure 14. Simplified diagram of the engine cooling water system. The raw-water system is shown in green and the jacket-water system components are shown in blue. The exhaust tubes were constructed of fiberglass and connected with rubber joints. According to the vessel specifications obtained from the original owner, the original exhaust tubing was Vernatube, which was a resin-impregnated glass filament-wound tubing. The manufacturer stated that the original tubing was made exclusively with a fire-retardant resin formulated for high-temperature applications. However, Tropical Breeze Casino had since replaced some or all of this tubing: For example; according to March 2017 maintenance records, the company purchased and installed 22 feet of 8-inch exhaust tubing and 22 clamps, and the July 2017 maintenance records noted replacement of a leaking exhaust tube in the lazarette. Investigators obtained the purchase receipt to determine the properties of the replacement tubing. The tubing was Novaflex marine hard-wall water exhaust tubing, which the manufacturer stated met standards for marine wet-exhaust applications. The exhaust tubing transited aft through the lazarette, which also housed the steering system, marine sanitation system, head pumps, and fresh water pumps. The exhaust tubing was held in place by wood supports and was in direct contact with the wood bulkheads between the engine room and the lazarette (figure 15). No fire detection system was located in the lazarette, nor was it required to be.13

13 The Coast Guard provided analyzed data about fire origination on board domestic passenger vessels from the past 18 years (see Appendix B). The summary statistics show that most fires originate in the engine room, followed by auxiliary spaces separate from the engine room, such as steering gear spaces (which include lazarettes) and ship service generators. Also see section “2.5 Lack of Fire Detection in Unmanned Spaces with Exhaust Tubing.”

21

Figure 15. Engine exhaust tubes transiting through the lazarette spaces on board vessels constructed similarly to the Island Lady. Electrical System Electrical power was produced by two Kubota alternating-current generators, one behind each engine. Each generator’s output was rated at 17 kilowatts. The captain told investigators that, normally, the vessel needed only one generator at a time in the winter (because of reduced need for air-conditioning); on the day of the accident, the starboard generator was running. None of the crewmembers reported any electrical problems on the vessel either before or during the fire, other than the loose electrical connection on the port engine’s starting battery that the captain tightened before departure. Fuel System Fuel was delivered from the fuel tanks to the engines via piping; emergency stop valves were located in a recessed panel on the main deck. The fuel tanks were located in a separate compartment forward of the engine room. Each tank had a drain valve located at its bottom that connected via hoses to the drain valves from other fuel tanks. The drain valves and hoses were also used to equalize the fuel levels in the tanks. Level indicators constructed of plastic tubing and affixed to marked vertical stanchions were connected to the drain valves. When the valves were opened, and as the fuel level changed in the tanks, a corresponding visual change in the plastic tube would indicate the level. There were no automatic shutoff valves for isolation of the level indicators. In accordance with Title 46 CFR 182.440 (a)(7), “tubular gauge glasses, if fitted to diesel fuel tanks, must be of heat[-]resistant materials, adequately protected from mechanical damage, and provided at the tank connections with devices that will automatically close in the event of rupture of the gauge or gauge lines.” In March 2017, during a Coast Guard vessel examination of the Island Lady, the inspector found the fuel valves in the open position and photographed them (figure 16). The inspector told the crew to close the valves and he later looked for the regulation

22

about appropriate tubing material and automatic shutoff valves. He was unable to find the regulation and did not document the finding in the Coast Guard inspection report.

Figure 16. The Island Lady’s fuel tank drain valve and plastic tubing to fuel-level indicator. (Image provided by the Coast Guard.) Fire Detection System In accordance with Title 46 CFR Part 181 Section 400, a space containing propulsion machinery must be equipped with a fire detection system of an approved type. Accordingly, the engine room on board the Island Lady had a Checkfire system manufactured by Interstate Fire Protection (figure 17). The system was custom-designed and custom-built with two 190°F heat detectors (one mounted above each propulsion engine) wired to a control module located in the wheelhouse. The engine room was the only space on board the vessel required to have a fire detection system.

23

Figure 17. Drawing of the fire detection system layout. (Drawing by Checkfire, provided by the Coast Guard) The fire detection system was to be tested annually; however, investigators could not find a record of the last test. The captain said in an interview that the heat detectors had been tested but that the records were destroyed in the fire. A Coast Guard “New to Zone” inspection of the Island Lady in November 2015 indicated that the overall firefighting system was inspected and found satisfactory. The Coast Guard’s most recent inspection report of the Island Lady (March 2017) listed the vessel’s firefighting system as “inspected with deficiencies noted,” but the deficiencies were not related to the detection system, and the owner addressed them during the inspection.14 Neither Coast Guard inspection narrative specifically mentioned testing of the fire detection system. After the fire, investigators could not locate the two heat detectors or the engine room alarm panel; they were likely destroyed in the blaze.

14 The noted deficiencies included a broken bracket on a fire extinguisher in the engine room and carpeting installed over the hatch to the fuel shutoff valve.

24

Fire Suppression System Title 46 CFR Part 181 Section 400 also requires that spaces containing propulsion machinery be equipped with a fixed fire extinguishing system. Accordingly, the engine room on board the Island Lady was equipped with a Kidde custom-engineered and manually operated carbon dioxide (CO2) system, installed in 1999.15 The last maintenance on the system was the annual maintenance and inspection performed in May 2017 by a third-party fire protection inspection and service company. The system consisted of two 75-pound cylinders of CO2 located in the fuel tank compartment forward of the engine room (figure 18).16 A distribution line from the cylinders penetrated through the forward engine room bulkhead and traveled down the centerline of the engine room to a tee that terminated in two bell-shaped discharge nozzles over the aft end of each engine.

Figure 18. Components of the Island Lady’s fixed fire suppression system in March 2017 before the fire. (Photo by the Coast Guard) According to the drawings, a manual pull box located on the main deck would remotely activate the release of CO2. The engine room’s ventilation dampers were manually operated and could be closed locally on the main deck.

15 Custom-engineered fire suppression systems are designed specifically for an individual vessel’s engine room. The system is designed to meet the needs of that particular space and the system is built with approved components. 16 The May 2017 suppression system maintenance report contained a note that stated the CO2 cylinders were due for hydrostatic testing. Investigators were not able to determine if this testing was completed before the fire occurred. Required tests of CO2 systems include weighing the gas cylinders (they must be recharged if their weight loss exceeds 10 percent of the charge); testing time delays, alarms, and ventilation shutdowns according to the manufacturer’s instruction manual; and making sure hoses and nozzles are clean.

25

Firefighting Equipment In addition to the fixed fire suppression system described earlier, the Island Lady had five portable fire extinguishers and two 1.5-inch-diameter, 50-foot-long firehoses (according to the vessel’s COI). Lifesaving Equipment The Island Lady’s COI required that the vessel carry lifesaving equipment for 152 persons. The equipment included 152 adult lifejackets, three life rings, and one rescue boat/platform. Two liferafts, rated for 50 people each, were installed on top of the wheelhouse.17 The vessel was not required to carry child lifejackets because the COI allowed adult passengers only. On the Island Lady, lifejackets were stowed in the wheelhouse and in lockers in the aft section.18 Inspection History Coast Guard Inspection. The Coast Guard inspected the Island Lady four times during the 2-year period between November 2015 (when A.B.K. Enterprises purchased the vessel) and the accident. The November 2015 “New to Zone” inspection (mentioned earlier) was conducted after the vessel was relocated from Maine to Port Richey. At the time, the Coast Guard inspector stated that it was evident that the vessel had been “very well maintained” and was in “excellent condition.” Four deficiencies (unrelated to the fire) were noted during this examination. On November 12, 2015, two Coast Guard officers returned to the vessel, ensured that the four deficiencies were corrected, and issued a COI and inspection decal. On February 10, 2017, the Island Lady’s COI expired and a new one was required. On March 16, 2017, the Coast Guard issued a “no-sail” CG-835 form (Vessel/Facility Inspection Requirements) because the vessel missed its annual inspection. The following day, a company official contacted the Coast Guard and scheduled the inspection. On March 21, 2017, two Coast Guard officers inspected the Island Lady while under way, including observing the 3-person crew conducting man-overboard, abandon-ship, and fire drills. After the inspection, the officers removed the no-sail CG-835 but noted seven deficiencies unrelated to the fire. The crew immediately corrected three of the deficiencies, and on April 17, 2017, the owner sent photos to the Coast Guard showing that the remaining deficiencies were corrected as well. The Coast Guard issued the new COI on March 21, 2017, stating that the vessel had completed satisfactory annual inspection and was fit for service and the route. On April 3, 2017, Coast Guard personnel conducting a drydock exam noted three deficiencies unrelated to the fire.19 Within 4 days, all deficiencies were corrected and the inspection was concluded.

17 This rating met the requirements of Title 46 CFR 180.200 and 180.205 (number and type of survival craft) for the Island Lady’s limited coastwise route in predominantly warm water, which the Coast Guard defines as monthly mean low water temperature of normally more than 59 degrees F. 18 Federal regulations at Title 46 CFR 180.78 state, “lifejackets must be stored in convenient places distributed throughout accommodation spaces,” and “each stowage container for lifejackets must not be capable of being locked. If practicable, the container must be designed to allow the lifejackets to float free.” Further, “each lifejacket kept in a stowage container must be readily available.” The Coast Guard’s most recent inspection of the Island Lady verified the availability of lifejackets. 19 The Coast Guard noted some hull delamination near the propeller, a non-standard electrical cable on the water heater, and a missing flame shield on a generator fuel strainer.

26

1. 12 Reported Incidents

During Tropical Breeze Casino Cruz’s ownership of the Island Lady, the Coast Guard received four reports of incidents involving the vessel: In August 2016, an 87-year-old passenger tripped and fell while stepping over a doorway threshold and broke her hip. She was taken to the hospital and died 3 days later. In September 2017, a concerned citizen contacted the Coast Guard alleging that the Island Lady caused a wake and forced several recreational vessels out of the channel. The Coast Guard investigated, but no enforcement action was taken. In October 2017, due to a control cable failing and preventing the starboard engine from disengaging from the transmission, the Island Lady struck a building along the banks of the Pithlachascotee River, damaging both the building and the vessel’s bow. The Coast Guard issued a CG-835 requiring engine repairs before the vessel could carry passengers again. The following day, a Coast Guard inspector witnessed the satisfactory engine repair and cleared the CG-835. In November 2017, the Coast Guard received a report that a crewmember fell through an open hatch to the engine room, causing injury to her forehead, legs, torso, and a toe. A week later, after her symptoms worsened, the crewmember went to the emergency room, where her toe was determined to be broken and infected. The Coast Guard referred the incident to enforcement for failure of the marine employer to notify the Coast Guard of a marine casualty. 1.13 Waterway Information The Pithlachascotee (“Cotee”) River flows for more than 20 miles through Pasco County into Miller’s Bayou at the town of Port Richey and then empties westward into the Gulf of Mexico.20 Two 90-degree turns in the channel near the river’s mouth were known to local mariners as the S-turn. On the day of the accident, the tide ranged about 3.5 feet, from -0.4 feet at low tide (0624) to 3.1 feet at high tide (2253). According to 2009 data, the controlling depth of the river was 3.8 feet (4.9 feet at midchannel) to the basin with 5.7 feet in the turning basin. An extensive shoal area lies off the mouth of the river; the Gulf of Mexico is only about 1–5 feet deep from the shoreline to about 3 nautical miles out. Between there and the Nine-Nautical-Mile line, the Gulf ranges from 6.5 to 14 feet in depth.21 1.14 Company Information A.B.K. Enterprises, the owner of the Island Lady, began operating as “Paradise Casino” in October 1995. At a later date, the company name was changed to “SunCruz.” In 2001, the operator changed its name again, this time to “Port Richey Casino.” In 2015, when the company purchased the casino boat Tropical Breeze I, a new company was formed―“Tropical Breeze Casino Cruz, LLC”―which was the operating company when the Island Lady fire occurred. At that time, the company operated two vessels: the casino boat Tropical Breeze I and the shuttle boat Island Lady. Day-to-Day Operations At the time of the accident, the company had four boat captains on its payroll and an engineer who worked mostly on shore. The owner managed day-to-day company operations. Shoreside support consisted of an administrative assistant, an engineer, a dockmaster, and the port captain. Tropical Breeze Casino Cruz offered three scheduled departures per day, 7 days a week:

20 National Oceanic and Atmospheric Administration, National Ocean Service, United States Coast Pilot, vol. 5 (Atlantic Coast: Gulf of Mexico, Puerto Rico, and Virgin Islands), 2004, p. 340. 21 National Oceanic and Atmospheric Administration, National Ocean Service, Coast Survey, United States - Gulf Coast, Florida, Chart 11409, Anclote Keys to Crystal River, 1999.

27

1100, 1530, and 1900. Return trips were scheduled for 1730, 2100, and midnight. Customers could choose to stay for just a few hours or until the last return to shore. The Island Lady captain told investigators that he worked 7 days a week; 4 days a week on the Island Lady and 3 days a week on the Tropical Breeze I. Port Captain The port captain, who was also the vessel owner’s spouse, told investigators that he took care of the slot machines and helped supervise general operations. He held a merchant mariner credential as captain of 100-ton vessels and had previously operated the Island Lady. His responsibilities included upkeep and maintenance of vessels and oversight of vessel safety, daily operations, and personnel. He was the person whom the Island Lady captain called on the day of the fire after receiving the high-temperature alarm. Engineer The company engineer was off-duty on the day of the accident but had worked for Tropical Breeze Casino Cruz for about 4 and a half years. He did not hold nor was he required by federal regulations to hold any Coast Guard credentials. He graduated from Marchman Technical College where he studied marine service technologies. He said his studies included training on passenger vessels and that he completed a year and a half-long class on diesel engines. Initially, his job entailed working overnights on the casino boat Royal Casino I until it was taken out of service, and then the Tropical Breeze I. He was employed as engineer and deckhand. About a year before the accident, the Island Lady was added to his responsibilities, which included checking fluids and performing minor repairs. He said he typically spent about 15–20 minutes daily on board the Island Lady, starting the engines, replacing light bulbs, and fixing toilets, as needed. The rest of the time, he worked at the shoreside facility. Other Company Vessels The company’s casino boat, the Tropical Breeze I (figure 19), was built in 1991 and served as the company’s casino boat starting in 2015. Between 2015 and the date of the accident, the Coast Guard attended the vessel seven times for scheduled certification, drydock inspections, and in response to passenger and crewmember concerns. The Coast Guard noted any deficiencies during the inspections, the company addressed them, and the Coast Guard subsequently cleared them.

28

Figure 19. Casino boat Tropical Breeze I. Since 1995, Port Richey Casino/Tropical Breeze Casino Cruz had also owned other casino and shuttle boats―the Monte Carlo, the Royal Casino I, the Royal Express, and the Royal Express II―all of which had undergone Coast Guard inspections and which the company eventually retired. Another of the company’s shuttle boats, the Express Shuttle II, was destroyed in a fire in 2004 (see section “1.15 Previous Fire and NTSB Safety Recommendations Involving Company Vessel”). Vessel Maintenance Tropical Breeze Casino Cruz had implemented a preventive maintenance program for its vessels after receiving NTSB Safety Recommendation M-06-12 in response to the 2004 Express Shuttle II fire.22 The captain and the engineer told investigators that the crew conducted maintenance checks on the Island Lady every morning before transits, checking oil-, water-, and bilge levels and the vessel’s overall condition. Any item requiring additional maintenance was reported to the company. Investigators found a blank “engine room daily checklist” (figure 20) on the company’s shoreside computer, which included various items to be inspected each day, including the engines, generators, fuel levels, and bilges, as well as other general inspections. For the main engines, a visual inspection was to be conducted and the following was to be checked: coolant, oil, transmission fluid (if added), sea strainers, and belts and hoses. Investigators requested to see completed daily checklists, but none were provided, as the company said they were destroyed in the fire and no copies were kept shoreside.

22 An effective preventive maintenance program contains such elements as procedures for reporting maintenance and repair needs, retaining and reviewing maintenance and repair records, conducting vessel inspections and repairs according to manufacturers’ guidelines, verifying and testing repairs, and overseeing the maintenance and repair process. It also contains procedures that promote effective interaction between the personnel who operate vessels and the staff who perform vessel maintenance.

29

Figure 20. Blank (sample) daily checklist for the Island Lady engine room. The Caterpillar 3406E engine manual, “Operation and Maintenance Manual,” stated that “fuel consumption, service hours, or calendar time, WHICH EVER OCCURS FIRST,” were to be used to determine the maintenance intervals. The manual also stated that engines in “severe operation” may require more frequent maintenance.23 The Island Lady engineer told investigators that he created a maintenance report based on the Caterpillar maintenance schedule and his experience. This report did not include Caterpillar’s recommended intervals, nor was there any guidance from Tropical Breeze Casino Cruz. The engineer estimated that the Island Lady operated

23 Caterpillar defined severe operation as “the use of an engine that exceeds current published standards for the engine.” The following factors can contribute to severe operation: environment, improper operating procedures, and improper maintenance procedures.

30

for about 6 hours a day and said that it had recently started operating 7 days a week, an increase from 4 days a week. Daily maintenance identified in the Caterpillar manual included a walk-around inspection to look for leaks and loose connections and a check of the crankcase oil level, the coolant system level, the air cleaner condition, and the oil level in the transmission. The Caterpillar manual also contained specific interval-related instruction, such as: • Every 50 hours or weekly Replace zinc rods24 Inspect seawater strainer

Inspect aftercooler condensate drain valve • Every 250 hours (or yearly, whichever comes first)

Sample and analyze crankcase oil

Change engine oil

Replace fuel filter

Drain fuel tank of water and sediment

Test cooling system additive

Clean the engine

Clean or replace air cleaner

Check, adjust, or replace belts

Check or replace hoses and clamps

Clean and check batteries

Check raw-water pump and rubber impeller

Check battery electrolyte level • Every 1,000 hours or 2 years Inspect turbocharger Clean and test aftercooler core • Every 3,000 hours

Replace water temperature regulator Inspect engine mounts, crankshaft vibration damper, valve lash and rotators, fuel injectors, heat exchanger, and starting motor Clean and inspect engine speed/timing sensor • Every 5,000 hours

Inspect jacket-water pump and alternator • Every 6,000 hours or 6 years Replace aftercooler core • Every 10,000 hours

Determine engine operating parameters Complete major overhaul The Caterpillar manual also gave direction regarding overhaul considerations, stating that the need for overhauls was generally indicated by increased fuel consumption and reduced power. The manual further explained that factors such as preventive maintenance, the quality of fuel used, operating conditions, and oil analysis results were important considerations in deciding when to overhaul an engine.

24 Zinc rods are inserted into the engine’s raw water-cooling system to help prevent the corrosive action of seawater.

31

The Tropical Breeze Casino Cruz engineer told investigators that he changed the engine oil monthly and reported any maintenance issues to the company. He estimated that the Island Lady engines had about 13,000 hours on them at the time of the accident but said that he “hadn’t thought about logging hours” and would only occasionally enter the engine hours on the daily checklists. The engineer kept monthly maintenance reports for both company vessels on a computer in the dock office. Each month was represented by one page (figure 21) and included oil and filter changes, impeller replacements, and so on.

Figure 21. Monthly maintenance report for the Island Lady, October 2017.

32

Although the maintenance report was filled out on a monthly basis, each listed item did not necessarily require a monthly maintenance interval. Moreover, the monthly maintenance report did not contain Caterpillar’s suggested intervals for engine maintenance, but was instead simply a form used to track the dates on which some maintenance was completed. No entries had been made for the number of engine hours or the next scheduled date of service. Investigators examined the Island Lady’s maintenance log for the year before the fire, between January 2017 and October 2017 (no records were available before or after this timespan). The log’s pages contained fields for manual entries of dates of service and an area for comments. According to the monthly maintenance reports, the impellers of the raw-water pumps for both main engines were replaced in May 2017. No records were available to show the number of hours or days of operation on the impellers. Investigators obtained photos, taken by the engineer in connection with the replacement, of water leaking from the pump housing (figure 22) and of one of the old pump housings and rubber impellers before replacement (figure 23). At least six of the 12 vanes were missing from that impeller.

Figure 22. Water leaking from the Island Lady’s raw-water pump before its May 2017 replacement, photographed by the engineer.

33

Figure 23. Raw-water pump housing and impeller from the Island Lady during the components’ May 2017 replacement, photographed by the engineer. Ring Power provided a photo to show the condition of a newly installed rubber impeller in a raw-water pump housing (figure 24).

34

Figure 24. New raw-water pump impeller installed in its pump housing. (Photo by Ring Power) According to interviews with the captain and the engineer, they would notify the owner of any maintenance that they believed required assistance from outside vendors, and the owner would decide if or when to schedule such repair work. According to the engineer’s maintenance log and invoices supplied by Tropical Breeze Casino Cruz, the Island Lady’s starboard engine was rebuilt in March 2017 (the port engine was not overhauled at that time). The engineer told investigators that the starboard engine was overhauled because it was producing excessive blowby, meaning that pressurized products of combustion were entering into the crankcase through worn internal components. He also said that the starboard engine was “putting oil through the turbocharger.” The owner stated that the timing of the starboard engine overhaul was placed during a downtime in the vessel’s schedule due to its COI having expired and the vessel not being permitted to carry passengers. According to the engineer, he and one of the company boat captains completed the work on the starboard engine. The owner told investigators that a service representative from Ring Power tested the engine afterwards. The service representative was reportedly called after hours and was paid in cash, and there was no service report. The engineer took photographs of starboard engine components during the overhaul. Two of the six removed pistons showed signs of vertical score marks (figure 25). Scoring of diesel engine pistons can result from overheating, lack of lubrication, or debris ingestion. As the engine

35

is operated with scored pistons, unburned fuel and the pressurized products of combustion are more likely to enter into the crankcase.

Figure 25. Removed pistons from the Island Lady’s starboard engine during March 2017 overhaul, photographed by the engineer. The piston in the upper left shows no damage; the remaining pistons are scored. The engineer told investigators that after the vessel was purchased, the engines were “rolling coal,” meaning that they were producing black smoke. As a result, the vessel’s transom was blackened (figure 26). The engineer said that the company called “a bunch of people” to determine the reason for the excessive smoke, but nobody was able to provide an answer.

36

Figure 26. Stern of the Island Lady while in drydock April 2017. (Photo by Coast Guard) 1.15 Previous Fire and NTSB Safety Recommendations Involving Company Vessel The NTSB investigated a previous fire on board a Port Richey Casino vessel (at that time, the company operated as “Paradise of Port Richey”). On the morning of October 17, 2004, a fire broke out in the engine room of the small passenger vessel Express Shuttle II at the mouth of the Pithlachascotee River as the shuttle was returning to the dock.25 Only the master and two deckhands were on board when the fire broke out. The crew did not activate the vessel’s fixed fire suppression system; instead, they tried unsuccessfully to fight the fire with portable extinguishers. When the fire burned out of control, they abandoned ship to a passing recreational boat. Firefighters from Port Richey and Pasco County fought the blaze, but the vessel, valued at $800,000, was a constructive total loss. One deckhand was treated for smoke inhalation at a local hospital. The NTSB determined that the probable cause of the fire on board the Express Shuttle II was a fractured, improperly installed fuel injection line on the inboard side of the starboard engine that allowed diesel fuel to spray onto the engine and ignite. Contributing to the cause of the fire was the failure of Paradise of Port Richey to have a preventive maintenance program, which could have identified the company’s ongoing problem with the vessel’s fuel lines before a failed line led to the fire. Contributing to the extent of the damage were the vessel’s faulty fire detection system and the crew’s failure to employ proper marine firefighting techniques. In the Express Shuttle II investigation, the NTSB determined that fuel lines on the vessel had failed numerous times in the months before the fire. Company employees indicated that

25 Fire On Board U.S. Small Passenger Vessel Express Shuttle II, Pithlachascotee River Near Port Richey, Florida, October 17, 2004, Marine Accident Report NTSB/MAR-06/02, Washington, DC: National Transportation Safety Board, 2006.

37

rather than following a regular schedule for vessel maintenance and repair, Paradise of Port Richey waited until a fuel line fractured before addressing any underlying issues. NTSB investigators found that the company did not keep accurate records of such repairs and had no formal system that would have identified an ongoing maintenance problem. As a result of the Express Shuttle II investigation, the NTSB issued five new safety recommendations, two of them to the operating company, Paradise of Port Richey: M-06-12 Develop and implement a preventive maintenance and inspection program for systems affecting the safe operation of your vessels, including the hull and the mechanical and electrical systems. M-06-13 Develop and implement a training program in marine firefighting for your crewmembers. The company stated that it agreed to implement a preventive maintenance program and marine firefighting training. In correspondence from July 2006, the company outlined the steps it had taken to address the issues. As a result, the NTSB classified Safety Recommendations M-06-12 and -13 “Closed―Acceptable Action” in December 2006. Also following the Express Shuttle II fire, the NTSB issued two new safety recommendations to the Coast Guard: M-06-10 Establish firefighting training requirements for crewmembers on board all small passenger vessels. M-06-11 Require that Officers-in-Charge, Marine Inspection, before issuing a certificate of inspection to a small passenger vessel that is required to have a fire detection system, verify that all system components are approved for use in fire detection systems and that the circuits of the system are electrically supervised. The Coast Guard implemented Safety Recommendation M-06-11 and the NTSB classified it “Closed―Acceptable Action” in April 2007. However, the Coast Guard did not implement Safety Recommendation M-06-10, stating in part that, per Title 46 CFR Subchapter B, masters on small passenger vessels are already required to demonstrate proficiency related to topics of fire prevention and firefighting, and that other crew already receive training in duties they are expected to perform in an emergency, such as fire. The NTSB responded in part that exams alone do not ensure proficiency and, with respect to vessel masters, an individual could fail the few fire-related questions and still pass the master’s exam. The NTSB classified Safety Recommendation M-06-10 “Closed―Unacceptable Action” in June 2009.

38

The NTSB also issued a new safety recommendation to the engine manufacturer, Caterpillar, following the Express Shuttle II investigation: M-06-14 Revise the service manual for your marine engines to give specific instructions on how to replace a single fuel line and on where fuel line clamps should be located. Caterpillar implemented this recommendation and revised its marine engine service manuals as requested. Accordingly, the NTSB classified M-06-14 “Closed―Acceptable Action” in July 2007. The NTSB also superseded (by issuing M-06-10) an existing safety recommendation to the Coast Guard (based on a November 17, 2000, fire on board the small passenger ferry Port Imperial Manhattan26): M-02-9 Establish firefighting training requirements for crewmembers on board small passenger vessels in commuter and ferry service. Safety Recommendation M-02-9 was classified “Closed―Superseded” in the Express Shuttle II report. The NTSB also reiterated two existing safety recommendations to the Coast Guard (also based on the Port Imperial Manhattan fire): M-02-5 Require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. M-02-10 Revise Navigation and Vessel Inspection Circular [NVIC] No. 1-91 so that it provides more in-depth guidance in training and drills for firefighting on board small passenger vessels.[27] Regarding the reiterated M-02-10, the Coast Guard declined once again to implement the recommendation, stating in part that it preferred to keep the guidance provided in NVIC 1-91 general in nature with respect to fire-related training and firefighting. The NTSB replied in part that, although NVIC 1-91 was indeed only a guidance document, fire safety could be improved by outlining more in-depth detail about training and firefighting drills instead of simply listing tasks

26 Fire On Board the Small Passenger Vessel Port Imperial Manhattan, Hudson River, New York City, New York, November 17, 2000, Marine Accident Report NTSB/MAR-02/02, Washington, DC: National Transportation Safety Board, 2002. 27 NVIC no. 1-91 pertained to recommended qualifications for deckhands working on board small passenger vessels.

39

that deckhands should be familiar with in emergencies. The NTSB classified the reiterated M-02-10 “Closed―Unacceptable Action” in June 2009. The Coast Guard also declined to implement Safety Recommendation M-02-5, stating in part that small passenger vessels are already subject to a comprehensive set of regulations promoting vessel safety. The NTSB expressed disappointment, responding in part that these regulations do not address vessel maintenance, do not require vessel owners to develop systematic programs for addressing repairs and maintenance, and do not require any maintenance oversight. As a result, in April 2005, the NTSB initially classified Safety Recommendation M-02-5 “Open―Unacceptable Response.” Six years later, in March 2011, the NTSB reclassified M-02-5 “Open―Acceptable Response” after reviewing the Coast Guard Authorization Act of 2010 (Public Law 111–281), Section 610, in which the Coast Guard obtained congressional authority to require safety management systems (SMS, which incorporate preventive maintenance programs) on domestic passenger vessels. However, in February 2017, after another 6 years had passed and the Coast Guard had not yet finalized the necessary regulations to implement safety management systems, the NTSB reclassified M-02-5 “Open―Unacceptable Response,” the status in which the recommendation remains as of the date of this report. For further discussion about and reiteration of Safety Recommendation M-02-5, see section “2.3 Insufficient Preventive Maintenance” in this report. In addition, section “2.4 Crew Emergency Response, Training, and Documentation” contains further detail about SMS and also reiterates a related safety recommendation, M-12-3, for the Coast Guard to require SMS on domestic passenger vessels.

40

• Analysis

1. 1 Exclusions

At the time the fire broke out, the weather was mild and did not hamper detection of the fire. The Island Lady crewmembers had just begun the day’s work, and their interviews and work/rest histories indicated that they were well-rested. In addition, all crewmembers tested negative for illicit drugs and alcohol. Therefore, the NTSB concludes that weather, fatigue, and impairment due to alcohol and other drugs were not factors in the accident. 2.2 Cause of the Fire The captain said that, after receiving a high-temperature alarm for the jacket-water system of the port engine, he also noticed that the temperature gauge for the jacket-water system was elevated. He reduced the speed to idle, took the engine out of gear, and proceeded down to the engine room to investigate. On entering the engine room, he noticed steam or light smoke and saw a wet area on the port bulkhead outboard of the port engine; the raw-water pump was mounted on the port side of the engine. A component failure in the raw-water system would have resulted in water discharge, consistent with what the captain observed. Caterpillar’s manual stated that a pump seal failure would also result in water discharge; in fact, in May 2017, when the impellers were replaced on the raw-water pumps, the engineer photographed a stream of water discharging from one of the pumps’ housing. A raw-water system failure would have caused the port engine to overheat because the engine’s jacket-water system that removed the heat of combustion from the engine was cooled by the raw water through a heat exchanger. A reduced flow of cooling water to the heat exchanger would cause a rise in jacket-water temperature. Therefore, the NTSB concludes that the high-temperature alarm for the port engine’s jacket-water system resulted from a failure of the port engine’s raw-water pump. The raw-water system cooled various components of the engine and also supplied cooling water to the wet-exhaust system tubing, which was not designed to run in a dry condition. The overheating engine, with high jacket-water temperatures and eventually a loss of jacket water from the cracked block, would have developed higher exhaust temperatures. Those elevated temperatures, plus the loss of raw water that normally cooled the wet-exhaust tubing, would have caused the internal temperatures of the tubing to rise, degrading the tubing material and eventually leading to ignition. Supporting this analysis was the shoreside surveillance video, which showed flames emanating from the port exhaust opening on the vessel’s stern before flames were visible elsewhere, indicating a fire in the exhaust tubing. This fire would then have ignited the surrounding wood supports. The NTSB therefore concludes that the fire likely started in the port engine’s fiberglass exhaust tubing and spread to wood structures in the lazarette, through which the tubing transited. Good marine practice stipulates that an engine that has experienced a complete loss of cooling and is overheating should be shut down to avoid damage; the Caterpillar manual also advises doing so. The captain understood from the jacket-water alarm and the elevated temperature on the gauge that the port engine was overheating and he also believed that a cooling water hose may have failed, but he still did not shut down the port engine. He said that he left it idling because he had “always been trained to . . . put it in neutral . . . let it cool down, because I didn’t want to 41

turn it off if overheating.” The Caterpillar manual did recommend idling a properly operating engine for at least 3 minutes to reduce and stabilize internal engine temperature before stopping if the engine had been running at high rpm or high load; however, the Island Lady engines had only operated at high load for less than 5 minutes and, moreover, a high-temperature alarm was sounding, indicating an abnormal condition. Many shipboard diesel engines are equipped with automatic shutdowns that activate if an initial high-temperature alarm is not addressed and the temperature continues to rise; this technology protects the engines from damage. The engines on the Island Lady were not equipped with automatic shutdowns. According to the captain, the port engine continued to run until he beached the vessel and both engines shut down. Had the captain shut down the port engine instead of placing it in idle, and had he then used only the functioning starboard engine, the overheating condition would have subsided. Instead, as the Island Lady’s port engine continued to run in a high jacket-water temperature condition, the jacket-water system circulated the remaining and increasingly hot water through the engine. The engine eventually failed and one of the jacket-water cooling passages in the engine block fractured from the excessive heat. Therefore, the NTSB concludes that the captain’s decision to continue to run the port engine in an overheated condition, even though the starboard engine was available and functioning normally, allowed the port engine to overheat to failure and the engine’s exhaust tubing to ignite. Although the company had emergency guidance for both its vessels, investigators found no evidence that the company provided its crews with any specific instructions on how to address high-temperature or other engine and machinery alarms. After the captain received the alarm, he notified the company port captain who told him to put the vessel in reverse to try to clear any possible debris in the raw-water inlet. The port captain did not advise the captain to shut down the engine. Had the captain received specific guidance regarding high-temperature alarms, he may have shut down the port engine immediately. The NTSB concludes that Tropical Breeze Casino Cruz did not provide adequate guidance to its crews regarding response to engine and other machinery alarms. After receiving the high-temperature alarm, the captain slowed the vessel, turned around, and began heading back to the boarding dock to address the overheating issue. If the captain had continued farther out to sea and the fire erupted, the evacuation would have been much more complicated. Offshore, the crew would have needed to launch liferafts, and passengers would have had to jump or swim to the rafts instead of wading about 150 feet to shore after the captain beached the vessel. Therefore, the NTSB concludes that the captain’s decisions to return the vessel to the dock after receiving the engine high-temperature alarm and to subsequently beach the Island Lady when smoke overwhelmed the vessel were prudent and increased the likelihood of survival for those on board. 2.3 Insufficient Preventive Maintenance Tropical Breeze Casino Cruz stated that it had implemented a preventive maintenance program for its vessels after receiving Safety Recommendation M-06-12 in response to the 2004 Express Shuttle II fire. However, when investigators interviewed company officials and reviewed maintenance records, they discovered several issues with the program that indicated that it was not adequate or robust.

42

For example, although the engine manufacturer, Caterpillar, provided a preventive maintenance schedule in its manual, investigators found no evidence that Tropical Breeze Casino Cruz followed all components of the program. Instead, the company engineer had created a basic monthly maintenance report, which recorded only completed maintenance and did not take engine hours into consideration for maintenance intervals, nor did it have a maintenance schedule with future dates for inspections and maintenance to be completed. The engineer kept this maintenance report for both company vessels on the company’s computer in the office on the dock. Investigators examined the Island Lady’s maintenance log for the year before the fire, between January 2017 and October 2017. No maintenance records were available before January 2017 and after October 2017. The items listed on the maintenance report were: “Flush, oil change, fuel filter, heat exchanger, air filter, transmission fluid change, thermostat, belts, battery water, and impeller.” Several maintenance items that were identified in the Caterpillar maintenance schedule were not included in Tropical Breeze Casino Cruz’s monthly maintenance reports, such as the zinc rod replacement, crankcase oil analysis, auxiliary water pump inspections, hose and clamp inspections, engine speed/timing sensor inspections, valve lash adjustments, and fuel injector checks, among other items. Several of these maintenance items were critical for proper operation, and the infrequent maintenance and inspection likely resulted in undetected, wear-related damage. Based on the captain’s statement that he believed a hose may have failed, releasing cooling water onto the port bulkhead, investigators considered the hoses associated with the raw-water system as a possible source for this water release. Caterpillar recommended that the hoses and clamps be inspected every 250 service hours. Although the monthly maintenance report (kept on a shoreside computer) did not include an entry for inspection or replacement of hoses, the daily engine room checklist (kept on board the vessel) had a fillable field titled “Hoses ok.” According to the owner, all completed daily checklists retained on board were consumed in the fire; therefore, investigators were unable to determine the quality of any hose inspections. After discussion between investigators and the owners, although the monthly maintenance reports were kept shoreside, there was no evidence that the company had reviewed them or provided guidance regarding engine maintenance to the engineer, indicating a lack of oversight by the company. Caterpillar’s interval for raw-water pump inspections was every 250 hours. Accordingly, the pumps installed on the Island Lady should have been inspected and the results documented at these intervals. However, Tropical Breeze Casino Cruz’s monthly maintenance report did not include an entry for inspection of the raw-water pumps. The only reference to the pumps in a report was in May 2017, when an entry recorded the replacement of both pump impellers. When the Island Lady operated 6 hours a day, 4 days a week, the pumps should have been inspected about every 10 weeks. Once the engines were being operated 7 days a week (when the Island Lady increased the number of trips to the casino boat), the pumps should have been inspected every 6 weeks. After the report entries for the May 2017 impeller replacements, no records were available to show any maintenance or inspections completed on the pumps, nor were there any receipts to show parts purchased for the pumps. Even if the Island Lady had been operating at the more conservative 4 days a week, the port engine would have accumulated about 24 hours a week, which would have amounted to about 840 hours in the 35 weeks between the date when the impellers were replaced and the accident. Based on that estimate, the pumps should have been

43

inspected three times since May 2017, but investigators found no record of inspection or replacement since that date. The NTSB therefore concludes that the company’s lack of inspections and infrequent maintenance likely resulted in undetected, wear-related damage causing the port engine’s raw-water pump to fail. Investigators learned that the starboard engine had been overhauled in March 2017, but the port engine had not, although the engines likely had similar running hours. No details were available about the overhaul; no service reports and no engine hours were recorded. According to company officials, at the time of the fire, the engines had an estimated 13,000 hours on them. In an undated vessel specification sheet, sometime after the year 2000, the previous owner had recorded the port engine’s hours as “2,191.4.” Photos taken during the drydock in April 2017 and video footage of the vessel’s stern on the day of the accident show dark exhaust and soot coating the stern. In an interview, the engineer said that after the vessel was purchased, it started blowing black smoke out of the exhaust. He said several people, including Caterpillar representatives, were unable to determine the source of the smoke. Regardless, the accumulation of soot on the stern indicated that the engines were not operating as designed. A well-developed oversight system for maintenance should include record-keeping and documentation. The Caterpillar manual recommended that accurate maintenance records be kept to determine operating costs, establish maintenance schedules, and show compliance with maintenance practices and intervals. The manual stated that such records were essential to a well-managed engine maintenance program and should include fuel consumption, service hours, and detailed service records. However, Tropical Breeze Casino Cruz did not follow these elements in its maintenance program. If the company had performed scheduled preventive maintenance and overhauls as Caterpillar recommended, the Island Lady’s raw-water pump would have been inspected on a regular schedule. The purpose of a raw-water pump is to cool an engine’s jacket-water system; without the pump functioning, the jacket water temperature rises and an engine overheats. Additionally, in a wet-exhaust system, loss of raw-water supply will cause the temperature of the exhaust gases in the tubing to rise substantially. Any issues with the pump could have been identified and addressed before the engine overheated. No records were available to indicate that the raw-water pump had been inspected from the time the impeller was replaced to the day of the fire―a period more than three times the length of the manufacturer’s recommended interval. The NTSB therefore concludes that if Tropical Breeze Casino Cruz had followed Caterpillar’s recommended maintenance schedule for the Island Lady’s propulsion engines, the failed raw-water cooling pump would have been inspected and likely replaced. The NTSB therefore recommends that Tropical Breeze Casino Cruz develop and apply an oversight system to ensure that its maintenance program complies with the manufacturer’s recommended preventive maintenance program for the engines and associated machinery and systems on board its vessels. Following the two previous fires on board the small passenger vessels Port Imperial Manhattan in 2000 and the Express Shuttle II in 2004, the NTSB issued and then reiterated Safety Recommendation M-02-5 to the Coast Guard to develop and implement maintenance systems on board domestic passenger vessels. However, because of the Coast Guard’s lack of progress on the issue, the recommendation remained “Open—Unacceptable Response” at the time of the Island Lady fire. In correspondence with the NTSB regarding the recommendation, the Coast Guard stated that small passenger vessels are already subject to a comprehensive set of regulations designed to promote vessel safety, and that operators are responsible for maintaining their vessels

44

accordingly. The NTSB replied that it was necessary for companies to develop a preventive maintenance program for all systems affecting the safety of passenger vessels. Preventive or periodic maintenance programs are an integral part of any well-run vessel operation, and a requirement to develop and implement such programs should not be burdensome to vessel operators. With a required, ongoing preventive maintenance program, owners might be less likely to operate substandard vessels that place the public at risk. However, the Coast Guard has yet to require preventive maintenance programs for small passenger vessels. Currently, numerous operators of domestic small passenger vessels have voluntarily implemented SMS, which include integral preventive maintenance programs. The NTSB maintains that companies operating domestic passenger vessels should be required to develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull, mechanical systems, and electrical systems. Had the Coast Guard completed implementation of Safety Recommendation M-02-5, Tropical Breeze Casino Cruz would have been required to have a compliant preventive maintenance program subject to Coast Guard oversight, and the Island Lady fire may have been prevented. Therefore, the NTSB once again recommends that the Coast Guard require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. In addition to covering preventive maintenance, SMS also addresses crew training, emergency preparedness, documentation, oversight, and so on. For further discussion, see next section. 2.4 Crew Emergency Response, Training, and Documentation When the high-temperature alarm for the port engine sounded, there was no obvious indication of fire on board the Island Lady. The captain and crewmembers said that they saw steam or light smoke coming from the engine room, and they tried to identify its source by lifting the access hatch to the engine room and by subsequently entering the space. However, at that time, there was no visible fire in the engine room. From what the deckhands told investigators, it is possible that they left the hatch open after the initial check of the engine room. Leaving the hatch open could have supplied the fire with oxygen once the fire spread into the engine room. After one of the deckhands informed the captain of the steam or light smoke in the engine room, the captain directed the crew to open the doors leading to the main deck to air out the enclosed main deck. Such an action could feed more oxygen to a heat source and is not advisable. Basic marine firefighting training includes closing all vents, doors, and other openings to a fire. The deckhands’ leaving the hatch open and the captain’s order to air out the enclosed main deck suggested that they lacked understanding of basic marine firefighting principles to limit oxygen to a suspected fire. Although federal regulations require that crewmembers know their emergency duties before getting under way and that captains conduct sufficient fire drills to ensure that crews are familiar with fire-related duties, only the senior deckhand on the Island Lady had participated in a recent fire and emergency drill (in mid-December 2017). The other deckhands, because of their recent employment with Tropical Breeze Casino Cruz, had not yet undergone any emergency training, including fire drills. Deckhand 1 was rehired a week before the accident and said he did recall drills during his previous employment with the company. However, the new-hire deckhand

45

stated that, during his 5 and a half months of employment with the company, he had not participated in a drill. The pre-hire deckhand had boarded the vessel for the first time just minutes before departing on the accident voyage and had not participated in any onboard drills. Further, although activating the engine room’s fire suppression system was not applicable in the Island Lady accident, in postaccident interviews only the captain could explain how the system worked. Following the Express Shuttle II fire in 2004, the company agreed to implement NTSB Safety Recommendation M-06-13 to develop and implement a crew training program in marine firefighting. Based on the company’s correspondence, the NTSB classified that recommendation “Closed—Acceptable Action” in December 2006. However, the circumstances of the Island Lady fire and the postaccident interviews suggest that the Island Lady crewmembers were not, in fact, proficient enough in marine firefighting practices. The NTSB therefore concludes that the Island Lady crewmembers had insufficient training in firefighting. Moreover, as with its firefighting program, Tropical Breeze Casino Cruz’s job training program may need enhancement as well, including greater familiarization with the vessel, company policies, and duties (emergency and other). Given the recurring nature of this company’s accidents and the high risk to passenger safety, the NTSB therefore recommends that Tropical Breeze Casino Cruz revise its marine firefighting and job training programs, including documenting both on board and ashore that all crewmembers are qualified and can continually demonstrate proficiency in their duties, such as firefighting techniques and other emergency situations. The NTSB has long advocated SMS, which is a comprehensive, documented system to enhance safety.28 Safety of operations is the objective behind every action and decision by both those who oversee procedures and those who carry them out. Regardless of the size of the company, an SMS ensures standardized and unambiguous procedures for each crewmember during both routine and emergency operations. Duties and responsibilities are specified and supervisory and subordinate chains of command delineated. As a result, each crewmember understands precisely what he or she is to do in critical phases of operations. In addition, SMS calls for the creation of plans to respond to a range of possible emergency situations, with crewmember duties and responsibilities specified. As noted earlier in this report, SMS also covers preventive maintenance. The Coast Guard requires that US vessels engaged in oceangoing international service have SMS, but such a requirement is not yet in place for the domestic vessel fleet. Following the 2010 allision of passenger ferry Andrew J. Barberi with a terminal at Staten Island, New York, in which 50 people were injured, the NTSB issued Safety Recommendation M-12-3 to the Coast Guard29: Require all operators of U.S.-flag passenger vessels to implement safety management systems, taking into account the characteristics, methods of operation,

28 See for example SMS-related Safety Recommendations M-05-6 to the Coast Guard and M-05-2 to the New York City Department of Transportation resulting from the 2003 Andrew J. Barberi allision with a pier at Staten Island, New York; M-10-7 to ferry operator Interstate Navigation Co. resulting from the 2008 collision between its vessel Block Island and Coast Guard cutter Morro Bay on Block Island Sound, Rhode Island; and M-14-7 to ferry operator Seastreak, LLC resulting from the 2013 allision of its vessel Seastreak Wall Street with a pier at Manhattan, New York. 29 Allision of Passenger Ferry Andrew J. Barberi With St. George Terminal, Staten Island, New York, May 8, 2010, Marine Accident Report NTSB/MAR 12/01. Washington, DC: National Transportation Safety Board, 2012. By issuing Safety Recommendation M-12-3, the NTSB superseded a previous SMS-related recommendation, M-05-6.

46

and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. After the Coast Guard initially responded that it was developing appropriate regulations for all US-flag passenger vessels (part of Public Law 111–281), the NTSB classified Safety Recommendation M-12-3 “Open―Acceptable Response” in May 2013. However, in April 2014, after more than 3 years had passed since Congress authorized the Coast Guard to mandate SMS and nearly 1 year had passed since the Coast Guard (in its response to receiving M-12-3) expressed intent to initiate rulemaking, the NTSB reclassified the recommendation “Open―Unacceptable Response,” the status in which M-12-3 remains as of the date of this report. The NTSB continues to believe that SMS is an essential tool for enhancing safety on board all US passenger vessels and that the Coast Guard is the appropriate authority to ensure implementation and enforcement of such a system. In the case of the Island Lady and Tropical Breeze Casino Cruz, a Coast Guard requirement for SMS would likely have ensured greater adherence to completing crew training drills, appropriate responses to emergencies such as alarms and fires, and failsafe record-keeping of training and maintenance-related documents. The NTSB concludes that implementing SMS on all domestic passenger vessels would further enhance operators’ ability to achieve the higher standards of safety that the Coast Guard requires of US oceangoing vessels in international service. Therefore, the NTSB once again recommends that the Coast Guard require all operators of U.S.-flag passenger vessels to implement SMS, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. 2.5 Lack of Fire Detection in Unmanned Spaces with Exhaust Tubing The small passenger vessel regulations at Title 46 CFR 181.400(c) require that a space containing propulsion machinery be equipped with a fire detection system of an approved type. The Island Lady had a custom-designed and custom-built fire detection system in the engine room, installed in 1994 when the vessel was constructed. The system had a control panel manufactured by Interstate Fire Protection and two heat detectors in the engine room wired directly to the panel. The captain stated that he did not recall the Island Lady’s fire detection system sounding during the fire, which is logical given that the fire did not originate in the engine room where the heat detectors were located. Instead, the most likely place of ignition was the lazarette, where the overheating exhaust tubes led through wood structures at the stern. However, regulations did not require fire detection systems in such spaces, nor was the Island Lady’s lazarette equipped with one. Further, the lazarette was unmanned, making early fire detection by the crew unlikely and further investigation difficult. As evident in the Coast Guard information on fire origination (appendix B), auxiliary spaces (such as lazarettes) are the second-most frequent locations in which fires start on board small passenger vessels. Moreover, these below-deck spaces are often difficult to access, especially while under way. Therefore, automatic fire detection would help crews identify otherwise unknown small fires and provide the opportunity to begin prompt firefighting efforts.Early detection is critical to extinguishing a fire. The earlier a fire is responded to, the better the chance of extinguishing it before it spreads beyond control. In the case of the Island Lady, after the undetected fire took hold and spread, it eventually engulfed the entire main deck. The NTSB therefore concludes that had the Island Lady been outfitted with fire detectors in the lazarette, the

47

fire and its location would have been identified earlier, providing the opportunity for swifter response. The NTSB is concerned that other small passenger vessels do not have fire detection systems in spaces such as lazarettes that contain machinery, hot exhaust tubing, and fuel sources. As shown in this accident, the lack of fire detection in these spaces can put passengers and crewmembers at risk. The NTSB therefore recommends that the Coast Guard require fire detection systems in unmanned spaces with machinery or other potential heat sources on board small passenger vessels. 2.6 Inappropriate Material and Design of Fuel Tank Level-Indicator System The Island Lady’s fuel tanks had tank level indicators constructed of plastic tubing and manually operated metal-construction valves that could isolate the level indicators from the tanks (no automatic shutoff valves were available). Once the fire reached the fuel tank room, the plastic tubing would have quickly melted. If the manual valve for isolating the level indicator was open, the entire content of the fuel tank would empty, exacerbating the fire until the fuel was consumed. Although the position of the isolation valves could not be determined because they had melted from the fire, the tanks were indeed found empty after the fire. If automatic shutoff valves had been available, the fuel in the tank would have quickly been isolated. The NTSB therefore concludes that the use of plastic tubing on local tank level indicators and lack of automatic shutoff valves on the fuel tanks resulted in release of diesel fuel, which contributed to the severity of the fire. A Coast Guard inspector found the fuel tank isolation valves open during an examination of the Island Lady in March 2017, raising concern that the valve arrangement and plastic materials did not meet applicable regulations and instructing the crew to close the valves. The inspector later looked for the regulation against plastic tubing and manual valves for fuel tank level indicators, but was unable to find it. Consequently, the use of plastic materials and lack of automatic fuel shutoff valves was not entered as a finding in the Coast Guard inspection report. Title 46 CFR 182.440 (Independent fuel tanks, (a) materials and construction (7) tubular gauge glasses) required the level indicators to be constructed of heat-resistant material and fitted with an automatic shutoff device. The NTSB concludes that during an inspection of the Island Lady before the fire, the Coast Guard did not correctly assess the fuel system’s compliance with applicable regulations. Had the Coast Guard reported the Island Lady’s fuel tank level-indicator system as failing to meet federal regulations, Tropical Breeze Casino Cruz would have had to replace the components to comply with regulations. The NTSB is concerned that other small passenger vessels may also have plastic tubing or other unapproved material in their fuel tank level-indicator systems, which can put passengers and crewmembers at risk by releasing fuel if a failure occurs during a fire or from impact. The Coast Guard can issue Marine Safety Information Bulletins (MSIBs), which are directed to OCMIs and vessel operators and that highlight specific safety issues in recent marine accidents. An MSIB relating to fuel tank level-indicator systems could enhance small passenger vessel safety by highlighting this issue to both regulators and industry. The NTSB therefore recommends that the Coast Guard issue an MSIB that addresses the need to use only approved material and components in fuel tank level-indicator systems.

48

• Conclusions

1. 1 Findings

• Weather, fatigue, and impairment due to alcohol and other drugs were not factors in

the accident.

• The high-temperature alarm for the port engine’s jacket-water system resulted from a

failure of the port engine’s raw-water pump.

• The fire likely started in the port engine’s fiberglass exhaust tubing and spread to wood

structures in the lazarette, through which the tubing transited.

• The captain’s decision to continue to run the port engine in an overheated condition,

even though the starboard engine was available and functioning normally, allowed the port engine to overheat to failure and the engine’s exhaust tubing to ignite.

• Tropical Breeze Casino Cruz did not provide adequate guidance to its crews regarding

response to engine and other machinery alarms.

• The captain’s decisions to return the vessel to the dock after receiving the engine

high-temperature alarm and to subsequently beach the Island Lady when smoke overwhelmed the vessel were prudent and increased the likelihood of survival for those on board.

• The company’s lack of inspections and infrequent maintenance likely resulted in

undetected, wear-related damage causing the port engine’s raw-water pump to fail.

• If Tropical Breeze Casino Cruz had followed Caterpillar’s recommended maintenance

schedule for the Island Lady’s propulsion engines, the failed raw-water cooling pump would have been inspected and likely replaced.

• The Island Lady crewmembers had insufficient training in firefighting.
• Implementing safety management systems on all domestic passenger vessels would

further enhance operators’ ability to achieve the higher standards of safety that the Coast Guard requires of US oceangoing vessels in international service.

• Had the Island Lady been outfitted with fire detectors in the lazarette, the fire and its

location would have been identified earlier, providing the opportunity for swifter response.

• The use of plastic tubing on local tank level indicators and lack of automatic shutoff

valves on the fuel tanks resulted in release of diesel fuel, which contributed to the severity of the fire.

• During an inspection of the Island Lady before the fire, the Coast Guard did not

correctly assess the fuel system’s compliance with applicable regulations. 49

1. 2 Probable Cause

The National Transportation Safety Board determines that the probable cause of the fire on board small passenger vessel Island Lady was Tropical Breeze Casino Cruz’s ineffective preventive maintenance program and insufficient guidance regarding the response to engine high-temperature conditions, which resulted in the captain’s continued operation of an engine that was overheating due to a cooling water pump failure, leading to ignition of the exhaust tubing and surrounding structure. Contributing to the spread of the fire was the lack of fire detection in the vessel’s lazarette, which was not required by regulations and which allowed the fire to take hold unbeknownst to the crew.

50

• Recommendations

1. 1 New Recommendations

As a result of its investigation of this accident, the National Transportation Safety Board makes the following new recommendations: To Tropical Breeze Casino Cruz, LLC: Develop and apply an oversight system to ensure that your maintenance program complies with the manufacturer’s recommended preventive maintenance program for the engines and associated machinery and systems on board your vessels. (M-18-11) Revise your marine firefighting and job training programs, including documenting both on board and ashore that all crewmembers are qualified and can continually demonstrate proficiency in their duties, such as firefighting techniques and other emergency situations. (M-18-12) To the US Coast Guard: Require fire detection systems in unmanned spaces with machinery or other potential heat sources on board small passenger vessels. (M-18-13) Issue a Marine Safety Information Bulletin that addresses the need to use only approved material and components in fuel tank level-indicator systems. (M-18-14) 4.2 Previously Issued Recommendation Reiterated in this Report As a result of its investigation, the National Transportation Safety Board reiterates the following safety recommendations: To the US Coast Guard: Require that companies operating domestic passenger vessels develop and implement a preventive maintenance program for all systems affecting the safe operation of their vessels, including the hull and mechanical and electrical systems. (M-02-5) Require all operators of U.S.-flag passenger vessels to implement safety management systems, taking into account the characteristics, methods of operation, and nature of service of these vessels, and, with respect to ferries, the sizes of the ferry systems within which the vessels operate. (M-12-3) 51

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member BRUCE LANDSBERG T. BELLA DINH-ZARR Vice Chairman Member

JENNIFER HOMENDY Adopted: December 11, 2018 Member

52

Appendix A Investigation On January 15, 2018, the NTSB launched an investigator-in-charge from the Office of Marine Safety, who interviewed crewmembers, employees, passengers, and good Samaritans. Witness videos were obtained and inspection documents reviewed. In May 2018, investigators returned to Port Richey to inspect the salvaged engines together with the engine manufacturer. In October 2018, the investigator in charge returned to Port Richey and conducted further interviews with the company owner.

The NTSB investigated the fire under Title 49 CFR 1131 as an accident of recurring character because of a similar fire on board another of the operating company’s vessels, the Express Shuttle II, in 2004.

53

Appendix B Table of Vessel Fires Coast Guard-provided information on fire origination, compiled from its MISLE database (Marine Information for Safety and Law Enforcement). Fires on US-Flag Inspected Passenger Vessels 2001–2018 Subchapter

Source Analysis H K T Subtotals Engine Room 24 62 187 273 Auxiliary 21 7 3 31 Accommodation 4 3 13 20 Exhaust 1 4 9 14 Wheelhouse 1 2 7 10 Galley 1 1 7 9 Unspecified 2 5 7 Arson 1 4 5 During Drydock 1 2 3 Shore Connection 1 1 2 Main Deck 1 1 2 Storage 1 1 Pilothouse 1 1 Trailorized 1 1 Fire at Shipyard 1 1 Rescue boat 1 1 Shoreside Source 1 1 Hotwork main deck 1 1 Grand Totals 54 87 242 383 MISLE data as of November 28, 2018

FD07503 ｜ 2018_美国_PAB1802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

NTSB/PAB-18/02 National Transportation Safety Board Pipeline Accident Brief Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System Canton, Illinois

The Accident On November 16, 2016, about 5:44 p.m. central standard time, a natural gas-fueled explosion occurred at a two-level commercial building located at 45 East Side Square in Canton, Illinois. One Ameren employee was killed and 11 people were injured, including two Ameren employees. Prior to the accident, Sure Shot Communications LLC (Sure Shot), a contractor for Mid Century Communications (Mid Century), a telephone and fiber optics cooperative, was performing directional drilling adjacent to the building to install conduit for fiber optic cable.1 About 9:00 a.m., the Sure Shot crew began performing multiple drills at various locations on the block. At 3:58 p.m., the contractor reported to the Joint Utility Locating Information for Excavators (JULIE), the one-call message handling and delivery service for identifying underground utilities, that a marked gas line had been damaged. The damage occurred while crews were pulling the drill rod back to the drilling rig after a directional drilling operation under the sidewalk along North First Street. At 4:06 p.m., Ameren Illinois (Ameren), the owner and operator of the gas line, received a damage report from Sure Shot and dispatched field technicians to evaluate the situation. About 7 minutes later, the first Ameren responder arrived at the scene; three other Ameren technicians arrived shortly thereafter. The lead Ameren responder contacted his supervisor to confirm the pipeline had been struck and to request excavation equipment to uncover the service line. A backhoe excavator arrived at 4:41p.m. and Ameren technicians began to isolate the leak. At 4:48 p.m., nearby customers called the Ameren Customer Contact Center to report natural gas odors both indoors and outdoors. According to Ameren, these customers were given safety instructions and told to leave their buildings if an odor was detected.2 By 5:37 p.m., Ameren technicians shut off the natural gas flow to the service line by squeezing off the pipeline. At 5:44 p.m., the Opera House Annex behind the Opera House Professional Center exploded, killing one and injuring 11 who were impacted by debris from the blast. (See figures 1 and 2.)

1 Directional drilling is a trenchless pipe or conduit installation technique that involves drilling into the soil to create a horizontal bore or pathway for the pipe or conduit. 2 Ameren provided verbal instructions as written in their Customer Contact Center Emergency Plan Procedures, subsection 4.G and 4.H.

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

2

Figure 1. A Google Earth image of the back of the Opera House Professional Center and the two-level Opera House Annex prior to the accident.

Figure 2. Photograph of the accident site and debris from the Opera House Annex. (Courtesy of Canton Police Department.)

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

3

The Pipeline System The damaged natural gas service line was a 1-inch polyethylene line connected to a 2-inch gas main located about 6 feet east of the west curb line (inside the roadway) of North First Street. The service line was installed on December 6, 2012, and was 32 feet long.3 The natural gas service was operating at 30 pounds per square inch gauge (psig) with a maximum allowable operating pressure of 60 psig. Sure Shot Communications LLC Sure Shot had previously performed fiber optic conduit installation for Mid Century; however, there was no written contract between the companies for the work performed on the day of the accident or past work. Additionally, Sure Shot did not have either a written project plan or an emergency response plans for the work. The company also did not have qualification and training records for the employees performing directional drilling. The day of the accident was the first field work day for the employee-in-charge (crew leader) of the directional drilling crew. Sure Shot positioned directional drilling equipment at the corner of East Chestnut and North First Street. The crew drilled southward, under the sidewalk, to a utility handhole located about 1 foot past the service line to the extension of the Opera House Professional Center.4 Figure 3 shows the location of the drilling rig in relation to the Opera House Professional Center and depicts the horizontal drill path and the location where the gas service line was struck.

3 Prior to the installation of this gas main line and service in 2012, the Opera House Annex was serviced by a branch line off the service line to the Opera House Professional Center at 45 East Side Square. 4 A handhole is an opening created on the face of an underground concrete junction box used for the routing and termination of below grade cables/wires.

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

4

Figure 3. An illustration of the drill path and the location where the gas service line was struck. The location of the natural gas service line damage was underneath the concrete sidewalk adjacent to the destroyed structure. Sure Shot did not excavate the utility crossing location before starting the drilling work, as required by Illinois statute.5 According to Illinois law, during directional drilling, each location where the drill path crosses underground, utilities must be excavated using methods such as hand or vacuum excavation. The excavator must visually inspect the work, while in progress, until clear of the underground utilities. Section 4(a) and (b) of 220 Illinois Compiled Statutes (ILCS) 50, Illinois Underground Utility Facilities Damage Prevention Act, states: Every person who engages in nonemergency excavation or demolition shall: (a) take reasonable action to inform himself of the location of any underground utility facilities in and near the area for which such operation is to be conducted; (b) plan the excavation or demolition to avoid or minimize interference with underground utility facilities within the tolerance zone by utilizing such precautions

5 The Illinois Commerce Commission’s Natural Gas Pipeline Safety section is charged with inspection and enforcement activities applicable to intrastate natural gas transmission, distribution and gathering pipeline facilities to assure compliance with all federal and state safety rules and regulations pertaining to the design, construction, operation, and maintenance of those facilities (see https://www.icc.illinois.gov/pipelinesafety/ accessed October 29, 2018).

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

5

that include, but are not limited to, hand excavation, vacuum excavation methods, and visually inspecting the excavation while in progress until clear of the existing marked facility. The crew leader told National Transportation Safety Board (NTSB) investigators that the owner of Sure Shot instructed him not to excavate under the concrete slab to avoid replacing the relatively new concrete sidewalk.6 The crew leader was concerned about the failure to expose the gas line; however, he thought it would be adequate since the crew was drilling 30 inches underground or below the depth of the natural gas line that he believed was buried 18 inches.7 (See figure 5.)

Figure 5. Image showing the damaged yellow service line intersected by the orange fiber optic cable conduit. He told investigators that he believed the drill crossed the natural gas line without incident and that the strike occurred when the drill machine operator was pulling the drill rod back to the drill rig.8 He was certain that he would have smelled natural gas in the handhole if the drill had

6 Interview summary of Sure Shot owner located in NTSB Docket DCA17FP003. 7 The bore diameter was 6 inches. 8 The pullback of the drill rod was described as a dead pull, meaning the drill is neither rotating nor spinning on the way back to the drill rig.

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

6

struck the gas line when pushing the drill rod to the vault since it was only a foot away and he had his face in the vault. After striking the gas line, the crew leader described hearing, smelling, and seeing the leaking gas moving rocks and soil in the handhole. He called JULIE to report the accident and also contacted Ameren after he spoke with a representative from Mid Century. He did not contact 911. He told NTSB investigators that he believed JULIE would make the 911 notification.9 Ameren provided the crew leader with safety instructions to block off the street and to evacuate nearby buildings. The Sure Shot crew shut off their equipment and blocked off the street: the crew leader spoke to people leaving the nearby buildings. Some of these individuals told him they smelled gas and he instructed them to leave the building. Additionally, he attempted to evacuate the Opera House Annex by knocking on the door, but no one answered. He awaited the arrival of Ameren response personnel. Mid Century Communications On the day of the accident, a Mid Century representative was at the excavation site all day; however, he told NTSB investigators he was not responsible for overseeing work by Sure Shot employees. His role was to answer technical questions from either Sure Shot or potential customers. He stated that he spent most of his day sitting in his vehicle.10 Local Emergency Response Notifications The Sure Shot employees, the Ameren field technicians, and Ameren dispatch center personnel called did not call 911 to report the gas leak prior to the explosion. In response to a one call enforcement information request from the Illinois Commerce Commission, the owner of Sure Shot stated that the company did not contact 911 since JULIE usually dispatches the fire department when gas leaks are reported. However, he affirmed on the same form that he is aware that Section 7 of Illinois Underground Utility Facilities Damage Prevention Act requires that “[i]n the event of any damage to any underground utility facility that results in the escape of any flammable, toxic, or corrosive gas or liquid, the person responsible for the excavation or demolition shall call 911 and notify authorities of the damage.” He also affirmed that the same section of the Act requires the person responsible to immediately notify both the affected utility and JULIE. Ameren employees responding to the damage report were on scene for about 1.5 hours before the explosion. The employees recorded gas readings were taken from the outside perimeter

9 The Horizontal Directional Drilling (HDD) industry at large must follow the appropriate state one call digging and Occupational Safety and Health Administration laws, however; in the state of Illinois, there are no training or certification requirements for HDD contractors who work on water, telecommunications, and other utilities with HDD equipment. Federal rules do exist for contractors performing work on gas utilities whereby HDD operators must comply and meet the requirements under the Operator Qualification rules in the PHMSA Pipeline Safety Regulations. 10 Interview summary of Mid Century employee located in NTSB Docket DCA17FP003.

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

7

of the Opera House Professional Center building; however, they did not take any readings from inside the building despite Ameren having received both indoor and outdoor odor complaints. Service Line Damage An Ameren utility crew excavated and visually examined the damaged service line at the accident scene. The top of the 1-inch polyethylene line showed clear damage as a result of being struck by drilling equipment. The damage to the service line from the directional drilling is shown in figure 6.

Figure 6. Damaged service line to the exploded building from two different angles. Probable Cause The National Transportation Safety Board determines that the probable cause of the natural gas release and subsequent explosion was third party damage from Sure Shot’s directional drilling to install underground fiber optic conduit. Contributing to the pipeline damage was Sure Shot’s decision not to excavate at the utility crossing to visually inspect the work, while in progress, until clear of the underground utilities, as required by Illinois law. Contributing to the severity of the accident was the failure of Sure Shot and Ameren to evacuate the area.

For more details about this accident, visit www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA17FP003. Issued: December 3, 2018

Third-party Damage by Sure Shot Communications to Ameren Natural Gas Distribution System

8

The NTSB has authority to investigate and establish the facts, circumstances, and cause or probable cause of a pipeline accident in which there is a fatality, substantial property damage, or significant injury to the environment. (49 US Code § 1131 - General authority)

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties . . . and are not conducted for the purpose of determining the rights or liabilities of any person.” Title 49 Code of Federal Regulations, Section 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 USC 1154(b).

FD07504 ｜ 2018_美国_RAR1802.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2018 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Derailment and Hazardous Materials Release of Union Pacific Railroad Unit Ethanol Train Graettinger, Iowa March 10, 2017

Accident Report NTSB/RAR-18/02 PB2019-100084

National Transportation Safety Board

NTSB/RAR-18/02 PB2019-100084 Notation 58536 Adopted October 30, 2018

Railroad Accident Report Derailment and Hazardous Materials Release of Union Pacific Railroad Unit Ethanol Train Graettinger, Iowa March 10, 2018

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2018. Derailment and Hazardous Materials Release of Union Pacific Railroad Unit Ethanol Train, Graettinger, Iowa, March 10, 2017. Railroad Accident Report NTSB/RAR-18/02. Washington, DC. Abstract: On March 10, 2017, about 12:50 a.m., central standard time, an eastbound Union Pacific Railroad (UP) unit ethanol train with 3 locomotives, 98 loaded tank cars, and 2 buffer cars derailed near milepost 56.8 at a timber railroad bridge near Graettinger, Iowa. Twenty loaded tank cars derailed. Fourteen of the derailed tank cars released about 322,000 gallons of undenatured ethanol, ethyl alcohol without a denaturant added to it, fueling a postaccident fire. The accident occurred near Jack Creek. There were no injuries and three nearby homes were evacuated. About 400 feet of railroad track and a 152-foot railroad bridge were destroyed in the accident. UP estimated damages, excluding environmental remediation or the cost of clearing the accident, at $4 million. The investigation focused on the following safety issues: the adequacy of UP’s track maintenance and inspection program, the adequacy of the Federal Railroad Administration’s (FRA) oversight, and the transportation of fuel ethanol without the use of volatile organic chemical denaturants. As a result of this investigation, the National Transportation Safety Board (NTSB) makes new safety recommendations to the FRA, the Pipeline and Hazardous Materials Safety Administration (PHMSA) and UP. The NTSB is also reiterating an existing safety recommendation to PHMSA.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA17MR007. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2019-100084 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Railroad Accident Report

Contents Figures ............................................................................................................................................ ii Tables ............................................................................................................................................ iii Abbreviations and Acronyms ..................................................................................................... iv Executive Summary .................................................................................................................... vii 1 Factual Information .................................................................................................................1 1.1 Accident Synopsis ....................................................................................................................1 1.2 The Accident ............................................................................................................................2 1.3 Hazardous Materials Release ...................................................................................................4 1.4 Emergency Response ...............................................................................................................5 1.5 Postaccident Site Inspection .....................................................................................................6 1.6 Injuries ......................................................................................................................................9 1.7 Damages ...................................................................................................................................9 1.7.1 Tank Car Damages .........................................................................................................9 1.7.2 Track and Structures Damages ....................................................................................11 1.7.3 Environmental Remediation ........................................................................................11 1.8 Personnel Information ............................................................................................................12 1.8.1 Accident Train Engineer ..............................................................................................12 1.8.2 Accident Train Conductor ............................................................................................12 1.8.3 UP Track Supervisor ....................................................................................................12 1.8.4 UP Track Inspector ......................................................................................................13 1.8.5 UP Bridge Inspector .....................................................................................................13 1.9 Work/Rest History ..................................................................................................................13 1.10 Toxicological Information ......................................................................................................13 1.11 Operations Information ..........................................................................................................14 1.11.1 Locomotive Event Recorder Data ................................................................................14 1.12 Site Description ......................................................................................................................14 1.12.1 Track ............................................................................................................................15 1.12.2 Bridge ...........................................................................................................................15 1.12.3 On-board Image Recorder ............................................................................................16 1.13 Mechanical Inspections ..........................................................................................................16 1.14 Track and Rail Inspection .......................................................................................................17 1.14.1 UP Track Inspection and Maintenance History ...........................................................17 1.14.2 UP Internal Rail Inspection History .............................................................................18 1.14.3 Track Geometry Inspections ........................................................................................18 1.14.4 Federal Oversight of Track and Rail Inspections ........................................................19 1.14.5 FRA Inspection and Enforcement Data .......................................................................20 1.14.6 FRA Compliance Agreement with UP ........................................................................20 1.14.7 FRA Interview .............................................................................................................21 1.15 Postaccident Track Inspections ..............................................................................................22

NTSB Railroad Accident Report i 1.15.1 Point of Derailment and Rail Reconstruction ..............................................................24 1.16 Hazardous Materials Information ...........................................................................................24 1.16.1 Denatured and Undenatured Ethanol ...........................................................................24 1.16.2 Shipping Paper Discrepancy ........................................................................................28 1.16.3 Tank Car Regulations and Industry Standards.............................................................29 1.16.4 Flammable Liquids Tank Car Fleet .............................................................................30 1.17 Tests and Research .................................................................................................................32 1.17.1 Examination of Recovered Rail ...................................................................................32 1.17.2 Evaluation of Net Braking Ratio..................................................................................33 1.17.3 Finite Element Study....................................................................................................33 1.18 Postaccident Actions ..............................................................................................................34 2 Analysis ...................................................................................................................................37 2.1 Introduction ............................................................................................................................37 2.2 Estherville Subdivision ...........................................................................................................37 2.2.1 UP’s Track Inspection Program ...................................................................................37 2.2.2 Transition Regions .......................................................................................................39 2.2.3 FRA Oversight .............................................................................................................41 2.3 Rail Metallurgy .......................................................................................................................43 2.3.1 Rail Break ....................................................................................................................44 2.4 Finite Element Analysis of 90-Pound Worn Rail ...................................................................45 2.5 DOT-111 Tank Cars in Ethanol Service ................................................................................45 2.5.1 Tank Head Breaches ....................................................................................................46 2.5.2 Tank Shell Breaches ....................................................................................................47 2.5.3 Unprotected Valves and Fittings ..................................................................................48 2.5.4 DOT-111 Tank Car Fleet Replacement .......................................................................50 2.6 Transportation of Fuel Ethanol Without Denaturant ..............................................................54 2.7 Factors Not Contributing to this Derailment ..........................................................................56 3 Conclusions .............................................................................................................................58 3.1 Findings ..................................................................................................................................58 3.2 Probable Cause .......................................................................................................................59 4 Recommendations ..................................................................................................................60 4.1 New Recommendations ..........................................................................................................60 4.2 Reiterated Recommendation ..................................................................................................60 Appendixes....................................................................................................................................61 Appendix A: Investigation .............................................................................................................64 Appendix B: Summary of Federal Railroad Administration and Union Pacific Railroad Inspections .....................................................................................................................................65 Appendix C: Tank Car Specifications ...........................................................................................70 References .....................................................................................................................................72

NTSB Railroad Accident Report ii Figures Figure 1. The accident site. ............................................................................................................ 2 Figure 2. Green Plains ethanol facility in Superior, Iowa. ............................................................. 3 Figure 3. Map showing the locations of the incident command center and the derailment. .......... 5 Figure 4. Illustration of train movement over rails. ....................................................................... 6 Figure 5. Wheel tread impact damage on TCBX 198115. ............................................................. 7 Figure 6. Aerial photograph of the derailed train and the damaged track. .................................... 9 Figure 7. Derailment scene and tank car identification. The numbers in parentheses identify the location of the tank cars. ....................................................................................................... 10 Figure 8. Jack Creek Bridge in 2013............................................................................................ 15 Figure 9. Still image of the track on approach to the Jack Creek Bridge. ................................... 16 Figure 10. Split and broken crossties, that are not holding fasteners, immediately west of MP 56.9. ......................................................................................................................... 23 Figure 11. US 2017 export figures for denatured and undenatured ethanol. ............................... 27 Figure 12. Ethanol shipments by tank car type, 2013 – Q1 2018. ............................................... 32 Figure 13. Comparison of the calculated internal transverse stresses of 90-pound rail supporting wheel loads. .............................................................................................................. 33 Figure 14. Section 10S from the south rail that was recovered from the accident ...................... 43

NTSB Railroad Accident Report iii Tables Table 1. US Department of Transportation Specification-111 breaching damage. ..................... 10 Table 2. FRA enforcement data on Regions 5 and 6: inspections and observations. .................. 20 Table 3. UMLER tank car statistics by owner, January 2016 vs. April 2017. ............................. 31 Table 4. Comparison of UP vs. FRA defective tie standards. ...................................................... 38 Table 5. Results of FRA inspections regarding crossties prior to the accident. ........................... 65 Table 6. Results of UP inspections regarding crossties prior to the accident. ............................. 67 Table 7. Flammable liquids tank car specifications. .................................................................... 70

NTSB Railroad Accident Report iv Abbreviations and Acronyms AAR

Association of American Railroads AFP

alcohol fuel plant Amtrak

National Railroad Passenger Corporation AREMA

American Railway Engineering and Maintenance-of-Way Association BTS

Bureau of Transportation Statistics CFR

Code of Federal Regulations CN

Canadian National Railroad CORTEX

Crude Oil Route Track Examination CPC-1232

Casualty Prevention Circular-Specification-1232 Tank Car CWR

continuously welded rail DOT

US Department of Transportation DOT-111

US Department of Transportation Specification-111 Tank Car DOT-117

US Department of Transportation Specification-117 Tank Car DPU

distributed power unit EERC

Ethanol Emergency Response Coalition EISA

Energy Independence and Security Act of 2007 EPA

Environmental Protection Agency FAST Act

Fixing America’s Surface Transportation Act FE

finite element FR

Federal Register FRA

Federal Railroad Administration FY

fiscal year GRL

gross rail load

NTSB Railroad Accident Report v GRMS

gage restraint measurement system HMR

Hazardous Materials Regulations HHFT

high hazard flammable train Iowa DNR

Iowa Department of Natural Resources kpsi

kilo-pounds-per-square-inch MGT

million-gross tonnage MP

milepost MTM

manager of track maintenance NIMS

National Incident Management System NIP

National Inspection Plan NTSB

National Transportation Safety Board PADD

Petroleum Administration for Defense Districts PHMSA

Pipeline and Hazardous Materials Safety Administration POD

point of derailment psi

pounds-per-square-inch RA

FRA regional administrator RFA

Renewable Fuels Association RFS

Renewable Fuel Standard RIN

renewable identification numbers RIP

Regional Inspection Plan TSS

track safety standards TTB

Alcohol and Tobacco Tax and Trade Bureau UMLER

Universal Machine Language Equipment Register UN

United Nations UP

Union Pacific Railroad

NTSB Railroad Accident Report vi USC

United States Code YTD

year-to-date

NTSB Railroad Accident Report vii Executive Summary On March 10, 2017, about 12:50 a.m., central standard time, eastbound Union Pacific Railroad unit ethanol train, UEGKOT-09, with 3 locomotives, 98 loaded tank cars, and 2 buffer cars filled with sand derailed near milepost 56.8 at a timber railroad bridge near Graettinger, Iowa. Twenty loaded tank cars in positions 21 through 40 derailed. Fourteen of the derailed tank cars released about 322,000 gallons of undenatured ethanol, ethyl alcohol without a denaturant added to it, fueling a postaccident fire. The accident occurred near Jack Creek, a tributary of the Des Moines River. There were no injuries and three nearby homes were evacuated. About 400 feet of railroad track and a 152-foot railroad bridge were destroyed in the accident. Union Pacific Railroad estimated damages, excluding environmental remediation or the cost of clearing the accident, at $4 million. At the time of the accident, the wind was from the northwest at 17 mph gusting to 30 mph, visibility was 10 miles, and the temperature was 10°F. The following are safety issues in this accident: • Adequacy of Union Pacific Railroad’s track maintenance and inspection program • Adequacy of the Federal Railroad Administration’s oversight • Transportation of fuel ethanol without the use of volatile organic chemical denaturants The National Transportation Safety Board determines that the probable cause of the derailment was a broken rail that occurred as the train was traveling over the west approach of the Jack Creek Bridge resulting from Union Pacific Railroad’s inadequate track maintenance and inspection program and the Federal Railroad Administration’s inadequate oversight of the application of federal track safety standards. Contributing to the consequences of this accident was the continued use of US Department of Transportation Specification-111 tank cars.

NTSB Railroad Accident Report 1 1 Factual Information 1.1 Accident Synopsis On March 10, 2017, about 12:50 a.m., central standard time, eastbound Union Pacific Railroad (UP) unit ethanol train, UEGKOT-09, with 3 locomotives, 98 loaded tank cars, and 2 buffer cars filled with sand derailed near milepost (MP) 56.8 at a timber railroad bridge on the Estherville Subdivision, near Graettinger, Iowa.1 Twenty loaded tank cars in positions 21 through 40 derailed. Fourteen of the derailed tank cars released about 322,000 gallons of undenatured ethanol, fueling a postaccident fire.2 The accident occurred near Jack Creek, a tributary of the Des Moines River. There were no injuries and three nearby homes were evacuated. About 400 feet of railroad track and a 152-foot railroad bridge were destroyed in the accident. UP estimated damages at $4 million.3 At the time of the accident, the wind was from the northwest at 17 mph gusting to 30 mph, visibility was 10 miles, and the temperature was 10°F. Figure 1 shows an aerial view of the accident.

1 (a) All times in this accident report are central standard time. (b) According to Railway Age’s Comprehensive Railroad Dictionary, a unit train is a train transporting a single commodity from one source to one destination in accordance with an applicable tariff and with assigned cars (Lewis and Others 1992); (c) Title 49 Code of Federal Regulations (CFR) Part 237.5, “Definitions,” defines railroad bridge as any structure with a deck, regardless of length, which supports one or more railroad tracks, or any other undergrade structure with an individual span length of 10 feet or more located at such a depth that it is affected by live loads. 2 Undenatured ethanol refers to pure ethyl alcohol without a denaturant added to it. 3 This estimate does not include environmental remediation or the cost of clearing the accident.

NTSB Railroad Accident Report 2

Figure 1. The accident site. 1.2 The Accident The train originated from the Green Plains Superior, LLC (Green Plains) ethanol plant in Superior, Iowa, as UP train UEGKOT-09 (accident train) on March 9, 2017. The Superior, Iowa, facility is situated on 238 acres, with 35,141 feet of track. The Green Plains facility has a single loading rack and two storage tanks for intermediate storage of denatured or undenatured ethanol. (See figure 2.)

NTSB Railroad Accident Report 3

Figure 2. Green Plains ethanol facility in Superior, Iowa. (Photograph courtesy of the Green Plains website.) The two-person train crew (engineer and conductor) were called for duty on March 9, 2017, at 4:30 p.m. The train crew boarded a UP contractor-supplied van in Eagle Grove, Iowa, and were transported about 95 miles to Estherville, Iowa, where they boarded the lead locomotive. At Estherville, the crew received authority from the UP dispatcher to go to Green Plains, at Superior, Iowa, which was 6 miles west, to pick up their train. The train crew departed Estherville at 7:36 p.m. and arrived at Green Plains at 8:22 p.m. Upon arrival at Green Plains, the train crew assembled the train, which at the time consisted of 2 locomotives on the head end of the train followed by a buffer car, followed by 99 tank cars loaded with ethanol.4 The loaded tank cars were followed by another buffer car, and then a rear locomotive, also known as a distributed power unit (DPU). Before departing Green Plains, the train crew removed (set out) one tank car with mechanical defects they had been previously notified of; thus, the accident train consisted of 98 loaded tank cars. UEGKOT-09 was a key train transporting about 2.9 million temperature-adjusted meter quantity gallons of undenatured ethanol, which is designated by the US Department of Transportation (DOT) as a Class 3 hazardous material.5 The accident train was also classified as a high hazard flammable train (HHFT) and subject to route planning requirements, speed restrictions, and commodity-specific phase-out of DOT-111 tank cars and reporting requirements of the Hazardous Materials Regulations (HMR).6

4 A buffer car is placed between the locomotive engine and shipments when available to protect train crews from hazardous materials, as required by 49 CFR 174.85, “Position in train of placarded cars, transport vehicles, freight containers and bulk packagings,” which requires that when the train length permits, placarded cars must not be nearer than the sixth car from the engine or occupied cars. Cars loaded with ethanol are placarded and, therefore, require separation from the locomotives. However, the regulation also says that when the train length does not permit, the placarded car must be placed near the middle of the train, but not nearer than the second car from an engine or occupied caboose. 5 According to the Association of American Railroads (AAR) key trains are subject to speed restrictions and other operating criteria and would include any train with 20 car loads or intermodal portable tank loads of any combination of hazardous material (AAR 2016). 6 An HHFT is a single train transporting 20 or more loaded tank cars of a Class 3 flammable liquid in a continuous block or a single train carrying 35 or more loaded tank cars of a Class 3 flammable liquid throughout the

NTSB Railroad Accident Report 4 The accident train was traveling at 28 mph when it approached the Jack Creek Bridge at MP 56.8. The track speed was restricted by UP to 30 mph between MP 56 and MP 57.7 The engineer said that the train was operating smoothly as it approached the accident area. Shortly after crossing the Jack Creek Bridge, and 70 minutes into its trip, the train’s emergency air brakes applied, without crew initiation.8 The train crew described the brake application as a “lurch forward” immediately after which both crewmembers saw a bright orange flash outside the locomotive cab window. The crewmembers said that they turned in their seats to see a large fireball rising into the night sky. The engineer immediately radioed the UP dispatcher in Omaha, Nebraska, and said that the train had experienced an undesired emergency brake application and had derailed, with cars piled up and several cars on fire. After the lead locomotive stopped, the train crew assessed the derailment. They observed that the first 20 cars (still on the rails and attached to the lead locomotives) had separated from the burning derailed cars. The train crew pulled the first 20 cars about 1.5 miles away from the burning cars. Emergency responders asked the crew to use the rear DPU to pull the 52 unaffected cars, west of the derailed cars at the bridge, away from the burning cars. After this task was accomplished, the train crew boarded a UP contractor van and was transported back to Estherville for a federally required DOT toxicological test. 1.3 Hazardous Materials Release Twenty tank cars, in positions 21 through 40, derailed. Of those, 14 tank cars released product. Ten of the derailed tank cars were breached from mechanical damage, while four tank cars with shell damage released product from leaking bottom outlets or top fittings and thermal damage that fueled a postaccident fire that burned for over 36 hours. Section 1.7 discusses how each tank car was damaged. UP contractors transferred ethanol from four nonbreached tank cars involved in the derailment to undamaged tank cars, which were returned to the shipper. The contractors transferred the remaining product from eight of the breached tank cars to on-site frac tanks for temporary storage.9 Based on recovery volumes, the amount of ethanol released in the accident was about 322,000 gallons.

train consist. Specific operating requirements for HHFTs are found at 49 CFR 174.310, “Requirements for the operation of high-hazard flammable trains.” 7 Railroads can choose to operate at any speed, taking into account factors such as operational needs, track geometry, or territory grade. FRA regulations found in 49 CFR 213.9, “Classes of track: operating speed limits,” set forth the maximum authorized speed per class. These speeds vary for freight and passenger trains because different railroad equipment has different capabilities. UP opted to operate at a maximum speed of 30 mph on the Estherville Subdivision. This falls into the speed range for FRA Class 3 track. 8 Emergency air brakes engage through the rapid release of air pressure from the brake pipe, resulting in the correspondent increase of brake pressure. Engineers and conductors can apply the emergency air brakes from their brake valves on the locomotive. However, the emergency brake may also engage because of a broken brake pipe or disconnected air hoses. In the railroad industry, this is commonly known as an undesired emergency brake. 9 A frac tank, originally manufactured for use in the oil and gas drilling industry, is a large mobile temporary storage tank that is used to hold waste water and chemicals. A typical frac tank holds about 21,000 gallons.

NTSB Railroad Accident Report 5 1.4 Emergency Response Within 10 minutes of the accident, the Palo Alto County 911 dispatch center notified the Graettinger, Iowa, fire department of a train accident with burning ethanol cars and a grass fire. The Graettinger fire chief (fire chief) advised firefighters that this was a “full hazardous materials incident” and was the first to arrive on scene. He told National Transportation Safety Board (NTSB) investigators that he was mindful of the emergency response to the ethanol, the amount of radio traffic, the availability of law enforcement, the size of the accident site, the train crew’s location, and moving any cars that were not derailed. He said that he could see the fire when he first turned onto 435th Avenue. (See figure 3.) At this location, he found that the train was blocking a grade crossing and road access to houses near the derailment.

Figure 3. Map showing the locations of the incident command center and the derailment. (Map courtesy of Google.) The fire chief requested additional resources and established incident command in the driveway of a nearby residence at 1:25 a.m., with an immediate goal of moving the nonderailed cars away from the fire and getting access to the nearby residences. The train crew arrived at the command post about 1:35 a.m. and created a plan with the fire chief to move the cars.

NTSB Railroad Accident Report 6 About an hour after the accident, the cars were clear of the grade crossing at 300th Street, and road access was restored to the nearby houses. Residents within a 0.5-mile radius were asked to voluntarily evacuate. The county emergency manager and the fire chief believed that the scene was stable, and they allowed the ethanol product to burn off while monitoring and cooling nearby tank cars with foam. The incident command was later transferred to UP at 3:30 a.m. 1.5 Postaccident Site Inspection NTSB investigators inspected the nonderailed cars (1st through the 20th) that traveled over the Jack Creek Bridge. NTSB investigators observed that the wheels on the right side of several cars that rolled over the right-side rail (or south rail) exhibited fresh horizontal impact damage (impressions perpendicular to the wheel tread).10 (See figure 4.) No such damage was observed on the wheels on the left side of the train. (See figure 5.)

Figure 4. Illustration of train movement over rails.

10 Horizontal impact damage is deformation to the surface of the wheel tread as a result of deviation from the normal wheel rail interface. This damage is the result of the wheel coming into contact with a discontinuity.

NTSB Railroad Accident Report 7

Figure 5. Wheel tread impact damage on TCBX 198115. The damage began to appear on the fourth tank car, but was not present on the fifth or sixth tank cars. On tank cars 10 through 20, the impact damage was observed on every car, becoming more pronounced toward the 20th car, which was a tank car. The 20th car, TCBX 198115, was the last car that traveled through the derailment area without derailing.11

11 The wheel flange is the inside rim which projects below the tread.

NTSB Railroad Accident Report 8 NTSB investigators completed walking track inspections from MP 57.10 to MP 56.35, through the derailment footprint.12 During these inspections, they identified seven defects that did not meet the FRA minimum track standards outlined in Title 49 Code of Federal Regulations (CFR) Part 213, “Track Safety Standards.” They included four crosstie distribution defects, one insufficient number of crossties in a rail segment, one rail fastener defect, and one concentrated load between the base of rail and tie plate. Periodic gage measurements were taken on both tangent track (straight track) and the curve east of the derailment with no gage defects found. There were no rail joints in this track segment, and there were no defects to the rail anchoring; there was no longitudinal movement noticed in either direction. NTSB investigators did, however, note that the crosstie condition on this track segment was marginal in many areas.13 They could find no obvious track disturbances or evidence of dragging equipment west of the location of the derailment at Jack Creek Bridge at MP 56.8. Significant track structure damage in the immediate area of the derailment prevented a comprehensive inspection of an intact track structure. The total amount of damaged and displaced rail was about 400 feet. (See figure 6.) NTSB investigators recovered, identified, and arranged about 390 feet of the damaged and displaced rail. The fractured pieces were “reassembled” based on the manufacturer, manufacture dates, and rail fracture characteristics. Each section was visually examined on scene, labeled, and inventoried. A total of 14 pieces were sent to NTSB’s Materials Laboratory in Washington, DC, for a metallurgical examination.

12 (a) A derailment footprint is a commonly used term in the railroad industry to describe the area near the derailment that was affected by the forces exerted during the accident. This includes damaged and displaced track structure, the railroad subgrade, and the area surrounding the railroad property. (b) The derailment footprint included the area associated with the disturbed rail, tank cars, and bridge wreckage at MP 56.8. 13 Marginal crossties are those that are near the end of useful service life and are close to being noncompliant with FRA track safety standards.

NTSB Railroad Accident Report 9

Figure 6. Aerial photograph of the derailed train and the damaged track. 1.6 Injuries No injuries were reported as a result the accident. 1.7 Damages 1.7.1 Tank Car Damages The orientation of the ethanol tank cars following the derailment is indicated in figure 7. After transloading the tank cars, crews staged them in a nearby farm field for examinations.

NTSB Railroad Accident Report 10

Figure 7. Derailment scene and tank car identification. The numbers in parentheses identify the location of the tank cars. Table 1 summarizes the likely breaching mechanisms for the tank cars involved in this accident. Table 1. US Department of Transportation Specification-111 breaching damage.

Line Number (from front)

Car Number

Head Breach

Shell Breach Bottom Outlet Damage Top Fittings Damage

Thermal Tear

Likely Breaching Mechanism 21 DBUX 301674

X

Vapor valve mechanically broken from multihousing flange 22 TAEX 2893

X

Bottom outlet valve operating handle was manipulated open by derailment forces, the nozzle sheared off 23 TILX 199147 X

A-end head punctured by coupler impact 24 TCBX 198194 X

Head punctured by a coupler or coupler shank impact 25 CTCX 732108

X

X

Large 10-feet tear, second irregular hole, liquid valve mechanically broken from multihousing flange 26 TILX 197694

X

Shell fractured in two pieces from 90° impact with TAEX 2909 27 DBUX 302834

X

Shell fractured in two pieces from 90° impact with TAEX 2909 28 DBUX 302746

No breach 29 TAEX 2909a X

Head punctured by coupler or coupler shank impact

NTSB Railroad Accident Report 11

Line Number (from front)

Car Number

Head Breach

Shell Breach Bottom Outlet Damage Top Fittings Damage

Thermal Tear

Likely Breaching Mechanism 30 WCHX 30078 X X

Tank midsection was torn and crushed between TAEX 2909 and TILX 199819, hole through Ring 6 and head from coupler impact 31 WCHX 30098

X

Bottom outlet valve was leaking, the nozzle was not sheared away from its flange 32 TILX 199819

X

Large shell tear in Ring 6 33 TILX 195202

X

X Small thermal shell tear, the bottom outlet valve was leaking 34 CTCX 731383 X X X

Shell puncture and fractures on car bottom, head fractured on edge of severe dent having the shape of another tank head, BOV open 35 TILX 195386

No breach 36 CTCX 731997 X

Tear and crack indented and folded material from car-to-car impact a Universal Machine Language Equipment Register (UMLER) database is a computer platform used by railroads, rolling stock owners, and repair shops to share rail car information. UMLER indicated TAEX 2909 replaced the original car number GATX 203812. 1.7.2 Track and Structures Damages A 152-foot long timber bridge and about 232 feet of rail on the west approach and 16 feet of rail on the east approach were destroyed. 1.7.3 Environmental Remediation UP contracted Arcadis, U.S., Inc., to support the derailment remediation efforts. These activities included collecting data to evaluate potential impacts to Jack Creek, implementing soil sampling and remediation, supporting ecological permitting, and preparing and submitting required reports to the Iowa Department of Natural Resources (Iowa DNR). The Arcadis report to the Iowa DNR concluded that most of the released ethanol was thought to have been consumed by the fire due to its size, duration, and intensity (Arcadis 2017). The Arcadis report further characterized the level of ethanol released to the soil in the vicinity of the derailment as relatively low. Arcadis reported that dissolved oxygen monitoring and ethanol testing did not indicate significant impact to the surface waters of Jack Creek.

NTSB Railroad Accident Report 12 1.8 Personnel Information 1.8.1 Accident Train Engineer The accident train engineer was hired by UP in January 2005. Engineers and conductors are required to be trained and certified under a federally approved program.14 He earned his latest certification as an engineer in June 2015. This certification was valid until June 2018. The engineer was part of a “pool crew,” which means he would work multiple types of jobs in various locations. In his interview with NTSB investigators, the engineer said that it had been a while since he traveled through this territory. When asked if he had experienced a rough ride or track as the train traveled over the Jack Creek Bridge, the engineer said, “it did not seem rougher than normal.” 1.8.2 Accident Train Conductor The train conductor was hired by UP in September 2003. His latest certification as a conductor was in June 2012. This certification was valid until February 2020. The conductor was also part of a pool crew. In his interview with NTSB investigators, the conductor said he had traveled this territory many times. He told investigators that he was looking out the front window of the lead locomotive as the train approached the Jack Creek Bridge and did not notice any rough track leading up to the Jack Creek Bridge. 1.8.2.1 Personnel Electronic Devices A review of cell phone records obtained by NTSB investigators showed that neither crewmember used their cell phones while on duty the day of the accident. 1.8.3 UP Track Supervisor The manager of track maintenance (MTM) had been in that position with UP in this area for more than 20 years. At the time of the accident, he was responsible for the track maintenance on about 350 miles of track. The MTM supervised 15 track department employees; using them to maintain the assigned track. The MTM told NTSB investigators that about 10 to 12 years ago, UP installed a large rail section from MP 0 to MP 32.2 on the Estherville Subdivision. He said a high percentage (about 90 percent) of rail defects are discovered in this section of the subdivision with 90-pound rail.15 He said that there were not many service failures (broken rails) in the accident area, and that they had not had a derailment in the area in over 20 years until this accident. When asked about bridge inspections, the MTM stated that he does not see reports from those inspections.

14 Title 49 CFR Part 240, “Qualification and Certification of Locomotive Engineers.” 15 Rail is classified by its linear weight for every 3 feet. This rail was designated as S-9020 rail. In this report, the rail is referred to as “90-pound rail.”

NTSB Railroad Accident Report 13 1.8.4 UP Track Inspector The track inspector for the Estherville Subdivision had over 40 years of service with UP; he had been a track inspector for about 34 years and had inspected the Estherville Subdivision for about 25 years. He was assigned a territory that consisted of about 185 miles of main track, which included over 100 track switches and different yard and industry tracks. He told investigators he normally inspects alone, with the exception that he is occasionally accompanied by an FRA inspector or railroad manager. He last inspected the track on the day before the accident and was the last qualified inspector to traverse it prior to the accident. He took no exception to the track near the derailment location. The only issue that he remembered finding in the area of the derailment during his many years of inspection was a broken rail west of the bridge. When asked about his interaction with the bridge inspectors, he stated that he does not normally join the bridge inspectors when they are conducting their work. 1.8.5 UP Bridge Inspector The bridge inspector had been employed by UP in the bridge department since 2004 and started inspecting bridges in 2008. He was assigned to inspect about 425 bridges and between 180 and 200 culverts. He said that the accident bridge was inspected twice per year and was last inspected in October 2016. During this inspection, he documented that the first tie off the west end of the bridge had lost some ballast and was gapped (unsupported). The bridge inspector told investigators that the condition did not meet the federal guidelines for being low, but he documented the condition to be in the record. He said that if he found a defective condition, he would notify the track department and, if necessary, he could protect the track by implementing a speed restriction. 1.9 Work/Rest History NTSB investigators examined the work and rest history for both the engineer and the conductor. The investigation determined that the engineer and conductor had been on duty for 8 hours 20 minutes at the time of the accident. Both the engineer and the conductor worked the previous day, March 8, 2017, beginning at 2:10 p.m., and completed their shift on March 9, 2017, at 1:45 a.m. Both crewmembers had more than the required 10 hours off duty from the previous day before reporting to work on March 9, 2017.16 1.10 Toxicological Information Postaccident testing was required under the regulations because this event involved a major train accident involving a release of hazardous material, as required in 49 CFR 219.201, “Events for which testing is required.” After supporting the emergency responders by moving the nonderailed equipment, the crewmembers were transported for toxicological testing. The

16 Hours-of-service requirements are outlined in 49 CFR Part 228, Appendix A, “Requirements of the Hours of Service Act: Statement of Agency Policy and Interpretation.”

NTSB Railroad Accident Report 14 engineer tested positive for doxylamine in his urine but not in his blood, indicating the level in his blood several hours after the derailment was below the reporting cut off.17 The reporting cut off is also the lowest blood level thought to correlate with any psychoactive effects of the drug such as drowsiness or impaired cognition (FAA 2017). 1.11 Operations Information The Estherville Subdivision runs between Goldfield, Iowa, and Superior, Iowa, about 79 miles. It is primarily single main track with one passing siding; it is not a passenger route. Railroad operations on the subdivision are controlled by track warrant control out of UP’s train dispatching center, located in Omaha, Nebraska. Track speed for the single main track was 30 mph at the accident location. The UP employees involved in the accident were governed by the General Code of Operating Rules (UP 2015). UP’s Iowa Area Timetable No. 5 (UP 2016) also governed train movements. The UP Air Brake and Train Handling Rules (UP 2016a), Instructions for Handling Hazardous Materials (UP 2013), and System Special Instructions (UP 2016b) were also in effect. The train crew received its track warrant from the dispatcher in Omaha upon arriving at Estherville to pick up its locomotives.18 1.11.1 Locomotive Event Recorder Data The leading locomotive’s event recorder data indicated that about 34 seconds after crossing the Jack Creek Bridge at 12:50:49 a.m., while the train was traveling at a speed of about 28 mph, the brake pipe pressure decreased from 88 pounds-per-square-inch (psi) to 5 psi. The train’s emergency brakes activated 1 second later, while maintaining a speed of 28 mph. Data indicated this was not an engineer-initiated activation. During the next 37 seconds, the train speed decreased from 28 mph to 0 mph. 1.12 Site Description The Estherville Subdivision consists of a single main track with one passing siding between MP 0.0 and MP 79.3. It originates in Goldfield, Iowa, and ends in Superior, Iowa, with an average daily train count of one train every other day. During the on-scene phase of the investigation, NTSB investigators reviewed tonnage records from MP 48.49 to 70.56 and found the million-gross tonnage (MGT), or total tonnage, was 2.4 MGT. The eastbound movements would traverse a grade ranging from +1.5 to -1.14 percent, from MP 79.3 to MP 56.45. From MP 56.85 to the point of derailment (POD) at 56.80, an eastbound train was on a slightly descending grade of -0.2 percent. In the accident location, the track alignment was tangent, meaning the track was straight and without curves.

17 Doxylamine is an over-the-counter medication that is used as a nighttime sleep aid. https://www.rxlist.com/consumer_doxylamine_unisom/drugs-condition.htm. Accessed September 12, 2018. 18 A track warrant authorizes main track use, which is restricted to defined movement limits, under the direction of the train dispatcher.

NTSB Railroad Accident Report 15 1.12.1 Track The track construction consisted of 90-pound, continuously welded rail (CWR), manufactured by various companies.19 The CWR was seated in 10-inch single-shoulder tie plates that lay between the bottom surface of the rail and the top surface of timber crossties. The rail was fastened through the tie plates to standard wooden crossties with conventional 6-inch cut track spikes. The spiking pattern used by UP prior to the derailment consisted of one rail-holding spike on the gage side and one rail-holding spike on the field side. The wooden crossties measured 9 inches by 7 inches by 8 feet 6 inches long, spaced 19.5 inches on center (nominal). The crossties were box anchored with rail anchors every other tie to restrain longitudinal movement of the CWR.20 The track was supported by granite and limestone rock ballast. 1.12.2 Bridge The Jack Creek Bridge was an 11-span, timber, open-deck bridge that measured 152 feet long. (See figure 8.) The bridge was destroyed by the derailment and ensuing fire.

Figure 8. Jack Creek Bridge in 2013. (Photographs courtesy of UP.) According to UP documentation, this bridge was last inspected on October 11, 2016. The inspection record shows that the bridge was built in 1937 and the bridge deck ties were replaced in 1970. Although no defects or abnormalities were noted during this inspection, the UP bridge inspector mentioned in the report that there was insufficient ballast on the approach to the bridge with the comment, “high end, first tie off of bridge hanging 2 1/2 [inches].”21 UP was unable to provide any documentation that this condition had been corrected prior to this derailment.

19 Continuous welded rail is rail that has been welded together into lengths exceeding 400 feet. 20 (a) Box anchored is a railroad term that means that each rail is affixed with two rail anchors at a given crosstie location and that those anchors (four per crosstie) would bear on the sides of a crosstie in order to restrict the potential longitudinal movement of the rail; (b) Rail anchor describes devices that are attached to the rail and bear against the side of the crosstie to control longitudinal movement. Certain types of rail fasteners also act as rail anchors and control rail movement by exerting a downward clamping force on the upper surface of the rail base. 21 While the bridge inspector’s report did not include a notation on whether this was on the east- or west-end approach, during his interview with NTSB investigators, he stated there was a gap on the west-end approach.

NTSB Railroad Accident Report 16 1.12.3 On-board Image Recorder The lead locomotive in this accident was equipped with a forward-facing video camera and an on-board image recording system. NTSB investigators reviewed the video and did not observe any discontinuities in the rail on the approach to the Jack Creek Bridge. (See figure 9.)

Figure 9. Still image of the track on approach to the Jack Creek Bridge. The video shows a bright light from the fire originating from behind the locomotive sufficient to illuminate large areas of the surrounding terrain 42 seconds after the lead locomotive crossed the Jack Creek Bridge. 1.13 Mechanical Inspections On March 9, 2017, at 10:22 p.m., about 2.5 hours prior to the derailment, the crew of UEGKOT-09 performed an FRA Class I brake test at Green Plains, LLC in Superior, Iowa, less than 20 miles from the accident location.22 NTSB investigators completed postaccident mechanical walking inspections and FRA Class 1 brake tests on all cars that did not derail, revealing very few defects. All of the inspected and tested cars revealed good integrity of the train’s air brake system⸻all brakes applied and released as designed. None of the conditions observed on the cars were found to be causal to the train accident.

22 According to 49 CFR 232.205, “Class I brake test-initial terminal inspection,” a Class I brake test-initial terminal inspection is required on all cars in a train at the location where it is assembled. It verifies that the brake system on the train is operating as intended.

NTSB Railroad Accident Report 17 NTSB investigators also examined the derailed tank cars, truck assemblies, and 80-wheel sets after the postaccident recovery. All wheels were found to be intact except two fractured wheels with derailment damage. Several wheels showed indications of thermal exposure consistent with the tank car fire. As discussed in section 1.5, the wheels of the nonderailed cars (1st through 20th) on the south side of the train exhibited fresh horizontal damage on the wheel tread. None of the wheels from the nonderailed cars behind the 40th car (41st through 98th and the DPU) or from the lead locomotives exhibited any horizontal wheel marks on the wheel tread. 1.14 Track and Rail Inspection This section discusses three types of inspections: track inspections, internal rail inspections, and track geometry inspections. Track inspectors typically visually inspect the track by walking or riding over the track in a hi-rail vehicle at a speed (20 mph or below) that allows the visual examination of the track structure.23 They evaluate the track structure including ballast, crossties, track assembly fittings, and the physical conditions of rails; the roadbed and areas immediately adjacent to the roadbed; and the track geometry to determine whether they meet federal and railroad requirements. With internal rail inspections, railroads use ultrasonic and induction inspection devices, either on a specialized inspection vehicle or handheld equipment, to examine rail for internal defects. In ultrasonic inspections, a transducer emits ultrasonic sound waves that penetrate the rail from various angles. Rail defects, such as cracks in the steel, and rail features will normally reflect the sound waves back to the transducers, and the reflected signals will display on a monitor.24 The equipment operator assesses these reflected signals to identify the cause of the reflections, which could be cracks, other internal rail defects, or features of the rail profile. In induction inspections, coils moving along the rail at a fixed distance above the rail head detect and measure any distortion within the magnetic field, which is then assessed by the equipment operator. These assessments are also used to identify and locate potential defects. Track geometry inspections are conducted with specialized railroad cars outfitted with measurement systems that automatically collect and evaluate the condition of the track structure. The systems collect measurements including track gage, alignment, and track surface, such as cross level, warp, and profile. 1.14.1 UP Track Inspection and Maintenance History NTSB investigators reviewed the UP track inspection records from July 1, 2016, to March 9, 2017, for MP 0.0 to MP 78.46 on the Estherville Subdivision. FRA regulations found in 49 CFR Part 213, “Track Safety Standards,” require that rail carriers prepare and sign track inspection records on the day of the inspection to document the frequency of inspections to ensure compliance with the rule. FRA track inspection records are required to reflect actual field conditions and deviations from regulations. UP elected to operate this section of track at FRA Class 3 speeds, which requires they inspect the main track at least once per calendar week.

23 A hi-rail vehicle is equipped to run on a conventional highway and railroad track. Its primarily used as a track inspection conveyance. 24 Rail features include bolt holes, welds, and joint bars.

NTSB Railroad Accident Report 18 Although the Estherville Subdivision did not meet the definition of a key route, UP had increased the frequency of track inspections on the subdivision from once a week to twice a week under a December 22, 2016, compliance agreement with the FRA (which is discussed further in section 1.14.6).25 UP met its obligation to inspect the track segments that were to be checked on a weekly basis, including the siding. However, on the segment of track which was to be inspected twice a week, UP completed one during the week of February 19-25, 2017. A review of UP track inspection records also showed that UP track inspectors had documented marginal tie conditions between Emmetsburg, Iowa, and Superior, Iowa. The inspector documented 49 locations between MP 44.5 and MP 78.4 with defective tie conditions between July 1, 2016, and November 4, 2016. On March 9, 2017, a qualified UP track inspector conducted the last inspection of the track in the area of the derailment prior to the accident. The track inspection record noted two defects between MP 48.49 to MP 78.46, an area that includes the derailment footprint. The two recorded defects were unrelated to this accident. These defective conditions were not near the accident area and were repaired before train movements resumed over that portion of track. A summary of UP’s track inspections in this area in the 2 years prior to the accident, along with those by the FRA, can be found in appendix B. 1.14.2 UP Internal Rail Inspection History UP provided the NTSB with the last two ultrasonic rail test reports for the Estherville Subdivision. The most recent test through the accident area was conducted on May 24, 2016. One defective rail condition was identified between MP 50.25 and MP 61.12, which was a defective plant weld at MP 56.54. UP installed a replacement rail on May 27, 2016. The previous ultrasonic rail test conducted through the area of the derailment prior to the accident occurred on July 14, 2015. The report showed that no defective rails were identified between MP 48.84 and MP 61.25, including the footprint of the derailment. 1.14.3 Track Geometry Inspections UP conducted a survey with a track geometry car once per year on the Estherville Subdivision. The last track geometry survey through the derailment area was conducted on August 15, 2016. No track geometry conditions or deviation from FRA minimum standards were identified between MP 54.16 and MP 57.64, including the area of the derailment. FRA had not conducted a survey using test vehicles from its Automated Track Inspection Program on the Estherville Subdivision.

25 According to AAR Circular OT-55-P, a key route is any track with a combination of 10,000 car loads or intermodal portable tank loads of hazardous materials, or a combination of 4,000 car loadings of PIH or TIH (hazard zone A, B, C, or D), anhydrous ammonia, flammable gas, Class 1.1 or 1.2 explosives, environmentally sensitive chemicals, spent nuclear fuel, and high level radioactive waste over a period of 1 year (AAR 2016).

NTSB Railroad Accident Report 19 1.14.4 Federal Oversight of Track and Rail Inspections The FRA’s Office of Railroad Safety regulates safety throughout the railroad industry. To carry out its mission, FRA staff includes about 400 federal safety inspectors who operate from eight regional offices. Railroads that are part of the general system in the state of Iowa are overseen by FRA Region 6, headquartered in Kansas City, Missouri. FRA Region 6 personnel are responsible for the oversight of Colorado, Iowa, Kansas, Missouri, Nebraska, Wyoming (southeast area), and Illinois. In addition, the states of Iowa, Missouri, and Illinois departments of transportation have inspectors that work in conjunction with FRA staff. Track inspections in Region 6 were conducted by 16 safety inspectors: 10 FRA inspectors, 2 Iowa state inspectors, 2 Missouri state inspectors, and 2 Illinois state inspectors. NTSB investigators reviewed FRA track inspection records from March 2015 through the day of the accident. The records indicate an FRA safety inspector last examined the derailment site on December 13, 2016.26 This inspection report noted no defective conditions; however, the report contained a comment stating that the track was snow covered during the inspection. The comment also documented a marginal tie condition between Superior and Emmetsburg (which included the derailment location). On August 10, 2016, the same safety inspector conducted an inspection from MP 78.4 to MP 44.0.27 The inspector documented 10 locations with crossties that did not meet the minimum FRA track safety standards (TSS).28 According to this report: Crosstie condition marginal from MP 49 Emmetsburg to MP 78 Superior. Within this area some very marginal tie conditions exist from MP 60 Graettinger to MP 70 south end of Estherville. Numerous areas with 5-10 or more ties in a row defective or nearly so. FRA class 2 speeds exist from MP 72 to 78. FRA class 3 speeds exist from MP 72 to the worst of the marginal ties extending to MP 49. This is an ethanol route with higher risk, especially on the most marginal area for ties and it [sic] being operated at FRA class 3 speeds. The inspection records also show two FRA track inspections were conducted in the area of derailment on the Estherville Subdivision in 2015. These inspections were conducted in March and July by different inspectors and documented 11 defective conditions with 9 of those being locations with defective crossties. A March 2015 FRA inspection report stated:29

26 Title 49 CFR 209.3, “Definitions,” defines an FRA safety inspector as “an FRA safety inspector, a state inspector participating in railroad safety investigations and surveillance activities under Part 212 of this chapter, or any other official duly authorized by FRA.” 27 For more information, see “FRA Inspection Report No. 67 – Dated August, 2016” in NTSB Docket DCA17MR007. 28 FRA TSS, as outlined in 49 CFR 213.9, “Classes of track: operating speed limits,” defines maximum operating speeds for several different classes of track. Class 3 track allows for a maximum operating speed of 40 mph for freight trains and 60 mph for passenger trains on Class 2 track, the maximum operating speed is 25 mph for freight trains and 30 mph for passenger trains. UP does not operate any passenger trains on the Estherville Subdivision. 29 For more information, see “FRA Inspection Report No. 28 – Dated March, 2015” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 20 Tie condition between MP 48 and 78 is in poor condition and approaching defectve [sic] condition for intend [sic] class in many areas. An FRA inspector commented in a July 2015 FRA inspection report:30 From MP 70 to MP 49 tie condition is marginal for the FRA class of track being operated in areas. Many areas where these ties are very close to the end of their life and another winter cycle will most likely put these areas in noncompliance. This is also a major ethanol hauling route. 1.14.5 FRA Inspection and Enforcement Data According to inspection and enforcement data from the FRA, of the 42,076 track miles operated by UP nationwide, about 24,390 exist in FRA Regions 5 and 6. UP operates about 12,170 miles in Region 5 and about 12,220 in Region 6. The following table shows fiscal year (FY) 2016 data across both regions for inspections and observations.31 Table 2. FRA enforcement data on Regions 5 and 6: inspections and observations. Region Inspections Observations Units Subunits Defects Violations 5 8,932 40,469 474,074 134,656 44,258 3,846 6 5,242 22,197 239,956 57,205 21,782 1,504 From these inspections, in FY 2016, Region 6 FRA assessed 42 total civil penalties. Of those, 7 were against UP for not meeting the minimum requirements of FRA TSS. While in Region 5, 17 FRA inspectors assessed 253 total civil penalties. Of those, 83 civil penalties against UP for deviation from FRA TSS. Accident data provided by the FRA specific to track-related derailments suggests a greater frequency of accidents in Region 5 compared to Region 6. Additional information comparing accident statistics on Regions 5 and 6, along with an MGT comparison across all regions in North America was provided by the FRA.32 A summary of FRA’s track inspections in this area in the 2 years prior to the accident, along with those by UP, can be found in appendix B. 1.14.6 FRA Compliance Agreement with UP FRA has many enforcement options available under 49 CFR Part 209, “Railroad Safety Enforcement Procedures,” including civil penalties, criminal penalties, compliance orders, and emergency safety orders. In response to a June 3, 2016, UP HHFT derailment in which three tank cars ignited at a bridge ramp at the approach to Interstate 84 in Mosier, Oregon, UP entered into a compliance agreement with the FRA on December 22, 2016 (FRA 2016). This compliance

30 For more information, see “FRA Inspection Report No. 55 & 76 - 2015” in NTSB Docket DCA17MR007. 31 Observations are reviews of railroad employee activities, while inspections are reviews of physical assets. 32 For more information, see “FRA Enforcement Data FY2016- Regions 5 & 6” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 21 agreement required UP to agree to remedial actions to improve compliance with 49 CFR Part 213 and other safety requirements. Some of these remedial actions include:33 ● Inventory curves with specified track components ● Increase walking or gage restraint measurement system (GRMS) inspections of track with specified physical characteristics ● Implement a program to eliminate elastic fasteners using lag screws to secure tie plates ● Implement increased track inspections Because of the compliance agreement, UP was required to conduct hi-rail or walking track inspections of the Estherville Subdivision twice weekly, conduct track geometry car inspections at least three times per year, conduct ultrasonic rail testing at least two times per year, and conduct GRMS testing at least once per year. 1.14.7 FRA Interview NTSB investigators interviewed the regional administrator (RA) for FRA Region 6.34 The RA had been employed by the FRA for about 32 years and had been in the current position for about 5 years. The interview focused primarily on the following: ● Planning of inspection activities; use of the Regional Inspection Plan (RIP) and the National Inspection Plan (NIP) ● Regional guidance given to track inspectors; use of enforcement tools ● Portable track loading fixtures to supplement visual inspections ● 2016 compliance agreement between FRA and UP The RA explained that both the RIP and the NIP are tools used to manage resources while conducting compliance inspections on the nation’s railroads. He also told NTSB investigators that the inspection plans factor in hazards when allocating resources. When asked if inspectors are allowed to use enforcement options, such as recommending the assessment of civil penalties, the RA stated, “our guidance gives the inspectors the flexibility, based on their judgment and the criteria that we have built into the general manual, to make decisions.”

33 To see a complete copy of the compliance agreement, see “FRA-UP Safety Compliance Agreement- Dated 12/22/2016” in NTSB Docket DCA17MR007. 34 For more information, see “Interview of FRA Regional Administrator – Region 6” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 22 The NTSB investigators asked the RA how the 2016 compliance agreement between the FRA and UP affected the inspection activity on the Estherville Subdivision. The RA answered, “It has absolutely no bearing on the Estherville Subdivision.” He said that it was his understanding that the compliance agreement applied to main track territory, not branch line territory. When asked for clarification regarding the difference between branch track and main track, he said that “a branch line is usually kind of a stub-end track with much lower densities.”35 NTSB investigators informed the RA that the Estherville Subdivision is FRA Class 3 track, where trains operate at speeds up to 30 mph and asked if class of track is considered when designating a track as branch or main track.36 The RA responded, “not to my knowledge.” 1.15 Postaccident Track Inspections NTSB investigators conducted a postaccident hi-rail inspection on both sides of the derailment area from MP 49.09 to MP 69.34 to assess the overall condition of the track and to identify any additional rails that may have broken under the accident train prior to the POD; no broken rails were found. NTSB investigators inspected track from MP 54.53 to MP 49.09 (east of the derailment) and track from MP 58.0 to MP 69.34 (west of the derailment). Track from MP 54.53 to MP 58.0 was not inspected because equipment from the derailment was occupying the track. The overall track conditions were as follows: 90-pound CWR rail; the rail anchoring was consistent, with no indications of longitudinal movement observed; although NTSB investigators noted some geometry conditions, they did not find any geometry defects, as prescribed by UP and FRA standards; no gage issues were identified; and the crosstie condition was marginal, with several locations that were found to be noncompliant with FRA regulations. On March 11, 2017, NTSB investigators conducted a walking inspection from MP 57.10 to MP 56.35 with FRA inspectors.37 This inspection was conducted up to the disturbed track and the derailed rail cars on both sides of the accident bridge. FRA inspectors completed an inspection report documenting seven defects which included: four crosstie distribution defects, one insufficient number of crossties in a rail segment, one rail fastener defect, and one concentrated load between the base of rail and tie plate. Based on the track alinement and track class, FRA minimum TSS allow no more than eight nondefective crossties per 39 feet of rail; the nondefective crossties must also be effectively distributed throughout the 39-foot rail segment.38 During this walking inspection, from MP 57.10 to MP 56.35, NTSB investigators noted that tie conditions were marginal in this track segment.

35 FRA regulations do not define “branch track.” Title 49 CFR 218.5, “Definitions,” states: “Main track means a track, other than an auxiliary track, extending through yards or between stations, upon which trains are operated by timetable or train order or both, or the use of which is governed by a signal system.” Thus, the compliance agreement did apply to the Estherville Subdivision. 36 Railroads can choose to operate at any speed, taking into account many factors, such as operational needs, track geometry, or territory grade. FRA classes of track set forth the maximum authorized speed per class. These speeds vary for freight and passenger trains because different railroad equipment has different capabilities. UP opted to operate at a maximum speed of 30 mph on the Estherville Subdivision, which falls into the speed range for FRA Class 3 track. 37 For more information, see “FRA Inspection Report No. 30- Dated March 11, 2017” in NTSB Docket DCA17MR007. 38 FRA TSS can be found at 49 CFR 213.109, “Crossties.”

NTSB Railroad Accident Report 23 Two crosstie distribution defects and an insufficient number of crossties in a rail segment defect were identified less than 1,000 feet from the POD. The crossties observed were found to be defective, split, broken, or unable to hold fasteners. NTSB investigators further noted during this postaccident walking inspection that the crosstie conditions improved as they approached Jack Creek Bridge from the west. Periodic gage measurements were taken on both tangent track and the curve east of the derailment with no gage defects found. There were no rail joints in this track segment and there were no rail anchoring defects; no longitudinal rail movement was noted. In the area of the derailment, the track structure was misaligned as a result of derailment forces. NTSB investigators took gage measurements, observed track alignment, and measured track surface leading into the disturbed track. No exceptions were taken to the track geometry in the track segment from MP 57.10 into the derailment area. NTSB investigators noted profile conditions ranging from 3/4 inch to 1-1/4 inches in the areas with defective crossties. (See figure 10.)

Figure 10. Split and broken crossties, that are not holding fasteners, immediately west of MP 56.9. The tie plates in the foreground have cut into the broken crossties.

NTSB Railroad Accident Report 24 1.15.1 Point of Derailment and Rail Reconstruction While on scene, NTSB investigators established the POD to be near MP 56.8 on the ballasted portion of track on the west approach of the bridge spanning Jack Creek, based upon the amount of damage to the rail infrastructure and the resting location of the tank cars. NTSB investigators recovered, identified, and reconstructed the rails from the west approach and across the bridge spanning Jack Creek.39 The total displaced track measured about 400 feet. About 15 feet of the south rail and 10 feet of the north rail were not recovered. The rails were identified by manufacturer, manufacture dates, and rail fracture characteristics and were pieced together to identify the first area of discontinuity. In the area of the derailment, the 90-pound rails were manufactured by Inland Steel Company and Illinois Steel Company. The majority of the rail was manufactured between 1925 and 1930; one rail section was manufactured in 1937; and another section was manufactured in 1957. An inventory of all the recovered rail was made. The north and south rail pieces were labeled in sequential order, starting from the west and progressing east through the accident area. As addressed in section 1.5, several wheels on the south side of the train exhibited fresh horizontal impact damage on the wheel tread that traveled over the south rail. As with the wheel impact damage on the wheel tread, when a rail vehicle’s wheel encounters a rail discontinuity, the rail ends can become disfigured from the hammering effect of the wheel rolling over it. This disfiguration that occurs on the rail is referred to in the railroad industry as rail end batter. Consistent with the wheel’s direction of travel, this rail end batter can be classified as either departing batter or receiving batter, meaning that the disfiguration will have unique characteristics when examined closely that are consistent with the direction of travel. Although rail end batter can serve as an indication of an existing discontinuity often associated with a preexisting broken rail, NTSB investigators were unable to recover any pieces of rail that displayed definitive rail end batter indicative of preexisting broken rail. 1.16 Hazardous Materials Information 1.16.1 Denatured and Undenatured Ethanol The March 10, 2017, accident in Graettinger, Iowa, is the first derailment with breached tank cars and postaccident fire involving an HHFT transporting undenatured ethanol. The Graettinger fire chief was the first emergency responder to arrive on scene.40 The fire chief told NTSB investigators that in sizing up the incident scene from a distance with binoculars, he observed “the fire seemed big, but could have been bigger.” He said the released material was steadily burning, but there were no explosions. The fire chief said that he concluded the ethanol was not an explosive commodity, based on his past training in ethanol emergency response. The

39 For more information, see “Materials Laboratory Factual Report” in NTSB Docket DCA17MR007. 40 The fire chief was Fire Fighter 2 certified. He had additional training on the National Incident Management System (NIMS), a Fire Science Certificate from Iowa Lakes Community College, and completed UP-sponsored ethanol response safety courses, Railroad Safety for Ethanol and Soy Diesel Shipments and Railroad Emergencies General Guide to Tank Cars.

NTSB Railroad Accident Report 25 fire chief also said that given the 0.5-mile distance to nearest residences, the emergency response efforts could, therefore, be focused on separating undamaged tank cars from those that were burning.41 In 2014, the FRA compared data relating to thermal failures of tank cars involved in train derailments between 2006 and 2013 and concluded that denatured ethanol tank cars pose a greater risk of high-energy explosive events than tank cars carrying volatile crude oil grades when exposed to pool fires (Alexy 2014). Comparing empirical data for postaccident pool fire damage, such as thermal tears and tank fragmentation, the FRA found that the rate of tank car thermal failure in a pool fire was 15.5 percent for tank cars carrying denatured ethanol and 9.5 percent for crude oil. In addition, the staff director for the FRA’s Hazardous Materials division stated the following at an April 2014 NTSB Rail Safety Forum: When you look at the damage to the tank cars, and in this case, particularly tank cars that have had thermal ruptures, thermal tears, there have—and then, I’m going to distinguish between just the thermal tear where you – you know, it opens up partially, and an incident where there’s enough energy to fragment the car. When we look at those, and of all the – I think there have been approximately 31 tank cars that have experienced some type of thermal damage, and there have been, I think, 7 or 8 that have had – that were violent ruptures or the ones where the tank car fragmented, all but one has been in ethanol service (NTSB 2014). This investigation sought to understand the differences associated with the transportation of denatured and undenatured ethanol. Ethanol for use in motor fuel will generally be denatured with 2-5 percent gasoline or similar hydrocarbon. According to the Renewable Fuels Association (RFA), the addition of denaturant to ethanol depresses its flash point, providing significantly more volatile vapor for the product to ignite following the release (RFA 2017). In comparison, the National Institutes of Health, US National Library of Medicine, reports the flash point of undenatured ethanol to be 55°F, and denatured fuel ethanol typically has a flash point range between -5 and 19.4°F (NIH 2013).42 The Environmental Protection Agency (EPA) Renewable Fuel Standard (RFS) program was created under the Energy Policy Act of 2005 amendments to the Clean Air Act.43 It is a national policy that requires a certain volume of renewable fuel, such as ethanol, to replace or

41 For more information, see “Emergency Response Factual Report” in NTSB Docket DCA17MR007. 42 (a) The flash point of denatured fuel ethanol varies based upon the characteristics of the denaturing agent. (b) Noble Americas Safety Data Sheet, https://mansfield.energy/assets/uploads/NASBE_MSDS_Ethanol_2015-05- 19.pdf. Accessed September 12, 2018; Valero Safety Data Sheet, https://www.valero.com/en- us/Documents/OSHA_GHS_SDS/SDS%20US%20-%20035-GHS%20Denatured%20Fuel%20Ethanol%205-14.pdf. Accessed September 12, 2018; Global Safety Data Sheet, http://www.globalp.com/documents/files/SDS%20Denatured%20Fuel%20Grade%20Ethanol%20Final.pdf. Accessed September 12, 2018. 43 (a) Energy Policy Act of 2005, Pub. L. No. 109-58, 119 Stat. 594 (2005); (b) EPA implements the RFS program in consultation with the US Department of Agriculture and the US Department of Energy.

NTSB Railroad Accident Report 26 reduce the quantity of petroleum-based transportation fuel. The RFS was amended by the Energy Independence and Security Act of 2007 (EISA).44 Section 202 of the EISA includes annual target volumes (goals) and requires the EPA to establish compliance obligations that refiners and importers must meet each year. The statutory target volume for total biofuel use increases from 24 billion gallons annually in 2017 to 36 billion gallons annually by 2022. However, in its December 14, 2015, final rule, the EPA responded to marketplace constraints by establishing reduced, finalized, renewable fuel volumes for the years 2014 through 2016 (Federal Register, 2015, 77420). Nevertheless, the EPA final rule states that nearly all the estimated 139 billion gallons of gasoline used as domestic transportation fuel contains 10 percent ethanol. Railroads account for about 70 percent of ethanol transportation (AAR 2018a). The director of regulatory affairs for the RFA told NTSB investigators that the ethanol industry has experienced significant recent growth in the shipment of undenatured fuel ethanol, as shown in figure 11. She explained that the growth in undenatured ethanol shipments is mostly due to foreign markets in Brazil and southeast Asia in which end users request the product without denaturant added. Unlike domestic ethanol producers, foreign ethanol producers typically do not denature their ethanol product (Federal Register, 2016, 80828).

44 Energy Independence and Security Act of 2007, Pub. L. No. 110-140, 121 Stat. 1492 (2007).

NTSB Railroad Accident Report 27

Figure 11. US 2017 export figures for denatured and undenatured ethanol. (Graphic courtesy of the RFA.) The RFA director of regulatory affairs explained that any decision to ship ethanol as undenatured is not constrained by logistics, but rather by regulatory disincentives given the Alcohol and Tobacco Tax and Trade Bureau (TTB) beverage tax requirements. Federal law requires that ethanol produced at an alcohol fuel plant (AFP) be restricted for use exclusively as a motor fuel.45 Before proprietors may withdraw distilled spirits from an AFP, the spirits must be rendered unfit for beverage use, otherwise the TTB requires payment of distilled spirits taxes if the ethanol is diverted to beverage use. The TTB defines fuel alcohol as having been made unfit for beverage use by adding materials to distilled spirits that will preclude beverage use without impairing their quality for fuel use.46 Formulas for completely denaturing alcohol to make it undrinkable and thus not subject to the beverage alcohol tax are provided in 27 CFR Part 21, “Formulas for Denatured Alcohol and Rum.” Under current RFS provisions, ethanol does not become a renewable fuel until a producer adds denaturant in accordance with TTB regulations at 27 CFR Parts 19-21. Only after a

45 Title 26 United States Code (USC) Part 5181, “Distilled spirits for fuel use.” 46 Rules for distilled spirits for fuel use are contained in 27 CFR Part 19, “Distilled Spirits Plants.”

NTSB Railroad Accident Report 28 renewable fuel producer has denatured the ethanol can they generate renewable identification numbers (RIN) for it.47 1.16.2 Shipping Paper Discrepancy Placards displayed on each rail car listed United Nations (UN) Identification Number 1170, signifying undenatured ethanol. The shipping description used on the hazardous materials shipping papers that were in the train crew’s possession was “UN1987, Alcohols, N.O.S., Class 3, PG II.” This describes denatured fuel ethanol and is not the proper shipping description for undenatured ethanol. Emergency response information (required by 49 CFR 172.602, “Emergency response information”) appended to the train consist described the hazards of UN1987 denatured fuel ethanol, not UN1170 absolute or undenatured ethanol. The shipper confirmed that the lading on the accident train was undenatured ethanol UN1170. The Green Plains plant manager told investigators that the shipping documents were prepared at the company’s headquarters in Omaha, Nebraska, and he could not explain the shipping name discrepancy in the train consist. Protocols first responders follow differ based on the nature of the hazards. For example, flames of burning undenatured ethanol may be invisible in daylight and, therefore, may pose additional challenges to the first responders. Misidentified hazardous materials could cause inappropriate or delayed responses. NTSB investigators learned that when Green Plains Superior received an order for an ethanol shipment, the Green Plains corporate headquarters provided loading tracking numbers and the customer’s chemical specification requirements. As the cars are loaded, an ETX Intellifuels system controlled the dispensing volumes, and reporting gross and net gallons with temperature correction. The system produced a metered ticket that displayed the shipping name in the old DOT shipping name format and identified the material by default as UN1987 denatured fuel ethanol. The UN1987 shipping name was the only product description that was programmed into the ETX Intellifuels system 9 years ago and could not be changed by the operator. The meter tickets, which contained the wrong hazardous materials description and tank car inspection sheets which indicated the correct UN identification number for undenatured ethanol, were forwarded to the Green Plains headquarters office in Omaha, Nebraska. Once this information was received, the Green Plains logistics coordinator was then responsible for arranging shipments and preparing electronic data interchange documents for the railroad. Following the accident, to eliminate confusion and prevent hazardous materials misdescription in future shipments, Green Plains disabled the ETX Intellifuels system function that printed the preprogrammed hazardous materials shipping name and description on its tank car loading tickets. The Green Plains headquarters uses the same coding for electronic data

47 RINs are credits used for tracking compliance and are the “currency” of the RFS program. RINs are generated when a fuel is produced and may be bought, sold, and traded amongst obligated parties (refiners and importers of gasoline) and domestic and foreign market participants.

NTSB Railroad Accident Report 29 interchange documents and is used when their product order is sent to the Green Plains ethanol plant.48 1.16.3 Tank Car Regulations and Industry Standards The HMR in 49 CFR Part 179, “Specifications for Tank Cars,” outlines the federal requirements for tank cars. Subpart B of Part 179 contains general design requirements, while Subpart D contains the specifications for nonpressure tank car tanks. Additional tank car industry standards, incorporated in the HMR by reference, are found in the Association of American Railroads (AAR) Manual of Standards and Recommended Practices. Appendix C contains a chart describing the specifications for flammable liquids tank cars. At the time the DOT-111 tank cars in the accident train were constructed, tank cars transporting ethanol could be fabricated of plate materials meeting the specifications that are outlined in 49 CFR 179.200-7, “Materials.” The tank cars involved in this accident were constructed from carbon steel plates. DOT-111 tank cars must be fabricated from either TC 128 Grade B steel or A5l6-70 steel.49 The specification requirement for DOT-111 requires a minimum plate thickness of 7/16-inch.50 At the time these tank cars were constructed, federal regulations did not require thermal protection, tank-head puncture resistance systems such as jackets or head shields, or the use of tougher normalized steel.51 Pipeline and Hazardous Materials Safety Administration (PHMSA) regulation 49 CFR 179 (D) “Specifications for Non-Pressure Tank Car Tanks” requires that after October 1, 2015, new tank cars manufactured for use in a HHFT must be constructed to the specification DOT-117, or 117P performance standard as specified in that regulation. The regulation further required that DOT-111 tank cars used in ethanol service after May 1, 2023, and Casualty Prevention Circular Specification-1232 (CPC-1232) tank cars used in ethanol service after July 1, 2023, must be replaced with new specification DOT-117 tank cars, or existing tank cars that have been retrofitted to DOT-117R performance standards. The regulation mandates the use of DOT-117-compliant tank cars for the transportation of all Class 3 flammable liquids regardless of train composition and regardless of whether flammable liquids tank cars are assembled in a HHFT. Retrofitted tank cars must be equipped with full height head shields, minimum 11-gauge jackets, thermal protection systems, top fittings protection, and an enhanced bottom outlet valve handle design to prevent unintentional opening in accidents.

48 Electronic data interchange is the computer-to-computer exchange of business documents in a standard electronic format between business partners. 49 See 49 CFR 179.200-7, “Materials.” 50 See 49 CFR 179.201-1, “Individual specification requirements applicable to nonpressure tank car tanks.” 51 (a) See 49 CFR 179.201-1, “Individual specification requirements applicable to nonpressure tank car tanks,” and 49 CFR 173.31 (b)(3) and (4) “Use of Tank Cars;” (b) In accordance with 49 CFR 173.31(b)(4), “Use of Tank Cars,” the tank cars that were involved in this accident were not required to have thermal protection systems. Only tank cars that are used to transport Hazard Class 2 and poison inhalation hazard materials are required by the Hazardous Materials Regulations to have thermal protection that conforms to the specifications of 49 CFR 179.18, “Thermal protection systems.”

NTSB Railroad Accident Report 30 Among the requirements for newly constructed DOT-117 tank cars are:52 ● 9/16-inch normalized TC-128 steel minimum for heads and shells ● Full height 1/2-inch thick head shield ● Thermal protection system ● Minimum 11-gauge jacket ● Top fittings protective housing, minimum 1/2-inch thick ● Enhanced bottom outlet handle design to prevent unintended actuation during a train accident ● 286,000 pounds gross rail load (GRL) authorized 1.16.4 Flammable Liquids Tank Car Fleet The Green Plains transportation and logistics vice president told NTSB investigators that the company selects tank cars according to market prices, which vary according to numbers leased and the lease duration. The lease agreements are full-service contracts in which the rail car retains the lessor’s reporting mark and the lessor is responsible for most of the maintenance and administrative record keeping. Tank cars are assigned by availability, usability, and potential weight restriction for servicing the railroad at each of the Green Plains plants. He stated that tank cars constructed to 286,000 GRL, such as DOT-117 tank cars, may not be capable of full-capacity loading because of track infrastructure limitations on rail lines leading into some ethanol plants.53 The Green Plains transportation and logistics vice president told investigators that company management is fully aware of the applicable rules and the 2023 phase-out deadline for DOT-111 tank cars, and, thus, the logistics team is tasked with ensuring compliance on behalf of the company. He stated that to ensure the fleet remains compliant, Green Plains has been negotiating replacement plans and the movement of tank cars into and out of the fleet during repair periods arranged by the lessors. He further stated that Green Plains intends to adhere to the law. NTSB investigators examined the UMLER database records for each of the seven rail car fleet owners that leased the tank cars used in the accident train to Green Plains. Table 3 provides the changes in the number of legacy DOT-111, CPC-1232, and DOT-117 tank cars in the respective overall fleets between January 2016 and April 2017.

52 See 49 CFR 179.202, “Individual specification requirements applicable to DOT-117 tank car tanks.” 53 Legacy DOT-111 tank cars not constructed to CPC-1232 standards are limited to 263,000 pounds GRL.

NTSB Railroad Accident Report 31 Table 3. UMLER tank car statistics by owner, January 2016 vs. April 2017. Car Ownera

Year

DOT-111

CPC-1232

DOT-117

DOT-117R 1 2016 3,397 200 0 0 2017 2,975 200 0 0 Change

-422

2 2016 10,022 12,325 930 4 2017 9,352 11,710 2,549 270 Change -670 -615 +1,619 +266 3 2016 3,527 1,354 200 0 2017 4,740 1,476 451 153 Change +1,213 +122 +251 +153 4 2016 4,761 4,916 100 0 2017 5,868 4,926 100 8 Change +1,107 +10

+8 5 2016 698 0 0 0 2017 673 0 0 0 Change -25

6 2016 16,174 9,154 100 114 2017 16,096 8,958 3,390 612 Change -78 -196 +3,290 +498 7 2016 518 105 0 0 2017 547 120 0 0 Change +29 +15

a. For the purposes of this report, the tank car fleet owners were not identified by name. AAR ethanol tank car fleet utilization data indicated that about one-third of the tank cars shipping ethanol today are now DOT-117 compliant. (See figure 12.) First quarter 2018 AAR data for tank cars in ethanol service indicated there remains about 18,700 jacketed and nonjacketed DOT-111, 2,020 nonjacketed CPC-1232, and 1,000 jacketed CPC-1232 tank cars that must be replaced or retrofitted to DOT-117 specifications. AAR reported that about 350 tank cars a month would need to be replaced or retrofitted to achieve the 2023 deadlines for replacing legacy DOT-111 and CPC-1232 tank cars, and the 2025 deadline for replacing jacketed CPC-1232 tank cars (AAR 2018b). NTSB Railroad Accident Report 32

Figure 12. Ethanol shipments by tank car type, 2013 – Q1 2018. (Chart courtesy of AAR.) 1.17 Tests and Research 1.17.1 Examination of Recovered Rail As discussed in section 1.15.1, NTSB investigators recovered about 390 feet of north rail and 385 feet of the south rail while on scene. This left about 10 feet of the north rail and 15 feet of the south rail unrecovered. The recovered rail pieces were arranged on scene in their respective positions at the time of the derailment by matching up the fracture faces of the broken sections and cross-referencing features from UP track records on the Estherville Subdivision. The records described the locations of welds that joined two pieces of rail together and contained information on rail type, length, and milepost. Many of the recovered rail pieces on scene exhibited prominent features, which included rail batter, wheel flange elevation (riding up), flakes, split webs, fire deposits, and recovery breaks.54 These features were consistent with damage typical of a loaded freight train derailment. Several rail pieces were sent to the NTSB Materials Laboratory for further examination. The tests included nondestructive visual examination, scanning electron microscopy, optical metallography, hardness testing, and material chemical composition testing.55 The results of the examination are discussed in section 2.3.

54 For more information, see “Materials Laboratory Factual Report 17-050” in NTSB Docket DCA17MR007. 55 For more information, see “Materials Laboratory Factual Report 17-050” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 33 1.17.2 Evaluation of Net Braking Ratio In response to an NTSB request, investigators traveled to the Trinity rail tank car maintenance facility in Saginaw, Texas, to witness in-service tank car net braking ratio tests on three exemplar undamaged tank cars from the accident train. The brake systems performed within their design parameters.56 1.17.3 Finite Element Study Finite element (FE) modeling was used to examine the effects of rail profile and track support conditions on the deformation and stresses in 90-pound rail under tank car wheel loads.57 Two three-dimensional FE models of the 90-pound rail track were constructed. One model, based on drawings provided from UP, had a standard (unworn) rail profile and assumed stiff track support conditions. The other model had a worn rail profile based on measurements collected on rail profiles from the accident and assumed less stiff track support conditions.58 Internal rail stresses and rail deformations from the two models were compared. (See figure 13.)

Figure 13. Comparison of the calculated internal transverse stresses of 90-pound rail supporting wheel loads using a worn rail profile with soft track support (left) and standard rail profile with stiff track support (right). In both illustrations, the gage side is on the left and the field side is on the right. The model showed that the transverse stress in the rail head region was dependent on the head area of the rail cross-section and the track support conditions. A worn rail has less head area, which results in higher transverse stress in the head region. Comparing the two rail profiles

56 For more information, see “Mechanical – In-Service Tank Car Net Braking Ratio Testing” in NTSB Docket DCA17MR007. 57 For more information, see “Finite Element Modeling Study Report” in NTSB Docket DCA17MR007. 58 The model was derived from rail profile measurements using a MiniProf rail profile measurement system.

NTSB Railroad Accident Report 34 and track support conditions modeled in the study, the peak transverse stress was about 50 percent higher for the case with the worn rail profile and less stiff support. The area with relatively high transverse stress [greater than 5 thousand-pounds-per-square-inch (ksi)] was considerably bigger. The transverse stress in the head region is known to be related to a vertical split head failure since it has the potential to open up cracks in the vertical direction. 1.18 Postaccident Actions FRA inspectors returned to the Estherville Subdivision in May 2017 and conducted walking and hi-rail inspections between MP 78.4 and MP 0.0; with the only exclusion being between MP 59.0 and MP 48.59. NTSB investigators requested records related to these inspections. As a result of these inspections, 78 defective track conditions were noted, of those, 51 were locations with defective crossties and 5 were locations with rail fasteners not maintaining track gage. The reports included no recommendations for civil penalties. On November 13, 2017, UP officials informed NTSB investigators of the following postaccident actions on Estherville Subdivision and other nearby subdivisions since the accident:59 ● Year-to-date [2017] regional work crews have installed about 8,600 crossties since the derailment in March 2017 ● UP’s 2018 capital program included the Grain Line crosstie program60 ● UP’s 2018 capital program included fortifying all bridge approaches on the aforementioned subdivisions with 10-foot approach crossties ● UP has reduced the maximum allowable speed on all Class 2 subdivisions on these Grain Lines from 30 mph to 25 mph ● UP has reduced maximum allowable speed on the portion of the subdivision that was 49 mph to 40 mph ● UP has increased the frequency of rail detector car tests on the Grain Lines from once per year to twice per year ● UP completed all of the requirements of the FRA compliance agreement by the end of 2017 o Track inspections increased in accordance with the FRA compliance agreement, including additional track inspectors, GRMS testing, geometry car inspections, and rail detector car inspections

59 For more information, see “UP Post-Accident Action Letter” in NTSB Docket DCA17MR007. 60 The Grain Line is the name of UP’s work effort.

NTSB Railroad Accident Report 35 o Specifically, UP increased track inspections on Class 3 track by one additional test per year. Main line and siding inspections increased from twice annually to three times per year UP officials provided NTSB investigators with an update on its postaccident actions on August 14, 2018:61 ● UP anticipates over 600,000 crossties will be installed on the Grain Line by the end of 2018 and that the Grain Line crosstie program will be completed in 2019 ● UP’s 2018 capital program was approved for bridge approach crossties ● Year-to-date [2018], UP is in compliance with the testing and inspection requirements of the FRA compliance agreement On November 16, 2017, FRA officials informed NTSB investigators of the following postaccident actions on the Estherville Subdivision since the accident: ● FRA conducted a comprehensive inspection of the track structure on UP’s Estherville Subdivision, where the accident occurred. UP has corrected the conditions noted during that inspection o UP has put on a divisional work crew to correct the defects identified by FRA inspectors and added an additional 150 ties-per-mile under the 90-pound rail ● FRA continues to monitor UP’s efforts to address the issues raised in the December 2016 compliance agreement related to deficiencies in UP’s track inspection and maintenance programs ● UP completed all the requirements of the FRA compliance agreement that were due by the end of 2017 on time o UP has increased track inspections per the compliance agreement. Inspections include track inspectors, GRMS testing, geometry car inspections, and rail detector car inspections FRA has scheduled its automated track inspection program car to inspect Estherville and surrounding subdivisions in October 2018.

61 E-mail from a UP official to NTSB in response to written questions, August 14, 2018.

NTSB Railroad Accident Report 36 FRA officials provided NTSB investigators with an update on the status of the compliance agreement on August 21, 2018:62 ● UP has been complying with all items in the compliance agreement ● UP is ahead of schedule in meeting the deliverables for the compliance agreement. Although the final deadline for these deliverables is the end of 2019, UP has the potential to exceed the required deliverables by the end of 2018 ● UP continues to increase track inspections, GRMS testing, geometry car inspection, and rail detector car inspections

62 E-mail from FRA official to NTSB in response to written questions, August 21, 2018.

NTSB Railroad Accident Report 37 2 Analysis 2.1 Introduction The NTSB considered the following factors in the investigation of this accident: (1) the condition of the track and structure on the Estherville Subdivision, (2) the adequacy of UP’s track maintenance and inspection program, (3) rail metallurgy, (4) the performance of 90-pound worn rail, (5) DOT-111 tank cars in ethanol service, (6) the transportation of fuel ethanol without denaturant, (7) ethanol product shipping paper discrepancy, (8) the mechanical condition of the train, (9) the performance of the train crew, (10) cell phone use by the train crew, (11) alcohol or other drugs by the train crew, and (12) the emergency response. 2.2 Estherville Subdivision 2.2.1 UP’s Track Inspection Program NTSB investigators determined that although UP track inspectors were identifying some defective crosstie conditions, not all defective conditions were reported or remediated. As an example, two defective conditions were identified and remediated by UP the day before the accident. However, both NTSB investigators and FRA inspectors identified more defects postaccident that had not been recorded during that UP inspection. The adequacy of the UP’s maintenance and inspection program has been addressed in previous NTSB investigations. On December 20, 1998, Amtrak (National Railroad Passenger Corporation) train 21 derailed while operating on UP track in Arlington, Texas. In that investigation, the NTSB determined that one element of the probable cause was “inadequate Union Pacific Railroad oversight of track maintenance work on this section of track.” As a result of this investigation, NTSB made the following recommendation to UP: Revise your track maintenance policies and practices to establish quality control procedures for track repair and maintenance activities. These procedures should be designed to ensure that the type of maintenance to be performed is appropriate to address the specific problem and that the maintenance itself is performed correctly. (R-01-16) In response to this recommendation, UP developed its Engineering Track Maintenance Field Manual and provided training to its employees. UP also developed an evaluation process for its managers to determine if these standards are being met. Therefore, on May 28, 2003, the NTSB classified Safety Recommendation R-01-16 as Closed⸻Acceptable Action (NTSB 2001). On May 27, 2000, 33 cars of a UP freight train carrying hazardous materials derailed in Eunice, Louisiana. The derailment resulted in a release of hazardous materials with explosions and fire. About 3,500 people were evacuated from the surrounding area, which included some of the business area of Eunice. No one was injured during the derailment of the train or the subsequent release of hazardous materials. The NTSB determined the probable cause was “the

NTSB Railroad Accident Report 38 failure of a set of joint bars that had remained in service with undetected and uncorrected defects because of Union Pacific Railroad’s ineffective track inspection and inadequate management oversight.” As a result of this investigation, the NTSB recommended that UP: Change your track inspection programs to ensure that managers are making use of all available information about track conditions, including railroad and Federal Railroad Administration track inspection reports, to identify trends or problem areas and to monitor the effectiveness of daily track inspections. (R-02-14) In response to this recommendation, UP established a team of field managers to lead its quality assurance effort and developed and implemented an electronic track inspection reporting system. Therefore, on August 9, 2002, the NTSB classified Safety Recommendation R-02-14 as Closed⸻Acceptable Action (NTSB 2002). The NTSB investigation noted the marginal crosstie conditions on the Estherville Subdivision, based on reviewed UP track inspection records, FRA track inspection records, and postaccident walking inspections. FRA regulations contain minimum safety standards that address defective crossties.63 UP also has minimum safety standards that address crossties; however, the NTSB determined based on evidence that the track structure in the accident area was not consistently maintained to those standards (UP 2017). Table 4 shows the parameters for a crosstie to be considered defective. Table 4. Comparison of UP vs. FRA defective tie standards. UP Defective Crosstie Condition Standards FRA Defective Crosstie Condition Standards Broken through or hollow. Broken through. Split or otherwise impaired to the extent that ballast works through. Split or otherwise impaired to the extent the crosstie will allow the ballast to work through or will not hold spikes or rail fasteners. Unable to hold spikes or other rail fasteners. Will not hold spikes or rail fasteners. Deteriorated to the extent that the tie plate or base of the rail can move laterally 1/2 inch or more in relation to the tie. So deteriorated that the crosstie plate or base of rail can move laterally 1/2 inch relative to the crosstie. Cut by wheel flanges or dragging equipment, or damaged by fire or other sources to a depth of more than 2 inches within an area closer than 12 inches to the base of the rail, frog, or other load bearing component. Cut by the crosstie plate through more than 40 percent of a crosstie’s thickness. FRA provided the following guidance regarding crossties and inspection of crossties in its Track and Infrastructure Integrity Compliance Manual (Volume 2), dated January 2017: Crossties are evaluated individually by the definitional and functional criteria set forth in the regulations. Crosstie “effectiveness” is naturally subjective and requires good judgment in the application and interpretation of this standard. The soundness and durability of a crosstie is demonstrated when a 39-foot track segment maintains safe track geometry and structurally supports the imposed wheel loads with minimal deviation. Key to the track segment lateral, longitudinal, and vertical support is a strong track modulus, which is a measure of

63 FRA minimum standards are set forth in 49 CFR 213.109(c), “Crossties.”

NTSB Railroad Accident Report 39 the vertical stiffness of the rail foundation. Continuous superior superstructure (including rails, crossties, fasteners, etc.) and high-quality ballast characteristics that transmit both dynamic and thermal loads to the subgrade are also important. Proper drainage that is free from the presence of excess moisture is an apparent and crucial factor in providing added structural support (FRA 2017). Crossties do not deteriorate in a matter of days—to the extent they are split, broken, and unable to hold rail fasteners—but do so over time. The useful service life of crossties varies greatly depending on track geometry characteristics, rail vehicle interaction, equipment axle loads exerted on the track, and environmental conditions. For this reason, the proper inspection of crossties requires visual inspection and performance-based measuring with accurate records to identify changes. Though the NTSB was not able to determine if the condition of the crossties at the POD contributed to the derailment, it is imperative that tracks are maintained in compliance with all minimum safety standards. The NTSB concludes that UP was not maintaining the track structure on the UP Estherville Subdivision in accordance with FRA minimum TSS or its own internal track maintenance standards. An organization’s oversight, in principle, provides assurance that front-line personnel ensure any system meets minimum safety requirements. In this case, the UP track supervisors were required to ensure their inspectors were identifying and remediating defects in accordance to UP internal track maintenance standards and FRA minimum TSS. As mentioned above, two defective crosstie conditions were identified and remediated by UP the day before the accident and NTSB investigators and FRA inspectors identified more defects that would have existed at the time of the prior UP inspection and were not recorded as part of that inspection. Therefore, the NTSB concludes that UP supervisors and managers were not ensuring defective crosstie conditions were being identified, reported, and remediated in accordance with UP track maintenance standards and FRA TSS. Therefore, the NTSB recommends that UP reexamine its track maintenance and inspection program standards to ensure those track inspection standards are complied with by both track inspectors and track supervisors. 2.2.2 Transition Regions Bridge approaches are where there are changes in the vertical stiffness of the track structure, sometimes referred to as track transition regions. The American Railway Engineering and Maintenance-of-Way Association (AREMA) Manual for Railway Engineering contains information regarding track transition problems, as well as track transition remedies and practices. The AREMA manual states: Track Transition Problem-stiffness transition regions are locations where railway track exhibits abrupt changes in vertical stiffness. They usually occur at abutments of open deck bridges, where concrete tie track changes to wooden tie track, at the ends of tunnels, at highway grade crossings, or at locations where rigid culverts are placed close to the bottom of ties. Abrupt changes in track stiffness result in increased dynamic wheel loading, accelerated track degradation etc., and poor ride quality. These locations have been seen to deteriorate significantly faster than regular track and require frequent maintenance.

NTSB Railroad Accident Report 40 Track Transition Remedies and Practices-in practice, several methods have been developed to alleviate the problems associated with abrupt changes in vertical track stiffness. These methods all attempt to match vertical track stiffness whenever possible. Abrupt changes in vertical track stiffness have historically presented maintenance problems to railroads and empirical methods have been used to try to correct the problem. These include gradually stiffening the approaches entering or leaving a high stiffness zone and reducing the stiffness on the hard side (e.g. grade crossing) of the track (AREMA 2016). Section 1.8 of the UP Engineering Track Maintenance Field Handbook discusses track transitions, and states: One of the highest maintenance issues for mainline track is maintaining track transitions. Typical problems are: bridge abutments; road crossing; turnouts; and tunnels. Where ballasted track changes to a structure there can be: accelerated track geometry and component degradation; increased maintenance; and chronic maintenance. Track transition maintenance issues can be attributed to the: abrupt change in vertical stiffness; ballasted track settling faster than structures; and the settlement of ballasted track is highly variable. The track transition maintenance issues can be found through track inspections; evaluation cars; and vehicle track interaction (UP 2017). Section 3 of the UP Engineering Track Maintenance Field Handbook covers crossties and fastenings. In the handbook, table 3-I sets forth the requirement for 10 crossties of 10 feet each to be installed in the transition zone on the approach of open-deck bridges (UP 2017). During FRA inspections conducted in May 2017, FRA inspectors documented conditions of track on the approaches of 12 bridges on the Estherville Subdivision. They reported five bridges had either fouled or had insufficient ballast at one or both bridge ends. In addition, the inspectors observed five bridges did not have 10-foot transition ties in the track transition regions. Based on the examination of aerial photographs of the postaccident condition of the ties in place up to the approach on the west side of Jack Creek Bridge, the 10-foot transition ties were not installed in the transition zone. Based on available evidence, the investigation could not conclusively determine if there were vertical track transition issues on the Estherville Subdivision on the west approach to Jack Creek Bridge. However, the available evidence does show that there were no 10-foot transition ties on the west approach to Jack Creek Bridge that could mitigate risk of abrupt changes in vertical track stiffness, avoiding localized dynamic wheel loading, which could otherwise lead to a deteriorating track structure and rail failure. Postaccident actions in this accident recognize that UP’s 2018 capital program, that included a plan for replacing inferior crossties, contained elements for all bridge approaches on the aforementioned subdivisions to be fortified with 10-foot approach ties.

NTSB Railroad Accident Report 41 2.2.3 FRA Oversight The NTSB considered the effectiveness of FRA’s oversight on the Estherville Subdivision in this investigation. FRA track inspection records from 2015 through the day of the accident showed that inspectors had concerns with the crosstie conditions on the subdivision and near the derailment location. Two FRA inspections were completed in the area of the derailment of the Estherville Subdivision in 2015. These inspections were conducted in March and July by different inspectors. These reports documented 11 defective conditions with 9 of those being locations with defective crossties. In March 2015, one FRA inspection report contained a comment regarding marginal crosstie condition “approaching defective condition.” In July 2015, an FRA inspector provided comment on an FRA inspection report about the marginal crosstie condition for the class of track being operated in the area. In addition, the inspector said that those crossties were close to the end of their life and another winter cycle would most likely put those areas in noncompliance. The inspector also emphasized that this was an ethanol route. FRA inspection reports from MP 78.4 to MP 44.0 on August 10, 2016, documented 10 locations with crossties that did not meet the minimum requirements of FRA TSS. The inspector characterized the crosstie condition as being “marginal” and in many areas “defective,” emphasizing in the report that this was an ethanol route and the risk was evident. No civil penalties were recommended in any of these inspection reports. Although FRA track inspectors identified some defective crosstie conditions, others were documented as comments to the railroad, rather than defects subject to civil penalties. In May 2017, when the FRA returned to the Estherville Subdivision and conducted walking and hi-rail inspections, they documented 78 defective track conditions. Of those, 51 were locations with defective crossties and 5 were locations with rail fasteners not maintaining track gage—a clear demonstration that not all defective crosstie conditions were being reported by FRA inspectors. As previously mentioned, crossties do not deteriorate in a matter of days—to the extent they are split, broken, and unable to hold rail fasteners—but do so over time. Title 49 CFR 213.241, “Inspection records” requires the location and nature of any deviations from the requirements of FRA TSS to be specified on the inspection record. Although the crosstie conditions near the accident location were brought to the attention of UP in March 2015 and again in 2016, defective crossties remained on the track until after the derailment. The NTSB concludes that FRA inspectors did not report all defective crosstie conditions on the UP Estherville Subdivision in the 2 years prior to the derailment. Furthermore, for those crosstie conditions that FRA inspectors identified as defective, the FRA did not use enforcement options, such as civil penalties, to compel UP to comply with safety regulations and to repair safety defects identified by FRA inspectors. Therefore, the NTSB further concludes that FRA inspectors were not using all available enforcement options, such as a recommendation for civil penalties, to require UP to comply with FRA minimum TSS on the Estherville Subdivision. Therefore, the NTSB recommends that the FRA provide additional training to all its track inspectors on regulatory track safety standards compliance and provide guidance of available enforcement options to obtain compliance with minimum TSS when defective conditions are not being properly remediated by railroads on all routes that carry high hazardous flammable materials.

NTSB Railroad Accident Report 42 When the FRA entered into a compliance agreement with UP in December 2016, the impetus was the derailment of an HHFT train in Mosier, Oregon, in June 2016. In that derailment, the FRA found that the train had derailed because of wide gage, a condition that occurs when the tracks are too wide to support normal wheel rail contact. According to the FRA’s investigation, the wide gage resulted from the failure of the track’s fasteners used to hold the tie plates in position. The FRA found that the fasteners could not adequately restrain the rail because they were worn, sheared, and in disrepair. The FRA also found evidence of other disrepair near the POD.64 In subsequent inspections of UP crude oil routes on subdivisions located in Oregon, the FRA found 159 defects with 26 of those related to track fasteners. The FRA has conducted other inspections on UP track which resulted from derailment investigations, which raised their level of concern of UP’s track maintenance and inspection program. In January 2015, the FRA commenced a program called the Crude Oil Route Track Examination (CORTEX). This program involved a series of FRA inspections specifically targeted at railroad tracks where crude oil and/or ethanol was transported and was conducted in every FRA region for every Class I railroad across the country. The FRA had been using some, but not all, of its available enforcement options to help UP improve compliance with federal TSS. The results of the CORTEX inspections demonstrated that more work is needed to improve the track conditions of UP’s HHFT routes. The FRA sought out the compliance agreement as an alternate to a compliance order. During his interview, NTSB investigators asked the RA how the 2016 Compliance Agreement between the FRA and UP affected the inspection activity on the Estherville Subdivision. The RA answered, “It has absolutely no bearing on the Estherville Subdivision.” He said that it was his understanding that the compliance agreement applied to main track territory, not branch line territory. However, when NTSB investigators followed up with the FRA requesting a definition of a branch line, the FRA responded that there is no official definition of a branch line and the Estherville Subdivision was subject to the requirements of the compliance agreement. Had the FRA RA been aware that the requirements of the compliance agreement applied to the Estherville Subdivision, there may have been an increased regulatory presence identifying track defects in the area around the derailment. However, the compliance agreement had only been in place for 3 months prior to the accident; therefore, the NTSB is unable to determine the efficacy of the compliance agreement at the time of the accident. After the postaccident inspections were completed, FRA officials informed NTSB investigators that UP corrected the defects identified by FRA inspectors and added an additional 150 crossties-per-mile under the 90-pound rail, thus increasing the strength of the track structure. As of August 2018, UP installed over 200,000 crossties since the derailment. According to the FRA, UP met all the requirements of the FRA compliance agreement by the end of 2017, but the FRA continues to monitor UP’s efforts to address the deficiencies in its inspection and maintenance programs.

64 For more information, see “FRA-UP Safety Compliance Agreement- Dated 12/22/2016” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 43 As of December 2016, the CORTEX inspections revealed about 5,700 defects on UP’s system and, as of that date, the FRA considered enforcement action for more than 800 documented violations. In addition, both prior to and following the Mosier derailment, the FRA repeatedly engaged with UP regarding its track maintenance and inspection program. UP willingly entered into the December 2016 compliance agreement with the FRA. 2.3 Rail Metallurgy The fresh horizontal impact damage observed on the wheel tread of the 4th through the 20th nonderailed cars that moved over the bridge immediately prior to the derailment was consistent with rolling wheels contacting an exposed leading edge of a broken rail segment. The broken rail segment’s leading edge impacted the wheels’ treads as they rolled over the damaged area, leaving behind impact damage. NTSB investigators did not observe any horizontal impact damage to the wheel tread on the wheels that traveled over the north rail; however, they documented a total of 14 tank cars and locomotives that had traveled over the south rail which had fresh horizontal wheel damage to the tread. The observed wheel impact damage was more pronounced on the south side wheels of tank cars that were further from the locomotive consist, indicating that the broken rail sections of track became progressively worse until the south rail was no longer able to support the train. NTSB’s Materials Laboratory Factual Report includes examination details on a particular section of the broken rail⸻a section of the south rail measuring 3 feet, 4 inches⸻that was located near the Jack Creek Bridge.65 (See figure 14.)

Figure 14. Section 10S from the south rail that was recovered from the accident, showing the field side and the west fracture face.

65 Section 10S.

NTSB Railroad Accident Report 44 Longitudinal impact damage, also known as head batter, was present on much of the west fracture face, although it was generally angled facing the field side of the rail. In addition, the gage side (side opposite of the field side) of the rail exhibited features, or defects, consistent with rolling contact fatigue.66 Head checking, flaking, shelling, and rail head defects have been known to lead to progressive cracking (predominantly by fatigue) inward, which leads to rail fracture, and were all present on section 10S. It is possible that there may have been a critical preexisting material or mechanical defect on one of the unrecovered pieces of rail. However, there was no direct evidence to suggest this, and any possibility is speculative. Examination of the head wear and the other head damage was generally inconsistent with the widespread preexisting damage of section 10S. The most damaged rail heads were inspected using ultrasonic testing, and none of those inspected revealed crack indications consistent with internal cracking. 2.3.1 Rail Break In its examination of the recovered pieces of rail, the NTSB Materials Laboratory determined all of the fracture surfaces of the examined rail from the accident exhibited features consistent with overstress fracture. Microscopic examination of these fracture surfaces revealed cleavage facets, consistent with overstress fracture of lower-ductility alloys. None of the rail fracture surfaces exhibited features consistent with preexisting cracks or defects that would have led to rail failure in this case. The importance of proper maintenance to the track structure plays a significant role in the safe operation of a railroad. Proper maintenance assures that all the components of the track structure are performing as designed. In this investigation, NTSB investigators determined that UP was not maintaining its track structure on the UP Estherville Subdivision in accordance with FRA minimum TSS or its own internal track maintenance standards. In addition, NTSB investigators determined that not all defective crossties were being identified, reported, and remediated according to UP track maintenance standards and FRA TSS. NTSB investigators determined that the FRA did not report all defective crosstie conditions on the UP Estherville Subdivision in the 2 years prior to the derailment. In addition, they were not using all available enforcement options, such as a recommendation for civil penalties, to require UP to comply with FRA minimum TSS of the Estherville Subdivision. Based on the observation of the fresh horizontal impact damage observed on the wheel tread of the 4th through the 20th nonderailed cars, examination of the rail recovered from the accident, and the condition of the crosstie structure on the Estherville Subdivision, the NTSB concludes that the train likely derailed from a broken south rail that occurred prior to or at the 20th car of UP train UEGKOT-09 as it was traveling over the west approach of the Jack Creek Bridge, resulting from UP’s inadequate track maintenance and inspection program and the FRA’s inadequate oversight of the application of federal track safety standards.

66 Rolling contact fatigue is defined as a failure or material removal driven by crack propagation caused by the near-surface alternating stress field.

NTSB Railroad Accident Report 45 2.4 Finite Element Analysis of 90-Pound Worn Rail Finite element modeling was used to explore the effects of worn rail and possibly degraded track support conditions. NTSB investigators measured rail wear but track support stiffness values were derived from data reported in the literature.67 A worst-case scenario with worn rail and less-stiff track support was compared to the best-case scenario of unworn rail and stiff track support. As expected, the degraded track exhibited higher stress levels under wheel loads compared with the best-case conditions, but the increased stresses in the assumed worst-case scenario were not sufficient by themselves to lead to track failure. It cannot be stated that any of the modeled track support conditions corresponded to the actual conditions at the accident site. Based on the FE modeling results, the peak rail deflection and peak longitudinal stress were both about three times higher with worn rail and soft track support conditions than with standard (unworn) rail and stiff track support conditions. The FE modeling results further showed that the transverse stress in the rail head region was dependent on the head area of the rail cross section and the support condition. A worn rail has less head area, which will result in higher transverse stress in the head region. Comparing the two rail profiles and track support conditions modeled in the study, the peak transverse stress was about 50 percent higher for the case with the worn rail profile and soft track support, and the area with relatively high transverse stress (greater than 5 ksi) was considerably larger. The transverse stress in the head region is known to be related to vertical split head failure because it has the potential to open up cracks in the vertical direction. However, in absence of evidence that the accident rail failed due to the vertical split head failure mode, it cannot be stated that the worn rail profile was responsible for the rail fracture during the accident. Based on the results of this study, the NTSB concludes that a deteriorated track structure, such as worn rail and degraded track support conditions, will cause more track movement and higher stresses in the rail. In particular, the NTSB concludes the finite element study demonstrates that worn 90-pound rail on a degraded track support will result in higher transverse stress in the rail head region, exposing the rail to increased risks of failure due to a vertical split-head failure mode. However, the NTSB’s FE study also showed no indications that the track was in danger of failure by overload, assuming that the loads, track, and support conditions in the model were representative of the actual conditions. 2.5 DOT-111 Tank Cars in Ethanol Service The involvement of US DOT Specification-111 (DOT-111) tank cars in this accident further demonstrates the vulnerability of tank car heads and shells to breaching damage. FRA research relating to puncture performance suggests that several variables influence the ability of tank cars to resist puncture from impacting objects. This section describes why existing DOT-111 tank cars used to transport flammable liquids must be replaced expeditiously with newly available better-performing tank cars that are designed to resist lading release in derailment situations.

67 For more information, see “Finite Element Modeling Study Report” in NTSB Docket DCA17MR007.

NTSB Railroad Accident Report 46 2.5.1 Tank Head Breaches Fourteen of the 20 derailed tank cars released ethanol in this accident. Of those, 10 tank cars sustained mechanical impact damage causing punctures, fractures, and tears that breached tank heads and/or shells.68 One tank car released product from a small thermal tear. Three tank cars released product only because of damage to top fittings and bottom outlet valves. Although the calculated puncture resistance energies for tank car heads is greatest in the center of a head, this area on tank cars TCBX 198194 (24th) and TAEX 2909 (29th) were punctured. Large-diameter rounded dents are evidence of head-to-head impacts between several tank cars. Such was the case with the 34th car, CTCX 731383, in which its B-end head sustained a deep rounded dent from impact with another tank car. Similar damage occurred to the 36th car, CTCX 731997, that caused an 8-inch crack in deeply folded material on the A-end head. The NTSB investigated other accidents where tank head protection systems on nonpressure tank cars transporting flammable liquids successfully prevented tank breach and subsequent releases. For example, on April 30, 2017, a standing Canadian National Railway (CN) crude oil unit train was struck from behind at a speed of about 33 mph by a CN manifest train in Money, Mississippi. A crude oil tank car, CBTX 718470, constructed to new DOT-117 specifications with 9/16-inch normalized steel heads and shells, thermal protection, full-height 1/2-inch thick headshield, and tank jacket, sustained a head impact from the rear CPC-1232 tank car that was driven forward by the collision. NTSB investigators observed that the DOT-117 tank car head shield successfully intercepted the impacting CPC-1232 tank car head without transmitting breaching damage to the tank head.69 The DOT-117 tank car did not release any crude oil in the accident. Additional evidence demonstrating the value of tank head protection systems was found in the investigation of the February 16, 2015, derailment of nonjacketed CPC-1232 tank cars transporting crude oil in Mount Carbon, West Virginia.70 Head shields successfully protected the heads of two tank cars that otherwise might have breached. Head shields are designed to absorb and distribute an impact load over a greater surface area on the tank head. By doing so, the energy required to fracture or rupture the tank head is increased (Tyrell and others, 2007). A one-half-inch thick full-height head shield could have prevented, or at least mitigated some of the less-energetic punctures to the six breached tank heads in this accident. Although the speed of the train was 30 mph at the time of derailment, somewhat lesser car-to-car impact speeds would be expected in many cases from run-in and deceleration, frictional forces acting on derailed cars, and relative motions of tank cars in the same general direction. The tank-head puncture resistance performance standard in 49 CFR 179.16, “Tank-head puncture-resistance systems,” that specifies that a system capable of sustaining without any loss of lading a coupler-to-head impact at relative car speeds of 18 mph, might still have been an effective accident mitigation measure had the tank cars been so

68 Some tank cars sustained multiple types of puncture damage and fittings damage. 69 For more information, see “Materials Laboratory Factual Report 17-406” in NTSB Docket DCA17SH002. 70 For more information, see “Tank Car Performance Factual Report” in NTSB Docket DCA15FR005.

NTSB Railroad Accident Report 47 equipped. The tank head puncture resistance performance standard is applicable to tank cars requiring such a system, such as the new specification DOT-117 and DOT-117R tank cars that are federally mandated to replace DOT-111 tank cars currently used to transport ethanol. Therefore, based on federal research and observed accident performance of tank car head protection systems in this accident, the NTSB concludes it is likely that had the legacy DOT-111 tank cars involved in this accident been replaced with DOT-117 tank cars equipped with head shields, breaches and punctures which resulted in the loss of hazardous material from six of the tank car heads could have been mitigated or prevented. 2.5.2 Tank Shell Breaches While this accident again highlights a long history of unacceptable crashworthiness performance for DOT-111 tank cars, there is little empirical evidence with which to draw tank shell accident performance comparisons to new specification DOT-117 tank cars that are scheduled to replace the existing flammable liquids fleet. Nevertheless, such protective features used on DOT-117 tank cars have successful track records in pressure tank car service, including the DOT-112 and DOT-105 tank cars that are used to transport liquefied compressed gases and poison inhalation hazard materials. While the available evidence is limited to the DOT-117 tank car in the Money, Mississippi, accident, NTSB investigators have observed many similar circumstances involving DOT-111 legacy tank cars that resulted in large shell fractures with total release of hazardous materials, such as the June 19, 2009, derailment in Cherry Valley, Illinois, which resulted in similar damage (NTSB 2012).71 The FRA tank car accident modeling research shows that more energy is needed to create punctures compared to the baseline DOT-111 car because of the stronger and tougher materials, increased thickness, and added jackets in the DOT-117 tank cars (FRA 2013). Although jacket material is less effective at resisting punctures than increased shell material thickness, adding tank thickness is not a practical option for retrofitting tank cars. FRA modeling suggests that adding a jacket to a DOT-111 tank car results in an almost 20 percent improvement in puncture resistance overall. The improvements were less for smaller contact-area impactors such as the end of a broken rail, and more for larger impactors such as couplers (FRA 2013). In the Graettinger accident, two tank cars, TILX 197694 (26th) and DBUX 302834 (27th) were impacted in their centers at 90° by the head of oncoming car TAEX 2909 (29th), which fractured, crushed, and cleaved these cars in half to instantly release their entire contents. A third major shell breach in tank car CTCX 732108 (25th), that came to rest just behind the two fractured tank cars, occurred from the same impact. The 25th tank car sustained a 10-foot diameter hole in the center of the car that probably caused most of its contents to release instantly as well. The energetic spray of released ethanol from these three tank cars found a source of ignition and is the likely cause of the reported explosion during the first moments following the derailment.

71 For more information, see “Materials Lab-Analysis Report 10-11A” in NTSB Docket DCA09MR006.

NTSB Railroad Accident Report 48 A fourth severely damaged tank car, WCHX 30078 (30th), was pinched between the heads of TAEX 2909 (29th) and TILX 199819 (32nd), forming a large shell tear at the point where the car was crushed. The severely damaged 32nd tank car impacted the 30th tank car, resulting in a 10-foot-wide hole in the shell. Most of the contents of these two tank cars emptied instantly and contributed to the initial fireball. A sixth tank car with shell breaching damage, CTCX 731383 (34th), sustained a 24-inch fracture on the center-left side that was most likely caused by other impacting objects, such as truck frames and wheels that were scattered about the derailment scene. Although the physical evidence suggests that impacts to this car were less energetic than impacts further forward in the train, the shell and head breaches and an open bottom outlet valve led to complete lading loss. In summary, damage to 5 of the 6 shell-breached tank cars was particularly severe and hazardous materials releases may not have been avoided in all cases, even if the tank cars had been equipped with the increased puncture resistance afforded by thicker normalized steel tank shells and 11-gauge jackets over a thermal protection blanket. Nevertheless, the NTSB concludes that tank car shell puncture resistance improvements required for new or retrofitted DOT-117 tank cars transporting flammable liquids that are scheduled to replace the existing fleet of DOT-111 ethanol tank cars by May 1, 2023, could have mitigated and might even have prevented some of the tank shell breaches from six of the tank cars involved in this accident. 2.5.3 Unprotected Valves and Fittings The observed tank car valve and fittings damage that contributed to poor lading retention in this accident was typical of damages incurred by DOT-111 tank cars in other derailment accidents. Six of the derailed tank cars sustained top fittings and bottom outlet valve damage that resulted in ethanol releases. Because of the extensive tank head and shell breaching damages, ethanol releases in just half of these cases were caused only by damaged valves or fittings themselves. Damage to top fittings can occur when a tank car rolls over and fittings that protrude from the tank (also referred to as discontinuities) strike the ground or another rail car. All of the DOT-111 tank cars involved in this accident were of pre-2010 vintage, equipped with a thinly constructed 0.119-inch-thick steel multihousing cover that served as little more than weather and vandalism protection. In contrast, top fittings protection for DOT-111 tank cars ordered after July 1, 2010, for transportation of Packing Groups I and II materials must be equipped with a protective structure capable of withstanding half the weight of a fully loaded car in the downward and lateral directions and the full weight of the car in the horizontal longitudinal direction (AAR 2018). If a DOT-111 tank car is retrofitted to specification DOT-117R standards, federal regulations require a top fittings protective housing not less than 0.5 inch in thickness with a tensile strength of not less than 65 kilo-pounds-per-square-inch (kpsi), and special allowance for the strength of the nozzle to tank or cover plate connection strength.72 These more robust protective housings have been shown effective in reducing rollover and impact damage to top fittings that project outward from the tank shell. For example, the investigation of the Lac-Mégantic, Quebec, accident found of the 27 derailed DOT-111 tank cars equipped with

72 Title 49 CFR 179.202-13(h), “Retrofit standard requirements (DOT-117R).”

NTSB Railroad Accident Report 49 robust top fittings protection that sustained impact damage, 4 of the tank cars had breached top fittings (TSB 2014). Conversely, of the 26 pre-2010 vintage derailed DOT-111 tank cars at Lac-Mégantic that were equipped with a thin multihousing cover, 16 sustained top fittings breaching damage (TSB 2014). In this accident, the fragile multihousing cover of the 25th car failed to protect the liquid valve from an impact that crushed the housing and severed the fitting from its eduction pipe, which can be used to remove ethanol from the top of the tank car. The multihousing cover was also broken away from the 21st tank car and the threaded vapor valve was pulled from the multihousing fittings flange, leaving a 2-inch opening into the tank. Therefore, the NTSB concludes that if the tank cars involved in this accident had been retrofitted or replaced with DOT-117 compliant tank cars, the breaching damage to the top fittings of the 21st and 25th tank cars could have been avoided. New bottom outlet valve design requirements have been adopted for all DOT-117 options in response to NTSB Safety Recommendation R-12-6, which resulted from the investigation into the Cherry Valley, Illinois, accident, that called for PHMSA to require that all bottom outlet valves used on newly manufactured and existing tank cars are designed to remain closed during accidents in which the valve and operating handle are subjected to impact forces. The bottom outlet nozzle adaptor attachment bolts have weakened cross sections to allow the adaptor to shear away on impact to avoid tank belly damage. Therefore, it is critical to prevent the operating handle from manipulating the bottom valve to an open position to avoid draining the tank contents. In derailments, valve operating handles frequently get caught in soil or debris as the tank rolls over and forces the valve to an open position. Federal regulations now require either the operating handle to be removed or designed to prevent unintended actuation during train accident scenarios.73 Several designs for new and retrofitted tank cars have been developed, such as removable handles, handles that disengage from the operating shaft, and recessed valving. Product released from the bottom outlet valves of four tank cars involved in this accident. None of the tank cars involved in this accident had the bottom outlet valve protective features prescribed by new federal regulations for specification DOT-117 tank cars. The 22nd and 34th tank cars had open bottom outlet ball valves because the operating handles were moved to the open position by derailment forces and the nozzle adaptors had broken away. This had the effect of creating a 4-inch opening in the tanks from which their contents quickly drained out by gravity. The bottom outlet ball valve remained closed on the 33rd tank car and the nozzle adaptor broke away at the fastening bolt shear sections as designed. However, the valve seals were damaged by pool fire exposure as evidenced by paint scorching over the bottom outlet area.74 In this case, ethanol likely escaped from the tank as it flowed around the damaged valve seals. In the 31st tank car, the valve operating handle was still in the closed position and the adapter nozzle had broken away. Because paint scorching was confined to the upper half of the

73 Title 49 CFR 179.202-8, “Bottom outlets” and 179.202-13 (g), “Retrofit standard requirements (DOT-117R).” 74 A pool fire is a turbulent diffusion fire burning above a horizontal pool of vaporizing hydrocarbon fuel where the fuel has zero or low initial momentum.

NTSB Railroad Accident Report 50 tank, leakage from this valve probably occurred because of impact damage or mechanical deformation rather than fire damage. Thick mud caking on the bottom of the car including in and around the bottom valve was evidence of a hard ground impact that could explain the valve damage. New valve operating handle closure protection features would not have prevented the releases of ethanol from the 31st and 33rd tank cars because these releases were not caused by the valve opening. In the case of the 34th tank car, it was extensively breached from head and shell damage and the bottom outlet valve failure had little effect on releases from that tank car. Therefore, the NTSB concludes that ethanol would not have released from the 22nd tank car had it been equipped with a bottom outlet valve operating mechanism that was designed to prevent actuation during an accident scenario. 2.5.4 DOT-111 Tank Car Fleet Replacement PHMSA final rule HM-251, published on May 8, 2015, established new and safer specification DOT-117 tank car design criteria for nonpressure tank cars transporting flammable liquids, a performance standard DOT-117P, and a retrofit standard DOT-117R to which existing DOT-111 tank cars may be converted (Federal Register, 2015a, 26644). These new specifications were intended to address crashworthiness concerns NTSB raised in earlier investigations that cited poor DOT-111 tank car performance as a critical safety issue. The new specifications addressed NTSB Safety Recommendations R-12-5 and R-12-6 that called for enhanced puncture resistance and fitting and valve protection for tank cars transporting crude oil and ethanol that were issued as a result of the June 19, 2009, derailment of an ethanol unit train in Cherry Valley, Illinois (NTSB 2012). The new specifications also addressed NTSB Urgent Safety Recommendations R-15-14 and R-15-15 that stressed the importance of thermal protection systems for new and existing tank cars in flammable liquids service that were issued following the February 16, 2015, derailment of a crude oil unit train containing CPC-1232 tank cars in Mount Carbon, West Virginia.75 In accordance with final rules HM-251 and HM-251C [as mandated by the Fixing America’s Surface Transportation Act (FAST Act)], the HMR have established commodity-based deadlines for phase-out or retrofitting DOT-111 tank cars in continued flammable liquids service (Federal Register, 2016a, 53935). PHMSA final rule HM-251 is not the first time that the DOT mandated a tank car safety enhancement and retrofit program. The DOT embarked on a similar effort in 1977, when it issued final rule HM-144, requiring that all new and existing specification 112 and 114 tank cars transporting flammable gases be equipped with thermal and tank head protection systems, and coupler restraint systems (Federal Register, 1977, 46306). In response to a 1978 NTSB public hearing on derailments and hazardous materials, the DOT amended the rule to require an accelerated retrofit schedule for existing flammable gas tank cars over a 2.5-year period (Federal Register, 1978a, 30057). The retrofit schedule required fleet owners to retrofit 20 percent of their existing fleets within 6 months, 65 percent by the following year, and their remaining tank cars by the following year.

75 For additional information, see letter for NTSB Safety Recommendations R-15-14 through -17, which can be found through the NTSB website.

NTSB Railroad Accident Report 51 In September 1978, the DOT issued a supplementary final rule to address compliance reporting (Federal Register, 1978, 39792). At that time, the DOT recognized that it was not sufficient to simply mandate the retrofit program because neglect by a tank car owner or owners to establish an adequate pace of retrofit could have resulted in a failure to meet regulatory deadlines. The DOT was concerned that such a failure could have resulted in an accumulation of unequipped cars, which would have been prohibited from use in transportation. The NTSB has the same concerns today regarding the current ethanol fleet of DOT-111 tank cars. Because the ethanol fleet of legacy DOT-111 tank cars constitutes a substantially large percentage of the overall general service tank car fleet, the NTSB is concerned about the potential for critical short-term shortages of DOT-117-compliant tank cars for flammable liquids transportation if tank car owners fail to take adequate measures to assure the phased completion of the retrofits and replacements. Due to the high demand for general service tank cars to transport ethanol and other flammable materials, it is essential that tank car owners make careful plans to assure their fleets are converted in advance of applicable deadlines. The accident tank cars were constructed between 2003 and 2009 and had the least crash-resistant features available for flammable liquids service. These legacy DOT-111 tank cars have the thinnest (7/16-inch thick) tank shells that are usually constructed of non-normalized steel, no head shields or puncture resistance system, no thermal protection system, and too little protection for top and bottom fittings. These shortcomings are responsible for the track record of poor accident performance for DOT-111 tank cars, especially since 2007 following their introduction into widespread use for flammable materials unit trains. Federal regulations place the burden on the shipper to offer the hazardous material in a package that is authorized for transportation. Although safer tank cars such as the DOT-117 are available, Green Plains obtained the accident train tank cars that meet current federal minimum safety standards from seven different leasing companies based on availability and market prices. Since most shippers are not rail car fleet owners and generally obtain tank cars through full service lease terms, they must rely on third-party leasing companies to ensure that replacement tank cars are available before the regulatory deadline for replacing DOT-111 ethanol tank cars by May 1, 2023. None of the tank cars in the accident train consist were constructed to DOT-117 specification requirements. At the time of this accident, three of the seven leasing companies that supplied tank cars used in the accident train had purchased significant numbers of DOT-117 tank cars. However, their rail car leasing fleets consisted predominantly of legacy DOT-111 and CPC-1232 tank cars.76 At the time of this accident, three other leasing companies that supplied tank cars for the accident train had no DOT-117 tank cars in their fleets. Prior to the publication of PHMSA final rule HM-251, the NTSB expressed concern about the lack of intermediate progress milestones for completing tank car modifications or replacements and the lack of transparency to hold the rail car owners accountable for progress

76 According to the UMLER database, which is the industry’s inventory of individual tank cars that are active or scheduled to be built.

NTSB Railroad Accident Report 52 toward implementing safer tank car fleets. This issue was addressed following the investigation of the Mount Carbon, West Virginia, accident with safety recommendations to PHMSA.77 Require an aggressive, intermediate progress milestone schedule, such as a 20 percent yearly completion metric over a 5-year implementation period, for the replacement or retrofitting of legacy DOT-111 and CPC-1232 tank cars to appropriate tank car performance standards, that includes equipping these tank cars with jackets, thermal protection, and appropriately sized pressure relief devices. (R-15-16) Safety Recommendation R-15-16 is currently classified Open—Unacceptable Response because PHMSA has not established a clear set of intermediate metrics that it could use to evaluate the safety improvement progress. The second recommendation, Safety Recommendation R-15-17, requested PHMSA: Establish a publicly available reporting mechanism that reports at least annually progress on retrofitting and replacing tank cars subject to thermal protection system performance standards as recommended in safety recommendation R-15-16. (R-15-17) Safety Recommendation R-15-17 is classified Open—Acceptable Response because PHMSA, collaborating with its stakeholders, entered into an agreement with the Bureau of Transportation Statistics (BTS) to collect and report data about progress made in modifying or replacing DOT-111 tank cars. To encourage compliance with DOT-111 replacement deadlines, Section 7308 of the FAST Act required the secretary of transportation to implement a reporting mechanism to monitor industry-wide progress toward modifying tank cars and to report the aggregate results of its tank car data survey annually to Congress. On September 22, 2017, the BTS submitted its first report to Congress detailing the fleet composition of rail tank cars transporting flammable liquids (BTS 2017). The BTS reported that as of the end of 2016, about 9 percent of the 81,000 tank cars used to transport Class 3 flammable liquids met new safety requirements. At that time, most of the flammable liquids fleet (53 percent) still consisted of nonjacketed DOT-111 tank cars, such as the tank cars that were involved in this accident. The number of nonjacketed DOT-111 tank cars used to transport ethanol has remained steady between 2014 and 2016 at about 26,000 to 28,000. However, during 2016, the BTS reported some progress with about 1,700 new DOT-117 and 1,200 retrofitted DOT-117R tank cars added to the ethanol fleet. However, the slow pace of ethanol fleet tank car conversions has prompted concern by the AAR and others in the industry about the availability of DOT-117 tank cars to service the flammable liquids fleet in years to come (Fronczak 2017). PHMSA stated in the U.S. Department of Transportation’s Status of Actions Addressing the Safety Issue Areas on the National Transportation Safety Board’s Most Wanted List: A Report to Congress and the National Transportation Safety Board that it is working with the rail industry and tank car facilities to develop reporting mechanisms to monitor tank car replacement progress and provide Congress with an annual written report (DOT 2017). PHMSA stated it

77 For additional information, see letter for NTSB Safety Recommendations R-15-14 through -17, which can be found through the NTSB website.

NTSB Railroad Accident Report 53 believes the transparency of the BTS report will help encourage industry to replace tank cars at a rate ahead of scheduled deadlines. However, in contrast to the earlier pressure tank car replacement regime mentioned above, the current regulatory scheme that responds to Section 7308(e) of the FAST Act requires DOT to redact tank car owners’ identities from progress reports to Congress. It requires DOT to report data in industry-wide totals and to treat company-specific information as confidential business information; therefore, shielding individual fleet owners from public scrutiny of their tank car replacement progress, or lack of progress. Therefore, the report to Congress does not offer complete transparency. Unlike the current regulatory system of assured anonymity and voluntary compliance that lacks targeted milestones, DOT chose to remedy potential failure of the earlier program in 1978 when it tasked FRA with closely monitoring the manner in which tank car owners complied with the deadlines. Thus, the 1978 rule required specification 112 and 114 tank car owners to file quarterly progress reports with the FRA, identifying the total number of tank car retrofits accomplished, as well as a declaration of intent concerning the remaining tank cars in their respective fleets. DOT stated that in the event any owner failed to establish a program leading to the timely completion of the retrofit tasks, the FRA could have instituted a compliance order or could have taken appropriate legal action under the provisions of 49 CFR Part 209, “Railroad Safety Enforcement Procedures.” The flammable gas tank car retrofit program was completed in 1980, nearly 1 year earlier than originally anticipated, and the NTSB noted as a result, the frequency and severity of accidents with these tank cars had been significantly reduced.78 In its most recent quarterly report to the AAR Tank Car Committee in May 2018, the AAR stated, “Forty-three percent of the cars used to ship ethanol during the 1st quarter of 2018 were built since 2011 to new standards vs. less than 2 percent in 2013 [that were built after 2011 and met the new standards].” In September 2018, the BTS sent its second report to Congress, Fleet Composition of Rail Tank Cars Carrying Flammable Liquids: 2018 Report. In this report, the BTS reported that nearly 20 percent of the tank cars used to carry Class 3 flammable liquids in 2017 met the new DOT-117 safety requirements—a significant increase from the 2 percent in 2015. The BTS further reported that nonjacketed DOT-111 tank cars, while carrying the largest share of flammable liquids, have decreased by 31 percent between 2014 and 2017. Furthermore, the number of both new and retrofit DOT-117 tank cars used in ethanol service more than doubled between 2016 and 2017 to over 6,000 tank cars (BTS 2018). Newly available AAR flammable liquids fleet utilization figures indicate there was remarkable progress made in replacing DOT-111 cars to transport ethanol in 2017 and also during the first quarter of 2018. According to the AAR, almost 11,000 DOT-117 tank cars were used during the first quarter of 2018 to transport ethanol, while the number of DOT-111 tank cars used to transport ethanol dropped by the same amount between 2016 and 2018. Despite recent tank car replacement progress, BTS and AAR fleet statistics indicate that still nearly one-half of the overall fleet of tank cars carrying flammable liquids were nonjacketed

78 Letter to the FRA from NTSB closing Safety Recommendations R-74-33; R-75-19 and -30; R-78-20 through -22; R-79-23 and -28; R-79-65; R-81-74; and R-81-75, September 10, 1982.

NTSB Railroad Accident Report 54 DOT-111, and most of these were used to transport ethanol. However, the NTSB concludes that since PHMSA has not established a clear set of intermediate metrics for evaluating tank car conversion and replacements, achievement of the deadlines may be overly reliant on future market and economic conditions. Therefore, NTSB reiterates Safety Recommendation R-15-16, which requests tank car retrofitting and replacement progress milestones. 2.6 Transportation of Fuel Ethanol Without Denaturant The Graettinger, Iowa, accident is the first unit train accident with release and fire that involved the transportation of undenatured fuel ethanol. While fuel ethanol is currently the most shipped hazardous material by railroad, the industry has experienced significant recent growth in the shipment of undenatured fuel ethanol to foreign markets. The foreign end-users generally request the product without denaturant added, which allows the ethanol to be used for other industrial purposes in addition to motor fuel. The RFA states that the 2017 undenatured ethanol export market in the United States is projected to amount to about 800 million gallons, and the transportation chain involves tank car originations mainly from Petroleum Administration for Defense Districts (PADD) 2 (Midwest) to Gulf and Northeast coast marine terminals.79 Domestically used ethanol is denatured for transport to discourage its use as a beverage. However, ethanol destined for export that is shipped from the same production facilities by the same tank cars and often on the same routes is not required to be denatured and is not treated to discourage use as a beverage. Denaturing agents, such as gasoline and benzene, may also increase both safety and environmental risks if a release occurs during an accident. The NTSB believes that the need to denature the 23 billion gallons of fuel ethanol transported annually for domestic use with volatile organic compounds, merely to discourage its use as a beverage, potentially poses an unnecessary risk of death, injury, and environmental contamination when released in transportation accidents. In fact, transporting fuel ethanol without a denaturant could provide a real and measurable safety benefit. The denaturant product typically used is 2 percent natural gasoline, which according to the RFA, lowers the flash point of denatured ethanol compared with undenatured ethanol, as described in section 1.16.1 (reported values between -5° and 19.4℉ instead of between 45°F and 55℉) (RFA 2017) and (EERC 2017).80 The purpose of adding denaturant to ethanol is to make the product completely unfit for beverage use, and the denaturants used must be nearly inseparable from the alcohol. A list of approved denaturants is specified in TTB regulations; however, natural gasoline is most commonly used to denature fuel ethanol. The addition of natural gasoline denaturant introduces volatile and toxic organic hydrocarbons into the product.

79 During a November 15, 2017, meeting with NTSB investigators, the RFA director of regulatory affairs stated that the export figure was 800 million gallons in 2017. However, earlier projections published by the RFA suggested an export volume of 1.2 billion gallons for 2017. The United States is divided into five PADD that were created to organize the allocation of fuels derived from petroleum products. 80 (a) Authorized denaturants are specified in 27 CFR 19.746, “Authorized Materials.” The most commonly used denaturants are 2 gallons or more of gasoline or natural gasoline per 100 gallons of ethanol. (b) Natural gasoline is a natural gas liquid with a vapor pressure intermediate between condensate and liquefied petroleum gas. This liquid hydrocarbon mixture is recovered at normal pressure and temperature and is more volatile and unstable than commercial gasoline.

NTSB Railroad Accident Report 55 Although the difference in flash point does not change the fact that denatured and undenatured ethanol are both Class 3 flammable liquids in Packing Group II, government and industry stakeholders have not studied what effect the absence of denaturant might have on the safety of transporting ethanol in unit trains. In particular, it is unknown the extent to which the absence of volatile constituents contained in natural gasoline denaturants could lessen the severity or probability of postaccident tank car shell thermal tears and energetic fireball eruptions. NTSB investigators noticed the relatively mild postaccident fire damage following the Graettinger derailment does not compare with the observed outcomes from previous denatured fuel ethanol accidents. The derailment scene did not produce energetic high-pressure events, rocketing car parts, or significant thermal damage to the derailed tank cars. This is in stark contrast to the thermal tears and tank car separations observed following the February 2011 derailment of a denatured fuel ethanol unit train of identical tank cars in Arcadia, Ohio (FRA 2011). The FRA has recognized that crude oil and denatured ethanol releases have a similar hazardous behavior, and that denatured ethanol even poses a greater hazard than crude oil on an equal tank car volume basis (Raj 2014). Moreover, the FRA has evaluated empirical tank car damage assessment data from accidents that occurred between 2006 and 2014, finding that denatured ethanol poses a greater risk to safety than the more volatile grades of crude oil (Alexy 2014). The FRA concluded that the tank car thermal failure rate for denatured ethanol was 1.5 times greater than for crude oil. The FRA opined that high energy events that result in tank cars completely separating are more likely to occur in tank cars transporting denatured ethanol. The accidents FRA examined all involved denatured fuel ethanol, which may have behaved differently than the undenatured fuel ethanol involved in this accident. Furthermore, the presence of toxic organic hydrocarbons associated with denaturant have complicated environmental remediation efforts whenever denatured ethanol has been released in train derailments because of polluted surface and ground water and soil contamination. Because the undenatured ethanol in the Graettinger derailment did not contain toxic compounds, such as the human carcinogen benzene, the environmental consequences of this accident were much less severe than typically experienced following a denatured ethanol release. Water testing found no significant impact to aquatic life or the environment downstream of the derailment scene. The released ethanol only resulted in localized depression of surface water dissolved oxygen levels. The contaminated soils cleanup was much easier because the material could be disposed of at a sanitary landfill without the necessity of pretreating hazardous waste constituents. Furthermore, the absence of denaturants that typically infiltrate and pollute aquifers also eliminated the need for long-term groundwater monitoring and remediation efforts. The NTSB, therefore, concludes that given the minimal thermal damage to tank cars, lack of energetic postaccident fireball eruptions, and less environmental impact observed in this accident compared with similar railroad accidents involving denatured fuel ethanol, it would appear a safety benefit may be derived from transporting ethanol without the use of volatile denaturant chemicals. This accident shows there may be safety benefits for shipping ethanol in its undenatured form; however, information is only available for this occurrence. The NTSB concludes that more

NTSB Railroad Accident Report 56 research should be conducted to determine whether operational changes to shipping ethanol in its undenatured form would improve safety. Therefore, the NTSB recommends that PHMSA sponsor research to study and publish the difference in characteristics between denatured and undenatured ethanol and the benefits that could be achieved by transporting fuel ethanol without the use of volatile organic chemical denaturants. 2.7 Factors Not Contributing to this Derailment The NTSB determined that the factors in this section did not cause or contribute to the severity of this accident. Among the requirements of 49 CFR Part 172 applicable to a person who offers a hazardous material for transportation, is certification that the hazardous material is properly classified and described on shipping papers. The erroneous hazardous materials shipping paper description conveyed to emergency responders that they were responding to a denatured ethanol release instead of an undenatured ethanol incident. NTSB investigators found that the shipper’s Intellifuels system, which generates meter tickets for each load, included a default DOT shipping description for denatured fuel ethanol. Green Plains, the shipper, claimed they were not able to change this description that the Intellifuels system manufacturer had programed into the unit when it was installed many years ago. This default description was established well before any consideration had ever been given to shipping ethanol as undenatured. Therefore, when the inaccurate description was forwarded to the Green Plains logistics coordinator at the company’s headquarters in Omaha, Nebraska, the error was carried forward to the electronic data interchange documents for the accident train, which were used to produce the hazardous materials shipping paper. Under 49 CFR 172.204, “Shipper’s certification,” Green Plains, the offeror of the shipment, had a duty to certify that the hazardous material was properly classified, described, packaged, marked and labeled, and was in proper condition for transportation in accordance with applicable DOT regulations. Even though the shipping papers incorrectly identified the consist of 98 tank cars as denatured fuel ethanol (UN1987), tank cars correctly displayed Class 3 placards with the UN identification number for undenatured ethanol (UN1170). When the train crew conducted a ground level acceptance inspection of the train as required by 49 CFR 174.26 (b), “Notice to train crews,” they should have noticed the inconsistency between the UN identification numbers displayed on the placards and the UN identification numbers listed in the train consist. The train crew should not have accepted the tank cars into transportation until the train consist was corrected. About 9 hours after the accident occurred, the logistics coordinator attempted to correct the error on the electronic data interchange system, but the system did not accept the correction because the shipment had already initiated. Therefore, the incorrect hazard communications were contained on the train consist that was available for emergency responder reference. Although the Graettinger fire chief told NTSB investigators he was initially unaware of the inconsistency between the shipping documents and placards, the shipper’s failure to properly identify the hazardous material in this case could have had significant safety consequences. For

NTSB Railroad Accident Report 57 instance, emergency response personnel need to be aware that flames of burning undenatured ethanol may be invisible in daylight. Had it been necessary for a close-quarters urgent extrication or evacuation, inaccurate hazard communications have the potential of causing delays and confusion, or worse, even injury if first responders are misinformed about the nature of the hazards. The remote location of this accident allowed first responders to take a stand-off approach without having to try to attack the fire or risk injury to themselves or the public. Therefore, the NTSB concludes that the erroneous shipping documentation identifying the hazardous material as denatured alcohol, instead of undenatured ethanol, did not have any adverse impact on the emergency response to this accident. As noted in section 1.10, the engineer tested positive for doxylamine in his urine, but not in his blood, which indicated that the level in his blood was below the reporting cut off level. Thus, it is unlikely the engineer was experiencing any effects of the drug at the time of the test. The blood was drawn at 5:12 a.m., about 4.5 hours after the accident. The half-life of the drug is between 6 and 12 hours. It is, therefore, impossible to determine if the level of the drug at the time of the accident was high enough that it could have caused any effects. However, the actions of the engineer throughout the trip and at the time of the accident were appropriate; there is no indication that he was impaired by his use of a sedating antihistamine at the time of the accident. The NTSB concludes that none of the following were factors in this accident: (1) the mechanical condition of the train to include the train’s braking system, (2) the performance of the train crew, (3) cell phone use by the train crew, (4) alcohol or other drugs by the train crew, and (5) the emergency response.

NTSB Railroad Accident Report 58 3 Conclusions 3.1 Findings

1. Union Pacific Railroad was not maintaining the track structure on the Union Pacific

Railroad Estherville Subdivision in accordance with Federal Railroad Administration minimum track safety standards or its own internal track maintenance standards.

1. Union Pacific Railroad supervisors and managers were not ensuring defective crosstie

conditions were being identified, reported, and remediated in accordance with Union Pacific Railroad track maintenance standards and Federal Railroad Administration track safety standards.

1. Federal Railroad Administration inspectors did not report all defective crosstie

conditions on the Union Pacific Railroad Estherville Subdivision in the 2 years prior to the derailment.

1. Federal Railroad Administration inspectors were not using all available enforcement

options, such as a recommendation for civil penalties, to require Union Pacific Railroad to comply with Federal Railroad Administration minimum track safety standards on the Union Pacific Railroad Estherville Subdivision.

1. Based on the observation of the fresh horizontal impact damage observed on the

wheel tread of the 4th through the 20th nonderailed cars, examination of the rail recovered from the accident, the condition of the crosstie structure on the Union Pacific Railroad Estherville Subdivision, the train likely derailed from a broken south rail that occurred prior to or at the 20th car of the Union Pacific train UEGKOT-09 as it was traveling over the west approach of the Jack Creek Bridge, resulting from UP’s inadequate track maintenance and inspection program and the FRA’s inadequate oversight of the application of federal track safety standards.

1. A deteriorated track structure, such as worn rail and degraded track support

conditions, will cause more track movement and higher stresses in the rail.

1. The finite element study demonstrates that worn 90-pound rail on a degraded track

support will result in higher transverse stress in the rail head region, exposing the rail to increased risks of failure due to a vertical split-head failure mode.

1. Based on federal research and observed accident performance of tank car head

protection systems in this accident, it is likely that had the legacy US Department of Transportation Specification-111 tank cars involved in this accident been replaced with US Department of Transportation Specification-117 tank cars equipped with head shields, breaches and punctures which resulted in the loss of hazardous material from six of the tank car heads could have been mitigated or prevented.

NTSB Railroad Accident Report 59

1. Tank car shell puncture resistance improvements required for new or retrofitted US

Department of Transportation Specification-117 tank cars transporting flammable liquids that are scheduled to replace the existing fleet of US Department of Transportation Specification-111 ethanol tank cars by May 1, 2023, could have mitigated and might even have prevented some of the tank shell breaches from six of the tank cars involved in this accident.

1. If the tank cars involved in this accident had been retrofitted or replaced with US

Department of Transportation Specification-117 compliant tank cars, the breaching damage to the top fittings of the 21st and 25th tank cars could have been avoided.

1. Ethanol would not have released from the 22nd tank car had it been equipped with a

bottom outlet valve operating mechanism that was designed to prevent actuation during an accident scenario.

1. Since the Pipeline and Hazardous Materials Safety Administration has not established

a clear set of intermediate metrics for evaluating tank car conversion and replacements, achievement of the deadlines may be overly reliant on future market and economic conditions.

1. Given the minimal thermal damage to tank cars, lack of energetic postaccident

fireball eruptions, and less environmental impact observed in this accident compared with similar railroad accidents involving denatured fuel ethanol, it would appear a safety benefit could be derived from transporting ethanol without the use of volatile denaturant chemicals.

1. More research should be conducted to determine whether operational changes to

shipping ethanol in its undenatured form would improve safety.

1. The erroneous shipping documentation identifying the hazardous material as

denatured alcohol, instead of undenatured ethanol, did not have any adverse impact on the emergency response to this accident.

1. None of the following were factors in this accident: (1) the mechanical condition of

the train to include the train’s braking system, (2) the performance of the train crew, (3) cell phone use by the train crew, (4) alcohol or other drugs by the train crew, and (5) the emergency response. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of the derailment was a broken rail that occurred as the train was traveling over the west approach of the Jack Creek Bridge resulting from Union Pacific Railroad’s inadequate track maintenance and inspection program and the Federal Railroad Administration’s inadequate oversight of the application of federal track safety standards. Contributing to the consequences of this accident was the continued use of US Department of Transportation Specification-111 tank cars.

NTSB Railroad Accident Report 60 4 Recommendations 4.1 New Recommendations As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations: To the Federal Railroad Administration: Provide additional training to all your track inspectors on regulatory track safety standards compliance and provide guidance of available enforcement options to obtain compliance with minimum track safety standards when defective conditions are not being properly remediated by railroads on all routes that carry high hazardous flammable materials. (R-18-026) To the Pipeline and Hazardous Materials Safety Administration: Sponsor research to study and publish the difference in characteristics between denatured and undenatured ethanol and the benefits that could be achieved by transporting fuel ethanol without the use of volatile organic chemical denaturants. (R-18-027) To Union Pacific Railroad: Reexamine your track maintenance and inspection program standards on all routes that carry high hazardous flammable materials and ensure those track inspection standards are complied with by both track inspectors and track supervisors. (R-18-028) 4.2 Reiterated Recommendation As a result of this investigation, the National Transportation Safety Board reiterates the following safety recommendation: To the Pipeline and Hazardous Materials Safety Administration: Require an aggressive, intermediate progress milestone schedule, such as a 20 percent yearly completion metric over a 5-year implementation period, for the replacement or retrofitting of legacy DOT-111 and CPC-1232 tank cars to appropriate tank car performance standards, that includes equipping these tank cars with jackets, thermal protection, and appropriately sized pressure relief devices. (R-15-16)

NTSB Railroad Accident Report 61 BY THE NATIONAL TRANSPORTATION SAFETY BOARD

ROBERT L. SUMWALT, III

EARL F. WEENER Chairman

Member

BRUCE LANDSBERG

T. BELLA DINH-ZARR Vice Chairman

Member

JENNIFER HOMENDY

Member

Adopted: October 30, 2018

NTSB Railroad Accident Report 62 Board Member Statement Member Jennifer Homendy filed the following concurring statement on November 5, 2018. Chairman Robert L. Sumwalt, III, Vice Chairman Bruce Landsberg, and Members Earl F. Weener and T. Bella Dinh-Zarr joined in this statement. The investigation of this accident highlighted significant deficiencies in Union Pacific Railroad’s (UP) track maintenance and inspection program. National Transportation Safety Board (NTSB) investigators found that from 2015 through 2017, UP identified 102 track defects on the Estherville Subdivision, noting crossties that were either “marginal” or in “poor condition.” Yet few of those track defects were remediated beyond the bare minimum. As noted in the accident report, this is not the first time that we have raised concerns with UP’s track maintenance and inspection program. Two previous NTSB accident investigations cited UP’s ineffective track inspections and inadequate oversight of track maintenance work, resulting in the issuance of NTSB safety recommendations. More recently, the UP accident in Mosier, Oregon, on June 3, 2016, in which 16 tank cars loaded with Bakken crude oil derailed (three of which ignited) was caused by track defects, specifically wide gage resulting from the failure of the track’s lag screw fasteners utilized to hold the tie plates in position. Following the Mosier accident, the Federal Railroad Administration (FRA) found 159 defects on UP’s Portland Subdivision, which runs between Troutdale, Oregon, and Hermiston, Oregon, and includes Mosier. Preceding the accident, in January 2015, the FRA commenced a national program called the Crude Oil Route Track Examination (CORTEX), inspecting railroad track on which crude oil and/or ethanol was being transported in every FRA region for every Class I railroad across the country. In total, CORTEX revealed 5,700 track defects on UP’s system. Section 1.18 of the accident report discusses UP’s postaccident actions on the Estherville Subdivision and other nearby subdivisions since the accident, which include installation of 8,600 crossties, reduction of maximum allowable speeds, and an increase in inspections. While I am encouraged by these safety improvements, it should not take a series of accidents for UP to take prompt action to address such serious deficiencies in their track maintenance and inspection program. A quick review of UP’s data that it submits annually to the FRA shows that, over the last decade, the leading cause of all UP train accidents (not including grade crossings) is track defects. While the deficiencies in UP’s track maintenance and inspection program are problematic, they were intensified by the FRA’s inadequate inspection regime. FRA inspectors from Region 6 identified numerous defects on the Estherville Subdivision but did little to nothing to address them. In fact, from 2015 through 2017, Region 6 inspectors identified 32 defective crosstie conditions, some of which were also identified by UP track inspectors. No enforcement actions were taken. Two months after the accident occurred on the Estherville Subdivision, the FRA again inspected the track and found 78 defective track conditions, 51 of which were

NTSB Railroad Accident Report 63 locations with defective crossties and 5 were locations with rail fasteners not maintaining track gage. Again, no further enforcement action was taken. Section 103 of Title 49, United States Code, states that the FRA “shall consider the assignment and maintenance of safety as the highest priority, recognizing the clear intent, encouragement, and dedication of Congress to the furtherance of the highest degree of safety in railroad transportation.” In other words, the FRA is the authority for ensuring safety on our nation’s rail network. If the railroads fail to address safety, it’s the FRA’s responsibility to take appropriate action. In this case, the regional administrator and Region 6 inspectors could have mandated speed restrictions, issued civil penalties, or required UP to report back to the FRA when repairs to the track were completed. None of that happened. Fortunately, there were no fatalities or injuries in this accident, but if the DOT-111 tank cars contained denatured ethanol, there could have been a different outcome. As noted in the report, denatured ethanol poses a greater hazard than crude oil in rail transportation. According to the FRA, the failure rate (due to thermal damage) of tank cars containing denatured ethanol is 1.5 times greater than that of tank cars transporting crude oil. The FRA also found that ethanol vapors are about nine times more hazardous than Bakken crude vapors at normal temperatures, and that ethanol poses “a greater fire ball hazard” than crude oil in tank car wall breaches. These hazards highlight the importance of considering the safety benefits of transporting undenatured ethanol in lieu of denatured ethanol; the urgent need to replace DOT-111 tank cars as required by existing regulations and the Fixing America’s Surface Transportation Act of 2015 (P.L. 114-94), and the need to ensure emergency responders are properly trained to react and respond to accidents involving hazardous materials. According to the National Fire Protection Association’s Fourth Needs Assessment of the U.S. Fire Service, dated November 2016, 39 percent of emergency responders are trained at the basic general awareness level (trained to initiate a response sequence by notifying proper authorities); another 14 percent have no training whatsoever. Only 41 percent of emergency responders are trained at the higher operations level (those who are part of an initial response to protect person, property, or the environment), and 7 percent are trained at the technician level (those who respond with the purpose of stopping the release). Additional training at the operations level, at a minimum, for emergency responders is needed. The Pipeline and Hazardous Materials Safety Administration of the U.S. Department of Transportation (US DOT) provides grants to states for training emergency responders. As a condition for receiving a grant, a state must train its emergency responders at the operations level. Funding is also provided for a train-the-trainer program at the operations level. These US DOT programs, and those offered by the rail industry through TRANSCAER (Transportation Community Awareness and Emergency Response), are critical for helping fire departments that may not otherwise be able to afford appropriate training for their personnel.

NTSB Railroad Accident Report 64 Appendixes Appendix A: Investigation The National Transportation Safety Board was notified on March 10, 2017, that a Union Pacific Railroad unit ethanol train derailed 20 loaded tank cars releasing product and fueling a postaccident fire on the Union Pacific Estherville Subdivision in Graettinger, Iowa. The National Transportation Safety Board launched Chairman Robert Sumwalt, who was a Board Member at the time, an investigator-in-charge, and 17 team members to investigate the accident. Parties to the investigation included the Federal Railroad Administration; Union Pacific Railroad; the Brotherhood of Locomotive Engineers and Trainmen; the International Association of Sheet Metal, Air, Rail and Transportation Workers; the Brotherhood of Railroad Signalmen; TrinityRail; the Brotherhood of Maintenance of Way Employes; and the Iowa Emergency Management of Palo Alto County.

NTSB Railroad Accident Report 65 Appendix B: Summary of Federal Railroad Administration and Union Pacific Railroad Inspections The following charts note results of the Federal Railroad Administration (FRA) and Union Pacific Railroad (UP) track inspections on the Estherville Subdivision in the 2 years prior to the accident. (See tables 5 and 6.) This is selected information and illustrates findings on crosstie conditions only. Table 5. Results of FRA inspections regarding crossties prior to the accident.

Date

Location (Milepost)

Findings Notification to FRA of Remedial Action

Violation March 11, 2015 77.75 Crossties not effectively distributed to support a 39-foot segment of track-5 in a row defective causing small profile approximately 100 feet west of crossing. Optional No March 11, 2015 71.85 Insufficient fasteners in a track segment-6 ties in a row not fully holding causing gage to shove out to almost 57 1/2". Optional No March 11, 2015 51.75 Crossties not effectively distributed to support a 39-foot segment of track-5 in a row defective causing small profile. Optional No March 11, 2015 51.20 Crossties not effectively distributed to support a 39-foot segment of track-5 in a row defective just west of point of tangent. Optional No March 11, 2015 50.13 Crossties not effectively distributed to support a 39-foot segment of track-5 in a row defective causing profile just [to the] east end of private crossing. Optional No March 11, 2015 46.13 [Rail] Head and web separation-2 inches breaking out in joint on 90lb. Side of comp [compromise joint bar] joint on south rail just west of turnout. Optional No March 11, 2015 48 - 78 Tie condition between MP 48 and 78 is in poor condition and approaching defective condition for intend class in many areas. Optional No July 29, 2015 76.35 Crossties not effectively distributed to support a 39-foot segment of track, several ties defective in a row. Optional No July 29, 2015 76.34 Crossties not effectively distributed to support a 39-foot segment of track, several ties defective in a row with one inch profile. Optional No July 29, 2015 73.45 Crossties not effectively distributed to support a 39-foot segment of track with deflection. Optional No July 29, 2015 66.10 Crossties not effectively distributed to support a 39-foot segment of track, seven ties defective in a row with deflection. Optional No July 29, 2015 62.52 Crossties not effectively distributed to support a 39-foot segment of track, eight ties defective in a row with deflection. Optional No July 29, 2015 70 - 49 Comment to Railroad Company Tie condition is marginal for the FRA class of track being operated in areas. Many areas where these ties are very close to the end of their life and another winter cycle will most likely put these areas in non-compliance. This is also a major ethanol hauling route. Optional No

NTSB Railroad Accident Report 66

Date

Location (Milepost)

Findings Notification to FRA of Remedial Action

Violation August 10, 2016 77.90 Failure to maintain the minimum number of crossties per FRA track class for each 39-foot segment of track as indicated in table in this section. (20 out of 25 defective) Optional No August 10, 2016 76.50 Crossties not effectively distributed to support a 39-foot segment of track, seven ties defective in a row. Optional No August 10, 2016 72.90 Crossties not effectively distributed to support a 39-foot segment of track, 15 ties in a row with plate movement and maximum gage of 57 5/8-inches. Optional No August 10, 2016 70.80 Crossties not effectively distributed to support a 39-foot segment of track, eight ties defective in a row. Optional No August 10, 2016 68.70 Crossties not effectively distributed to support a 39-foot segment of track, nine ties defective in a row. Optional No August 10, 2016 62.49 Crossties not effectively distributed to support a 39-foot segment of track, five ties defective in a row. Optional No August 10, 2016 62.48 Crossties not effectively distributed to support a 39-foot segment of track, 12 ties defective in a row. Optional No August 10, 2016 61.10 Crossties not effectively distributed to support a 39-foot segment of track, seven ties defective in a row. Optional No August 10, 2016 52.60 Crossties not effectively distributed to support a 39-foot segment of track, 10 out of 12 ties defective with one inch of profile. Optional No August 10, 2016 52.05 Crossties not effectively distributed to support a 39-foot segment of track, 7 out of 8 defective ties with profile. Optional No August 10, 2016 49 - 78 Crosstie condition marginal from MP 49 Emmetsburg to MP 78 Superior. Within this area some very marginal tie conditions exist from MP 60 Graettinger to MP 70 south end of Estherville. Numerous areas with 5-10 or more ties in a row defective or nearly so. FRA class 2 speeds exist from MP 72 to 78. FRA class 3 speeds exist from MP 72 to the worst of the marginal ties extending to MP 49. This is an ethanol route with higher risk, especially on the most marginal area for ties and it being operated at FRA class 3 speeds. Optional No December 13, 2016 44.5 – 78.40 No defects noted, snow cover. We also had a discussion about marginal tie conditions that exist between Superior, Iowa and Emmetsburg. Especially the hill and curves west of Estherville and between Emmetsburg and Estherville. FRA report 67 dated August 10th, 2016 listed 10 areas of defective tie conditions. This condition can only get worse going into the next year. Railroad will need to monitor this tie condition and take proper remedial action if necessary Optional No March 10, 2017 49.09 – 69.34 Made a hi-rail inspection to look at the overall condition of the track in each direction of Jack Creek (MP 56.72) and to rule out any additional broken rails that could have occurred under the Optional No

NTSB Railroad Accident Report 67

Date

Location (Milepost)

Findings Notification to FRA of Remedial Action

Violation derailing train prior to Jack Creek in the event of a flattened rail wheel. No broken rail were found. The inspection east of the derailment was from MP 54.53 to MP 49.09, while the inspection west was from MP 58.0 to MP 69.34. The portion in between was not inspected because of equipment occupying the track. Overall condition of this portion was: 90lb CWR; anchoring was good with no longitudinal movement, surface is fair for intended FRA Class 3 track; no gage issues were identified; tie condition is poor in many areas. March 11, 2017 56.98 Crossties not effectively distrubuted to support a 39-foot segment of track-6 in a row defective, with plate cutting and tight gage 56 1/16". Optional No March 11, 2017 56.95 Failure to maintain the minimum number of crossties per FRA track class for each 39-foot segment of track as indicated in table in this section. - only 7 effective ties in 39' causing 7/8" profile and tight gage (56 1/8"). Optional No March 11, 2017 56.94 Crossties not effectively distributed to support a 39-foot section of track, 4 in a row defective causing 3/4" profile. Optional No March 11, 2017 56.62 Crossties not effectively distributed to support a 39-foot section of track, 4 in a row defective causing 3/4" profile just west of curve on tangent. Optional No March 11, 2017 56.58 Crossties not effectively distributed to support a 39-foot section of track, 4 in a row defective causing 1 1/4" profile and 57 1/8" gage at west end of curve. Optional No March 11, 2017 56.50 Insufficient fasteners in a track segment. - 8 ties in a row with either no spikes or raised spikes causing 2" profile on south rail and 2 1/4" profile on north rail. Optional No

Table 6. Results of UP inspections regarding crossties prior to the accident.

Date Location (Milepost)

Findings

Repair Date March 18, 2015 65.50 Crossties not effective March 31, 2015 March 18, 2015 67.40 Crossties not effective March 31, 2015 March 18, 2015 71.65 Crossties not effective March 25, 2015 March 31, 2015 51.70 Crossties not effective March 31, 2015 April 7, 2015 39.30 Crossties not effective April 30, 2015 April 7, 2015 42.40 Crossties not effective April 30, 2015 April 7, 2015 43.75 Crossties not effective April 30, 2015 April 11, 2015 60.95 Crossties not effective April 24, 2015 April 11, 2015 61.63 Crossties not effective April 24, 2015 April 23, 2015 63.20 Crossties not effective May 1, 2015 April 23, 2015 63.30 Crossties not effective May 1, 2015 April 30, 2015 61.90 Crossties not effective May 8, 2015 April 30, 2015 70.43 Crossties not effective May 5, 2015 May 9, 2015 50.75 Crossties not effective May 20, 2015 May 12, 2015 47.27 Crossties not effective June 10, 2015

NTSB Railroad Accident Report 68

Date Location (Milepost)

Findings

Repair Date May 16, 2015 69.52 Crossties not effective May 22, 2015 May 21, 2015 58.70 Crossties not effective June 19, 2015 June 2, 2015 1.77 Crossties not effective June 18, 2015 June 2, 2015 34.87 Crossties not effective June 30, 2015 June 6, 2015 49.00 Crossties not effective June 30, 2015 June 6, 2015 77.77 Crossties not effective June 26, 2015 June 12, 2015 62.60 Crossties not effective July 1, 2015 June 12, 2015 68.50 Crossties not effective July 1, 2015 June 27, 2015 54.06 Crossties not effective July 24, 2015 June 27, 2015 54.17 Crossties not effective July 24, 2015 July 3, 2015 68.30 Crossties not effective July 29, 2015 July 3, 2015 68.35 Crossties not effective July 29, 2015 July 3, 2015 68.45 Crossties not effective July 29, 2015 July 11, 2015 40.40 Crossties not effective July 31, 2015 July 22, 2015 69.07 Crossties not effective July 31, 2015 July 25, 2015 73.68 Crossties not effective August 18, 2015 August 11, 2015 49.17 8-defective ties in 39' segment September 2, 2015 August 11, 2015 49.49 8-defective ties in 39' segment August 25, 2015 September 11, 2015 58.12 Crossties not effective September 18, 2015 September 11, 2015 73.60 Crossties not effective September 18, 2015 September 12, 2015 38.08 Crossties not effective September 21, 2015 October 1, 2015 64.80 Crossties not effective October 20, 2015 October 1, 2015 65.20 Crossties not effective October 29, 2015 October 13, 2015 2.39 Crossties not effective November 11, 2015 March 15, 2016 69.01 Crossties not effective April 13, 2016 March 15, 2016 69.02 Crossties not effective April 13, 2016 March 15, 2016 69.07 Crossties not effective April 12, 2016 March 15, 2016 71.35 Crossties not effective April 12, 2016 March 29, 2016 61.07 Crossties not effective April 27, 2016 March 29, 2016 61.15 Crossties not effective April 27, 2016 March 29, 2016 68.06 Crossties not effective March 29, 2016 March 29, 2016 68.08 Crossties not effective March 29, 2016 April 5, 2016 0.25 Crossties not effective April 27, 2016 April 19, 2016 42.50 Crossties not effective May 19, 2016 May 10, 2016 48.58 2-defective crossties May 12, 2016 May 10, 2016 48.59 2-defective crossties May 12, 2016 June 1, 2016 57.64 Crossties not effective June 29, 2016 June 1, 2016 58.24 Crossties not effective June 28, 2016 June 24, 2016 71.84 Crossties not effective July 15, 2016 June 24, 2016 73.10 Crossties not effective July 15, 2016 June 24, 2016 73.11 Crossties not effective July 21, 2016 July 7, 2016 32.82 Crossties not effective July 18, 2016 July 7, 2016 32.80 Crossties not effective July 18, 2016 July 7, 2016 32.81 Crossties not effective July 18, 2016 July 15, 2016 73.12 Crossties not effective July 29, 2016 July 29, 2016 73.13 10-defective crossties August 5, 2016 August 5, 2016 73.12 10-defective crossties September 2, 2016 August 27, 2016 44.36 Crossties not effective September 7, 2016 August 31, 2016 63.65 Crossties not effective September 9, 2016 August 31, 2016 63.74 Crossties not effective September 9, 2016 September 3, 2016 38.09 Crossties not effective September 28, 2016 September 3, 2016 39.85 Crossties not effective September 6, 2016 September 8, 2016 70.28 Crossties not effective October 5, 2016 September 10, 2016 76.90 Crossties not effective October 5, 2016 September 10, 2016 77.13 Crossties not effective October 5, 2016 September 15, 2016 32.33 Crossties not effective October 10, 2016 September 15, 2016 39.74 Crossties not effective October 10, 2016

NTSB Railroad Accident Report 69

Date Location (Milepost)

Findings

Repair Date September 20, 2016 77.63 Crossties not effective October 7, 2016 September 20, 2016 77.70 Crossties not effective October 7, 2016 September 20, 2016 77.71 Crossties not effective October 7, 2016 September 23, 2016 62.56 Crossties not effective October 19, 2016 September 23, 2016 62.58 Crossties not effective October 19, 2016 September 23, 2016 70.36 Crossties not effective October 19, 2016 September 23, 2016 70.41 Crossties not effective October 19, 2016 September 23, 2016 70.55 Crossties not effective October 12, 2016 September 27, 2016 67.32 Crossties not effective October 21, 2016 September 27, 2016 68.46 Crossties not effective October 21, 2016 September 27, 2016 69.73 Crossties not effective October 21, 2016 September 27, 2016 69.77 Crossties not effective October 21, 2016 September 27, 2016 70.02 Crossties not effective October 21, 2016 September 28, 2016 59.70 Crossties not effective October 25, 2016 September 28, 2016 59.71 Crossties not effective October 25, 2016 September 28, 2016 70.43 Crossties not effective October 12, 2016 October 1, 2016 50.29 Crossties not effective October 10, 2016 October 1, 2016 74.44 5-defective crossties October 18, 2016 October 4, 2016 57.55 Crossties not effective October 10, 2016 October 5, 2016 76.72 Crossties not effective October 7, 2016 October 12, 2016 67.58 Crossties not effective October 21, 2016 October 12, 2016 75.40 Crossties not effective October 18, 2016 October 12, 2016 77.85 Crossties not effective October 18, 2016 October 12, 2016 77.90 Crossties not effective October 18, 2016 October 12, 2016 77.21 Crossties not effective October 18, 2016 October 15, 2016 49.57 Crossties not effective October 25, 2016 October 19, 2016 69.93 Crossties not effective October 19, 2018 October 26, 2016 63.59 Crossties not effective October 28, 2016 October 26, 2016 63.70 Crossties not effective October 28, 2016 November 4, 2016 58.44 Crossties not effective November 9, 2016

NTSB Railroad Accident Report 70 Appendix C: Tank Car Specifications There are three primary types of tank cars used to transport flammable liquids: DOT-111, CPC-1232, and DOT-117. • DOT-111: Referred to as “legacy” DOT-111 nonpressure tank cars, the tanks have thinner heads and shells (7/16 inch) than what is now required for newly manufactured DOT-117 tank cars. These tank cars are not required to have head shields to protect the tank from impact damage. The top fittings are vulnerable to impact damage and bottom outlet valve operating mechanisms are not designed to prevent releases in accident scenarios. These tank cars do not have a pressure relief device that is sufficiently sized to protect against tank shell rupture from severe fire exposure. • CPC-1232: An industry-sponsored specification for more robust DOT-111 tank cars used to transport crude oil and ethanol was applicable to tank cars ordered after October 2011. These tank cars have a thicker head and shell (1/2-inch nonjacketed, and 7/16-inch jacketed) constructed of normalized steel, with a full-height head shield for jacketed tank cars and half-height head shield for nonjacketed cars. These tank cars have more extensive top fittings protection than legacy DOT-111 cars and must be equipped with a reclosing pressure relief device. • DOT-117: A nonpressure tank car constructed of normalized steel with a minimum head and shell thickness of 9/16 inch, a jacket, full head shields, top fittings protective housing, and a bottom outlet valve operating mechanism designed to prevent opening during accident scenarios. These tank cars must have a thermal protection system and appropriately sized pressure relief device designed to protect the tank from exposure to a 100-minute pool fire and a 30-minute torch fire. DOT-117R tank cars are DOT-111 or CPC-1232 tank cars that have been retrofitted to meet the specifications for DOT-117. The features of these various types of tank cars are noted in the table below. (See table 7.) Table 7. Flammable liquids tank car specifications.

Tank Car Specification

Phaseout or Replacement? Head and Shell Thickness (inches)

Normalized Steel?

Head Shield?

Jacket?

Thermal Protection?

Top Fittings Protection? Bottom Outlet Valve Handle Modification? DOT-111a Legacy Nonjacketed Phaseout 0.4375 No No No No No No DOT-111 Legacy Jacketed Phaseout 0.4375 No No Yes Fiberglass insulation No No CPC-1232 Jacketed Phaseout 0.4375 Yes Full Yes Fiberglass insulation Yes No CPC-1232 Nonjacketed Phaseout 0.5 Yes Half No No Yes No

NTSB Railroad Accident Report 71

Tank Car Specification

Phaseout or Replacement? Head and Shell Thickness (inches)

Normalized Steel?

Head Shield?

Jacket?

Thermal Protection?

Top Fittings Protection? Bottom Outlet Valve Handle Modification? DOT-117R Legacy DOT-111 Retrofit Replacement 0.4375 No Full Yes Fiberglass insulation Modified Yes DOT-117R CPC-1232 Jacketed Retrofit Replacement 0.4375 Yes Full Yes Fiberglass insulation Yes Yes DOT-117R CPC-1232 Nonjacketed Retrofit Replacement 0.5 Yes Full Yes Yes Yes Yes DOT-117J Replacement 0.5625 Yes Full Yes Yes Yes Yes a Specification for all tank cars involved in the Graettinger, Iowa, accident.

NTSB Railroad Accident Report 72 References AAR (Association of American Railroads). 2018. Manual of Standards and Recommended Practices, Section C-Part III, Specifications for Tank Cars, Specification M-1002. August 10, 2018. (Washington, DC: AAR). ----. 2018a. Freight Rail and Energy: Safely Moving Coal, Ethanol and Crude Oil. (https://www.aar.org/wp-content/uploads/2018/03/AAR-Energy-Issue.pdf), accessed August 10, 2018. ----. 2018b. Status of North American Flammable Liquid Fleet as of March 31, 2018. (Washington, DC: AAR). ----. 2016. Recommended Railroad Operating Practices for Transportation of Hazardous Materials. OT-55-P. January 19, 2016. (Washington, DC: AAR). Alexy, Karl, 2014. Comparative Analysis of Documented Damage to Tank Cars Containing Denatured Alcohol or Crude Oil Exposed to Pool Fire Conditions. white paper. June 2014. (Washington, DC: US Department of Transportation, FRA Office of Safety). Arcadis (Arcadis Design & Consultancy – United States Headquarters). 2017. Written Report for Hazardous Conditions Union Pacific Railroad – March 10, 2017 Derailment, Iowa Department of Natural Resources, Graettinger, Palo Alto County, Iowa. Spill Number 031017-JBV-0221. (Highlands Ranch, Colorado: Arcadis). AREMA (American Railway Engineering and Maintenance-of-Way Association). 2016. Manual for Railway Engineering. Part 1, General Considerations, Sections 1.8.1 and 1.8.3. (Lanham, Maryland: AREMA). BTS (Bureau of Transportation Statistics). 2018. Fleet Composition of Rail Tank Cars That Transport Flammable Liquids: 2018 Report. (Washington, DC: BTS). ----. 2017. Fleet Composition of Rail Tank Cars That Transport Flammable Liquids: 2013-2016. (Washington, DC: BTS). DOT (US Department of Transportation). 2017. U.S. Department of Transportation’s Status of Actions Addressing the Safety Issue Areas on the National Transportation Safety Board’s Most Wanted List: A Report to Congress and the National Transportation Safety Board. (Washington, DC: DOT). EERC (Ethanol Emergency Response Coalition). 2017. Training Guide to Ethanol Emergency Response. (http://www.ethanolresponse.com/resources/), accessed August 12, 2018. FAA (Federal Aviation Administration). 2017. Forensic Toxicology Drug Information: doxylamine. (http://jag.cami.jccbi.gov/toxicology/DrugDetail.asp?did=53), accessed December 11, 2017.

NTSB Railroad Accident Report 73 FR (Federal Register). 2016. Vol. 81, no. 221 (November 16). ----. 2016a. Vol. 81, no. 157 (August 15). ----. 2015. Vol. 80, no. 239 (December 14). ----. 2015a. Vol. 80, no. 89 (May 8). ----. 1978. Vol. 43, no. 180 (September 15). ----. 1978a. Vol. 43, no. 135 (July 13). ----. 1977. Vol. 42, no. 179 (September 15). FRA (Federal Railroad Administration). 2017. Track and Infrastructure Integrity Compliance Manual (Volume 2), January 2017. (Washington, DC: US Department of Transportation, FRA). ----. 2016. Union Pacific (UP), Mosier, Oregon, June 3, 2016. Accident Investigation Report. HQ-2016-1136. (Washington, DC: US Department of Transportation, FRA). ----. 2013. Detailed Puncture Analysis Tank Cars: Analysis of Different Impactor Threats and Impact Conditions. DOT/FRA/ORD-13/17. (Washington, DC: US Department of Transportation, FRA). ----. 2011. FRA Factual Railroad Accident Report. HQ-2011-4. (Washington, DC: US Department of Transportation, FRA). Fronczak, R. 2017. “Status of the North American Flammable Liquids Fleet.” Presentation to the Association of American Railroads Tank Car Committee, April 19, 2017, Atlanta, Georgia. Lewis, Robert G.; Miller, Luther G.; Welty, Gus; Ellsworth, Kenneth G.; and Flagg, Mason B., eds. 2010. Railway Age’s Comprehensive Railroad Dictionary Second Edition, Second Printing. (Omaha, Nebraska: Simmons-Boardman Books, Inc., 2010). NIH (National Library of Medicine). 2013. Hazardous Substance Data Bank, Wireless Information System for Emergency Responders. (https://toxnet.nlm.nih.gov/cgi- bin/sis/htmlgen?HSDB), accessed September 24, 2018. NTSB (National Transportation Safety Board). 2014. “Rail Safety Forum: Transportation of Crude Oil and Ethanol.” public hearing. Washington, DC, April 22-23, 2014. ----. 2012. Derailment of CN Freight Train U70691-18 With Subsequent Hazardous Materials Release and Fire, Cherry Valley, Illinois, June 19, 2009. RAR-12/01. (Washington, DC: NTSB). ----. 2002. Derailment of Union Pacific Railroad Train QFPLI-26 at Eunice, Louisiana, May 27,

1. RAR-02/03. (Washington, DC: NTSB).

NTSB Railroad Accident Report 74 ----. 2001. Derailment of Amtrak Train 21 on the Union Pacific Railroad at Arlington, Texas, December 20, 1998. RAR-01/02. (Washington, DC: NTSB). Raj, Phani, 2014. Comparison of Magnitude of Hazards Resulting from the Release of Crude Oil and Ethanol from Tank Cars. (Washington, DC: US Department of Transportation, FRA). RFA (Renewable Fuels Association). 2017. Best Practices for Rail Transport of Fuel Ethanol. (Washington, DC: RFA). TSB (Transportation Safety Board of Canada). 2014. Field Examination of Tank Cars, Montreal, Maine & Atlantic Railway, Train MMA-002. Engineering Laboratory Report. LP149/2013. (Ottawa, Ontario, Canada: TCB). Tyrell, D.C., D.Y. Jeong, K. Jacobsen, and E. Martinez, “Improved Tank Car Safety Research,” Proceedings of the 2007 ASME Rail Transportation Division Rail Technical Conference, RTD2007-46013, September 2007. UP (Union Pacific Railroad). 2017. UP Engineering Track Maintenance Field Handbook. Revised March 9, 2017. (Omaha, Nebraska: UP). ----. 2016. Iowa Area Timetable No. 5. Effective November 14, 2016. (Omaha, Nebraska: UP). ----. 2016a. UP Air Brake and Train Handling Rules. Effective May 2, 2016. (Omaha, Nebraska: UP). ----. 2016b. UP System Special Instructions. Effective May 2, 2016. (Omaha, Nebraska: UP). ----. 2015. General Code of Operating Rules. Effective April 2015. (Omaha, Nebraska: UP). ----. 2013. Instructions for Handling Hazardous Materials. Effective July 2, 2013. (Omaha, Nebraska: UP).

FD07505 ｜ 2019_美国_AAR1901.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Runway Overrun During Rejected Takeoff Ameristar Air Cargo, Inc., dba Ameristar Charters, flight 9363 Boeing MD-83, N786TW Ypsilanti, Michigan March 8, 2017

Accident Report NTSB/AAR-19/01 PB2019-100293

National Transportation Safety Board

NTSB/AAR-19/01 PB2019-100293 Notation 58626 Adopted February 14, 2019 Aircraft Accident Report Runway Overrun During Rejected Takeoff Ameristar Air Cargo, Inc. dba Ameristar Charters, flight 9363 Boeing MD-83, N786TW Ypsilanti, Michigan March 8, 2017 National Transportation Safety Board 490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2019. Runway Overrun During Rejected Takeoff, Ameristar Air Cargo, Inc., dba Ameristar Charters, flight 9363, Boeing MD-83, N786TW, Ypsilanti, Michigan, March 8, 2017. NTSB/AAR-19/01. Washington, DC.

Abstract: This report discusses the March 8, 2017, accident involving Ameristar Air Cargo, Inc., dba Ameristar Charters, flight 9363, a Boeing MD-83 airplane, which overran the departure end of runway 23L at Willow Run Airport, Ypsilanti, Michigan, after the captain executed a rejected takeoff. The 110 passengers and 6 flight crewmembers evacuated the airplane via emergency escape slides; however, one slide failed to inflate and could not be used. One passenger received a minor injury, and the airplane sustained substantial damage. Safety issues identified in this report include the lack of a means to enable flight crews of Boeing DC-9/MD-80 series and 717 model airplanes to verify before takeoff that the elevators are not jammed, the need for improved in-service inspection techniques for critical rotating parts of all engines, the need for lower ground gust criteria for elevator physical inspections and operational checks by maintenance personnel for Boeing DC 9/MD-80 series and 717 model airplanes, the potential inadequacy of ground gust limit loads for the certification of transport-category airplanes, the lack of procedures for operators of Boeing DC-9/MD-80 series and 717 model airplanes to monitor the wind that affects parked airplanes, the lack of procedures for weather observers related to sign off and backup augmentation responsibilities during a facility evacuation, and evacuation slide malfunction. As a result of this investigation, the National Transportation Safety Board makes three safety recommendations to the Federal Aviation Administration and three recommendations to The Boeing Company. The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID DCA17FA076. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2019-100293 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NTSB Aircraft Accident Report i Contents Figures ........................................................................................................................................... iv Tables ............................................................................................................................................ vi Abbreviations .............................................................................................................................. vii Executive Summary .......................................................................................................................x

1. Factual Information .................................................................................................................1
2. 1 History of Flight .......................................................................................................................1
3. 2 Personnel Information ..............................................................................................................4
4. 2.1 Captain ...........................................................................................................................4
5. 2.2 Check Airman ................................................................................................................5
6. 3 Airplane Information ................................................................................................................5
7. 3.1 General ...........................................................................................................................5
8. 3.1.1 Maintenance ....................................................................................................5
9. 3.1.2 Weight and Balance ........................................................................................7
10. 3.2 Elevator Control System ................................................................................................7
11. 3.2.1 General Design ................................................................................................7
12. 3.2.2 Damage Observed on Accident Airplane ......................................................10
13. 3.2.3 Elevator Design Standard for Ground Gust Loads........................................12
14. 4 Meteorological Information ...................................................................................................12
15. 4.1 General .........................................................................................................................12
16. 4.2 Airport Surface Weather ..............................................................................................13
17. 4.2.1 Forecasts and Advisories ...............................................................................13
18. 4.2.2 Official Observations ....................................................................................13
19. 4.2.3 Other Sources of Wind Data .........................................................................14
20. 5 Airport Information ................................................................................................................15
21. 5.1 General .........................................................................................................................15
22. 5.2 Runway Safety Areas ...................................................................................................15
23. 6 Flight Recorders .....................................................................................................................16
24. 7 Wreckage and Impact Information .........................................................................................17
25. 8 Medical and Pathological Information ...................................................................................17
26. 9 Survival Aspects .....................................................................................................................17
27. 9.1 Emergency Evacuation ................................................................................................17
28. 9.2 Runway Safety Area ....................................................................................................19
29. 10 Tests and Research .................................................................................................................19
30. 10.1 Airplane Performance Study ........................................................................................19
31. 10.1.1 Accident Flight Takeoff ..............................................................................20
32. 10.1.2 Deceleration Profile and Distance to Stop ..................................................22
33. 10.2 Elevator Component Examinations and Testing..........................................................22
34. 10.3 Wind Simulation ..........................................................................................................22
35. 10.4 Static and Dynamic Elevator Load Testing .................................................................25

NTSB Aircraft Accident Report ii 1.10.4.1 Results Summary.........................................................................................26 1.10.4.2 Additional Test: Effect of Lifting Force on Locked Linkage .....................27 1.10.5 Evacuation Slide and Inflation Assembly Examination ..............................................28 1.11 Organizational and Management Information .......................................................................29 1.11.1 Risk Assessment Program............................................................................................29 1.11.2`Flight Release and Weather Information for Flight Crews .........................................30 1.11.2.1 Accident Flight’s Release............................................................................30 1.11.2.2 Company Procedures...................................................................................30 1.11.2.3 Related Regulations.....................................................................................31 1.11.2.4 Flight Crew’s Efforts to Obtain Weather Information ................................32 1.11.3 Flight Crew Procedures................................................................................................32 1.11.3.1 High-Wind Parking and Inspection Procedures ..........................................32 1.11.3.2 Elevator Preflight Inspection .......................................................................34 1.11.3.3 Taxi Checklist: Elevator Control Check .....................................................35 1.11.3.4 Increased Rotation Speed for Windshear Mitigation ..................................36 1.11.3.5 Rejected Takeoff .........................................................................................36 1.11.3.6 Emergency Evacuation ................................................................................39 1.12 Additional Information ...........................................................................................................40 1.12.1 Previous Elevator Jam Event .......................................................................................40 1.12.2 Previously Issued Safety Recommendations Related to Runway Safety Areas .................41 1.12.3 Procedures for Weather Observers ..............................................................................45 1.12.3.1 Sign Off for Nonaugmented Reports (Automated METAR) ......................45 1.12.3.2 Backup Responsibilities During Equipment Outage ...................................45 1.13 Effective New Investigation Techniques ...............................................................................46 1.14 Postaccident Safety Actions ...................................................................................................48 1.14.1 Boeing’s Multioperator Message and Ongoing Efforts ...............................................48 1.14.2 Ameristar’s Wind Monitoring Procedures for Parked Airplanes ................................48

1. Analysis ...................................................................................................................................50
2. 1 Introduction ............................................................................................................................50
3. 2 Flight Crew’s Performance ....................................................................................................51
4. 2.1 Preflight Responsibilities Related to Elevators............................................................51
5. 2.1.1 Parking and Inspection Criteria for High-Wind Exposure ............................51
6. 2.1.2 Preflight Inspection and Taxi Control Check ................................................51
7. 2.2 Preflight Weather Evaluation and Decision to Use Increased Rotation Speed ...........52
8. 2.3 Decision to Reject Takeoff after V1 .............................................................................53
9. 3 Right Elevator Jammed Condition .........................................................................................54
10. 3.1 Damage to Right Elevator’s Geared Tab Actuating Crank and Links.........................54
11. 3.2 Simulation of Wind Conditions at Airplane’s Parked Location ..................................55
12. 3.3 Elevator Load Testing ..................................................................................................56
13. 4 Mitigations to Prevent Future Occurrences ............................................................................57
14. 4.1 Review of Elevator Design Standard for Ground Gust Loads .....................................57
15. 4.2 Means to Enable Flight Crews to Detect a Jammed Elevator, Lowered Wind

Criteria for Elevator Inspections .............................................................................................58 2.4.3 Operator Procedures for Monitoring Wind Affecting Parked Boeing DC-9/MD-80 Series and 717 Model Airplanes .............................................................................................59 2.5 Previously Issued Safety Recommendations Related to Runway Safety Areas ....................59

NTSB Aircraft Accident Report iii 2.6 Weather Observer Procedures during Evacuation ..................................................................61 2.6.1 Sign-Off Procedures.....................................................................................................61 2.6.2 Backup Augmentation Responsibilities .......................................................................61 2.6.3 Subsequent Revisions to FAA Order JO 7900.5D.......................................................61 2.7 Evacuation Slide Malfunction ................................................................................................62

1. Findings ...................................................................................................................................63
2. 1 Conclusions ............................................................................................................................63
3. 2 Probable Cause .......................................................................................................................64
4. Safety Recommendations ......................................................................................................65
5. 1 New Recommendations ..........................................................................................................65
6. 2 Previously Issued Safety Recommendations Reclassified in This Report .............................65

Appendixes....................................................................................................................................67 Appendix A: Investigation .............................................................................................................67 Appendix B: Cockpit Voice Recorder Transcript ..........................................................................68 References ...................................................................................................................................133

NTSB Aircraft Accident Report iv Figures Figure 1. Orthomosaic image of the airplane’s path from the end of runway 23L to its final location. ........................................................................................................................................... 3 Figure 2. Rear view of the airplane wreckage. .............................................................................. 3 Figure 3. Right elevator and relative locations of control, geared, and antifloat tabs. .................. 8 Figure 4. Simplified diagram showing the direct connection between the cockpit control columns and the control tab on each elevator. .............................................................................................. 9 Figure 5. Drawing of installed location of geared tab linkage components (left) and closer view of the links and actuating crank (right). ............................................................................................ 10 Figure 6. View of accident airplane’s elevator geared tab links and actuating crank in an overcenter position with links bent outboard. Inset shows undamaged exemplar links and actuating crank in an overcenter position. .................................................................................................................. 11 Figure 7. Diagram showing the relative positions of the links (blue) and actuating crank (gray) when moving within their normal range of travel (in green) and when locked overcenter after having moved beyond their normal range of travel (in red). ........................................................ 11 Figure 8. Photographs of the RSA off the departure end of runway 23L before upgrade (left) and after (right). ................................................................................................................................... 16 Figure 9. Orthomosaic image showing runway, airplane, and annotated locations of tire marks. .................................................................................................................. 19 Figure 10. Airplane performance parameters over time. ............................................................. 21 Figure 11. 3-D visualization of wind simulation results for a discrete time showing the locations of the hangar and airplane. Wind flow from the west (left side of image) is disrupted downwind of the hangar. ..................................................................................................................................... 23 Figure 12. 3-D visualization of wind simulation results for a discrete time showing turbulence generated downwind of the hangar. .............................................................................................. 24 Figure 13. Vertical cross-section visualization of wind simulation results for a discrete time showing flow pattern and horizontal (“U”) and vertical (“w”) wind magnitudes near the accident airplane’s elevators (view from behind looking forward). ........................................................... 24 Figure 14. Test rig representing an exemplar horizontal stabilizer and elevator system. ............ 25 Figure 15. Damage to the left geared tab inboard links and actuating crank (left) after load testing versus damage observed postaccident on the accident airplane’s right geared tab inboard links and actuating crank (right). .................................................................................................................. 27

NTSB Aircraft Accident Report v Figure 16. Excerpt from Ameristar’s preflight inspection pictorial training (elevator control system)............................................................................................................... 35 Figure 17. Screenshot of one view of the hangar 3-D model created from sUAS-captured imagery. ............................................................................................................... 47

NTSB Aircraft Accident Report vi Tables Table 1. Wind data from airport authority’s anemometer. ........................................................... 15 Table 2. Results of dynamic load tests (without boost cylinder). ................................................ 27

NTSB Aircraft Accident Report vii Abbreviations 3-D three-dimensional AC advisory circular ACU acquisition control unit agl above ground level AIRMET airmen’s meteorological information AFM Airplane Flight Manual AMM Aircraft Maintenance Manual AOM Aircraft Operating Manual ASOS automated surface observing system ATC air traffic control ATCT air traffic control tower ATIS automatic terminal information service ATP airline transport pilot AWOS automated weather observing system BFU German Federal Bureau of Aircraft Accident Investigation CAM cockpit area microphone CASS continuing analysis and surveillance system CFD computational fluid dynamics CFR Code of Federal Regulations CG center of gravity CMM Component Maintenance Manual CVR cockpit voice recorder DCP data collection package DO director of operations DTW Detroit Metropolitan Wayne County Airport EMAS engineered materials arresting system EST eastern standard time FAA Federal Aviation Administration FAM Flight Attendant Manual FCOM Flight Crew Operations Manual

NTSB Aircraft Accident Report viii FDR flight data recorder FOB flight operations bulletin FTD Fleet Team Digest GCP ground control point GOM General Operations Manual IFR instrument flight rules LAWRS limited aviation weather reporting station MAC mean aerodynamic chord METAR aviation routine weather report NAVAID navigational aid nm nautical miles NOAA National Oceanic and Atmospheric Administration NOTAM notice to airmen NPRM notice of proposed rulemaking NTSB National Transportation Safety Board NWS National Weather Service OAMP on aircraft maintenance planning OID operator interface device OIG Office of Inspector General OpSpecs operations specifications PF pilot flying PIC pilot-in-command PM pilot monitoring psi pounds per square inch RAP risk assessment program RPU remote processing unit RSA runway safety area RTMA real-time mesoscale analysis RWIS runway weather information system SAWS stand-alone weather sensor SB service bulletin

NTSB Aircraft Accident Report ix SIGMET significant meteorological information SMS safety management system SOP standard operating procedure SPECI aviation selected special weather reports sUAS small unmanned aircraft system TAF terminal aerodrome forecast TED trailing edge down TEU trailing edge up VFR visual flight rules V1 takeoff decision speed V2 minimum takeoff safety speed VR rotation speed YIP Willow Run Airport

NTSB Aircraft Accident Report x Executive Summary On March 8, 2017, about 1452 eastern standard time, Ameristar Air Cargo, Inc., dba Ameristar Charters, flight 9363, a Boeing MD-83 airplane, N786TW, overran the departure end of runway 23L at Willow Run Airport (YIP), Ypsilanti, Michigan, after the captain executed a rejected takeoff. The 110 passengers and 6 flight crewmembers evacuated the airplane via emergency escape slides; however, one slide failed to inflate and could not be used. One passenger received a minor injury, and the airplane sustained substantial damage. The airplane was operated under the provisions of Title 14 Code of Federal Regulations (CFR) Part 121 as an on-demand charter flight and was destined for Washington Dulles International Airport, Dulles, Virginia. Visual flight rules conditions prevailed at YIP at the time of the accident. During the takeoff roll, the captain, who was the pilot flying, executed the rejected takeoff 12 seconds after the airplane achieved V1 (takeoff decision speed) because he perceived that the airplane did not respond normally when he pulled back on the control column to command rotation. (V1 is defined, in part, as the maximum speed in the takeoff by which a rejected takeoff must be initiated to ensure that a safe stop can be completed within the remaining runway.) The check airman, who was the pilot monitoring (and was providing airplane differences training to the captain), questioned the captain’s decision to reject the takeoff after V1 but adhered to company standard operating procedures and did not attempt to intervene. Data from the airplane’s flight data recorder (FDR) showed that the airplane’s right elevator was positioned full trailing edge down (TED) when the flight crew first powered up the airplane on the day of the accident and remained there throughout the accident sequence. An airplane performance study (based, in part, on FDR data) confirmed that the airplane did not respond in pitch when the captain pulled on the control column. Based on the study’s comparison with a previous takeoff, the National Transportation Safety Board (NTSB) determined that the airplane’s lack of rotational response to the control column input did not become apparent to the captain in time for him to have stopped the airplane on the runway. Before the accident flight, the airplane had been parked on the ramp at YIP for 2 days near a large hangar, and the elevators (which, by design, did not have gust locks) were exposed to high, gusting surface wind conditions. Postaccident examination showed that the right elevator’s geared tab’s inboard actuating crank and links had moved beyond their normal range of travel and became locked overcenter, effectively jamming the right elevator in a full-TED position and rendering the airplane incapable of rotation during takeoff. The speed of the surface wind and gusts at YIP did not exceed the certification design limit or maintenance inspection criteria for the airplane. However, the NTSB determined the airflow at the airplane’s parked location was affected by the presence of the large hangar that generated localized turbulence with a vertical component that moved the elevator surfaces rapidly up and down, which resulted in impacts against the elevator mechanical stops, imposing dynamic loads sufficient to jam the right elevator. As a result of this investigation, the NTSB identified the following safety issues: • Lack of a means to enable flight crews of Boeing DC-9/MD-80 series and 717 model airplanes to verify before takeoff that the elevators are not jammed. The accident flight crew performed both the preflight inspection and the control check

NTSB Aircraft Accident Report xi during taxi in accordance with the procedures in Ameristar’s Aircraft Operating Manual (AOM) for the Boeing MD-83; however, these checks did not enable them to detect the jammed elevator condition. For all Boeing DC-9/MD-80 series and 717 model airplanes (which have a similar elevator design), a full-TED elevator position (which may be visible during the preflight walkaround inspection) is not necessarily indicative of an anomaly because the elevators can freely move to that position under a nominal ground wind. Also, on these airplane models, the control column is mechanically connected to and directly controls the elevator control tabs, not the elevators. During the taxi control check for the accident airplane, the elevator control tabs responded normally to control column input, even though the right elevator was jammed. • Need for lower ground gust criteria for elevator physical inspections and operational checks by maintenance personnel for Boeing DC-9/MD-80 series and 717 model airplanes. The AOM contained an amplified normal checklist for flight crews that included a caution that airplanes exposed to high sustained wind or gusts greater than 65 kts were susceptible to elevator damage and/or jamming and stated that, for any airplanes suspected of such exposure, inspections and checks specified in Ameristar’s Aircraft Maintenance Manual (AMM) for the Boeing MD-83 were required. The AMM included a warning that the airplane must be parked headed into the wind if gusts were expected to exceed 60 kts and a caution that visual and physical inspections of all flight control surfaces were required if the airplane was subjected to wind exceeding 65 kts. However, none of the recorded or forecasted wind at YIP exceeded these limits during the time that the airplane was parked on the ramp (the highest reported wind gust was 55 kts and the highest forecasted gust was 48 kts). • Potential inadequacy of ground gust limit loads for the certification of transport category airplanes. The airworthiness standard current at the time of the accident specified in 14 CFR 25.415, “Ground gust conditions,” that flight control systems and surfaces of transport-category airplanes must be designed for the limit loads generated when the airplane is subjected to a 65 kt horizontal ground gust from any direction while parked and taxiing. The regulation allowed for the assumption of static loads and provided the formula from which the hinge moments must be computed for elevators. However, considering the circumstances of the accident, the NTSB is concerned that the ground gust criteria specified in the regulation may not adequately ensure that critical flight control systems are protected from hazards introduced by ground gusts that contain dynamic, vertical wind components. • Lack of procedures for operators of Boeing DC-9/MD-80 series and 717 model airplanes to monitor the wind that affects parked airplanes. Although the AOM and AMM specified actions for flight crews and maintenance personnel to take when ground gusts reached certain criteria, Ameristar had no procedures to identify who was responsible for monitoring the known and forecasted wind that may affect the company’s parked airplanes. Had the wind at YIP exceeded the ground gust criteria specified in the AOM and AMM, it is unclear from Ameristar’s procedures if any personnel would have known and subsequently ensured that the specified parking and/or inspection actions were taken. To ensure that the elevators of Boeing DC 9/MD 80 series and 717 model airplanes are inspected by maintenance

NTSB Aircraft Accident Report xii personnel when exposed to ground gusts that meet or exceed criteria specified in the AMM, all operators of these airplanes must maintain awareness at all times of the forecasted and known wind where the airplanes are parked. After the accident, Ameristar implemented procedures for monitoring the wind affecting its parked airplanes. • Lack of procedures for weather observers related to sign off and backup augmentation responsibilities during a facility evacuation. YIP was a Limited Aviation Weather Reporting Station (LAWRS) facility, and, on the day of the accident, all personnel evacuated from the air traffic control tower due to the high wind. Further, due to a power outage, the automated surface observing system (ASOS) lost some of its sensor functions. Before evacuating the duty station, a LAWRS observer did not sign off from the ASOS operator interface device (OID), and, after evacuating, no LAWRS observer provided any backup information to supplement the weather data that was missing from the partially disabled ASOS. As a result, throughout the day of the accident, the ASOS continued to automatically disseminate aviation routine weather reports (METARs) that did not contain the AUTO modifier (because the observer did not sign off from the OID) to show that the METARs were not being augmented by a weather observer and did not contain complete weather information.1 The investigation identified procedural gaps in Federal Aviation Administration (FAA) Order JO 7900.5D (which was current at the time of the accident) and its subsequent revision in Change 1 (effective November 29, 2017) that could be clarified to ensure dissemination of the most complete and accurate weather information possible during circumstances in which weather observers are unable to perform their prescribed duties from their normal duty stations during normal duty hours. • Evacuation slide malfunction. The evacuation slide for the airplane’s right front (1R) door did not inflate when a flight attendant pulled the manual inflation handle, which rendered the exit unusable. The investigation found that the cable had been installed incorrectly in the valve assembly, which prevented proper inflation. On July 14, 2017, the slide manufacturer issued a revision to the Component Maintenance Manual to provide more descriptive valve testing procedures intended to prevent improper cable installation. During the overrun, the airplane was traveling about 100 kts when it exited the paved surface off the departure end of runway 23L at YIP. It then traveled about 950 ft across the grassy part of the runway safety area (RSA) before striking the airport perimeter fence and a raised, paved road before coming to a stop. The RSA off the departure end of runway 23L met the dimensional standards specified in FAA Advisory Circular 150/5300-13A, Change 1, having been upgraded between 2006 and 2009. The NTSB notes that these upgrades were responsive to previously issued NTSB safety recommendations and were part of a national program that the FAA initiated in 1999

1 According to FAA Order JO 7900.5D, Surface Weather Observing, section 14.10.a., the AUTO modifier “identifies the type of report as a fully automated report with no human intervention…the absence of AUTO indicates that the report is either a manual report or an automated report with an observer ‘logged on’ to the system” (FAA 2014b, 102).

NTSB Aircraft Accident Report xiii to improve RSAs, install engineered material arresting systems, and relocate or make frangible FAA-owned navigational aids located in an RSA. The NTSB determines that the probable cause of this accident was the jammed condition of the airplane’s right elevator, which resulted from exposure to localized, dynamic wind while the airplane was parked and rendered the airplane unable to rotate during takeoff. Contributing to the accident were (1) the effect of a large structure on the gusting surface wind at the airplane’s parked location, which led to turbulent gust loads on the right elevator sufficient to jam it, even though the horizontal surface wind speed was below the certification design limit and maintenance inspection criteria for the airplane, and (2) the lack of a means to enable the flight crew to detect a jammed elevator during preflight checks for the Boeing MD-83 airplane. Contributing to the survivability of the accident was the captain’s timely and appropriate decision to reject the takeoff, the check airman’s disciplined adherence to standard operating procedures after the captain called for the rejected takeoff, and the dimensionally compliant runway safety area where the overrun occurred. As a result of this investigation, the NTSB makes safety recommendations to the FAA and The Boeing Company and reclassifies two previously issued safety recommendations to the FAA.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1

History of Flight On March 8, 2017, about 1452 eastern standard time (EST), Ameristar Air Cargo, Inc., dba Ameristar Charters, flight 9363, a Boeing MD-83 airplane, N786TW, overran the departure end of runway 23L at Willow Run Airport (YIP), Ypsilanti, Michigan, after the captain executed a rejected takeoff.1 The 110 passengers and 6 flight crewmembers (two airline transport pilots [ATPs] and four flight attendants) evacuated the airplane via emergency escape slides.2 One passenger received a minor injury, and the airplane sustained substantial damage. The airplane was operated under the provisions of Title 14 Code of Federal Regulations (CFR) Part 121 as an on-demand charter flight and was destined for Washington Dulles International Airport, Dulles, Virginia. Visual flight rules (VFR) conditions prevailed at YIP at the time of the accident.3 The airplane had been parked at YIP for 2 days before the accident on a ramp area east of a large (about 0.25-mile long) hangar. About 1139 on the morning of the accident, high wind from the west resulted in a power outage at the airport that affected some weather observing equipment (see section 1.4.2.2) and prompted the air traffic control tower (ATCT) personnel to evacuate the tower. According to Federal Aviation Administration (FAA) records, the ATCT issued a notification at 1217 to advise that the airport had no air traffic control (ATC) services (referred to as “ATC Zero”). The flight crew first powered up the airplane about 1236. They followed company procedures for operations at nontowered airports and used a cell phone to obtain updated weather information and ATC clearances (see section 1.11.2.4). The captain, seated in the left seat, was the pilot flying (PF), and the check airman in the right seat (who was providing differences training to the captain) was the pilot monitoring (PM).4 The captain performed the preflight walkaround inspection of the airplane and noticed no anomalies (see section 1.11.3.2).

1 All times in this report are EST. 2 The 110 passengers included 109 charter passengers and 1 Ameristar Air Cargo ground security coordinator, who assisted with the security screening and passenger boarding. The ground security coordinator was also qualified as a flight attendant but was not acting in that capacity for this flight. 3 (a) According to 14 CFR 91.155, VFR conditions for takeoffs from an airport in controlled airspace (like YIP) are visibility of at least 3 miles and a ceiling of at least 1,000 ft above ground level. (b) Supporting documentation referenced in this report can be found in the public docket for this accident, accessible from the National Transportation Safety Board’s (NTSB) Accident Dockets web page by searching DCA17FA076. Other NTSB documents referenced in this report, including reports and summarized safety recommendation correspondence, are accessible from the NTSB’s Aviation Information Resources web page (www.ntsb.gov/air). 4 The captain held a type rating for Boeing DC-9 airplanes but was receiving differences training in the Boeing MD-83 airplane (which was considered a Boeing DC-9 variant) in accordance with 14 CFR 121.418 and Ameristar’s approved training program. Until such differences training was completed, the captain could not serve as pilot-in-command (PIC) of a Boeing MD-83 operated under Part 121 by Ameristar.

NTSB Aircraft Accident Report 2 During their preflight planning, the flight crewmembers considered the high gusting wind when discussing the V-speed calculations. During a postaccident interview, the check airman stated that they chose to use a maximum thrust takeoff, which was their normal procedure. According to the flight crew’s completed takeoff speed card recovered from the airplane, they calculated the V-speeds as follows: V1 (takeoff decision speed) was 139 kts, VR (rotation speed) was 142 kts, and V2 (minimum takeoff safety speed) was 150 kts.5 He also stated during the interview that the wind was “pretty gusty,” so they agreed to increase the rotation speed about 5 kts.6 The cockpit voice recorder (CVR) transcript indicated that the check airman advised the captain to “delay rotation until at least V2…wait for me to call it.”7 The captain later confirmed their plan during his briefing, affirming to the check airman that “we are going to delay our rotation because of the gusty, strong gusty winds.” The captain’s briefing also considered wind in the event of an emergency; according to the CVR transcript, he told the check airman to really keep an eye out on what our airspeed is doing today, ahm, in the event of an engine fire or failure at or after V1, we’re going to continue the takeoff ….[I]f you get any kind of a [windshear] warning, it’s gonna be max thrust, ah, all the way to the firewall thrust, if necessary…we’ll fly out of the shear, back me up on the, ah, airspeed calls. While performing all their predeparture procedures and checklist items, neither pilot observed any anomalies with the airplane. The check airman performed the flight control checks during taxi and felt nothing unusual when he moved the control column forward and aft (see section 1.11.3.3). The flight crew positioned the airplane for departure from runway 23L, and, at 1451:12, the check airman called for the captain to begin the takeoff roll. At 1451:55, the check airman called “V1.” Six seconds later (at 1452:01), he called “rotate,” followed 3 seconds later (at 1452:04) by “V2.” At 1452:05, the captain said, “hey, what’s goin’ on?” and, 3 seconds later, “abort.” The check airman stated, “no, not above…” and then “…don’t abort above V1 like that,” and the captain replied, “it wasn’t flying.”

5 V1 was defined, in part, as the maximum speed in the takeoff by which a rejected takeoff must be initiated to ensure that a safe stop can be completed within the remaining runway (FAA 1994). Ameristar’s Aircraft Operating Manual (AOM) for the airplane defined VR as the speed at which rotation to the climbout attitude is initiated and V2 as the speed used for initial climb following an engine failure on takeoff. 6 During interviews, the flight crew described that they did not use an airspeed reference bug to set the increased rotation speed on the airspeed indicator, but the check airman, as PM, called out “rotate” when the airplane reached the increased airspeed. (An airspeed reference bug is a movable pointer that a pilot can use to identify specific reference speeds on the airspeed indicator.) 7 Quotes from the CVR transcript in this report may contain punctuation, capitalization, or other editorial style revisions. See Appendix B for the unrevised transcript.

NTSB Aircraft Accident Report 3 At 1452:23, the CVR captured sounds consistent with the airplane’s excursion from the paved surface. The airplane exited the paved surface off the departure end of runway 23L (including a 200 ft blast pad) and traveled about 950 ft across the grassy part of the runway safety area (RSA) before striking the airport perimeter fence and a raised, paved road before coming to a stop. The airplane came to rest on the fuselage belly with the tail on the road, about 1,150 ft west-southwest of the end of the runway (see figures 1 and 2). Figure 1. Orthomosaic image of the airplane’s path from the end of runway 23L to its final location. Source: The Boeing Company (label added by NTSB) Figure 2. Rear view of the airplane wreckage.

NTSB Aircraft Accident Report 4 The CVR captured that, after the airplane came to a stop, the check airman stated “evacuate, evacuate, evacuate” over the public address system at 1452:37. All 110 passengers and 6 crewmembers evacuated the airplane using four of the airplane’s eight exits. Flight attendants reported that two overwing exits were not opened, and the right front (1R) door exit was unusable because the evacuation slide did not inflate. Further, the tailcone exit door initially could not open fully due to a seatbelt buckle that became wedged under it, and passengers had used other exits by the time the flight attendant cleared the buckle and opened the door (see section 1.9.1). During a postaccident interview, the captain recalled that, when he began a normal rotation of the airplane at the “rotate” call, it did not rotate, so he applied more back pressure. (During a normal takeoff at rotation speed, pulling the control column aft results in trailing edge up [TEU] elevator movement to produce airplane-nose-up pitch; see section 1.3.2.1.) The captain said the control column was not quite to the physical limit of aft movement but was “further back than for a normal rotation.” Both pilots stated in interviews that, after the captain called for the rejected takeoff, they applied maximum braking, but the airplane went off the end of the runway. Initial examination of the airplane found that the airplane’s right elevator was jammed in a trailing edge down (TED) position and could not be moved when manipulated by hand (see section 1.3.2.2). 1.2 Personnel Information 1.2.1 Captain The captain, age 54, resided in Mequon, Wisconsin, and held an ATP certificate with type ratings for the Boeing 747, Boeing DC-9, and Saab SF-340 airplanes. He also held a flight instructor certificate. He held a first-class airman medical certificate dated January 27, 2017, with a limitation to possess glasses for near and intermediate vision. He stated in an interview that he had his glasses during the accident flight. The captain was hired by Ameristar on January 25, 2016, and had flown the Boeing DC-9 as a first officer before upgrading to captain on February 26, 2016. He was also a proficiency check airman for the company in the Boeing DC-9 flight simulator. His most recent proficiency training was completed on February 4, 2017; his most recent proficiency check was completed on November 4, 2016, in the Boeing DC-9; and his most recent PIC line check was completed on February 2, 2017, in the Boeing DC-9. According to company records, the captain had accumulated 15,518 hours total flight experience, which included 4,752 PIC hours and 8,495 hours in the Boeing DC-9. He had flown 68 hours, 30 hours, and 0 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. He had flown into YIP 10 times between April 17, 2016, and March 6, 2017, and his last three flights were with the check airman (January 8, 2017; January 15, 2017; and March 6, 2017). A review of FAA records showed no previous aviation incidents or accidents involving the captain. He received a notice of disapproval in 1996 for the Saab SF-340 type rating and in 1987 for the flight instructor certificate.

NTSB Aircraft Accident Report 5 1.2.2 Check Airman The check airman, age 41, resided in The Colony, Texas, and held an ATP certificate with type ratings for the Boeing 737, Boeing DC-9, Dassault (Falcon) DA-20, and Learjet airplanes. He also held flight instructor and advanced (ground) instructor certificates. He held a first-class airman medical certificate dated September 8, 2016, with no limitations. The check airman was hired by Ameristar on March 31, 2004; received his initial type rating on the Boeing DC-9 on February 13, 2007; and upgraded to the Boeing MD-80 on September 20, 201l. He was qualified for the company on the Boeing DC-9, MD-83, and 737 airplanes and was a check airman on the Boeing MD-83. He completed his most recent proficiency training on February 11, 2016; his most recent proficiency check on January 31, 2017; and his most recent PIC line check on June 9, 2016. According to company records, the check airman had accumulated 9,660 hours total flight experience, which included 7,240 PIC hours and 2,462 hours in the Boeing DC-9 (2,047 of which were as PIC). He had flown 50 hours, 19 hours, and 0 hours in the 90 days, 30 days, and 24 hours, respectively, before the accident. He had flown 152 flights into YIP (53 times on the Boeing MD-83) between January 1, 2003, and March 6, 2017. A review of FAA records showed no previous aviation incidents or accidents involving the check airman. He received a notice of disapproval in 1998 for the flight instructor certificate and in 1997 for the commercial single-engine airplane certificate. 1.3 Airplane Information 1.3.1 General The Boeing MD-83 airplane was equipped with two Pratt & Whitney JT8D-219 engines and a Honeywell GTCP 281276-1 auxiliary power unit. The airplane had 41,008.6 total flight hours with 39,472 total flight cycles at the time of the accident. 1.3.1.1 Maintenance Ameristar’s maintenance program for the airplane was based on the McDonnell Douglas On Aircraft Maintenance Planning (OAMP) report 761-93 and was referenced in the company’s OAMP report 761-93, revision 11, dated August 1, 1993.8 The company also had an approved continuing analysis and surveillance system (CASS). The December 2016 to March 2017 CASS report was reviewed with no issues noted with the elevator, elevator controls, hydraulic system, or elevator structures.

8 According to the type certificate data sheet (A6WE) for the Boeing MD-83, the type certificate was previously held by McDonnell Douglas Corporation, which merged with The Boeing Company in 1997, and Douglas Aircraft Company, Inc., which merged with McDonnell Aircraft Corporation in 1967.

NTSB Aircraft Accident Report 6 A review of airplane flight logs from October 2016 through March 2017 revealed no flight control discrepancies. Both right and left elevators were last lubricated on December 30, 2016. A records review that focused on elevator and stabilizer entries found that a C-check, including all nonroutine work cards, was completed in August 2015.9 The C-check requirements included detailed visual inspections of the horizontal stabilizer and elevator skins, internal structures, attachments, and actuation mechanisms. The inspection was completed with no nonroutine work cards generated for these components. A corrosion control inspection reported no findings of corrosion. The previous C-check, completed in July 2013, included seven nonroutine work cards for discrepancies found on both elevators and tabs. Four of the nonroutine items involved hail dents that required reinspections. A special inspection task was created for the 500-hour inspection of the hail dents for each elevator and tab. The right elevator float tab was found to be delaminated, which required a more restrictive 300-hour repetitive inspection per the Structural Repair Manual. A 300-hour repetitive inspection was not found; the inspection was included in the 500-hour repetitive inspection. The airplane had flown 611.4 flight hours since the July 2013 C-check when the delamination was discovered. The C-check completed in July 2011 included replacing and rigging the right elevator control tab in accordance with the Aircraft Maintenance Manual (AMM). There was a write-up for the right elevator damper leaking, and the records reflected that a check of the right elevator damper was accomplished in accordance with the AMM with no leaks noted. 1R Door Evacuation Slide Records showed that the evacuation slide for the 1R door was overhauled by Shoreline Marine, Inc., dba Safetech, on July 6, 2015, in accordance with the manufacturer’s Component Maintenance Manual (CMM) 25-26-48, revision 21, and CMM 25-65-11, revision 26. It was installed on the accident airplane on July 14, 2015, in accordance with the AMM. Recent Log Items On the inbound flight to YIP, the following three log items were generated and resolved before the accident flight: (a) Navigation number one will not receive ILS [instrument landing system] Frequency. Maintenance replaced the navigation receiver. (b) Forward [f]light [a]ttendant seat shoulder harness will not retract. Maintenance adjusted the harness.

9 A C-check, which is a comprehensive inspection of installations with maximum access to components and systems, is accomplished every 3,500 flight hours or 24 months, whichever occurs first. It includes qualitative and quantitative checks on the components and systems for performance deterioration.

NTSB Aircraft Accident Report 7 (c) Auto Throttles will not engage. After replacing the navigation receiver, maintenance performed the Auto Throttle system test and the Digital Flight Guidance System return to service test, both tested good. 1.3.1.2 Weight and Balance The company flight-follower performed initial weight and balance estimates on the accident airplane using the weight and balance software approved for company use by Operations Specification (OpSpecs) A025-3. After loading the passengers and baggage, the flight crew manually entered the weight and balance data into the company’s load manifest and takeoff information form. For the accident flight, the crew used a standard weight of 195 lbs per passenger, which included 16 lbs per passenger for carry-on baggage weight, and standard average weights for the baggage; their planning resulted in an estimate of 5,002 lbs for checked baggage and 1,760 lbs for carry-on baggage. They calculated the takeoff weight to be 145,076 lbs and rounded it up to 146,000 lbs, and the takeoff center of gravity (CG) to be 11.7% of mean aerodynamic chord (MAC).10 The airplane’s maximum certificated takeoff weight was 160,000 lbs with forward and aft CG limits of 3.7% and 22.1% MAC, respectively. After the accident, the National Transportation Safety Board (NTSB) weighed all of the baggage. The total actual weight of the checked baggage was 6,353 lbs, and the total actual weight of the carry-on baggage was 1,462 lbs. Actual passenger weights could not be determined. Postaccident calculations using the actual baggage weights and assumed passenger weights showed a total takeoff weight of 146,427 lbs with a CG of 10.4% MAC. 1.3.2 Elevator Control System 1.3.2.1 General Design The airplane is a t-tail design, such that the elevators and horizontal stabilizer are attached near the top of the vertical stabilizer about 30 ft above ground level (agl). The left and right elevators are attached by hinges to the rear spar of the horizontal stabilizer, and each is equipped with control, geared, and antifloat tabs attached to the trailing edge (see figure 3). Each elevator can travel between 27° TEU and 16.5° TED between mechanical stops mounted on the horizontal

10 The company’s passenger and baggage weight program was defined in OpSpecs A099, which specified that, for large cabin aircraft (like the accident airplane), either actual weights or standard average weights could be used in aircraft weight and balance calculations for passengers and baggage. The flight was carrying a college basketball team, band members, and cheerleaders, as well as support staff and family members, including children. FAA guidance in Advisory Circular 120-27E, “Aircraft Weight and Balance Control,” recommended using actual passenger weights (or established average weights) for flights carrying passengers of a nonstandard weight group (such as a sports team) when performing weight and balance calculations (FAA 2005).

NTSB Aircraft Accident Report 8 stabilizer.11 (A stop arm on each elevator contacts the mechanical stops to limit elevator travel, and a torsion bar distributes the increased loading.) Each elevator is also equipped with a damper designed to prevent elevator flutter during flight and dampen rapid movement of the elevator during gusty wind when the airplane is on the ground. When the airplane is parked, each elevator is free to move independently within the confines of the mechanical stops if acted upon by an external force, such as wind or manipulation by maintenance personnel. The elevator system (by design) has no gust lock, and the elevators are not interconnected. Figure 3. Right elevator and relative locations of control, geared, and antifloat tabs.

11 These values +/- 0.5° are within AMM-specified limits.

NTSB Aircraft Accident Report 9 Elevator control is accomplished via the trailing-edge elevator control tabs, which are mechanically connected to and directly controlled by the cockpit control column. During takeoff (at VR or higher) and during flight, when a pilot provides aft or forward control column input to command a change in airplane pitch, the elevator control tabs mechanically deflect, and the resultant aerodynamic forces on the deflected control tabs move the elevator surfaces to produce the change in airplane pitch. For example, when a pilot pulls the control column aft to command airplane nose-up pitch (such as during rotation), the control tabs respond by deflecting TED, and the resultant aerodynamic forces move the elevators TEU (see figure 4). Figure 4. Simplified diagram showing the direct connection between the cockpit control columns and the control tab on each elevator. Elevator geared tabs, which mechanically deflect in response to elevator movements, are attached to the horizontal stabilizer through a system of drive linkages. The geared tab drive linkage consists of a pushrod that is attached to the horizontal stabilizer spar by means of an actuating crank and links (see figure 5). The antifloat tabs are connected to the horizontal stabilizer through mechanical linkages and deflect based on stabilizer position to prevent down-float of the elevator when the horizontal stabilizer position exceeds certain criteria.

NTSB Aircraft Accident Report 10 Source: The Boeing Company (some labels and revisions added by NTSB) Figure 5. Drawing of installed location of geared tab linkage components (left) and closer view of the links and actuating crank (right). Additional system features include a hydraulically operated elevator power control boost cylinder for each elevator that will activate to help drive the elevators toward TED when a large amount of airplane nose-down pitch is commanded (via control tab deflection) and the resultant elevator position cannot be achieved through aerodynamic forces alone. 1.3.2.2 Damage Observed on Accident Airplane During an on-scene postaccident examination, investigators established flight control continuity for the elevator system by exercising the cockpit control columns through their full range to the control column stops in both the aircraft nose-up and aircraft nose-down directions. The left and right elevator control tabs responded with movement in the appropriate direction. Investigators noted that the control columns in some positions did not move smoothly, and there were tactile and audible indications of control cable friction under the cockpit floor. Further examination revealed airplane structural damage in an area where the cables were routed; the cables were riding on the damaged structure.

NTSB Aircraft Accident Report 11 Using a lift to access the elevators, investigators found that the airplane’s right elevator was jammed in a TED position and could not be moved when manipulated by hand. Examination found that the inboard actuating crank for the right elevator’s geared tab was bent outboard, and its links were bent (see figure 6). Further, the actuating crank and links were found locked overcenter beyond their normal range of travel (see figure 7). Figure 6. View of accident airplane’s elevator geared tab links and actuating crank in an overcenter position with links bent outboard. Inset shows undamaged exemplar links and actuating crank in an overcenter position. Note: The orange bar is not part of the airplane and was used as a pointer. Figure 7. Diagram showing the relative positions of the links (blue) and actuating crank (gray) when moving within their normal range of travel (in green) and when locked overcenter after having moved beyond their normal range of travel (in red).

NTSB Aircraft Accident Report 12 Examination of the left elevator found that it moved freely when manipulated by hand, and the left geared tab and linkages moved normally. When the left elevator surface was manipulated through its full range of motion (between the TED and TEU stops), the inboard actuating crank and links for the left geared tab moved within their normal travel range, and their relative positions never neared overcenter. Both elevators (including torsion bars, stop arms, and trailing-edge tabs), dampers, and boost cylinders were removed from the airplane for further examination and testing (see section 1.10.2). 1.3.2.3 Elevator Design Standard for Ground Gust Loads The airworthiness standard current at the time of the accident specified in 14 CFR 25.415, “Ground gust conditions,” that flight control systems and surfaces of transport-category airplanes must be designed for the limit loads generated when the airplane is subjected to a 65 kt horizontal ground gust from any direction while parked and taxiing. The regulation allowed for the assumption of static loads and provided the formula from which the hinge moments must be computed for elevators. The airworthiness regulation effective at the time the airplane was originally certificated specified a ground gust value of 88 ft per second (about 52 kts); it was revised in 1997 to increase the ground gust speed to 65 kts. Boeing stated in its submission to the investigation that the MD-80 series airplanes (which include the MD-83) were designed to withstand a 65 kt horizontal ground gust. According to Boeing, in the history of this elevator design (which exists on all Boeing DC-9/MD-80 series and 717 model airplanes), this accident was the first notification that Boeing had received of an elevator jam occurring on an airplane exposed to ground gusts lower than 65 kts. Boeing noted that the elevator design first entered service in 1965 on the then-Douglas DC-9 airplane. 1.4 Meteorological Information 1.4.1 General The National Weather Service (NWS) surface analysis chart for 1600 identified a northeast–southwest-oriented cold front over central lower Michigan that was advancing southeast. A trough extended southwest from Ontario, Canada, into the region that included the accident location. Wind ahead of the cold front was generally from the west or west–southwest with wind magnitudes at or above 25 kts at many locations. Regional weather radar for 1445 did not depict any echoes across the accident region, and satellite data imagery from the same time identified no clouds over the accident site at the accident time.

NTSB Aircraft Accident Report 13 1.4.2 Airport Surface Weather 1.4.2.1 Forecasts and Advisories The most recent terminal aerodrome forecast (TAF) for YIP before the accident was issued at 1222 and was valid for a time period that included the accident. The expected conditions in the TAF for the accident time were sustained wind from 250° at 32 kts with gusts to 48 kts, visibility greater than 6 miles, and few clouds at 6,000 ft agl. An NWS area forecast issued at 1445, valid for the accident time and location, forecasted surface wind from the west at 30 kts with gusts to 45 kts.12 A significant meteorological information (SIGMET) advisory was issued at 1441, valid for the accident time and location. The SIGMET advised of occasional severe turbulence below 12,000 ft due, in part, to strong low-level wind. Airmen’s meteorological information (AIRMET) advisories for strong surface wind were issued at 0945 and 1441, each valid for the accident time and location. Each AIRMET Tango advised that sustained surface wind greater than 30 kts was expected.13 1.4.2.2 Official Observations YIP was a limited aviation weather reporting station (LAWRS) facility and, as such, had FAA-certified ATC specialists who were responsible for the completeness and accuracy of the weather observations. These included the aviation routine weather reports (METARs) and aviation selected special weather reports (SPECIs) disseminated by the automated surface observing system (ASOS) located near midfield with an anemometer height of about 33 ft agl. On the morning of the accident, the METAR issued at 1153 was the last report for which complete ASOS data with LAWRS observer augmentation were available. It contained the following information: Wind from 260° at 35 kts with gusts to 50 kts, visibility 10 miles or greater, sky clear below 12,000 ft agl, temperature 11°C, dew point -11°C, altimeter setting of 29.81 inches of mercury with remarks that the station had a precipitation discriminator, a peak wind from 260° of 55 kts occurred at 1139, sea level pressure was 1009.5 hectopascals, temperature 10.6°C, and dew point -10.6°C.14

12 All wind directions in this report are in reference to true north unless otherwise indicated. 13 An AIRMET Tango is issued to describe conditions of moderate turbulence, sustained winds of 30 kts or greater, or nonconvective low-level windshear (FAA 2018a, 5-21). 14 The 55 kt gust at 1139 (reported in the 1153 METAR) was the highest gust recorded before the power outage. A 45 kt wind from 246° at 1133 was the highest sustained wind recorded before the outage (based on a review of the raw ASOS data for each minute). According to the National Oceanic and Atmospheric Administration’s (NOAA’s) “ASOS User’s Guide,” generally, ASOS-reported gust information is computed once every 5 seconds based on the greatest 5-second average wind speed (and corresponding direction) during the past minute and is stored for 12 hours

NTSB Aircraft Accident Report 14 After 1202, some ASOS equipment was no longer operational because of the power outage. After the tower was evacuated about 1217, no LAWRS observer provided augmentation or backup information for the ASOS.15 Each of the following METARs were disseminated automatically but did not contain the AUTO modifier. (See section 1.12.3 for more information about weather observer sign-off procedures [for nonaugmented METARs] and backup responsibilities.) • The 1253 report contained only an altimeter setting and the remarks, which included, in part, a statement that a peak wind of 46 kts from 240° occurred at 1156 and that maintenance was needed on the system. • The 1353 and 1453 reports also contained only an altimeter setting and the remarks, which included, in part, a statement that maintenance was needed on the system. 1.4.2.3 Other Sources of Wind Data The Wayne County Airport Authority owned and operated several runway weather information system (RWIS) units. An RWIS remote processing unit (RPU) located near the touchdown zone of runway 5R included an anemometer that was 9 to 10 ft agl and was unaffected by the power outage. The airport authority (and the vendor that processed the data) provided the NTSB with archived data from this RWIS RPU.16 The average wind and gusts it reported about the time of the accident are shown in table 1.17

(with some specified exceptions). An ASOS-reported sustained wind is computed every 5 seconds from a running 2-minute average (NOAA 1998). 15 According to NWS personnel, the ASOS’s three pressure sensors and its acquisition control unit (ACU), which publicly disseminates automated reports of ASOS-collected data, were powered by a source unaffected by the outage and remained operational. The ASOS data collection package (DCP), which collects data from most of the ASOS sensors on the field, lost power at 1139 but ran on battery backup until 1202. (The DCP resumed normal operation about 9 hours later.) For the time period in which the ASOS ACU was operational but the DCP was not, the ACU continued to disseminate automated METARs that did not include any DCP-provided information. YIP was also equipped with an FAA-owned stand-alone weather sensor (SAWS) located near the approach end of runway 23L that included an anemometer that was 35 ft agl. During normal operations, the SAWS provides real-time data to the ATC tower. On the day of the accident, the SAWS went out of service at 1138 due to the power outage, and its data were not archived. (According to the FAA, no formal archiving of SAWS data exists across the National Airspace System.) 16 The airport authority maintained this equipment for its own use; the data from it were not publicly disseminated. 17 Wind and gust magnitudes (which were reported in mph) and wind direction (which was reported in reference to magnetic north) have been converted in the table to kts and true north, respectively. (According to the airport diagram effective for the date of the accident, YIP had a magnetic variation of 7.1° west.)

NTSB Aircraft Accident Report 15 Table 1. Wind data from airport authority’s anemometer. Time Wind magnitude Wind direction (true) Gust magnitude 1438 29 kts 248° 44 kts 1443 31 kts 228° 49 kts 1448 26 kts 243° 43 kts 1453 24 kts 248° 37 kts 1458 31 kts 235° 41 kts 1503 24 kts 238° 41 kts Archived wind data from the RWIS RPU from earlier in the day, between 0703 and 1158, were compared with the available wind data from the ASOS. In general, the average ratio of the RWIS RPU’s wind magnitude to that from the ASOS was 0.76 (the average ratio of the gust magnitude was 0.82). The average difference between the RWIS RPU’s wind direction and that of the ASOS was 16°. 1.5 Airport Information 1.5.1 General YIP was located 24 miles southwest of Detroit, Michigan, at an elevation of 716 ft. It had six runways: 5R/23L, 5L/23R, and 9/27. Runway 5R/23L was 7,543 ft long and 150 ft wide with a grooved concrete surface.18 Runway 23L had a 0.2% upslope gradient and a 200-ft paved blast pad (for runway 5R) off the departure end. The airport was certificated under Part 139 and was in Class D airspace during ATCT operating hours. 1.5.2 Runway Safety Areas The airport was equipped with RSAs at the ends of runways 5L/23R and 5R/23L that met the dimensional standards specified in FAA Advisory Circular (AC) 150/5300-13A, Change 1, “Airport Design.” The accident airplane crossed the RSA beyond the end of runway 23L before it ran through the airport perimeter fence and struck a raised road. According to the FAA Airports Division, the RSAs at YIP had been upgraded between 2006 and 2009. The NTSB notes that these upgrades were responsive to NTSB Safety Recommendation A-03-11 (see section 1.12.2) and were part of a national program that the FAA initiated in 1999.19

18 The 150-ft width was verified with measurements taken using current satellite imagery. (The 2016 Jeppesen 20-9 airport chart listed the width as 161 ft; more recent Jeppesen and FAA airport charts listed the width as 150 ft.) 19 The FAA had issued Order 5200.8 in 1999 to bring all RSAs in the United States up to standards specified in AC 150/5300-13, whenever possible. AC 150/5300-13 was current when we issued Safety Recommendation A-03-11; the version current at the time of this report was AC 150/5300-13A, Change 1 (FAA 2014a).

NTSB Aircraft Accident Report 16 The FAA stated that improving the RSAs on the ends of runways 5R/23L and 5L/23R involved land acquisition, filling in a ravine (the maximum depth of which was 30 ft in some locations), removing a taxiway, moving or making frangible approach lighting systems, removing structures and concrete markers from the RSA, and moving the perimeter fence and a road about 200 ft. The YIP RSA improvement project had cost $20 million, with a federal investment of $19 million. Figure 8 shows aerial photographs provided by the FAA of the RSA off the end of runway 23L both before and after the improvements. Source: FAA (some labels added by NTSB) Figure 8. Photographs of the RSA off the departure end of runway 23L before upgrade (left) and after (right). As shown in the left side of figure 8, the former RSA configuration included a taxiway (which no longer exists) and a different location of the airport perimeter road. 1.6 Flight Recorders The airplane was equipped with an L-3/Fairchild FA2100 model flight data recorder (FDR) that records a minimum of 25 hours of flight data in a digital format using solid-state flash memory as the recording medium. The NTSB examined the unit, found it to be in good condition, and extracted the data normally. (Select FDR data referenced throughout this report are time, acceleration, airspeed, altitude, attitude, engine, and various other parameters, including elevator position and control column position.) The FDR recording contained about 368 hours of data; data from the accident flight and the airplane’s previous takeoff and landing were used to support an airplane performance study (see section 1.10.1). The airplane was also equipped with an L-3/Fairchild FA2100-1020 model CVR that records onto solid-state memory modules a minimum of 2 hours of digital audio from four channels (typically one channel for each pilot, one channel for a cockpit observer, and one channel for the cockpit area microphone [CAM]). The NTSB examined the unit, found it to be undamaged, and extracted 124 minutes of audio information (from 1249:35 to 1453:49). For the accident flight, the CVR provided excellent-quality audio information from one channel of the flight crew audio panel

NTSB Aircraft Accident Report 17 and good-quality audio from the CAM.20 The CVR group prepared a partial transcript for the recording, the timing for which was correlated with common events recorded by the FDR and converted to reflect local time. (The transcript can be found in Appendix B.) 1.7 Wreckage and Impact Information As described in section 1.1, the airplane ran through the airport perimeter fence and struck a raised, paved road before coming to a stop with the tail resting on the road. The nose landing gear and both main landing gear were bent, fractured, and displaced aft; all examined fracture surfaces exhibited features consistent with overstress. The fuselage lower skin panel assemblies, including longeron and frames, exhibited severe buckling, deformation, missing sections, and severed internal structure at several locations; the damage was consistent with ground impact after the collapse of the landing gear. 1.8 Medical and Pathological Information Postaccident drug and alcohol testing for the captain and the check airman indicated negative results. 1.9 Survival Aspects 1.9.1 Emergency Evacuation All four flight attendants (identified by the company as flight attendants A, B, C, and D) were seated in their jumpseats at the time of the runway excursion. The lead flight attendant (flight attendant A) was seated with flight attendant C in a two-place jumpseat at the door exit on the front left side of the airplane (1L door), flight attendant B was seated alone in a two-place jumpseat at the tailcone exit, and flight attendant D was seated at the door exit on the rear left side of the airplane (2L door). The airplane was also equipped with a door exit on the front right side (1R door) and four overwing exits (a forward and aft exit on each wing). The flight attendants described (in postaccident statements and interviews) that the takeoff roll was normal until they felt the airplane’s brakes suddenly applied, then they felt the airplane “shake” and “jump and jerk” after it left the runway. (The CVR captured sounds consistent with the airplane departing the paved surface at 1452:23.) The lead flight attendant reported seeing the terrain outside the airplane change, and both he and flight attendant C began shouting “heads down, stay down” until the airplane came to a stop. (The CVR captured these instructions at 1452:27.) Flight attendants B and D said that they heard the pilot’s “evacuation” announcement after the

20 According to the CVR quality rating scale, generally, excellent-quality audio allows easy and accurate understanding of virtually all of the crew conversations (with possibly one or two words unintelligible), and good-quality audio enables such understanding for most of the crew conversations (with possibly several words or phrases unintelligible). For the accident flight’s recording, two of the four recorded channels did not provide useful audio information. (One channel contained no audio information, and another, which lacked microphone input from the flight crew audio panel, recorded only radio/intercom information.)

NTSB Aircraft Accident Report 18 airplane came to a stop, but neither the lead flight attendant nor flight attendant C recalled hearing it. The lead flight attendant said that he assessed the conditions and opened the 1L door to initiate the evacuation. He said he had to pull twice on the slide’s manual inflation handle before it inflated; once it did, he started evacuating passengers from that exit. Flight attendant D said that she assessed the 2L door, opened it, and evacuated passengers. She said that, at first, she thought the engine was still running but then realized it was the wind pushing the engine blades. Flight attendant C said that she assessed the 1R door and opened it, but when she pulled the manual inflation handle for the slide, it did not inflate. When she pulled it a second time, the slide deployed from the slide pack and hung outside the door but did not inflate. She blocked the unusable exit and redirected passengers to use another exit. Flight attendant B said that he assessed the tailcone exit door and opened it, but it opened only a few inches before becoming stuck by a seatbelt buckle (from an unbuckled jumpseat seatbelt) wedged under it. He said the Ameristar ground security coordinator (who was trained as a flight attendant) was near him and yelled to the passengers, “Exit blocked, go forward!” Flight attendant B pushed the door closed, cleared the seatbelt from its path, then opened the door fully. He saw that the tailcone had not jettisoned. He went to the end of the catwalk and pulled the manual jettison handle; the tailcone fell, and the slide inflated. He went back to the cabin to start the evacuation but found that everyone had already exited the airplane. Flight attendants described that, during the evacuation, the passengers were “incredibly calm and responsive,” “followed flight attendant directions,” and “did not take or attempt to take luggage” or personal belongings with them. They also stated that, after exiting via the slides, the passengers remained orderly and quickly moved away from airplane. Flight attendants walked through the airplane and checked the lavatories to ensure that all passengers had evacuated. After all four flight attendants evacuated, they gathered the passengers to conduct a head count. All 110 passengers and 6 crewmembers evacuated the airplane with one reported minor injury (a leg laceration that required sutures). The investigation found that, of the airplane’s eight exits, four were used: passengers evacuated from the 1L and 2L doors and the left and right forward overwing exits. The aft left and right overwing exits were not opened, and, as described above, no passengers used the 1R door exit (with the unusable slide) or the tailcone exit. Investigators retained the 1R door slide and inflation assembly for further examination (see section 1.10.5). Postaccident examination of the tailcone jumpseat found that both the left and right seatbelts were unbuckled.21 The emergency procedures section of Ameristar’s Flight Attendant Manual (FAM) stated that the cabin floor (due to a damaged condition or displaced items) may have obstacles to egress.

21 According to the FAM (page 3-17 [G][4]), unoccupied jumpseats should be stowed with the seatbelts buckled. It was not determined which seat’s belt initially prevented the tailcone exit door from fully opening.

NTSB Aircraft Accident Report 19 1.9.2 Runway Safety Area RSAs are designed to reduce injuries to persons and damage to aircraft in the event of a runway overrun, veer-off, or undershoot. As described in section 1.5.2, YIP was equipped with a dimensionally compliant RSA off the end of runway 23L that had been upgraded between 2006 and 2009. The improvements included removing a taxiway and relocating the perimeter fence and road (some of which are visible in figure 8). According to the FAA Airports Division, the improved RSA at the end of runway 23L “provided a clear area to accommodate the [accident airplane’s] excursion. The FAA believes the RSA performance in this instance demonstrates the design standard’s contribution to aircraft accident survivability in the event of an excursion.” 1.10 Tests and Research 1.10.1 Airplane Performance Study The NTSB performed an airplane performance study using FDR data for the accident flight (and the previous flight and maintenance check); CVR data; postaccident calculated airplane weight and balance information (see section 1.3.1.2); a calculated 10-kt headwind component; and site mapping information that included the locations of tire marks on the runway, grass and dirt disruption beyond the end of the runway, and the airplane’s final location (see figure 9).22 Figure 9. Orthomosaic image showing runway, airplane, and annotated locations of tire marks.

22 The study used FDR-recorded longitudinal acceleration data as a basis for calculating the airplane’s groundspeed and ground track, and the 10-kt headwind component was calculated using the FDR-recorded airspeed and integrated groundspeed (and was consistent with anemometer-reported wind information on the day of the accident, as described in section 1.4.2.3). The ground mark and airplane resting location information, including an orthomosaic image, was provided by the Michigan State Police, who photographed the site using a small unmanned aircraft system.

NTSB Aircraft Accident Report 20 FDR data showed that, on March 6, 2017, the airplane was powered up for about 2 minutes for a maintenance check (unrelated to the elevator system) while parked at YIP. (This check occurred more than 5 hours after the flight crew had parked the airplane following the completion of its most recent flight.) Review of the data showed that, while the airplane was powered on for the check, the left elevator was about -2° TED, and the right elevator was about 13° TEU. The check occurred about 0710 (based on correlating the FDR time with local time), and wind at the time was relatively light. The airplane was not powered up again until the day of the accident. 1.10.1.1 Accident Flight Takeoff FDR data showed that, from the time that the accident airplane was first powered up (about 1236) on the day of the accident, repositioned for loading (about 1242 to 1249), and then prepared and taxied for takeoff (beginning about 1435), the left elevator moved in the wind to various positions between about -16° TED and 27° TEU, but the right elevator did not move and remained about -16° TED. As described in section 1.1, before takeoff, the flight crew determined V1, VR, and V2 to be 139 kts, 150 kts, and 150 kts, respectively. (They calculated VR to be 142 kts but chose to increase it about 5 kts because of the strong, gusty wind conditions.) The performance study determined that, during the attempted takeoff, at 1451:56 (about 1 second after the check airman called “V1”), the airplane was at an airspeed of about 138 kts, a slight input on the elevator control column was applied, the airplane’s left elevator moved from -15° TED to -13° TED, and the right elevator did not move, remaining about -16° TED.23 Five seconds later, at 1452:01 (when the check airman called “rotate”), the airspeed was about 151 kts, and a large control column input was applied over the next 8 seconds. The left elevator moved to about 15° TEU, and the right elevator remained about -16° TED until the last 3 seconds of maximum control column input, at which time the right elevator moved to about -13° TED. The airplane did not respond in pitch and did not rotate (see figure 10).

23 As described in section 1.3.2.1, only the elevator control tabs (not the elevators) are directly controlled by the cockpit control columns. Control column input deflects the elevator control tabs through a direct mechanical linkage, and the elevators move as a result of aerodynamic forces on the tabs to produce the desired change in airplane pitch. The FDR does not record elevator control tab position.

NTSB Aircraft Accident Report 21 Figure 10. Airplane performance parameters over time. Note: “CA” indicates comments from the check airman, while “CO” indicates comments from the captain. The study found that the brakes were applied at 1452:08 (about the same time the captain called “abort”), and the control column was released 1 second later. The study determined that the airplane’s maximum airspeed had reached 173 kts (163 kts calculated groundspeed) before it began to decelerate with the brake application and continued to decelerate with the deployment of spoilers at 1452:10 and thrust reversers between 1452:13 and 1452:15. The study determined that the airplane overran the end of the paved surface at 1452:16 and struck the raised airport perimeter road at 1452:24, at which time the accelerometer data abruptly stopped. (It resumed 11 seconds later and recorded loads consistent with the airplane at rest.) Using integrated groundspeed data, the study determined that the airplane traveled 8,600 ft from the start of its takeoff roll to its final location; this information was used as a basis to calculate that the takeoff roll began about 80 ft from the runway 23L threshold. The study determined that, during the takeoff, the airplane had traveled 5,850 ft before the brakes were applied, which left about 1,800 ft of paved surface remaining (including the paved blast pad area). The first tire mark evidence on the runway was about 5,956 ft down the runway (about 5,876 ft from the beginning of the takeoff roll), with about 1,780 ft of paved surface remaining. The airplane’s calculated groundspeed was 100 kts when it left the paved surface (about 7,650 ft from the start of the takeoff roll) and 40 kts when it struck the raised perimeter road and came to a stop (about 8,600 ft from the start).

NTSB Aircraft Accident Report 22 1.10.1.2 Deceleration Profile and Distance to Stop The study used the deceleration profile of the accident flight’s integrated groundspeed over distance to determine that, to successfully stop the airplane on the runway, the crew would have had to start braking once the airplane was about 5,000 ft into the takeoff roll. (The accident crew began braking about 5,800 ft into the roll.) When the accident flight was 5,000 ft into its takeoff roll, the airspeed was about 164 kts (groundspeed 151 kts). The study determined that, at that time, the left elevator was only beginning to reach a neutral position (it had not yet moved to TEU) in response to the control column input that had begun 3 seconds earlier (and the right elevator remained TED). For comparison, the study examined FDR data from the flight crew’s previous takeoff in the accident airplane and found that the airplane took about 3 seconds to begin responding in pitch to the control column input.24 1.10.2 Elevator Component Examinations and Testing Examination of the damaged actuating crank from the right elevator’s geared tab revealed that the bearings were free to rotate with no signs of binding. Materials properties testing on the actuating crank and links yielded results consistent with the part requirements specified on the manufacturer’s engineering drawings. Examination of each elevator’s torsion bar and stop arm revealed no evidence of damage. Hardness testing on various locations on each torsion bar yielded results consistent with the manufacturer’s drawings. Magnetic particle testing (which can detect cracks down to a size of 0.010 inch) performed on the splines of the right elevator’s torsion bar and stop arm revealed no indication of cracking. Sealant was observed on the left elevator’s torsion bar bearing surfaces, and investigators had difficulty removing the bar from the elevator. Examination of each elevator’s damper revealed that each had a broken safety wire, but none of the bolts intended to be secured by the wires appeared to be displaced. Functional testing of both dampers was performed in accordance with the component overhaul manual procedures. Visual inspection of both elevator boost cylinders showed no evidence of anomalies. Functional testing of both boost cylinders in accordance with the component overhaul manual procedures revealed that the right elevator’s boost cylinder passed all tests except for the relief valve reseat test (it did not meet the required minimum reseat pressure of 2,050 lbs per square inch [psi], having tested to a maximum of 1,950 psi), and the left elevator’s boost cylinder passed all tests. 1.10.3 Wind Simulation The NTSB provided weather data from YIP and photogrammetric products developed using imagery obtained from a small unmanned aircraft system (sUAS) (see section 1.13) to Boeing for use in performing a computational fluid dynamics (CFD) model wind simulation.

24 For the previous takeoff, the airplane departed March 5, 2017, from Lincoln, Nebraska, en route to YIP. During that takeoff, the airplane was at an airspeed of about 140 kts when the control column input was applied.

NTSB Aircraft Accident Report 23 Because the airplane was parked downwind of a large hangar and other structures that could affect wind flow, the CFD study was used to determine a plausible scenario of the wind flow pattern at the airplane’s parked location. The simulation examined a period of variable wind magnitudes, directions, and gusts simulated over three-dimensional (3-D) objects developed from images captured by the sUAS. Boeing further processed 3-D obstacles to optimize them for use in the CFD simulation and inserted a 3-D model of an MD-83 to represent the position of the accident airplane’s elevators at its parked location (see figure 11). The analysis used ASOS-observed wind data to initialize the simulation.25

Figure 11. 3-D visualization of wind simulation results for a discrete time showing the locations of the hangar and airplane. Wind flow from the west (left side of image) is disrupted downwind of the hangar. Note: The airplane’s horizontal tail surfaces are highlighted in green. The results of the wind simulation revealed that, shortly after a 55 kt gust from 261° was introduced (consistent with the maximum ASOS-observed gust), a small-scale horizontal gust of 58+ kts moved over the airplane. The gust appeared to be related to turbulence generated downwind of the hangar. The simulation also sampled and tabulated wind data at several locations on the airplane’s tail for the time period that the maximum gusts were affecting the airplane. The tabular data for the simulation showed instances of upward vertical wind followed within 1 second by downward vertical wind at the airplane’s tail, including the elevators. The results of the simulation enabled the NTSB to gain an understanding of the relative wind flow and possible wind

25 A postmodel analysis verified that the prescribed wind in the simulation could be correlated to the observed wind from the ASOS. Thus, the study concluded that the use of ASOS-observed wind data to initialize the simulation was valid.

NTSB Aircraft Accident Report 24 speed fluctuations in the area where the accident airplane was parked (see figures 12 and 13), which assisted in designing a representative test plan for the airplane’s elevator system.

Figure 12. 3-D visualization of wind simulation results for a discrete time showing turbulence generated downwind of the hangar. Note: The airplane’s horizontal tail surfaces are highlighted in green (fuselage is not shown).

Figure 13. Vertical cross-section visualization of wind simulation results for a discrete time showing flow pattern and horizontal (“U”) and vertical (“w”) wind magnitudes near the accident airplane’s elevators (view from behind looking forward). Note: The airplane’s horizontal tail surfaces are highlighted in green (fuselage is not shown).

NTSB Aircraft Accident Report 25 1.10.4 Static and Dynamic Elevator Load Testing Considering the CFD wind simulation results and the overcenter position of the right elevator’s geared tab components, the NTSB designed several series of static and dynamic elevator load tests to determine how an exemplar elevator system would perform under various gust loads. The tests were performed at the Boeing laboratory in Huntington Beach, California, using a test rig, which included a ground-based fixture supporting an exemplar horizontal stabilizer. Components from the accident airplane served as an exemplar elevator system and included the left elevator (with its torsion bar and stop arm assembly), right elevator damper, and right boost cylinder.26 (Accident airplane components were examined and/or tested as described in section 1.10.2 before being used on the test rig.) A hydraulic test bench supplied pressure to the boost cylinder, representative of the airplane’s hydraulic system (see figure 14). Figure 14. Test rig representing an exemplar horizontal stabilizer and elevator system.

26 The elevator damper and boost cylinder are not left- or right-specific and can be mounted on either elevator.

NTSB Aircraft Accident Report 26 In preparing the test plan, the NTSB used the hinge moment formula specified in 14 CFR 25.415 (described in section 1.3.2.3) to calculate the hinge moments needed to simulate elevator loads from ground gusts of 25, 55, 60, 65, 70, and 75 kts (the maximum recorded wind gust at YIP was 55 kts). For most tests, the calculated loads were distributed across 11 hinge points along the trailing edge of the elevator on the test rig using weights secured at each hinge point and an assumed loading profile of 60% loading on the control tab, 30% loading on the geared tab, and 10% loading on the antifloat tab. (Some tests required a different loading profile to simulate boost cylinder activation.) For both the static and dynamic tests, a beam deflection gauge measured the deflection (rotation) of the torsion bar and stop arm assembly, calibrated such that 0° deflection represented the torsion bar position when the stop arm was in contact with the TED stop and there was no load on the elevator. 1.10.4.1 Results Summary For each static load test, the elevator was positioned such that the stop arm was resting on the TED stop when the load was applied. Tests that simulated gust loads of 25, 55, and 75 kts (the only speeds tested for the static condition) both with and without boost cylinder activation revealed that the applied loads resulted in torsion bar rotation and elevator position travel beyond the nominal unloaded TED stop position of 16.5°. Each successive increase in load resulted in increased torsion bar rotation and elevator surface deflection, and the tests performed with the boost cylinder activation produced comparatively greater rotation and deflection for each load than the tests without the activation. None of the static tests resulted in the geared tab linkage becoming overcenter. For each dynamic test, the load was applied to the elevator; the elevator was then raised to either a neutral or full-TEU position (using a forklift and lifting straps) before it was released (using a quick-release mechanism). Releasing the lifted elevator from either the neutral or full-TEU position allowed it to travel downward and dynamically contact the TED stop. A series of dynamic tests without the boost cylinder activation and with the elevator starting in either a neutral or full-TEU position did not result in the geared tab linkage becoming overcenter for simulated gust loads of 25 and 55 kts. For the 60-kt simulated gust load, the linkage became overcenter for only the full-TEU initial elevator position test (see table 2). For the 65-, 70-, and 75-kt simulated gust loads, the linkage became overcenter for the neutral initial elevator position tests (the full-TEU initial position was not tested for these loads).27

27 In addition, dynamic tests with the boost cylinder activated were not conducted for loads above 25 kts due to concerns about damaging the test rig. For the 25-kt gust load, the linkage did not become overcenter for either the neutral or full-TEU initial elevator position.

NTSB Aircraft Accident Report 27 Table 2. Results of dynamic load tests (without boost cylinder). Gust speed Elevator initial position Maximum stop arm/ torsion bar rotation Maximum estimated elevator surface position* Geared tab linkage overcenter? 25 kts Neutral 1.98° 17.82° No TEU 2.91° 18.44° No 55 kts Neutral 4.84° 19.73° No TEU 6.20° 20.64° No 60 kts Neutral 5.43° 20.12° No TEU 7.16° 21.28° Yes 65 kts Neutral 6.17° 20.62° No 70 kts Neutral 6.65° 20.94° Yes 75 kts Neutral 6.90° 21.10° Yes

• Estimated elevator surface position calculated as follows: (torsion bar rotation x 0.667) + nominal

elevator TED stop position of 16.5°. 1.10.4.2 Additional Test: Effect of Lifting Force on Locked Linkage After the completion of the dynamic tests (described in the previous section), investigators sought to determine if adding a lifting force (to simulate airplane-nose-up air loading that would develop during the takeoff roll) would result in damage to the geared tab actuating crank and links similar to the damage observed on the accident airplane. With the geared tab inboard linkage in an overcenter position, an upward force was applied to hinge locations on the control tab. When the load cell reached about 800 lbs, the links began to fail; the load cell peaked at 975 lbs before the links completely bent outboard (see figure 15). Figure 15. Damage to the left geared tab inboard links and actuating crank (left) after load testing versus damage observed postaccident on the accident airplane’s right geared tab inboard links and actuating crank (right).

NTSB Aircraft Accident Report 28 1.10.5 Evacuation Slide and Inflation Assembly Examination Postaccident examination of the 1R door evacuation slide and inflation assembly (consisting of a gas reservoir and valve) was performed at Zodiac Aerospace (the parent company of the slide manufacturer, Air Cruisers) in Wall Township, New Jersey. By design, when the evacuation system is deployed, the packed slide releases below the airplane door. The manual inflation handle for the evacuation slide is directly connected to the valve release cable routed inside the slide inflation valve housing, and within the housing, the cable ball end engages into a pulley recess to mechanically operate the valve. During normal operations, manually pulling the valve release cable (via the handle) rotates the pulley to open the inflation valve. Once open, the valve releases the compressed gas from the reservoir into the slide to inflate it. Examination of the slide and inflation assembly found that the reservoir and valve were in place in the slide packboard. The reservoir was found fully charged, and the valve was in the closed position without the manual inflation cable in place. Examination of the cable, which had come free of the housing when pulled by the flight attendant, found no evidence of anomalies. The valve was reassembled with the valve release cable installed for testing. A test gauge was attached to the outlet fitting. Pulling the cable required 15 lbs of force to open the valve, which was consistent with the maximum force specified in the CMM. The valve operated smoothly, and the reservoir system pressure reading was 2,832 psi. (The CMM specified an expected value of 2,840 psi.) Investigators subsequently closed the valve, removed the test gauge, and attached the evacuation slide to test the system. Pulling the valve release cable resulted in successful slide inflation, with an internal slide pressure of 2.72 psi. (The CMM specified an expected value of 2.3 to 3.25 psi.) Disassembly examination of the valve revealed chafe marks inside the pulley housing near the cable through hole, which is inconsistent with what would be expected during normal valve operation. Investigators found it was possible to incorrectly install the valve release cable in the pulley housing such that that ball end would catch in the area where the chafe marks were observed. Such an incorrect installation would not enable the cable ball end to engage the pulley recess to properly operate the valve. On July 14, 2017, Zodiac Aerospace issued a revision to the CMM to provide more descriptive valve testing procedures intended to prevent improper cable installation, which included the following instructions: Verify that the valve release cable is pulled into the pulley housing as the pulley is rotated to the valve closed position…. Gently pull or tug on the valve release cable. Looking closely around the gaps in the valve cover assembly on the inflation valve, verify that there is slight movement of the pulley and the lock pin due to the movement of the valve release cable. The valve release cable should not pull free of the inflation valve assembly. If the valve release cable can withdraw from the valve assembly, either the lock pin is not fully engaged or the inflation cable was not fully inserted into the pulley during the arming procedure. Repeat [the preceding steps] to resolve unacceptable cable movement.

NTSB Aircraft Accident Report 29 1.11 Organizational and Management Information In accordance with 14 CFR 119.21(e), Ameristar Air Cargo, Inc., was authorized to conduct supplemental operations in common carriage under Part 121 and to use the business names Ameristar and Ameristar Charters. The company’s principal base of operations was in Addison, Texas, and it employed 16-17 pilots and about 20 flight attendants. The company fleet consisted of two Boeing 737, four DC-9, and two MD-83 airplanes (including the accident airplane). An organizational chart in the General Operations Manual (GOM), chapter 1, showed that all line pilots, ground instructors and check airmen reported directly to the chief pilot. The chief pilot reported directly to the director of operations (DO), who, along with the director of safety, reported to the company president. The pilots flew about 20 to 25 hours per month. By policy, pilots had an 18-day schedule in which they were on-call. The average flight segment was about 1 to 1.5 hours. According to the GOM, the DO’s duties included, in part, ensuring that flights were monitored with respect to departures, arrivals, and diversions; maintenance and mechanical delays; and conditions that may adversely affect the safety of flight. The DO was jointly responsible with the PIC for the initiation, continuation, diversion, and termination of a flight in compliance with regulations and OpSpecs. According to the director of safety, voluntary reporting of safety information was accomplished through irregularity reports that were submitted to the DO and the chief pilot and were forwarded to the director of safety for review. The director of safety said he typically received about two irregularity reports per month. 1.11.1 Risk Assessment Program Ameristar’s risk assessment program (RAP), which was defined in the company’s Safety and Emergency Response Program, was a process for data collection, reporting, and audits. The company used the collected data to identify latent unsafe conditions. According to the director of safety, the company was in the process of implementing a safety management system (SMS).28 According to the RAP, flight-followers were required to review each flight for hazards and risk mitigation strategies, prepare the flight release, and complete a risk assessment worksheet to provide to the pilots with their flight release paperwork. The worksheet, which was completed via a computer program, included elements with numerical values for predetermined operational risks. The worksheet scored total risk on a scale of 0 to 30; a score of 1-10 was considered low risk, 11-20 medium risk, and 21-30 high risk. According to the director of safety, any score that was 20 or greater required the DO’s or the chief pilot’s approval to conduct that flight, and the captain always had the right to discuss any flight with them.

28 According to the FAA, an SMS is an organization-wide, comprehensive, and preventive approach to managing safety. It includes a safety policy, formal methods for identifying hazards and mitigating risk, and promotion of a positive safety culture. An SMS also provides assurance of the overall safety performance of an organization (FAA 2015). As of March 9, 2018, Part 121 operators must have an SMS that meets the requirements of 14 CFR Part 5.

NTSB Aircraft Accident Report 30 The risk assessment conducted for the accident flight by the flight-follower and provided to the pilots indicated a total score of 0 (low risk). The worksheet box for “[Weather] — Thunderstorms at Departure or Destination or wind gusts above 30 [kts]” was not checked for the accident flight. According to the company Safety and Emergency Response Manual (Appendix B-1, page 4), the score for wind gusts above 30 kts was 4 points. 1.11.2`Flight Release and Weather Information for Flight Crews 1.11.2.1 Accident Flight’s Release The company used a software program to develop its flight plans that would automatically populate the flight release with the most current weather. The original flight plan was generated at

1. The flight-follower for the accident flight said that ATC did not accept the initial flight plan,

and he generated a new flight release at 1213 that changed the routing of the flight. He did not update the weather information from the earlier release. The flight release contained one METAR for YIP, which was the 1153 report that included wind from 260° at 35 kts with gusts to 50 kts and the remark that a peak wind from 260° at 55 kts occurred at 1139. The release contained a forecast for YIP that expected conditions from 1100 to include wind from 240° at 33 kts with gusts to 47 kts and conditions from 1600 to include wind from 260° at 34 kts with gusts to 48 kts. 1.11.2.2 Company Procedures According to the GOM (chapter 4, paragraph 4.10.1), all flights were to be filed and flown under instrument flight rules (IFR), and flight crews must obtain the ceiling and visibility values (or a specified runway visual range) from the latest weather report to determine whether a visual takeoff can be performed. The GOM (paragraph 4.2.10) also specified that pilots must use the airplane radios to obtain approved weather information to include at least the ceiling, visibility, altimeter, temperature, wind direction, and wind velocity. According to the GOM, any of the following sources were acceptable:

1. [Automated weather observing system (AWOS)]-3 or above;
2. A flight service station receiving hourly weather information from

departure/destination airport;

1. An operating control tower; or
2. A certified weather observer that is capable of transmitting the current weather

to the pilots at least 30 minutes before estimated time of arrival or departure and must begin in time to provide pilots with an observation before beginning an approach or departure. Basic weather watch must not be discontinued until the arrival or departure is completed.

NTSB Aircraft Accident Report 31 The GOM (paragraph 4. 2.10) also stated, in part, that pilots departing from an uncontrolled airport that has automated weather capability (like ASOS) should monitor automated broadcasts. According to the GOM, in the event that temperature information is missing from an automated broadcast, pilots should follow the company’s procedure for obtaining a real-time mesoscale analysis (RTMA) temperature from company personnel. 1.11.2.3 Related Regulations Title 14 CFR 121.119, “Weather reporting facilities,” stated the following: (a) No certificate holder conducting supplemental operations may use any weather report to control flight unless it was prepared and released by the [NWS] or a source approved by the Weather Bureau.… (b) Each certificate holder conducting supplemental operations that uses forecasts to control flight movements shall use forecasts prepared from weather reports specified in paragraph (a) of this section. Title 14 CFR 121.599, “Familiarity with weather conditions,” which applied to supplemental operations, stated in paragraph (b) that “[n]o [PIC] may begin a flight unless he is thoroughly familiar with reported and forecast weather conditions on the route to be flown.” Title 14 CFR 121.651, “Takeoff and landing weather minimums: IFR,” stated the following: (a) Notwithstanding any clearance from ATC, no pilot may begin a takeoff in an airplane under IFR when the weather conditions reported by the [NWS], a source approved by that Service, or a source approved by the Administrator, are less than those specified in - (1) The certificate holder’s [OpSpecs]; or (2) Parts 91 and 97 of this chapter, if the certificate holder’s [OpSpecs] do not specify takeoff minimums for the airport. In a response to an NTSB inquiry for a legal interpretation of 14 CFR 121.651 with regard to the circumstances associated with the accident day (that is, equipment outages), the FAA responded in a June 8, 2017, memorandum that stated, in part, the following: Although [14 CFR] 121.651(a) is silent on the operational capabilities of weather facilities and the recency of reported weather, reported weather conditions are a precondition for takeoff, which indicates a nearness in time. Furthermore, [P]art 121 contains other weather report and aircraft performance regulations that require reports of weather conditions that are occurring at the time of takeoff. For example, [14 CFR] 121.189(e) requires, in relevant part, “correction…for the ambient temperature and wind component at the time of takeoff” when determining maximum weights, minimum distances, and flight paths.

NTSB Aircraft Accident Report 32 Accordingly, to operate consistently with [14 CFR] 121.651(a) and other related regulations, a pilot must have a reasonable certainty that conditions existing at the time of takeoff have been accurately reflected by the weather report that is used to determine the flight will meet or exceed the required minimums and thereby ensure safe operation of the aircraft. 1.11.2.4 Flight Crew’s Efforts to Obtain Weather Information During interviews, the flight crewmembers stated that, before departure, they attempted to obtain the most current weather information at YIP but that, due to the power outages at the airport, the information was incomplete. The check airman said that he used his cell phone to call the automatic terminal information service (ATIS) frequency but received a report that was “just an updated version of the previous weather with winds about 260[°] at 40 [kts].” (The CVR captured that, at 1314:39, the flight crew listened to the ATIS recording that was from 1153, and the check airman mentioned calling to “ask can we legally use this weather.” The CVR captured numerous subsequent phrases from the check airman consistent with cell phone calls to obtain weather information and ATC clearances up until 1448:46.) The check airman stated that he also used his cell phone to obtain the weather observation at Detroit Metropolitan Wayne County Airport (DTW), about 8 nautical miles (nm) east of YIP, and to call the DO to obtain an RTMA temperature at YIP. The flight crewmembers said that they used a windsock to determine the most favorable runway for takeoff. The CVR captured the flight crew discussing the windsock at 1437:07. Windsocks nearest to the accident airplane during its taxi and takeoff included a primary windsock at midfield (on the south side of runway 23L) and supplemental windsocks near approach ends of runways 23L and 27. According to the airport authority, all of the windsocks at the field were universal and complied with FAA AC 150/5345-27E, “Specification for Wind Cone Assemblies,” which specified that a fabric windsock must fully extend when exposed to a wind of 15 kts (FAA 2013). 1.11.3 Flight Crew Procedures 1.11.3.1 High-Wind Parking and Inspection Procedures An amplified normal checklist in Ameristar’s Boeing DC-9 (Boeing MD-83) Aircraft Operating Manual (AOM) (volume 1, page 1.2-2) contained the following caution:[29] Caution Airplanes that are exposed to high-sustained winds, or wind gusts, greater than 75 mph are susceptible to elevator damage and/or

29 The AOM stated that “a caution is used to highlight specific information [that], if not followed, could cause damage to the equipment.” It also indicated that “a warning is used to highlight specific information [that], if not followed, could cause damage to the equipment and harm to the operator and occupants.”

NTSB Aircraft Accident Report 33 jamming. In accordance with the …[AMM], airplanes suspected to have been exposed to these conditions must have visual and physical inspections (moving surfaces by hand) of all flight controls and operational check of these [systems].[30] Ameristar’s Boeing DC-9 (Boeing MD-83) AMM contained the following warning and caution under “Parking: General Procedures”: WARNING: If wind gusts are expected to exceed 69 mph, aircraft should be headed into wind to prevent structural damage to primary control surfaces. CAUTION: If there is any possibility that [the] aircraft has been subjected to winds in excess of 75 mph, and aircraft has not been headed into wind or wind direction changed during parking, perform visual and physical inspections (moving the surfaces by hand) of all flight controls and an operational check of these systems. According to the DO, a pilot would be responsible for alerting maintenance personnel if the pilot knew that a parked airplane was exposed to wind that exceeded the 65 kt limit, but pilots were not expected to monitor wind when they were off duty because such an activity would be considered duty time.31 He said that Ameristar did not have a process or procedure for monitoring wind affecting parked airplanes or a policy that placed the duty on a specific person or persons to take action when wind exceeding 65 kts affected or was forecasted to affect the parked location of a company airplane. The director of quality control/assurance also stated that the company did not have notification procedures for wind exceeding 65 kts at locations where airplanes are parked. He said that maintenance personnel would be responsible to conduct the required inspections specified in the AMM, but it would take a system to monitor the airplane and airports at all times to determine who would notify maintenance personnel of an airplane’s potential high-wind exposure. He said that, on the day of the accident, no one notified maintenance about high wind possibly affecting the accident airplane. During an interview, the flight-follower for the accident flight stated that he did not monitor wind when an airplane was on the ground, and he had not known about the 65-kt wind gust

30 A physical inspection of the elevators and tabs (which are about 30 ft above the ground) would require the use of a lift or other equipment. 31 According to the GOM (page 41), duty time (which differed from a flight duty period) included activities related to ground school, company errands, or activities that the company directed but were not associated with a flight. By definition, a flight duty period began when a flight crewmember was required to report for duty with the intention of conducting a flight and ended when the airplane was parked after the last flight. It included the duties performed by the flight crewmember on behalf of the company that occur before a flight segment or between flight segments without an intervening required rest period.

NTSB Aircraft Accident Report 34 limitation before the accident flight. He said he did not know if it was the pilot’s or mechanic’s responsibility to monitor the wind when the airplane was on the ground. A review of the GOM found no reference that defined a duty or responsibility for a flight crewmember to monitor a particular parked airplane for wind effects when they were not operating it (such as, during an overnight situation after a flight duty period). 1.11.3.2 Elevator Preflight Inspection Procedures The AOM stated that the flight crew’s preflight walkaround inspection of the airplane helps provide assurance of its airworthiness. The AOM’s normal checklist (page 1.2-8) for the preflight inspection of the elevators stated, “Elevators and tabs….Condition Good.” The AOM’s amplified normal checklist (page 1.2-3) indicated that the flight crews should check surfaces and structures to ensure that they are undamaged and the “flight control surfaces [are] clear.” Training Ameristar provided its pilots preflight inspection training and proficiency checks during initial and recurrent training in accordance with 14 CFR 121.441, “Proficiency checks.” According to the preflight inspection proficiency requirements specified in Part 121, Appendix F, the pilot must (1) Conduct an actual visual inspection of the exterior and interior of the airplane, locating each item and explaining briefly the purpose for inspecting it; and (2) Demonstrate the use of the prestart check list, appropriate control system checks, starting procedures, radio and electronic equipment checks…. Ameristar was approved to use an “Advanced Pictorial Preflight” for the preflight training and proficiency checks per OpSpec A005, exemption 4416Q.32 The pictorial, which consisted of a slide presentation, included a slide with a photograph showing a view from the ground of primarily one elevator and its tabs (see figure 16). A tabular description of the presentation referenced the proficiency check requirements and described the slide as showing the “elevators and tabs” as the “item to be checked” and indicated that the photograph depicted “condition good.”

32 According to the proficiency check requirements specified in Part 121, Appendix F, an approved pictorial that “realistically portrays the location and detail of preflight inspection items and provides for the portrayal of abnormal conditions may be substituted for the preflight inspection.”

NTSB Aircraft Accident Report 35 Source: Ameristar Figure 16. Excerpt from Ameristar’s preflight inspection pictorial training (elevator control system). Both the captain and the check airman were trained and evaluated using the pictorial during their most recent proficiency checks and both achieved “satisfactory” results. 1.11.3.3 Taxi Checklist: Elevator Control Check The AOM’s normal checklist (page 1.2-5) contained a taxi checklist with challenge/response items to be completed, which included “Flight controls/Elev[ator] Augmentation…CHECKED.” The AOM’s amplified normal checklist (page 1.2-31) included, in part, the following description for this item: Control column to the full aft position while noting that the ELEVATOR POWER ON Light is off and then pushing the control column full forward while noting that the Blue ELEVATOR POWER ON Annunciator Light illuminates indicating the elevator augmentation system is working…..

NTSB Aircraft Accident Report 36 Aileron/Spoiler Operational Check: The First Officer will check elevators by noting fluctuations on both hydraulic pressure indicators…. The last check is to note that the ELEVATOR POWER ON light goes out after releasing the control column…. 1.11.3.4 Increased Rotation Speed for Windshear Mitigation The AOM provided precautions for pilots to take to mitigate a potential encounter with windshear during takeoff. The precautions advised pilots to “Use Maximum Rated Takeoff Thrust” and “Consider Using Increased Rotation Speed,” among other considerations. 1.11.3.5 Rejected Takeoff Company Procedures and Guidance The AOM Rejected Takeoff Procedure (page 4-35) specified that [t]he right hand of the Captain will remain on the thrust levers until V1 speed is reached. In this way, the Captain can respond quickly to a decision to reject the takeoff regardless of who is performing the takeoff. The decision to continue or reject the takeoff will always be made by the [captain]. At high speeds (at or near V1), consideration should be given to the effect of a high-energy reject. Experience has shown that, in many cases, rejected takeoffs at high speed have had far more negative or catastrophic results than would have been likely if the takeoffs had been continued…. In general, if the aircraft’s flying performance has not been affected (such as in a tire failure), the safer course of action may be to continue the takeoff and then land under a controlled condition at a lighter weight and slower speed. Therefore, as a consideration, a rejected takeoff above 100 [kts] should be made only for safety of flight items such as the occurrence of an engine failure or a condition where there is serious doubt that the airplane can safely fly. If, during the takeoff, a pilot recognizes a malfunction, he should make the callout clearly and precisely. The Captain must make a decision and react accordingly. If the decision is to reject the takeoff, the following actions must be accomplished immediately: • Disconnect Autothrottles. • Retard the throttle levers to idle. • Manually deploy the spoilers, simultaneously apply maximum wheel braking. • Apply reverse thrust. • The [first officer] should advise ATC.

NTSB Aircraft Accident Report 37 • Clear the runway, if practical, and notify the tower…. • Take the necessary steps to assure the safety of passengers, crew, and the aircraft. • Consider Emergency Evacuation. • Make [public address] to passengers… • If an evacuation of the aircraft is necessary and after the aircraft comes to a stop, complete the Evacuation Checklist and use the evacuation commands: • “EVACUATE, EVACUATE, EVACUATE” announce three (3) times • Call for the After Landing Checklist…. During a postaccident interview, the check airman stated that the captain was always in command for a rejected takeoff decision and that they had briefed this ahead of time. He said that he never felt the airplane’s nose come off the ground, but everything happened fast. He said that, after the captain called for the rejected takeoff, he (the check airman) started to reach toward the control column but observed that the captain had already disconnected the autothrottles and reduced the engine thrust to idle. The check airman said that he did not assume control of the airplane but assisted with applying maximum reverse thrust and wheel braking. The AOM (page 5-1-6) described rejected takeoff considerations, including the following: The Go/No-Go Decision Every takeoff has the potential for a rejected takeoff. A [rejected takeoff] close to V1 must use maximum deceleration to stop on the remaining runway. The most critical condition is an engine failure close to V1 at a weight near the Runway Limited Takeoff Weight. Factors Affecting Go/No-Go Decisions The decision to continue or reject a takeoff rests solely with the Captain. The [rejected takeoff] decision must be made, and appropriate procedures initiated, before reaching V1 so that deceleration begins at or before V1. Stopping ability is directly dependent on the kinetic energy which increases as a square of the ground speed. A change in speed has a greater impact on kinetic energy than a proportional change in weight. A 10% increase in speed increases kinetic energy by approximately 21%, while a 10% increase in takeoff weight only increase[s] kinetic energy by 10%.

NTSB Aircraft Accident Report 38 The same section of the AOM (page 5-1-7) stated, in part, the following: V1 V1 is the end of the Go/No-Go decision process, not the beginning. • If brakes have not been applied by V1, the go decision has been made by default. • If an engine failure is recognized and maximum braking applied no later than V1, [a rejected takeoff] can be accomplished on the remaining runway. • If an engine failure is recognized at or after V1, the takeoff can be continued with a climb to 35 [ft] before reaching the end of the runway. The AOM described the consequences of a late no-go decision under “Performance” (page 5-1-8) that included the following: Consequences of…[a] Late…No-Go Decision When takeoff weight is at or near the runway limited takeoff weight (due to field length, not obstacle clearance), the balanced field length approaches the available runway. In this scenario: • [A rejected takeoff] past V1 (late decision) results in the aircraft unable to stop on the remaining runway. Delaying [a rejected takeoff] 4 to 6 [kts] beyond V1 (approximately 1 second) may cause the aircraft to leave the end of the runway at approximately 70 [kts] or more. …[A]nything less than maximum deceleration significantly increase[s] that speed. Boeing Guidance The Boeing Flight Crew Operations Manual (FCOM) contained guidance for rejected takeoffs under “Procedures and Techniques – Takeoff” (pages PT.20.14-PT20.16) that included, in part, the following: The Captain has the sole responsibility for the decision to reject the takeoff. The rejected takeoff maneuver must be initiated no later than V1….Rejecting the takeoff after V1 is not recommended unless the Captain judges the airplane to be incapable of flight.[33]

33 This guidance is consistent with longstanding FAA and industry guidance. In 1989, after several takeoff accidents that resulted from improper rejected-takeoff decisions and procedures, a joint FAA/industry taskforce (including airframe manufacturers, airlines, pilot groups, and regulatory agencies) studied what actions might be taken to increase takeoff safety. As a result, the taskforce developed the Takeoff Safety Training Aid (announced by FAA AC 120-62, “Takeoff Training Safety Aid, Announcement of Availability,” and published in 1994) dedicated to reducing the number of rejected takeoff accidents (FAA 1994). Section 2 of the training aid, known as the “Pilot Guide

NTSB Aircraft Accident Report 39 Training Ameristar trained its Boeing MD-80 series pilots at the American Airlines Training Center in Fort Worth, Texas, using its own instructors and check airmen to conduct training and evaluations. Simulator training was conducted in an American Airlines Level C simulator. The training program was outlined in Ameristar’s Flight Crewmember Training Program that was designed to fulfill the requirements specified in Part 121, Subparts N and O, and Appendixes E, F, and H. Rejected takeoff training was included in the initial and recurrent training programs. According to the Check Airman/Instructor Guide (page 37), rejected takeoff training was accomplished “during a normal takeoff run after reaching a reasonable speed determined by giving due consideration to aircraft characteristics, runway length, surface conditions, wind direction and velocity, brake heat energy, and any other pertinent factors that may adversely affect safety or the airplane.” According to interviews and a review of company training documents, Ameristar Air Cargo did not train MD-80 pilots on rejected takeoffs past a speed of V1. Company records showed that the captain performed a rejected takeoff during his most recent proficiency check and was graded “satisfactory.” The check airman also was graded “satisfactory” on a rejected takeoff he performed during his most recent proficiency check, which an FAA aviation safety inspector observed in the simulator. 1.11.3.6 Emergency Evacuation Procedures for Pilots According to the GOM (chapter 7, page 7), “it is the responsibility of the PIC to determine the requirement for and order evacuation of the aircraft. If the PIC is incapacitated, this responsibility will follow the chain of command to other flight crewmembers.” A red-bordered emergency evacuation checklist was found on two emergency checklist cards installed in the cockpit. It included procedures for securing the airplane and commanding an evacuation using the “evacuate, evacuate, evacuate” command over the public address system. Procedures for Flight Attendants According to the GOM (chapter 6, page 28), flight attendants were to wait for an evacuation command from the flight deck. If a signal was not given and there was no response from the flight deck, the flight attendants were directed to initiate the evacuation, if necessary.

to Takeoff Safety,” recommended that pilots “consider V1 to be a limit speed: Do not attempt [a rejected takeoff] once the airplane has passed V1 unless the pilot has reason to conclude the airplane is unsafe or unable to fly. This recommendation should prevail no matter what runway length appears to remain after V1” emphasis in original.

NTSB Aircraft Accident Report 40 The Ameristar FAM provided guidance under “Emergency Procedures” (page 12-3) that stated, in part, the following: Evacuation Criteria Whether planned or unplanned, the decision to do an emergency evacuation must be made by a crewmember.[34] The following must be taken into consideration:

1. Necessity of evacuation – Is it in the best interests of the passengers to get out

of the aircraft? Injuries often result while passengers are evacuating. If the aircraft is still intact and the emergency is under control, evacuation may not be necessary. This situation may occur in an aborted takeoff or runway excursion.

1. Best way to evacuate – This decision will be made by the [flight attendants] in

most cases. They will command the passengers to proceed to the nearest and most accessible exit.

1. Who will decide – Preferably the Captain decides if an evacuation is necessary.

However, the decision will rest upon the [flight attendants] should a signal from the flight deck not be received. 1.12 Additional Information 1.12.1 Previous Elevator Jam Event According to an incident report from the German Federal Bureau of Aircraft Accident Investigation (BFU), on December 26, 1999, a Douglas DC-9-83 was involved in a rejected takeoff incident at Munich Airport, Munich, Germany (BFU 2000). The BFU reported that the inboard linkage of the left elevator’s geared tab was jammed, causing the left elevator to be jammed in a TED position. The airplane had been exposed to gusty tailwinds up to 70 kts when parked before the flight. As a result of its investigation, the BFU recommended in November 2000 that (1) the Airplane Flight Manual (AFM) be revised to state that the elevator control can jam and that a special examination of the flight controls is necessary if the airplane is subjected to wind exceeding 65 kts when not parked facing into the wind, (2) the checklist should include directions for examining the elevator’s hydraulics (including moving the control column) under specified criteria, and (3) the AMM should mention the possibility of a jammed elevator and should contain instructions for a special examination of the airplane if subjected to wind exceeding 65 kts when not parked facing into the wind. Subsequently, on June 25, 2001, Boeing issued Flight Operations Bulletin (FOB) MD-80-01-02, “Flight Control Jam,” that alerted operators about the circumstances of the incident, including the belief that the wind forced the left elevator into a TED position beyond the design

34 The GOM (chapter 6, page 27) defined a planned emergency as an emergency for which the crew has 10 minutes or more to plan.

NTSB Aircraft Accident Report 41 limits, causing it to jam.35 The FOB stated that the flight crew and maintenance personnel had been concerned about the high wind exposure and performed an “operational check” by exercising the flight controls from the cockpit and noted no anomalies. The FOB stated that “it is believed that the control tabs responded properly to the cockpit input, but that the ‘feel’ with one elevator jammed was not sufficiently different from the norm to alert the crew to the problem.” Boeing subsequently issued revisions to the AMM to prescribe physical inspections of the flight controls to include moving the control surfaces by hand. (Ameristar’s AMM contained this information.) 1.12.2 Previously Issued Safety Recommendations Related to Runway Safety Areas As described in sections 1.5.2 and 1.9.2, the RSAs at YIP (a Part 139-certificated airport) were upgraded between 2006 and 2009 and, at the time of the accident, conformed to the standards prescribed in AC 150/5300-13A, Change 1. According to the FAA, the performance of the RSA at YIP, which provided a clear area to accommodate the accident airplane’s overrun, demonstrated the design standard’s contribution to accident survivability. The NTSB notes that the FAA’s efforts to upgrade the RSAs at YIP were responsive to Safety Recommendation A-03-11 (described later in this section), issued on May 6, 2003, that asked the FAA to require all Part 139 airports to meet the AC standards. This recommendation is part of our decades-long history of advocating for adequate RSAs based on evidence discovered during accident investigations. We issued our first safety recommendation related to RSAs on April 20, 1977, as a result of our investigation of the November 16, 1976, accident involving a McDonnell Douglas DC-9-14 airplane that ran off the end of the runway during an aborted takeoff and caught fire after striking two ditches and nonfrangible structures in Denver, Colorado (NTSB 1977).36 Based on our findings, we recommended that the FAA [a]mend [14 CFR 139.45] to require, after a reasonable date, that extended [RSA] criteria be applied retroactively to all certificated airports. At those airports [that] cannot meet the full criteria, the extended [RSA] should be as close to the full 1,000-foot length as possible. (Safety Recommendation A-77-1637) The FAA replied on July 11, 1977, that extended RSAs at all existing airports would be “impractical and infeasible.” The FAA said it would instead propose an amendment to Part 139 to require extended safety areas concurrently with the construction of new airports, new runways,

35 The FOB, which applied to all Boeing DC-9, C9, MD-80, MD-90, and 717 airplanes, was also referenced by number DC-9-01-02, MD-90-01-02, and B-717-01-05. 36 Nonfrangible structures do not break, yield, or distort upon impact in a manner that presents a minimum hazard to an aircraft in the event of a collision (FAA 2014a, 6, 61). 37 When we issued the recommendation, Part 139 did not specify dimensions for RSAs. Effective February 28, 1983, AC 150/5300-12 established that an RSA should be at least 500 ft wide and should extend 1,000 ft beyond each runway end. Subsequent revisions included AC 150/5300-13, which became effective on September 29, 1989; AC 150/5300-13A, which became effective September 28, 2012; and AC 150/5300-13A, Change 1, which became effective February 26, 2014.

NTSB Aircraft Accident Report 42 and major runway extensions at existing airports. To that effect, on October 23, 1985, the FAA published Notice of Proposed Rulemaking (NPRM) 85-22, “Revision of Airport Certification Rules.” In our February 5, 1986, comments about the NPRM, we said that we continued to believe that the RSA criteria should be mandatory at all certificated airports, regardless of the date of construction. On January 1, 1988, the final rule based on the NPRM became effective, and, because it did not require retroactive upgrades of RSAs, we classified Safety Recommendation A-77-16 “Closed—Unacceptable Action.” As a result of our investigation of an April 27, 1994, accident in which a Piper PA-31-350 airplane ran off the end of the runway during landing in Stratford, Connecticut, and crashed into a blast fence, killing 8 people on board the airplane and seriously injuring another person (NTSB 1994), on January 5, 1995, we recommended that the FAA [i]nspect all…Part 139 certificated airports for adequate [RSAs] and nonfrangible objects, such as blast fences, and require that substandard [RSAs] be upgraded to [AC] 150/5300-13 minimum standards wherever it is feasible. (Safety Recommendation A-94-211) On October 15, 1997, the FAA told us that its inspections revealed that 58% of the RSAs met current standards, 25% were substandard but feasibly improvable, and 17% were substandard but not feasibly improvable. The FAA stated that improving the RSAs at the feasibly improvable airports would cost $1.2 billion, and that, due to the cost and the infrequency of overruns, RSA upgrades would be required only as part of overall runway improvement projects. In our February 10, 1999, response, we expressed our concerns that the FAA’s plan could delay RSA upgrades and allow substandard RSAs to continue for many years. As a result, we classified Safety Recommendation A-94-211 “Closed—Unacceptable Action.” Subsequently, on March 5, 2000, a Boeing 737-300 operated by Southwest Airlines overran the runway during landing and collided with a blast fence and an airport perimeter wall before coming to rest on a city street near a gas station off the airport property in Burbank, California (NTSB 2002). We noted during our investigation that the RSA for the runway was significantly smaller than that prescribed in the AC and that the FAA subsequently funded and completed the installation of an engineered material arresting system (EMAS) in January 2002.38 The FAA had developed EMAS in the 1990s as a result of Safety Recommendation A-84-37, and, since then, the technology had been shown to be a practical, affordable, and effective system for use at the end of runways that could not, with feasible improvements, meet the minimum RSA standards.39 As a result of our investigation, on May 6, 2003, we recommended that the FAA

38 An EMAS uses crushable material placed at the end of a runway to stop an aircraft that overruns the runway. The tires of the aircraft sink into the lightweight material, and the aircraft is decelerated. 39 As a result of our 1984 safety study on airports, on April 11, 1984, we recommended that the FAA “initiate research and development activities to establish the feasibility of soft-ground aircraft arresting systems and promulgate a design standard, if the systems are found to be practical” (Safety Recommendation A-84-37) (NTSB 1984). The FAA completed the research and development and responded on February 27, 1997, that it had installed a prototype arrestor bed. As a result, we classified Safety Recommendation A-84-37 “Closed—Acceptable Action” on June 2, 1997.

NTSB Aircraft Accident Report 43 [r]equire all…Part 139 certificated airports to upgrade all [RSAs] that could, with feasible improvements, be made to meet the minimum standards established by [AC 150/5300-13]. The upgrades should be made proactively, not only as part of other runway improvement projects (Safety Recommendation A-03-11); and [r]equire all…Part 139 certificated airports to install [EMAS] in each [RSA] available for air carrier use that could not, with feasible improvements, be made to meet the minimum standards established by [AC 150/5300-13]. The systems should be installed proactively, not only as part of other runway improvement projects. (Safety Recommendation A-03-12) The FAA responded on August 7, 2003, stating that, although it agreed with the intent of Safety Recommendation A-03-11, it did not believe that regulatory action was needed. The FAA referred to FAA Order 5200.8, [RSA] Program, which was issued October 1, 1999, and stated that the program’s objective was for all RSAs at all Part 139 airports and federally obligated airports to conform to the AC’s standards, to the extent practicable (FAA 1999).40 After issuing Safety Recommendations A-03-11 and -12, we continued to investigate accidents involving runway overruns. On December 8, 2005, a Boeing 737-74H operated by Southwest Airlines collided with a blast fence, an airport perimeter fence, and an occupied passenger car on an adjacent roadway after it overran the runway during landing in Chicago, Illinois (NTSB 2007). Eighteen of the airplane’s 103 occupants sustained minor injuries; of the people in the car, one person (a child) was killed, another person received serious injuries, and three others received minor injuries. The RSA extended 82 ft beyond the end of the runway (the AC standard was 1,000 ft) and had no EMAS. Our investigation found that, in 2000, the FAA had determined that achieving RSA standards for the runway did not appear practicable (due, primarily, to land constraints), but it had asked the airport operator to explore all options to bring the airport’s RSAs into full conformance. We found that the FAA had followed up in 2003, asking the city to assess enhancement measures for improving the RSAs, but the city concluded in May 2004 (19 months before the accident) that there was insufficient spacing for an EMAS installation. Our investigation determined that the installation of a shorter, nonstandard EMAS at the end of the accident runway could have safely stopped the airplane. (After the accident, the FAA approved [and the city began installing] nonstandard EMAS beds at the airport.) On February 18, 2007, an Embraer ERJ-170 operated by Shuttle America, Inc., dba Delta Connection flight 6448, overran the runway during landing in Cleveland, Ohio (NTSB 2008). The airplane had crossed the 60-ft-long, 275-ft-wide RSA and struck a navigational aid (NAVAID) and the perimeter fence before coming to rest adjacent to a road. In our investigation, we found that the RSA had not been upgraded to the AC’s standards. The FAA had inventoried the RSA in 2000, notified the airport authority about some short-term and long-term options to enhance the RSA (one of which included shifting the runway and installing an EMAS), and asked the airport authority to evaluate the options and make a recommendation by March 2001. We found that the

40 The NTSB was already familiar with the order, having referenced it in our May 6, 2003, letter to the FAA. At the time, we acknowledged the order’s objective but noted that it did not require RSAs to be proactively upgraded; instead, it restated the FAA’s position to require RSA improvements only as part of overall runway improvement projects.

NTSB Aircraft Accident Report 44 airport provided the FAA its first draft RSA report in 2004 (with subsequent drafts in 2006 and 2007) but had not recommended a solution. The FAA extended the airport’s deadline for completing the RSA upgrades to September 2010. Had the RSA been upgraded with a runway shift and EMAS installation, the airplane would have come to a stop within the EMAS. From November 2007 through November 2008, the Department of Transportation’s Office of Inspector General (OIG) had conducted an audit of the FAA’s RSA program and issued a report on its findings on March 3, 2009. The OIG reported that the FAA had made significant progress and was “generally effective in identifying, prioritizing, and funding needed RSA improvements with two major exceptions: NAVAIDs and data quality” (DOT OIG 2009). The OIG audit found that noncompliant NAVAIDs in some RSAs posed significant safety risks, and the FAA’s ability to track and report RSA improvements was hampered by inaccurate and incomplete data. The OIG also noted that the FAA’s annual report to Congress (which was based on those data) did not provide sufficient detail for decision-makers and overstated the number of RSAs meeting full standards. As a result of the audit, the FAA agreed to identify and address noncompliant NAVAIDs and take steps to improve its RSA data and annual report to Congress (DOT OIG 2009). As a result of Safety Recommendation A-03-11 and FAA Order 5200.8, the FAA evaluated more than 1,000 runway ends at all Part 139 airports for compliance with current RSA standards. The improvements made were divided into two categories, based on the funding source for the improvements. RSA improvements involving airports progressing to meet dimensional standards were funded with grants from the Airport Improvement Program. All RSA improvements that were practicable under this program (including the RSA improvements made at YIP between 2006 and 2009) were completed by December 31, 2015, which was a congressionally mandated deadline.41 Upgrades involving relocating or making frangible FAA-owned NAVAIDs located in the RSAs were funded from the FAA’s facilities and equipment budget. As of April 6, 2017, the FAA said that, by the end of fiscal year 2016, it had improved 84% of RSAs with NAVAIDs needing relocation or to be made frangible and that it expected to complete the NAVAID program by the end of 2018. On June 8, 2017, pending completion of the NAVAID project, Safety Recommendation A-03-11 was classified “Open—Acceptable Response.” With regard to the installations of EMAS at locations where RSA dimensional conformance was not feasible, as recommended in Safety Recommendation A-03-12, on August 12, 2015, the FAA said that it had installed EMAS beds at 83 runway ends at 53 airports in the United States and that these installations had safely stopped 9 aircraft during overruns. Additional EMAS installations were scheduled to be completed at 13 runway ends at 11 airports by the end of 2015 (including the runway in Stratford, Connecticut, where a 1994 accident was the basis for Safety Recommendation A-94-211). On September 29, 2015, pending completion of the EMAS program, we classified Safety Recommendation A-03-12 “Open—Acceptable Response.” According to the FAA’s July 5, 2018, EMAS fact sheet, EMAS had been installed at 113 runway ends at 68 airports in the United States, and 7 additional EMAS installations were planned for 6 more US airports (FAA 2018b). The FAA also said that, as of the date of the fact

41 Congress had enacted Public Law 109-115 on November 30, 2005, that required Part 139 airports to comply with RSA design standards by the end of 2015 and required the FAA to report annually to Congress on its progress.

NTSB Aircraft Accident Report 45 sheet, EMAS installations had safely stopped 13 overrunning aircraft with 288 crew and passengers aboard those flights. 1.12.3 Procedures for Weather Observers 1.12.3.1 Sign Off for Nonaugmented Reports (Automated METAR) As described in section 1.4.2.2, YIP was a facility with LAWRS observers. During normal operations, a LAWRS observer is logged in to the ASOS operator interface device (OID) and provides augmentation of the METARs and SPECIs. Soon after the power outage on the morning of the accident, the tower personnel evacuated, and a LAWRS observer did so without logging out of the system. As a result, the automatically disseminated METARs did not contain an AUTO modifier. According to FAA Order JO 7900.5D, Surface Weather Observing, section 14.10.a., the AUTO modifier “identifies the type of report as a fully automated report with no human intervention…the absence of AUTO indicates that the report is either a manual report or an automated report with an observer ‘logged on’ to the system” (FAA 2014b, 102). A review of the ATCT evacuation procedures identified no guidance for observers to log out of the ASOS OID. FAA Order JO 7900.5D, section 5.3, which addressed “sign on/sign off” procedures, did not specify sign-off (log-out) procedures except for scenarios involving certain weather events that are occurring at the close of augmentation coverage (FAA 2014b, 32). 1.12.3.2 Backup Responsibilities During Equipment Outage As described in section 1.4.2.2, after 1202 on the morning of the accident, the ASOS lost some of its sensor functions due to the power outage, but its OID retained dissemination capability. As a result, the ASOS automatically disseminated METARs that contained incomplete information. According to section 2.5.a. of FAA Order JO 7900.5D (which was current at the time of the accident), [c]ertified observers are responsible for the completeness and accuracy of the weather observation. If the complete automated observation is unavailable due to sensor/system malfunction…, backup information must be provided….(FAA 2014b, 642) Appendix C, section C.5.b., of the order stated the following:

42 The section indicated that a sensor/system malfunction occurs when “[o]ne or more sensors or the entire observing system is (are) not reporting data (for any reason). Provide manual backup and make appropriate maintenance notifications.”

NTSB Aircraft Accident Report 46 If portions of, or the complete automated systems with SPECI capability observation is unavailable due to sensor/system malfunction…LAWRS must backup, at a minimum, the following weather elements at sites with an automated system with SPECI capability:… (1) Wind (2) Visibility to 10 miles (3) Present weather and obscurations… (4) Sky condition to 12K feet (5) Temperature/dew point (6) Altimeter setting. (FAA 2014b, 146) FAA Order JO 7900.5D did not provide LAWRS procedures that specifically addressed whether the backup requirements applied if observers must evacuate from a duty station. Section 1.8.d. contained the following general guidance for unforeseen scenarios: No set of procedures and practices can cover all possibilities in weather observing. The observer must use good judgment, adhering as closely as possible to this order, to describe phenomena not adequately covered by specific instructions. (FAA 2014b, 2) No LAWRS observer provided any backup information to supplement the missing ASOS data after evacuating the tower due to high wind about 1217. 1.13 Effective New Investigation Techniques To maximize the fidelity of the CFD wind simulation described in section 1.10.3, NTSB investigators conducted a mapping mission using an sUAS to obtain the imagery necessary to produce an accurate, photogrammetric 3-D model of the hangar, other buildings, and terrain near the area where the airplane was parked. The mapping consisted of seven missions with overlapping grids and oblique orbits between 100 and 150 ft agl. These missions were flown within the YIP Class D airspace under an amended Certificate of Authorization or Waiver from the FAA to operate at or below 250 ft agl, as coordinated with the YIP ATCT. In accordance with the authorization, a notice to airmen (NOTAM) was issued, continuous communication with ATCT personnel was maintained, and airport operations were not affected.

NTSB Aircraft Accident Report 47 The missions obtained about 900 high-resolution photographs. The team also created multiple ground control points (GCPs), logged the position of each using a handheld global navigation satellite system, then processed the data using software and a nearby continuously operating reference station to increase the positional accuracy of the handheld measurements. Still imagery and GCP information was processed using photogrammetry software to produce full-resolution orthomosaic .kmz files and a 3-D model that was further processed and used in the CFD simulation (see figure 17).43 Figure 17. Screenshot of one view of the hangar 3-D model created from sUAS-captured imagery. Using conventional techniques, 3-D modeling of the complex building and terrain environment would have required the use of blueprints, photographs, terrain data, and computer-aided design software to manually create the model. This would have involved considerable resources (time and manpower) to accurately model the basic hangar and all its small- scale obstructions that could affect wind patterns (such as duct work, chimneys, ladders, architectural details, bushes, trees, and terrain). Manually modeling the hangar and its detailed features would have taken several weeks and may not have produced the level of accuracy necessary for effective use in the CFD simulation (Bauer et al. 2018).

43 A .kmz file is a compressed file that contains imagery and corresponding keyhole markup language files that enable the imagery and associated file information to be viewed on Google Earth.

NTSB Aircraft Accident Report 48 1.14 Postaccident Safety Actions 1.14.1 Boeing’s Multioperator Message and Ongoing Efforts In its May 1, 2018, submission to the investigation, Boeing noted that it had issued a multioperator message to provide operators with details about the jammed elevator condition seen in this accident, including the overcenter position of and damage to the geared tab linkage and the wind conditions that affected the airplane while parked near the large hangar. The message emphasized the importance of inspecting airplanes that potentially have been exposed to high wind or gusts while on the ground. In November 2018, Boeing provided an update that included copies of revised Fleet Team Digest (FTD) documents that it had distributed to operators.44 According to the FTDs, Boeing was developing a service bulletin (SB) for modifying the elevator structure of Boeing DC-9/MD-80 series and 717 model airplanes to attach a secondary travel stop that would prevent the excessive elevator TED travel that could result in the geared tab linkage becoming locked overcenter. Boeing also reported that it was developing a revision to the AMM for Boeing DC-9/MD-80 series and 717 model airplanes to add new elevator wind damage inspection procedures, which would also include a lower wind speed threshold for the inspection. The inspection would involve verifying that an elevator was positioned trailing edge neutral or above. For an elevator that appeared below neutral, performing additional control checks with a ground observer or a hands-on check of the elevator to ensure freedom of movement would be required. (These new inspection procedures would not apply to any airplanes with the secondary stop installed per the SB.) In addition, Boeing revised the FCOM (and planned to revise the AFM) for Boeing 717 model airplanes to include a taxi procedure for the flight crew to check the system configuration synoptic (part of the advanced flight deck display in the cockpit) for indications of elevator position movements when a control column is moved full aft. 1.14.2 Ameristar’s Wind Monitoring Procedures for Parked Airplanes On May 22, 2018, Ameristar issued an FAA-accepted bulletin for flight-followers that prescribed company procedures for monitoring the wind that affects its parked Boeing DC-9 (MD-80 series) airplanes. The bulletin stated that flight-followers (who are flight control personnel) should use the TAF for each airplane’s parked location to evaluate, for the entire TAF timeframe, whether any wind speeds were forecasted to reach or exceed 50 kts. The procedure included, in part, the following:

44 FTD documents 717-FTD-27-18001 and DC-9-FTD-27-18001 were each revised November 28, 2018.

NTSB Aircraft Accident Report 49

1. If it is determined that 50 [kts] may be reached or exceeded for the

timeframe that an aircraft is on the ground, [flight control] will notify [maintenance control] of the forecast winds.

1. [Flight control] will monitor the METARs for actual winds being reported

during the timeframe that they have been forecast to exceed 50 [kts].

1. If [flight control] finds that a METAR indicates winds in excess of 50 [kts]

has been reached or exceeded, [maintenance control] must be notified with the affected aircraft and airport location. [Maintenance control] will determine if the High Wind/Gust Damage Inspection will be required….

1. If [maintenance control] determines that a High Wind/Gust Damage

Inspection is required, [maintenance control] will notify [flight control] to place the affected aircraft in a “RED” status. The bulletin provided required procedures for documenting daily the TAF information on the company’s wind analysis form for each airplane and for saving the files into a company directory that is subject to random audits by the director of safety.

NTSB Aircraft Accident Report 50

1. Analysis
2. 1

Introduction This accident occurred when the Boeing MD-83 airplane overran the departure end of runway 23L at YIP during a rejected takeoff, crossed through the RSA, and struck the airport perimeter fence and a raised road before coming to a stop. The captain, who was the PF, executed the rejected takeoff after V1 when he perceived that the airplane did not respond normally when he pulled back on the control column to command rotation. All 116 persons on board evacuated the airplane via the emergency escape slides with only one reported minor injury; however, one slide failed to inflate. FDR data showed that the airplane’s right elevator was full TED when the flight crew first powered up the airplane on the day of the accident and remained there throughout the accident sequence. An airplane performance study (based, in part, on FDR data) confirmed that airplane did not respond in pitch when the captain pulled on the control column. Before the accident flight, the airplane had been parked on the ramp at YIP for 2 days near a large hangar, and the elevators (which, by design, did not have gust locks) were exposed to high, gusting surface wind conditions. Postaccident examination showed that the right elevator’s geared tab’s inboard actuating crank and links had moved beyond their normal range of travel and became locked overcenter, effectively jamming the right elevator in a full-TED position. Thus, the NTSB concludes that the right elevator’s jammed condition rendered the airplane unable to rotate during takeoff. The following analysis discusses the flight crew’s performance, including their preflight airplane inspection and control checks, preflight weather planning, and execution of the rejected takeoff after V1 (section 2.2), and evaluates the following: • The right elevator’s jammed condition, including geared tab linkage damage, effects of wind flow characteristics at the airplane’s parked location near the large hangar, and static and dynamic elevator load testing (section 2.3); • Mitigations to prevent takeoffs with an undetected jammed elevator for Boeing DC-9/MD-80 series and 717 model airplanes (section 2.4); • RSA enhancements at YIP and nationwide (section 2.5); • Weather observer procedures during a facility evacuation (section 2.6); and • Evacuation slide inflation malfunction (section 2.7). Further, the investigation examined the following issue areas and found no related factors that contributed to the accident: • Flight crew qualifications. The captain and the check airman were certificated, current, and qualified in accordance with federal regulations and company requirements. The captain and the check airman held valid and current FAA airman medical certificates.

NTSB Aircraft Accident Report 51 • Flight crew alcohol or other drug use. Postaccident alcohol and drug testing on specimens from each pilot revealed no evidence of alcohol or other drugs. • Airplane maintenance. The airplane was properly equipped and maintained in accordance with federal regulations. No evidence indicated that any maintenance discrepancy contributed to the jammed elevator condition. • Airplane weight and balance. Although the FAA guidance in AC 120-27E recommends using actual passenger weights (or established average weights) for flights carrying passengers of a nonstandard weight group (such as a sports team) when performing weight and balance calculations, Ameristar’s OpSpecs allowed for the use of standard weights for passengers and baggage for the accident flight. Postaccident calculations performed using assumed passenger weights and actual baggage weights determined that the airplane was within weight and CG limits at takeoff. Thus, the NTSB concludes that the investigation determined that (1) the captain and the check airman were appropriately qualified for the operation, (2) neither pilot was impaired by alcohol or other drugs, (3) the airplane was properly maintained, and (4) the airplane was within weight and CG limits at takeoff. 2.2 Flight Crew’s Performance 2.2.1 Preflight Responsibilities Related to Elevators 2.2.1.1 Parking and Inspection Criteria for High-Wind Exposure Ameristar’s AOM for the Boeing MD-83 contained an amplified normal checklist for flight crews that included a caution that airplanes exposed to high sustained wind or gusts greater than 65 kts were susceptible to elevator damage and/or jamming and stated that, for any airplanes suspected of such exposure, inspections and checks specified in the AMM were required. Ameristar’s AMM for the Boeing MD-83 included a warning that the airplane must be parked headed into the wind if gusts were expected to exceed 60 kts and a caution that a visual and physical inspection of all flight control surfaces was required if the airplane was subjected to wind exceeding 65 kts. However, none of the recorded or forecasted wind at YIP exceeded these limits during the time that the airplane was parked on the ramp (the highest reported wind gust was 55 kts and the highest forecasted gust was 48 kts). Thus, the NTSB concludes that, based on the available wind data for YIP, the flight crew was not required to perform high-wind parking procedures or request flight control inspections from maintenance personnel. 2.2.1.2 Preflight Inspection and Taxi Control Check The amplified normal checklist in the AOM and Ameristar training specified that a pilot must visually check the general condition of the elevators and tabs before each flight segment. The captain performed the preflight inspection and noted no visible damage. Flight crews are not required to physically move the elevator surfaces (which are about 30 ft above the ground), and the geared tab linkage is not visible from the ground. Although it is possible to see when an elevator is positioned full TED (as evident in figure 2, which shows that the accident airplane’s jammed

NTSB Aircraft Accident Report 52 elevator was in a full-TED position), a full-TED elevator position is not necessarily indicative of an anomaly because the elevators can freely move to that position under nominal ground wind. The amplified procedures in AOM for the taxi checklist specified that a pilot must move the control column through the full range of travel to determine if the controls are free and normal. The check airman performed this check and noticed nothing unusual, and postaccident examination found that moving the control columns forward and aft resulted in the correct corresponding movement of the elevator control tabs. (Investigators noted some difficulty moving the cockpit control columns; however, this was likely due to impact-damaged airplane structure that was in contact with the control cables.) The control tabs are the only parts of the elevator system that are connected to the control column, and the control tabs were not damaged. Thus, the NTSB concludes that the flight crew’s preflight inspection and control check during taxi, which were performed in accordance with the procedures specified in the AOM, could not have detected the overcenter position of the right elevator geared tab’s linkage or the resultant jammed elevator condition. 2.2.2 Preflight Weather Evaluation and Decision to Use Increased Rotation Speed The flight crew was required by regulations and company procedures to verify that the takeoff weather conditions met the minimum requirements. However, at the time of departure, the ASOS, ATIS, and ATCT at YIP had not been operational for 3 hours. The flight crew attempted to obtain current information from the ASOS and ATIS using the airplane’s radios, but, finding it incomplete, the check airman used a cell phone to access the YIP ATIS, weather information from DTW (which was 8 nm away), and the DO to obtain the RTMA temperature. The FAA legal interpretation dated June 8, 2017, stated, in part, the following concerning these circumstances on the day of the accident: Although [14 CFR] 121.651(a) is silent on the operational capabilities of weather facilities and the recency of reported weather…, to operate consistently with [this] and other related regulations, a pilot must have a reasonable certainty that conditions existing at the time of takeoff have been accurately reflected by the weather report that is used to determine the flight will meet or exceed the required minimums and thereby ensure safe operation of the aircraft. The NTSB notes that the weather conditions at YIP were VFR based on the most recent METAR received by the flight crew, DTW was reporting VFR conditions when the check airman called to receive the information, and the flight crew visually verified that the conditions at YIP were VFR at the time of the departure. Thus, the NTSB concludes that the flight crew’s preflight weather evaluation was sufficient to establish with reasonable certainty that the conditions existing at the time of takeoff met the required minimums for departure. Ameristar procedures allow flight crews to use an increased VR to mitigate a potential encounter with windshear during takeoff, which the flight crew had reason to expect as likely due to the high, gusting wind conditions on the day of the accident. As a result, the flight crew chose to increase the rotation speed about 5 kts. Thus, the NTSB concludes that the flight crew’s decision to use an increased rotation speed was appropriate for the known weather conditions and consistent with company procedures.

NTSB Aircraft Accident Report 53 2.2.3 Decision to Reject Takeoff after V1 V1 is the maximum airspeed at which a rejected takeoff can be initiated and the airplane stopped on a runway that is limited by field length. Company guidance specified that initiating a rejected takeoff even 4 to 6 kts (about 1 second) after V1 may result in a runway overrun at high speed. Although the flight crew’s use of the increased rotation speed to mitigate a possible windshear encounter during takeoff was appropriate, it resulted in the check airman not calling “rotate” until 5 seconds after the airplane achieved V1. By the time the captain recognized that the airplane would not rotate and called to abort the takeoff, 12 seconds had elapsed since V1, essentially guaranteeing that the airplane would overrun the runway. Ameristar guidance and training specifically stated that the captain was solely responsible for the decision to continue or reject a takeoff and that the no-go decision must be made—and the appropriate procedures initiated—before the airplane reached V1. The guidance stated that, in many cases, rejected takeoffs at high speed have resulted in far more negative or catastrophic outcomes than would have been likely if the takeoffs had been continued. For decades, pilot training has extensively emphasized that the no-go decision must be made before V1. However, company guidance also stated that a high-speed rejected takeoff should be made only for safety of flight items, such as a condition where there is serious doubt that the airplane can safely fly. Boeing guidance also stated that rejecting the takeoff after V1 is not recommended unless the captain judges the airplane to be incapable of flight. In the case of this attempted takeoff, it was not until after the airplane had exceeded V1 that the captain discovered that the airplane would not rotate in response to his control inputs. When the check airman called “rotate,” the captain pulled back on the control column, observed that the airplane did not respond in pitch, then added more back pressure until the control column came “further back than for a normal rotation,” but the airplane still did not respond. The captain called for the rejected takeoff, and the flight crewmembers applied maximum braking, but the airplane went off the end of the runway. The airplane performance study showed that, assuming the same deceleration profile as that of the accident flight, the captain would have had to start braking 4 seconds sooner for the airplane to have come to a stop on the paved surface. However, at that point in the accident flight’s takeoff, the captain’s control column input had been applied for only 3 seconds. A review of FDR data showed that, during the airplane’s previous successful takeoff, at 3 seconds after control column input, the airplane had only begun to respond in pitch. Thus, the NTSB concludes that the airplane’s lack of rotational response to the control column input during the accident takeoff did not become apparent to the captain in time for him to have stopped the airplane on the runway. Rarely could all of the safeguards in place to ensure an airplane is airworthy before departure (such as proper aircraft maintenance, preflight inspections, and control checks) fail to detect that an airplane was incapable of flight, as occurred with the jammed elevator on the accident airplane. Perhaps even more remarkable was that a flight crew would be placed in a situation in which the airplane’s inability to fly would not be discoverable until after it had accelerated past V1 during a takeoff roll. The captain had extensive flight experience with many takeoffs, but none of them presented a scenario like the one he faced during the accident takeoff. Although the captain was relatively new to flying the Boeing MD-83, because of his prior

NTSB Aircraft Accident Report 54 experience in the Boeing DC-9 (a variant with an identical elevator system and controls), he correctly assessed the state of the accident airplane and quickly called for and initiated the rejected takeoff. Thus, the NTSB concludes that, once the airplane’s inability to rotate became apparent, the captain’s decision to reject the takeoff was both quick and appropriate. Crew coordination during takeoff is essential to managing one of the most critical phases of a flight. Effective crew coordination and performance depend on the flight crewmembers having a shared mental model of each task; such a mental model, in turn, is founded on effective standard operating procedures (SOPs) (FAA 2017b). Flight crew adherence to SOPs during a takeoff, including maintaining the defined roles of PF and PM, is of paramount importance to flight safety (FAA 2017b). Although Ameristar’s procedures for a rejected takeoff clearly establish that the responsibility for the go/no-go decision is exclusively that of the captain, in this flight, the PM was also a check airman providing airplane differences instruction to the captain trainee; thus, the check airman was the PIC of the flight. This increased the potential for confusion as to who was truly responsible for the go/no-go decision during an anomalous situation. Instructors typically have more experience in the airplane than the pilot receiving instruction (as was the case with this crew) and are primed to assume control should the trainee’s actions pose a risk to the flight. Although the check airman instinctively reached toward the control column after the captain’s “abort” call out (and stated to the captain that they should not reject a takeoff after V1), the check airman did not take control of the airplane but rather observed that the captain had initiated the rejected takeoff procedures and then took action to assist the captain in executing those procedures. The flight crew’s coordinated performance around the moment that the captain rejected the takeoff showed that both pilots had a shared mental model of their responsibilities. By adhering to SOPs—rather than reacting and taking control of the airplane from the captain trainee—the check airman demonstrated disciplined restraint in a challenging situation. Had the check airman simply reacted and assumed control of the airplane after the captain decided to reject, the results could have been catastrophic if such action were to further delay the deceleration (at best) or to try to continue the takeoff in an airplane that was incapable of flight. Thus, the NTSB concludes that the check airman’s disciplined adherence to company SOPs after the captain called for the rejected takeoff likely prevented further damage to the airplane and reduced the possibility of serious or fatal injuries to the crew and passengers. 2.3 Right Elevator Jammed Condition 2.3.1 Damage to Right Elevator’s Geared Tab Actuating Crank and Links As stated in section 2.1, based on FDR data (which showed when the right elevator was last in a different position), the overcenter position of the right elevator geared tab components occurred sometime during the 2 days that the airplane was parked on the ramp and exposed to high gusting wind before the accident (between 0712 on March 6 and 1236 on March 8). Examination (and, in some cases, functional and/or materials testing) of various elevator system components (including both elevator power control boost cylinders, dampers, torsion bars, and stop arms) revealed no preexisting conditions or defects within the system that could have

NTSB Aircraft Accident Report 55 resulted in the locked-overcenter condition of the right geared tab linkage.45 Although a similar jammed elevator condition occurred with a Boeing MD-83 that was involved in a rejected takeoff incident in Munich, Germany, in 1999, that airplane had been exposed to ground gusts that exceeded the certification design limits for the airplane. As stated in section 2.2.1.1, none of the recorded or forecasted wind at YIP exceeded these limits during the time that the airplane was parked on the ramp. However, the investigation sought to determine whether the presence of a large hangar upwind of the airplane’s parked location may have altered the wind flow that affected the airplane. 2.3.2 Simulation of Wind Conditions at Airplane’s Parked Location To determine a plausible scenario of the wind flow that affected the parked airplane, Boeing (as a party to the investigation) performed a CFD wind simulation using NTSB-provided weather data for YIP and a detailed 3-D model of the large hangar that was upwind of the airplane’s parked location. (The 3-D hangar model was developed using imagery obtained from the NTSB’s sUAS.) The simulation used ASOS-observed wind data to examine a period of variable wind magnitudes, directions, and gusts simulated over real-life, 3-D models of the hangar and an MD-83 airplane.

The wind simulation presented a visual representation of the air flow around the parked airplane and various wind speeds at points around the airplane. During the simulation, shortly after a 55-kt gust from 261° was introduced (consistent with the maximum ASOS-observed gust), a localized horizontal gust of 58+ kts, which appeared to be related to turbulence generated downwind of the hangar, moved over the airplane. The simulation also showed that the wind affecting the airplane’s elevators included an upward and downward vertical component. A review of the tabulated wind data from the simulation showed that, during the maximum gust, a speed increase occurred near the top of the vertical stabilizer and the tip of the right elevator. Further, as the gust wave flowed across the tail as shown in the simulation, the airflow would provide a lifting motion followed by a downward push in less than 3 seconds. In higher gust conditions, this would result in a hard slam of the elevators against either the upper or lower stop, depending on the direction of motion. Thus, the NTSB concludes that, based on the results of the CFD simulation, the airflow at the airplane’s parked location was affected by the presence of the large hangar that generated localized turbulence with a vertical component that moved the elevator surfaces rapidly up and down, which resulted in impacts against the elevator mechanical stops. The results of the simulation enabled the NTSB to gain an understanding of the relative wind flow and possible wind speed fluctuations in the area where the accident airplane was parked, which assisted in designing a representative test plan for the airplane’s elevator system.

45 Some elevator system components showed unrelated anomalies: the right elevator’s power control boost cylinder did not meet the relief valve reseat pressure criteria when tested, but the possible effect of this condition would apply only after a boost cylinder activation (which is highly unlikely to occur while an airplane is parked and could not cause the right geared tab linkage to become locked overcenter). Neither the sealant found on the left elevator torsion bar bearing surfaces (which could result in a smaller-than-normal rotation of the left torsion bar under some conditions) nor the left elevator damper’s unknown compliance with acceptable torque values could affect any right elevator system components.

NTSB Aircraft Accident Report 56 2.3.3 Elevator Load Testing Considering the results of the CFD wind simulation, the NTSB designed several series of static and dynamic elevator load tests to determine what conditions, consistent with the known circumstances of the accident, could enable the inboard actuating crank and links of the right elevator’s geared tab to move beyond their normal range of travel and become locked in an overcenter position (and, as a result, jam the right elevator). In preparing the test plan, the NTSB used the hinge moment formula specified in 14 CFR 25.415 to calculate the hinge moments needed to simulate elevator loads from ground gusts ranging from 25 to 75 kts. (The regulation specified that flight control systems and surfaces must be designed for the limit loads generated when the airplane is subjected to a 65-kt horizontal ground gust from any direction while parked and taxiing.) These loads were distributed across the elevator hinge points during full-scale static and dynamic testing using the accident airplane’s left elevator (including torsion bar and stop arm assembly) and other elevator components that were not damaged before or during the accident. During the static tests, 25-, 55- and 75-kt simulated gust loads both with and without boost cylinder activation resulted in torsion bar rotation and elevator position travel beyond the nominal unloaded TED stop position of 16.5°. Although each successive load increase resulted in increased torsion bar rotation and elevator surface deflection, and the tests performed with the boost cylinder activation produced comparatively greater rotation and deflection for each load, none of the static tests resulted in the geared tab linkage becoming overcenter. Thus, the NTSB concludes that a static load on the elevators consistent with the airplane’s certification design limit for a ground gust as specified in 14 CFR 25.415 would not likely result in an overcenter condition of an elevator’s geared tab linkage. A series of dynamic tests without the boost cylinder were performed by starting the loaded elevator in either a neutral or full-TEU position and then releasing it, which allowed it to accelerate due to gravitational forces and impact the stop. This testing was intended to simulate elevator motion while exposed to turbulent flow, such as the rapid fluctuations in vertical wind magnitude shown to flow over the tail in the simulation. The dynamic tests did not result in the geared tab linkage becoming overcenter for simulated gust loads of 25 and 55 kts. For the 60-kt simulated gust load, the linkage became overcenter for only the full-TEU initial elevator position test. For the 65-, 70-, and 75-kt simulated gust loads, the linkage became overcenter for the neutral initial elevator position tests (the full-TEU initial position was not tested for these loads). Estimated elevator surface positions during the overcenter cases were between about 20.9° and 21.3° TED. These tests showed that an elevator under loading that dynamically impacts the stop is subjected to increased hinge moment (versus the static loading condition) that results in greater torsion bar deflection and, thus, increases the likelihood that the geared tab linkage could travel to an overcenter position. Based on the results of the testing conducted, gust loads between 55 and 60 kts could result in an overcenter condition of the geared tab linkage if the elevator traveled from a full-TEU position to the TED stop. Thus, the NTSB concludes that, although the reported wind at the airport did not exceed the horizontal ground gust limits specified for transport-category airplanes, the effects of the large hangar near the accident airplane’s parked location resulted in a

NTSB Aircraft Accident Report 57 turbulent windflow with vertical components that imposed dynamic loads on the elevator system sufficient to jam the right elevator. 2.4 Mitigations to Prevent Future Occurrences 2.4.1 Review of Elevator Design Standard for Ground Gust Loads The airworthiness standard current at the time of the accident specified in 14 CFR 25.415(a), “Ground gust conditions,” that flight control systems and surfaces of transport-category airplanes must be designed for the limit loads generated when the airplane is subjected to a 65-kt horizontal ground gust from any direction while parked and taxiing. Paragraph (b) of the regulation allowed for the assumption of static loads when computing the hinge moments for elevators (and other control surfaces). Although the regulation in effect when the MD-80 series airplane was originally certificated specified only a 52-kt ground gust, Boeing stated that the airplane was designed to withstand a 65-kt horizontal ground gust. However, as the NTSB concluded above, the accident airplane’s elevator became jammed when exposed to a horizontal wind gust that was lower than 65-kts but had been altered by the effects of the hangar to include dynamic, vertical wind components. The NTSB notes that, in the past, the FAA has amended parts of 14 CFR Part 25 to consider dynamic factors for certain types of systems and circumstances. For example, in 2014 (effective for February 9, 2015), the FAA revised 14 CFR 25.415 to provide an additional multiplying factor to account for dynamic amplification, which it further explained in AC 25.415-1, “Ground Gust Conditions,” (released concurrent with the final rule), as follows: There have been several incidents and accidents caused by hidden damage that had previously occurred in ground gust conditions. Although many of these events were for airplanes that had used the lower [than 65-kt] wind speeds from earlier rules, analysis indicates that the most significant contributor to the damage was the dynamic load effect. The dynamic effects were most significant for control system designs in which the gust locks were designed to engage the control system at locations far from the control surface horn. Based on these events, [the regulation was revised via Amendment 25-141] to include additional factors for use in those portions of the system and surfaces that could be affected by dynamic effects. Although that particular regulatory amendment was prompted primarily by the FAA’s review of events involving airplanes equipped with certain control systems with gust locks, given the circumstances of this accident, a similar review could ensure the adequacy of the regulation as it pertains to free-floating elevator designs like that of the accident airplane. Therefore, the NTSB recommends that the FAA determine if the ground gust limit loads contained in 14 CFR 25.415 adequately ensure that critical flight control systems are protected from hazards introduced by ground gusts that contain dynamic, vertical wind components.

NTSB Aircraft Accident Report 58 2.4.2 Means to Enable Flight Crews to Detect a Jammed Elevator, Lowered Wind Criteria for Elevator Inspections As described in section 2.2.1.1, the AOM cautioned flight crews that parked airplanes exposed to high, sustained wind or gusts greater than 65 kts were susceptible to elevator damage and/or jamming and that airplanes suspected of such wind exposure must receive flight control inspections and operational checks “in accordance with the [AMM].” The AMM warned that, if wind gusts were expected to exceed 60 kts, the airplane should be parked headed into the wind and cautioned that visual and physical inspections and operational checks of all flight control systems were required for wind exposure in excess of 65 kts (if there were any possibility the airplane was not parked into the wind or the wind direction changed). Thus, the NTSB concludes that, although a unique combination of the large hangar’s effects on the wind at the airplane’s parked location resulted in the elevator becoming jammed during ground gust conditions that were below the caution and warning criteria specified in the AOM and AMM, the circumstances of this accident highlight that Boeing’s safeguards do not adequately protect flight crews and passengers from the possibility that a free-floating elevator can become jammed, and the condition can remain undetected, before takeoff. After this accident, Boeing began exploring potential airplane modifications and new preflight inspection procedures intended to prevent takeoff attempts with a jammed elevator. These efforts included initiating the development of an SB for modifying the elevator structure of Boeing DC-9/MD-80 series and 717 model airplanes to attach a secondary travel stop that would prevent the geared tab linkage from becoming locked overcenter. Boeing also initiated the development of a revision to the AMM for Boeing DC-9/MD-80 series and 717 model airplanes to add new elevator wind damage inspection procedures, which would include a lower wind speed threshold for the inspection and specific actions to ensure elevator freedom of movement. Boeing also revised the FCOM (and planned to revise the AFM) for Boeing 717 model airplanes to include a taxi procedure for the flight crew to check the system configuration synoptic (part of the advanced flight deck display in the cockpit) for indications of elevator position movements when a control column is moved full aft. However, the NTSB notes that this procedure would require airflow over the tail for the elevators to move in response to control column inputs, and it would not apply to the Boeing DC-9/MD-80 series airplanes, which were not equipped with such displays. The NTSB notes that, given the circumstances of this accident and the potentially catastrophic outcome of an undetected jammed elevator, effective mitigations are needed. Therefore, the NTSB recommends that Boeing complete the development of a modification for Boeing DC-9/MD-80 series and 717 model airplanes that will prevent the possibility of elevator jamming due to ground wind exposure. The NTSB also recommends that Boeing develop new preflight procedures or other mitigations for Boeing DC-9/MD-80 series and 717 model airplanes that will enable a flight crew to verify before takeoff that the elevators are not jammed. The NTSB further recommends that Boeing, until the actions in the preceding two recommendations are completed, revise the AOM and AMM for Boeing DC-9/MD-80 series and 717 model airplanes to lower the ground gust criteria that will require physical inspections and operational checks of the elevators by maintenance personnel.

NTSB Aircraft Accident Report 59 2.4.3 Operator Procedures for Monitoring Wind Affecting Parked Boeing DC-9/MD-80 Series and 717 Model Airplanes Although the AOM and AMM specified actions for flight crews and maintenance personnel to take when ground gusts reached certain criteria, Ameristar had no procedures to identify who was responsible for monitoring the known and forecasted wind that may affect the company’s parked airplanes to determine if those criteria were met or exceeded. The accident airplane had been parked at YIP for 2 days; however, the company had no expectation for off-duty pilots to monitor the wind (as any such monitoring would be considered duty time), maintenance personnel received no notification of possible high-wind exposure, and the flight-follower who provided the flight release for the accident flight was unaware of the AMM wind limitations and had never been asked to monitor wind for the location of a parked airplane. The NTSB notes that, had the wind at YIP exceeded the ground gust criteria specified in the AOM and AMM, it is unclear from Ameristar’s procedures if any personnel would have known and subsequently ensured that the specified parking and/or inspection actions were taken. The NTSB notes that, after the accident, Ameristar implemented FAA-accepted procedures for its flight control personnel (the flight-followers) to monitor the wind that affects its parked Boeing DC-9 (MD-80 series) airplanes and to document this information on a company wind analysis form. These procedures, which were based on wind speeds that were more conservative than those prescribed in the AOM and AMM, required flight control personnel to notify maintenance control personnel any time that a TAF or METAR for an airplane’s parked location referenced wind (forecast or reported, respectively) of 50 kts or more. The procedures specified that maintenance control personnel were responsible for determining if a high-wind/gust damage inspection of the airplane was required. Thus, the NTSB concludes that, to ensure that the elevators of Boeing DC-9/MD-80 series and 717 model airplanes are inspected by maintenance personnel when exposed to ground gusts that meet or exceed criteria specified in the AMM, operators of these airplanes must maintain awareness at all times of the forecast and known wind where the airplanes are parked. Therefore, the NTSB recommends that the FAA ensure the operators of Boeing DC-9/MD-80 series and 717 model airplanes have procedures that define who is responsible for monitoring the wind that affects parked airplanes and for notifying maintenance personnel when conditions could meet or exceed the ground gust criteria specified in the AMM. 2.5 Previously Issued Safety Recommendations Related to Runway Safety Areas The RSAs at YIP (a Part 139-certificated airport) were upgraded between 2006 and 2009 to conform to the standards prescribed in AC 150/5300-13 (the version current at the time). The RSA improvement project at YIP, which had cost $20 million with a federal investment of $19 million, involved land acquisition, filling in a ravine, removing a taxiway, and relocating the perimeter fence and the road off the departure end of runways 23L and 23R. According to the FAA, the improved RSA at the end of runway 23L provided a clear area through which the accident airplane traveled and demonstrated the design standard’s contribution to accident survivability. Had the area not been clear, additional damage or injuries could have resulted, as seen in other runway overrun accidents.

NTSB Aircraft Accident Report 60 As described in section 1.12.2, the NTSB has a decades-long history (dating back to 1977) of advocating for effective RSAs, based on evidence discovered during numerous accident investigations. At the time that the RSA upgrades at YIP began, the FAA was responding to two safety recommendations we issued on May 6, 2003, that asked the FAA to [r]equire all…Part 139 certificated airports to upgrade all [RSAs] that could, with feasible improvements, be made to meet the minimum standards established by [AC 150/5300-13]. The upgrades should be made proactively, not only as part of other runway improvement projects (Safety Recommendation A-03-11); and [r]equire all…Part 139 certificated airports to install [EMAS] in each [RSA] available for air carrier use that could not, with feasible improvements, be made to meet the minimum standards established by [AC 150/5300-13]. The systems should be installed proactively, not only as part of other runway improvement projects. (Safety Recommendation A-03-1246) The FAA provided its initial response in August 2003, stating that it agreed with the intent of Safety Recommendations A-03-11 and -12; had implemented an RSA Program (FAA Order 5200.8) with the objective that all RSAs at all Part 139 airports and federally obligated airports conform to the AC’s standards, to the extent practicable; and supported the installations of an EMAS or an alternative that could provide a comparable level of safety in areas where a full RSA cannot be achieved. To accomplish these goals, the FAA initiated two subprograms: the first program addressed RSAs and EMAS, and the second addressed relocating or making frangible FAA-owned NAVAIDs located in RSAs. For the first program, the FAA surveyed runway ends at all commercial airports in the United States; identified about 1,000 runway ends with RSAs that were not in dimensional compliance with the AC; and, where practicable, funded improvements to bring the RSAs into compliance with the AC. These actions were completed by the congressionally mandated deadline of December 31, 2015. Where RSA compliance was not practicable, the FAA encouraged and funded EMAS installations. As of the end of 2017, EMAS had been installed at 113 runway ends at 68 airports in the United States and had safely stopped 13 overrunning aircraft with (collectively) 288 crew and passengers on board. For the second program, the FAA (to date) has made needed improvements to NAVAIDs in RSAs at the 30 busiest US airports and is scheduled to complete the remaining RSA improvements (representing about 4% of the identified NAVAID issues at smaller Part 139 airports) before December 31, 2018. Thus, the NTSB concludes that the FAA’s programs to improve RSAs, install EMAS, and relocate or make frangible FAA-owned NAVAIDs located in an RSA have led to increased safety for airplanes during runway overruns, such as in this accident. As a result, we are reclassifying Safety Recommendations A-03-11 and -12 “Closed—Acceptable Action” in this report.

46 When we issued Safety Recommendations A-03-11 and -12, AC 150/5300-13 was current.

NTSB Aircraft Accident Report 61 2.6 Weather Observer Procedures during Evacuation As described in section 2.2.2, the flight crew took appropriate measures to obtain adequate preflight weather information, and weather conditions encountered during takeoff played no role in the accident. However, the investigation highlighted procedural gaps that could be clarified to ensure dissemination of the most complete and accurate weather information possible. 2.6.1 Sign-Off Procedures On the day of the accident, a LAWRS observer did not sign off from the ASOS OID system before leaving the duty station when all ATCT personnel evacuated from the tower due to the high wind. As a result, after the LAWRS observer left, the ASOS continued to automatically disseminate METARs that did not contain the AUTO modifier to show that the reports were not being augmented by a weather observer. Neither the YIP ATCT evacuation procedures nor FAA Order JO 7900.5D (which was current at the time of the accident) specified any sign-off procedures for weather observers in the event that they must physically leave their stations during normal duty hours. 2.6.2 Backup Augmentation Responsibilities On the day of the accident, equipment issues at YIP also affected complete and accurate weather reporting. Due to a power outage that affected some sensors, the ASOS stopped providing wind, visibility, and other critical information. After evacuating the tower, LAWRS observers did not provide any backup information to supplement the missing ASOS data. As a result, for a 9-hour period that began about 2 hours before the accident, the automatically disseminated METARs contained only an altimeter setting and some remarks. Although FAA Order JO 7900.5D prescribed procedures for LAWRS observers that specified that, in the event that portions of the ASOS data become unavailable, the observers were required to provide backup information for wind, visibility, sky condition, and other parameters (FAA 2014b), it did not clearly specify if these backup requirements applied when the observers could not physically be at their duty stations. 2.6.3 Subsequent Revisions to FAA Order JO 7900.5D The FAA issued Change 1 to Order 7900.5D, effective November 29, 2017, that included some revisions related to both sign-off procedures and backup responsibilities for weather observers. Section 5.3 was revised to specify that, at part-time facilities with an automated system with SPECI capabilities (like YIP), “the observer must sign off…at the close of augmentation coverage and enter ‘Last’ in the remarks section of the METAR” (FAA 2017a). The NTSB notes, however, that this revised language refers only to the known close of an observer’s duty day. Thus, it remains unclear whether the sign-off procedures would apply in a scenario when an observer is forced to abandon the reporting station during normal duty hours. With regard to weather observers’ responsibilities to provide backup information for wind, visibility, sky condition, and other parameters in the event that portions of the ASOS data become unavailable, the revised FAA order included changes to Appendix B that provided specific

NTSB Aircraft Accident Report 62 procedures only for FAA contract and nonfederal weather observers who are unable to perform their prescribed duties from their normal place of operation (FAA 2017a). The NTSB notes that, although the revised order stated that FAA contract observers must relocate to a suitable location that has access to an ASOS OID and continue to provide weather observations (or, if unable to do so, they must leave the system in standalone AUTO mode), it did not contain any such procedures for LAWRS personnel. Thus, the NTSB concludes that, although facility evacuations are rare and no set of procedures and practices can cover all possibilities, clear guidance for weather observers that addresses circumstances involving restricted access to normal duty stations can help ensure that surface weather observations accurately reflect the augmentation status of the reports and are as complete as possible. Therefore, the NTSB recommends that the FAA revise Order JO 7900.5D, Change 1, to specify sign-off procedures and backup augmentation responsibilities for all types of weather-observing personnel when they are unable to perform their prescribed duties from their normal duty station during normal duty hours. 2.7 Evacuation Slide Malfunction All 110 passengers and 6 crewmembers evacuated the airplane (with one reported minor injury) using four of the airplane’s eight exits: the 1L and 2L doors and the left and right forward overwing exits. The aft left and right overwing exits were not opened, the tailcone exit’s opening was delayed (the door was initially restricted from opening by a jumpseat seatbelt), and the 1R door exit was unusable after the evacuation slide failed to inflate. According to flight attendant C, she twice pulled the manual inflation handle for the evacuation slide at the 1R door, but it did not inflate, so she blocked the unusable exit and redirected the passengers. Postaccident examination of the 1R door slide, valve, and inflation assembly found chafe mark evidence consistent with contact with the valve release cable ball end at that location, which suggests that the ball caught at that location when the flight attendant pulled the handle. Such catching could result from an incorrect installation of the valve release cable and would prevent the cable from rotating the valve to allow compressed gas to inflate the slide. Testing of the system with the cable installed correctly resulted in proper slide inflation. Thus, the NTSB concludes that the incorrect installation of the valve release cable in the valve assembly resulted in the failure of the 1R door evacuation slide to inflate. On July 14, 2017, Zodiac Aerospace (the parent company of the slide manufacturer) issued a revision to the CMM to provide more descriptive valve testing procedures intended to prevent improper cable installation. The revisions included steps for verifying that the valve release cable is installed securely in the valve assembly and for ensuring that pulling the cable results in the correct corresponding movement of the valve pulley.

NTSB Aircraft Accident Report 63

1. Findings
2. 1

Conclusions

1. The investigation determined that (1) the captain and the check airman were appropriately

qualified for the operation, (2) neither pilot was impaired by alcohol or other drugs, (3) the airplane was properly maintained, and (4) the airplane was within weight and center of gravity limits at takeoff.

1. Based on the available wind data for Willow Run Airport, the flight crew was not required to

perform high-wind parking procedures or request flight control inspections from maintenance personnel.

1. The flight crew’s preflight inspection and control check during taxi, which were performed in

accordance with the procedures specified in the Aircraft Operating Manual, could not have detected the overcenter position of the right elevator geared tab’s linkage or the resultant jammed elevator condition.

1. The flight crew’s preflight weather evaluation was sufficient to establish with reasonable

certainty that the conditions existing at the time of takeoff met the required minimums for departure.

1. The flight crew’s decision to use an increased rotation speed was appropriate for the known

weather conditions and consistent with company procedures.

1. The right elevator’s jammed condition rendered the airplane unable to rotate during takeoff.
2. The airplane’s lack of rotational response to the control column input during the accident

takeoff did not become apparent to the captain in time for him to have stopped the airplane on the runway.

1. Once the airplane’s inability to rotate became apparent, the captain’s decision to reject the

takeoff was both quick and appropriate.

1. The check airman’s disciplined adherence to company standard operating procedures after the

captain called for the rejected takeoff likely prevented further damage to the airplane and reduced the possibility of serious or fatal injuries to the crew and passengers.

1. Based on the results of the computational fluid dynamics simulation, the airflow at the

airplane’s parked location was affected by the presence of the large hangar that generated localized turbulence with a vertical component that moved the elevator surfaces rapidly up and down, which resulted in impacts against the elevator mechanical stops.

1. A static load on the elevators consistent with the airplane’s certification design limit for a

ground gust as specified in Title 14 Code of Federal Regulations 25.415 would not likely result in an overcenter condition of an elevator’s geared tab linkage.

NTSB Aircraft Accident Report 64

1. Although the reported wind at the airport did not exceed the horizontal ground gust limits

specified for transport-category airplanes, the effects of the large hangar near the accident airplane’s parked location resulted in a turbulent windflow with vertical components that imposed dynamic loads on the elevator system sufficient to jam the right elevator.

1. Although a unique combination of the large hangar’s effects on the wind at the airplane’s

parked location resulted in the elevator becoming jammed during ground gust conditions that were below the caution and warning criteria specified in the Aircraft Operating Manual and Aircraft Maintenance Manual, the circumstances of this accident highlight that Boeing’s safeguards do not adequately protect flight crews and passengers from the possibility that a free-floating elevator can become jammed, and the condition can remain undetected, before takeoff.

1. To ensure that the elevators of Boeing DC-9/MD-80 series and 717 model airplanes are

inspected by maintenance personnel when exposed to ground gusts that meet or exceed criteria specified in the Aircraft Maintenance Manual, operators of these airplanes must maintain awareness at all times of the forecast and known wind where the airplanes are parked.

1. The Federal Aviation Administration’s (FAA) programs to improve runway safety areas

(RSA), install engineered materials arresting systems, and relocate or make frangible FAA-owned navigational aids located in an RSA have led to increased safety for airplanes during runway overruns, such as in this accident.

1. Although facility evacuations are rare, and no set of procedures and practices can cover all

possibilities, clear guidance for weather observers that addresses circumstances involving restricted access to normal duty stations can help ensure that surface weather observations accurately reflect the augmentation status of the reports and are as complete as possible.

1. The incorrect installation of the valve release cable in the valve assembly resulted in the failure

of the 1R door evacuation slide to inflate. 3.2 Probable Cause The NTSB determines that the probable cause of this accident was the jammed condition of the airplane’s right elevator, which resulted from exposure to localized, dynamic wind while the airplane was parked and rendered the airplane unable to rotate during takeoff. Contributing to the accident were (1) the effect of a large structure on the gusting surface wind at the airplane’s parked location, which led to turbulent gust loads on the right elevator sufficient to jam it, even though the horizontal surface wind speed was below the certification design limit and maintenance inspection criteria for the airplane, and (2) the lack of a means to enable the flight crew to detect a jammed elevator during preflight checks for the Boeing MD-83 airplane. Contributing to the survivability of the accident was the captain’s timely and appropriate decision to reject the takeoff, the check airman’s disciplined adherence to standard operating procedures after the captain called for the rejected takeoff, and the dimensionally compliant runway safety area where the overrun occurred.

NTSB Aircraft Accident Report 65

1. Safety Recommendations
2. 1

New Recommendations To The Boeing Company: Complete the development of a modification for Boeing DC-9/MD-80 series and 717 model airplanes that will prevent the possibility of elevator jamming due to ground wind exposure. (A-19-1) Develop new preflight procedures or other mitigations for Boeing DC-9/MD-80 series and 717 model airplanes that will enable a flight crew to verify before takeoff that the elevators are not jammed. (A-19-2) Until the actions in Safety Recommendations A-19-1 and -2 are completed, revise the Aircraft Operating Manual and Aircraft Maintenance Manual for Boeing DC-9/MD-80 series and 717 model airplanes to lower the ground gust criteria that will require physical inspections and operational checks of the elevators by maintenance personnel. (A-19-3) To the Federal Aviation Administration: Determine if the ground gust limit loads contained in Title 14 Code of Federal Regulations 25.415 adequately ensure that critical flight control systems are protected from hazards introduced by ground gusts that contain dynamic, vertical wind components. (A-19-4) Ensure the operators of Boeing DC-9/MD-80 series and 717 model airplanes have procedures that define who is responsible for monitoring the wind that affects parked airplanes and for notifying maintenance personnel when conditions could meet or exceed the ground gust criteria specified in the Aircraft Maintenance Manual. (A-19-5) Revise Order JO 7900.5D, Surface Weather Observing, Change 1, to specify sign-off procedures and backup augmentation responsibilities for all types of weather-observing personnel when they are unable to perform their prescribed duties from their normal duty station during normal duty hours. (A-19-6) 4.2 Previously Issued Safety Recommendations Reclassified in This Report To the Federal Aviation Administration: Require all 14 Code of Federal Regulations Part 139 certificated airports to upgrade all runway safety areas that could, with feasible improvements, be made to meet the minimum standards established by Advisory Circular 150/5300-13, “Airport

NTSB Aircraft Accident Report 66 Design.” The upgrades should be made proactively, not only as part of other runway improvement projects. (A-03-11) Reclassified “Closed—Acceptable Action.” Require all 14 Code of Federal Regulations Part 139 certificated airports to install engineered materials arresting systems in each runway safety area available for air carrier use that could not, with feasible improvements, be made to meet the minimum standards established by Advisory Circular 150/5300-13, “Airport Design.” The systems should be installed proactively, not only as part of other runway improvement projects. (A-03-12) Reclassified “Closed—Acceptable Action.”

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member

BRUCE LANDSBERG JENNIFER HOMENDY Vice Chairman Member

Adopted: February 14, 2019

NTSB Aircraft Accident Report 67 Appendixes Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified of this accident on March 8, 2017, shortly after the accident occurred. Investigators from NTSB headquarters in Washington, D.C., arrived on scene the following morning. Investigative groups were formed to evaluate operational factors; airplane systems, maintenance, and structures; survival factors; and the cockpit voice recorder. Also, specialists were assigned to evaluate the meteorological conditions, airplane performance, pilot toxicology reports, and the flight data recorder. An unmanned aircraft system team provided photogrammetric models to support the wind study simulation. The Federal Aviation Administration, The Boeing Company, and Ameristar Air Cargo, Inc., were parties to the investigation.

NTSB Aircraft Accident Report 68 Appendix B: Cockpit Voice Recorder Transcript The following is the transcript of the L-3/Fairchild FA2100-1020 cockpit voice recorder, serial number 000357984, installed on a Boeing MD-83, N786TW, which crashed after an aborted takeoff from Willow Run Airport, Ypsilanti, Michigan.

LEGEND

ATIS Automated terminal information service broadcast CAM Cockpit area microphone voice or sound source FA Flight attendant voice or sound source GND Radio transmission from the Hanscom ground controller HDL Ground handler voice or sound source HOT Flight crew audio panel voice or sound source INT Intercom N555P Aircraft (Baron) in the pattern at Willow Run PA Public address system sound source RDO Radio transmission from N121JM TWR Radio transmission from the Hanscom airport tower controller -1 Voice identified as the check airman -2 Voice identified as the captain -3 Voice identified as cabin crewmember -4 Additional voice identified as cabin crewmember -5 Additional voice identified as cabin crewmember -? Voice unidentified * Unintelligible word

Expletive @ Non-pertinent word ( ) Questionable insertion [ ] Editorial insertion Note 1: Times are expressed in eastern standard time (EST). Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed. Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken. Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft.

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 12:49:35 Start of Recording 12:50:06 Start of Transcript 12:50:06 CAM-2 ah we wanna see that right side put back. 12:50:12 CAM-1 I might go in and get the . 12:50:15 CAM-2 alright. 12:50:16 CAM-2 you walked around and did all that? 12:50:17 CAM-1 yeah absolutely. 12:50:35 CAM [unintelligible background voices and conversations consistent with passenger boarding]. 12:55:50 HDL-1 man alive. 12:56:09 HDL-1 will be, should be pretty fun getting this thing off of the ground huh? 12:56:12 CAM-2 yeah glad I don't have to get it back on the ground. Ahm thanks for comin' over. 12:56:16 HDL-1 yeah no problem. better up here than out there. 12:56:23 CAM-2 ahm just a couple forms we have to fill out for ground handlers. if you could please just write your name and then sign right there. NTSB Aircraft Accident Report 69

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 12:56:28 HDL-1 okay. okay. 12:56:36 CAM-2 appreciate it. 12:56:37 HDL-1 yeah no problem. 12:56:43 CAM-2 all that form is, is ah, certifying that you received training on all the duties that you already know how to do, so. 12:56:51 HDL-1 right right. 12:56:52 CAM-2 okay there's that one. and then for ah loading. ah can I just get the first names for the guys that are gonna load? 12:57:02 HDL-1 yeah @, @, @, and @. 12:57:14 CAM-2 ahm @? 12:57:15 HDL-1 yes. 12:57:19 CAM-2 okay when you load the bags start with the far back 12:57:23 HDL-1

• the back first.

12:57:24 CAM-2 the back of the back. 12:57:25 HDL-1 I'll get yeah. NTSB Aircraft Accident Report 70

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 12:57:26 CAM-2 and as soon as that's full then go the front of the number three pit. 12:57:29 HDL-1 okay. 12:57:30 CAM-2 and then hopefully everything will fit there if not then you know work your way forward. 12:57:34 HDL-1 okay. 12:57:35 CAM-2 cause this thing is ah nose-heavy so. 12:57:38 CAM-2 the more weight we can get in the back the better. 12:57:40 HDL-1 okay. 12:57:40 CAM-2 and then keep track of the number of bags in each - 12:57:42 HDL-1 yes sir. 12:57:43 CAM-2 location please. 12:57:44 HDL-1 yeah can do. 12:57:45 CAM-2 thank you appreciate it. 12:57:46 HDL-1 yeah no problem. NTSB Aircraft Accident Report 71

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 12:57:47 CAM-2 alright good luck. we're all counting on you. [laughter]. 12:59:27 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:01:11 CAM-1 alright (can) you get some, speeds for a hundred and forty six thousand? 13:01:18 CAM-2 that is gonna be the weight? 13:01:23 CAM-2 we have a current temp? 13:01:24 CAM-2 just get off of ah. 13:01:26 CAM-1

• below (nine) .

13:01:30 CAM-1 let's go off of this one, nine degrees. 13:01:32 CAM-2 okay. 13:01:39 CAM-1 you got that, good deal. **. 13:01:48 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:03:42 CAM-2 I want to me show you this real quick. using nine degrees so ten degrees Fahrenheit one forty six V-speeds right here. is that, did I do that (correct)? 13:03:53 CAM-1

• * ten (knots)?

NTSB Aircraft Accident Report 72

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:03:54 CAM-2 I'm sorry yeah, you need to be in this column. 13:03:58 CAM-2 so it's, all the way down here? 13:04:01 CAM-1 yeah. So speed yeah. right there. flaps sixteen use flaps fifteen. 13:04:06 CAM-2 fifteen okay very good. 13:04:07 CAM-1 fifteen. 13:04:11 CAM-1 so what I used to do then, use max thrust. 13:04:15 CAM-2 yeah. 13:04:16 CAM-1 flaps fifteen. 13:04:18 CAM-2 and then stab that's for stab which we don't know yet. and then speeds are one thirty nine. 13:04:23 CAM-1 one thirty nine. 13:04:24 CAM-2 one forty two. 13:04:25 CAM-1 one forty two. 13:04:26 CAM-2 one fifty. 13:04:27 CAM-1

• fifty.

NTSB Aircraft Accident Report 73

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:04:28 CAM-2 one sixty five. 13:04:30 CAM-2 and then the other . 13:04:32 CAM-1 ** delay rotation until at least V-two. 13:04:36 CAM-2 yeah, that's. 13:04:37 CAM-1 *** wait for me to call it. 13:04:39 CAM-2 yup. 13:04:46 CAM-2 I'd like to try to put the flightplan in the box if that's *. for practice. 13:04:50 CAM-1 I'll ah read them off for you. 13:04:55 CAM-1 CARLETON. 13:04:56 CAM-2

• hold on.

13:05:05 CAM-2 okay go ahead. 13:05:08 CAM-1 next one is gonna be ah WOOST w- oscar oscar ah sie- sierra tango. 13:05:16 CAM-1 next one is ah romeo india echo kilo echo. 13:05:26 CAM-2 okay. NTSB Aircraft Accident Report 74

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:05:27 CAM-1 next one is dryer delta juliet bravo. 13:05:30 CAM-2 yup. 13:05:34 CAM-1 next one is ah bravo oscar bravo charlie tango. 13:05:44 CAM-1 next one is a BIGLE bravo india golf lima echo. 13:05:53 CAM-2 'kay. 13:05:56 CAM-1 next one is BLISS bravo lima india sierra sierra. 13:06:02 CAM [unintelligible background conversations]. 13:06:05 CAM-1 next one is OTMAN oscar tango mike alpha november. 13:06:16 CAM-1 next one is JAMOX juliet alpha mike oscar x-ray. 13:06:24 CAM-2 'kay. 13:06:26 CAM-1 next one is LAYED lima alpha yankee echo delta. 13:06:38 CAM-1 do we have any stars in there? 13:06:41 CAM-2 oh that's, that's it? 13:06:45 CAM-2 ****. 13:06:46 CAM-1 yeah. NTSB Aircraft Accident Report 75

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:06:49 CAM-1 H-V-Q. let me see what's (wrong) with (any of that). 13:06:57 CAM-1

• winds out of the west *.

13:07:10 CAM-1 better not be # gusting to thirty knots out of the west. 13:07:15 CAM-2 well then we'll use ah three zero * we have to. 13:07:18 CAM-1 huh? 13:07:19 CAM-2 have to use three zero then. 13:07:25 CAM-1 yeah just put ah. put one nine right down for now. 13:07:29 CAM-2 one nine right. 13:07:35 CAM-1 (let’s go). 13:07:36 CAM-2 ah you wanna review it before you execute? 13:07:38 CAM-1 *. 13:07:40 CAM-2 so, HUNTINGTON, GIBBS two. 13:07:44 CAM-1 you gotta go to the legs page. 13:07:45 CAM-2 legs. 13:07:48 CAM-2 CARLETON, WOOST, RIEKE, DRYER, BOBCAT. NTSB Aircraft Accident Report 76

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:07:54 CAM-2 BIGLE, BLISS, OTMAN, JAMOX, LAYED. 13:07:59 CAM-2 and I should close this discontinuity, right? 13:08:01 CAM-1 yeah. 13:08:04 CAM-2 HUNTINGTON, PINFA, WOOJO, BERT, WHO. BEEZLY, GIZMO, BBONE, KILMER, AUTO, MAY, GRIFFIN, GIBBS, SUNY, J, Y-D-Y-U-whatever, M- A-T-T-C then vectors, CLAY, MOHE now we're on for the runway, so. 13:08:30 CAM-1 we'll just see what - we'll check it * it didn't match the last two fixes but that might be because of the runway. 13:08:30 CAM-2

• *.

13:08:35 CAM-2 right, right. 13:08:36 CAM-1 we'll check it *. 13:08:37 CAM-2 I'll execute, and then ah. 13:08:41 CAM-2 total distance. 13:08:44 CAM-2 what do you have for the - I have ah five hundred and forty three, nautical miles? 13:08:48 CAM-1 yeah. NTSB Aircraft Accident Report 77

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:08:49 CAM-2 is that right? 13:08:50 CAM-1 yeah that's with the I-L-S. 13:08:52 CAM-2 sure, sure. 13:09:01 HOT-1 it's an hour down there password will be @. 13:09:09 CAM-2 current time is eighteen oh nine, thirty, seven. 13:09:15 CAM-1 three thousand. 13:09:25 CAM-2

• thirty three?

13:09:25 CAM-? ***. 13:09:27 CAM-? okay. 13:09:29 CAM-1 ah, let's go ahead and do the brief ***. 13:09:32 CAM-2 alright. it's gonna be a left seat takeoff. a hundred and forty six thousand pounds flaps fifteen. speeds one thirty nine, one forty tow, one fifty, one sixty five, one ninety nine, two forty eight. max thrust we are going to delay our rotation because of the gusty, strong gusty winds, do the short segment climb checklist * better immediate return, quite honestly, I think it would be prudent to go over to Metro for the longer runway - 13:09:58 CAM-1 absolutely, we're not coming *. NTSB Aircraft Accident Report 78

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:10:01 CAM-2 there are no M-E-Ls here. ah taxi operations we'll just go right here golf to two three left. no hot spots. departure NOTAMS * frequencies are out of service we'll have to get our clearance some other way. and we'll use C-TAF to announce our intentions. departure SID ahm there is none, initial course of whatever they give us to ah join the ah course into CARLETON. two thirty three the initial heading, just runway heading. altitude we know is gonna be three thousand feet, probably eighteen ninety five for a Detroit ah departure, transponder code . call out any abnormals that you see. really keep an eye out on what our airspeed is doing today. ahm, in the event of an engine fire or failure at or after V-1 we're going to continue the takeoff, treat it as an inflight emergency just head on over to Metro. level off height here is fifteen sixteen and is no procedure. and ah we'll head on over to Metro and do it visually. ah stall warning or windshear warning, we're not expecting any kind of stall today, but ah windshear for sure, keep an eye out on the ah, if you get any kind of a warning it's gonna be max thrust, ah all the way to firewall thrust if necessary, leave the aircraft configured, we'll fly out of the shear, back me up on the ah airspeed calls and the * speed calls. any questions anything to add? 13:11:27 CAM-1 nope. 13:11:29 CAM-2 let's do the ah before start to the line. 13:11:35 CAM-2 is the mirror up to remind you of anything, for a reason? or, is that just up? NTSB Aircraft Accident Report 79

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:11:41 CAM-1 briefing complete? 13:11:42 CAM-2 completed, set. 13:11:44 CAM-1

• .

13:11:45 CAM-2 three on board. 13:11:46 CAM-1 cockpit preparations. 13:11:46 CAM-2 are complete. 13:11:48 CAM-1

• preflight inspection?

13:11:49 CAM-2 completed. 13:11:49 CAM-1

• windows?

13:11:50 CAM-2 closed and locked. 13:11:51 CAM-1 **. 13:11:51 CAM-1

• circuit breakers?

13:11:52 CAM-2 are checked. 13:11:53 CAM-1 checked oxygen and interphone. 13:11:55 CAM-2 checked on one hundred percent. NTSB Aircraft Accident Report 80

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:11:57 CAM-1 checked on one hundred percent, smoke goggles? 13:11:58 CAM-2 are checked. 13:11:59 CAM-1 pressurization? 13:12:01 CAM-2 is ah auto up and set. 13:12:02 CAM-1 air conditioning shutoff? 13:12:04 CAM-2 is auto. 13:12:04 CAM-1 anti-skid? 13:12:05 CAM-2 is armed. 13:12:06 CAM-1 (E)GPWS. 13:12:07 CAM-2 tested. 13:12:07 CAM-1 ***. 13:12:10 CAM-2 all normal. normal. 13:12:10 CAM-1 emergency lights? 13:12:11 CAM-2 ah armed. 13:12:14 CAM-1 seatbelt no smoking sign? NTSB Aircraft Accident Report 81

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:12:15 CAM-2 on. 13:12:16 CAM-2

• ?

13:12:17 CAM-2 ah checked and set. 13:12:21 CAM-2 checked and set. 13:12:22 CAM-1 clocks and altimeters? 13:12:24 CAM-2 I've got ah twelve minutes past. altimeter two niner eight one. seven hundred and eighty feet checked and set. 13:12:28 CAM-1 eighteen twelve, two niner eight one, set. F-M- S? 13:12:34 CAM-2 checked and set. 13:12:40 CAM-1 checked and set. engine oil quantity? 13:12:42 CAM-2 is checked. 13:12:44 CAM-1 takeoff warning? 13:12:46 CAM [sound of warning tone] slats [electronic voice], [sound of warning tone] brake [electronic voice], [sound of warning tone] flaps [electronic voice], [sound of warning tone] slats [electronic voice]. 13:12:54 CAM-2 checked. NTSB Aircraft Accident Report 82

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:12:56 CAM-1 ah rudder power? 13:12:57 CAM-2 power. 13:12:59 CAM-1 radar? 13:12:59 CAM-2 is off. 13:13:01 CAM-1 transponder? 13:13:02 CAM-2 standby. 13:13:03 CAM-1 radios? 13:13:04 CAM-2 are set. 13:13:04 CAM-1 set. 13:13:05 CAM-1 rudder and aileron trim? 13:13:07 CAM-2 free and zero. 13:13:08 CAM-1 parking brakes. 13:13:09 CAM-2 set * checked. 13:13:11 CAM-2 (thank you). NTSB Aircraft Accident Report 83

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:13:35 CAM-2 feel sorry for the regional guys that're only going like an hour out of Metro and then coming back, you gotta fly in this # all day. 13:13:49 CAM-2 at least long haul you can take off and get outta here. 13:14:12 CAM-2 #. 13:14:13 CAM-? ****. 13:14:39 ATIS Willow Run tower information X-ray 1653z winds two six zero at three five gust five zero visibility one zero sky clear below one two thousand temperature one one dew point minus one one altimeter 29.81 remarks *** 1639z runway five right circle to land runway two seven ** landing and departing runway two seven ****. 13:15:31 CAM-1 I'm gonna, I'm gonna call ask @ can we legally use this weather? because I'm not, I'm not gonna have the FAA come afterwards, how did you guys take off outta there? hold on one second. 13:15:40 CAM-2 yeah that's fine. 13:15:43 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:15:45 CAM-2 you have the ah flight plan handy? 13:15:48 CAM-1 they're gonna bring it out. NTSB Aircraft Accident Report 84

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:15:51 CAM-1 they gotta send it to the other side * the power is out. [consistent with cell phone call]. 13:16:11 CAM-1

• got a little problem. ahm Willow Run. ah. tower is

closed. airport uncontrolled because they lost power. ATIS is out of service. * last weather reported. you gotta call in to * one six five three. ah how do we legally take off? [consistent with cell phone call]. 13:16:44 CAM-1 yup. [consistent with cell phone call]. 13:16:53 CAM-1 gusting to fifty two knots *. [consistent with cell phone call]. 13:16:57 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:17:00 CAM-1 ****. 13:17:08 CAM-1 well @ is fine sir. [consistent with cell phone call]. 13:17:12 CAM-2 tell him the risk assessment went way up. 13:17:25 CAM-1 yeah I just want to have something on record if the FAA comes back and say how did you guys take off. [consistent with cell phone call]. 13:17:51 CAM-2 they're comin' out. NTSB Aircraft Accident Report 85

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:17:53 CAM-1

• can you call Ameristar and find out where our

paperwork's * talk to @. [consistent with cell phone call]. 13:17:59 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:18:13 CAM-1

• fuel burn ***. [consistent with cell phone call].

13:18:20 CAM-2 breezy out there. 13:18:34 CAM-2 hi @ is @ there please? thank you. thank you. [consistent with cell phone call]. 13:18:41 CAM-1 yeah they reported I think eleven on the sixteen fifty three weather. [consistent with cell phone call]. 13:18:55 CAM-2 hi @ it's @ ah @ asked me to call you they still, they still have not brought our paperwork out **** we'll keep watching for it part of the airport, part of the airport has lost power so, we'll keep looking for it. alright perfect okay excellent. thank you. yeah bye bye. [consistent with cell phone call]. 13:18:58 CAM-1

• at what time? seventeen? okay and that was ten

point ? okay. appreciate it. [consistent with cell phone call]. 13:19:34 CAM-2 he got an e-mail from somebody that it's on its way, but he's gonna call again to follow up. 13:20:33 CAM-1 It's all start loading aft . NTSB Aircraft Accident Report 86

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:20:37 CAM-2 and to keep track of the bags. he understood all that, so. 13:20:51 CAM-2 that's extra envelope is for, Dulles, and then I got a fuel vendor audit out for Dulles, and then the PHM- four - 13:20:59 CAM-2 did you set this thing ***? 13:21:00 CAM-2 I did not, you don't have too. 13:21:03 CAM-1 ah I don't know *. 13:21:05 CAM-2 the PHM-four is still out and the HAZMAT form is still out. 13:21:09 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:21:17 CAM [sound consistent with stab trim aural annunciation]. 13:21:31 FA-4 it's pretty nice for you, you don't have to screen. 13:21:33 CAM-? huh? 13:21:34 CAM-2 hey @ how are you? 13:21:35 FA-? we're not making any money though. and we're not making any money for your guys, like we always do. NTSB Aircraft Accident Report 87

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:21:37 FA-4

• we're missin' out on our twenty eight bucks.

13:21:44 FA-4 yeah you guys screen and we get the money. 13:21:48 CAM-2 oh you said screen, I though you said nice for us that we didn't have to scream. 13:21:52 FA-4 ah we'll do that during takeoff, I'm sure. 13:21:56 CAM-2 I was trying to figure out what you meant. I thought- 13:21:58 CAM-? security. 13:21:59 CAM-2 yeah I got it. 13:22:03 CAM-1 I didn't see the shear ***. 13:22:07 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:22:29 CAM-1 thank you. appreciate it. for some reason they don't have any power here. 13:22:30 CAM-? ***. 13:22:34 CAM-1 thank you appreciate it. 13:22:35 CAM-2 thanks for bringing it over. 13:22:36 CAM-? yeah, cool. NTSB Aircraft Accident Report 88

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:22:38 CAM-? ***. 13:22:39 CAM-2 oh yeah. 13:22:42 HDL-3 even rockin' the airplane *. 13:22:44 CAM-2 oh yeah. 13:22:52 HDL-3 should be everything there. hopefully. 13:22:55 CAM-? ***. 13:23:01 HDL-3 is that everything you needed? 13:23:03 CAM-1 well I just needed two of these but we'll make it work. 13:23:05 HDL-3 oh you need two? 13:23:07 CAM-1 yeah no worries. 13:23:10 HDL-3 can you make out without one? 13:23:12 CAM-1 yeah. 13:23:13 HDL-3 I can go get you another if you need it. 13:23:15 CAM-1 no I'll I'll e-mail the it in instead of the, mailing it in. 13:23:19 HDL-3 okay, have a safe flight gentlemen. thank you. NTSB Aircraft Accident Report 89

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:23:42 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:24:09 CAM-1 it's gonna be very bumpy *. 13:24:29 CAM-1 [sound of sneeze] yeah you would think they would have backup generators. 13:24:32 CAM-2 yeah. 13:24:47 CAM-2 so you'll have to call flight service on your phone? I don't know of any other way to get 'em. 13:25:28 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:25:39 CAM-1 thank you. 13:25:59 CAM-1

• is ten two seventy six.

13:26:05 CAM-2 *** the flight plan? 13:26:07 CAM-1 ***? 13:26:09 CAM-2 seven five forty three. 13:26:15 CAM-2 ***. 13:26:17 CAM-1 sixteen three. NTSB Aircraft Accident Report 90

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:27:22 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:28:54 CAM-2 so what did @ we okay to go with that recorded weather it - it's an hour old? 13:28:59 CAM-1 no, naw you gotta in and check on the ah ARCAM. it's it's on there in that runway analysis stuff and they have a ah I've never done it so I gotta go in myself. You, you can pull up the last temperatures that way and put a time on it. temperatures pretty much all everything you need. 13:29:19 FA-1 could you guys call AVFLT and see if they ah loaded flagpole for the van, they're asking if we can clarify that * it's loaded on the bus. 13:29:28 CAM-1 which AVFLT? 13:29:29 FA-1 ** these people that loaded - 13:29:32 CAM-1 the power is out. 13:29:34 FA-1 and all the water and ah. 13:29:37 CAM-1 I don't even have their phone number *. 13:29:40 CAM ***. 13:29:46 CAM-2 it was in the, it was in the bus? NTSB Aircraft Accident Report 91

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:29:48 FA-1 yeah. 13:29:51 CAM-1 why don't we ask one of the? 13:29:52 FA-1 why didn't she ask that when she was inside? 13:29:57 CAM-? whatever. 13:29:59 FA-1 ah one of those one. 13:30:00 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:30:17 CAM-2 here's a number if you wanna call. area seven three four, four eight two - 13:30:24 CAM-1 hold on a second, seven three four. 13:30:27 CAM-2 four eight two. 13:30:27 CAM-1 yep. 13:30:28 CAM-2 two six two one. 13:30:34 CAM-2

• frequency ** it's not gonna work.

13:30:48 CAM-1 yeah the power is out. 13:30:50 CAM-2 yeah so nothing's gonna work. NTSB Aircraft Accident Report 92

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:30:55 CAM-2 when the guy comes up to give us the bag count we'll get it from him. 13:31:15 CAM-1 I don't think we can reach Detroit on the ground here. 13:31:18 CAM-2 I don't think so. 13:31:19 CAM-1 huh? 13:31:20 CAM-2 we can try. 13:31:22 CAM-2 it'd make life a lot easier. 13:32:35 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:34:42 CAM-2 was the phone *? 13:34:44 CAM-1 no its a- 13:34:46 CAM-2 one of their ah guys will come up and give us the bag count and we'll ask him then. 13:34:50 FA-1 that's uncle @ he's inside, right? 13:34:52 CAM-? yeah. there ya go. 13:35:00 CAM-? I forgot about him. NTSB Aircraft Accident Report 93

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:35:02 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:35:37 CAM-2 hey @? 13:35:54 CAM-2 hey @? Oh ah you're on the phone, I'm sorry. 13:36:00 FA-1 they're coming inside right now @, so, yeah. 13:36:08 FA-1 yeah it was with the luggage it was with the luggage. 13:36:14 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:37:01 HDL-2 alright ahm for the rear bin we have, do you want the three sections or a total? 13:37:07 CAM-2 ah three sections. 13:37:07 CAM-1 do you guys have the players bags and everything on? 13:37:10 HDL-2 ah the second bus has just left, so they'll be here in about fifteen. 13:37:14 CAM-1 okay. 13:37:15 HDL-2 but in the very rear section, twenty nine. NTSB Aircraft Accident Report 94

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:37:18 CAM-2 look wait a minute there's another bus coming, so are you gonna add to that? 13:37:20 HDL-2 yes. 13:37:21 HDL-2 yeah, the- this is just in the back bin. 13:37:23 CAM-2 okay so. 13:37:23 CAM-1

• full already?

13:37:24 HDL-2 the back bin's full, so twenty nine, twenty seven, and seven. 13:37:31 CAM-1 seven in the mid already? 13:37:32 HDL-2 yeah * yeah. 13:37:35 CAM-1 we don't want anything in the forward, so make sure to fill up the -. 13:37:39 HDL-2

• the mid? okay, yeah I mean, the basketball team

normally isn't a terribly large amount. so, hopefully we'll be able to do that. 13:37:46 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:37:50 HDL-2 so in D-two, 13:37:53 CAM-1 alright. NTSB Aircraft Accident Report 95

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:37:55 CAM-1 twenty nine. 13:37:59 CAM-1 twenty nine times thirty. 13:38:01 CAM-1 D-two is all the way back, it's ah eight seventy. 13:38:04 CAM-2 eight seven. eight seven zero. 13:38:08 CAM-1

• .

13:38:12 CAM-1 and a D-one, ah twenty seven bags at eight ten. 13:38:18 CAM-2 okay. 13:38:26 CAM-1 and in C-two, you need to scratch that off and - 13:38:31 CAM-2 oh because it's gonna be - 13:38:32 CAM-1 yeah. just initial it. 13:38:42 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:38:57 CAM-1 we got one eighty six, two hundred. 13:39:00 CAM-2 two hundred. three seventy and then *. 13:39:05 CAM-1

• one * is.

13:39:07 CAM-2 eight ten. NTSB Aircraft Accident Report 96

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:39:07 CAM-1 eight ten. 13:39:08 CAM-2

• (eight seventy).

13:39:10 CAM-1 (eight seventy). 13:39:12 CAM-1 you put fuel down already? 13:39:14 CAM-2 ah, I put eighteen thousand in the wing, I did not put anything in the center yet. because I wasn't sure how much we were gonna burn down. 13:39:23 CAM-2 want ah twelve thousand in the center? 13:39:26 CAM-1 ah we'll show ah thirty point five total fuel. 13:39:28 CAM-2 so twelve five then. 13:39:33 CAM-1 ah we can show thirty one *. 13:39:34 CAM-2 so then it'll be thirteen thousand in the center. 13:39:38 CAM-1 *. 13:39:44 CAM-1 *** fuel burn is, ten two seventy six, ten two seventy six. 13:40:05 CAM [sound similar to sneeze.] 13:40:11 CAM-2 God bless you. NTSB Aircraft Accident Report 97

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:40:39 CAM ***. 13:40:48 CAM-2 so @, we're gonna have both the band, and and the team on board or? 13:40:52 FA-1 looks that way. [sound of laughter]. 13:40:56 CAM [non-flight related conversation]. 13:41:26 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:41:53 CAM-2 what is ah departure eighteen ninety five out here? 13:41:56 CAM-1 that's Detroit. 13:41:59 HOT [sound similar to static]. 13:42:08 HOT [sound similar to static]. 13:42:13 CAM-2 I don't think so. 13:42:15 CAM-1

• hearing *?

13:42:18 CAM-2 not hearing anything? 13:44:47 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:46:10 CAM-1 can we get some candy please? we just ran out. NTSB Aircraft Accident Report 98

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:46:11 FA-1 we just ran out *. 13:46:13 CAM-1 yeah right [sound of laughter] 13:46:20 CAM-2 you want some trail mix. ***. 13:47:02 CAM-2 did you see *** when we pulled up to the airport? did you look? 13:47:07 CAM-1 yeah I looked I couldn't see it. 13:48:01 CAM-1 huh look at this. 13:48:04 CAM-2 what am I looking at? 13:48:05 CAM-1 a roof panel that came up? 13:48:09 CAM-2 still there. 13:48:10 CAM-1 on the building. 13:48:20 CAM-2 okay we're hearing them. 13:48:38 CAM-1 that's why I called them instead of. I didn't want to tie up Detroit approach because that's the same frequency for everyone going into Metro. 13:48:45 CAM-2 that's fine. they don't sound very busy right now. NTSB Aircraft Accident Report 99

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 13:49:23 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 13:54:35 HDL-2 [non-flight related conversation]. 13:57:25 CAM-2 I tried that earlier the other ramp * worked. 13:57:53 CAM-1 maintenance said told me that you gotta have a signal going from NAV one one to the the autothrottles. it's like why would, why would that be connected? 13:58:04 CAM-2 I don't know. that doesn't make sense. but if that's true. so. 13:58:09 CAM-1 that's why it didn't work. 13:58:15 CAM-1 they said they replaced the receiver on that thing. 13:58:17 CAM-2 right. 13:58:21 CAM-1 did you see that fuel ticket ? 13:58:24 CAM-2 ah they never brought one on. 13:58:26 CAM-1 I had a little yellow one somewhere ***. 13:58:36 CAM [unintelligible background voices and conversation consistent with passenger boarding]. NTSB Aircraft Accident Report 100

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:02:54 FA-3 we got two police officers that going to be flying with 'em. 14:02:58 CAM-1 fill out a form? 14:02:58 FA-3 they don't have, they don't have their forms. I gotta get the forms. oh shoo. 14:03:01 CAM-2 I'll get it. 14:03:01 CAM-1 I'll get 'em. 14:03:06 CAM-1 they're law enforcement officers? 14:03:07 FA-3 yes. 14:03:08 CAM-1 okay. 14:03:09 FA-3 and they're carrying weapons on them. 14:03:11 CAM-1 alright. 14:03:14 CAM-1 so which one is that one? 14:03:16 CAM-2 P-H-M seven and eight. 14:03:21 CAM-1 I think we only need seven for . because I haven't seen it. all I've seen here are P-H-M fours. NTSB Aircraft Accident Report 101

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:03:25 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 14:03:29 CAM-2 is it the other one? 14:03:38 CAM-1 are they here on the airplane? 14:03:40 FA-3 no they're still inside. 14:03:45 CAM-2 it might be in that ah three ring binder, in the locked **. because I haven't seen it. all I've seen are P-H- M fours. 14:03:58 FA-3 I'm gonna I probably have some in mine. 14:04:01 CAM-1 would you bring that ah, overhead, binder? 14:04:04 FA-3 *. 14:04:05 CAM-2 he needs the key, right, isn't the key over here? 14:04:09 CAM [unintelligible background voices and conversation consistent with passenger boarding]. NTSB Aircraft Accident Report 102

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:04:33 FA-2 ladies and gentlemen welcome onboard Ameristar charter. please remember that all carry on articles must be stowed and properly secured under the seat in front of you or in an overhead compartment. please use caution when opening the overhead compartment, if you article do not fit properly or you need assistance in stowing **** can I have the attention of the passenger seated in an emergency exit row, please read the emergency * criterion on the safety information card in the seat packet in front of you review the information explaining the exit row requirements. if you are seated **** criterion or are unable to carry out the instructions feel free to let one of the flight attendants know so you can be reseated at this time. in compliance with federal regulations smoking is not permitted in this cabin. the smoking of e-cigarettes is not permitted in the aircraft. thank you for your attention. 14:04:38 CAM-2 there's two ah breakers popped here. 14:04:40 CAM-1 what is it? 14:04:42 CAM-2 forward water system, and, they're both water related. they, they can go in, right? 14:04:50 CAM [multiple unintelligible voices]. 14:05:37 FA-3 okay tell them I'm coming out. 14:05:49 CAM-1 that's all you need. 14:05:51 FA-3 just this one? NTSB Aircraft Accident Report 103

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:05:53 CAM-1 that for passengers are not . 14:06:00 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 14:06:56 CAM-1 [sound similar to phone ringtone] honey I gotta call you when I get to Washington, I'm very busy *****. [consistent with cell phone call]. 14:09:12 CAM [sound similar to telephone ringtone]. 14:10:16 CAM [unintelligible voices]. 14:10:21 CAM-? this is one of the police officers **. 14:10:30 FA-? you guys have ahm paperwork for an armed ***? 14:10:33 CAM-2 I gave it to @ already. 14:10:34 FA-? oh okay I didn't know about that. 14:10:35 CAM-2 yeah he's got it. 14:10:37 FA-? okay. 14:10:38 CAM [sounds consistent with passengers boarding the aircraft]. 14:11:48 CAM [unintelligible background voices and conversation consistent with passenger boarding]. NTSB Aircraft Accident Report 104

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:13:54 INT [sound similar to passenger call button]. 14:14:03 FA-2 @? 14:14:05 FA-5 @? 14:14:05 FA-5 yes? 14:14:06 FA-2 can you ah bring a few sick bags up for me please? 14:14:09 FA-5 say that one more time. 14:14:10 FA-2 can you bring up a few sick bags for me? 14:14:13 FA-5 sick bags? 14:14:14 FA-5 okay. 14:14:15 FA-2 thank you. 14:15:28 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 14:19:02 CAM-2 your phone rang while you were gone, so you got a missed call. 14:19:11 CAM-1 can't even fit bags. 14:19:12 CAM-2 huh? NTSB Aircraft Accident Report 105

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:19:13 CAM-1 it's * (forward) is packed. 14:19:14 CAM-2 oh is it? 14:19:35 CAM-2 so how did you do this R-C-A-M thing? 14:19:39 CAM-1

• .

14:19:40 CAM-? *. 14:19:41 CAM-2 because the power's out right so you couldn't - 14:20:04 CAM-1 (we) can erase A and B too. 14:20:08 CAM-2 I didn't put anything in. 14:20:10 CAM-1 ah look here. 14:20:40 CAM-2 well if they make it to Sunday they gotta pack for five days. four days I guess. 14:21:06 CAM-? almost there. 14:21:10 CAM [multiple unintelligible background voices]. 14:22:22 CAM-2 do you know how * those numbers broke down? 14:22:24 CAM-1 ah you're probably gonna have to move some passengers, to the back. NTSB Aircraft Accident Report 106

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:22:28 CAM-1 how many do we have one twelve? 14:22:29 CAM-2 I didn't hear a count. 14:22:33 CAM-1 no count yet? 14:22:35 FA-1 there's still people loading stuff. (we don't) everybody on board. 14:22:36 CAM-1

• .

14:22:39 CAM-1 what where's @ with the paperwork? 14:22:41 FA-1

• (@) is outside, doing something.

14:22:45 CAM [unintelligible background voices and conversation consistent with passenger boarding]. 14:23:27 CAM-? hey @. 14:23:31 FA-2 we got one, minus one, so one oh nine. 14:23:38 CAM-1 one ten with you? 14:23:40 FA-2 yeah one ten with me. 14:23:41 CAM [unintelligible]. 14:23:41 CAM-2

• * paperwork.

NTSB Aircraft Accident Report 107

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:24:15 CAM-1 @. 14:24:18 FA-1 what's up? 14:24:19 CAM-1 I cannot have more than thirty passengers in zone one. 14:24:21 FA-1 in zone one? 14:24:25 CAM-1 that, that's all you gotta count. 14:24:34 CAM-1 we'll just do this, ah you ready? 14:24:35 FA-1 yeah. 14:24:37 CAM-1 zone one twenty five at forty eight seventy five. 14:24:44 CAM-? (okay). 14:24:45 CAM-1 zone two forty at seventy eight hundred. 14:24:48 CAM-? okay. 14:24:49 CAM-1 zone three forty five at eighty * - 14:24:52 FA-1 so we have thirty two in zone one but look eight of them are kids, like little tiny kids. 14:24:58 CAM-1 (we) show there's twenty five, forty, forty five. NTSB Aircraft Accident Report 108

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:25:00 FA-1 twenty five, forty, forty five. 14:25:04 CAM-2 forty five at how much? 14:25:05 CAM-1 eighty seven seventy five. 14:25:06 CAM-2 k. 14:25:10 CAM-1 uhmm. 14:25:12 CAM-2 zero fuel weight? 14:25:13 CAM-1 zero fuel weight is one one four, four seven six. 14:25:17 CAM [unintelligible]. 14:25:24 CAM-2 taxi? 14:25:25 CAM-1 taxi weight ah one four five, four seven six. 14:25:32 CAM-1 takeoff weight one four five zero seven six. 14:25:36 CAM-2 yup. 14:25:37 CAM-1 landing weight one three four, eight hundred. forward C-G three point seven. aft twenty two point one. wet eleven point seven. 14:25:54 CAM-? *. NTSB Aircraft Accident Report 109

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:25:55 CAM-1 stab trim is ah seven point zero. [sound similar to stabilizer trim aural movement sound]. 14:26:07 CAM-2

• for A B and C two *.

14:26:10 CAM-1 ah that's right ah. in ah section A show twenty bags at seven eighty six. 14:26:21 CAM-2 okay. 14:26:22 CAM-1 and in C thirty or I mean ah. 14:26:26 CAM-2 B? 14:26:27 CAM-1 yeah in B a twenty - let's show - yeah, thirty at eleven sixty. 14:26:34 CAM-1 and C- two is gonna be ah twenty at a thousand. 14:26:39 CAM-2 okay. 14:26:43 CAM-1 you got everything? 14:26:44 CAM-2 yes. 14:26:45 CAM-2 here ya go. 14:26:50 CAM-2 before start below the line. 14:26:52 CAM-1 yeah I gotta *. NTSB Aircraft Accident Report 110

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:26:53 CAM-2 alright. 14:26:59 CAM-1

• .

14:27:03 HOT [sound similar to passenger call chime]. 14:27:07 CAM-1 they're still loading *. 14:27:09 CAM-2 yeah. 14:27:41 CAM [occasional unintelligible background voices]. 14:28:23 FA-3 I gotta stand in here for a minute, I'm cold. 14:28:27 CAM-2 I'm sorry? 14:28:28 FA-3 I gotta stand in here for a second I'm freezing. 14:28:30 CAM-2 It feels like the temperature is dropping. 14:28:32 FA-3 I know. 14:28:50 CAM [occasional unintelligible background voices]. 14:30:11 CAM-1 where ah where's the * sitting. 14:30:20 FA-1 five, D? 14:30:22 CAM-1 both of them? NTSB Aircraft Accident Report 111

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:30:25 FA-1

• , I wasn't even aware of it until he came on.

14:30:31 CAM-2 alright, below the line. 14:30:32 CAM-1 fuel pumps and crossfeed. 14:30:33 CAM-?

• .

14:30:36 CAM-2 on and closed. 14:30:37 CAM-1 fuel pumps, quantity *, fuel quantity? 14:30:40 CAM-2 ah required is sixteen three we have thirty thousand five hundred on board. 14:30:44 CAM-1 sixteen three * on board ah. 14:30:44 CAM [multiple unintelligible voices]. 14:30:47 CAM-1 V- speeds? 14:30:48 CAM-2 ah the one forty six thousand pound flaps fifteen, one thirty nine, one forty two, one fifty, one sixty five, one ninety nine, two forty eight set *. 14:30:56 CAM-1 one thirty nine, one forty two, one fifty stabilizer trim *. 14:31:01 CAM-2 okay envelopes out? NTSB Aircraft Accident Report 112

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:31:03 CAM-1 ah I e-mailed it in. 14:31:05 CAM-2 seven point zero. 14:31:06 CAM-1 pull the - pull the chocks. 14:31:07 CAM-? pull chocks. 14:31:08 CAM-2 seven point zero checked and set. 14:31:10 CAM-1 seven point zero checked and set. ? 14:31:12 CAM-2 checked and set. 14:31:14 CAM-? [unintelligible]. 14:31:21 CAM-1 tower's still down? 14:31:22 CAM-2 ah I checked about ten minutes ago and it was, yes. keep trying. 14:31:32 FA-4 ladies and gentlemen in preparation for our departure we do ask that all passengers be seated with their seatbelts fastened low and tight across their ** portable electronic devices * cell phones laptops be turned off and stowed at this time. we appreciate your cooperation thank you. 14:31:41 RDO-1 Willow Run tower Ameristar ninety three sixty three. 14:31:55 CAM-2 ready for start please. NTSB Aircraft Accident Report 113

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:31:58 HOT-1 ready * start. 14:32:01 HOT-1 documents. 14:32:03 CAM-2 crossfeeds are open. 14:32:04 HOT-1 documents. 14:32:05 CAM-2 oh documents on board. 14:32:06 HOT-1 cabin. 14:32:07 CAM-2 ah secured. 14:32:08 HOT-1 cockpit door. 14:32:09 CAM-2 it'll be locked. 14:32:10 HOT-1 pneumatic crossfeed. 14:32:11 CAM-2 open. 14:32:12 HOT-1 hydraulics. 14:32:13 CAM-2 on high and checked. 14:32:14 HOT-1 anti-collision lights. 14:32:15 CAM-2 on. NTSB Aircraft Accident Report 114

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:32:16 HOT-1 annunciator door lights. 14:32:17 CAM-2 checked and lights out. 14:32:19 CAM-?

• this thing.

14:32:19 HOT-1 air conditioning supply switch. 14:32:21 CAM-2 off. 14:32:22 HOT-1 fuel pumps. 14:32:23 CAM-2 uhm set. 14:32:24 HOT-1 pitot windshield heat. 14:32:25 CAM-2 captain on. 14:32:26 HOT-1 ignition? 14:32:27 CAM-2 is on. 14:32:28 HOT-1 pneumatic pressure. 14:32:28 CAM-2 check. 14:32:29 HOT-1 alright ready for start check's complete. 14:32:29 CAM-2 go ahead and start the right engine please. NTSB Aircraft Accident Report 115

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:32:44 HOT-1 start valve open. oil pressure. 14:33:09 CAM-2 forty percent. 14:33:14 CAM-2 starting left engine. 14:33:21 CAM-1 start valve open. 14:33:31 CAM-1 Michigan. [consistent with cell phone call]. 14:33:34 CAM-1 oil pressure. 14:33:38 CAM-1 yes. [consistent with cell phone call]. 14:33:57 CAM-2 forty percent. 14:33:58 HOT [electronic sound consistent with transfer of electrical power]. 14:34:00 CAM-? got it? 14:34:01 HOT-1 ah good day sir this is Ameristar ninety three sixty three, that's Alpha Juliet India nine three six three. ah we're on the ground in Detroit Willow Run ah Yankee India Papa and tower I guess they lost power out here so we need to try to get a clearance with you going to Dulles. [consistent with cell phone call]. NTSB Aircraft Accident Report 116

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:34:26 HOT-1 it's gonna be departing runway two three left and we'll be ready in five minutes. [consistent with cell phone call]. 14:34:32 CAM-2 after start. 14:34:41 HOT-1 all right. appreciate it. [consistent with cell phone call]. 14:34:46 CAM-1 after start. pneumatic crossfeeds? 14:34:47 FA-4 at this time we do ask that you give your undivided attention to the flight attendant nearest you while important safety information is review. please observe the no smoking signs and fasten seatbelt signs when they are illuminated. federal aviation regulations require passenger compliance with lighted passenger information sign and posted placards and all crewmember instructions. please take a moment to review the passenger information card located in the seat pocket in front of you. it illustrates the location of operat- 14:34:47 CAM-2 closed. 14:34:48 CAM-1 transponder? 14:34:49 CAM-2

• *.

14:34:49 CAM-2 transponder one. 14:34:50 CAM-1 hydraulics? NTSB Aircraft Accident Report 117

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:34:51 CAM-2 on high and checked. 14:34:52 CAM-1 A-P-U air switch? 14:34:53 CAM-2 is off. 14:34:53 CAM-1 engine anti-ice? 14:34:54 CAM-2 is off. 14:34:55 CAM-2 off. 14:34:55 CAM-1 ignition? 14:34:56 CAM-2 off. 14:34:56 CAM-1 electrical system? 14:34:57 CAM-2 checked. 14:34:58 CAM-1

• ignition (start) switches?

14:35:00 CAM-2 auto. 14:35:00 CAM-1

• .

14:35:01 CAM-2 on. 14:35:02 CAM-1 annunciators. NTSB Aircraft Accident Report 118

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:35:02 CAM-2 checked. 14:35:03 CAM-1 shoulder harnesses. 14:35:04 CAM-2 on left. 14:35:05 CAM-1 on right. ground equipment? 14:35:07 CAM-2 clear left. 14:35:08 CAM-1 after start checklist complete. 14:35:09 CAM-2 start taxiing out. 14:35:19 RDO-1 Willow Run traffic Ameristar ninety three sixty three MD-eighty is taxiing from the ah east ramp out to runway ah two three left any inbound traffic and traffic in the pattern please advise Willow Run. 14:35:35 HOT-1 easy on the tiller. 14:35:36 CAM-2 *. 14:35:37 HOT-1 yup. [consistent with cell phone call]. 14:35:41 HOT-1 okay. [consistent with cell phone call]. 14:35:46 HOT-1 yup. [consistent with cell phone call]. NTSB Aircraft Accident Report 119

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:35:48 HOT-1 eight one eight one. [consistent with cell phone call]. 14:35:51 HOT-1 okay. [consistent with cell phone call]. 14:35:52 HOT-1 thank you sir I appreciate it. [consistent with cell phone call]. 14:36:03 CAM-2 okay I'll taxi slow on the off chance. 14:36:06 HOT-1 yeah * do the taxi check first and then we'll- 14:36:08 CAM-2 slats extend flaps fifteen taxi checklist. 14:36:11 HOT-1 no, no, no straight ahead. 14:36:29 HOT-1 taxi checklist, flaps and slats. 14:36:31 CAM-2 no this goes to two seven we're gonna use two- 14:36:33 HOT-1 yes we gotta take two seven to two three. 14:36:35 CAM-2 okay. 14:36:36 CAM-2 umh, fifteen, fifteen, fifteen, takeoff and a blue light. 14:36:41 HOT-1 fifteen, fifteen, fifteen, takeoff, blue light. 14:36:44 HOT-1 ah V-speeds. NTSB Aircraft Accident Report 120

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:36:46 CAM-2 off the one forty six thousand pound card one thirty nine, one forty two, one fifty, recheck. 14:36:51 HOT-1 one thirty nine, one forty two, one fifty recheck. 14:36:55 HOT-1 stab trim. 14:36:56 CAM-2 seven point zero, set. 14:37:00 HOT-1 seven point zero units set, annunciators checked, I'll get the flight attendants here in a little bit. 14:37:07 HOT-1 we'll just wait here. * you see the windsock, what's it better for? 14:37:10 CAM-2 ah, I, I prefer two three *. 14:37:14 CAM-2 it's variable. 14:37:21 CAM-2 gonna hold short until you make the announcement. 14:37:24 HOT-1 yes sir this is ah Ameristar ninety three sixty three we're on the ground here at Willow Run holding short of runway two three left ah ready to go like to get a clearance to Dulles. [consistent with cell phone call]. 14:37:37 HOT-1 it's ah alpha juliet india nine three six three, it's Amerista ninety three sixty three. [consistent with cell phone call]. NTSB Aircraft Accident Report 121

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:37:46 HOT-1 thanks. [consistent with cell phone call]. 14:37:58 HOT-1 I don't see anything in the system. [consistent with cell phone call]. 14:38:06 HOT-1 no flightplan stored that's just great, ah, okay I guess we need to ah call the company and have them refile then. [consistent with cell phone call]. 14:38:16 HOT-1 [sound similar to chuckle] * I ah. thank you bye-bye. [consistent with cell phone call]. 14:38:23 CAM-2 unbelievable. 14:38:26 HOT-1 it's just one thing after another. 14:38:27 CAM-2 oh yeah. 14:38:32 HOT-1 you know what? it's probably faster just for me to file myself, right? 14:39:10 HOT-1 briefer. [consistent with cell phone call]. 14:39:18 HOT-1 Michigan. [consistent with cell phone call]. 14:39:47 HOT-1 yes sir ah we'd like to file an I-F-R flightplan please. [consistent with cell phone call]. NTSB Aircraft Accident Report 122

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:39:52 HOT-1 ah it’s gonna be for alpha juliet India ah nine three six three that's Ameristar nine three six three, ah. no alpha juliet india nine three six three. it's an MD- eighty three slant let me see what we got * slant lima, ah, usually the company does this, so let me know what else you need. ah airspeed four five zero knots. ah it’s gonna be kilo yankee india papa. Detroit Willow run. ah at nineteen ah as soon as possible nineteen forty five Z. altitude will be flight level three one zero. the route of flight will be ah direct to Carlton charlie romeo lima, jet three four to Dryer that's delta juliet bravo, J-eighty five to hotel victor quebec and then it’s the Gibbz two arrival that's golf india bravo bravo zulu two into Dulles. destination Dulles kilo india alpha delta and alternate airport will be ah Baltimore kilo bravo whiskey india. time in route one hour and thirty - fifteen minutes. fifteen minutes. just tell 'em its a (flow) . [consistent with cell phone call]. 14:41:33 CAM-2 *. 14:41:33 HOT-1 I'm sorry. fuel on board is a two hours and thirty minutes. ah first initial alpha. last name ah golf romeo uniform sierra echo uniform sierra. based at alpha delta sierra. and the phone ah one eight hundred three six eight five three eight seven. five three eight seven. ah total people on board is ah hundred ah fifteen. and ah red and blue on white. yeah it's november seven eight six tango whiskey. [consistent with cell phone call]. NTSB Aircraft Accident Report 123

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:41:37 CAM-2 ladies and gentlemen from the flight deck welcome aboard flight nine three six three service to Washington Dulles airport, flight time today one hour fifteen minutes, experiencing just a short delay here on the ground. power on the airports not working air traffic **********. [sound similar to flight attendant bell]. 14:42:53 HOT-1 that's it. [consistent with cell phone call]. 14:43:12 HOT-1 that's it. [consistent with cell phone call]. 14:43:20 HOT-1 naw we got, all that I appreciate the help. thank you sir. [consistent with cell phone call]. 14:43:25 HOT-?

• .

14:43:26 HOT-1 what a # cluster#. 14:43:32 HOT-1 yup. 14:43:41 HOT-1 @ said he had issues, filing it. 14:44:01 HOT-1 yes sir ah this ah Ameristar ninety three sixty three ah on the ground here at Willow Run hopefully the ATC clearance is in the system this time. not yet? okay, sounds good appreciate that. okay, I'll call back here in a few minutes. Alright, sounds good, thank you, bye. [consistent with cell phone call]. 14:44:37 CAM-2 let's run the taxi check while were waiting from the top please. NTSB Aircraft Accident Report 124

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:44:40 HOT-1 we did that. the taxi check. 14:44:41 CAM-2 I don't think we completed it. 14:44:43 HOT-1 yeah. 14:44:45 HOT-1 ah taxi check ah flap, flaps and slats? 14:44:45 CAM-2 yeah. 14:44:47 CAM-2 I have fifteen, fifteen, fifteen, takeoff and a blue light. 14:44:51 HOT-1 fifteen, fifteen, fifteen, takeoff blue light. flight controls elevator on. 14:44:55 CAM-2 checked. 14:44:55 HOT-1 checked A-P-U. 14:44:57 CAM-2 off. 14:44:58 HOT-1 and ah fuel heat? 14:45:00 CAM-2 should be off. 14:45:00 HOT-1 off. takeoff briefing? NTSB Aircraft Accident Report 125

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:45:02 CAM-2 ah left seat takeoff. assigned headings, probably three thousand feet. emergency return we'll just take it right over to Metro airport landing on one of the two one . 14:45:16 HOT-1 before takeoff the line flaps and slats. 14:45:18 CAM-2 are fifteen, fifteen, fifteen, takeoff and a blue light. 14:45:21 HOT-1 fifteen, fifteen, fifteen, takeoff blue light. V-speeds? 14:45:24 CAM-2 off the one forty six thousand pound card, one thirty nine, one forty two, one fifty recheck. 14:45:29 HOT-1 one thirty nine, one forty two, one fifty, rechecked. stab trim? 14:45:32 CAM-2 seven point zero set. 14:45:35 HOT-1 seven point ah zero units set. annunciators checked. I'll get the flight attendants here. 14:45:41 CAM-2 I told them to be seated for departure, I got the two dings so ah we're good to go. 14:45:45 HOT-1 oh. 14:46:00 CAM-2 wonder why more often than not we have trouble * *. NTSB Aircraft Accident Report 126

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:46:15 CAM-2 I should also add to my briefing we're gonna delay rotation because of the gusty winds. 14:46:20 HOT-1 yeah I'll just call rotate. 14:46:21 CAM-2 yup. 14:46:41 CAM-2 I'll get those n- those phone number from you. 14:46:44 HOT-1 huh? 14:46:44 CAM-2 I'll get those phone number from you * later today. I don't know if I have those numbers, for my own use in the future. 14:47:07 HOT-1 yeah sir it's Ameristar ninety three sixty three again any luck? ready to copy. [consistent with cell phone call]. 14:47:37 HOT-1 Ameristar ninety three sixty three cleared to Dulles via Akron five departure Akron direct ah hotel victor quebec as filed. three thousand three one oh in ten eighteen ninety five in seven two one four in the box hold for release. and yeah we're number one ready to go runway two three left. Two three left, yes sir. [consistent with cell phone call]. 14:48:14 HOT-1 yeah void if not off by fifty one and ah time now forty eight and a half. that's all we need appreciate the help. [consistent with cell phone call]. NTSB Aircraft Accident Report 127

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:48:24 HOT-1 heading three zero zero. hold that. [consistent with cell phone call]. 14:48:26 HOT-1 ah departure. thank you bye. [consistent with cell phone call]. 14:48:29 HOT-1 let me put that in real quick * Akron five. It's gonna be the one oh six out of thirteen four. 14:48:33 CAM-2 what is it? 14:48:36 CAM-2 alright. 14:48:39 CAM-2 thank you. 14:48:42 HOT-1 fix. V-lock. 14:48:47 CAM-2 Akron five? 14:48:49 HOT-1 yeah. 14:49:25 HOT-1 there ya go. so heading three zero zero on departure. 14:49:25 CAM-2 ready? 14:49:27 CAM-2 alright. 14:49:28 CAM-2 three hundred heading up to three thousand. ready? NTSB Aircraft Accident Report 128

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:49:30 HOT-1 yup. 14:49:31 CAM-2 alright, let's announce our intentions. 14:49:33 HOT-1 yup. 14:49:35 RDO-1 Willow Run traffic ah Ameristar ninety three sixty three is taking an active runway ah two three left for departure and ah it will be a right turn out ah north west departure any inboud traffic please advise Willow Run. 14:49:49 N555P and a Willow Run Baron triple five papa is ah four to the northwest I'm entering a right downwind for runway two seven and I've got the ah Ameristar MD- 80 visual. 14:50:01 RDO-1 thank you sir appreciate it. 14:50:02 CAM-2 before takeoff to the line. 14:50:04 HOT-1 ah below the line. 14:50:05 CAM-2 *. 14:50:05 HOT-1 depart - ah departure runway two three left confirm ignition is on transponder T-A-R-A and landing lights are on runway alignment's set *. 14:50:09 CAM-2 left confirmed. NTSB Aircraft Accident Report 129

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:50:19 INT-1 ladies and gentlemen from the flight deck ah we've been cleared for departure flight attendants please be seated. 14:50:42 HOT-1 final's clear. 14:50:45 CAM-2 clear left. 14:50:47 HOT-1 clear right. 14:50:48 N555P and Willow Run traffic Baron five five five papa's right downwind two seven. we're gonna be a full stop. 14:51:06 CAM-2 alright, runway alignment is checked. 14:51:08 HOT-1 checks. 14:51:11 CAM-2 before takeoff is complete. 14:51:12 HOT-1 go. 14:51:18 HOT-1 looks like the wind is a little bit from the right. 14:51:20 CAM-2 right. 14:51:21 CAM-2 I'm gonna some right crosswind . 14:51:27 CAM-2 autothrottles on please. set takeoff thrust. NTSB Aircraft Accident Report 130

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:51:35 HOT-1 takeoff thrust set N1's checked. 14:51:38 HOT-1 airspeed alive. 14:51:41 HOT-1 clamp. 14:51:43 HOT-1 eighty knots. 14:51:44 CAM-2 checked. 14:51:45 N555P ah Willow Run Baron triple five papa right * two seven full stop. 14:51:55 HOT-1 V-one. 14:52:01 HOT-1 rotate. 14:52:04 HOT-1 V-two. 14:52:05 CAM-2 hey what's goin' on? 14:52:08 CAM-2 abort. 14:52:09 HOT-1 no. not above - #. 14:52:15 HOT-1

don't abort above V-one like that.

14:52:19 HOT-1 #. 14:52:19 CAM-2 it wasn't flying. NTSB Aircraft Accident Report 131

TIME and SOURCE INTRA-AIRCRAFT COMMUNICATION CONTENT TIME and SOURCE AIR-GROUND COMMUNICATION CONTENT 14:52:22 HOT-1 #. 14:52:23 CAM [sounds consistent with departure from the prepared surface]. 14:52:27 CAM speed brake speed brake speed brake [electronic voice]. 14:52:27 FA-1 heads down, stay down, heads down, stay down, heads down, stay down. 14:52:32 CAM landing gear landing gear [multiple repetitions electronic voice]. 14:52:37 PA-1 evacuate, evacuate, evacuate. 14:52:41 CAM-2 it wasn't flying. it wasn't - I had it all the way back here it wasn't flying. 14:52:46 CAM [sounds consistent with emergency evacuation of the cabin]. 14:53:12 CAM-2 it was not rotating I had it all the way back here. 14:53:29 CAM-2 #. 14:53:47 HOT-1 evacuation checklist. 14:53:49 End of Recording 14:53:49 End of Transcript NTSB Aircraft Accident Report 132

NTSB Aircraft Accident Report 133 References Bauer, Michael, William R. English, Michael Richards, and Matthew Grzych. 2018. “Use of sUAS in Developing Photogrammetric Model for Wind Simulation.” Technical paper presented at the International Society of Air Safety Investigators 2018 Annual Seminar, “The Future of Aircraft Accident Investigation,” Dubai, United Arab Emirates, October 30 – November 1, 2018. Accessed December 17, 2018. https://www.isasi.org/Documents/library/technical- papers/2018/Tues/Use%20of%20sUAS%20in%20Developing%20Photogrammetric%20 Model%20for%20Wind%20Simulation%20- %20Bill%20English,%20Mike%20Bauer.pdf. BFU (German Federal Bureau of Aircraft Accident Investigation). 2000. Aircraft Incident Report 5X011-0/99. DOT OIG (Department of Transportation Safety, Office of Inspector General). 2009. “Actions Taken and Needed to Improve Federal Aviation Administration’s Runway Safety Area Program.” AV-2009-039. Accessed June 12, 2008. https://www.oig.dot.gov/sites/default/ files/11WEB_FILE_RSA_Report_03-3-09_Issued.pdf. FAA (Federal Aviation Administration). 1994. Advisory Circular 120-62, “Takeoff Training Safety Aid, Announcement of Availability.” Accessed June 26, 2018. http://www.faa.gov/documentLibrary/media/Advisory_Circular/AC%20120-62.pdf. ———. 1999. Order 5200.8, Runway Safety Area Program. Accessed June 8, 2018. http://www.faa.gov/documentLibrary/media/Order/Construction_5200_8.pdf. ———. 2004. “Section 2: Pilot Guide to Takeoff Safety” (Part of and excerpted from the Takeoff Safety Training Aid). Accessed June 26, 2018. https://www.faa.gov/other_visit/aviation_industry/airline_operators/training/media/takeof f_safety.pdf. ———. 2005. Advisory Circular 120-27E, “Aircraft Weight and Balance Control.” Accessed May 14, 2018. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC120- 27E.pdf. ———. 2013. Advisory Circular 150/5345-27E, “FAA Specification for Wind Cone Assemblies.” Accessed June 20, 2018. http://www.faa.gov/documentLibrary/media/Advisory_Circular/ 150_5345_27e.pdf. ———. 2014a. Advisory Circular 150/5300-13A – Change 1, “Airport Design.” Accessed June 8, 2018. http://www.faa.gov/documentLibrary/media/Advisory_Circular/150-5300-13A- chg1-interactive-201804.pdf. ———. 2014b. JO 7900.5D, Surface Weather Observing. Accessed June 23, 2018. https://www.faa.gov/documentLibrary/media/Order/JO_7900_5D.pdf.

NTSB Aircraft Accident Report 134 ———. 2015. Advisory Circular 120-92B, “Safety Management Systems for Aviation Service Providers.” Accessed September 18, 2018. http://www.faa.gov/documentLibrary/media/ Advisory_Circular/AC_120-92B.pdf. ———. 2017a. JO 7900.5D – Change 1, Surface Weather Observing. Accessed June 23, 2018. https://www.faa.gov/documentLibrary/media/Order/JO_7900.5D.pdf. ———. 2017b. Advisory Circular 120-71B, “Standard Operating Procedures and Pilot Monitoring Duties for Flight Deck Crewmembers.” Accessed October 10, 2018. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC_120-71B.pdf. ———. 2018a. Advisory Circular 00-45H, Change 1, “Aviation Weather Services.” Accessed December 14, 2018. https://www.faa.gov/documentLibrary/media/Advisory_Circular/AC _00-45H_Chg_1.pdf. ———. 2018b. “Fact Sheet – Engineered Material Arresting System (EMAS).” Accessed June 29, 2018. https://www.faa.gov/news/fact_sheets/news_story.cfm?newsid=13754. NOAA (National Oceanic and Atmospheric Administration). 1998. Automated Surface Observing System (ASOS) User’s Guide. Accessed June 21, 2018. https://www.weather.gov/media/asos/aum-toc.pdf. NTSB (National Transportation Safety Board). 1977. Texas International Airlines, Inc. McDonnell Douglas DC-9-14, N9104, Stapleton International Airport, Denver, Colorado, November 16, 1976. AAR-77/10. Washington, DC: NTSB. ———. 1984. Safety Study: Airport Certification and Operations. SS-04/02. Washington, DC: NTSB. ———. 1994. Impact with Blast Fence upon Landing Rollout, Action Air Charters Flight 990, Piper PA-31-350, N990RA, Stratford, Connecticut, April 27, 1994. AAR-94/08. Washington, DC: NTSB. ———. 2002. Southwest Airlines Flight 1455, Boeing 737-300, N668SW, Burbank, California, March 5, 2000. AAB-02/04. Washington, DC: NTSB. ———. 2007. Runway Overrun and Collision, Southwest Airlines Flight 1248, Boeing 737-7H4, N471WN, Chicago Midway International Airport, Chicago, Illinois, December 8, 2005. AAR-07/06. Washington, DC: NTSB. ———. 2008. Runway Overrun During Landing, Shuttle America, Inc., Doing Business as Delta Connection Flight 6448, Embraer ERJ-170, N862RW, Cleveland, Ohio, February 18,

1. AAR-08/01. Washington, DC: NTSB.

FD07506 ｜ 2019_美国_AAR1902.pdf

分类：06_境外及港澳台调查报告 ｜ 年份：2019 ｜ 地域： ｜ 严重程度： ｜ 场所： ｜ 起火原因： ｜ 来源格式：pdf

Departure From Controlled Flight Trans-Pacific Air Charter, LLC Learjet 35A, N452DA Teterboro, New Jersey May 15, 2017

Accident Report NTSB/AAR-19/02 PB2019-100271

National Transportation Safety Board

NTSB/AAR-19/02 PB2019-100271 Notation 58039 Adopted March 12, 2019

Aircraft Accident Report Departure From Controlled Flight Trans-Pacific Air Charter, LLC Learjet 35A, N452DA Teterboro, New Jersey May 15, 2017

National Transportation Safety Board

490 L’Enfant Plaza, S.W. Washington, D.C. 20594

National Transportation Safety Board. 2019. Departure From Controlled Flight Trans-Pacific Air Charter, LLC, Learjet 35A, N452DA Teterboro, New Jersey, May 15, 2017. Aircraft Accident Report NTSB/AAR-19/02. Washington, DC.

Abstract: This report discusses the May 15, 2017, accident involving a Learjet 35A, N452DA, operated by Trans-Pacific Air Charter, LLC, that departed controlled flight while on a circling approach to runway 1 at Teterboro Airport, Teterboro, New Jersey, and impacted a commercial building and parking lot. The pilot-in-command (PIC) and the second-in-command died; no one on the ground was injured. The airplane was destroyed by impact forces and postcrash fire. Safety issues identified in this report include the need for flight data monitoring programs (and supporting recording devices) for 14 Code of Federal Regulations Part 135 operators; the need for safety management systems for Part 135 operators; the need for the Federal Aviation Administration (FAA) to develop and implement procedures to identify Part 135 operators whose pilots do not comply with standard operating procedures (SOP); the need for Part 135 operators to monitor pilots with performance deficiencies; inadequate FAA guidance for Part 135 crew resource management training; the need for leadership training for Part 135 PICs; and the lack of approach speed wind additive guidance in Trans-Pacific SOPs. As a result of this investigation, the National Transportation Safety Board makes three new safety recommendations to the FAA, reiterates six safety recommendations, and reclassifies one recommendation.

The National Transportation Safety Board (NTSB) is an independent federal agency dedicated to promoting aviation, railroad, highway, marine, and pipeline safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The NTSB makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

The NTSB does not assign fault or blame for an accident or incident; rather, as specified by NTSB regulation, “accident/incident investigations are fact-finding proceedings with no formal issues and no adverse parties … and are not conducted for the purpose of determining the rights or liabilities of any person.” 49 C.F.R. § 831.4. Assignment of fault or legal liability is not relevant to the NTSB’s statutory mission to improve transportation safety by investigating accidents and incidents and issuing safety recommendations. In addition, statutory language prohibits the admission into evidence or use of any part of an NTSB report related to an accident in a civil action for damages resulting from a matter mentioned in the report. 49 U.S.C. § 1154(b).

For more detailed background information on this report, visit http://www.ntsb.gov/investigations/dms.html and search for NTSB accident ID CEN17MA183. Recent publications are available in their entirety on the Internet at http://www.ntsb.gov. Other information about available publications also may be obtained from the website or by contacting:

National Transportation Safety Board Records Management Division, CIO-40 490 L’Enfant Plaza, SW Washington, DC 20594 (800) 877-6799 or (202) 314-6551

NTSB publications may be purchased from the National Technical Information Service. To purchase this publication, order product number PB2019-100271 from:

National Technical Information Service 5301 Shawnee Rd. Alexandria, VA 22312 (800) 553-6847 or (703) 605-6000 http://www.ntis.gov/

NOTE: This report was reissued on October 27, 2022, with corrections to the runway labels on figure 11 on page 37.

NTSB Aircraft Accident Report i Contents Figures and Table ........................................................................................................................ iii Abbreviations ............................................................................................................................... iv Executive Summary .................................................................................................................... vii

1. Factual Information ...................................................................................................................1
2. 1 History of Flight .........................................................................................................................1
3. 2 Flight Crew Information ............................................................................................................7
4. 2.1 The Pilot-In-Command ....................................................................................................7
5. 2.2 The Second-in-Command ................................................................................................9
6. 2.3 Preaccident Activities and Crew Rest ............................................................................10
7. 3 Airplane Information ...............................................................................................................11
8. 3.1 General ...........................................................................................................................11
9. 3.2 Stall Warning System ....................................................................................................12
10. 3.3 Navigation Equipment ...................................................................................................13
11. 3.3.1 Navigation Receivers .......................................................................................13
12. 3.3.2 Flight Management System .............................................................................14
13. 3.4 Autopilot ........................................................................................................................14
14. 4 Meteorological Information .....................................................................................................15
15. 5 Teterboro Airport and Approach Procedures ...........................................................................16
16. 6 Flight Recorders .......................................................................................................................19
17. 7 Wreckage and Impact Information ..........................................................................................19
18. 8 Medical and Pathological Information.....................................................................................21
19. 9 Tests and Research ...................................................................................................................22
20. 10 Organizational and Management Information .......................................................................23
21. 10.1 Trans-Pacific Operational Policies and Procedures .....................................................23
22. 10.1.1 Preflight..........................................................................................................23
23. 10.1.2 Checklists .......................................................................................................24
24. 10.1.3 Crew Coordination .........................................................................................26
25. 10.1.4 Approach Briefing .........................................................................................26
26. 10.1.5 Stabilized Approach .......................................................................................27
27. 10.1.6 Circle-to-Land Approach ...............................................................................28
28. 10.1.7 Approach Speeds ...........................................................................................28
29. 10.1.8 Trans-Pacific Second-in-Command Policy....................................................28
30. 10.2 Crew Resource Management Training ........................................................................29
31. 10.3 Trans-Pacific Safety Policy .........................................................................................30
32. 11 Manufacturer Guidance on Wind Additives ..........................................................................30
33. 12 Federal Aviation Administration Oversight...........................................................................30
34. Analysis .....................................................................................................................................32
35. 1 Introduction ..............................................................................................................................32
36. 2 Accident Sequence ...................................................................................................................33
37. 2.1 Preflight Planning, Taxi, and Takeoff ...........................................................................33
38. 2.2 En Route and Approach .................................................................................................33

NTSB Aircraft Accident Report ii 2.2.3 Circle-to-Land Maneuver and Stall ...............................................................................37 2.3 Flight Crew Performance .........................................................................................................39 2.3.1 Decision to Allow the Second-in-Command to Act as Pilot Flying ..............................39 2.3.2 Inadequate Preflight and Approach Planning ................................................................40 2.4 Flight Data Monitoring ............................................................................................................41 2.5 Operational Safety Programs ...................................................................................................44 2.5.1 Safety Management System ..........................................................................................44 2.5.2 Procedural Compliance ..................................................................................................46 2.5.3 Monitoring Pilots with Performance Deficiencies ........................................................47 2.6 Crew Resource Management and Leadership Training ...........................................................48 2.6.1 Crew Resource Management .........................................................................................48 2.6.2 Leadership ......................................................................................................................50 2.7 Trans-Pacific Jets Policy ..........................................................................................................51 2.7.1 Second-in-Command Policy ..........................................................................................51 2.7.2 Approach Speed Wind Additives ..................................................................................52

1. Conclusions ...............................................................................................................................54
2. 1 Findings....................................................................................................................................54
3. 2 Probable Cause.........................................................................................................................55
4. Recommendations ....................................................................................................................56
5. 1 New Recommendations ...........................................................................................................56
6. 2 Previously Issued Recommendations Reiterated in This Report .............................................56
7. 3 Previously Issued Recommendation Reclassified in This Report ...........................................57
8. Appendixes................................................................................................................................58

Appendix A: Investigation .............................................................................................................58 Appendix B: Trans-Pacific Jets Postaccident Actions ...................................................................59 Appendix C: Cockpit Voice Recorder Transcript ..........................................................................60 References ...................................................................................................................................132

NTSB Aircraft Accident Report iii Figures and Table Figure 1. Accident airplane’s ground track en route to TEB. ........................................................ 5 Figure 2. Accident airplane: N452DA, a Learjet 35A. ................................................................ 11 Figure 3. AOA indicator on the left side of the Learjet 35A cockpit. ......................................... 13 Figure 4. Locations of TEB, LGA, JFK, and EWR. .................................................................... 16 Figure 5. TEB ILS runway 6 instrument approach procedure. .................................................... 18 Figure 6. Security video image of N452DA at ground impact. ................................................... 20 Figure 7. Photograph of the initial impact point and start of the debris path............................... 20 Figure 8. Photograph of the continuation of the debris path. ....................................................... 21 Figure 9. Radar data depicting the airplane’s track during the approach. ................................... 22 Figure 10. Diagram illustrating the airplane’s vertical profile between TORBY and the MDA along with relevant events. ........................................................................................... 36 Figure 11. Overhead image showing a stabilized flightpath to runway 1 (in blue) compared with the accident airplane’s flightpath (in yellow). ...................................................................... 37 Table. Trans-Pacific SIC positions and authorized duties. .......................................................... 28

NTSB Aircraft Accident Report iv Abbreviations AC advisory circular AFCS automatic flight control system AFM airplane flight manual agl above ground level AOA angle of attack ASAP aviation safety action program ATC air traffic control ATIS automatic terminal information service BED Laurence G. Hanscom Field CFR Code of Federal Regulations CDU control display unit CRM crew resource management CVR cockpit voice recorder DME distance measuring equipment DUATS Direct User Access Terminal Service EGPWS enhanced ground proximity warning system EWR Newark Liberty International Airport FAA Federal Aviation Administration FDM flight data monitoring FedEx Federal Express Corporation FMS flight management system FSDO flight standards district office GOM general operations manual HAA helicopter air ambulance HSI horizontal situation indicator

NTSB Aircraft Accident Report v IFR instrument flight rules ILS instrument landing system JFK John F. Kennedy International Airport kts knots (nautical miles per hour) LGA LaGuardia Airport LOC localizer LOFT line-oriented flight training LOM locator outer marker MDA minimum descent altitude msl mean sea level nm nautical miles NCU navigation computer unit NPRM notice of proposed rulemaking NTSB National Transportation Safety Board PF pilot flying PHL Philadelphia International Airport PIC pilot-in-command PM pilot monitoring PNF pilot not flying POI principal operations inspector PRIA Pilot Records Improvement Act of 1996 SAS safety assurance system SIC second-in-command SMS safety management system SOP standard operating procedure TEB Teterboro Airport

NTSB Aircraft Accident Report vi VMC visual meteorological conditions VOR very-high-frequency omnidirectional radio range

NTSB Aircraft Accident Report vii Executive Summary On May 15, 2017, about 1529 eastern daylight time, a Learjet 35A, N452DA, departed controlled flight while on a circling approach to runway 1 at Teterboro Airport (TEB), Teterboro, New Jersey, and impacted a commercial building and parking lot. The pilot-in-command (PIC) and the second-in-command (SIC) died; no one on the ground was injured. The airplane was destroyed by impact forces and postcrash fire. The airplane was registered to A&C Big Sky Aviation, LLC, and was operated by Trans-Pacific Air Charter, LLC, under the provisions of Title 14 Code of Federal Regulations (CFR) Part 91 as a positioning flight. Visual meteorological conditions prevailed, and an instrument flight rules flight plan was filed. The flight departed from Philadelphia International Airport (PHL), Philadelphia, Pennsylvania, about 1504 and was destined for TEB. The accident occurred on the flight crew’s third and final scheduled flight of the day; the crew had previously flown from TEB to Laurence G. Hanscom Field (BED), Bedford, Massachusetts, and then from BED to PHL. The PIC checked the weather before departing TEB about 0732; however, he did not check the weather again before the flight from PHL to TEB despite a company policy requiring that weather information be obtained within 3 hours of departure. Further, the crew filed a flight plan for the accident flight that included altitude (27,000 ft) and time en route (28 minutes) entries that were incompatible with each other, which suggests that the crew devoted little attention to preflight planning. The crew also had limited time in flight to plan and brief the approach, as required by company policy, and did not conduct an approach briefing before attempting to land at TEB. Cockpit voice recorder data indicated that the SIC was the pilot flying (PF) from PHL to TEB, despite a company policy prohibiting the SIC from acting as PF based on his level of experience. Although the accident flight was likely not the first time that the SIC acted as PF (based on comments made during the flight), the PIC regularly coached the SIC (primarily on checklist initiation and airplane control) from before takeoff to the final seconds of the flight. The extensive coaching likely distracted the PIC from his duties as PIC and pilot monitoring, such as executing checklists and entering approach waypoints into the flight management system. Collectively, procedural deviations and errors resulted in the flight crew’s lack of situational awareness throughout the flight and approach to TEB. Because neither pilot realized that the airplane’s navigation equipment had not been properly set for the instrument approach clearance that the flight crew received, the crew improperly executed the vertical profile of the approach, crossing an intermediate fix and the final approach fix hundreds of feet above the altitudes specified by the approach procedure. The controller had vectored the flight for the instrument landing system runway 6 approach, circle to runway 1. When the crew initiated the circle-to-land maneuver, the airplane was 2.8 nautical miles (nm) beyond the final approach fix (about 1 mile from the runway 6 threshold) and could not be maneuvered to line up with the landing runway, which should have prompted the crew to execute a go-around because the flight did not meet the company’s stabilized approach criteria. However, neither pilot called for a go-around, and the PIC (who had assumed control of the airplane at this point in the flight) continued the approach by initiating a turn to align with the landing runway. Radar data indicated that the airplane’s airspeed was below the approach

NTSB Aircraft Accident Report viii speed required by company standard operating procedures (SOPs). During the turn, the airplane stalled and crashed about 1/2 nm south of the runway 1 threshold. The National Transportation Safety Board (NTSB) identified the following safety issues as a result of this accident investigation: • Need for flight data monitoring (FDM) programs (and supporting recording devices) for 14 CFR Part 135 operators. If this flight hadn’t ended in an accident, Trans-Pacific (a Part 135 operator) would not have had a way to identify the flight crew’s deviations from policy and procedures just as it had no way to determine whether this (or any) crew’s previous operations were conducted in accordance with company policies and SOPs. The NTSB has long recognized the value of FDM programs for Part 135 operators, having first issued a safety recommendation for data recording devices and monitoring programs for helicopter emergency medical service operators in 2009. More recently, as a result of our investigation of a 2015 fatal accident in Akron, Ohio, involving a Part 135 operator, the NTSB recommended that the Federal Aviation Administration (FAA) require all Part 135 operators to install data recording devices capable of supporting an FDM program and then to establish structured FDM programs (Safety Recommendations A-16-34 and -35, respectively). The Trans-Pacific accident further highlights the need for such programs and recording devices to be required for Part 135 operators. • Need for safety management systems (SMS) for Part 135 operators. Although a safety officer position was included in Trans-Pacific’s organizational chart and the company was pursuing an SMS, no formal safety programs were in place at the time of the accident. Therefore, the company did not identify or mitigate the hazards that contributed to this accident (such as an unauthorized SIC acting as PF and pairing two pilots who had both exhibited difficulties in training). The NTSB has investigated several other Part 135 accidents that highlighted operational safety issues that could have been identified and mitigated by an SMS. As a result of our investigation of the Akron accident, the NTSB also recommended that the FAA require all Part 135 operators to establish an SMS (Safety Recommendation A-16-36). • Need for the FAA to develop and implement procedures to identify Part 135 operators whose pilots do not comply with SOPs. FAA guidance states that cockpit en route inspections are one of the “most effective methods of accomplishing [the FAA’s] air transportation surveillance objectives.” Despite this statement, the FAA’s principal operations inspector for Trans-Pacific at the time of the accident stated that he had never conducted an en route inspection for a Part 135 operator and had no way of knowing if pilots were following SOPs during flights based on the line checks that he performed. Similar to this accident, the NTSB found multiple instances of a flight crew’s failure to comply with SOPs during the Akron accident investigation and noted that the FAA had never conducted an en route inspection of any pilots at that company. As part of the Akron investigation, we recommended that the FAA review its Safety Assurance System (SAS) and develop and implement procedures needed to identify Part 135 operators whose pilots do not comply with SOPs (Safety Recommendation A-16-41), but the FAA has not yet taken the requested action, even though the circumstances of the TEB accident demonstrate that noncompliance with SOPs remains a pervasive issue for Part 135 operations.

NTSB Aircraft Accident Report ix • Need for Part 135 operators to monitor pilots with performance deficiencies. Trans-Pacific was aware that both accident pilots required additional simulator training sessions to complete initial company training. However, after completing the simulator training, both pilots began line operations without any further monitoring or evaluation. During the accident flight, both pilots exhibited performance problems that mirrored some of those noted during their simulator training courses (for example, the PIC did not properly execute the circling approach, and the SIC struggled with aircraft control). As a result of our investigation of a 2003 accident in Memphis, Tennessee, the NTSB recommended that the FAA require Part 121 air carriers to establish programs to review the performance history of crewmembers who had performance deficiencies or had experienced failures in training and administer additional oversight and training to ensure that performance deficiencies are addressed and corrected (Safety Recommendation A-05-14, classified “Closed—Acceptable Action”). Part 135 operators would benefit from similar required programs. • Inadequate FAA guidance for Part 135 crew resource management (CRM) training. Beginning in 2013, the FAA required all Part 135 operators to provide CRM training to flight crews. Title 14 CFR 135.330 requires operators to cover eight specific topics in CRM training; however, the FAA does not provide clear guidance on how operators can implement required CRM training, even though such guidance is available for Part 121 CRM programs. Both accident pilots participated in Trans-Pacific’s CRM training program, which had been approved by the FAA and covered all required topics. However, the training did not seem to influence the crew’s actions during the accident flight. FAA-funded scientific research has identified factors that influence the effectiveness of CRM training. These findings could be used to develop guidance for CRM training programs tailored to the specific characteristics of Part 135 operations. • Need for leadership training for Part 135 PICs. The absence of adequate preflight planning and the omission of required checklists, callouts, and briefings during the accident flight were indications of the PIC’s inadequate leadership. Title 14 CFR 135.330 requires operators, as part of CRM training, to provide training that addresses the authority of the PIC but does not contain additional details. Trans-Pacific’s CRM training did not adequately describe core leadership functions necessary for ensuring effective crew performance. The NTSB has found deficiencies in PIC leadership in previous accident investigations, most notably in the investigation of the 2009 accident in Clarence Center, New York. As a result of that investigation, we recommended that the FAA issue an advisory circular on leadership training for upgrading captains and require all Part 121, 135, and 91K operators to provide such training (Safety Recommendations A-10-13 and -14, respectively). In October 2016, the FAA issued a notice of proposed rulemaking modifying leadership training requirements for Part 121 operators but not Part 135 or 91K operators.

The NTSB notes that the PIC in this accident had never been employed as a Part 135 PIC before being hired by Trans-Pacific and had never received formal specific leadership training to prepare him for the leadership duties associated with the upgrade to PIC. Specific leadership training for Part 135 and 91K PICs provided during the

NTSB Aircraft Accident Report x upgrade process would help standardize and reinforce the critical command authority skills that PICs need. • Lack of approach speed wind additive guidance in Trans-Pacific SOPs. The Learjet 35A airplane flight manual recommends increasing approach speed in gusting wind conditions. However, the approach speeds listed in Trans-Pacific’s SOPs did not include these wind additives. Gusting wind conditions were present during the accident flight. Although the accident airplane was flown significantly slower than directed by the SOPs during the approach, the airplane remained above the manufacturer-published stall speed. However, the strong, gusting wind might have momentarily reduced the airplane’s airspeed below the stall speed. Adding guidance to Learjet 35A operations manuals to include a wind additive (if appropriate) when calculating approach speeds would provide additional stall margin and reduce the risk of a stall. The NTSB determines that the probable cause of this accident was the PIC’s attempt to salvage an unstabilized visual approach, which resulted in an aerodynamic stall at low altitude. Contributing to the accident was the PIC’s decision to allow an unapproved SIC to act as PF, the PIC’s inadequate and incomplete preflight planning, and the flight crew’s lack of an approach briefing. Also contributing to the accident were Trans-Pacific’s lack of safety programs that would have enabled the company to identify and correct patterns of poor performance and procedural noncompliance and the FAA’s ineffective SAS procedures, which failed to identify these company oversight deficiencies. As a result of this investigation, the NTSB makes three new safety recommendations and reiterates six previously issued safety recommendations to the FAA.

NTSB Aircraft Accident Report 1

1. Factual Information
2. 1 History of Flight

On May 15, 2017, about 1529 eastern daylight time, a Learjet 35A, N452DA, departed controlled flight while on a circling approach to runway 1 at Teterboro Airport (TEB), Teterboro, New Jersey, and impacted a commercial building and parking lot.1 The pilot-in-command (PIC) and the second-in-command (SIC) died; no one on the ground was injured. The airplane was destroyed by impact forces and postcrash fire. The airplane was registered to A&C Big Sky Aviation, LLC, and was operated by Trans-Pacific Air Charter, LLC, under the provisions of Title 14 Code of Federal Regulations (CFR) Part 91 as a positioning flight.2 Visual meteorological conditions (VMC) prevailed, and an instrument flight rules (IFR) flight plan was filed. The flight departed from Philadelphia International Airport (PHL), Philadelphia, Pennsylvania, about 1504 and was destined for TEB.3 The accident occurred on the flight crew’s third and final scheduled flight of the day. The PIC checked the weather before the first flight, which departed TEB about 0732 and arrived at Laurence G. Hanscom Field (BED), Bedford, Massachusetts, about 0815. The second flight was scheduled to pick up one passenger at BED and depart about 0915; however, three passengers were waiting for the airplane. The flight was delayed until the pilots were able to address the discrepancy and complete passenger documentation. The airplane departed BED about 1009 and landed at PHL about 1104. Passenger interviews indicated that the PIC was the pilot flying (PF) on that flight. Records obtained from the Direct User Access Terminal Service (DUATS) indicated that the PIC’s account was used about 1415 to file an IFR flight plan from PHL to TEB.4 The flight plan listed an en route time of 28 minutes and requested an altitude of 27,000 ft mean sea level (msl).5 The PIC generated the flight plan using FltPlan.com, an online planning application.6 No record was found of the pilot checking the weather before departure from PHL, as required by company policy (see section 1.10.1.1 for additional information).

1 All times in this report are expressed in eastern daylight time. 2 Trans-Pacific Air Charter did business as Trans-Pacific Jets. This report uses the company names interchangeably and refers to the company as “Trans-Pacific.” Trans-Pacific also conducted operations under Part 135. 3 Supporting documentation referenced in this report can be found in the public docket for this accident accessible from the National Transportation Safety Board’s (NTSB) Accident Dockets web page by searching CEN17MA183. Other NTSB documents referenced in this report, including other reports and summarized safety recommendation correspondence, are accessible from the NTSB’s Aviation Information Resources web page (www.ntsb.gov/air). 4 DUATS was a free online Federal Aviation Administration (FAA)-sponsored weather and flight-planning service that was available to pilots until May 2018. 5 All altitudes are expressed in msl unless otherwise noted. 6 To generate a flight plan, a pilot enters the requested route of flight and an altitude request, if desired. The application calculates estimated time en route and selects an en route altitude (if the pilot does not enter one). For the accident flight, the PIC entered a requested altitude of 27,000 ft.

NTSB Aircraft Accident Report 2 Air traffic control (ATC) audio recordings indicated that the crew contacted the PHL clearance delivery controller about 1433. The clearance delivery controller cleared the flight to TEB via the Philadelphia One standard instrument departure and instructed the crew to climb to 3,000 ft after departure and to expect clearance to 4,000 ft 10 minutes after departure.7 The crew read back the clearance, contacted PHL ground control, and received instructions to taxi to runway 35. At 1500:51, the cockpit voice recorder (CVR) recorded the PIC’s statement to the SIC, “okay I think we’re next man. hand on your yoke,” while the flight crew was holding short of the runway.8 The PIC continued to make statements directing the SIC’s control inputs during the takeoff roll. Just after takeoff, at 1504:18, the PIC stated, “gear up. yaw dampener engaged. ya gotta tell me to do that.” About 20 seconds after takeoff, the PIC stated, “after takeoff checks.” The SIC acknowledged the statement. The PIC then contacted PHL departure control and stated that the airplane was climbing to 2,000 ft. The controller then cleared the airplane to 4,000 ft and instructed the pilot to contact PHL approach control.9 About 1506, while leveling off the airplane at 4,000 ft, the PIC directed the SIC in the use of the trim wheel; shortly thereafter, he reminded the SIC to “watch the altitude.” At 1507:03, the PIC told the SIC that he (the PIC) selected the altitude hold mode of the autopilot and reminded the SIC to keep the airplane’s speed below 250 knots (kts); about 24 seconds later, the PIC prompted the SIC to check airspeed. The PIC then stated that the SIC was doing much better, had been paying attention, and was understanding what to do. At 1508:39, the PIC stated to the SIC, “two fifty on the speed,” which was followed by the sound of increased engine thrust. At 1508:54, the SIC stated, “keep us below two fifty.” At 1509:35, the controller asked for the airplane’s speed. The CVR captured sound similar to a decrease in engine thrust about 1 second before the PIC reported an airspeed of 260 kts. Between 1510:33 and 1510:37, the PIC stated, “#. give it a little power [along with a sound similar to a sigh]” and “keep it within ten.”10 About 1512, the PIC asked the controller if the flight could be cleared to fly at a higher altitude (the PIC had requested an altitude of 27,000 ft when he filed the flight plan). The controller replied “unable higher” and explained that a higher altitude would require resequencing the airplane for arrival at TEB. Speaking to the PIC, the SIC exclaimed, “ha. it’s like she [the controller] doesn’t like us.” At 1512:32, the SIC said, “it’s holdin’ the speed,” and the PIC replied, “no it’s a # tail wind so yeah you have to pull back the power juuust a little.” The PIC made

7 A standard instrument departure is an FAA departure procedure developed to meet environmental, capacity, and ATC requirements for a specific airport. 8 See appendix C for the full CVR transcript. 9 Philadelphia approach control provided en route handling for the flight from 1505:40 to the handoff to New York approach control at 1513:31. 10 The “#” symbol in the CVR transcript indicates an expletive.

NTSB Aircraft Accident Report 3 additional comments about the controller and concluded by exclaiming in a high-pitched voice, “she’s a # idiot. get us someone else if she can’t do it.” About 1514, after changing frequencies to New York approach control as instructed, the flight crew was given the altimeter setting for Newark Liberty International Airport (EWR), Newark, New Jersey, and the controller vectored the flight for the instrument landing system (ILS) runway 6 approach, circle to runway 1 at TEB.11 The PIC asked the controller to repeat the altimeter setting. After the controller repeated the altimeter setting and the vector for the ILS runway 6 approach, circle to runway 1, the PIC read back the assigned heading. Speaking to the SIC, the PIC stated, “he was saying circling # six or something. I don’t know what the # they thinkin’ we’re doin’. we’re # hundreds of miles away man.” Radar data showed that the airplane was 48 nm from TEB at that time.12 The crewmembers then discussed their arrival time at TEB; the SIC stated that they would arrive in “like # an hour.” At 1515:08, the PIC corrected the SIC’s estimate by stating that they would arrive in 20 minutes. At 1515:13, the controller instructed the flight crew to descend to and maintain 3,000 ft. After acknowledging the clearance, the PIC stated to the SIC, at 1515:22, “we’re # gonna be there in ten minutes. I gotta get the # ATIS [automatic terminal information service] #. I didn’t realize we’re that # close.” At 1515:30, the PIC stated, “of course I don’t have # G-P-S that’s why.” The SIC replied, “you wanna use my ipad?” and the PIC responded, “naw that’s okay.” At 1515:46, while the SIC flew the descent to 3,000 ft, the PIC tuned the TEB ATIS broadcast. While the PIC was listening to the ATIS broadcast, the controller instructed the crew to turn the airplane to a heading of 120°, which the SIC acknowledged. The PIC questioned the vector as the ATIS broadcast continued to play. He stated the altimeter setting that was broadcast over the ATIS and told the SIC to “watch the altitude.” The PIC then tuned the radio off the ATIS frequency, stating that he did not have time to listen to it, and repeated the altimeter setting.13 Radar data indicated that the airplane was southwest of TEB about 1517; at that time, the PIC asked the SIC if he could see New York, and the SIC responded, “negative. we’re so # far from it. like—…we’re (in) the boonies.” Shortly thereafter, the PIC stated, “well it’s less than fifty miles man. that’s why. two five zero on the speed sir,” which was followed by the sound of increased engine thrust. The PIC continued to talk about the airplane’s location and altitude and then stated in a high-pitched loud voice, “but they got us at # three thousand. really?… and we’re goin’ # south we’re not goin’ # north,” followed by, “I don’t know what. (well it) must be a flow issue.” At 1517:59, the PIC said to the SIC, “let’s do the checklist,” but the PIC did not identify

11 An ILS transmits course and glideslope signals from collocated transmitters. The two signals are received by tuning a navigation receiver to the published ILS frequency. The ILS approach procedure for runway 6 is described in section 1.5 of this report. 12 The NTSB completed a radar performance study to determine the airplane’s position, airspeed, altitude, pitch angle, and bank angle at various times in the flight. The study is discussed in section 1.9 of this report. 13 ATIS information Zulu indicated an automated observation of wind from 340° at 18 kts gusting to 29 kts, visibility 10 miles with light rain, scattered clouds at 5,500 ft above ground level, temperature 18°C, dew point 6°C, and altimeter 29.74 inches of mercury.

NTSB Aircraft Accident Report 4 which checklist he was referring to. At 1518:24, the PIC stated, “approach is one twenty-six. V-ref is one-nineteen.”14 About 1519:17, the controller instructed the flight crew to fly a heading of 90° to intercept the runway 6 localizer. Between 1519:40 and 1519:45, the PIC told the SIC to “set this up on your side” and “one oh eight point nine,” which was the frequency used to set the pilots’ navigation equipment for the TEB ILS. At 1520:09, the PIC stated that he was also setting his navigation equipment for the ILS. Radar data indicated the airplane flew through the localizer course at 1520:20. At 1520:29, the SIC announced to the PIC, “runway in sight”; radar data showed that the airplane was about 30 nm from TEB at the time. At 1520:32, the controller stated, “make sure you intercept the localizer,” which the PIC acknowledged. At 1520:42, the controller stated, “Learjet two delta alpha left turn twenty heading (if) you (need it) to join,” which the PIC acknowledged. At 1520:38, the PIC stated to the SIC, “why aren’t you not—intercepting it. I guess it’s # left,” followed by, “we’re makin’ the left.” The SIC then stated, “you want me to hit nav?” to which the PIC replied, “#. that’s why.” The PIC redirected the SIC’s attention to the runway; afterward, between 1521:01 and 1521:05, the SIC stated, “that was Newark” twice and “I thought that was Teterboro.” At 1521:09, the PIC stated to the SIC, “alright your localizer is captured. and we’ve got nav mode selected on the F-M-S [flight management system].”15 At 1521:42, the PIC stated, “you got two forty on your speed. two four zero,” which was followed by the sound of a decrease in engine thrust. At 1521:52, the controller stated, “can you go to VINGS? can you do that? VINGS? and then just localizer six?” and the PIC stated, “copy.”16 He then spelled out VINGS (“V-I…N-G-S”); provided the heading; and stated, “gonna go in nav mode.” At 1522:29, the SIC stated, “go ahead and take over.” CVR information indicated that the SIC continued to fly the airplane. The PIC stated, “on the F-M-S…we’re there we’re going direct VINGS at this time. twelve miles away to VINGS.” Radar data confirmed that the airplane was 12 miles from VINGS at the time. The PIC added, “you still got the localizer on your side so we’re doin’ good.” The SIC replied, “alright. I don’t wanna # up.” At 1522:46, the controller instructed the crew to descend to and maintain 2,000 ft. As the descent to that altitude began, the PIC continued to coach the SIC. At 1523:04, the PIC stated, “try to keep the speed at about one er two forty,” which was followed by the sound of an increase in engine thrust. The PIC continued to coach the SIC, stating, “let me help you out we’re trimming it forward a little.” At 1523:23, the controller advised the flight crew that the airplane was 8 nm from VINGS, instructed the flight to cross VINGS at 2,000 ft, and cleared the flight for the ILS runway 6

14 VREF is commonly defined as stall speed with full landing flaps or selected landing flaps multiplied by 1.3. 15 An FMS, or flight management system, is an onboard computer system that integrates inputs from various subsystems to aid the pilot in controlling the airplane’s lateral and vertical paths. 16 VINGS, DANDY, and TORBY are fixes on the ILS runway 6 instrument approach procedure, which is discussed in detail in section 1.5 of this report.

NTSB Aircraft Accident Report 5 instrument approach to TEB with an instruction to circle to land on runway 1. The crew read back the clearance. The controller then asked for the airplane’s airspeed; the PIC replied that the airspeed was 240 kts. The controller instructed the flight crew to maintain 240 kts until the airplane reached VINGS and then to slow to 180 kts until reaching TORBY, the final approach fix. The PIC read back the instruction. Figure 1 shows the distance from PHL to TEB (about 80 nm) along with the airplane’s position, heading, and ground track before ATC directed the flight to the VINGS navigational fix. Figure 1. Accident airplane’s ground track en route to TEB. At 1524:01, the PIC told the SIC, “you are nav mode selected. we’re on F-M-S still.” The PIC added that it was 6 miles to VINGS and told the SIC to maintain 240 kts at 2,000 ft. The PIC reminded the SIC that they were circling to runway 1 and stated, “so circling minimums…is seven hundred and sixty [ft].” The SIC replied with an expletive. At 1524:34, the PIC told the SIC that he was changing the autopilot mode to heading select and that he was setting his navigation equipment for the ILS approach. At 1525:08, the SIC stated, “you’re gonna have to get on with it—with me when we uh start this #.” The PIC then stated, “hey we’re tracking the V-O-R inbound now.”17 The SIC stated, “there’s the airport,” and the PIC responded, “yes sir. we’re tracking—we’re tracking the localizer excuse me.” At 1525:17, the PIC stated to the SIC, “two forty on the speed sir,” which the SIC acknowledged, and a sound similar to decreasing engine thrust was heard on the CVR. At 1525:25, the PIC announced that the airplane was over VINGS and, at 1525:31, told the SIC to “go ahead and pull all the way to idle” to slow the airplane. Radar data indicated that the airplane began to

17 VOR is the abbreviation for very-high-frequency omnidirectional radio range.

NTSB Aircraft Accident Report 6 descend and slow. The PIC then stated, “down to one eighty on the airspeed. no. no. no. no. don’t

do that yet. we haven’t captured the glideslope.” At 1526:02, the PIC stated the tower frequency;

he then told the SIC to maintain between 180 and 190 kts. At 1526:21, the PIC stated, “before landing checks.” At 1526:32, the controller instructed the flight crew to contact TEB tower and added, “be sure (you) cross DANDY (fitch) hundred feet circle at TORBY.”18 The PIC read back the instruction, stating “DANDY at two hundred feet. circle at TORBY.” The controller repeated DANDY at 1,500 ft, and the PIC stated, “DANDY at fifteen.” The PIC then twice told the SIC to be at 1,500 ft at DANDY. At 1527:07, the PIC asked the SIC, “you got any indication on uh distance for DANDY?” The SIC replied, “nope. I got nothing.” The PIC then stated “six point four [nm to] Teterboro…okay we’re fine.” When the SIC asked if he should descend, the PIC replied, “not yet.” The airplane continued to follow the approach course and crossed DANDY at 2,050 ft. While crossing DANDY, the airplane reached but flew through the glideslope without descending. At 1527:19, the PIC stated, “glideslope’s come’n in you gotta’ look at my side.” About 17 seconds later, the PIC stated, “it did not capture. trim the nose over,” and, “you’re gonna have to fly on—you gotta’ glideslope on your side?” When the SIC replied, “yes sir,” the PIC stated, with emphasis, “follow the glideslope. do not go below fifteen.” At 1527:54, the CVR recorded increased background noise consistent with the sound of air drag on landing gear during extension. The PIC then told the SIC (for the second time) to slow to 180 kts so that the PIC could extend the flaps to 20°. CVR and radar data indicated that the SIC slowed the airplane and stopped its descent at 1,600 ft. The airplane crossed TORBY at 1528:08 at an altitude of 1,550 ft. At 1528:10, the PIC told the SIC, with emphasis, to “follow the # glideslope.” The SIC replied, “alright you said don’t go below one—,” and the PIC replied, “yeah don’t go below fifteen ‘til I call TORBY.” At 1528:17, the controller again instructed the crew to contact TEB tower, which the PIC acknowledged. At 1528:22, before checking in with the tower, the PIC stated to the SIC, “now you can bring it on down.” At 1528:27, the PIC added, with emphasis, “seven sixty,” which is the published minimum descent altitude (MDA) for the circling approach; the SIC repeated the altitude. At 1528:30, the TEB tower controller made initial contact with the flight crew, and the PIC responded with “yeah we’re up uh for the circling” to runway 1. The controller stated that the wind was from 360° at 16 kts gusting to 32 kts, instructed the flight crew to continue toward runway 1, and stated that traffic was holding in position; the PIC acknowledged this transmission. Following this exchange with the tower controller, the PIC told the SIC, “eight—eight hundred. right there. hold eight hundred.” The SIC stated, “(yeah) I am,” and the PIC then added, “watch your airspeed. hand on the # throttle.” Radar data indicated the airplane was about 2.5 nm from runway 6. According to radar data, the airplane leveled off at an altitude of about 800 ft while continuing inbound. At 1528:51, the TEB controller asked the pilots where the airplane would be parking, and the PIC responded with the parking location. Between 1528:58 and 1529:05, the PIC told the SIC that they would circle for runway 1; stated, “so we’re kinda on a downwind” and “so.

18 Questionable words in a CVR transcript are enclosed in parentheses.

NTSB Aircraft Accident Report 7 go’head”; and told the SIC to disengage the autopilot. At 1529:07, the TEB controller asked the pilots if they were going to start their turn, and the PIC replied, “we’re doin’ it right now.” Radar data indicated that the airplane began a right turn after the transmission, when the airplane was about 1 nm from runway 6. The PIC then directed the SIC through a right turn. Radar data indicated that the airplane descended from about 650 to 350 ft as it turned. At 1529:15, the PIC stated to the SIC, “watch the airspeed”; the SIC then stated, “your flight controls,” with emphasis. The PIC did not verbally respond to the SIC’s statement. At 1529:18, the enhanced ground proximity warning system (EGPWS) issued an aural “five hundred” feet alert, which the PIC told the SIC to disregard. The 500-ft alert was followed 3 seconds later by an aural alert indicating “sink rate. pull up.” Radar data indicated the airplane then rolled wings level and climbed 100 ft. At 1529:26, the SIC said to the PIC, in a strained voice, “I’m gonna give ya your controls, okay?” The PIC replied, “alright. my controls,” and the SIC responded, “your flight controls.” The PIC stated, “# eh,” in an angry tone. He then told the SIC to watch the airspeed. Radar data indicated that the airplane then began to turn left and that the speed slowed. At 1529:35, the SIC announced, “V-ref” as the airplane slowed; 3 seconds later, he emphasized “add airspeed” and exclaimed “airspeed” three times. Radar data indicated that the airplane reached a left bank angle of 35o and slowed to about 111 kts at 1529:39. At 1529:40, the PIC said, “stall” in a strained voice, and the SIC replied, “yup.” At 1529:43, the SIC again exclaimed, “airspeed. airspeed.” The PIC stated an expletive, and the EGPWS annunciated “sink rate” and “pull up.” At 1529:43.9, the PIC yelled an expletive over the radio, which was the last communication recorded by the CVR and ATC audio recordings. One witness reported seeing the airplane make two “hard” turns, the last of which was to line up for runway 1. Witnesses reported seeing the airplane nearly inverted in a nose-low attitude just before impact. A security camera recorded the airplane’s impact in a parking lot about 0.5 mile south of runway 1 at TEB. Three buildings and 16 vehicles were damaged or destroyed by the impact forces and postcrash fire. 1.2 Flight Crew Information 1.2.1 The Pilot-In-Command The 53-year-old PIC held a Federal Aviation Administration (FAA) airline transport pilot certificate with a multiengine land airplane rating and Learjet, Beechjet 400 (SIC only), and Mitsubishi MU-300 (SIC only) type ratings, issued on November 26, 2014. The PIC completed his Learjet line check on October 7, 2016 (the date he received his PIC upgrade), and completed a proficiency check on March 20, 2017. The PIC’s most recent first-class medical certificate, issued on February 28, 2017, required him to wear corrective lenses. The PIC was current and qualified under FAA and Trans-Pacific requirements. A review of Trans-Pacific records indicated that the PIC had about 6,898 hours total flight experience, of which 353 flight hours were as a Learjet PIC. In the 90, 30, and 7 days before the accident, the PIC flew about 96, 33, and 8.4 hours, respectively. FAA records of certificate and

NTSB Aircraft Accident Report 8 rating checkrides indicated that the PIC had been issued notices of disapproval for three different certificates but obtained each of the certificates on subsequent attempts.19 The PIC was hired as a Learjet PIC by Sunquest Executive Air Charter, LLC (later Trans-Pacific), on July 15, 2016, which was his first job as a PIC for a Part 135 operator.20 Before being hired by Sunquest (Trans-Pacific), the PIC’s most recent aviation employment was with D&D Aviation in Salt Lake City, Utah, as a Learjet and Beechjet SIC. He was a Learjet SIC from May 2006 to February 2009 but was laid off due to a “lack of work.” In November 2014, D&D Aviation rehired him as a Beechjet SIC; his employment ended in December 2015 because his contract was not renewed. The PIC’s employment status between the D&D Aviation positions is unknown. On an application for an FAA medical certificate dated June 24, 2016, the PIC noted that his occupation was “pilot” and that his employment status was “unemployed.” He also reported that he had 6,599 total flight hours, with no hours in the last 6 months. According to company records and interviews with the Trans-Pacific director of operations, the company requested Pilot Records Improvement Act of 1996 (PRIA) records for the PIC from D&D Aviation on July 10, 2016, but never received a response to the initial request or follow-up telephone calls.21 FAA Advisory Circular (AC) 120-68G, which addresses PRIA requirements, describes a “good faith exception” to the regulation. Specifically, section 3.5.2 indicates that, if PRIA records are not received from a previous employer, the hiring employer can allow an individual to begin service as a pilot 30 days after submitting the request for PRIA records as long as the hiring employer made “a documented attempt” to obtain that information. Trans-Pacific’s director of operations stated that he had hired the PIC based on a recommendation from a friend (the former director of operations for D&D Aviation). The PIC was enrolled in a 4-day recurrent Learjet training program at CAE Simuflite that began on July 15, 2016.22 The training plan included 2 days of ground school, 1 day of simulator training, and a checkride. CAE Simuflite records from July 17, 2016, indicated that, during his first simulator training session, the PIC was graded “Not Yet Proficient - Additional Training Required” for engine failure, circling approach, and landing from a circling approach maneuver. CAE Simuflite used the VOR 4L Circle Runway 31R approach to John F. Kennedy International Airport (JFK), Queens, New York, to both train and evaluate students on circle-to-land approaches.

19 On December 18, 1996, the PIC was disapproved for a flight instructor airplane certificate; he was approved on February 3, 1997. On November 29, 1997, the PIC was disapproved for commercial pilot–airplane multiengine land and instrument airplane type ratings; he was approved later that day. On February 7, 2001, the PIC was disapproved for an airline transport pilot–multiengine land type rating; he was approved the next day. 20 Sunquest Executive Air Charter, LLC, changed its name to Trans-Pacific Air Charter, LLC, in January 2017. Company information is discussed in section 1.10 of this report. 21 PRIA, as amended, was enacted to ensure that air carriers and air operators adequately investigate a pilot’s background “before allowing that individual to begin service as a pilot with their company.” Under PRIA, a hiring employer cannot place a pilot into service until that employer obtains and reviews the last 5 years of the pilot’s background and other safety-related records. PRIA requirements are codified at Title 49 United States Code 44703(h), (i), and (j). 22 Trans-Pacific used the CAE Simuflite training center in Dallas, Texas, as part of its approved training program. CAE Simuflite is an FAA-certified training center operating under the provisions of 14 CFR Part 142. Both the PIC and SIC received training from CAE Simuflite.

NTSB Aircraft Accident Report 9 The instructor for that session sent an e-mail to CAE Simuflite’s Learjet manager stating that the PIC had not flown a Learjet for more than 7 years and that the instructor could not recommend him for a checkride due to a lack of proficiency. On July 18, 2016, the PIC received additional simulator training. His instructor that day sent an e-mail to CAE Simuflite’s Learjet manager stating that the PIC was not recommended for a checkride and that he needed additional training on circling approaches. The instructor also asked the manager to make Trans-Pacific aware of the PIC’s training difficulties. On July 20, 2016, Trans-Pacific received notification that the PIC needed additional training and approved it. During his training course, the PIC accumulated 17.5 hours of simulator flight time: 9.2 hours as PF and 8.3 hours as pilot monitoring (PM).23 He conducted eight ILS approaches, nine nonprecision approaches, two visual approaches, and five circle-to-land approaches. The PIC completed his simulator checkride on July 24, 2016. The Trans-Pacific chief pilot stated, during a postaccident interview, that he was aware of the PIC’s training difficulties and that he attributed them to the PIC having flown a different airplane model (the Beechjet) during his previous employment. The National Transportation Safety Board (NTSB) interviewed D&D Aviation and Trans-Pacific pilots who had flown with the accident PIC. Some of his former colleagues at D&D Aviation described the PIC as not proactive with checklists and ineffective in his role as PM. One pilot stated that he and another D&D Aviation PIC had agreed that the accident pilot was not ready to be a PIC. A Trans-Pacific pilot who was qualified on both the Learjet and the Dassault Falcon stated that he had flown with the accident PIC when both were designated as PICs. He stated that the accident PIC had overbanked the Learjet once on approach to landing. The pilot stated that he thought that the accident PIC would need a competent SIC in the right seat. 1.2.2 The Second-in-Command The 33-year-old SIC held an FAA commercial pilot certificate with single- and multiengine land airplane and instrument ratings and a Learjet type rating (SIC privileges only), issued on October 19, 2015. The SIC completed his Learjet proficiency check on September 29, 2016, and he completed proficiency training on November 1, 2016. The SIC’s most recent first-class medical certificate, issued on October 13, 2016, required him to wear corrective lenses. The SIC was current and qualified under FAA requirements; per Trans-Pacific policy, he was authorized to perform PM duties only (see section 1.10.1.8). A review of Trans-Pacific records indicated that the SIC had about 1,167 hours total flight experience, of which 407 hours were as an SIC. In the 90, 30, and 7 days before the accident, the SIC flew about 81, 33, and 8.4 hours, respectively. The SIC had been issued notices of disapproval for a private pilot single-engine land airplane certificate on April 10 and 13, 2009. He was issued the certificate on April 28, 2009. Before being employed at Trans-Pacific, the SIC was employed as a Learjet 35A SIC by MedFlight Air Ambulance and was based in Albuquerque, New Mexico. Trans-Pacific hired the

23 The term “pilot monitoring” has mostly replaced the term “pilot not flying” (PNF) (FAA 2015). The term PM is used in this report except when directly quoting Trans-Pacific policy documents, which used the term PNF.

NTSB Aircraft Accident Report 10 SIC on September 1, 2016. Trans-Pacific requested and received the SIC’s PRIA records documenting his training and flight check history from MedFlight Air Ambulance. The SIC was enrolled in a 5-day recurrent Learjet training program at CAE Simuflite that began on September 16, 2016. The training plan included 2 days of ground school, 2 days of simulator training, and a checkride. After the SIC’s simulator training session on September 18, 2016, the instructor noted the following: • Struggled with normal procedures • Did not perform takeoff checks correctly or know what to look for during the checks • Did not know how to start the engines • Crashed on first takeoff due to incorrect flight director settings • Unable to control speed and altitude during the stall series • Flew inverted on unusual attitude module • Crashed on landing during an ILS approach During circle-to-land training on September 22 and 26, 2016, the SIC was graded “Not Yet Proficient – Additional Training Required.” CAE Simuflite e-mail records showed that the SIC’s instructor informed the CAE Simuflite Learjet manager and the Trans-Pacific director of operations that the SIC was not ready for his scheduled checkride. The director of operations approved additional simulator training. The SIC completed four additional simulator training sessions and was graded proficient on circle-to-land training on September 28, 2016. The SIC’s proficiency checkride on September 29, 2016, did not include (and was not required to include) evaluation of a circle-to-land approach. During his training program, the SIC accumulated 24.7 hours of simulator flight time: 18.6 hours as PF and 6.1 hours as PM. He conducted 17 ILS approaches, 12 nonprecision approaches, 2 visual approaches, and 5 circle-to-land approaches. The NTSB interviewed MedFlight Air Ambulance pilots and Trans-Pacific pilots who had flown with the accident SIC. The chief pilot of MedFlight Air Ambulance described the SIC’s performance as “hit or miss.” The chief pilot stated that the SIC was not as proficient as some SICs who had less experience. The chief pilot added that the company had not documented the SIC’s weak performance and was considering such documentation, but the SIC voluntarily left the company. A Trans-Pacific PIC who had flown with the accident SIC stated that the SIC was progressing but that he was prone to errors. That PIC also stated that the SIC was not ready for a higher SIC level at the time they last flew together. The SIC was hired by Short Hills Aviation Services, Inc., in Morristown, New Jersey, as a Dassault Falcon 50/900 SIC. His employment would have been effective on May 23, 2017, and he was scheduled to begin simulator training at CAE Simuflite that same day. Trans-Pacific managers were not aware that the SIC intended to leave the company. 1.2.3 Preaccident Activities and Crew Rest Trans-Pacific records indicated that the pilots had been scheduled together as a crew during April and May 2017. On May 12 and 13, 2017, the crew completed four flights, accumulating

NTSB Aircraft Accident Report 11 1.8 flight hours and 7.8 duty hours. The crew was not scheduled to fly for the company on May 14, 2017. Limited information was available regarding the pilots’ 72-hour histories. During a postaccident interview, the PIC’s wife stated that she last spoke to him via telephone about 2300 on May 14. She recalled that he was in his hotel room near TEB and was about to go to sleep. The SIC stayed at his mother’s home in New Jersey on the night of May 14. During a postaccident interview, the SIC’s mother stated that he wanted to go to sleep early because he had an early flight the next morning. Company records indicated that the pilots’ rest opportunities in the 72 hours before the accident met FAA requirements. 1.3 Airplane Information 1.3.1 General The accident airplane, shown in figure 2, was a Learjet 35A manufactured in 1981. The airplane was powered by two Honeywell TFE-731-series engines. Postaccident examination of the airplane and engines did not reveal any preaccident anomalies that would have precluded normal operation. Source: Rainer Bexten, www.airliners.net. Figure 2. Accident airplane: N452DA, a Learjet 35A.

NTSB Aircraft Accident Report 12 1.3.2 Stall Warning System The accident airplane was equipped with a dual stall warning system that provided both tactile and visual indications of an impending stall. System components included angle-of-attack (AOA) indicators (on the instrument panel at both pilot positions), a stick shaker and stick pusher that could be felt through both sets of controls, and stall warning lights (on the glareshield annunciator panel). The stall warning system activates based on flap position and stall vane signals.24 The system produces tactile indications of a stall via the stick shaker, which causes the control column to vibrate, and visual indications of a stall via the AOA indicators, which provide information about the airplane’s potential stall hazard with a set of bands that are green, yellow, and red, as described below and shown in figure 3. • The green band on the AOA indicators represents safe operation; when the airplane is operating in the green band, no stall warning tactile or visual indicators will activate. • When the stall warning system determines that the airspeed has decreased to about 7% above the system-derived stall speed, the AOA indicators will move into the yellow band, and the stick shaker will activate and remain active until the airspeed increases above that margin. The frequency of stick shaker vibration increases as the airplane’s speed approaches stall speed. The stall warning lights illuminate when the stick shaker activates and pulses at the same frequency as the stick shaker. • When the airplane’s airspeed has decayed to just above the system-derived stall speed, the AOA indicators will be in the red band. Within 1 kt of the stall speed, the stall computer sends a signal directly to the elevator servo to initiate nose-down elevator movement via the stick pusher. The stall warning lights remain illuminated when the stick pusher activates.

24 The left and right stall vanes, located on the forward fuselage, aligned with airflow to provide AOA information to the system. Flap position switches provide information to a computer amplifier, which will decrease stall indication speeds as the flaps move from 0° to 40°.

NTSB Aircraft Accident Report 13

Figure 3. AOA indicator on the left side of the Learjet 35A cockpit. 1.3.3 Navigation Equipment The installed navigation equipment relevant to this accident is described below.25 1.3.3.1 Navigation Receivers Two identically functioning navigation receivers, designated NAV-1 and NAV-2, were installed in the airplane to process VOR, ILS, and distance measuring equipment (DME) signals.26 Tuning a VOR or an ILS frequency in either receiver configured it to process the course signal and, for an ILS frequency, the glideslope signal.27 Navigation information from the NAV-1 and NAV-2 receivers is displayed on horizontal situation indicators (HSI) on the left and right sides of the instrument panel in front of each of the control columns. The HSIs depict course information via a deviation bar that indicates whether the airplane is on, to the left, or to the right of the selected

25 Navigation equipment installed on the accident airplane also included an automatic direction finder receiver and a marker beacon receiver. 26 The NAV-1 receiver provided information to the left side of the instrument panel and the autopilot. The NAV-2 receiver provided information to the right side of the instrument panel. 27 If a DME transmitter is collocated with the VOR or ILS transmitter, DME information can be received on that channel.

NTSB Aircraft Accident Report 14 course. Glideslope pointers in each HSI indicate whether the airplane is on, below, or above the glideslope. DME information is also displayed in a digital readout. 1.3.3.2 Flight Management System The accident airplane was equipped with a Universal Avionics UNS-1K+ FMS that included a navigation computer unit (NCU), GPS receiver, and control display unit (CDU) mounted in the console between the pilot seats.28 The CDU included an alphanumeric keypad for data entry, a display screen, and various function keys. According to the UNS-1K+ Operator’s Training Manual, pilots use the FMS for navigation by entering route data in the NCU via the CDU keypad (Universal Avionics Systems Corporation 2009).29 The NCU uses GPS information and other navigation data to generate course, distance, time, speed, and other navigation information related to the flight plan and displays the information in pilot-selectable formats on the CDU display. 1.3.4 Autopilot The accident airplane was equipped with a J.E.T. FC-200 automatic flight control system (AFCS) that performed autopilot functions when coupled to the flight controls (autopilot engaged) and flight director functions when not coupled to the flight controls (autopilot disengaged); the autopilot was controlled by the ENG button in the center of the AFCS control panel.30 The buttons on the AFCS panel that control the roll modes include heading (HDG) and navigation (NAV). Pressing the HDG button engages the heading mode in which the autopilot provides roll inputs to maintain a pilot-selected heading. Pressing the NAV button engages the navigation mode in which the airplane follows the previously engaged roll mode or pilot control inputs until the airplane nears a pilot-selected course from the NAV-1/DME receiver or FMS. As the airplane nears the course, the navigation mode engages, and any previous roll mode disengages. After the navigation mode engages, the autopilot adjusts roll to track the selected course. The buttons on the AFCS panel that control the pitch modes include speed (SPD), altitude (ALT), and glideslope (G/S). Pressing the SPD or ALT mode button on the AFCS control panel engages the corresponding mode, which then adjusts pitch to maintain the current value for the selected parameter. Pressing the G/S button on the AFCS control panel arms the glideslope mode, which is used during ILS approaches.31 When the airplane approaches the glideslope signal from

28 Although an FMS performs many functions, this report discusses only the navigation functions of the FMS installed on the accident airplane. 29 Entries used to create a flight plan include, but are not limited to, identifiers for departure procedures, VORs, airways, navigation fixes, arrival procedures, and airports. 30 (a) The autopilot controlled the airplane in the roll and pitch axes by adjusting the aileron (roll) and elevator (pitch) servos. Yaw control was provided by a separate yaw damper system. (b) The AFCS control panel was mounted in the center of the glareshield on the accident airplane and could be reached from either pilot position. 31 When any mode is engaged, a green light above the mode button illuminates to indicate system status. The NAV and G/S buttons also have an amber light above them to indicate that the mode is armed. When either of these modes is engaged after arming, the amber light extinguishes, and the green light above the button illuminates.

NTSB Aircraft Accident Report 15 an ILS transmitter with the glideslope mode armed, the autopilot glideslope mode engages and adjusts pitch to intercept and track the glideslope. If the G/S button is pressed when another pitch mode is engaged, the glideslope mode would arm, but the autopilot would remain in the previous mode until the airplane neared the glideslope. The glideslope mode would then engage to intercept and track the glideslope signal. 1.4 Meteorological Information The TEB forecast that the PIC obtained about 0637 forecasted wind from 320° at 20 kts with gusts to 32 kts, visibility greater than 6 statute miles, and scattered clouds at 6,000 ft above ground level (agl). At that time, there were limited pilot reports for the area and no in-flight weather advisories. There was no record indicating that the accident pilots obtained any weather information after that obtained about 0831 for the BED-to-PHL flight leg. The National Weather Service Surface Analysis charts for 1400 on the day of the accident depicted a deep low-pressure system and an associated occluded front located off the northeastern US coast and a strong high-pressure system located over Michigan and Ohio. These conditions resulted in strong, gusting northwesterly winds over the New Jersey/New York area. A High Resolution Rapid Refresh numerical model sounding noted a moderate and greater potential for low-level windshear below 100 ft agl and a high probability of moderate turbulence between 3,500 and 4,500 ft. Several aircraft in-situ reports also noted strong wind at low altitude and potential turbulence below 5,000 ft. One-minute wind data from the TEB automated surface observing system, collected from 1509 through 1539, indicated wind from 310° to 340° sustained at 16 to 20 kts gusting to 32 kts.32 No significant wind shifts were noted, and only slight changes in direction and speed were recorded during the period. About 1525, the TEB tower controller reported wind from 330° at 19 kts gusting to 29 kts, visibility of 10 statute miles or more, and scattered clouds at 5,500 ft agl. At 1528:36, the TEB tower controller reported wind from 360° at 16 kts gusting to 32 kts. At 1528:45, the TEB tower controller reported that the wind was 18 kts gusting to 32 kts before clearing another airplane for takeoff. Pilot reports from airplanes within 20 nm of TEB included severe turbulence and/or low-level windshear encounters before and after the accident. About 16 minutes before the accident, a regional jet over LaGuardia Airport (LGA), New York, New York, which was about 10 nm from TEB, issued an urgent pilot report of severe low-level windshear at 700 ft with a 20-kt loss of airspeed. About 10 minutes after the accident, the flight crew of a corporate jet over Morristown, New Jersey, about 16 nm from TEB, reported severe windshear at 200 ft with a 20-kt airspeed loss.

32 The automated surface observing system reported wind relative to true north, whereas ATIS and ATC reported magnetic wind; the variation was 12° west.

NTSB Aircraft Accident Report 16 1.5 Teterboro Airport and Approach Procedures TEB is a general aviation airport owned and operated by the Port Authority of New York and New Jersey and is located about 1 nm southwest of Teterboro, New Jersey. TEB has two intersecting runways, runway 1/19, which is 7,000 ft long, and runway 6/24, which is 6,013 ft long. As shown in figure 4, TEB is located near three high-volume, commercial airports: LGA, JFK, and EWR. When TEB uses runway 1 (as on the day of the accident due to a strong northwest wind), inbound aircraft are commonly routed to the airport from the southwest via the ILS to runway 6 to limit conflicts with traffic at the other three airports.

Figure 4. Locations of TEB, LGA, JFK, and EWR. Note: Airplanes flying the ILS runway 6, circle to runway 1 approach typically circle at TORBY; afterward, the airplanes turn right, fly toward MetLife Stadium, and turn left to line up with runway 1. Additional information about the navigational fixes shown in this figure appears in this section. Vectoring aircraft for an instrument approach procedure to runway 6 followed by a circle-to-land maneuver to runway 1 is a common method of landing aircraft to the north at TEB.33 The FAA’s Pilot/Controller Glossary defines a circle-to-land maneuver as follows: A maneuver initiated by the pilot to align the aircraft with a runway for landing when a straight-in landing from an instrument approach is not possible or is not desirable. At tower controlled airports, the maneuver is made only after ATC

33 The instrument approach for runway 6 could be flown as either an ILS approach (using course and glideslope guidance) or a localizer approach (using course guidance only). Both procedures are based on navigation information from the ILS.

NTSB Aircraft Accident Report 17 authorization has been obtained and the pilot has established visual reference to the airport. (FAA 2018) Because the circling maneuver is a visual maneuver, the pilot is responsible for determining the appropriate point at which to begin to circle to the landing runway. The runway 6 ILS approach procedure, shown in figure 5, includes four navigation fixes (two of which were identified by DME) and the missed approach point; to receive a DME signal, an aircraft on an ILS or localizer (LOC) approach to TEB would have one navigation receiver tuned to the ILS to receive course and glideslope signals and a second navigation receiver tuned to the TEB VOR to receive a DME signal.34 Information about the fixes and missed approach point appears below. • The SOLBERG VOR, which is not depicted on the printed instrument approach procedure, is the initial approach fix (as referenced by SBJ in figure 5). • VINGS is the second approach fix and is 12.5 DME from the TEB VOR. Aircraft are required to be at or above 2,000 ft until they pass VINGS. • DANDY is the third approach fix and is 6.4 DME from the TEB VOR; this fix can also be identified by ATC, upon pilot request, using radar. Aircraft are required to be at 1,500 ft when passing over DANDY. After passing DANDY, aircraft are permitted to descend to 1,300 ft until reaching the final approach fix (or, if on the ILS approach, intercepting the glideslope). • TORBY is the final approach fix and is identified by passing the locator outer marker (LOM) or by reaching 1,284 ft while on the glideslope.35 • The missed approach point for the ILS procedure is reached when an aircraft following the glideslope signal descends to the decision height or, in the case of a circling approach, descends to the MDA and flies to the missed approach point depicted on the instrument approach procedure. The MDA is 760 ft for a circling approach. If an aircraft is not in position to land on runway 1, a pilot should execute the missed approach procedure indicated on the approach chart (turn toward the airport, climb to an altitude of 1,000 ft, and intercept the TEB 335° radial).

34 The fixes use a DME signal from the TEB VOR transmitter rather than the ILS transmitter. 35 The TEB ILS/LOC approach also includes a LOM, which consists of a nondirectional beacon transmitter collocated with a marker beacon transmitter. The LOM is normally positioned where an aircraft is expected to intercept the glideslope on an ILS approach. The LOM broadcasts a signal that activates visual and audio marker beacon annunciations in aircraft passing overhead.

NTSB Aircraft Accident Report 18

Source: Jeppesen. Figure 5. TEB ILS runway 6 instrument approach procedure.

NTSB Aircraft Accident Report 19 On December 28, 2018, the FAA issued the following notice to airmen: “when circling to [TEB runway] 01, begin maneuver as soon as practical to establish a stabilized approach.” The FAA estimated that the notice would be in effect until December 28, 2020. 1.6 Flight Recorders The airplane was equipped with a Universal CVR-30 voice recorder, which stored a minimum of 30 minutes of digital audio on solid-state memory modules. Four channels were recorded: one channel for each pilot, one channel for a cockpit observer, and one channel for the cockpit area microphone. The recording began at 1459:44 when the airplane was holding short of runway 35 at PHL. A transcript of the entire recording is provided in appendix C. The airplane was not equipped with a flight data recorder and was not required by federal regulations to be so equipped.36 1.7 Wreckage and Impact Information Examination of the accident site revealed that the access panel to the right wing tip tank and a fragment that appeared to be from the right (green) navigation light were found on the roof of an office building that was 30 ft tall; this location was consistent with the initial impact point. Fragments of the right wing tip tank were located below the initial impact point. The remainder of the wreckage was found in a debris path that was 315 ft in length and was oriented on a heading of about 135°. The airframe was fragmented by impact forces and damaged by fire. Both aileron quadrants and the rudder quadrant were found with broken cables attached. The cable breaks were consistent with impact damage. The elevator cable was found with continuity through the tail cone. Both flap tracks were found intact. Measurements taken at the crash site indicated the flaps and landing gear were fully extended at impact. Figures 6 through 8 depict the airplane’s initial impact point, ground impact area, and the debris field, respectively.

36 According to 14 CFR 135.152(a), an approved flight recorder is required for multiengine, turbine-powered airplanes and rotorcraft that have a passenger seating configuration of 10 to 19 seats. The accident airplane was configured with eight passenger seats.

NTSB Aircraft Accident Report 20 Source: Carlstadt, New Jersey, Police Department. Figure 6. Security video image of N452DA at ground impact. Note: The NTSB enhanced the image in the red square to emphasize pertinent information. Figure 7. Photograph of the initial impact point and start of the debris path.

NTSB Aircraft Accident Report 21 Figure 8. Photograph of the continuation of the debris path. Both engines were found separated from the main wreckage near the farthest point of the debris path. The left engine traveled about 25 ft farther than the right engine. Compressor blades from both engines were bent opposite the direction of rotation; the blades also exhibited tearing and battering damage, indicating that the engines were operating at the time of impact. The oil caps from each engine were found in place, and oil drained from both engines when they were moved. The thrust reversers from both engines were found in the stowed position. 1.8 Medical and Pathological Information The Bergen County Medical Examiner’s Office, Paramus, New Jersey, performed autopsies on the pilots. The cause of death for each pilot was multiple blunt trauma injuries. The FAA’s Bioaeronautical Sciences Research Laboratory, Oklahoma City, Oklahoma, performed toxicology testing on specimens from each pilot; results for both pilots were negative for ethanol and commonly abused drugs.37

37 Only the pilots’ muscle tissue was available for toxicological testing.

NTSB Aircraft Accident Report 22 1.9 Tests and Research The NTSB completed radar, CVR sound spectrum, and surveillance video studies to better understand the airplane’s performance during the accident flight. Airplane performance parameters were derived primarily from radar data; limited data from the airplane’s EGPWS were used to supplement the radar data. Figure 9 shows the airplane’s approach to the airport starting just before TORBY, the final approach fix. Radar data indicated that the airplane began the circle-to-land maneuver about 2.8 nm beyond TORBY (1 nm from the TEB runway 6 threshold). During the airplane’s first turn to the right, the bank angle reached 28°, and the airspeed decreased from 127 to about 123 kts starting at 1529:16. The airplane’s altitude also decreased from 650 to 350 ft during the right turn. After the EGPWS 500-ft callout at 1529:18, the airplane returned to wings level and climbed 100 ft. About 1529:36, the airplane began a left turn toward the runway at an altitude of 450 ft and an airspeed of 120 kts. At 1529:39, the airplane reached a left bank angle of 35°, and the airspeed decreased to about 111 kts. Figure 9. Radar data depicting the airplane’s track during the approach.

NTSB Aircraft Accident Report 23 Manufacturer-provided data indicated that the stall speed for the accident airplane in a 35° level turn was 102 kts. Although radar data indicated that the airplane remained 9 kts above the stall speed during the final left turn, the margin does not account for the effect of wind gusts or flight control inputs that could reduce the airplane’s airspeed below the stall speed. The left-wing-down aileron input required to make the turn to final and to counter the strong left crosswind would have increased the AOA of the right wing and potentially led that wing to stall first, inducing a roll to the right. Radar data and the security video showed that the airplane rolled to the right (away from the runway) before impact. A sound spectrum study of the CVR was conducted to determine the airplane’s engine speed, particularly at the end of the flight after the landing gear was extended. However, after the landing gear extended, the signal-to-noise ratio was insufficient to definitively extract engine speed information. 1.10 Organizational and Management Information At the time of the accident, Trans-Pacific was a privately held company based in Honolulu, Hawaii, and was certificated to operate under 14 CFR Part 135.38 At the time of the accident, Trans-Pacific operated six airplanes and had nine pilots.39 Company management included a director of operations (who also acted as safety officer and charter coordinator), a chief pilot, and a director of maintenance. 1.10.1 Trans-Pacific Operational Policies and Procedures Trans-Pacific’s policies and procedures were published in two manuals: the Trans-Pacific Jets General Operations Manual (GOM) and the Standard Operating Procedures (SOPs) manual. 1.10.1.1 Preflight Among preflight activities, Trans-Pacific SOPs listed performing the mission briefing, obtaining weather information, and completing flight planning. The SOPs stated that “the mission briefing is a general overview of all assigned flight legs, any layover periods and other factors pertinent to the mission.” The SOPs stated that the mission briefing should include the following items:

1. Duty position assigned to each crewmember.
2. Aircraft (by registration number) and the status of that aircraft, making note of

deferred items or repeat discrepancies.

38 Trans-Pacific moved its principal base of operations from Van Nuys, California, to Honolulu, Hawaii, in May 2016. The company’s principal maintenance base moved to Honolulu in March 2017. 39 The operator’s six airplanes comprised two Dassault Falcon AMD-50-50s (Falcon 50), one Learjet 31A, and three Learjet 35As. The operator employed three PICs and one SIC for the Falcon airplanes and three PICs and two SICs for the Learjet airplanes. The company did not employ a Learjet-qualified check airman.

NTSB Aircraft Accident Report 24

1. Assigned flight legs [to] include departure airport, destination airport, departure

times, estimated arrival and flight times.

1. Planned routing for each flight leg, including pertinent navigation aids, en route

weather, winds aloft, altitudes, turbulence, SIGMETS [significant meteorological information], etc.

1. Departure and arrival airport information including NOTAMS [notices to

airmen], runway lengths, instrument approach procedures, terrain, special considerations and taxi route from the runway of expected landing to the FBO [fixed-based operator]. The SOPs also stated that the mission briefing “may include other items…as necessitated by the nature of the mission,” In addition, the SOPs required flight crews to obtain weather information from an approved source (listed in the GOM) and complete flight planning no earlier than 3 hours before their scheduled departure time. 1.10.1.2 Checklists According to the Trans-Pacific GOM, pilots were to conduct checklists using one of three FAA-accepted methods. The GOM described the types of checklists as follows: Do List: The do list is a checklist that must be completed as written, but may be done silently by a single pilot crewmember. It is standard practice that when a ‘do list’ checklist is completed by a single pilot crewmember, that the other pilot crewmember conduct a second check to assure that all items are completed. In the event that an item is found to have not been completed as required by the ‘do list’ checklist, the checklist is to be completed in its entirety again. Challenge and Response: Challenge and response checklists require the presence and participation of both flight crew members. This method of checklist completion is typically utilized when the aircraft is not in motion. During the use of this checklist completion method, the PNF [pilot not flying] will read the checklist items and elicit a response from the PF. Any movement of controls or switches or operational checks will be verbalized and conducted by the PF. The PF may command the PNF to complete all or some of an operational check or control movement, but only if ordered should the PNF do so. Additionally, if ordered to manipulate any controls or switches, the PNF must verbalize all actions as they occur. Challenge and Self-Response: When an aircraft is in motion checklists are usually conducted as a challenge and self-response checklist. While completing a checklist using this method, the PF will focus on control of the aircraft and monitoring the surrounding ramp, taxiways, or airspace. The PNF will read the checklist aloud while responding aloud with the action taken with regards to the checklist items. This is done so that the PF can monitor the actions are being taken as required without distracting him or her from flying the aircraft.

NTSB Aircraft Accident Report 25 Trans-Pacific Learjet 35A pilots used checklists in the CAE Learjet 35/36 Operating Handbook, dated May 2012. Section 12.4.3 of the GOM stated the following about checklist use: It is Trans-Pacific Air Charter’s policy that the use of checklists are [sic] to be as they are written – verbatim, smartly, and professionally. Skipping items, modifying checklist flow or adding items undermines the effectiveness, standardization and is prohibited. If divergence from standard checklist use is observed, it is the duty of any Trans-Pacific Air Charter employee to query the divergence and, if necessary, restart the checklist as it is written. Checklists should be initiated by command of the PF. Good resource management requires that, if in the opinion of the PNF (pilot not flying), the initiation of a checklist has been overlooked, the PNF inquire with the PF as to whether that checklist should commence. According to the Trans-Pacific SOPs, the Before Taxi checklist was a challenge and response checklist. The Taxi, Before Takeoff, After Takeoff, Climb, Cruise, Descent, Approach, and Before Landing checklists were all challenge and self-response checklists. During the accident flight, the crew referenced three checklists. The PIC verbalized steps from the Runway Lineup checklist and the After Takeoff checklist.40 The PIC also called out the initiation of the Before Landing checklist. The latter two checklists, which are relevant to the accident, are shown below. The After Takeoff checklist read as follows:

PM PF 1. Landing Gear UP 2. Yaw Damper ENGAGED 3. Flaps UP 4. Thrust Reversers (below 200 kts) OFF 5. Anti-ice Systems AS REQUIRED 6. Air Ignition AS REQUIRED or OFF 7. Landing/Taxi Lights OFF 8. Pressurization MONITORED 9. Autopilot APPR Light OUT

1. Hydraulic Pressure

NORMAL

1. Angle-of-attack Sensors

CROSS CHECK

40 Checklists were initiated by PF callouts. Most checklists were initiated by a PF callout of the checklist title, such as “Descent Checklist.” Other checklists were initiated with callouts that included the checklist title after a command. For example, the PF callout to initiate the Before Landing checklist was “Gear down, Before Landing Checklist.” The initiating callout for the After Takeoff checklist did not include the title of the checklist. The PF callout to initiate the After Takeoff checklist was “Gear up, Yaw Damper on.”

NTSB Aircraft Accident Report 26 The Before Landing checklist read as follows:

PM PF 1. Spoilers RETRACTED 2. Flaps AS DESIRED (8° or 20°) 3. Landing Gear DOWN 4. Engine Sync OFF 5. Anti-Skid ON/LIGHTS EXTINGUISHED 6. Landing/Taxi Lights ON 7. Thrust Reversers (below 200 kts) ARMED 8. Cabin CHECKED 9. Flaps DOWN

1. Hydraulic Pressure

CHECKED

1. Air Ignition

ON

1. Autopilot

DISENGAGED

1. Yaw Damper

DISENGAGED Trans-Pacific SOPs also provided specific guidance for distinct flight phases. Section 5.1.1 of the SOPs stated that, before the top of descent, A review of the assigned arrival procedure will be conducted by both the Pilot Flying and Pilot Not Flying and the Pilot Not Flying will validate that the waypoints in the FMS or GPS match the waypoints defined by the applicable navigation chart. 1.10.1.3 Crew Coordination Section 12.4.5 of the Trans-Pacific GOM identified actions performed by the PF and the PM, stating the following: A coordinated crew is required for maximum workload dispersal, awareness, and general safety. Seemingly small duties can lead to serious distractions if a divergence from the standard protocols occurs. Section 12.4.5 listed all FMS functions as PM actions. 1.10.1.4 Approach Briefing According to section 12.4.4 of the Trans-Pacific GOM and section 5.1.5 of the Trans-Pacific SOPs, pilots were required to conduct an approach briefing for every approach and

NTSB Aircraft Accident Report 27 landing.41 The brief could be completed any time before the airplane reached 10,000 ft height above the airport. (The manual did not specify when the approach brief should be conducted on flights that were operated below 10,000 ft, such as the accident flight.) The approach brief (SOPs, page 5-5) consisted of 14 items, including the following: • type of approach (approach chart page number and revision date); • approach navigation aid frequencies and identifying code, as defined by the approach chart; • intercept altitude or altitude stepdowns, as defined by the approach chart; • expected altitude at the final approach fix; • the missed approach point, MDA, and/or decision altitude, as defined by the approach chart; and • any deviations from the SOPs. 1.10.1.5 Stabilized Approach The Trans-Pacific GOM and SOPs required that all flights be stabilized by 1,000 ft height above the airport unless that criteria could not be met “due to approach considerations or abnormal aircraft conditions.” Trans-Pacific’s SOPs (section 6.1.1) provided the following criteria for a stabilized approach: • On the correct vertical and lateral flight path. • Requiring only small changes to pitch and heading. • Within 10 knots of target speed as defined by the approach briefing. • Aircraft configured for landing. • Sink rate of no greater than 1,200 [feet per minute], unless required by the approach. • Appropriate power settings for the approach without need for drastic changes.

41 According to the Trans-Pacific SOPs, section 5.1.5, “dictating ‘Standard Briefing’ is not considered a proper briefing by Trans-Pacific Air Charter and should not be used.” The SOPs further stated, “operations defined in these SOPs are applicable to a standard approach, and when abnormal routing is expected the flight crew shall brief any divergence from these SOPs.”

NTSB Aircraft Accident Report 28 • Aircraft aligned with the runway for straight-in landing by no less than 500 feet [height above the airport]. • All briefings and checklists complete. 1.10.1.6 Circle-to-Land Approach Trans-Pacific’s operations specification C075 authorized pilots to conduct a circle-to-land maneuver to the runway of intended landing using the lowest IFR landing minimums. Trans-Pacific pilots were required to complete approved training and a proficiency check on the circle-to-land approach.42 1.10.1.7 Approach Speeds Trans-Pacific SOPs (section 5.1.7) defined a precision approach as “any instrument approach with vertical and lateral guidance” and stated that precision approach SOPs “shall be followed even if that precision approach is executed in VMC.” Trans-Pacific SOPs for a precision approach called for an approach speed of VREF +20 kts before glideslope intercept and an airspeed of VREF +10 kts after glideslope intercept. Trans-Pacific SOPs for a visual approach called for an approach speed of VREF +20 kts until established on final approach to the landing runway and an approach speed of VREF +10 kts thereafter. 1.10.1.8 Trans-Pacific Second-in-Command Policy At the time of hire, Trans-Pacific SICs were classified SIC-0, which meant that they could only perform PM duties. To be authorized as PF, an SIC had to first be designated SIC-1 by management, which would allow the SIC to act as PF with a check airman or management pilot for evaluation on nonrevenue flights before potential advancement to SIC-2 through -4. The designations SIC-2 through -4 allowed an SIC to be PF in various scenarios under the supervision of a line PIC. The following table outlines the guidance provided in the Trans-Pacific GOM (section 11.3.3, page 11-4) for each of the SIC levels. Table. Trans-Pacific SIC positions and authorized duties. Position Authorization SIC-0 Pilot may only perform SIC duties as PM. SIC-1 Pilot may act as PF on nonrevenue flights when authorized for observation by a Trans-Pacific Air Charter check airman or management pilot. SIC-2 Pilot may act as PF from the right pilot seat on nonrevenue flights. SIC-3 Pilot may act as PF from the left pilot seat on nonrevenue flights. SIC-4 Pilot may act as PF on alternating legs from the left pilot seat at the discretion of the PIC. During a postaccident interview, the director of operations stated that he had adopted the Trans-Pacific SIC policy from a previous employer. He stated that the SIC policy was intended to

42 The PIC attended recurrent training that included circle-to-land training from July 15 to 18, 2016; the SIC attended circle-to-land training on September 22 and 26, 2016. For more information, see section 1.2 of this report.

NTSB Aircraft Accident Report 29 ensure that SICs had acceptable skills before giving them additional responsibilities. The director of operations stated that the company tried to assess SICs’ readiness to advance about once per month. He stated that the accident SIC, who was designated SIC-0 at the time of the accident, was not yet ready to perform PF duties but was improving. During the accident SIC’s period of employment at Trans-Pacific, there were no Learjet-qualified management pilots or check airmen to fly with an SIC-1.43 The SIC from the company’s other Learjet flight crew, who was an SIC-0 and had been with the company for 6 months, reported that the PIC with whom he was normally paired had allowed him to act as PF on five or six positioning flight legs. 1.10.2 Crew Resource Management Training Title 14 CFR 135.330, “Crew Resource Management [CRM] Training,” requires each Part 135 certificate holder to have an approved CRM training program that includes initial and recurrent training and at least the following elements:

1. Authority of the pilot in command;
2. Communication

processes, decisions, and coordination, to include communication with Air Traffic Control, personnel performing flight locating and other operational functions, and passengers;

1. Building and maintenance of a flight team;
2. Workload and time management;
3. Situational awareness;
4. Effects of fatigue on performance, avoidance strategies and countermeasures;
5. Effects of stress and stress reduction strategies; and
6. Aeronautical decision-making and judgment training tailored to the operator’s

flight operations and aviation environment. Trans-Pacific used a PowerPoint presentation consisting of 27 slides for its CRM training. The presentation addressed effective communication, team building, the use of strategies for workload management, and the use of crew briefings.44 The training also included scenarios for discussion. The training materials highlighted the negative effects of excessive workload and stated that high workload could be “mitigated through use of effective crew coordination.” Trans-Pacific’s CRM training presentation discussed leadership in three bullet points on one slide, which stated that “a leader’s actions and ideas influence the thoughts and behavior of others,” “leadership is acquired,” and “a leader can be either crew member and must know how to

43 Trans-Pacific no longer operates Learjet airplanes. 44 The PIC attended Trans-Pacific CRM training on July 8, 2016, and the SIC attended this training on August 26, 2016.

NTSB Aircraft Accident Report 30 effectively communicate ideas and observations.” Trans-Pacific’s CRM training also advised that “good followership skills allow for the follower to step up to leader when necessary.” 1.10.3 Trans-Pacific Safety Policy According to the Trans-Pacific GOM, the company safety officer was responsible for monitoring company activities using safety assessments, identifying areas in which corrective measures were necessary, recommending improvements, and ensuring continued compliance with best practices for operational safety. During a postaccident interview, the director of operations stated that the company had no formal safety reporting systems but that an open-door, nonpunitive policy was in place. The director of operations stated that, at the time of the accident, the company was in the process of adopting a safety management system (SMS) that would include a formal risk assessment tool.45 1.11 Manufacturer Guidance on Wind Additives The Learjet 35A airplane flight manual (AFM) stated the following concerning approach speed in gusty wind or windshear conditions: It is recommended that if turbulence is anticipated due to gusty winds, wake turbulence, or wind shear, the approach speed be increased. For gusty wind conditions, an increase in approach speed of one half the gust factor is recommended. 1.12 Federal Aviation Administration Oversight An FAA principal operations inspector (POI) based in the Van Nuys, California, flight standards district office (FSDO) had provided oversight for the Trans-Pacific certificate for about 6 years at the time of the accident.46 According to the POI’s postaccident interview, his primary method of conducting oversight was reviewing company records, including the GOM, SOPs, and PRIA documents. The POI had observed Trans-Pacific’s basic indoctrination training for new employees from August 24 to 26, 2016, in Honolulu but had never observed a Trans-Pacific pilot checkride at CAE Simuflite. He was not aware of the Trans-Pacific SIC qualification policy. Because Trans-Pacific did not have any Learjet-qualified check airmen before and at the time of the accident, the POI conducted line checks for the company’s Learjet pilots. The POI completed the accident PIC’s line check on October 7, 2016, which he passed. The POI stated that

45 The FAA describes SMS as a “formal, top-down business-like approach to managing safety risk” (FAA 2016). The FAA states that SMS provides structure, accountability, policy, and procedure to the safety process. Only Part 121 carriers are required to incorporate SMS; however, the FAA has advocated for SMS implementation beyond Part 121 operations. To demonstrate the scalability of SMS, the FAA released a video, SMS for Small Operators, in 2013 that described a process for SMS implementation by any operator (FAA 2013). 46 Oversight of Trans-Pacific’s certificate was transferred from the Van Nuys FSDO to the Honolulu FSDO in June 2017. The POI considered his working relationship with the director of operations at Trans-Pacific to be “amicable” but stated that Trans-Pacific had “buried us in paperwork” associated with the company’s move from Van Nuys to Honolulu.

NTSB Aircraft Accident Report 31 he had debriefed the PIC on disengaging the yaw damper during the circle-to-land maneuver and using standard callouts as part of CRM. The POI added that “you would never really know if pilots were complying with SOPs for every flight” based on the primary method of ensuring compliance with SOPs through line checks for PICs. FAA Order 8900.1, Flight Standards Information Management System, states the following about the benefits of FAA en route inspections: The primary objective of cockpit en route inspections is for an inspector to observe and evaluate the in-flight operations of a certificate holder within the total operational environment of the air transportation system. En route inspections are one of the Federal Aviation Administration’s (FAA) most effective methods of accomplishing its air transportation surveillance objectives and responsibilities. These inspections provide the FAA with an opportunity to assess elements of the aviation system that are both internal and external to an operator. Thus, unlike a line check, an en route inspection allows an FAA inspector to observe and assess a certificate holder’s operation as a whole. The order further states that cockpit en route inspections provide an opportunity to observe flight crews during each phase of flight and evaluate crewmember adherence to approved procedures and checklists. The standard for evaluation of the approach phase of flight states, “Procedures used during the selected approach (instrument or visual) should be accomplished as outlined in the operator’s maneuvers and procedures document.” In addition, the order directs FAA inspectors to observe PICs’ CRM techniques, delegation of duties, and overall conduct. The POI indicated that he had never done an en route inspection of Trans-Pacific or any other Part 135 operator, stating that “the operator would not like it on a revenue flight.” The POI also stated that he would have to pay for a return flight and that an en route inspection would be difficult to schedule. The en route inspection information cited above appeared in a section in the FAA order (volume 6, chapter 2, section 9) with a title that referenced the FAA’s Safety Assurance System (SAS). In its August 2015 response to a 2003 safety recommendation that resulted from an accident involving a Part 135 on-demand passenger charter flight (Safety Recommendation A-03-51), the FAA stated that the SAS would be implemented as a new oversight system for Part 135 operators.47 As of February 2019, the SAS had not been fully implemented for Part 135 operations.

47 Safety Recommendation A-03-51 asked the FAA to “conduct en route inspections and observe ground training, flight training, and proficiency checks at all 14 Code of Federal Regulations Part 135 on-demand charter operations as is done at Part 121 operations and Part 135 commuter operations to ensure the adequacy, quality, and standardization of pilot training and flight operations.” The NTSB issued this recommendation as a result of the October 2002 accident involving a Raytheon (Beechcraft) King Air A100 in Eveleth, Minnesota (NTSB 2003). The crash occurred while the flight crew was attempting to execute a VOR approach; a loss of control and impact with terrain ensued. The NTSB classified this recommendation “Closed—Unacceptable Action” on November 19, 2015.

NTSB Aircraft Accident Report 32

1. Analysis
2. 1 Introduction

This accident occurred when the Learjet 35A, operated by Trans-Pacific Jets (a Part 135 operator) as a Part 91 positioning flight, departed controlled flight and crashed during a circling approach to TEB, killing the two pilots and destroying the airplane. This analysis discusses the accident sequence (section 2.2) and evaluates the following: • the effect of preflight planning and decision-making on flight crew performance during the accident flight (section 2.3), • the use of FDM programs for detecting noncompliance with SOPs (section 2.4), • FAA safety programs for Part 135 operators (section 2.5), • CRM and leadership training requirements for Part 135 operators (section 2.6), and • Trans-Pacific policies relating to SIC qualification and approach speed wind additives (section 2.7). Having completed a review of the circumstances that led to the accident, the NTSB found no evidence that any of the following contributed to the cause of the accident: • Flight crew FAA qualifications: The PIC and SIC were certificated, current, and qualified in accordance with federal regulations. • Flight crew medical conditions: The PIC and SIC held valid and current FAA airman medical certificates. A review of information about the PIC’s and SIC’s recent activities, work schedule data, and other company and FAA records showed no evidence of impairment or performance degradation due to preexisting medical conditions for either pilot. • Flight crew alcohol or other drug use: Toxicology testing on specimens from each pilot revealed no evidence of alcohol, medication, or other substance that could have affected the ability of either pilot to safely fly the airplane. • Airplane mechanical condition: Examination of the airplane’s airframe, engines, and systems identified no evidence of preimpact anomalies or malfunction that would have precluded normal operation. The crew did not discuss or report to ATC any airplane anomalies or malfunctions during the flight. Thus, the NTSB concludes that the flight crew was properly certificated; there was no indication that the flight crew was impaired by medical conditions, alcohol, or other drugs; and there were no preimpact airplane anomalies that would have precluded normal operation. In addition, as stated in section 1.2.1, Trans-Pacific requested, but did not receive, PRIA records for the PIC and placed him in revenue service for the company without an evaluation of these records. The NTSB reviewed the PRIA records for the PIC as part of this accident

NTSB Aircraft Accident Report 33 investigation and found no failures at the PIC’s previous employer. Thus, the lack of PRIA records for the PIC was not a factor in this accident because nothing in the records would have precluded Trans-Pacific from placing the PIC in revenue service. 2.2 Accident Sequence 2.2.1 Preflight Planning, Taxi, and Takeoff Trans-Pacific SOPs did not include specific preflight planning tasks but required the PIC to include planned routing, pertinent navigation aids, and en route weather (among other information) in a crew mission briefing before every flight. The only evidence of preflight planning for the accident flight was the IFR flight plan filed using the PIC’s DUATS account less than 1 hour before the accident flight’s departure. The flight plan listed an estimated flight time of 28 minutes and requested an en route altitude of 27,000 ft, which were not compatible with each other because it would have been impractical to climb to and descend from 27,000 ft in 28 minutes. Such a discrepancy suggests that the PIC devoted little attention to planning the flight from PHL to TEB and that the planning that he did accomplish was inadequate. Although a weather forecast for TEB was obtained at 0637 in preparation for an earlier flight, there was no evidence that the crew obtained weather information for the accident flight leg to TEB, which was contrary to the Trans-Pacific’s SOPs requiring that the PIC obtain weather information within 3 hours of a scheduled departure. Thus, the NTSB concludes that the PIC’s preflight planning was inadequate and incomplete. About 4 minutes before takeoff, the PIC told the SIC, “okay I think we’re next man. hand on your yoke,” indicating that the SIC was the PF. The PIC coached the SIC through the takeoff sequence and most of the remainder of the short flight. Due to the SIC’s lack of experience, he had the lowest classification under Trans-Pacific’s graduated SIC qualification program. As a result, he was not authorized by the company to act as PF. Thus, the NTSB concludes that the PIC’s decision to allow the SIC to act as PF was improper and contrary to company SOPs. (See section 2.7.1 for more information on Trans-Pacific’s SIC policy.) As the PF, the SIC did not initiate the After Takeoff checklist, as required by Trans-Pacific SOPs, which the PIC corrected by initiating the items on the checklist himself and telling the SIC “ya gotta tell me to do that.” However, the reminder did not prompt the SIC to initiate any other checklists, which he should have done as PF. The crew’s nonstandard checklist execution likely occurred because they were not acting in their usual roles during the accident flight (the PIC usually acted as PF, and the SIC usually acted as PM). The effects of this role reversal are discussed further in section 2.3.1. 2.2.2 En Route and Approach About 2 minutes after takeoff, as the airplane leveled off at 4,000 ft, the PIC coached the SIC’s power control and use of trim and reminded him to “watch the altitude.” About 8 seconds later, the PIC told the SIC to keep the airspeed below 250 kts; about 24 seconds after that (the first of 12 times during the flight), the PIC prompted the SIC to check the airspeed. The CVR did not

NTSB Aircraft Accident Report 34 record either pilot initiating, verbalizing steps from, or announcing the completion of the Climb or Cruise checklists (as required by Trans-Pacific SOPs for those phases of flight). About 8 minutes after takeoff, the PIC requested a higher altitude from PHL approach control despite the estimated flight duration of 28 minutes, as indicated in the flight plan. PHL approach control told the flight crew that the request was denied because it would require resequencing the flight’s arrival. About 2 minutes later, New York approach control provided the crew vectors for the ILS approach to runway 6, circle to runway 1 at TEB. The PIC repeated the vectors but not the approach assignment and commented to the SIC, “he was saying circling # six or something. I don’t know what the # they thinkin’ we’re doin’. we’re # hundreds of miles away man.” Radar data indicated that the airplane was about 48 nm away from TEB at that time. The SIC responded to the PIC by indicating that they would arrive in “like # an hour.” About 15 seconds later, the PIC acknowledged the New York approach controller’s clearance to descend to 3,000 ft. At 1515:22, the PIC stated, “we’re # gonna be there in ten minutes. I gotta get the # ATIS. #. I didn’t realize we’re that # close.” This discussion indicates the pilots’ lack of understanding of the route and positional awareness along the route (likely due to his poor preflight planning). Further, although the crew was provided with the approach to expect into TEB, the PIC did not seem to be clear about the approach and did not ask for clarification; he expressed his confusion only to the SIC and not the controller. Had the PIC asked the controller for clarification about the circling approach, the pilots might have had a better mental model of the circle-to-land maneuver that they would be flying; that clarification could then have been reinforced during an approach briefing (which the crew did not perform). While the PIC listened to the ATIS broadcast beginning at 1515:46, the New York approach controller instructed the flight crew to turn southeast to a heading of 120°, which the PIC acknowledged. The PIC then tuned the radio off the ATIS frequency and relayed only the altimeter setting to the SIC, with the PIC stating that he did not have time to listen to the full broadcast. The CVR did not record the crew verbalizing steps from or announcing the completion of the Descent checklist, which the operator’s SOPs required the PF to initiate and the PM to perform using the challenge and self-response method. Radar data indicated that the airplane was southwest of TEB when the PIC stated, “but they got us at # three thousand. really?…and we’re goin’ # south we’re not goin’ # north” in a high-pitched loud voice. The ATC instruction to turn southeast appropriately placed the airplane on a course that would intercept the final approach course, which tracked northeast; the PIC’s confusion further indicates his lack of understanding of the route and approach and the airplane’s position on the route. The flight crew began the approach but did not conduct an approach briefing, which the operator’s SOPs required for every approach and landing. The PIC was likely referencing the Approach checklist when he stated, at 1517:59, “let’s do the checklist,” which the SIC should have initiated as the PF. About 25 seconds later, the PIC stated, “approach is one twenty-six. V-ref is one-nineteen,” but did not verbalize any checklist steps.

NTSB Aircraft Accident Report 35 At 1519:17, the controller instructed the flight crew to intercept the localizer for runway 6. At 1519:40, the PIC told the SIC to set his navigation equipment for the TEB ILS. At 1520:09, the PIC stated that he was also setting his navigation equipment for the ILS. Shortly afterward, the airplane flew through the localizer course to TEB.48 Neither pilot noted that the airplane had not intercepted the course until informed twice by the controller. In addition, neither pilot detected that one of the navigation receivers was not tuned to the TEB VOR, which was necessary to identify DANDY (the third approach fix). This error might have been detected if an approach briefing had been conducted. After the airplane began to track the localizer course about 1521, the PIC continued to coach and reassure the SIC on airspeed and navigation. Between 1521 and 1524, the PIC mentioned being “on” the FMS three times and appeared to have added VINGS (the second approach fix) to the FMS flight plan (as indicated by the PIC’s statement “V-I…N-G-S”). However, these statements indicate that the crew had not programmed the approach waypoints into the FMS flight plan before descent, as Trans-Pacific policy required; the pilots’ failure to program the FMS might have also contributed to their poor positional awareness on the approach. After receiving (at 1523:23) and reading back a clearance for the ILS runway 6 approach, along with an instruction to conduct a circle-to-land maneuver, the PIC reminded the SIC to circle to runway 1 and added “so circling minimums. is seven hundred and sixty [ft].” From about 1525 to 1528, the flight crew mismanaged the vertical profile for the TEB ILS approach. After reaching VINGS, the PIC told the SIC, at 1525:31, to reduce thrust “all the way to idle” to decrease the airspeed to 180 kts, as instructed by New York approach control. The power reduction caused the airplane to descend, and the PIC stated “no” four times and, “don’t # do that yet. we haven’t captured the glideslope,” suggesting that the PIC did not understand that the approach required a descent to 1,500 ft. At 1526:32, the controller instructed the flight crew to contact the TEB tower and added, “be sure (you) cross DANDY (fitch) hundred feet circle at TORBY[the final approach fix].”49 The PIC read back the instruction to circle at TORBY. The circling maneuver is generally begun at the pilots’ discretion because it is a visual maneuver at that point. However, in this case, because the controller told the flight crew to circle at TORBY, the flight crewmembers were required to either comply with the instruction or tell the controller that they were unable to comply. Neither occurred. The controller repeated the instruction for the airplane to be at 1,500 ft at DANDY, and the PIC twice stated this information to the SIC. When the SIC asked if he should descend, the PIC replied, “not yet.” The airplane crossed DANDY at 2,050 ft and passed through the glideslope without capturing it. It is possible that the autopilot glideslope mode was not armed and the glideslope button on the AFCS panel was not pressed, which had to be accomplished before reaching the glideslope, and that neither pilot monitored to ensure activation. It is also possible

48 At 1520:49, the SIC asked the PIC, “you want me to hit nav?” About 7 seconds later, the PIC responded, “there we go.” Given these cockpit communications, which occurred when the airplane was turning toward the localizer, and the airplane’s straight-line track (as shown by radar data), the flight crew had likely armed the localizer in autopilot NAV mode, and the autopilot tracked the localizer inbound. Specifically, because the autopilot would follow inputs only from the left side of the cockpit, the PIC had likely tuned the ILS frequency on the navigation receiver on his side of the cockpit and pressed the NAV button on the AFCS panel. 49 Although (fitch) was unintelligible on the CVR transcript, it is likely that the controller said “fifteen.”

NTSB Aircraft Accident Report 36 that the glideslope was armed but was not captured because the airplane was above the glideslope signal at the time. The PIC stated, “it did not capture. trim the nose over,” indicating his belief that the autopilot glideslope mode was armed. The PIC then instructed the SIC (with emphasis) to “follow the glideslope. do not go below fifteen,” indicating that the PIC was unaware that, at this point in the approach, it was permissible to descend below 1,500 ft. After crossing DANDY, the SIC leveled the airplane at 1,600 ft near TORBY, which was 100 ft higher than the maximum altitude allowed during that portion of the approach. The airplane crossed TORBY at 1528:08 at an altitude of 1,550 ft. At 1528:10, the PIC again told the SIC (with emphasis) to “follow the # glideslope.” The SIC replied, “alright you said don’t go below one—,” and the PIC interrupted with, “yeah don’t go below fifteen ‘til I call TORBY.” About that time, the airplane was about 0.3 nm past TORBY and was above the glideslope (see figure 10). At 1528:54, the PIC responded to a low-priority ATC transmission asking about the crew’s intended parking location instead of focusing on the approach. Figure 10. Diagram illustrating the airplane’s vertical profile between TORBY and the MDA along with relevant events. Note: The orange line approximates the airplane’s vertical path from 1527:54 to 1528:58. The dashed line (MDA) is shown on the Jeppesen instrument approach chart for TEB (see figure 5). Neither pilot verbally acknowledged crossing the final approach fix, and neither mentioned the ATC instruction to begin the circle-to-land maneuver at TORBY. Thus, the NTSB concludes that the flight crewmembers’ failure to verify the approach and conduct an approach briefing resulted in confusion and errors that led them to mismanage the vertical profile for the approach and not initiate the circle-to-land maneuver according to ATC instructions.

NTSB Aircraft Accident Report 37 2.2.3 Circle-to-Land Maneuver and Stall Contrary to the ATC clearance, the crew did not begin the circle-to-land maneuver at TORBY and continued to fly past TORBY before the PIC instructed the SIC to descend to the MDA. Although the MDA for a circling approach was 760 ft, the weather was clear, and the pilots did not have to descend to the MDA to see the airport environment. Further, the crew began the descent to the MDA from an altitude about 250 ft above the minimum crossing altitude for TORBY and continued to fly inbound toward the airport; thus, the MDA was reached when the airplane was beyond a position at which the crew could maneuver to runway 1 and fly a stabilized approach. However, the crew continued to fly the approach without discussing that the turns to align with the runway would be late. During this critical period, the PIC remained focused on coaching the SIC and ensuring that the SIC stopped the airplane’s descent at the MDA. According to CVR and radar data, the airplane was 1 nm from the threshold of runway 6 by the time the flight crew began the circling maneuver to runway 1 (see figure 11). Figure 11. Overhead image showing a stabilized flightpath to runway 1 (in blue) compared with the accident airplane’s flightpath (in yellow). CORRECTED COPY

NTSB Aircraft Accident Report 38 Two turns (first to the right and then to the left) were required for the circling maneuver to align the airplane with runway 1. Per SOPs, the target airspeed was 139 kts (VREF of 119 plus 20 kts); the PIC had previously indicated that the approach speed was 126 kts, which is further evidence that he did not adequately prepare for the approach. Early in the right turn, the SIC attempted to transfer the controls to the PIC, stating with emphasis, “your flight controls.” The PIC did not verbally acknowledge the attempted control transfer. Radar data showed that, as the airplane turned to the right, it slowed from 127 to about 123 kts and reached a right bank angle of 28º. The airplane’s altitude also decreased from 650 to 350 ft during the right turn. (At 1529:18, the EGPWS activated a 500-ft aural alert, which the PIC told the SIC to disregard.) By the end of the right turn, the airplane was below 500 ft and was not stabilized on the landing runway heading, which should have prompted the flight crew to call for and perform a go-around per Trans-Pacific SOPs.50 The aural alert “sink rate. pull up” occurred about 3 seconds after the 500-ft alert, which should also have prompted the flight crew to call for a go-around, but neither pilot made the callout. CVR and radar data indicated that, after the alerts, the airplane rolled wings level and climbed 100 ft. About 17 seconds before the end of the CVR recording, the SIC again attempted to transfer the controls to the PIC, stating in a strained voice, “I’m gonna give ya your controls okay?” The PIC responded, “alright. my controls”; he then said “# eh” in an angry tone and told the SIC to monitor the airspeed. Radar data indicated that the airplane then made a rapid left turn toward runway 1 at an altitude of 450 ft and that the airplane’s airspeed decreased to 120 kts. The CVR did not record the PIC stating that he intended to perform a go-around, and the CVR sound spectrum study could not determine whether he increased engine power, which would be necessary to begin a climbing turn for a missed approach. Therefore, the rapid left turn was likely the PIC’s attempt to continue the approach to landing. Thus, the NTSB concludes that the PIC’s decision to continue the approach was inappropriate because the approach did not meet the company’s stabilized approach criteria and the airplane was not in a position to make a safe landing. A notice to airmen regarding maneuvering to TEB runway 1, which became effective in December 2018, indicated that pilots should begin the circling maneuver “as soon as practical to establish a stabilized approach.” The SIC, now acting as PM, announced “V-ref” while the airplane was in the left turn and then emphasized “add airspeed” and exclaimed “airspeed” three times as the airspeed continued to rapidly decrease to 111 kts (the slowest airspeed derived from radar). About this time, radar data indicated that the airplane reached a left bank angle of 35° at an altitude of 450 ft. One second later, the PIC announced “stall” in a strained voice, and the SIC replied “yup.” According to manufacturer-provided data, the stall speed for the accident airplane in a 35° level turn was 102 kts. Although this stall speed is 9 kts lower than the slowest airspeed derived from radar for the accident flight, the manufacturer’s data does not account for wind gusts (about 1 minute before the accident, the tower controller told the pilots that the wind was from 360° at 16 kts gusting to 32 kts) or flight control inputs that could have eliminated the 9-kt margin. For example, the left-wing-down aileron input required to make the turn to final and counter the strong (possibly gusting) left crosswind would have increased the right wing’s AOA and potentially led

50 The flight crew’s decision to fly the circling approach to the published MDA of 760 ft precluded using Trans-Pacific’s 1,000-ft stabilized approach criterion as a threshold for evaluating the stability of the approach.

NTSB Aircraft Accident Report 39 the wing to stall first, inducing the airplane’s roll to the right (shown on radar data) just before impact. Despite the SIC’s airspeed callouts, the PIC continued the left turn without adding power or lowering the airplane’s nose to reduce AOA. The PIC might not have processed the SIC’s callouts warning him that airspeed was decreasing due to a phenomenon known as inattentional deafness in which pilots tune out critical auditory alerts in the cockpit during times of stress (Dehais et al. 2014). As a result, the PIC’s announcement of “stall” might have been a response to the stall warning system’s stick shaker activation rather than any of the SIC’s callouts. Although the AOA indicator would have depicted the decreasing stall margin, the PIC likely did not scan the AOA indicator because he was focused on the visual task of aligning the airplane with the landing runway. Thus, the NTSB concludes that the PIC’s focus on the visual maneuver of aligning the airplane with the landing runway distracted him from multiple indications of decreasing stall margin, resulting in an aerodynamic stall at low altitude. 2.3 Flight Crew Performance The NTSB explored reasons for the pilots’ poor performance throughout the flight. As discussed below, the PIC’s distraction resulting from the improper decision to allow the SIC to fly, the PIC’s inadequate preparation for the flight, and the flight crew’s inadequate preparation for the approach led to many of the failures occurring throughout the accident flight. 2.3.1 Decision to Allow the Second-in-Command to Act as Pilot Flying The PIC’s decision to allow the SIC to act as PF placed both pilots in roles that they did not routinely perform. As PF, the SIC was responsible for controlling the airplane and initiating configuration changes and checklists. As PM, the PIC was responsible for monitoring the aircraft; calling out deviations from the intended flightpath; and completing tasks that did not directly involve controlling the airplane, such as checklist execution and FMS programming. However, the SIC’s performance of PF tasks was weak and required frequent coaching from the PIC. This frequent coaching appeared to distract the PIC, degrading his situational awareness and performance of PM tasks. The SIC’s difficulties in the role of PF were evident throughout the short flight. The PIC initiated checklists that the SIC should have called for, including the After Takeoff and the Before Landing checklists. The SIC also had difficulty with primary flight control tasks, especially maintaining airspeed; the CVR indicated that the PIC often prompted the SIC to adjust thrust to control airspeed. In addition, the SIC was coached through most altitude changes and turns. Although monitoring the PF’s actions is an explicit PM duty, the SIC required a substantial amount of attention and instruction during the accident flight. The PIC’s improper decision to allow the SIC to act as PF resulted in neither pilot being able to consistently meet the requirements of their roles. The effects of this decision were evident in execution errors (by both pilots), monitoring errors (by the PIC), and the general lack of situational and positional awareness exhibited by both pilots. For example, the PIC’s instruction to the SIC to tune his navigation receiver to the ILS frequency and set the final approach course

NTSB Aircraft Accident Report 40 on his navigation display resulted in the improper setup of the airplane’s navigation equipment for the instrument approach.51 In addition, the PIC did not (1) effectively perform his PM role while he was coaching and directing the SIC because the PIC did not call for the Climb, Cruise, or Descent checklists (which the SIC, as PF, failed to initiate), (2) listen to the full ATIS broadcast, and (3) detect that the autopilot might not have been armed to capture the glideslope. Finally, the time devoted to coaching the SIC during the short flight reduced time available for the PIC to ensure that he had an accurate understanding of the airplane’s position and state. Thus, the NTSB concludes that the PIC’s extensive coaching of the SIC in his PF duties distracted the PIC, interfered with the normal division of PF and PM duties, and degraded the flight crew’s overall performance. 2.3.2 Inadequate Preflight and Approach Planning Trans-Pacific SOPs state that, in addition to the mission briefing items discussed in section 1.10.1.1, the briefing may include other items “as necessitated by the nature of the mission,” indicating that, for certain missions, the published briefing items (and associated preflight activities) may not be adequate. In the case of the accident flight, opportunities for in-flight planning of the likely instrument approach to TEB would be limited because of the estimated 28-minute flight duration. The PIC should have recognized the potential time pressure inherent in the short flight and conducted additional planning and briefing, including a discussion of the likely approach procedure, before the flight to reduce the pilots’ workload and increase their situational awareness and understanding of the flight. Doing so would have provided the crewmembers a common understanding of the challenges that they could face during the flight and an opportunity to plan how to mitigate them. The result of the PIC’s inadequate and incomplete planning was evident in the confused and agitated statements that he made during the flight. For example, when the PIC requested ATC clearance for a higher altitude, he did not appear to understand that the airplane was already being sequenced for arrival at TEB, and he subsequently questioned the controller’s competence in a conversation with the SIC. Similarly, when initial vectors for the circling approach were issued, the PIC expressed surprise and confusion. If the flight crew had reviewed the available instrument approach procedures at TEB before the flight, the PIC would have known that there were no instrument approaches to runway 1 and could have anticipated a circling approach. Further, because the approach was likely not discussed before the flight and an approach briefing was not completed in flight, the pilots had to figure out the approach as it was being flown, which increased their workload and led to errors, such as failing to detect that their navigation equipment was not tuned to the TEB VOR. Further, the pilots failed to set up the FMS before descent, which led to their lack of understanding of the approach waypoints and glideslope. After the controller instructed the crew to circle at TORBY, the pilots seemed confused about the airplane’s position on the approach, did not identify TORBY, and continued past the point at which they had been instructed to begin the circle-to-land maneuver. Thus, the NTSB concludes that the

51 DME information was required to identify DANDY for the approach. To fly the ILS runway 6 approach procedure using the autopilot, the accident airplane needed to be configured with the ILS frequency tuned on NAV-1 and the VOR frequency tuned on NAV-2. This configuration would provide course and glideslope information to the PIC’s HSI and autopilot and DME information to the SIC’s HSI.

NTSB Aircraft Accident Report 41 PIC’s inadequate and incomplete preflight planning and the flight crew’s lack of an approach briefing contributed to the crew’s confusion and lack of situational awareness during the accident flight. 2.4 Flight Data Monitoring As discussed in sections 2.2 and 2.3, the flight crew repeatedly deviated from company policy and procedures. If the flight had not ended in an accident, Trans-Pacific would not have a way to identify this crew’s deviations from policy and SOPs, and the company had no way to determine whether this (or any) crew’s previous operations were conducted in accordance with company policy and SOPs. As discussed in the NTSB’s report on a 2014 accident involving a Gulfstream G-IV at BED, procedural drift and normalization of procedural deviance can pose a significant threat to the safety of flight operations, particularly for small operators (including Trans-Pacific) with limited operational oversight and consistent crew pairings (NTSB 2015). Flight data monitoring (FDM) can be a very useful tool for combating these problems.52 As a result of an increase in fatal helicopter air ambulance (HAA) accidents in 2008, the NTSB recommended that the FAA “require helicopter emergency medical services operators to install flight data recording devices and establish a structured flight data monitoring program that reviews all available data sources to identify deviations from established norms and procedures and other potential safety issues” (Safety Recommendation A-09-90). On February 21, 2014, the FAA issued a comprehensive final rule, “Helicopter Air Ambulance, Commercial Helicopter, and Part 91 Helicopter Operations” (79 Federal Register 9932), addressing many aspects of these operations. The final rule included 14 CFR 135.607, “Flight Data Monitoring System,” which required that helicopters used for Part 135 HAA operations be equipped with an approved FDM system capable of recording flight performance data (FAA 2014). However, the final rule did not require that all HAA operators establish an FDM program. In a November 1, 2017, response to Safety Recommendation A-09-90, the FAA said that it endorsed using voluntary flight operational quality assurance programs to continuously monitor and evaluate operational practices and procedures. However, because the protections provided in Part 193, “Protection of Voluntarily Submitted Information,” pertain only if data are collected by operators as part of a voluntary FAA-approved program, the FAA did not intend to initiate rulemaking to mandate that HAA operators establish FDM programs. In a January 25, 2018, response, the NTSB pointed out that the intent of Safety Recommendation A-09-90 was for HAA operators to establish an internal program that analyzes recorded FDM system data and monitors trends in their operations. Because the data collected would not need to be shared with the FAA, there would be no need to protect the data. Because the FAA did not intend to take any additional actions regarding this recommendation, the NTSB classified Safety Recommendation A-09-90 “Closed—Unacceptable Action.”

52 FDM programs consist of a system or combination of systems that record an aircraft’s flight performance and operational data. These data are downloaded, evaluated, and used to identify and mitigate risks by modifying operational and maintenance procedures, providing feedback to pilots in training, and highlighting areas in which additional training may be needed.

NTSB Aircraft Accident Report 42 During our investigation of the November 10, 2015, accident involving an Execuflight Hawker 700A that departed controlled flight while on an instrument approach to Akron Fulton International Airport, Akron, Ohio, the NTSB found that operational FDM programs could provide Part 135 operators with objective information regarding the manner in which their pilots conduct flights (NTSB 2016). Our investigation also found that a periodic review of such information could assist operators in detecting and correcting unsafe deviations from company SOPs (NTSB 2016). Therefore, the NTSB recommended that the FAA “require all 14 Code of Federal Regulations Part 135 operators to install flight data recording devices capable of supporting a flight data monitoring program” (Safety Recommendation A-16-34). We also recommended that the FAA, “after the action in Safety Recommendation A-16-34 is completed, require all 14 Code of Federal Regulations Part 135 operators to establish a structured flight data monitoring program that reviews all available data sources to identify deviations from established norms and procedures and other potential safety issues” (Safety Recommendation A-16-35). In a January 9, 2017, response addressing Safety Recommendation A-16-34, the FAA stated that it would evaluate the costs and benefits of requiring all Part 135 operators to install flight data recording devices. The FAA also stated that, in advance of the 2014 rule change to 14 CFR 135.607, it conducted a similar study of the costs and benefits to require data recording devices for HAA operators. The FAA determined, through a financial analysis, that the proposed rule change “did not meet the cost-benefit requirements for safety” but noted that the proposed change, as mandated, applied only to Part 135 operators providing air ambulance services. In an April 6, 2017, response to the FAA, the NTSB expressed surprise that the FAA’s published regulatory evaluation of the rule change to 14 CFR 135.607 showed costs of about $20.4 million over a 10-year period but that the benefits determination amounted to $0. The NTSB’s response provided the results of our review of major aviation accident investigations from 2000 to 2015 involving Part 135 on-demand operators to identify accidents with findings related to pilot performance. The review identified seven such accidents in which a total of 53 people died and 4 people were seriously injured. Our response restated that an effective FDM program could help an operator identify issues with pilot performance (such as noncompliance with SOPs) and, through an SMS, could lead to mitigations that would prevent future accidents. The NTSB asked that the FAA, in its review of Safety Recommendation A-16-34, consider likely benefits from such a mandate instead of determining that there would be no quantifiable benefit. Pending completion of the FAA’s review and actions, the NTSB classified Safety Recommendation A-16-34 “Open— Acceptable Response.” In its January 9, 2017, response concerning Safety Recommendation A-16-35, the FAA stated that it planned to review Part 135 operators’ level of participation in voluntary programs and evaluate additional actions needed to increase the level of participation; however, the FAA also stated that “maintaining a voluntary nature is paramount to the success of [FDM] programs.” In our April 6, 2017, response, the NTSB stated that, based on our review of major aviation accident investigations involving Part 135 on-demand operators (as discussed above), FDM programs are not common among Part 135 operators; as a result, we disagreed that the implementation of voluntary programs was successful. The NTSB further stated that the FAA’s planned review might be a basis for an acceptable alternate action to satisfy Safety Recommendation A-16-35 if the review identified additional actions to encourage and periodically evaluate the level of Part 135 operators’ voluntary compliance. However, the NTSB cautioned that

NTSB Aircraft Accident Report 43 any acceptable response must measure the level of voluntary participation in FDM programs and must find widespread participation among Part 135 operators. Pending completion of the FAA’s review of its voluntary FDM programs and the identification and implementation of additional activities to encourage and measure Part 135 operators’ level of voluntary participation in FDM programs, the NTSB classified Safety Recommendation A-16-35 “Open—Acceptable Alternate Response.” Another recent accident investigation that demonstrated the benefits of FDM programs for Part 135 operators involved a Cessna 208B operated by Hageland Aviation Services, which collided with terrain in low-visibility conditions near Togiak, Alaska, on October 2, 2016 (NTSB 2018). The NTSB found that the company had safety programs in place—including an aviation safety action program (ASAP), an online internal reporting system, and an anonymous safety hotline—and that safety program deficiencies did not play a role in the accident.53 However, the investigation also identified two instances of the flight crew’s noncompliance with SOPs on the day of the accident that were not related to the accident and found that the company did not have a process to ensure compliance with SOPs and regulations. The NTSB concluded that operational FDM programs could provide Part 135 operators with objective information on how their pilots conduct flights and that a periodic review of such information could assist operators in detecting and correcting unsafe deviations from company SOPs. As a result, the NTSB reiterated Safety Recommendations A-16-34 and -35 to the FAA. As with the operators involved in the accidents in BED, Akron, and Togiak, the NTSB’s investigation of the TEB accident found a Part 135 operator that had no means to monitor flights to identify and mitigate operational deficiencies (such as noncompliance with established SOPs) before the accident occurred. An FDM program would have enabled Trans-Pacific to identify issues, such as airspeed deviations and unstable approach profiles, and address them. Such a program could have led to corrective actions before the accident. Thus, the NTSB concludes that an FDM program could help Part 135 operators identify and mitigate procedural noncompliance, including the operational deficiencies identified in this accident investigation. Therefore, the NTSB reiterates Safety Recommendations A-16-34 and A-16-35. In addition, the NTSB notes that, on February 4, 2019, we announced our 2019-2020 Most Wanted List of Transportation Safety Improvements, and Safety Recommendations A-16-34 and -35 were associated with one of the issue areas on the Most Wanted List, “Improve the Safety of Part 135 Aircraft Flight Operations.”

53 The FAA’s website states that the goal of an ASAP “is to enhance aviation safety through the prevention of accidents and incidents. Its focus is to encourage voluntary reporting of safety issues and events that come to the attention of employees of certain certificate holders. To encourage an employee to voluntarily report safety issues even though they may involve an alleged violation of Title 14 of the Code of Federal Regulations…enforcement-related incentives have been designed into the program. An ASAP is based on a safety partnership that will include the [FAA] and the certificate holder, and may include any third party such as the employee's labor organization” (FAA 2017b).

NTSB Aircraft Accident Report 44 2.5 Operational Safety Programs 2.5.1 Safety Management System Despite having a dedicated safety officer position within the organization, Trans-Pacific did not have any formal safety programs in place, such as an anonymous hazard reporting program. The director of operations (who was acting as safety officer) said that he was available to pilots if a safety concern developed and that he had an “open door” policy. The director of operations also provided anecdotal evidence that the company had addressed concerns that pilots reported but did not describe any means for identifying hazards beyond informal reports. The managing director stated that, at the time of the accident, the company had begun, but had not completed, the process of implementing an SMS. After the accident, the company planned to expedite the implementation of an SMS.54 However, Trans-Pacific provided no indication, as of February 2019, that the company’s SMS had been implemented. The NTSB recognizes the value of SMS for all operators and has recommended broadening requirements for SMS.55 In the Akron accident report, the NTSB stated that the company’s “casual attitude” toward compliance with standards “illustrates a disregard for operational safety, an attitude that likely led its pilots to believe that strict adherence to standard operating procedures was not required” (NTSB 2016). (That accident report also referenced three other accidents involving Part 135 operators that could have benefitted from an SMS.)56 As a result, the NTSB concluded that all Part 135 operators could benefit from an SMS because formal system safety methods would be incorporated into internal oversight programs and recommended that the FAA “require all 14 Code of Federal Regulations Part 135 operators to establish safety management system programs” (Safety Recommendation A-16-36). In a January 9, 2017, response concerning Safety Recommendation A-16-36, the FAA noted that Part 135 operators could participate in a formal voluntary SMS. The FAA also stated its intention to conduct a review and hold meetings to determine if further action was needed on SMS for Part 135 operators. Our April 6, 2017, response to the FAA concerning Safety Recommendation A-16-36 again cited the results of our review of major accident investigations involving Part 135 on-demand operators (see the discussion of Safety Recommendation A-16-34). We stated that these accidents involved a safety problem that an SMS could have mitigated. Given the FAA’s stated intention of reviewing Part 135 operations regarding voluntary SMS, we classified Safety Recommendation A-16-36 “Open—Acceptable Response.” The NTSB again recognized the benefits of SMS for Part 135 operators as a result of our investigation of the June 25, 2015, accident involving a de Havilland DHC-3 operated by Promech Air, which struck mountainous terrain northeast of Ketchikan, Alaska, in near-zero

54 Trans-Pacific’s postaccident actions can be found in appendix B. 55 As stated earlier, only Part 121 carriers are required to incorporate SMS; however, the FAA has advocated for SMS implementation beyond Part 121 operations. 56 These accidents are NTSB case numbers ERA14FA120, ANC14MA008, and ANC14LA007.

NTSB Aircraft Accident Report 45 visibility conditions (NTSB 2017). The NTSB’s investigation found that Promech had an anonymous safety reporting system that company managers believed was effective. Promech’s director of operations stated his belief that the company’s informal flight risk assessment process accomplished the same objective as formal risk assessment forms (which he had used at other jobs). The company president said that, typically, pilots verbally reported concerns to managers. Despite their confidence in the company’s existing safety programs, Promech managers were unaware of serious incidents that had occurred. For example, the accident pilot had struck trees during a different takeoff; this event was known to other company pilots but had never been reported to management. The NTSB concluded that, “although Promech had a hazard reporting system, the system was underused by the pilots, and the company’s informal safety processes were not effective for identifying major risks in the company’s flight operations and did not facilitate organizational learning about major areas of risk.” Similar to the Akron accident investigation, the NTSB concluded that an SMS could benefit all Part 135 operators because SMS requires the operators to incorporate formal system safety methods into their internal oversight programs. As a result, the NTSB reiterated Safety Recommendation A-16-36. The recommendation was again reiterated as a result of the Togiak, Alaska, accident investigation. The NTSB noted that Hageland Aviation Services had three accidents in 3 years involving continued visual flight rules flight into instrument meteorological conditions.57 The NTSB believed that the similar circumstances of these three accidents indicated the potential for underlying safety issues that an SMS might have identified. Trans-Pacific’s management (as with Promech’s and Hageland’s) likely believed its existing safety programs effectively identified and mitigated hazards. However, the company’s programs did not identify or mitigate the hazards that contributed to this accident. For example, Trans-Pacific’s safety program did not identify or mitigate the hazard of unapproved (and likely inexperienced) SICs acting as PF. Similarly, Trans-Pacific did not identify the hazard associated with pairing two pilots who had both exhibited difficulties in training. Under an SMS, Trans-Pacific’s progressive qualification policy could be considered part of the risk management component of SMS. In theory, the policy provided a structured way for SICs to develop experience (first under the supervision of management pilots or check airmen and then with company PICs). However, Trans-Pacific lacked the safety assurance component of SMS that would have triggered a review of the progressive qualification policy. Such a review would have likely identified that SICs could not gain experience or advance according to the policy because no Learjet-qualified management pilots or check airmen were employed by the company during the time that the accident SIC was employed by the company. As previously discussed, an FDM program would have provided the company information about how flights were being conducted during normal operations. SMS complements FDM because SMS ensures formal review of strategies developed to mitigate risks identified through FDM. Thus, the NTSB concludes that an SMS would have improved Trans-Pacific’s ability to identify and mitigate risks because an SMS requires operators to incorporate formal system safety methods into their internal oversight programs. Therefore, the NTSB reiterates Safety

57 For information about the other two cases, see NTSB case numbers ANC14MA008 and ANC14LA007.

NTSB Aircraft Accident Report 46 Recommendation A-16-36. In addition, the NTSB notes that Safety Recommendations A-16-36 was associated with the “Improve the Safety of Part 135 Aircraft Flight Operations” issue area on the agency’s 2019-2020 Most Wanted List of Transportation Safety Improvements. 2.5.2 Procedural Compliance Although section 2.4 discussed the benefits of an FDM program, the NTSB recognizes that some procedural noncompliance, such as the flight crew’s apparent omission of programming the FMS with all of the approach waypoints, could be difficult to detect using FDR data. FAA Order 8900.1 states that en route inspections are another method for detecting deviations from SOPs. However, the POI responsible for Trans-Pacific’s oversight during the 6 years before the accident stated that his primary method of conducting oversight was by reviewing company records. The POI said that he had little first-hand knowledge of Trans-Pacific’s operations. He also stated that funding and logistical issues associated with scheduling en route inspections prevented him from conducting them and that he had never done an en route inspection of Trans-Pacific or any other Part 135 operator. Trans-Pacific did not have any Learjet-qualified check airmen on staff, so the POI conducted line checks for the company’s Learjet pilots (including the PIC’s line check on October 7, 2016). Because of logistical issues, these checks were conducted on short nonrevenue flights, and the POI stated that he did not know if company pilots were complying with SOPs during revenue flights. Thus, the NTSB concludes that, because the FAA was not conducting checks in a manner that allowed observation of routine flight operations, the FAA could not evaluate Trans-Pacific pilots’ compliance with SOPs during these operations. The impediments to conducting en route inspections and line checks mentioned by Trans-Pacific’s POI are neither unique nor new. As a result of our investigation of the July 31, 2008, East Coast Jets accident in Owatonna, Minnesota, the NTSB determined that Part 135 line checks were not adequate because they were not conducted on flights that represented typical revenue operations (NTSB 2011). The NTSB recommended the following to the FAA: Require that 14 Code of Federal Regulations Part 135 pilot-in-command line checks be conducted independently from other required checks and be conducted on flights that truly represent typical revenue operations, including a portion of cruise flight, to ensure that thorough and complete line checks, during which pilots demonstrate their ability to manage weather information, checklist execution, sterile cockpit adherence, and other variables that might affect revenue flights, are conducted. (Safety Recommendation A-11-30) On August 8 2013, the FAA responded that the action in Safety Recommendation A-11-30 would be logistically problematic and would increase the FAA’s workload without a corresponding improvement in safety. The FAA also asserted that current guidance to POIs concerning line checks was appropriate and stated that it planned no further action. Given this response, the NTSB classified Safety Recommendation A-11-30 “Closed—Unacceptable Action” on November 7, 2013.

NTSB Aircraft Accident Report 47 Lack of verification of procedural compliance remained a problem after the Owatonna accident. During the Akron accident investigation, the NTSB found multiple flight crew failures to comply with SOPs and noted that the FAA had never conducted an en route inspection of the operator. The accident report stated that, although the FAA’s new oversight system for Part 135 operators (SAS) had not been fully implemented at the time of the accident, SAS was “an opportunity to develop and use oversight procedures to identify and correct problems with failures of…Part 135 operators to use SOPs.”58 As a result, the NTSB recommended that the FAA “review the Safety Assurance System and develop and implement procedures needed to identify 14 Code of Federal Regulations Part 135 operators that do not comply with standard operating procedures” (Safety Recommendation A-16-41). In its January 9, 2017, response to the NTSB, the FAA indicated that it would conduct a review and make necessary corrective actions to the SAS to develop and implement a methodology to identify Part 135 certificate holders that either had or had not established procedures to ensure pilot compliance with SOPs. On April 6, 2017, pending the results of the FAA’s review and the development of effective procedures to ensure pilot compliance with Part 135 carriers’ SOPs, the NTSB classified Safety Recommendation A-16-41 “Open—Acceptable Response.” Although the NTSB notes that the FAA assesses pilot compliance with SOPs during line checks, the intent of Safety Recommendation A-16-41 was to ensure that the FAA used the SAS to develop a strategy to identify those Part 135 operators that do not have procedures promoting pilot adherence to SOPs. As of February 2019, the FAA had not provided the results of its SAS review to the NTSB and had not released any revisions to SAS to address pilot noncompliance with SOPs during Part 135 operations. The NTSB concludes that effective oversight procedures within the SAS would help the FAA identify operators that do not ensure flight crew compliance with SOPs. Therefore, the NTSB reiterates Safety Recommendation A-16-41. In addition, because of the FAA’s lack of action in this area since January 2017, the NTSB reclassifies Safety Recommendation A-16-41 “Open—Unacceptable Response.” 2.5.3 Monitoring Pilots with Performance Deficiencies Although Trans-Pacific did not have a method to determine whether the accident pilots routinely complied with company policy and procedures, the company did have information that could have prompted increased surveillance and evaluation of the pilots. Trans-Pacific’s director of operations was aware of the flight crew’s training difficulties; he was informed about them by CAE Simuflite (which provided training to the pilots after they were hired by Trans-Pacific). For example, the PIC did not properly execute the circling approach, and the SIC struggled with aircraft control. Subsequently, the Trans-Pacific director of operations approved additional training sessions for both pilots. Even with knowledge of the PIC’s and SIC’s training difficulties, Trans-Pacific assigned both pilots to revenue operations without any formal company evaluation or monitoring of their performance in an airplane.

58 According to the FAA, “the SAS policy and procedure provide aviation safety inspectors…with standardized protocols to evaluate certificate holder programs required by regulations to be approved or accepted. SAS implements FAA policy by providing safety controls (i.e., regulations and their application) of business organizations and individuals that fall under FAA regulations” (FAA 2017).

NTSB Aircraft Accident Report 48 The NTSB encountered a similar issue in a Part 121 operation during our investigation of the December 18, 2003, accident involving a Boeing MD-10-10F operated as Federal Express Corporation (FedEx) flight 647, which crashed while landing at Memphis International Airport Memphis, Tennessee (NTSB 2005). The first officer, who was the PF during the landing, had a history of repeated substandard performance on checkrides. Each substandard performance was addressed as a singular event that did not require further evaluation or monitoring after the checkrides were satisfactorily completed. As a result of our findings, the NTSB recommended that the FAA take the following action: Require all 14 Code of Federal Regulations Part 121 air carrier operators to establish programs for flight crewmembers who had demonstrated performance deficiencies or experienced failures in the training environment that would require a review of their whole performance history at the company and administer additional oversight and training to ensure that performance deficiencies are addressed and corrected. (Safety Recommendation A-05-14) On November 12, 2013, the FAA issued a final rule titled, “Qualification, Service, and Use of Crewmembers and Aircraft Dispatchers” (78 Federal Register 67800), which was applicable only to Part 121 operators (FAA 2013b). Among the revisions in this final rule were new crewmember requirements in 14 CFR 121.415(h) and (i) that fully satisfied the recommendation. On March 18, 2014, the NTSB classified Safety Recommendation A-05-14 “Closed—Acceptable Action.” Similar to the first officer in the FedEx accident, the accident flight crew’s training difficulties at CAE Simuflite appear to have been treated as singular events that were perceived as corrected by additional training. However, Trans-Pacific did not oversee the pilots’ performance after their additional initial training to determine whether the noted performance deficiencies were fully resolved or were continuing and necessitated further training. On the accident flight, both pilots exhibited performance problems that had previously occurred during their simulator training courses. Thus, the NTSB concludes that the pilots’ performance on the accident flight included deficiencies that were noted during their initial Trans-Pacific training, but the company did not monitor the pilots’ subsequent performance to identify and correct any continued deficiencies. Therefore, the NTSB recommends that the FAA require all 14 CFR Part 135 operators to establish programs for flight crewmembers who have demonstrated performance deficiencies or experienced failures during training and administer additional oversight and training to address and correct performance deficiencies. 2.6 Crew Resource Management and Leadership Training 2.6.1 Crew Resource Management The FAA’s Risk Management Handbook defines CRM as “[t]he application of team management concepts in the flight deck environment” (FAA 2016a). The handbook also states that CRM training emphasizes “situation awareness, communication skills, teamwork, task allocation, and decision making within a comprehensive framework of standard operating procedures (SOP).” During the accident flight, the crew deviated from prescribed roles and responsibilities,

NTSB Aircraft Accident Report 49 disregarded numerous SOPs, and exhibited poor planning, which led to high workload and degraded situational awareness. In addition, the crew did not communicate effectively. The SIC made several comments during the flight that appeared to indicate that he was not comfortable flying the approach procedure, but the PIC did not respond directly to any of these comments. During the circle-to-land maneuver, the SIC announced a control transfer, but the PIC did not respond to the call for a control transfer until the SIC made a second request. The crewmembers compounded their errors by not responding appropriately when the approach became unstable. Simply stated, the flight crew’s teamwork was less than optimal and did not represent effective CRM. CRM skills are developed and reinforced through mandatory initial and recurrent training. Since March 22, 2013, all Part 135 operators have been required to provide CRM training to flight crews; 14 CFR 135.330 requires operators to provide training that includes, at a minimum, eight specific CRM topics. Trans-Pacific’s CRM training, which was approved by the FAA and presented to company pilots, including the PIC and SIC involved in this accident, consisted of a computer-based, 27-slide presentation used for both initial and recurrent training. These materials referenced all required topics to some extent. However, the training materials did not explicitly state the importance of adhering to SOPs to facilitate effective teamwork, which was a major deficiency observed in this crew. Trans-Pacific training materials advised that “good followership skills allow for the follower to step up to leader when necessary”; however, the SIC did not apply this guidance and call for a go-around when the PIC elected to continue an unstable approach. The materials advised the use of crew briefings, but a standard approach briefing was omitted, and the PIC’s weather briefing was incomplete (because he relayed only the altimeter setting to the SIC and stated that he did not have time to listen to the full ATIS broadcast). Although the training materials highlighted the negative effects of excessive workload and stated that high workload could be “mitigated through use of effective crew coordination,” the materials did not describe the influence of planning, briefing, and decision-making on workload and time management. Many of the flight crew’s performance deficiencies occurred during conditions of high workload that stemmed from inadequate planning, briefing, and decision-making. In short, Trans-Pacific’s CRM training curriculum did not adequately address some aspects of CRM and was ineffective at producing the desired behaviors that the training addressed. The FAA provided guidelines for developing, implementing, reinforcing, and assessing CRM training in AC 120-51E, “Crew Resource Management Training.” The AC states that its guidance was developed for Part 121 operators required by regulation to provide CRM training and that Part 135 operators “electing to train in accordance with part 121 requirements” should also use the guidance. AC 120-51E also makes extensive reference to line-oriented flight training (LOFT), which is described as “an extremely effective means of practicing CRM skills and receiving reinforcement” (FAA 2004). Although LOFT is commonly used by Part 121 air carriers to evaluate CRM behaviors as part of an advanced qualification program, LOFT is not commonly used by Part 135 operators, particularly small operators. The FAA has not provided clear guidance on how Part 135 operators should implement required CRM training so that the training would be effective in producing desired flight crew behaviors. Thus, the NTSB concludes that, although Trans-Pacific’s CRM

NTSB Aircraft Accident Report 50 training program complied with the requirements of 14 CFR 135.330, the FAA had not provided adequate guidance for Part 135 operators to develop and implement effective CRM training programs; consequently, Trans-Pacific’s training did not result in the flight crew effectively using CRM to mitigate safety risks. FAA-funded scientific research has identified factors that influence the effectiveness of CRM training (Salas et al. 2006). These findings could be used to develop guidance for CRM training programs that is tailored to the specific characteristics of Part 135 operators. Therefore, the NTSB recommends that the FAA develop guidance for Part 135 operators to help them create and implement effective CRM training programs. 2.6.2 Leadership The PIC was responsible for setting the appropriate tone in the cockpit and managing communications and workload in a manner that promoted professionalism and adherence to SOPs. The absence of adequate preflight planning and the omission of required checklists, callouts, and briefings demonstrated the PIC’s inadequate leadership. Paragraph (a)(1) of 14 CFR 135.330 requires operators to provide training that addresses the PIC’s authority. However, this requirement is vague because the regulation does not specify the leadership skills that should be trained, which could include professional standards of conduct and strategies for (1) briefing and debriefing, (2) reinforcing and correcting skills, and (3) encouraging adherence to SOPs. Thus, the topic of PIC leadership responsibilities may not receive adequate attention in Part 135 operators’ CRM training programs. Trans-Pacific’s CRM training, for example, contained very little information explicitly addressing the responsibilities of the PIC as the team leader. Leadership was only covered in three bullet points on one slide that stated that “a leader’s actions and ideas influence the thoughts and behavior of others,” “leadership is acquired,” and “a leader can be either crew member and must know how to effectively communicate ideas and observations.” This material did not adequately describe core leadership functions necessary for ensuring effective crew performance. The NTSB has noted deficiencies in PIC leadership in previous accidents, most notably in our investigation of the February 12, 2009, accident in Clarence Center, New York, involving Colgan Air flight 3407, a Bombardier DHC-8-400, while on an instrument approach to Buffalo-Niagara International Airport, Buffalo, New York (NTSB 2010). In that accident report, the NTSB emphasized the importance of effective leadership for ensuring successful crew performance and recommended that the FAA take the following actions: Issue an advisory circular with guidance on leadership training for upgrading captains at 14 Code of Federal Regulations Part 121, 135, and 91K operators, including methods and techniques for effective leadership; professional standards of conduct; strategies for briefing and debriefing; reinforcement and correction skills; and other knowledge, skills, and abilities that are critical for air carrier operations. (Safety Recommendation A-10-13) Require all 14 Code of Federal Regulations Part 121, 135, and 91K operators to provide a specific course on leadership training to their upgrading captains that is consistent with the advisory circular requested in Safety Recommendation A-10-13. (Safety Recommendation A-10-14)

NTSB Aircraft Accident Report 51 In a September 24, 2012, response, the FAA reported its intent to issue a notice of proposed rulemaking (NPRM) addressing leadership training for Part 121 operations. On January 11, 2013, the NTSB noted that the FAA did not plan to include Part 135 or Part 91K operations in the proposed rule and indicated that “leadership skills are essential for all upgrading captains, regardless of the operation.” Thus, the NTSB classified these recommendations “Open— Unacceptable Response.” On October 7, 2016, the FAA issued an NPRM titled, “Pilot Professional Development” (81 Federal Register 69908), which proposed modifying requirements for leadership training that were primarily applicable to Part 121 air carriers conducting domestic, flag, and supplemental operations to enhance the professional development of pilots in those operations (FAA 2016c). On January 4, 2017, the NTSB commented on the rulemaking, stating that “catastrophic outcomes associated with unprofessional behavior are not limited to Part 121 operations.” This accident provides another example of inadequate leadership on the part of a PIC, contributing to poor CRM and ineffective flight crew performance. The PIC was responsible for setting the appropriate tone in the cockpit, but the PIC’s numerous expletives throughout the flight and negative comments about a controller handling the flight (“she’s a # idiot”) were unprofessional. The PIC was also responsible for following company SOPs (including those for preflight planning and briefings) as a means of managing crew workload and avoiding errors, but his actions during the flight demonstrated disregard for the SOPs. As with the captain of Colgan Air flight 3407, the PIC’s failure to establish a professional cockpit tone and show appropriate command authority is disconcerting. The NTSB notes that the PIC in this accident had never been employed as a Part 135 PIC before being hired by Trans-Pacific and had never received formal specific leadership training to prepare him for the leadership duties associated with the upgrade to PIC. The NTSB is concerned that, even if the FAA provides the CRM training guidance recommended in Safety Recommendation A-19-8 for Part 135 operators, leadership training for future captains might not be provided at the time of upgrade, when the training would have the greatest impact. The NTSB continues to believe that specific leadership training for PICs provided during the upgrade process would help standardize and reinforce the critical command authority skills that PICs need. Lack of leadership in the cockpit can occur in any dual-pilot operation; without appropriate training, some Part 135 and Part 91K PICs may lack the necessary leadership skills to operate as PIC, which poses a safety risk to the traveling public. Thus, the NTSB concludes that specific leadership training provided to Part 135 and 91K pilots at the time of upgrade to PIC would help standardize and reinforce critical command authority skills and improve flight safety. Therefore, the NTSB reiterates Safety Recommendations A-10-13 and -14. 2.7 Trans-Pacific Jets Policy 2.7.1 Second-in-Command Policy A review of Trans-Pacific’s policy pertaining to SIC classification revealed that staffing in the months before the accident did not allow Trans-Pacific Learjet SICs to advance to higher qualification levels. Thus, there was no mechanism in place for a Learjet SIC to develop PF skills.

NTSB Aircraft Accident Report 52 In fact, being an SIC who was only approved to perform PM duties, as was the case for the accident SIC for 8 months, posed a risk of flying skill decay if company pilots rigorously adhered to the policy. Opportunities for SICs to serve as PF would benefit both SICs and PICs. SICs would gain experience for upgrade by acting as PF. Also, it would be in the PIC’s interest to allow SICs to act as PF to ensure they would be able to fly the airplane in the event of an emergency, such as PIC incapacitation. Because developing skills as PF was beneficial to Trans-Pacific SICs and the PICs who flew with them, pilots in both crew positions had incentive to not comply with the policy. The accident flight crew did not comply with this policy during the accident flight leg (and possibly other flight legs), and Trans-Pacific’s other Learjet flight crew was also not complying with the policy.59 The company’s lack of a method to discover noncompliance with the SIC policy may also have increased the opportunity for the flight crews’ noncompliance. Given that both Learjet flight crews at Trans-Pacific were not complying with the company’s SIC policy, decisions about when a SIC could fly were regularly being made at the PIC level, which removed supervisory oversight at the company level. The company’s director of operations indicated that Trans-Pacific’s SIC qualification policy was intended to mitigate the hazard of an inexperienced SIC acting as PF. However, company staffing at the time of the accident did not allow Learjet SICs, including the accident SIC, to develop experience and skills according to the company’s policy. Thus, the NTSB concludes that, because the company did not have a Learjet-qualified management pilot or check airman on staff during the accident SIC’s period of employment, Trans-Pacific’s graduated SIC qualification policy could not provide him and the other company Learjet SIC a viable, well- structured path to gain experience as a PF. The NTSB notes that the company staffing concern identified in this accident investigation was resolved after the accident because Trans-Pacific no longer operates Learjet airplanes (and thus has no need for a Learjet-qualified management pilot or check airman) and had management pilots on staff who were qualified to fly the aircraft models that the company operated. 2.7.2 Approach Speed Wind Additives Trans-Pacific SOPs indicated that, for a visual approach, pilots were expected to maintain VREF + 20 kts until aligned with the landing runway. While en route to TEB, the PIC stated, “V-ref is one-nineteen.” NTSB investigators verified that the PIC had correctly determined VREF for the airplane’s configuration. Therefore, according to Trans-Pacific SOPs, the pilots should have been flying at 139 kts during the approach until the circling turn to runway 1 was completed and the airplane was aligned with the runway. However, radar and EGPWS data indicated that the airplane flew significantly slower than 139 kts during the approach phase of the flight. The pilots’ intended airspeed for the approach could not be determined because they did not discuss it.

59 The SIC from that crew, who had been with the company for 6 months, reported that the PIC with whom he was normally paired had allowed him to act as PF on five or six positioning flight legs.

NTSB Aircraft Accident Report 53 The approach speeds listed in Trans-Pacific’s SOPs were consistent with manufacturer guidelines, but the SOPs did not include the manufacturer’s wind additives. The Learjet 35A AFM stated the following: It is recommended that if turbulence is anticipated due to gusty winds, wake turbulence, or wind shear, the approach speed be increased. For gusty wind conditions, an increase in approach speed of one half the gust factor is recommended. Although the airplane was flown significantly slower than directed by SOPs, it remained above the manufacturer-published stall speed of 102 kts for a 35° level turn. However, the strong, gusting wind might have momentarily reduced the airplane’s airspeed below the stall speed. Thus, including a wind additive (if appropriate) when calculating approach speeds would provide additional stall margin. The NTSB notes that FAA-approved GOMs and SOPs provide the policies and procedures that crews must use to operate company aircraft. However, the NTSB is concerned that Trans-Pacific’s manual did not incorporate the manufacturer-recommended procedures for approach speed wind additives, which could affect flight safety. The NTSB is also concerned that other operator-published manuals might not include that information. Thus, the NTSB concludes that including the manufacturer-recommended approach speed wind additives in operations manuals for Learjet 35A airplanes could reduce the risk of a stall by requiring pilots to increase the approach speed in weather conditions conducive to rapid and possibly unexpected wind changes. Therefore, the NTSB recommends that the FAA review operators’ Learjet 35A operations manuals to determine whether they contain manufacturer-recommended approach speed wind additives and encourage those operators without that information to add it to their operations documents.

NTSB Aircraft Accident Report 54

1. Conclusions
2. 1 Findings
3. The flight crew was properly certificated; there was no indication that the flight crew was

impaired by medical conditions, alcohol, or other drugs; and there were no preimpact airplane anomalies that would have precluded normal operation.

1. The pilot-in-command’s preflight planning was inadequate and incomplete.
2. The flight crewmembers’ failure to verify the approach and conduct an approach briefing

resulted in confusion and errors that led them to mismanage the vertical profile for the approach and not initiate the circle-to-land maneuver according to air traffic control instructions.

1. The pilot-in-command’s inadequate and incomplete preflight planning and the flight crew’s

lack of an approach briefing contributed to the crew’s confusion and lack of situational awareness during the accident flight.

1. The pilot-in-command’s decision to allow the second-in-command to act as pilot flying was

improper and contrary to company standard operating procedures.

1. The pilot-in-command’s (PIC) extensive coaching of the second-in-command in his pilot

flying (PF) duties distracted the PIC, interfered with the normal division of PF and pilot monitoring duties, and degraded the flight crew’s overall performance.

1. The pilot-in-command’s decision to continue the approach was inappropriate because the

approach did not meet the company’s stabilized approach criteria and the airplane was not in a position to make a safe landing.

1. The pilot-in-command’s focus on the visual maneuver of aligning the airplane with the landing

runway distracted him from multiple indications of decreasing stall margin, resulting in an aerodynamic stall at low altitude.

1. A flight data monitoring program could help Title 14 Code of Federal Regulations Part 135

operators identify and mitigate procedural noncompliance, including the operational deficiencies identified in this accident investigation.

1. Because the Federal Aviation Administration (FAA) was not conducting checks in a manner

that allowed observation of routine flight operations, the FAA could not evaluate Trans-Pacific Jets pilots’ compliance with standard operating procedures during these operations.

1. A safety management system (SMS) would have improved Trans-Pacific Jets’ ability to

identify and mitigate risks because an SMS requires operators to incorporate formal system safety methods into their internal oversight programs.

NTSB Aircraft Accident Report 55

1. Effective oversight procedures within the Safety Assurance System would help the Federal

Aviation Administration identify operators that do not ensure flight crew compliance with standard operating procedures.

1. The pilots’ performance on the accident flight included deficiencies that were noted during

their initial Trans-Pacific Jets training, but the company did not monitor the pilots’ subsequent performance to identify and correct any continued deficiencies.

1. Although Trans-Pacific Jets’ crew resource management (CRM) training program complied

with the requirements of Title 14 Code of Federal Regulations (CFR) 135.330, the Federal Aviation Administration had not provided adequate guidance for 14 CFR Part 135 operators to develop and implement effective CRM training programs; consequently, Trans-Pacific’s training did not result in the flight crew effectively using CRM to mitigate safety risks.

1. Specific leadership training provided to Title 14 Code of Federal Regulations Part 135

and 91K pilots at the time of upgrade to pilot-in-command would help standardize and reinforce critical command authority skills and improve flight safety.

1. Because the company did not have a Learjet-qualified management pilot or check airman on

staff during the accident second-in-command’s (SIC) period of employment, Trans-Pacific Jets’ graduated SIC qualification policy could not provide him and the other company Learjet SIC a viable, well-structured path to gain experience as pilot flying.

1. Including the manufacturer-recommended approach speed wind additives in operations

manuals for Learjet 35A airplanes could reduce the risk of a stall by requiring pilots to increase the approach speed in weather conditions conducive to rapid and possibly unexpected wind changes. 3.2 Probable Cause The National Transportation Safety Board determines that the probable cause of this accident was the pilot-in-command’s (PIC) attempt to salvage an unstabilized visual approach, which resulted in an aerodynamic stall at low altitude. Contributing to the accident was the PIC’s decision to allow an unapproved second-in-command to act as pilot flying, the PIC’s inadequate and incomplete preflight planning, and the flight crew’s lack of an approach briefing. Also contributing to the accident were Trans-Pacific Jets’ lack of safety programs that would have enabled the company to identify and correct patterns of poor performance and procedural noncompliance and the Federal Aviation Administration’s ineffective Safety Assurance System procedures, which failed to identify these company oversight deficiencies.

NTSB Aircraft Accident Report 56

1. Recommendations
2. 1 New Recommendations

As a result of this investigation, the National Transportation Safety Board makes the following new safety recommendations to the Federal Aviation Administration: Require all Title 14 Code of Federal Regulations Part 135 operators to establish programs for flight crewmembers who have demonstrated performance deficiencies or experienced failures during training and administer additional oversight and training to address and correct performance deficiencies. (A-19-7) Develop guidance for Title 14 Code of Federal Regulations Part 135 operators to help them create and implement effective crew resource management training programs. (A-19-8) Review operators’ Learjet 35A operations manuals to determine whether they contain manufacturer-recommended approach speed wind additives and encourage those operators without that information to add it to their operations documents. (A-19-9) 4.2 Previously Issued Recommendations Reiterated in This Report The National Transportation Safety Board reiterates the following recommendations to the Federal Aviation Administration: Issue an advisory circular with guidance on leadership training for upgrading captains at 14 Code of Federal Regulations Part 121, 135, and 91K operators, including methods and techniques for effective leadership; professional standards of conduct; strategies for briefing and debriefing; reinforcement and correction skills; and other knowledge, skills, and abilities that are critical for air carrier operations. (A-10-13) Require all 14 Code of Federal Regulations Part 121, 135, and 91K operators to provide a specific course on leadership training to their upgrading captains that is consistent with the advisory circular requested in Safety Recommendation A-10-13. (A-10-14) Require all 14 Code of Federal Regulations Part 135 operators to install flight data recording devices capable of supporting a flight data monitoring program. (A-16-34) After the action in Safety Recommendation A-16-34 is completed, require all 14 Code of Federal Regulations Part 135 operators to establish a structured flight

NTSB Aircraft Accident Report 57 data monitoring program that reviews all available data sources to identify deviations from established norms and procedures and other potential safety issues. (A-16-35) Require all 14 Code of Federal Regulations Part 135 operators to establish safety management system programs. (A-16-36) Review the Safety Assurance System and develop and implement procedures needed to identify 14 Code of Federal Regulations Part 135 operators that do not comply with standard operating procedures. (A-16-41) 4.3 Previously Issued Recommendation Reclassified in This Report Safety Recommendation A-16-41 is reclassified “Open—Unacceptable Response” in section 2.5.2 of this report.

BY THE NATIONAL TRANSPORTATION SAFETY BOARD ROBERT L. SUMWALT, III EARL F. WEENER Chairman Member

BRUCE LANDSBERG JENNIFER HOMENDY Vice Chairman Member

Adopted: March 12, 2019

NTSB Aircraft Accident Report 58

1. Appendixes

Appendix A: Investigation The National Transportation Safety Board (NTSB) was notified of this accident on May 15, 2017. The NTSB investigator-in-charge and the airworthiness group chairman arrived on scene about 0800 on May 16, 2017. Investigative groups were formed for operations and human performance, air traffic control, airworthiness, cockpit voice recorder (CVR), and meteorology. Also, specialists were assigned to evaluate pilot medical issues, maintenance records, the enhanced ground proximity warning system, and the digital electronic engine controls. Radar, CVR sound spectrum analysis, and surveillance video studies were also completed. The Federal Aviation Administration (FAA); Trans-Pacific Air Charter, LLC; Bombardier; Honeywell Aerospace; and the National Air Traffic Controllers Association were parties to the investigation.

NTSB Aircraft Accident Report 59 Appendix B: Trans-Pacific Jets Postaccident Actions Trans-Pacific Jets, in a submission to the NTSB dated March 1, 2018, reported taking the following actions in response to the accident: • required pilots to sign for receipt of the company manuals and acknowledge an intention to comply with the directives in the manuals; • revised the training program to include a presentation on “Procedural Intentional Non-Compliance”; • updated annual training to review and analyze the accident and discuss how standard operating procedures can reduce the risk of every aircraft operation; • required pilot route checks at 6-month intervals rather than the FAA-mandated 12 months; • planned to expedite full implementation of a safety management system; • retained a third-party safety auditor to conduct periodic safety inspections, record audits, and make recommendations toward systemic improvement; and • required that all passenger and positioning flights be conducted under the same guidelines.

NTSB Aircraft Accident Report 60 Appendix C: Cockpit Voice Recorder Transcript The following is a transcript of a Universal CVR-30 solid-state cockpit voice recorder, unknown serial number, installed on a Trans-Pacific Jets Learjet 35A (N452DA), which crashed during approach to land at Teterboro Airport in Teterboro, New Jersey: LEGEND CAM Cockpit area microphone voice or sound source HOT Flight crew audio panel voice or sound source RDO Radio transmissions from N452DA TWR-PHL Radio transmission from Philadelphia airport tower controller DEP-PHL Radio transmission from Philadelphia Departure controller APP-PHL Radio transmission from Philadelphia Approach controller APR-NYC Radio transmission from the New York Approach controller TWR-TEB Radio transmission from the Teterboro airport tower controller ATIS-TEB Teterboro airport Automatic Terminal Information Service AC-$$$ Radio transmission from a relevant aircraft (see note 5) EGPWS Enhanced Ground Proximity Warning System -1 Voice identified as the pilot-in-command -2 Voice identified as the second-in-command -? Voice unidentified * Unintelligible word

Expletive @ Non-pertinent word ( ) Questionable insertion [ ] Editorial insertion — Cut-off in utterance

Note 1: Times are expressed in eastern daylight time (EDT). Note 2: Generally, only radio transmissions to and from the accident aircraft were transcribed. Note 3: Words shown with excess vowels, letters, or drawn out syllables are a phonetic representation of the words as spoken. Note 4: A non-pertinent word, where noted, refers to a word not directly related to the operation, control or condition of the aircraft. Note 5: $$$ is replaced in the transcript with a partial call-sign of the related aircraft; AC-UNK is used when the aircraft call sign could not be determined.

NTSB Aircraft Accident Report 61 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 14:59:44.4 EST START OF RECORDING START OF TRANSCRIPT

14:59:44.4 HOT-1

[recording begins] —we uh go to five.

14:59:46.4 HOT-1

or go to three.

14:59:46.6 HOT-2

gotch’ya

14:59:47.7 HOT-1

but we're only ten. ten.

14:59:50.8 HOT-1

'kay he's waiting for everybody to clear the airspace. this guy's landing. that's why he's holding us.

15:00:00.6 HOT-1

go. one oh eight ninety five. that's the localizer. we don't want that.

15:00:04.1 HOT-1

twelve zip is North Philadelphia.

15:00:06.9 HOT

[sound of multiple clicks]

15:00:22.3 HOT-1

test. test. test. test. test. there's my volume.

15:00:23.7 HOT-2

loud and clear.

NTSB Aircraft Accident Report 62 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:00:25.3 HOT-1

I've been have’n my volume all the way down for some stupid reason.

15:00:29.0 HOT-1

test. test. test. talk to me.

15:00:30.5 HOT-2

one two. one two. one two. one two.

15:00:32.9 HOT-1

there we go.

15:00:34.0 HOT-(2)

on the microphone.

15:00:36.1 HOT

[sound of two static bursts, similar to VHF radio static noise]

15:00:36.9 HOT-2

wow. look how slow he looks like he's goin’.

15:00:39.0 HOT-1

I know. it's that # wind man. it's gusting to what the # was it gusting to? thirty-five?

15:00:44.3 HOT-2

yeah.

15:00:44.6 HOT-1

no. twenty five.

15:00:46.6 HOT-2

Air Wisconsin.

NTSB Aircraft Accident Report 63 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:00:47.2 HOT-1

Air Wisconsin.

15:00:48.6 HOT-1

weren't you uh doin' a # ground thing for em?

15:00:50.8 HOT-2

yeah.

15:00:51.6 HOT-1

okay I think we’re next man. hand on your yoke.

15:00:55.7 HOT-1

standing on the brakes. you got your handbrake. to— your parking brake is set.

15:00:59.3 HOT-2

yes sir.

15:01:05.8 HOT-2

go around.

15:01:07.6 HOT-2

is it working?

15:01:07.6 HOT-1

yeah. it's supposed to disengage yeah but it's not. there we go. now it's disengage.

15:01:12.9 HOT-1

ehhh. # it's not working.

15:01:16.4 HOT-1

there we go. disengage.

NTSB Aircraft Accident Report 64 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:01:17.7 CAM

[sound of 1.2-second tone (480Hz increase to 560Hz), similar to yaw damper alert tone]

15:01:22.6 HOT-2

look at that big boy.

15:01:26.3 HOT-1

was that a crosswind landing?

15:01:27.7 HOT-2

yeah it was.

15:01:28.6 HOT-1

#.

15:01:28.6 HOT-2

it had to be- look at that #.

15:01:30.6 HOT-1

yeah.

15:01:33.4 RDO-1

and tower four five two delta alpha we're ready to go at three five.

15:01:37.1 TWR-PHL

yeah just uh one more to land for (november) two delta alpha then we'll get you goin’. there just wasn't enough room with the two (separate) arrivals to squeeze ya out.

15:01:43.8 RDO-1

not a problem.

NTSB Aircraft Accident Report 65 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:01:44.8 CAM

[sound of click]

15:01:47.2 HOT-2

Frontier.

15:01:52.4 CAM

[sound similar to cabin air flowing from cabin vents]

15:01:53.6 HOT-2

wooo.

15:01:54.3 HOT-2

that's that heat.

15:02:01.0 HOT-1

okay. power setting was ninety-five?

15:02:03.2 HOT-2

yeah.

15:02:03.9 HOT-1

ninety-four nine?

15:02:04.5 HOT-2

ninety-four five.

15:02:10.9 HOT-2

I thought Frontier was come’n this way.

15:02:14.6 HOT-1

three forty-nine. [exhale]

NTSB Aircraft Accident Report 66 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:02:22.7 HOT-1

there we go a little Pilatus. I guess we're gonna go after him.

15:02:25.9 HOT-1

unless there's someone come'n in on two seven right.

15:02:28.2 HOT-2

Pilatuses

15:02:30.2 HOT-1

aren't you glad you're not # with Pilatuses?

15:02:32.2 HOT-2

I would have been captain though.

15:02:37.3 HOT-2

he's gonna say line up and wait.

15:02:39.7 HOT-1

stand by.

15:02:41.1 TWR-PHL

[Tower talks to a helicopter lacking a transponder code]

15:02:46.5 HOT-1

(ehhh) dude you're in a # controlled airspace.

15:02:54.3 HOT-1

yeah bother the poor controller because you didn't get a clearance for V-F-R

15:03:04.4 HOT-1

• four thirty-five.

NTSB Aircraft Accident Report 67 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:03:06.6 TWR-PHL

november uh four five two delta alpha runway three five full length line up and wait traffic four out for runway ah two seven (right) I'll get ya goin’ as soon as the runway's clear.

15:03:07.6 HOT-1

there we go.

15:03:08.9 CAM

[sound of clicks]

15:03:11.5 HOT-1

I'll get it.

15:03:14.2 RDO-1

alright. line up and wait three five. two delta alpha.

15:03:15.9 CAM

[sound of increase in engine thrust]

15:03:17.2 HOT-1

get runway line ups. pitot heat. stall warning.

15:03:21.3 HOT-1

** (heading).

15:03:24.8 HOT-1

gear lights are all done.

15:03:26.0 CAM

[sound similar to engine igniters begins and continues through takeoff]

NTSB Aircraft Accident Report 68 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:03:26.3 HOT-2

yes sir.

15:03:27.5 HOT-1

under the thumb sir.

15:03:28.6 HOT-2

yeah I am. look.

15:03:29.8 HOT-1

alright.

15:03:31.5 HOT-2

I've been learning.

15:03:33.3 HOT-1

power— power to idle.

15:03:34.3 CAM

[sound similar to decrease in engine thrust]

15:03:37.3 CAM

[sound of multiple thunks, similar to aircraft's landing gear taxiing over grooved surface, and continues during takeoff roll]

15:03:47.1 TWR-PHL

Lear four five two delta alpha just fly runway heading runway three five. clear for takeoff. traffic's three out for two seven right.

15:03:52.3 RDO-1

alright. clear for takeoff three five. runway heading. two delta alpha so long.

NTSB Aircraft Accident Report 69 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:03:57.1 HOT-1

alright ninety-five somethin'.

15:03:59.6 HOT-2

ninety-five five.

15:03:59.6 CAM

[sound similar to increase in engine thrust]

15:04:01.0 HOT-2

ninety-four five.

15:04:01.5 HOT-1

alright a little more. keep advancing it slowwwwly [emphasized] don't go crazy on it. little more. more. more. more.

15:04:07.3 HOT-1

there ya go airspeeds set. airspeed's alive.

15:04:10.1 HOT-1

airspeed alive. eighty knots crosscheck. I didn't say # V-one.

15:04:13.6 HOT-2

yup.

15:04:14.0 HOT-1

V-one [emphasized].

15:04:16.2 HOT-1

rotate.

NTSB Aircraft Accident Report 70 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:04:18.2 HOT-1

slowwwwly. positive rate. gear up. yaw dampener engaged. ya gotta tell me to do that.

15:04:22.0 CAM

[sound of clunk, similar to gear movement]

15:04:22.7 HOT-2

yup.

15:04:25.9 CAM

[sound of clunk, similar to gear door closing]

15:04:26.5 HOT-1

there ya go.

15:04:34.0 HOT-1

'kay four hundred feet.

15:04:35.4 HOT-2

flaps up.

15:04:36.5 HOT-1

after takeoff checks.

15:04:37.7 HOT-2

yes sir.

15:04:40.8 HOT-1

and if you'd like autopilot engaged you can go ahead and do so at this time.

15:04:45.3 HOT-2

roger.

NTSB Aircraft Accident Report 71 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:04:45.7 HOT-1

it'll be off my heading.

15:04:46.4 TWR-PHL

(four) two delta alpha runway heading contact departure. have a good one.

15:04:49.5 RDO-1

four. two delta alpha. so long.

15:04:53.9 HOT-1

'kay two thousand. one thousand to go.

15:04:57.7 RDO-1

and departure Lear jet four five two delta alpha out of one thousand for two thousand runway heading.

15:04:59.4 CAM

[sound of high pitch tone, similar to altitude alerter]

15:05:01.7 DEP-PHL

november four five two delta alpha. Philly departure radar contact.

15:05:02.1 CAM

[sound of click]

15:05:05.8 HOT-1

ahhh. [spoken in almost a whisper]

15:05:08.7 HOT-2

it's on right?

NTSB Aircraft Accident Report 72 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:05:09.8 HOT-1

uhhh it is now. yeah.

15:05:11.9 HOT-2

okay.

15:05:16.6 HOT-1

five hundred feet to go.

15:05:17.9 HOT-2

roger.

15:05:18.3 HOT-1

start trimmin' that thing nose down it'll punch right through two thousand.

15:05:26.1 HOT-1

go ahead and turn off your uhhh...

15:05:29.5 HOT-1

...(I have) nothing really. leave everything goin’.

15:05:34.4 HOT-1

there ya go.

15:05:34.5 DEP-PHL

november two delta alpha climb to maintain four thousand and contact approach on one twenty three point eight.

15:05:40.1 RDO-1

'kay. four thousand. twenty three point eight. four five two delta alpha so long.

NTSB Aircraft Accident Report 73 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:05:46.1 HOT-1

up to four.

15:05:46.9 HOT-2

up to four.

15:05:59.5 RDO-1

four five two delta alpha's out of two point five for four thousand runway heading.

15:06:03.9 APP-PHL

november four five two delta alpha Philly approach altimeter is two niner eight one.

15:06:07.7 RDO-1

two niner eight one.

15:06:12.4 CAM

[sound of high pitch tone, similar to altitude alerter]

15:06:13.5 HOT-2

one to go.

15:06:13.6 HOT-1

one to go.

15:06:14.8 HOT-1

trim that nose over.

15:06:20.0 HOT-1

there ya go.

15:06:22.1 HOT-2

smaaall.

NTSB Aircraft Accident Report 74 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:06:24.5 HOT-2

corrections.

15:06:33.3 HOT-1

okay when you hit that you want that thing to be less than a thousand.

15:06:36.7 HOT-2

roger.

15:06:37.4 HOT-1

you want your V-S-I to be less than a thousand.

15:06:37.9 APP-PHL

november four five two delta alpha proceed direct MAZIE.

15:06:41.5 RDO-1

direct MAZIE four five two delta alpha.

15:06:43.2 HOT-1

don't. don't lose altitude.

15:06:51.3 HOT-1

zero three six on the heading.

15:06:53.0 HOT-2

zero three six.

15:06:55.1 HOT-1

watch the altitude.

15:06:56.4 HOT-2

turn it. thank you.

NTSB Aircraft Accident Report 75 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:06:57.3 HOT-1

there ya go. I'll give you nav select nav mode when (we're) ready.

15:07:01.3 HOT-2

yup.

15:07:03.9 HOT-1

and four thousand altitude is selected. good. watch the airspeed. don't get above two fifty.

15:07:11.5 HOT-1

you can hit A-C if you want. get some A-C goin’ on in here.

15:07:13.6 HOT-2

it's already in there.

15:07:14.7 HOT-1

yeah did we takeoff with A-C?

15:07:16.7 HOT-2

no.

15:07:17.1 HOT-1

ah 'kay.

15:07:19.9 HOT-1

air conditioning I know it's hot so.

15:07:27.5 HOT-1

speed.

15:07:28.6 CAM

[sound similar to decrease in engine thrust]

NTSB Aircraft Accident Report 76 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:07:28.8 HOT-2

pullin' back.

15:07:32.8 HOT-1

much # better.

15:07:36.8 HOT-2

I thought you were gonna say why are you # up?

15:07:38.8 HOT-1

no. no. much # better.

15:07:41.5 HOT-1

you've been paying attention to what I've been doin'. you're

understanding the #.

15:07:45.6 HOT-1

you know what to # look for now.

15:07:46.7 CAM

[sound similar to decrease in engine thrust]

15:07:49.4 HOT-1

see how # ya # (it) and # incredible man. you're # doin' good right now.

15:07:55.3 CAM

[sound similar to decrease in engine thrust]

15:07:56.7 HOT-1

(at) least I've got the # radio so...

15:07:58.9 HOT-2

yup.

NTSB Aircraft Accident Report 77 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:07:58.9 HOT-1

...that. that—

15:08:00.3 HOT-1

mean you can see how I'm # handle the radios.

15:08:03.2 HOT-1

while you're # flying.

15:08:04.7 HOT-2

yes sir.

15:08:05.5 APP-PHL

november four five two delta alpha you have traffic at your one o'clock and about four miles is a Grumman V-F-R three thousand five hundred west bound.

15:08:12.4 RDO-1

yeah lookin' for that traffic two delta alpha.

15:08:14.3 APP-PHL

november one one niner six golf, you have traffic at your ten o'clock four miles eastbound it's a Learjet four thousand

15:08:17.1 HOT-1

Grumman.

15:08:20.6 HOT-1

and if they give us # higher.

15:08:20.6 AC-N1196G

okay. ***.

NTSB Aircraft Accident Report 78 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:08:22.7 HOT-2

we wouldn't have to worry about it.

15:08:24.1 HOT-1

yeaaah.

15:08:26.1 HOT-1

he's thirty-five. I don't even # see him on the-the traffic here.

15:08:30.8 HOT-1

traffic is failed.

15:08:33.1 HOT-1

don't ask me why # traffic is failed.

15:08:33.2 CAM

[sound similar to increase in engine thrust]

15:08:37.7 CAM

[sound similar to increase in engine thrust]

15:08:39.8 HOT-1

two fifty on the speed. four thousand and we're direct MAZIE.

15:08:42.1 CAM

[sound similar to increase in engine thrust]

15:08:42.4 HOT-2

yup.

15:08:43.7 HOT-1

nav mode select. so-so far # good. no issues what so # ever.

NTSB Aircraft Accident Report 79 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:08:49.1 HOT-2

seventy-five should do it. right now that's good right there. seventy-three. seventy-four.

15:08:52.7 HOT-1

yeah that'll do it.

15:08:54.7 HOT-2

keep us below two fifty.

15:08:56.5 HOT-1

yup. uhhh.

15:08:58.9 HOT-2

a Grumman at what? one o'clock? two o'clock?

15:09:00.8 HOT-1

well he's # below us and ah not a factor I'm guess’n. I don't

see 'em.

15:09:04.9 APP-PHL

november four five two delta alpha turn left heading three six zero (it's) a vector for sequence I'll have you back direct MAZIE in a few more moments.

15:09:10.4 HOT-2

three six zero.

15:09:11.3 RDO-1

okay three six zero on the heading for two five brav— errr two delta alpha I'm (sorry).

15:09:17.0 HOT-1

heading select.

NTSB Aircraft Accident Report 80 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:09:18.9 HOT-1

there we go.

15:09:22.6 HOT-1

someone's come’n behind us that the what they # wanna do. there's no one in front of us they want someone to climb over the top of us so they give us # uh forty-five degree bank to # MAZIE.

15:09:30.7 HOT-2

those guys.

15:09:31.9 HOT-1

yeaaah. what the # man. we're a # Learjet. get us # higher.

15:09:34.5 HOT-2

we could go faster.

15:09:35.7 APP-PHL

november four five two delta alpha. what's your airspeed?

15:09:37.5 CAM

[sound similar to decrease in engine thrust]

15:09:38.3 RDO-1

(now) we're showin' right now at twwwo siiiixty. four five two delta alpha.

15:09:44.5 HOT-2

(slowin') down.

15:09:45.5 HOT-1

yes sir. # just admitted I violated # airspace but we're far enough away.

NTSB Aircraft Accident Report 81 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:09:49.3 HOT-2

that's why I was like ahhhhhhh.

15:09:53.8 HOT-2

come on baby slow down for me.

15:10:00.4 HOT-2

there we go.

15:10:03.7 HOT-1

(eh) its within ten.

15:10:05.8 HOT-1

I don't think (shh) we'll be violated for that.

15:10:18.5 HOT-1

that's good. just right there. it'll bleed off a little.

15:10:24.6 HOT-1

okay. where the # man? who why the # are they jackin' us on this? let us get the # up and get home.

15:10:31.0 HOT-2

that's why. they don't want us to go home.

15:10:33.4 HOT-1

#. give it a little power [sound similar to sigh].

15:10:36.9 HOT-1

keep it within ten.

15:10:39.4 CAM

[sound similar to increase in engine thrust]

NTSB Aircraft Accident Report 82 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:10:48.2 CAM

[sound similar to increase in engine thrust]

15:10:53.0 AC-789HA

seven eight nine hotel alpha check’n on four thousand tango.

15:10:56.8 HOT-1

that's who (ya is).

15:11:19.8 HOT-1

come on man. what the #. over.

15:11:23.0 APP-PHL

november four five two delta alpha turn right direct uh MAZIE.

15:11:27.0 RDO-1

'kay right turn direct MAZIE. four five two delta alpha.

15:11:30.0 HOT-2

number six.

15:11:32.0 HOT-2

enter.

15:11:33.3 HOT-2

aaand one zero nine please.

15:11:33.7 HOT-1

one zero nine.

15:11:39.6 HOT-1

and nav mode select when able.

NTSB Aircraft Accident Report 83 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:11:40.9 HOT-2

yup.

15:11:42.6 HOT-1

there ya go.

15:11:45.7 HOT-1

airspeed's good. # everything's # good.

15:11:45.8 HOT-2

one zero nine.

15:11:49.3 HOT-1

MAZIE. it's gonna be-# behind us by the time we # get

lined up for it.

15:11:53.9 HOT-2

yup.

15:12:03.3 HOT-2

balls.

15:12:04.7 RDO-1

yeah four five two delta alpha any chance we can get higher?

15:12:07.6 APP-PHL

four five two delta alpha. unable higher. I would have to ah spin you back around and sequence you with the rest of the traffic goin’ into Teterboro.

15:12:14.5 RDO-1

four five two delta alpha.

NTSB Aircraft Accident Report 84 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:12:17.0 HOT-2

ha [exclaimed].

15:12:19.9 HOT-2

it's like she doesn't like us.

15:12:21.7 HOT-1

whatever. it's four # miles. it's right here somewhere.

15:12:25.7 HOT-1

we're never gonna # get there. we're gonna fly right # over it before we # get there.

15:12:32.0 HOT-2

it's holdin' the speed.

15:12:32.8 HOT-1

now it's a # tail wind so yeah you have to pull back the power juuust a little.

15:12:35.5 HOT-2

yup.

15:12:36.1 CAM

[sound similar to decrease in engine noise]

15:12:37.0 HOT-2

I've been listenin' to what you say.

15:12:39.0 HOT-1

yeaaap.

15:12:41.6 HOT-2

I've been keepin' it. and watching.

NTSB Aircraft Accident Report 85 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:12:47.3 HOT-1

two miles. right over # MAZIE.

15:12:50.1 HOT-1

gonna be a left turn heading offfff zero five nine.

15:12:54.1 HOT-2

yup.

15:12:55.0 HOT-2

zero five nine.

15:12:55.5 HOT-1

zero five nine.

15:13:00.1 HOT-2

set right.

15:13:01.9 HOT-1

zero five nine. set left.

15:13:06.4 HOT-1

goin’ to # BIGGY. #. how the #—

15:13:10.2 HOT-1

yeah (now) don't # put us at # at four thousand all the # way. what the #? [high pitch, exclaiming].

15:13:14.1 HOT-2

(and) zig zagging.

NTSB Aircraft Accident Report 86 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:13:16.7 HOT-1

yeah. she's gonna # carry it we-we won't # make it if we got (a) four thousand. she's a # idiot. get us someone else if she can't do it [high pitch, exclaiming].

15:13:27.1 HOT-1

I # filed for #...

15:13:30.0 HOT-1

...what is it? for twenty-seven man.

15:13:31.8 APP-PHL

november four five two delta alpha contact New York approach on one three two point eight good day.

15:13:37.4 RDO-1

one three two point eight four five two delta alpha so long.

15:13:40.7 APP-NYC

[prior cut off, similar to frequency change] —two niner seven five expect vectors I-L-S six circle runway one.

15:13:41.4 HOT-2

uhhh.

15:13:46.1 AC-RRBZ

two niner seven five. uh expect vectors I-L-S six. circle runway zero one. romeo bravo zulu.

15:13:53.1 RDO-1

and New York center Learjet four five two delta alpha's checkin' in four thousand uh direct BIGGY at this time.

NTSB Aircraft Accident Report 87 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:13:58.2 APP-NYC

Lear four five two delta alpha New York approach Newark altimeter two niner seven five. fly heading zero two zero vector I-L-S six circle one.

15:14:06.4 HOT-1

okay what was the heading—

15:14:08.5 RDO-1

okay we got a two niner niner er uhh excuse me. what was that again. say again altimeter for two delta alpha.

15:14:10.9 HOT-2

two nine seven five.

15:14:12.8 APP-NYC

the altimeter's two niner seven five at Newark. Lear two delta alpha fly heading zero two zero vector I-L-S six circle one.

15:14:14.8 CAM

[sound of high pitch tone, similar to altitude alerter]

15:14:20.0 RDO-1

'kay zero two zero. four five two delta alpha.

15:14:23.1 APP-NYC

papa romeo romeo bravo zulu descend and maintain five thousand.

15:14:24.3 HOT-2

zero two zero on the heading.

NTSB Aircraft Accident Report 88 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:14:26.5 AC-RRBZ

five thousand. romeo bravo zulu.

15:14:26.7 HOT-1

what the # are they doing man? circling six?

15:14:28.1 HOT-2

uh zig zagging man.

15:14:29.8 APP-NYC

Jetlink mike foxtrot nine five kilo New York.

15:14:29.8 HOT-2

heading zero two zero.

15:14:32.1 HOT-1

well we got the power pulled all the way # back you know so it’s—

15:14:36.8 HOT-1

no # point in—

15:14:39.3 HOT-2

zero two zero.

15:14:40.6 HOT-1

yeah. we're set.

15:14:41.6 HOT-2

alright.

15:14:42.0 HOT-1

zero two zero on the left.

NTSB Aircraft Accident Report 89 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:14:43.1 HOT-2

yup.

15:14:44.1 HOT-2

#. alright.

15:14:45.7 HOT-2

(set on the) right.

15:14:47.4 HOT-1

he was saying circling # six or something. I don't know what the # they thinkin' we're doin'. we're # hundreds of miles away man.

15:14:51.9 HOT-2

[sound similar to heavy breathing]

15:14:54.5 APP-NYC

(Jetlink) nine five (kilo) if you read New York ident.

15:14:58.9 HOT-2

what the # over?

15:15:01.0 HOT-2

dude we're gonna get there like # an hour and you're gonna look at me and you're gonna say why is the time like this?

15:15:03.7 APP-NYC

roger papa romeo romeo bravo zulu turn right zero niner zero descend and maintain three thousand.

15:15:08.3 HOT-1

be there in twenty # minutes.

NTSB Aircraft Accident Report 90 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:15:09.4 AC-RRBZ

right heading zero niner zero descend three thousand. romeo bravo zulu.

15:15:12.5 HOT-1

no act—

15:15:12.5 HOT-2

no we're doin' S turns on this #.

15:15:13.5 HOT-1

actually—

15:15:13.6 APP-NYC

Lear two delta alpha descend and maintain three thousand.

15:15:16.2 RDO-1

three thousand. two delta alpha.

15:15:18.6 HOT-1

eh man.

15:15:20.5 HOT-1

let's go down to three.

15:15:21.5 HOT-2

yup. doin' it.

15:15:22.3 HOT-1

we're # gonna be there in ten minutes.

15:15:25.0 HOT-1

I gotta’ get the # ATIS. #. I didn't realize we're that # close.

NTSB Aircraft Accident Report 91 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:15:30.4 HOT-1

of course I don't have # uh G-P-S that's why.

15:15:32.9 HOT-2

you wanna use my ipad?

15:15:34.1 HOT-1

naw that's okay. (we'll/will ) #—

15:15:36.5 HOT-1

Teterboro—

15:15:38.1 HOT-1

thirty-two eighty five.

15:15:42.2 CAM

[sound of multiple clicks]

15:15:44.1 HOT-1

I'm goin’ off of one.

15:15:45.1 HOT-2

yes sir.

15:15:46.9 ATIS-TEB

departure. ** (fly the procedure as published). all pilots follow noise abatement procedures. read back hold short instructions ** — [static throughout transmission]

15:15:56.4 APP-NYC

Lear(jet) two delta alpha turn right heading one two zero.

15:15:59.1 RDO-2

one two zero. four five two delta alpha.

NTSB Aircraft Accident Report 92 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:16:02.6 HOT-1

what the #? one two zero? [high pitch, loudly]

15:16:04.4 HOT-2

yes sir.

15:16:05.2 HOT-2

turn right to one two zero sir.

15:16:05.2 HOT-1

holy #.

15:16:07.6 HOT-1

yes sir. one two zero.

15:16:12.8 ATIS-TEB

[static] visibility [static].

15:16:14.0 CAM

[sound similar to decrease in engine thrust]

15:16:16.0 ATIS-TEB

light rain. five thousand five hundred scattered. temperature one eight. dew point six. altimeter two niner seven four [static throughout transmission].

15:16:25.4 HOT-1

two nine seven four.

15:16:26.9 ATIS-TEB

• approach in use ***. V-F-R departures contact clearance

delivery on one two eight point zero five prior to taxi. bird activity in the vicinity of Teterboro airport. *** — [static throughout transmission] NTSB Aircraft Accident Report 93 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:16:31.8 HOT-2

hey it's uh at least it's good practice.

15:16:41.0 HOT-1

watch the altitude.

15:16:42.1 HOT-2

yup I'm on it.

15:16:42.9 HOT-1

shallow it out.

15:16:44.0 HOT-2

I already did.

15:16:44.8 ATIS-TEB

(departure.) comply with altitude restrictions as published— [static throughout transmission]

15:16:48.8 APP-NYC

papa romeo romeo bravo zulu turn right one one zero. vector for your descent.

15:16:54.0 AC-RRBZ

right heading one one zero. vector for descent romeo bravo zulu.

15:16:54.2 ATIS-TEB

advise on initial contact you have information zulu [static throughout transmission].

15:16:58.6 HOT-1

zulu.

NTSB Aircraft Accident Report 94 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:16:59.5 CAM

[sound similar to papers rustling]

15:17:00.9 HOT-1

information zulu. who the # knows what's going on (in) Teterboro.

15:17:02.8 APP-NYC

(seven mike foxtrot) nine (mike) kilo New York.

15:17:05.3 HOT-1

don't have time to listen to it.

15:17:08.2 HOT-1

I just got the altimeter.

15:17:09.1 APP-NYC

• nine five kilo

15:17:10.1 HOT-2

no worries.

15:17:11.2 HOT-1

it's zulu two nine seven four.

15:17:14.1 CAM

[sound similar to either papers rustling or seat moving on seat track]

15:17:14.9 HOT-2

roger.

NTSB Aircraft Accident Report 95 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:17:15.5 HOT-1

I guess we're #— do you see New York out there anywhere?

15:17:18.0 HOT-2

negative. we're so # far from it. like—

15:17:19.8 HOT-1

yeah.

15:17:20.3 APP-NYC

romeo romeo bravo zulu. turn left zero eight zero intercept the six localizer.

15:17:22.1 HOT-2

we're (in) the boonies.

15:17:25.4 AC-RRBZ

zero eight zero the localizer runway six bravo **.

15:17:25.4 HOT-1

well it's less than fifty miles man. that's why. two five zero on the speed sir.

15:17:26.7 CAM

[sound similar to increase in engine thrust]

15:17:29.9 HOT-2

yup.

15:17:30.7 HOT-1

that's why. we're less than fifty miles away. #.

NTSB Aircraft Accident Report 96 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:17:33.8 HOT-1

no wonder they're s— got us so # low.

15:17:38.0 HOT-1

but they got us at # three thousand. really? [high pitch, loudly]. what the # over? [high pitch, loudly] and we're goin’

south we're not goin’ # north [high pitch, loudly].

15:17:49.1 HOT-1

I don't know what. (well it) must be a flow issue.

15:17:49.3 HOT-2

** al-al-altitude is good. three thousand’s good. speed is good.

15:17:55.5 HOT-1

yeah. there we go man. let's get some V-speeds (on the way).

15:17:55.8 APP-NYC

papa romeo romeo bravo zulu. contact New York approach on one two seven point six.

15:17:59.6 HOT-1

let's do the checklist.

15:18:01.5 AC-RRBZ

one two seven six. romeo bravo zulu so long.

15:18:05.0 HOT-1

so we got five. ten. fifteen. twenty. I'm gonna say one twenty-two.

NTSB Aircraft Accident Report 97 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:18:06.7 AC-UNK

*** five thousand for seven thousand direct REGLE we have zulu at Teterboro.

15:18:10.9 HOT-1

now (you) got thirteen. fourteen. let's go uh. one twenty-six one nineteen.

15:18:12.4 APP-NYC

• zero *. *** wind gusts * two niner seven five. expect

vectors I-L-S six circle one. 15:18:16.0 HOT-2

one twenty-six to one nineteen. roger.

15:18:18.6 HOT-1

so just make it one twenty-six (man).

15:18:19.9 AC-N900QC

two nine seven five. uh I-L-S runway six circle to runway one. zero quebec charlie.

15:18:24.6 HOT-1

approach is one twenty-six. V-ref is one-nineteen.

15:18:31.3 CAM

[sound similar to decrease in engine thrust]

15:18:31.3 HOT-2

speed. I gotta’ slow down a lot.

15:18:33.6 HOT-1

yeah. we're only you know three thousand. #. two fifty's our top speed.

NTSB Aircraft Accident Report 98 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:18:40.5 HOT-1

red sled man. and they got it— havin' us doing # S-turns

into Teterboro. what the #. over?

15:18:48.6 HOT-2

do some (airframes) have like a speed-dometer like you like can hold the speed?

15:18:53.2 HOT-1

yeah. we do.

15:18:54.3 HOT-2

oh.

15:18:55.8 HOT-1

well—

15:18:56.1 HOT-2

oh right there.

15:18:56.9 AC-UNK

uhh New York uhh *.

15:18:58.0 HOT-1

yeah. speed. but what it'll do to maintain that— it'll pitch up or down to maintain two fifty.

15:19:02.0 APP-NYC

• alpha. New York approach one niner zero. descend

and maintain four thousand. newark altimeter two niner seven five. 15:19:04.9 HOT-2

I gotch’ya.

NTSB Aircraft Accident Report 99 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:19:06.6 HOT-1

because we—

15:19:08.8 AC-95K

one niner zero down to four thousand. two niner seven five for (compassion flight) niner five kilo.

15:19:08.9 HOT-1

we don't have auto throttles.

15:19:11.2 HOT-2

I gotchy’a.

15:19:17.1 APP-NYC

Lear two delta alpha fly heading zero niner zero intercept the six localizer contact New York approach one two seven point six.

15:19:20.9 CAM

[sound similar to increase in engine thrust]

15:19:25.0 RDO-1

okay one two seven point six. fly heading zero nine zero to intercept the six into Teterboro. four five two delta alpha.

15:19:31.6 APP-NYC

Falcon zero quebec charlie descend and maintain three— [cut off by frequency change]

15:19:37.0 HOT-1

runway six I-L-S.

15:19:38.0 CAM

[sound similar to increase in engine thrust]

NTSB Aircraft Accident Report 100 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:19:40.5 HOT-1

set this up on your side. one oh nine point nine.

15:19:45.1 HOT-1

or excuse me. one oh eight point nine.

15:19:47.1 HOT-1

zero six zero on the— localizer.

15:19:49.8 RDO-1

New York Learjet four five two delta alpha. three thousand. zero nine zero on the heading for the I-L-S six into Teterboro.

15:19:55.2 HOT-1

zero six zero. [spoken in a whisper]

15:19:55.8 APP-NYC

Learjet four five two delta alpha New York approach roger.

15:20:00.2 HOT-1

one oh eight point nine and zero six zero.

15:20:01.2 APP-NYC

(Gotham) eight three two about eight miles from DANDY. (two thousand) * localizer. cleared I-L-S runway six approach circle runway one. traffic no factor.

15:20:09.1 CAM

[sound similar to increase in engine thrust]

15:20:09.1 AC-GOTH832

two thousand localizer * Gotham ***.

NTSB Aircraft Accident Report 101 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:20:09.7 HOT-1

'kay we're radar vectors so I'm gonna go ahead and set my

up for it as well.

15:20:13.2 HOT-2

roger.

15:20:16.5 HOT-1

you're on heading mode (nav) select one oh eight point nine.

15:20:19.1 AC-N10MB

Lear one zero mike bravo. eight thousand descending six thousand zulu at Teterboro.

15:20:19.2 HOT-2

yes sir.

15:20:23.5 APP-NYC

Learjet one zero mike bravo New York approach. Newark altimeter's two niner seven five.

15:20:23.7 CAM

[sound similar to increase in engine thrust]

15:20:28.4 AC-N10MB

nine(r) seven five.

15:20:29.5 HOT-2

runway in sight.

15:20:31.2 HOT-1

for six?

NTSB Aircraft Accident Report 102 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:20:32.0 APP-NYC

Learjet two delta alpha make sure you intercept the localizer.

15:20:32.0 HOT-2

right there.

15:20:34.8 RDO-1

four five two delta alpha copy.

15:20:36.8 HOT-1

what the # over?

15:20:38.0 HOT-1

zero six zero why aren't you not—

15:20:40.0 HOT-1

intercepting it. I guess it's # left.

15:20:42.0 HOT-1

we're makin' the left.

15:20:42.6 APP-NYC

Learjet two delta alpha left turn twenty heading (if) you (need it) to join.

15:20:42.9 HOT-2

yup.

15:20:45.7 RDO-1

we got it four five two delta alpha.

NTSB Aircraft Accident Report 103 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT

15:20:47.3 APP-NYC

papa romeo romeo bravo zulu descend and maintain (two) thousand.

15:20:49.7 HOT-2

you want me to hit nav?

15:20:50.9 AC-RRBZ

** romeo bravo zulu.

15:20:51.1 HOT-1

#. that's why.

15:20:57.0 HOT-1

there we go. #—

15:21:00.1 HOT-1

runway's out there somewhere. I don't know why you're

lookin' over there.

15:21:00.2 APP-NYC

Gotham eight three two *** five.

15:21:01.7 HOT-2

yeah that was Newark. that was Newark.

15:21:04.8 HOT-2

I thought that was Teterboro.

15:21:04.8 AC-UNK

Teterboro nineteen five . copy (and you too).

15:21:09.0 HOT-1

alright your localizer is captured.

NTSB Aircraft Accident Report 104 TIME/ SOURCE INTRA-COCKPIT CONTENT TIME/ SOURCE AIR-GROUND COMMUNICATION CONTENT 15:21:11.5 HOT-1

and we've got nav mode selected on the F-M-S.

15:21:13.4 APP-NYC

Learjet one zero mike bravo (depart metro) heading *.

15:21:15.4 HOT-1

go ahead and slowwwwly bring it on back on the power not not crazy though 'cause we still got a ways to go.

15:21:20.8 HOT-2

I'll put it at like one eighty.

15:21:22.4 HOT-2

what do ya think?

15:21:22.6 HOT-1

not. no. no.

15:21:23.1 AC-N10MB

what's uh give me again uh * again the phonetic.

15:21:24.0 HOT-1

keep it about two forty.

15:21:25.4 HOT-2

okay.

15:21:26.8 HOT-1

we're not far enough.