Honorable Carol J. Carmody
Member, National Transportation Safety Board
Remarks for SMU Aviation Law Symposium
February 28, 2003
Thanks for inviting me to address the SMU Aviation Law Symposium. I appreciate
being asked to discuss aviation safety issues of concern to your organizations
and the National Transportation Safety Board (NTSB). I am always glad to
talk about the NTSB because it is a unique organization.
Our mission is to investigate accidents, determine the cause and make recommendations to prevent recurrence. Originally aircraft accident investigations were handled by the Department of Commerce. When the Civil Aeronautics Board was established in 1940, the investigation function was incorporated there. It wasn't until 1967 that Congress established the National Transportation Safety Board to investigate accidents in all modes of transportation: aviation, highway, marine, rail, pipeline, and hazardous materials, and to provide oversight to the Department of Transportation modal administrations. In 1974 Congress removed us from the Department, and made the NTSB an independent agency.
The investigative organization must be truly independent from any other governmental body. No entity should be expected to investigate or oversee itself -- it can't and doesn't work. I believe the traveling public has benefited from the work of professional air safety investigators and accident investigation agencies throughout the world. Their work has led to direct improvements in the way aircraft are built, maintained and operated. It is for that reason that the Safety Board has long advocated that all countries should have an investigative organization separate from other governmental agencies that oversee the regulation and operation of their transportation systems.
In 1994, the European Civil Aviation Conference, which represents nearly 40 European states, adopted a directive that aviation accidents and serious incidents will be investigated by an authority that is independent of the organizations responsible for regulation and safety oversight of the aviation system. As a result, many European states have formed independent aviation investigation bodies. Currently, we have 10 such independent boards in place around the world. And, collectively, we have formed an organization, International Transportation Safety Association, to share ideas and discuss issues of mutual concern.
When the Board investigates an accident, we don't do it in isolation. We involve all of the organizations with an interest in a particular accident -- in the case of an aircraft accident, that's the regulators, the airlines, the airports, the manufacturers, and the various professional associations and unions -- through what is known as the party system. This system has worked well and has helped give the American people confidence in their transportation system. Maintaining that confidence requires constant vigilance by everyone within that system -- regulators must properly regulate the industry; owners and operators must ensure the safety of their operations; manufacturers must design and build safe products; and the NTSB must reassure the public that there is an independent review of how well those entities are fulfilling their responsibilities. This interrelationship creates a healthy tension between the participants - by design -- and it works.
On that Saturday the shuttle was destroyed, the Safety Board launched six people to Texas and Louisiana to assist NASA in debris recovery and to help initiate the investigation. We sent two seasoned investigators-in-charge who have extensive experience with in-flight break-ups, a forensic pathologist, and structure, systems and aircraft performance experts. In Washington, our staff is working on the radar data and working with meteorologists to help locate wreckage. We now have six investigators at the Kennedy Space Center in Florida helping NASA engineers reassemble portions of the shuttle. We also have several radar interpretation experts assisting their NASA counterparts at the Johnson Space Center in Houston. And, several NTSB supervisory personnel have been placed on the staffs of members of the independent Columbia Accident Investigation Board, also operating out of the Johnson Space Center. We will continue to provide support to NASA as long as we are needed.
Let me talk about a couple of the Board's ongoing investigations and then some safety concerns that we have.
We are working on the recent accident involving an Air Midwest Beech 1900 that crashed shortly after takeoff from Charlotte, North Carolina on January 8, 2003, killing all 21 persons on board. Two areas of our focus are the weight and balance of the aircraft, and recent maintenance on the elevator system. Initial information indicates that the airplane was loaded to near its maximum gross weight and to its aft center of gravity. Average passenger and baggage weights were used by the airline, and our investigators are verifying the actual weight and balance of the airplane at the time of takeoff. Several days before the accident, the airplane had undergone routine maintenance, including re-tensioning of the elevator control cables, in Huntington, West Virginia. The flight data recorder indicates that following maintenance there is a 10-degree forward shift in the pitch control position parameter. Examination of the wreckage found that elevator control cable turnbuckles were not adjusted to the same length. Typically, these turnbuckles are adjusted evenly. Bear in mind that the airplane made nine revenue flights after maintenance with no pilot reports of any flight control difficulties. The FAA has already taken action both with respect to the maintenance and the weight issue, but clearly, we are in early stages of this investigation.
Investigation continues on the accident that killed Senator Paul Wellstone and seven others in Minnesota in October. I was the Board Member accompanying the Go-Team. The flight had been a normal one in all respects; air traffic transmissions normal, the aircraft lined up headed west on the runway when it began to turn south and lose altitude. It crashed minutes later headed due south. An intense post crash fire destroyed most of the aircraft. The accident aircraft was a King Air 100 which was not required to be equipped and was not equipped with a CVR or an FDR -- which will make it difficult for our investigators to determine exactly what happened due to the fragmentation of the wreckage. The engines and propellers have been torn down and there are no indications of pre-impact failures. We are continuing to examine radar data from previous flights and data from the FAA flight inspection airplane to determine if there are any navigational issues that would have resulted in the airplane turning to the south. We are also looking into the pilots' training and experience. While icing was present in the area at the time, we don't believe it was a factor in the accident.
Last October, we held a hearing on the American Airlines flight 587 accident that occurred in November 2001. The accident was the second worse in US history, the first catastrophic loss of an Airbus product in the United States, and the first we have investigated that involved an in-flight failure of a major structural component made of composite materials-in this case, the vertical stabilizer and its attached rudder. This has been a very broad and intense investigation covering a number of issues. Currently we are focusing on the vertical stabilizer, rudder and the aircraft's performance. Our investigators believe, that the tail fin separated because it was subjected to aerodynamic loads that exceeded its design limitations. The examinations indicate that the vertical stabilizer was actually stronger than its certification requirements. Aerodynamic calculations show that the loads on the vertical stabilizer were extremely high -- almost twice limit load. It appears that the rudder movements prior to the fin separation were the source of the large aerodynamic loads.
Unlike metal failures, which include local fracture surface markings that indicate whether it is the result of fatigue or static overload, the analysis of damage patterns of composites is more complicated. Following the accident, flight 587's fin components were subjected to a series of non-destructive examinations to define the areas of damaged and undamaged structure.
We also asked NASA to produce a model of the wake vortices that flight 587 encountered to further study their possible role in the accident sequence. We provided NASA with the flight data recorder information from flight 587 and the Boeing 747 aircraft that preceded it on takeoff, including temperature, wind speed and direction, and acceleration data to develop the model. We evaluated that information and found nothing abnormal with respect to the vortices.
Recommendations we made just a few months after the accident alerted pilots to the possibility of damage to the vertical stabilizer by rudder manipulation. At this stage of our investigation, we are looking at rudder pedal design, and certification standards for strength and controllability. We hope to wrap up this investigation by this fall.
Just last month, the Safety Board adopted its report on the January 31, 2000 Alaska Airlines flight 261 accident. This was an MD-83 which departed Puerto Vallarta, Mexico enroute to Seattle; nearly four hours into the flight, and after several attempts to control the aircraft and perform an emergency landing at Los Angeles International Airport, the aircraft crashed into the Pacific Ocean, and killed all 88 aboard. The Board determined that the probable cause of the accident was the loss of airplane pitch control resulting from in-flight failure of the acme nut thread in the horizontal stabilizer trim system jackscrew assembly. The component failed because of excessive wear resulting from Alaska Airlines' insufficient lubrication of the jackscrew assembly.
Contributing to the accident were Alaska Airlines' extended lubrication interval and the FAA's approval of that extension. This increased the likelihood that unperformed or inadequate lubrication would result in excessive wear of the acme nut threads. Contributing as well was Alaska Airlines' extended endplay check interval and the FAA's approval of that extension. This allowed the excessive wear of the acme nut threads to progress to failure without the opportunity for detection. In addition, the Board believed that the absence of a fail-safe mechanism on the MD-80 to prevent the catastrophic effects of total acme nut thread loss also contributed to the accident.
The Safety Board issued 16 recommendations to the FAA. One called for a review of all existing maintenance intervals for tasks that could affect critical aircraft components. Another recommended that the FAA conduct a systematic engineering review of all transport category airplanes to identify means to eliminate the catastrophic effects of a system or structural failure in the horizontal stabilizer trim jackscrew assembly. We also recommended that the FAA ask air carriers to instruct pilots that in the event of an inoperative or malfunctioning flight control system, the pilot should complete only a checklist and then proceed to land if procedures were not effective.
Most of the aviation activity the past year has centered on security issues. I am relieved to say that security is not part of the NTSB's responsibility. I have said many times since September 11 that with all the emphasis on security, we must be sure not to give safety short shrift. With all the efforts to make things more secure, let's not make them less safe. For instance, the reinforcement of the cockpit doors, which was done to improve security, raises some concerns.
· Ease of communication. Through some of our investigations, we have found that communication problems between the cockpit and the cabin crews, caused by damaged interphone systems, cockpit workload issues, or human error, could be resolved by face-to-face discussions between the crews. As security improvements are implemented, we must be sure that crew communications during emergency situations are not compromised.
· Emergency Access. Access to the cockpit can also be very important in an emergency. For example, in the DC-10 accident at Sioux City, Iowa in 1989, an off-duty DC-10 check airman seated in the cabin was taken to the cockpit by a flight attendant so that he could provide much needed assistance to the flight crew as they tried to land the plane.
· Emergency Escape and Rescue. We must consider how changes to the cockpit door would affect the crew's ability to escape or be rescued following an accident. Rescue personnel have had to use the cockpit door to free the trapped pilots, and crew and passengers have used the cockpit windows to escape when other exits were inoperable or blocked.
The Board is advocating another change, which has generated a great deal
of controversy -- cameras in the cockpit. Recording images of the cockpit
is both technically and economically feasible, and would make it possible
for investigators to see what is happening in the cockpit so that questions
regarding crew actions can be readily resolved. For example, a cockpit video
recorder could tell us which pilot was at the controls, what controls were
being manipulated, pilot inputs to instruments such as switches or circuit
breakers, or what information was on the video displays such as the display
screens and weather radar. September 11th showed us that they might have
even more uses. Imagine how much information such cameras could have provided
investigators following the attacks.
In April 2000, the Safety Board recommended that the FAA require commercial aircraft currently equipped with a CVR and a FDR to also be equipped with a crash-protected cockpit image recording system. We made this recommendation because we didn't have adequate information about the cockpit environment in several recent major investigations, such as the ValuJet flight 592 and EgyptAir flight 990 investigations. In each of these investigations, crucial information about the circumstances and physical conditions in the cockpit was simply not available to investigators, despite the availability of good data from the FDRs and CVRs.
The Egyptair accident highlighted the need for a video recording of the cockpit environment. Such information could have ended the debate over the flight crew's actions in the cockpit, and saved considerable time and expense in the investigation.
We are sensitive to the privacy concerns expressed by pilot associations and others with respect to recording images of flight crews. In order to protect crewmembers' privacy, the Safety Board has asked Congress to apply the same protections that exist for CVRs to the use of image recorders in all modes of transportation. Under these provisions, the Board could not publicly release cockpit image recordings.
In its 36-year history, the Board has issued almost 12,000 recommendations to more than 1,250 recipients. Most of our recommendations go to government agencies, but, when appropriate, they are sent to state and local governments and industry organizations and associations. To date, 80 percent of them have been adopted and they have led to countless safety improvements in all transportation modes -- aircraft collision and ground proximity warning systems; airport wind shear warning systems; passenger vehicle next generation air bags; improved school bus construction standards; pipeline excess flow valves; and better commuter train emergency exit markings -- just to mention a few.
I want to focus the remainder of my remarks on just two of the aviation safety issues the Board is concerned about: runway incursions and fatigue.
There were 337 runway incursions in the United States last year, more than 1½ times the 200 that occurred in 1994. There were 29 runway incursions reported in January 2003 compared to only 14 reported for January last year. Runway incursions can be deadly. When two loaded aircraft are involved the loss of life is high. You may recall the collision between two aircraft at the airport in Milan in 2001, which killed more than one hundred people or the accident in Singapore in 2000, in which an aircraft hit an obstruction on the runway, killing 83 people. Although the aviation community has been working to reduce this safety hazard, the number of incursions is still too high.
Since 1973, the Safety Board has issued more than 100 recommendations regarding
runway incursions. The issue has been on our list of Most Wanted Safety
Improvements for over 10 years. We all know that there isn't any one solution
that will eliminate the problem of runway incursions. It will take a combination
of approaches including procedural changes, educational efforts, and technology
One of the most touted technology improvements to deal with runway incursions is the implementation of AMASS -- Airport Movement Area Safety System. AMASS generates an audible and visual alert to controllers when an aircraft or vehicle is occupying a runway and when arriving or departing aircraft cross a certain threshold or attain a certain speed. AMASS has been in development for ten years, although the FAA says that AMASS will be operational at 32 of the nations' busiest airports by the end of 2003. Although it is a promising technology for some situations associated with runway incursions, AMASS parameters may not provide controllers and flight crews sufficient time to intervene and react to maintain safe separation in all circumstances. We believe that the system is missing a key element -- a direct warning to flight crews or vehicle operators. This warning is crucial because it would give both controllers and those operating the aircraft time to react.
Improper or misunderstood clearances continue to place aircraft, vehicles, and their passengers in danger -- despite ongoing safety briefings and seminars, improved signage, painted runway markings, and informational brochures. The reason is simple - human error. Pilots may misunderstand a clearance or read it back incorrectly and controllers fail to catch the error. Or, they turn at the wrong point. Or, controllers clear an aircraft onto a runway already occupied by a vehicle or another aircraft. We have recommended to the FAA that since the technology isn't complete, some operational measures be considered to minimize the possibilities of runway incursions, such as:
· adopt procedures to specific clearances for each runway crossing;
· stop allowing departing aircraft to be held on active runways at night;
· use standard ICAO phraseology to reduce confusion in pilots whose native language is not English.
To date, the FAA has not implemented any of these recommendations. The
FAA's runway incursion program does address awareness and education, and
these are certainly important; but in a system as complex as airport traffic
control, human mistakes are unavoidable. Our recommendations build in redundancies
to compensate for the inevitable lapses in human performance. We believe
it is critical to take action to retard the growth in incursions before
we have an accident like Milan accident on US soil.
Recommendations addressing operator fatigue in all modes of transportation have also been on the Safety Board's Most Wanted List since the list's inception in 1990. Over the years, we have made about 100 recommendations to operators and regulators asking for additional education and research as well as specific regulatory changes. In 1989, the Safety Board issued three safety recommendations to DOT, calling for an aggressive federal program to address the fatigue problem in all sectors of the transportation industry. These recommendations asked for:
· a coordinated research effort;
· an extensive educational program; and
· a systematic review and improvement of regulations.
In 1999, the Board reviewed the status of those recommendations. Our report examined the progress, or rather the lack of progress, in each mode. We again asked DOT to require the modal administrations to modify their regulations to establish scientifically based hours-of-service regulations, to provide predictable work and rest schedules, and to consider circadian rhythms and human sleep and rest requirements. We asked that this be done within two years. Here we are four years later -- 14 years after our first set of recommendations -- and little progress has been made.
In 2001, the Board found that fatigue played a role in the American Airlines flight 1420 accident in Little Rock, Arkansas, on June 1, 1999. We concluded that the probable causes of the accident were the flight crew's failure to discontinue the approach when severe thunderstorms and their associated hazards to flight operations had moved into the airport area and the crew's failure to ensure that the spoilers had extended after touchdown. Contributing to the accident was the flight crew's impaired performance resulting from fatigue and the situational stress associated with the intent to land under the circumstances. Clearly, this is an issue that must be addressed.
Aviation continues to be the safest mode of transportation available to the world's travelers. The Board's job -- and all of yours -- is to ensure that it remains that way. The measures that I've discussed today will help us do that. Thank you for inviting me to be here today.