Good morning Chairman Wolf and Members of the Subcommittee. It is a
pleasure to represent the National Transportation
Safety Board before you today on the subject of aviation safety.
As you are all probably aware, 1998 was the first year that no passenger
died on a scheduled Part 121 or Part 135 carrier in
the United States. This is a remarkable achievement considering the
statistics: in 1998, the airlines carried about 611 million
passengers on almost 11 million flights. The more than 500,000 people
employed by scheduled air carriers in the United States
and the 40+ thousand employees of the FAA should be commended for this
outstanding record.
My prepared testimony discusses five safety issues, but in the interest
of time, I will briefly discuss only 2 - flight recorders and
collision avoidance systems. I will, of course, be happy to answer
your questions on these and the other three issues - aircraft
icing, runway incursions, and child safety.
The upgrading of accident recorders is a top priority at the Safety
Board, and an issue on the Board's Most Wanted list of
safety improvements since 1990. The purpose of flight recorders --
whether it be a cockpit voice recorder or a flight data
recorder -- is to collect data that can help us learn. What these important
devices tell us can prevent accidents. The Safety
Board and this Subcommittee have for many years prodded the FAA to
require upgraded recorders on transport category
aircraft, but sadly most of the U.S. fleet is still equipped with outmoded
models. Just two weeks ago, a control incident
involving a Metrojet Boeing 737 occurred. That aircraft had an 11-parameter
recorder on board. Once again, because of FAA
and industry inaction, the Safety Board does not have important information
needed to find out what happened on that 737.
As you are aware, the Safety Board has urgently recommended that the
FAA require all transport category aircraft to have
upgraded flight recorder capability and asked that the FAA expedite
this action with regard to the Boeing 737. Although the
FAA has published a final rule mandating the inclusion of almost all
of the data parameters we originally recommended, we are
concerned that the completion of the upgrade is 3 years away. In addition,
the FAA chose not to single out the 737 as urgently
requested by the Board. The Board's safety recommendation asked for
an effective date of December 30, 1995 - the FAA's
rule has an effective date of 2002.
In addition, the Metrojet's in-flight event was not preserved on the
aircraft's cockpit voice recorder because the 30-minute
continuous loop had recorded over the event. Important safety information
is often lost on CVRs that record for only 30
minutes, and two years ago the Safety Board recommended that the FAA
move expeditiously to equip aircraft with 2-hour
cockpit voice recorders so that valuable investigative data could be
retrieved during accident and incident investigations. To
date, the FAA has yet to require the 2-hour recorder.
Another problem is the loss of recorder data due to interruption of
aircraft electrical power. The Canadian's investigation of
Swissair flight 111 has been hampered because the cockpit voice recorder
and the digital flight data recorder both stopped
nearly 6 minutes before the airplane hit the water. The NTSB and the
Canadian Transportation Safety Board yesterday
recommended that CVRs be retrofitted, on all airplanes required to
carry both a CVR and an FDR, with a CVR that is capable
of recording the last 2 hours of audio, and that it be fitted with
an independent power source that will provide 10 minutes of
operation whenever aircraft power to the recorder ceases.
The second issue I want to discuss is traffic alert collision avoidance
systems. We believe the regulation regarding the phased
installation program of TCAS II should include cargo aircraft. A week
ago yesterday two large cargo planes nearly collided at
33,000 feet over Kansas after both planes apparently lost radio contact
with an air traffic control center. Domestic air cargo
nearly tripled between 1980 and 1996. The growth in cargo operations,
including 8-million pounds of hazardous materials
freight shipped by air daily, has brought about an increase in daytime
flying for cargo operators, which means they are
increasingly using the same airspace at the same time as passenger
carriers. This traffic mix and density increases the challenge
of maintaining safe separation among aircraft. While it is encouraging
that since the incident last week the FAA has issued press
statements that it now favors installation of TCAS on cargo carriers,
no official documentation has been released.
Mr. Chairman, before closing I would like to briefly mention the Board's
increased activity in foreign aviation accident
investigations. In 1998, 110 United States citizens were killed in
foreign aviation accidents, and a United States citizen can be
found on most air carrier flights anywhere in the world. This is, in
part, as a result of every-increasing code-sharing
arrangements with foreign airlines. You will recall that several years
ago the FAA acted on Safety Board recommendations
regarding one level of safety between smaller commuter airlines and
large air carriers. As code sharing agreements continue to
increase, we plan to monitor this situation closely to determine whether
safety recommendations are appropriate.
It is apparent to me, Mr. Chairman, that issues of aviation safety are
no longer parochial, but are international in nature. The
NTSB expects to be more and more involved in foreign accident and incident
investigations, as U.S. airlines become more
entwined with foreign counterparts, and U.S. aircraft and engine manufacturers
find themselves competing more and more with
foreign companies.
That completes my testimony, Mr. Chairman. I would be happy to respond to any questions you may have.
Good morning Chairman Wolf and Members of the Subcommittee. It is a pleasure to represent the National Transportation Safety Board before you today on the subject of aviation safety.
As you are all probably aware, 1998 was the first year that no passenger died on a scheduled Part 121 or Part 135 carrier in the United States. This a remarkable achievement considering the statistics: in 1998, there were about 611 million passenger enplanements; nearly 11 million scheduled air carrier departures, and over 16 million scheduled air carrier flight hours. We commend the more than 500,000 people employed by scheduled air carriers in the United States for this remarkable achievement.
We can all be proud of the consistent high level of safety in which the U.S. commercial aviation industry operates. And while we can take pride in our 1998 record, we must not reduce our continuing efforts to have every year as safe as 1998. We must temper our enthusiasm over the good news of 1998 with the recognition that our colleagues in Canada are continuing their investigation into the crash of Swissair flight 111 near Halifax, Nova Scotia on September 2, 1998, in which all 229 persons aboard that aircraft perished, including 102 U.S. citizens.
The Swiss Air accident was only one of 121 international accident investigations the NTSB supported last year. The rapid growth of international aviation and projections for continued growth are placing increased responsibilities on the Safety Board in the international arena. On one recent day, five countries were represented in our laboratories on accident investigations in which Safety Board staff are participating.
In addition, a significant amount of the world's aircraft fleet are manufactured in the U.S. and more and more foreign-manufactured aircraft are operating to and from and within the U.S. More importantly, nearly every foreign airline accident in the recent past has had American citizens on board. In 1998 alone, 110 U.S. citizens were killed in foreign accidents. This raises another issue that is rapidly emerging--airline code-share agreements.
As you know, the Safety Board is responsible for fulfilling the U.S. obligations for international accident and incident investigation under the Convention on International Civil Aviation. The specific obligations are contained in Annex 13 to that Convention, which outlines the standards and recommended practices for international investigations, and specifies that the States of Registry, Operator, Design, and Manufacture must support the States of Occurrence during investigations of accidents and serious incidents. The Safety Board leads the U.S. teams to support foreign investigations involving U.S. operated aircraft and U.S. manufactured aircraft and engines.
Additionally, Annex 8 to the Convention contains the obligations for States of Design and Manufacture to monitor the continuing airworthiness of the aircraft and engines operating around the world. The U.S. is obligated to notify other States operating U.S. products all over the world about airworthiness problems with our products. As a result of our participation in foreign accident investigations, the Safety Board can facilitate access to data from foreign investigations for the FAA and our aviation industry. And, we can apply the lessons learned from those foreign investigations to help improve U.S. aviation safety.
The need for our involvement in international accident investigations has also increased because more and more U.S. airlines are entering into code-share arrangements with foreign airlines. These agreements mean that if an American citizen buys a ticket on a U.S. airline to fly outside of the United States, there is a growing likelihood that all or part of the flight may be on a non-U.S. airline. As you know, FAA oversight responsibilities for foreign airlines is limited and the safety records of many foreign airlines, unfortunately, are not at the same level as U.S. airlines. Several years ago, a similar issue arose in the United States when large air carriers began code-share arrangements with smaller commuter airlines that did not have to meet more stringent safety requirements of large air carriers. At that time, the relationships between the large and small airlines were strictly economic. Consequently, the traveling public was receiving in effect two levels of safety, until December 1995 when the FAA acted on Safety Board recommendations and issued its final rule that raised the standards for commuter airlines to the same level as the large airlines. The Safety Board played a major role in prompting those changes in the United States, and we plan to monitor the code share trend closely to determine whether additional safety recommendations may be appropriate to ensure one level of safety for international travel as well.
One significant area of concern in foreign accidents is CFIT. CFIT and other approach and landing accidents continue to account for a significant percentage of the accidents and fatalities on a worldwide basis. Nearly 15 approach and landing accidents involving large jet and turbojet aircraft occur each year, not counting CFIT accidents in the Commonwealth of Independent States. Eighty percent of fatalities in commercial transport aircraft accidents from 1979 to 1991 were classified by the Flight Safety Foundation (FSF) as CFIT, or occurred in the approach and landing phase. During the period 1980 - 1996, there were 287 fatal approach and landing accidents that killed 7,185 people worldwide. Based on current projections for air traffic growth, by 2010, there could be 23 CFIT accidents annually.
Over the years, the Safety Board has also addressed pilot training and procedures, such as stabilized approaches, defined missed approach criteria, cockpit resource management training, simulator training for pilots in tactical decisionmaking, etc., to prevent CFIT accidents. With the exception of the tragic Korean Air Boeing 747 accident in Guam on August 6, 1997, that killed 228 passengers and crew, including 14 United States citizens, CFIT accidents have been significantly reduced in the U.S. for both large and small airliners.
The Safety Board issued its first recommendation for a terrain warning system in cockpits of airliners following a non-fatal CFIT accident in 1971, when a DC-9 struck antennas during approach for landing in Gulfport, Mississippi. Additional recommendations were issued following fatal airline accidents in Virginia and the Everglades and in 1975, the FAA began to require large passenger aircraft to be equipped with a ground proximity warning system (GPWS). In 1986, based on a series of commuter airline accidents, the Safety Board recommended that GPWS be required on smaller passenger airliners as well.
After this issue was placed on the Board's "Most Wanted" list in 1994, commuter aircraft with 10 or more seats were required to have GPWS installed. In December 1995, an American Airlines Boeing 757 crashed in Colombia killing all but four of the 163 persons aboard. As a result of that accident, the Safety Board recommended that the FAA require next generation "enhanced" GPWS to be installed on U.S. airliners. A proposed rule for EGPWS was issued in 1998 and the FAA is currently reviewing the comments. In the meantime, some airlines are voluntarily installing EGPWS on their aircraft. During the investigation for the Korean Air accident, it was revealed that the installation of EGPWS would have provided the flightcrew significant warning of the impending ground collision. However, at that time, the system was not certified for that model aircraft.
There are five other specific areas that I also wish to address today and that I believe, Mr. Chairman, will go a long way in producing the type of year we had in 1998 are:
The Safety Board is currently investigating an in-flight occurrence involving a Metrojet Boeing-737-200 that happened just two weeks ago. On February 23, 1999, the flight crew of that airplane declared an emergency after reporting flight control anomalies. Although fortunately no one was injured during the emergency landing, the story is one that has been repeated far too often. The flight data recorder that was aboard that Boeing 737 was an out-moded, 11-parameter model. Important information relating to the flight control surfaces on the aircraft-which could have assisted us in quickly determining the existence, if any, of a control problem with the aircraft-were not available to Safety Board investigators. Once again, an investigation into a reported flight control anomaly is being hampered by the lack of basic performance data. This continues to be unacceptable, because we are prevented from learning lessons from incidents that could be applied to prevent future accidents.
Slightly more than 4 years ago, in the wake of two Boeing 737 accidents, the circumstances of which are well known by this Subcommittee, the Safety Board urgently recommended that the Federal Aviation Administration (FAA) require all transport category aircraft to have upgraded flight recorder capability, so that important data like flight control surface position and crew inputs could be recorded. In addition, the FAA was asked to expedite this action with regard to the Boeing 737. In response to action taken by this Subcommittee and to Board recommendations, on July 17, 1997, the FAA published a final rule that mandates the inclusion of almost all of the data parameters the Safety Board originally recommended. However, the FAA chose not to single out the Boeing 737 as urgently requested by the Board. Further, we are concerned that the effective dates, stipulated for some airplanes as much as 5 years after the date of the final rule (2002), are unacceptably excessive. This is particularly true for the Boeing 737. Because the FAA did not implement the full intent of the urgent 1995 recommendation, we may never have the factual information needed to find out what happened on that Metrojet Boeing 737. This issue, Mr. Chairman, will be discussed at the public Board meeting later this month on the investigation of the crash of USAir flight 427 on September 8, 1994, near Pittsburgh, Pennsylvania.
Mr. Chairman, there are approximately 3,300 Boeing 737s flying somewhere in the world today; over 1,300 of those are in registered in the United States. Three hundred twenty one of the U.S. registered 737s have been fully retrofitted; 226 have been partially retrofitted; and another 95 will be retrofitted by the end of this year. Southwest Airlines has nearly completed retrofitting their entire fleet, which consists of 284 Boeing 737 aircraft, with upgraded flight recorders. Southwest has shown that it can be done in a timely manner and without significant economic penalty. We urge the rest of the industry to follow suit.
Our investigative experience has shown us that many in-flight incidents, such as Metrojet, do not result in accidents but are nevertheless instructive in developing safety improvements. However, this important safety information is often lost on CVRs that record for only 30 minutes. Unfortunately, the Metrojet in-flight event was not preserved on the aircraft's cockpit voice recorder because the 30-minute continuous loop had recorded over the event. Mr. Chairman, this highlights the need for another Safety Board recommendation-issued more than 2 years ago-that all newly manufactured cockpit voice recorders have a minimum recorder duration of 2 hours. To date, the FAA has yet to require the 2-hour recorder.
Although a handful of high technology general aviation aircraft have 2-hour CVRs installed, the only Part 121 or 135 aircraft with this equipment are the Embraer 145s operated by Continental Express. Of the approximately 10,000 CVRs installed on aircraft in the United States, only about 150 to 300 can record for 2 hours, and almost all of these are in general aviation or military aircraft. I hope this Subcommittee will join the NTSB in urging the FAA to move on this matter expeditiously so that valuable investigative data can be retrieved during accident and incident investigations.
Mr. Chairman, another recorder issue of concern to both the National Transportation Safety Board and the Canadian Transportation Safety Board is the loss of recorder data due to the interruption of aircraft electrical power. The Canadian investigation of the Swissair flight 111 crash has been impeded by the lack of data from the cockpit voice recorder and the digital flight data recorder, both of which stopped nearly 6 minutes before the airplane hit the water. Mr. Chairman, this investigation is just the latest of more than 50 accidents or incidents since 1983 that has been hampered by the loss of flight recorder data due to the interruption of aircraft electrical power.
Until recently, recorder technology did not offer a practical solution to the problem of loss of electrical power to the on-board recorders. However, recent innovations in recorder and power supply technologies have made it possible to provide an independent power source with sufficient power to operate a solid-state flight recorder for 10 minutes following a main power loss. Because older model tape-based recorders require too much electrical power and are not easily adapted to a direct current (d.c.) battery or capacitor, the use of an independent power source would also require the use of solid-state flight recorders. The replacement of magnetic tape flight recorders with solid-state flight recorders would not appear to be an undue burden on the industry. In fact, several major U.S. air carriers have recognized the economic benefits of solid-state recorders and are replacing tape flight recorders in their fleets with solid-state units solely for economic reasons. Obviously, providing a 30-minute CVR with 10 minutes of independent power after main power ceases would result in about one-third of the in-flight audio being recorded over. Therefore, this change would also make it necessary to require CVRs with at least 2 hours of recording capacity.
Just this week, Mr. Chairman, the National Transportation Safety Board, in close cooperation with the Canadian Transportation Safety Board, recommended the retrofit after January 1, 2005, of CVRs on all airplanes required to carry both a CVR and a FDR with a CVR that is capable of recording the last 2 hours of audio, and that it be fitted with an independent power source that will provide 10 minutes of operation whenever aircraft power to the recorder ceases. The Canadian Transportation Safety Board has issued a similar recommendation, and both investigative authorities are hopeful that the actions recommended will be adopted by civil aviation regulators worldwide.
The Safety Board has also recommended that the FAA require that all commercial transport aircraft manufactured after January 1, 2003, be equipped with a dual solid-state combination (CVR/DFDR) recording system. A problem that has occurred in several accidents, including ValuJet flight 592 and TWA flight 800, is that either the aircraft's electrical power bus had been severed or the signal wires connecting the CVR/DFDR to the aircraft's sensors had been compromised. The CVR and DFDR are intentionally located in the rear of the aircraft for greater survivability. This rear mounting usually results in long cable runs from the forward cockpit areas to the recorders. One option for mitigating the risks to both recorder and cable survivability would be to create redundancy by locating one combination recorder in the rear of the aircraft and another combination CVR/DFDR recorder near or in the cockpit of the aircraft. This installation would virtually eliminate the vulnerability of the signal wires to external damage. As a result, the probability of loss of power to the combination recorder due to an in-flight fire, structural damage, or breakup would decrease. The additional, forward-mounted combination recorder would also be fitted with an independent power source. Consequently, if primary aircraft power were lost, the independent power source would further ensure that the combination recorder would continue to record via the cockpit area microphone.
Mr. Chairman, we firmly believe that implementation of all of these recommendations will eliminate many of the problems we have encountered in the past because of inadequate flight recorder data, and ensure more complete, and possibly more expeditious, investigations.
Lastly on this topic, I would like to mention that the Safety Board is convening an International Symposium on Transportation Recorders on May 3 - 5, 1999, in Arlington, Virginia. The goal of the symposium is to share the knowledge and experience gained from the use of recorded information to investigate transportation accidents in all modes and to improve transportation safety and efficiency. We believe the symposium will provide the opportunity to identify methods for expanding the use of recorders in all transportation modes for safety as well as for commercial and economic advantages.
The Safety Board issued a series of recommendations on November 30, 1998, as a result of the Comair investigation and reiterated recommendations previously issued as a result of the American Eagle accident investigation. Most importantly, the Safety Board urged the FAA to revise icing criteria and certification testing requirements and to research and develop onboard aircraft ice protection and detection systems. The FAA has tasked several Aviation Rulemaking Advisory Committee working groups to address the concerns of the Board. Also, the FAA on February 2 - 4, 1999, held an International Conference, at which the Safety Board participated, on in-flight operations in icing conditions to discuss the Board's recommendations from the Comair report with industry and academia. We, of course, will closely monitor the actions being taken in response to those recommendations. The original recommendations that stemmed from our 1981 safety study, Mr. Chairman, were eventually either closed as unacceptable or superceded, but the recommendations remained in an "Open-Unacceptable Response" status for 15 years. We are hopeful that the new recommendations that have been made to the FAA on icing issues will not meet a similar fate. The FAA's response to our November 30, 1999, recommendations was received on March 4, 1999, and it is currently being analyzed.
Less than one month earlier, on February 6, 1999, a Federal Express DC-10 cargo aircraft nearly collided with an Air Canada Airbus A-320 near Lincoln, Nebraska. The conflict was resolved when the Air Canada crew climbed in response to a TCAS warning about the approaching DC-10. We understand that Federal Express is in the process of voluntarily installing TCAS aboard their aircraft, but the aircraft involved in the Nebraska and Kansas incidents were not so equipped. Most other cargo carriers have not elected to install TCAS absent a regulatory requirement to do so.
Mr. Chairman, the Safety Board's support for the development of an airborne collision avoidance system dates back to 1969, just 2 years after the creation of the Safety Board. Following a September 9, 1969, midair collision between an Allegheny Airlines DC-9 and a Piper PA-28, the Safety Board recommended that the FAA "support the expeditious development of low-cost collision avoidance systems for all civil aircraft." In the Board's long list of safety recommendations advocating a traffic alert and collision avoidance system (TCAS), the Board did not distinguish between passenger-carrying aircraft and cargo-only operations, and saw no reason to do so.
The Safety Board was supportive of the phased installation program of TCAS II as established by regulation in 1990. We would have preferred, however, that the regulation include cargo aircraft. According to the Bureau of Transportation Statistics, there were 22 U.S. carriers operating 1,161 cargo aircraft who made 369,007 scheduled and 207,293 unscheduled departures, and this industry is growing; the amount of domestic air cargo nearly tripled between 1980 and 1996, from 4.5 to 12.9 billion ton-miles. And it is further estimated that air shipments are expected to triple within the next 20 years in this $40 billion dollar industry.
The growth in cargo operations, including 8 million pounds of hazardous materials freight shipped by air daily, has brought about an increase in daytime flying for cargo operators, which means that they are increasingly using the same airspace at the same time as passenger carriers. This traffic mix and density increases the challenge of maintaining safe separation among aircraft.
TCAS II, of course, works best when the airplanes that are on a potential collision course are both equipped with the system, so that two TCAS units can communicate and coordinate evasive maneuvers. There can be no such coordination if the passenger aircraft is equipped with TCAS and the cargo plane is not.
The Safety Board is aware that the FAA and industry are engaged in joint efforts to develop advanced methods of traffic separation as part of "free flight." Implementation of free flight would allow aircraft to cooperatively plan and execute their optimal flightpaths with minimal interference from ground-based controllers. The need for airborne collision avoidance systems in all transport-category airplanes is likely to be heightened in this new environment in which there is reduced controller interaction.
The Safety Board strongly supports more widespread installation of TCAS II in aircraft using the national airspace system, including in all cargo, large transport category aircraft. Mr. Chairman, we do not need more incidents like the one at 33,000 feet over Kansas last week to tell us that we need the installation of a traffic collision avoidance system in all large aircraft.
Although there had been a slight downward trend in runway incursions from 1990 to 1993, the number and rate have been moving up steadily since that time. For example, in 1997 there were 300 incursions-up from 275 in 1996. In 1998, there were 326 incursions. According to the FAA's Web site, in September 1998, the monthly rate (0.73 incursions per 100,000 operations) was the highest monthly rate in 11 years. Below is a chart that shows FAA information regarding the number of runway incursions from 1993 through 1998, along with the rate per 100,000 operations.
| Year | Number of
incursions |
Rate per 100,000
operations |
| 1993 | 188 | 0.30 |
| 1994 | 200 | 0.32 |
| 1995 | 240 | 0.39 |
| 1996 | 275 | 0.44 |
| 1997 | 300 | 0.46 |
| preliminary 1998 | 326 | 0.50 |
Mr. Chairman, this trend must be reversed. We remain concerned that FAA efforts to address runway incursions through technological development falls short of what is needed. The FAA has made some progress in the installation of the Airport Surface Detection Equipment (ASDE-3) radar systems which will go far to improving runway safety. The latest figures from the FAA indicate that 40 ASDE-3 systems have been commissioned. Except for the installation and current testing of Airport Movement Area Safety Systems (AMASS) at the San Francisco, St. Louis, Detroit, and Atlanta, we have seen little progress in the development and installation of AMASS -- designed to alert controllers to an impending surface incident. We remain concerned that technical problems with this much-needed system continue, such that AMASS has not yet progressed expeditiously from a developmental to an operational system.
Of further concern is the fact that AMASS will only be installed at 39 large airports, which leaves scores of other air carrier airports without redundant systems to prevent ground collisions. Currently, there are several low-cost runway incursion systems under development that could enhance safety at many airports. However, none of these systems are operational, nor have any been certified by the FAA.
The FAA has studied this issue for years and has developed several action plans. Just last year, the FAA announced that reducing runway incursions was one of its top priorities and issued the Airport Surface Operation Safety Action Plan. However, implementation of that plan has not yet been finalized. As a result, real world changes and improvements in surface operations have not occurred, while traffic volume is increasing and congestion is worsening. It is time, Mr. Chairman, for the FAA to expeditiously move forward with real world changes - such as those mentioned above -- that will reverse the upward trend in the number and rate of runway incursions.
