Understanding Air Safety in the Jet Age/Printable version

Understanding Air Safety in the Jet Age

The current, editable version of this book is available in Wikibooks, the open-content textbooks collection, at
https://en.wikibooks.org/wiki/Understanding_Air_Safety_in_the_Jet_Age

Permission is granted to copy, distribute, and/or modify this document under the terms of the Creative Commons Attribution-ShareAlike 3.0 License.

The Dawn of the Jet Age

The British de Havilland Comet was the first jet airliner to fly (1949), the first in service (1952), and the first to offer a regular jet-powered transatlantic service (1958). One hundred and fourteen of all versions were built but the Comet 1 had serious design problems, and out of nine original aircraft, four crashed (one at takeoff and three broke up in flight), which grounded the entire fleet. The Comet 4 solved these problems but the program was overtaken by the Boeing 707 on the trans-Atlantic run. The Comet 4 was developed into the Hawker Siddeley Nimrod which retired in June 2011.

Following the grounding of the Comet 1, the Tu-104 became the first jet airliner to provide a sustained and reliable service, its introduction having been delayed pending the outcome of investigations into the Comet crashes. It was the world's only jet airliner in operation between 1956 and 1958 (after which the Comet 4 and Boeing 707 entered service). The plane was operated by Aeroflot (from 1956) and Czech Airlines ČSA (from 1957). ČSA became the first airline in the world to fly jet-only routes, using the Tu-104A variant.

The first western jet airliner with significant commercial success was the Boeing 707. It began service on the New York City|New York to London route in 1958, the first year that more trans-Atlantic passengers traveled by air than by ship. Comparable long-range airliner designs were the DC-8, VC10 and Il-62. The Boeing 747, the "Jumbo jet", was the first widebody aircraft that reduced the cost of flying and further accelerated the Jet Age.

One exception to the domination by turbofan engines was the turboprop-powered Tupolev Tu-114 (first flight 1957). This airliner was able to match or even exceed the performance of contemporary jets, however the use of such powerplants in large airframes was restricted to the military after 1976.

Jet airliners are able to fly much higher, faster, and further than piston-powered propliners, making transcontinental and intercontinental travel considerably faster and easier than in the past. Aircraft making long transcontinental and trans-oceanic flights could now fly to their destinations non-stop, making much of the world accessible within a single day's travel for the first time. As demand grew, airliners became larger, further reducing the cost of air travel. People from a greater range of social classes could afford to travel outside of their own countries.

General aviation

The use of mass-production techniques similar to those of the motor industry lowered the cost of private aircraft, with types such as the Cessna 172 and Beechcraft Bonanza seeing widespread use, the 172 eclipsing even wartime production levels.

Aircraft came to be used increasingly in specialist roles such as crop spraying, policing, fire fighting, air ambulances and many others.

As helicopter technology developed, they also came into widespread use, dominated by Sikorsky's approach of a single main rotor plus tail counter-torque rotor.

Sport flying also developed, with both powered aeroplanes and gliders becoming more sophisticated. The introduction of glass fibre construction allowed sailplanes to achieve new levels of performance. In the 1960s the re-introduction of the hang-glider, now using the flexible Rogallo wing, ushered in a new era of ultralight aircraft.

The development of safe gas burners led to the re-introduction of hot air ballooning, and it became a popular sport.

Supersonic transport

The introduction of the Concorde supersonic transport (SST) airliner to regular service in 1976 was expected to bring similar social changes, but the aircraft never found commercial success. After several years of service, the fatal crash of Air France Flight 4590 near Paris in July 2000 and other factors eventually caused Concorde flights to be discontinued in 2003. This was the only loss of an SST in civilian service. Only one other SST design was used in a civilian capacity, the Soviet era Tu-144, but it was soon withdrawn due to high maintenance and other issues. McDonnell Douglas, Lockheed and Boeing were three U.S. manufacturers that had originally planned to develop various SST designs since the 1960s, but these projects were eventually abandoned for various developmental, cost, and other practical reasons.

Ground activities

Manufacturing

The fabrication of riveted stressed-skin aluminium airframes was widespread by the end of the Second World War, although the use of wood for private aviation continued. The pursuit of greater strength for less weight led to the introduction of advanced, and often expensive, manufacturing techniques. Key developments during the 1960s and 70s included; milling a complex part from a solid billet rather than building it up from smaller parts, the use of synthetic resin adhesives in place of rivets to avoid stress concentrations and fatigue around the rivet holes, and electron beam welding.

The development of composite materials such as fibreglass and, later, carbon fibre, freed up designers to make more fluid, aerodynamic shapes. However the unknown properties of these novel materials meant that introduction has been slow and methodical.

Airports

Many military aerodromes became civilian airports after the war, while pre-war airports reverted to their former role. The rapid growth in air travel ushered in by the jet age required an equally rapid enlargement of airport facilities worldwide.

As jet airliners grew larger and passenger numbers per flight increased, larger and more sophisticated equipment was developed for handling the aircraft, passengers and baggage.

Radar systems became commonplace, with Air traffic control facilities needed to manage the large number of aircraft in the sky at any one time.

Runways were made longer and smoother to accommodate new, larger and faster aircraft, while safety considerations and night flying led to much improved runway lighting.

Major airports became such vast and busy places that their environmental impact became substantial and the siting of any new airport, or even the expansion of an existing one, became a major social and political affair.

Metal Fatigue

Metal fatigue was worsened by the design choices used on the de Havilland Comet, eventually leading to catastrophic failure. Modern aircraft must still contend with the issue.

Without exception modern airliners rely almost exclusively on metal for their structure. All metals suffer from fatigue to some degree. Fatigue occurs when repeated loading leads to progressive structural damage and the growth of cracks. Once a fatigue crack has started, it will grow slightly with each loading cycle. The crack will continue to grow until it reaches a critical size at which point it will grow rapidly and lead to the complete fracture of the structure. Because of the dangers of fatigue, the concept of a failsafe was introduced. A failsafe is a secondary structure that will carry the load if the primary mechanism fails. Unfortunately it is usually weaker than the primary structure and provides only a short window for the failure to be found if disaster is to be avoided.

Accidents involving metal fatigue have been happening since the very first jet airliner took to the sky. They all have at least one of the following characteristics: poor design, flawed maintenance or inadequate repairs. Unfortunately the industry as a whole doesn't seem to have learnt and fatigue induced accidents continue with frightening regularity. Therefore vigilant maintenance is the only solution for an aircraft with a metal structure.

Fire Down Below - ValuJet Flight 592

A number of factors would be involved in the incident involving ValuJet Flight 592.

Fires can occur anywhere. The most common, perhaps unsurprisingly, are engine fires. But bad decisions and bad practice can put a plane at risk from fire in more unusual ways. ValuJet Flight 592 was a DC-9 on a domestic passenger flight between Miami International Airport, in Florida, and Hartsfield-Jackson Atlanta International Airport in Georgia. It disappeared over the Florida Everglades on 11 May 1996.

There were 105 passengers on board, as well as a crew of two pilots and three flight attendants, bringing the total number of people on board to 110. At 2:04 pm, 10 minutes before the disaster, the DC-9 took off from runway 9L and began a normal climb.

At 2:10 pm, Captain Candalyn Kubeck and First Officer Richard Hazen heard a loud bang in their headphones, and noticed the plane was losing electrical power. Seconds later, flight attendant Mandy Summers entered the cockpit and advised the flight crew of a fire in the passenger cabin. Passengers' shouts of "fire, fire, fire" were recorded on the plane's cockpit voice recorder when the cockpit door was opened. Though the ValuJet flight attendant manual stated that the cockpit door should not be opened when smoke or other harmful gases might be present in the cabin, the intercom was disabled and there was no other way to inform the pilots of what was happening.

Kubeck and Hazen immediately asked air traffic control for a return to Miami due to smoke in the cockpit and cabin, and were given instructions for a return to the airport. One minute later, Hazen requested the nearest available airport. Kubeck began to turn the plane left in preparation for the return to Miami.

Flight 592 disappeared from radar at 2:13:42 pm. It rolled onto its side and crashed to the ground nose-first in the Francis S. Taylor Wildlife Management Area in the Everglades, a few miles west of Miami, at a speed in excess of 500 mph. The crew continued to fly the plane until about seven seconds before impact, likely until the front left floor beams collapsed and caused failure of the flight controls. Everyone on board was killed. Recovery of the aircraft and victims was made extremely difficult by the location of the crash. The nearest road of any kind was more than a quarter of a mile away from the crash scene, and the location of the crash itself was a deep-water swamp. The DC-9 shattered on impact leaving very few large portions of the plane intact. Sawgrass, alligators, and risk of bacterial infection from cuts plagued searchers involved in the recovery effort. No intact bodies were ever recovered, only human remains.

Investigation

The NTSB investigation eventually determined that the fire that downed Flight 592 began in a cargo compartment below the passenger cabin. The cargo compartment was of a Class D design, in which fire suppression is accomplished by sealing off the hold from outside air. Any fire in such an airtight compartment will in theory quickly exhaust all available oxygen and then burn itself out. As the fire suppression is accomplished without any intervention by the crew, such holds are not equipped with smoke detectors. However, the NTSB determined that just before takeoff, expired chemical oxygen generators were placed in the cargo compartment in five boxes marked COMAT (Company-Owned MATerial) by ValuJet's maintenance contractor, SabreTech, in contravention of FAA regulations forbidding the transport of hazardous materials in aircraft cargo holds. Failure to cover the firing pins for the generators with the prescribed plastic caps made an accidental activation much more likely. Rather than covering the firing pins, the SabreTech workers simply taped the cords around the cans, or cut them, and used tape to stick the ends down. It is also possible that the cylindrical, tennis ball can-sized generators were loaded on board in the mistaken belief that they were just empty canisters, thus being certified as safe to transport in an aircraft cargo compartment. SabreTech employees indicated on the cargo manifest that the "oxy canisters" were "empty" instead of being expired oxygen generators. ValuJet employees interpreted this to mean that they were empty oxygen canisters, when in fact they were neither simple oxygen canisters, nor empty.

Chemical oxygen generators, when activated, produce oxygen. As a byproduct of the exothermic chemical reaction, they also produce a great quantity of heat. These two together were sufficient not only to start an accidental fire, but also to produce enough oxygen to keep the fire burning. The fire risk was made much worse by the presence of combustible aircraft wheels in the hold. Two main tyres and wheels and a nose tyre and wheel were also included in the COMAT. NTSB investigators theorized that when the plane experienced a slight jolt while taxiing on the runway, an oxygen generator activated, producing oxygen and heat. Laboratory testing showed that canisters of the same type could heat nearby materials up to 250C, enough to ignite a smouldering fire. The oxygen from the generators fed the resulting fire in the cargo hold without any need for outside air, defeating the airtight fire suppression design. A pop and jolt heard on the cockpit voice recorder and correlated with a brief and dramatic spike in the altimeter reading in the flight data recorder were attributed to the sudden cabin pressure change caused by a semi-inflated aircraft wheel in the cargo hold exploding in the fire.

Smoke detectors in the cargo holds can alert the flight crew of a fire long before the problem becomes apparent in the cabin, and a fire suppression system buys valuable time to land the plane safely. In February 1998, the FAA issued revised standards requiring all Class D cargo holds to be converted by early 2001 to Class C or E; these types of holds have additional fire detection and suppression equipment. For the victims it was far too late.

The NTSB report placed responsibility for the accident on three parties:

• SabreTech, for improperly packaging and storing hazardous materials,
• ValuJet, for not supervising SabreTech, and
• the FAA, for not mandating smoke detection and fire suppression systems in cargo holds.

ValuJet was grounded by the FAA on June 16, 1996. It was allowed to resume flying again on September 30, but never recovered from the crash. In 1997, the company merged with AirTran Airways. Although ValuJet was the nominal survivor, the ValuJet name was so tarnished by this time that it was scrapped in favor of the AirTran name. In 2006, AirTran did not make any major announcements on the crash's 10th anniversary out of respect for the victims' families.

Many families of the Flight 592 victims were outraged that ValuJet was not prosecuted, given the airline's poor safety record. ValuJet's accident rate was not only one of the highest in the low-fare sector, but 14 times higher than those of the major airlines. In the aftermath of the accident, an internal FAA memo surfaced questioning whether ValuJet should have been allowed to stay in the air. The victims' families also point to statements made by ValuJet officials immediately after the crash that appeared to indicate the company knew the generators were on the plane, and in fact had ordered them returned to Atlanta rather than properly disposed of in Miami.

Hanging on by the Fingertips - British Airways Flight 5390

When British Airways Flight 5390 took off from Birmingham Airport for the short hop to Málaga nobody could have predicted the dramatic events that would follow 15 minutes later. Extraordinary airmanship and courage from the crew would return the BAC One-Eleven, registration GBJRT, to the ground with no loss of life. The captain was 42-year-old Tim Lancaster, who had logged 11,050 flight hours, including 1,075 hours on the BAC One-eleven; the copilot was 39-year-old Alastair Atchison, with 7,500 flight hours, with 1,100 of them on the BAC One-eleven. Atchison would need every hour of that experience to save the 81 passengers and four cabin crew.

After a routine take-off at 08:20, the plane climbed out of Birmingham. With everything normal, both pilots released their shoulder harnesses and Captain Lancaster loosened his lap belt. By 08:33 the plane had climbed through about 17,300 ft and was passing over Oxfordshire. The cabin crew began preparing the meal service. Checking in with the flight crew, Air Steward Nigel Ogden had just entered the cockpit when there was a loud bang as the left windscreen panel, in front of Captain Lancaster, exploded outwards, decompressing the plane and filling the cabin with condensation. With his seat belt loose, Lancaster was propelled out of his seat by the rushing air from the decompression and forced head first out of the flight deck. His knees were caught on the flight controls and his upper torso remained outside the aircraft, exposed to extreme wind and cold. To make matters worse, the autopilot disengaged, causing the plane to descend rapidly. The decompression had also blown the flight deck door onto the control console, blocking the throttle control and causing the aircraft to gain speed as it descended. Adding to the confusion, papers and debris blew into the flight deck from the passenger cabin. Reacting with astonishing speed, Ogden grabbed Lancaster's belt, preventing him from being dragged out of the plane - something that would have both killed the captain and imperilled the plane if his body had impacted the wings or engines. Meanwhile the other two air stewards secured loose objects, reassured passengers, and instructed them to adopt brace position] in anticipation of an emergency landing.

Atchison had taken control immediately after the decompression and continued the emergency descent to reach an altitude with sufficient air pressure. Once low enough, he re-engaged the autopilot and broadcast a distress call, requesting clearance for an immediate approach to the nearest airport, but he was unable to hear the response from air traffic control because of wind noise; the difficulty in establishing two-way communication led to a delay in initiation of emergency procedures.

Ogden was still holding on to Lancaster, but was reaching the limit of his endurance and was developing frostbite. Chief steward John Heward and air steward Simon Rogers took over the task of holding on to the captain. By this time Lancaster had shifted several inches farther outside and his head was repeatedly striking the side of the fuselage. The crew believed him to be dead, but Atchison told the others to continue holding onto him, out of fear that letting go of him might cause him to strike the left wing, engine, or horizontal stabiliser, potentially damaging it.

Eventually, Atchison was able to hear the clearance from air traffic control to make an emergency landing at Southampton Airport. The air stewards managed to free Lancaster's ankles from the flight controls while still keeping hold of him. At 08:55 , the aircraft landed at Southampton and the passengers disembarked using boarding steps. Miraculously, Lancaster survived with relatively minor injuries: frostbite, bruising, shock, and fractures to his right arm, left thumb and right wrist. Later Atchison and cabin crew members Susan Gibbins and Nigel Ogden were awarded the Queen's Commendation for Valuable Service in the Air for their actions.

Police found the windscreen panel and many of the 90 bolts securing it near Cholsey, Oxfordshire. Investigators found that when the windscreen was installed 27 hours before the flight, 84 of the bolts used were too small in diameter and the remaining six were the correct diameter but too short. How had such an error occurred? The previous windscreen had also been fitted using incorrect bolts, which were replaced by the shift maintenance manager on a like-for-like basis without reference to maintenance documentation, as the plane was due to depart shortly. The undersized bolts were unable to withstand the air pressure difference between the cabin and the outside atmosphere during flight. The final report was particularly telling. Not only had the shift maintenance manager responsible for installing the incorrect bolts failed to follow British Airways policies but he had not been wearing his normal spectacles, which impacted his ability to read the documentation. The policies compounded the problem by not requiring supervision or checking of work. Without extraordinary luck, and incredible airmanship, 87 people could have lost their lives due to a failure to wear glasses.

Bad Design, Bad Maintenance - TWA 800

The investigation that followed the midair explosion of TWA 800 on 17 July 1996 would be the longest, most complex and expensive in U.S. history. It would also prove to be controversial and give rein to accusations of cover-up and conspiracy. Ultimately though, the disaster would be shown to be due to the most prosaic of causes: bad design and shoddy maintenance.

Trans World Airlines Flight 800 was a Boeing 747-131. The aircraft, registration N93119, was manufactured in July 1971; it had been ordered by Eastern Air Lines, but after Eastern canceled its 747 orders, the plane was purchased new by Trans World Airlines. It had completed 16,869 flights with 93,303 hours of operation. The day of the accident, the plane departed from Athens and arrived at John F. Kennedy International Airport (JFK) where it was refueled and the crew changed. The crew for the upcoming flight was 58-year-old Captain Ralph G. Kevorkian, with 18,800 flight hours, 57-year-old Captain/Check Airman Steven E. Snyder with 17,000 flight hours, and 63-year-old Flight Engineer/Check Airman Richard G. Campbell, as well as 25-year-old flight engineer trainee Oliver Krick, who was starting the sixth leg of his initial operating experience training. While Snyder was officially the captain, the planned flight was a training flight for Kevorkian and he was, therefore, seated in the captain's (left) seat.

The ground-maintenance crew locked out the thrust reverser for engine #3 because of technical problems with the thrust reverser sensors during the inbound landing at JFK, prior to Flight 800's departure. Additionally, severed cables for the engine #3 thrust reverser were replaced. During refueling of the aircraft, the volumetric shutoff (VSO) control was believed to have been triggered before the tanks were full. To continue the pressure fueling, a TWA mechanic overrode the automatic VSO by pulling the volumetric fuse and an overflow circuit breaker. Maintenance records indicate that the airplane had numerous VSO-related maintenance writeups in the weeks before the accident.

TWA 800 was scheduled to depart JFK for Charles de Gaulle Airport around 7:00 p.m., but the flight was delayed until 8:02 p.m. by a disabled piece of ground equipment and a passenger/baggage mismatch. After the owner of the baggage in question was confirmed to be on board, the flight crew prepared for departure and the aircraft pushed back from Gate 27 at the TWA Flight Center. The flight crew started the engines at 8:04 pm. however, because of the previous maintenance undertaken on engine #3, the flight crew only started engines #1, #2, and #4. Engine #3 was started ten minutes later at 8:14 pm. Taxi and takeoff proceeded uneventfully.

Flight path of TWA 800. The colored rectangles are areas from which wreckage was recovered.

TWA 800 then received a series of heading changes and generally increasing altitude assignments as it climbed to its intended cruising altitude. Weather in the area was benign with light winds and scattered clouds. The last radio transmission from the airplane occurred at 8:30 p.m. when the flight crew received and then acknowledged instructions from Boston Air Route Traffic Control Center to climb to 15,000 ft. The last recorded radar transponder return from the airplane was recorded by the Federal Aviation Administration (FAA) radar site at Trevose, Pennsylvania at 8:31:12 p.m.

What happened next stunned onlookers. Thirty-eight seconds after the last contact the captain of an Eastwind Airlines Boeing 737 reported to Boston ARTCC that he "just saw an explosion out here", adding, "we just saw an explosion up ahead of us here... about 16,000 ft or something like that, it just went down into the water." Subsequently, many air traffic control facilities in the New York/Long Island area received reports of an explosion from other pilots operating in the area. Many witnesses in the vicinity of the crash stated that they saw or heard explosions, accompanied by a large fireball or fireballs over the ocean, and observed debris, some of which was burning while falling into the water.

Various civilian, military, and police vessels reached the crash site and searched for survivors within minutes of the initial water impact, but found none, making TWA 800 the second-deadliest aircraft accident in United States history at that time.

The NTSB was notified about 8:50 p.m. the day of the accident; a full "go team" was assembled in Washington, D.C. and arrived on scene early the next morning. Meanwhile, initial witness descriptions led many to believe the cause of the crash was a bomb or surface-to-air missile attack. Given the potential for criminal causes, the FBI initiated a parallel investigation alongside the NTSB's accident investigation.

The search-and-rescue began immediately: a helicopter of the New York Air National Guard saw the explosion from approximately eight miles away, and arrived on scene so quickly that debris was still raining down, and the aircraft had to pull away. They reported their sighting to the tower at Suffolk County Airport. Later, remote-operated vehicles (ROVs), side-scan sonar, and laser line-scanning equipment were used to search for and investigate underwater debris fields. Victims and wreckage were recovered by scuba divers and ROVs; later scallop trawlers were used to recover wreckage embedded in the sea floor. In one of the largest diver-assisted salvage operations ever conducted, often working in very difficult and dangerous conditions, over 95% of the airplane wreckage was eventually recovered. The search and recovery effort identified three main areas of wreckage underwater :the yellow zone, red zone, and green zone contained wreckage from front, center, and rear sections of the airplane, respectively. The green zone with the tail section of the aircraft was located the furthest along the flight path.

Wreckage recovered with tangled and damaged wires attached.

Pieces of wreckage were transported by boat to shore and then by truck to leased hangar space at the former Grumman Aircraft facility in Calverton, New York, for storage, examination, and reconstruction. This facility became the command center and headquarters for the investigation. NTSB and FBI personnel were present to observe all transfers to preserve the evidentiary value of the wreckage. The cockpit voice recorder and flight data recorder were recovered by U.S. Navy divers one week after the accident; they were immediately shipped to the NTSB laboratory in Washington, D.C., for readout. The victims' remains were transported to the Suffolk County Medical Examiner's Office in Hauppauge, New York.

Tensions in the investigation

Relatives of TWA 800 passengers and crew, as well as the media, gathered at the Ramada Plaza JFK Hotel. Many waited until the remains of their family members had been recovered, identified, and released. This hotel became known as the "Heartbreak Hotel" for its role in handling families of victims of several airliner crashes.

Grief turned to anger at TWA's delay in confirming the passenger list, conflicting information from agencies and officials, and mistrust of the recovery operation's priorities. Although NTSB vice chairman Robert Francis stated that all bodies were being retrieved as soon as they were spotted, and that wreckage was being recovered only if divers believed that victims were hidden underneath, many families were suspicious that investigators were not being truthful, or withholding information.

Much anger and political pressure was also directed at Suffolk County Medical Examiner Dr. Charles V. Wetli as recovered bodies backlogged at the morgue. Under constant and considerable pressure to identify victims with minimal delay, pathologists worked non-stop. Since the primary objective was to identify all remains rather than performing a detailed forensic autopsy, the thoroughness of the examinations was highly variable. Ultimately, remains of all 230 victims were recovered and identified, the last over 10 months after the crash.

With lines of authority unclear, differences in agendas and culture between the FBI and NTSB resulted in discord. The FBI, from the start assuming that a criminal act had occurred, saw the NTSB as indecisive. Expressing frustration at the NTSB's unwillingness to speculate on a cause, one FBI agent described the NTSB as "No opinions. No nothing." Meanwhile, the NTSB was required to refute or play down speculation about conclusions and evidence, frequently supplied to reporters by law enforcement officials and politicians. The International Association of Machinists and Aerospace Workers, an invited party to the NTSB investigation, criticized the undocumented removal by FBI agents of wreckage from the hangar where it was stored.

Witness interviews

An FBI witness statement summary (with personal information redacted).

Although there were considerable discrepancies between different accounts, most witnesses to the accident had seen a "streak of light" that was described by 38 of 258 witnesses as ascending, moving to a point where a large fireball appeared, with several witnesses reporting that the fireball split in two as it descended toward the water. There was intense public interest in these witness reports and much speculation that the reported streak of light was a missile that had struck TWA 800, causing the airplane to explode. These witness accounts were a major reason for the initiation and duration of the FBI's criminal investigation.

Approximately 80 FBI agents conducted interviews with potential witnesses daily. No verbatim records of the witness interviews were produced; instead, the agents who conducted the interviews wrote summaries that they then submitted. Witnesses were not asked to review or correct the summaries. Included in some of the witness summaries were drawings or diagrams of what the witness observed. Witnesses were not allowed to testify at the court hearings.

Within days of the crash the NTSB announced its intent to form its own witness group and to interview witnesses to the crash. After the FBI raised concerns about non-governmental parties in the NTSB's investigation having access to this information and possible prosecutorial difficulties resulting from multiple interviews of the same witness, the NTSB deferred and did not interview witnesses to the crash. A Safety Board investigator later reviewed FBI interview notes and briefed other Board investigators on their contents. In November 1996, the FBI agreed to allow the NTSB access to summaries of witness accounts in which personally identifying information had been redacted and to conduct a limited number of witness interviews. In April 1998, the FBI provided the NTSB with the identities of the witnesses but due to the time elapsed a decision was made to rely on the original FBI documents rather than reinterview witnesses.

Further investigation and analysis

Examination of the cockpit voice recorder (CVR) and flight data recorder data showed a normal takeoff and climb, with the aircraft in normal flight before both abruptly stopped at 8:31:12 pm. At 8:29:15 pm, Captain Kevorkian was heard to say, "Look at that crazy fuel flow indicator there on number four... see that?" A loud noise recorded on the last few tenths of a second of the CVR was similar to the last noises recorded from other airplanes that had experienced in-flight breakups. This, together with the distribution of wreckage and witness reports, all indicated a sudden catastrophic in-flight breakup of TWA 800.

Possible causes of the in-flight breakup

Investigators considered several possible causes for the structural breakup: structural failure and decompression, detonation of a high-energy explosive device, such as a missile warhead exploding either upon impact with the airplane, or just before impact, a bomb exploding inside the airplane, or a fuel-air explosion in the center wing fuel tank.

Structural failure and decompression

Close examination of the wreckage revealed no evidence of structural faults such as fatigue, corrosion or mechanical damage that could have caused the in-flight breakup. It was also suggested that the breakup could have been initiated by an in-flight separation of the forward cargo door like the disasters on board Turkish Airlines Flight 981 or United Airlines Flight 811, but all evidence indicated that the door was closed and locked at impact. The NTSB concluded that "the in-flight breakup of TWA flight 800 was not initiated by a preexisting condition resulting in a structural failure and decompression."

Missile or bomb detonation

A review of recorded data from long-range and airport surveillance radars revealed multiple contacts of airplanes or objects in TWA 800's vicinity at the time of the accident. None of these contacts intersected TWA 800's position at any time. Attention was drawn to data from the Islip, New York, ARTCC facility that showed three tracks in the vicinity of TWA 800 that did not appear in any of the other radar data. None of these sequences intersected TWA 800's position at any time either. All the reviewed radar data showed no radar returns consistent with a missile or other projectile traveling toward TWA 800.

The NTSB addressed allegations that the Islip radar data showed groups of military surface targets converging in a suspicious manner in an area around the accident, and that a 30-knot radar track, never identified and 3 nautical miles from the crash site, was involved in foul play, as evidenced by its failure to divert from its course and assist with the search and rescue operations. Military records examined by the NTSB showed no military surface vessels within 15 NM of TWA 800 at the time of the accident. In addition, the records indicated that the closest area scheduled for military use, warning area W-387A/B, was 160 NM south.

The NTSB reviewed the 30-knot target track to try to determine why it did not divert from its course and proceed to the area where the TWA 800 wreckage had fallen. TWA 800 was behind the target, and with the likely forward-looking perspective of the target's occupant(s), the occupants would not have been in a position to observe the aircraft's breakup or subsequent explosions or fireball(s). Additionally, it was unlikely that the occupants of the target track would have been able to hear the explosions over the sound of its engines and the noise of the hull traveling through water, even more so if the occupants were in an enclosed bridge or cabin. Further, review of the Islip radar data for other similar summer days and nights in 1999 indicated that the 30-knot track was consistent with normal commercial fishing, recreational, and cargo vessel traffic.

• Recorded radar data
• 
  Radar data showing vehicle and/or object tracks within 10 NM of TWA flight 800 just before the accident.
• 
  Three sequences of primary returns near TWA 800 that were only recorded by the Islip radar.
• 
  Primary radar returns that appeared near the TWA 800 after 8:31:12 pm. The 30-knot track is at the bottom center of the image.

Trace amounts of explosive residue were detected on three samples of material from three separate locations of the recovered airplane wreckage (described by the FBI as a piece of canvas-like material and two pieces of a floor panel). These samples were submitted to the FBI's laboratory in Washington, D.C., which determined that one sample contained traces of cyclotrimethylenetrinitramine (RDX), another nitroglycerin, and the third a combination of RDX and pentaerythritol tetranitrate (PETN); these findings received much media attention at the time. In addition, the backs of several damaged passenger seats were observed to have an unknown red/brown-shaded substance on them. According to the seat manufacturer, the locations and appearance of this substance were consistent with adhesive used in the construction of the seats, and additional laboratory testing by NASA identified the substance as being consistent with adhesives.

Further examination of the airplane structure, seats, and other interior components found no damage typically associated with a high-energy explosion of a bomb or missile warhead ("severe pitting, cratering, petalling, or hot gas washing"). This included the pieces on which trace amounts of explosives were found. Of the 5 percent of the fuselage that was not recovered, none of the missing areas were large enough to have covered all the damage that would have been caused by the detonation of a bomb or missile. None of the victims' remains showed any evidence of injuries that could have been caused by high-energy explosives.

The NTSB considered the possibility that the explosive residue was due to contamination from the aircraft's use in 1991 transporting troops during the Gulf War or its use in a dog-training explosive detection exercise about one month before the accident. Testing conducted by the FAA's Technical Center indicated that residues of the type of explosives found on the wreckage would dissipate completely after two days of immersion in sea water (almost all recovered wreckage was immersed longer than two days). The NTSB concluded that it was "quite possible" that the explosive residue detected was transferred from military ships or ground vehicles, or the clothing and boots of military personnel, onto the wreckage during or after the recovery operation and was not present when the aircraft crashed into the water.

Although it was unable to determine the exact source of the trace amounts of explosive residue found on the wreckage, the lack of any other corroborating evidence associated with a high-energy explosion led the NTSB to conclude that "the in-flight breakup of TWA flight 800 was not initiated by a bomb or missile strike."

Fuel-air explosion in the center wing fuel tank

The wing center section of a Boeing 747-100, including the CWT.

Scale-model test of a CWT fuel/air vapor explosion

In order to evaluate the sequence of structural breakup of the airplane, the NTSB formed the Sequencing Group, which examined individual pieces of the recovered structure, two-dimensional reconstructions or layouts of sections of the airplane, and various-sized three-dimensional reconstructions of portions of the airplane. In addition, the locations of pieces of wreckage at the time of recovery and differences in fire effects on pieces that are normally adjacent to each other were evaluated. The Sequencing Group concluded that the first event in the breakup sequence was a fracture in the wing center section of the aircraft, caused by an "overpressure event" in the center wing fuel tank (CWT). An overpressure event was defined as a rapid increase in pressure resulting in failure of the structure of the CWT.

Because there was no evidence that an explosive device detonated in this (or any other) area of the airplane, this overpressure event could only have been caused by a fuel/air explosion in the CWT. There were Template:Convert/gal of fuel in the CWT of TWA 800; tests recreating the conditions of the flight showed the combination of liquid fuel and fuel/air vapor to be flammable. A major reason for the flammability of the fuel/air vapor in the CWT of the 747 was the large amount of heat generated and transferred to the CWT by air conditioning packs located directly below the tank; with the CWT temperature raised to a sufficient level, a single ignition source could cause an explosion.

Computer modeling and scale-model testing were used to predict and demonstrate how an explosion would progress in a 747 CWT. During this time, quenching was identified as an issue, where the explosion would extinguish itself as it passed through the complex structure of the CWT. Because the research data regarding quenching was limited, a complete understanding of quenching behavior was not possible, and the issue of quenching remained unresolved.

In order to better determine whether a fuel/air vapor explosion in the CWT would generate sufficient pressure to break apart the fuel tank and lead to the destruction of the airplane, tests were conducted in July and August 1997, using a retired Air France 747 at Bruntingthorpe Airfield, England. These tests simulated a fuel/air explosion in the CWT by igniting a propane/air mixture; this resulted in the failure of the tank structure due to overpressure. While the NTSB acknowledged that the test conditions at Bruntingthorpe were not fully comparable to the conditions that existed on TWA 800 at the time of the accident, previous fuel explosions in the CWTs of commercial airliners such as Avianca Flight 203 and Philippine Airlines Flight 143 confirmed that a CWT explosion could break apart the fuel tank and lead to the destruction of an airplane.

Ultimately, based on "the accident airplane's breakup sequence; wreckage damage characteristics; scientific tests and research on fuels, fuel tank explosions, and the conditions in the CWT at the time of the accident; and analysis of witness information," the NTSB concluded that "the TWA flight 800 in-flight breakup was initiated by a fuel/air explosion in the CWT."

In-flight breakup sequence and crippled flight

• Debris fields
• 
  Map showing the locations of the red, yellow, and green zones.
• 
  Wreckage found in each zone corresponded to specific areas of the aircraft.
• 
  The pathways the wreckage took as it fell to the ocean.

Slide from NTSB presentation of TWA 800 breakup sequence, illustrating structure and size of CWT.

Recovery locations of the wreckage from the ocean (the red, yellow, and green zones) clearly indicated that: (1) the red area pieces (from the forward portion of the wing center section and a ring of fuselage directly in front) were the earliest pieces to separate from the airplane; (2) the forward fuselage section departed simultaneously with or shortly after the red area pieces, landing relatively intact in the yellow zone; (3) the green area pieces (wings and the aft portion of the fuselage) remained intact for a period after the separation of the forward fuselage, and impacted the water in the green zone.

Frame from the CIA's animated depiction of how TWA Flight 800 broke apart. When the bottom of the aircraft blew out from the exploding fuel tank, cracks spread around the fuselage and severed the entire front section of the plane.

Fire damage and soot deposits on the recovered wreckage indicated that some areas of fire existed on the airplane as it continued in crippled flight after the loss of the forward fuselage. After about 34 seconds (based on information from witness documents), the outer portions of both the right and left wings failed. Shortly after, the left wing separated from what remained of the main fuselage, which resulted in further development of the fuel-fed fireballs as the pieces of wreckage fell to the ocean.

Only the FAA radar facility in North Truro, Massachusetts, using specialized processing software from the United States Air Force 84th Radar Evaluation Squadron, was capable of estimating the altitude of TWA 800 after it lost power due to the CWT explosion. Because of accuracy limitations, this radar data could not be used to determine whether the aircraft climbed after the nose separated. Instead, the NTSB conducted a series of computer simulations to examine the flightpath of the main portion of the fuselage. Hundreds of simulations were run using various combinations of possible times the nose of TWA 800 separated (the exact time was unknown), different models of the behavior of the crippled aircraft (the aerodynamic properties of the aircraft without its nose could only be estimated), and longitudinal radar data (the recorded radar tracks of the east/west position of TWA 800 from various sites differed). These simulations indicated that after the loss of the forward fuselage the remainder of the aircraft continued in crippled flight, then pitched up while rolling to the left (north), climbing to a maximum altitude between 15,537 and 16,678 feet (4,736 and 5,083 m) from its last recorded altitude, 13,760 feet (4,190 m).

Analysis of reported witness observations

Most witness observations of a streak of light were determined by the NTSB to be consistent with the calculated flightpath of TWA 800 after the CWT explosion (screenshot from an NTSB animation).

At the start of FBI's investigation, because of the possibility that international terrorists might have been involved, assistance was requested from the CIA (US Central Intelligence Agency. CIA analysts, relying on sound-propagation analysis, concluded that the witnesses could not be describing a missile approaching an intact aircraft, but were seeing a trail of burning fuel coming from the aircraft after the initial explosion. This conclusion was reached after calculating how long it took for the sound of the initial explosion to reach the witnesses, and using that to correlate the witness observations with the accident sequence. In all cases the witnesses could not be describing a missile approaching an intact aircraft, as the plane had already exploded before their observations began.

As the investigation progressed, the NTSB decided to form a witness group to more fully address the accounts of witnesses. From November 1996 through April 1997 this group reviewed summaries of witness accounts on loan from the FBI (with personal information redacted), and conducted interviews with crewmembers from a New York Air National Guard HH-60 helicopter and C-130 airplane, as well as a U.S. Navy P-3 airplane that was flying in the vicinity of TWA 800 at the time of the accident.

In February 1998, the FBI, having closed its active investigation, agreed to fully release the witness summaries to the NTSB. With access to these documents no longer controlled by the FBI, the NTSB formed a second witness group to review the documents. Because of the amount of time that had elapsed (about 21 months) before the NTSB received information about the identity of the witnesses, the witness group chose not to re-interview the witnesses, but instead to rely on the original summaries of witness statements written by FBI agents as the best available evidence of the observations initially reported by the witnesses. Despite the two and a half years that had elapsed since the accident, the witness group did interview the captain of Eastwind Airlines Flight 507, who was the first to report the explosion of TWA 800, because of his vantage point and experience as an airline pilot.

A frame from the NTSB's animation depicting how the noseless plane climbed erratically before descending into the ocean

The NTSB's review of the released witness documents determined that they contained 736 witness accounts, of which 258 were characterized as "streak of light" witnesses ("an object moving in the sky... variously described [as] a point of light, fireworks, a flare, a shooting star, or something similar.") The NTSB Witness Group concluded that the streak of light reported by witnesses might have been the actual airplane during some stage of its flight before the fireball developed, noting that most of the 258 streak of light accounts were generally consistent with the calculated flightpath of the accident airplane after the CWT explosion.

Thirty-eight witnesses described a streak of light that ascended vertically, or nearly so, and these accounts "seem[ed] to be inconsistent with the accident airplane's flightpath." In addition, 18 witnesses reported seeing a streak of light that originated at the surface, or the horizon, which did not "appear to be consistent with the airplane's calculated flightpath and other known aspects of the accident sequence." Regarding these differing accounts, the NTSB noted that based on their experience in previous investigations "witness reports are often inconsistent with the known facts or with other witnesses' reports of the same events." The interviews conducted by the FBI focused on the possibility of a missile attack; suggested interview questions given to FBI agents such as "Where was the sun in relation to the aircraft and the missile launch point?" and "How long did the missile fly?" could have biased interviewees' responses in some cases. The NTSB concluded that given the large number of witnesses in this case, they "did not expect all of the documented witness observations to be consistent with one another" and "did not view these apparently anomalous witness reports as persuasive evidence that some witnesses might have observed a missile."

After missile visibility tests were conducted in April 2000, at Eglin Air Force Base, Fort Walton Beach, Florida, the NTSB determined that if witnesses had observed a missile attack they would have seen:

1. a light from the burning missile motor ascending very rapidly and steeply for about 8 seconds;
2. the light disappearing for up to 7 seconds;
3. upon the missile striking the aircraft and igniting the CWT, another light, moving considerably more slowly and more laterally than the first, for about 30 seconds;
4. this light descending while simultaneously developing into a fireball falling toward the ocean. None of the witness documents described such a scenario.

Another frame from the CIA's animation depicting how the left wing of TWA Flight 800 was shorn off and created a second fireball

Because of their unique vantage points or the level of precision and detail provided in their accounts, five witness accounts generated special interest: the pilot of Eastwind Airlines Flight 507, the crew members in the HH-60 helicopter, a streak-of-light witness aboard US Airways Flight 217, a land witness on the Beach Lane Bridge in Westhampton Beach, New York, and a witness on a boat near Great Gun Beach. Advocates of a missile-attack scenario asserted that some of these witnesses observed a missile; analysis demonstrated that the observations were not consistent with a missile attack on TWA 800, but instead were consistent with these witnesses having observed part of the in-flight fire and breakup sequence after the CWT explosion.

The NTSB concluded that "the witness observations of a streak of light were not related to a missile and that the streak of light reported by most of these witnesses was burning fuel from the accident airplane in crippled flight during some portion of the post-explosion, preimpact breakup sequence". The NTSB further concluded that "the witnesses' observations of one or more fireballs were of the airplane's burning wreckage falling toward the ocean".

Possible ignition sources of the center wing fuel tank

To determine what ignited the flammable fuel-air vapor in the CWT and caused the explosion, the NTSB evaluated numerous potential ignition sources. All but one were considered very unlikely to have been the source of ignition.

Missile fragment or small explosive charge

Although the NTSB had already reached the conclusion that a missile strike did not cause the structural failure of the airplane, the possibility that a missile could have exploded close enough to TWA 800 for a missile fragment to have entered the CWT and ignited the fuel/air vapor, yet far enough away not to have left any damage characteristic of a missile strike, was considered. Computer simulations using missile performance data simulated a missile detonating in a location such that a fragment from the warhead could penetrate the CWT. Based on these simulations, the NTSB concluded that it was "very unlikely" that a warhead detonated in such a location where a fragment could penetrate the CWT, but no other fragments impact the surrounding airplane structure leaving distinctive impact marks.

Similarly, the investigation considered the possibility that a small explosive charge placed on the CWT could have been the ignition source. Testing by the NTSB and the British Defence Evaluation and Research Agency demonstrated that when metal of the same type and thickness of the CWT was penetrated by a small charge, there was petalling of the surface where the charge was placed, pitting on the adjacent surfaces, and visible hot gas washing damage in the surrounding area. Since none of the recovered CWT wreckage exhibited these damage characteristics, and none of the areas of missing wreckage were large enough to encompass all the expected damage, the investigation concluded that this scenario was "very unlikely."

Other potential sources

The NTSB also investigated whether the fuel/air mixture in the CWT could have been ignited by lightning strike, meteor strike, auto-ignition or hot surface ignition, a fire migrating to the CWT from another fuel tank via the vent system, an uncontained engine failure, a turbine burst in the air conditioning packs beneath the CWT, a malfunctioning CWT jettison/override pump, a malfunctioning CWT scavenger pump, or static electricity. After analysis the investigation determined that these potential sources were "very unlikely" to have been the source of ignition.

Fuel quantity indication system

Because a combustible fuel/air mixture will always exist in fuel tanks, Boeing designers had attempted to eliminate all possible sources of ignition in the 747's tanks. To do so, all devices are protected from vapor intrusion, and voltages and currents used by the Fuel Quantity Indication System (FQIS) are kept very low. In the case of the 747-100 series, the only wiring located inside the CWT is that which is associated with the FQIS.

In order for the FQIS to have been Flight 800's ignition source, a transfer of higher-than-normal voltage to the FQIS would have needed to occur, as well as some mechanism whereby the excess energy was released by the FQIS wiring into the CWT. While the NTSB determined that factors suggesting the likelihood of a short circuit event existed, they added that "neither the release mechanism nor the location of the ignition inside the CWT could be determined from the available evidence." Nonetheless, the NTSB concluded that "the ignition energy for the CWT explosion most likely entered the CWT through the FQIS wiring".

Though the FQIS itself was designed to prevent danger by minimizing voltages and currents, the innermost tube of Flight 800's FQIS compensator showed damage similar to that of the compensator tube identified as the ignition source for the surge tank fire that destroyed a 747 near Madrid in 1976. This was not considered proof of a source of ignition. Evidence of arcing was found in a wire bundle that included FQIS wiring connecting to the center wing tank. Arcing signs were also seen on two wires sharing a cable raceway with FQIS wiring at station 955.

The captain's cockpit voice recorder channel showed two "dropouts" of background power harmonics in the second before the recording ended (with the separation of the nose). This might well be the signature of an arc on cockpit wiring adjacent to the FQIS wiring. The captain commented on the "crazy" readings of the number 4 engine fuel flow gauge about 2 1/2 minutes before the CVR recording ended. Finally, the Center Wing Tank fuel quantity gauge was recovered and indicated 640 pounds instead of the 300 pounds that had been loaded into that tank. Experiments showed that applying power to a wire leading to the fuel quantity gauge can cause the digital display to change by several hundred pounds before the circuit breaker trips. Thus the gauge anomaly could have been caused by a short to the FQIS wiring. The NTSB concluded that the most likely source of sufficient voltage to cause ignition was a short from damaged wiring, or within electrical components of the FQIS. As not all components and wiring were recovered, it was not possible to pinpoint the source of the necessary voltage.

Report conclusions

The NTSB investigation ended with the adoption of the board's final report on August 23, 2000. The Board determined that the probable cause of the TWA 800 accident was:

[An] explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system.

In addition to the probable cause, the NTSB found the following contributing factors to the accident:

• The design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources.
• The certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel tank vapor non-combustible.

During the course of its investigation, and in its final report, the NTSB issued fifteen safety recommendations, mostly covering fuel tank and wiring-related issues. Among the recommendations was that significant consideration should be given to the development of modifications such as nitrogen-inerting systems for new airplane designs and, where feasible, for existing airplanes.

Air Florida Flight 90

On a freezing night in Washington, 74 people would die due to a simple error by the pilots. On January 13, 1982 Air Florida Flight 90 was scheduled to depart from Washington National Airport (now Ronald Reagan Washington National Airport) to Fort Lauderdale–Hollywood International Airport with an intermediate stopover at Tampa International Airport. Less than two minutes after the Boeing 737-222 left the runway it crashed into the 14th Street Bridge over the Potomac River, killing four motorists on the bridge, before falling into the river to drown most of the survivors. What went wrong? Like all air accidents, multiple things contributed to the outcome, but the root cause was forgetting it was cold outside - despite the snow.

Striking the bridge, which carries Interstate 395 between Washington, D.C. and Arlington County, Virginia, it hit seven occupied vehicles and destroyed nearly 100 ft of guard rail before plunging through the ice into the Potomac River. The aircraft was carrying 74 passengers and five crew members. Only four passengers and one crew member (a flight attendant) were rescued from the crash and survived. Another passenger, Arland D. Williams, Jr., assisted in the rescue of the survivors but drowned before he could be rescued. Four motorists on the bridge were killed. The survivors were rescued from the icy river by civilians and professionals. President Ronald Reagan commended these acts during his State of the Union speech a few days later.

The National Transportation Safety Board (NTSB) determined that the cause of the accident was pilot error. The pilots failed to switch on the engines' internal ice protection systems, used reverse thrust in a snowstorm prior to takeoff, tried to use the jet exhaust of a plane in front of them to melt their ice, and failed to abort the takeoff even after detecting a power problem while taxiing and having ice and snow buildup on the wings.

Aircraft

The aircraft involved, a Boeing 737-222, registered as N62AF, was manufactured in 1969 and previously flown by United Airlines under the registration N9050U. It was sold to Air Florida in 1980. The aircraft was powered by two Pratt & Whitney JT8D-9A turbofan engines and had recorded over 27,000 hours before the crash.

Cockpit crew

The pilot, Captain Larry M. Wheaton, aged 34, was hired by Air Florida in October 1978 as a first officer. He upgraded to captain in August 1980. At the time of the accident, he had about 8,300 total flight hours, with 2,322 hours of commercial jet experience, all logged at Air Florida. He had logged 1,752 hours on the Boeing 737, the accident-aircraft type, 1,100 of those hours as captain.

Wheaton was described by fellow pilots as a quiet person, with good operational skills and knowledge, who had operated well in high-workload flying situations. His leadership style was described as similar to those of other pilots. On May 8, 1980, though, he was suspended after failing a Boeing 737 company line check and was found to be unsatisfactory in these areas: adherence to regulations, checklist usage, flight procedures such as departures and cruise control, and approaches and landings. He resumed his duties after passing a retest on August 27, 1980. On April 24, 1981, he received an unsatisfactory grade on a company recurrent proficiency check when he showed deficiencies in memory items, knowledge of aircraft systems, and aircraft limitations. Three days later, he satisfactorily passed a proficiency recheck.

The first officer, Roger A. Pettit, aged 31, was hired by Air Florida on October 3, 1980, as a first officer on the Boeing 737. At the time of the accident, he had around 3,353 flight hours, 992 with Air Florida, all on the 737. From October 1977 to October 1980, he had been a fighter pilot in the US Air Force, accumulating 669 hours as a flight examiner, instructor pilot, and ground instructor in an F-15 unit.

The first officer was described by personal friends and pilots as a witty, bright, outgoing individual with an excellent command of physical and mental skills in aircraft piloting. Those who had flown with him during stressful flight operations said that during those times, he remained the same witty, sharp individual, "who knew his limitations." Several persons said that he was the type of pilot who would not hesitate to speak up if he knew something specific was wrong with flight operations.

Alternating the role of "primary pilot" between the pilot in command (PIC), the captain, and second in command (SIC), the first officer, is customary in commercial airline operations, with pilots swapping roles after each leg. One pilot is designated the pilot flying (PF) and the other as pilot not flying (PNF); however, the PIC retains the ultimate authority for all aircraft operations and safety. The first officer was on the controls as the PF during the Air Florida Flight 90 accident.

Background

Weather conditions

On Wednesday, January 13, 1982, Washington National Airport (DCA) was closed by a heavy snowstorm that produced 6.5 in (16.5 cm) of snow. It reopened at noon under marginal conditions as the snowfall began to slacken.

That afternoon, the plane was to return to Fort Lauderdale–Hollywood International Airport in Dania, Florida, with an intermediate stop at Tampa International Airport. The scheduled departure time was delayed about 1 hour and 45 minutes because of a backlog of arrivals and departures caused by the temporary closing of Washington National Airport. As the plane was readied for departure from DCA, a moderate snowfall continued and the air temperature was well below freezing.

Improper de-icing procedures

The Boeing 737 was de-iced with a mixture of heated water and monopropylene glycol by American Airlines, under a ground-service agreement with Air Florida. That agreement specified that covers for the pitot tubes, static ports, and engine inlets had to be used, but the American Airlines employees did not comply with those rules. One de-icing vehicle was used by two different operators, who chose widely different mixture percentages to de-ice the left and right sides of the aircraft. Subsequent testing of the de-icing truck showed that "the mixture dispensed differed substantially from the mixture selected" (18% actual vs. 30% selected). The inaccurate mixture was the result of the replacement of the standard nozzle, "...which is specially modified and calibrated, with a non-modified, commercially available nozzle." The operator had no means to determine if the proportioning valves were operating properly because no "mix monitor" was installed on the nozzle.

Events of crash

Flight

The plane had trouble leaving the gate when the ground-services tow motor could not get traction on the ice. For roughly 30 to 90 seconds, the crew attempted to back away from the gate using the reverse thrust of the engines (a powerback), which proved futile. Boeing operations bulletins had warned against using reverse thrust in those kinds of conditions.

Eventually, a tug ground unit properly equipped with snow chains was used to push the aircraft back from the gate. After leaving the gate, the aircraft waited in a taxi line with many other aircraft for 49 minutes before reaching the takeoff runway. The pilot apparently decided not to return to the gate for reapplication of deicing, fearing that the flight's departure would be even further delayed. More snow and ice accumulated on the wings during that period, and the crew was aware of that fact when they decided to make the takeoff. Heavy snow was falling during their takeoff roll at 3:59 pm EST.

Though the outside temperature was well below freezing and it was snowing, the crew did not activate the engine anti-ice system. This system uses heat from the engines to prevent sensors from freezing, ensuring accurate readings.

While running through the takeoff checklist, the following conversation snippet took place (CAM-1 is the captain, CAM-2 is the first officer):

{{quote|CAM-2 Pitot heat?

CAM-1 On.

CAM-2 Engine anti-ice?

CAM-1 Off.

Despite the icing condition with weather temperature of about 24 °F (-4 °C), the crew failed to activate the engine anti-ice systems, which caused the engine pressure ratio (EPR) thrust indicators to provide false readings. The correct engine power setting for the temperature and airport altitude of Washington National at the time was 2.04 EPR, but it was later determined from analysis of the engine noise recorded on the cockpit voice recorder that the actual power output corresponded with an engine pressure ratio of only 1.70.

Neither pilot had much experience flying in snowy, cold weather. The captain had made only eight takeoffs or landings in snowy conditions on the 737, and the first officer had flown in snow only twice.

NTSB diagram of flight path for Air Florida Flight 90

Adding to the plane's troubles was the pilots' decision to maneuver closely behind a DC-9 that was taxiing just ahead of them prior to takeoff, due to their mistaken belief that the warmth from the DC-9's engines would melt the snow and ice that had accumulated on Flight 90's wings. This action, which went specifically against flight-manual recommendations for an icing situation, actually contributed to icing on the 737. The exhaust gases from the other aircraft melted the snow on the wings, but during takeoff, instead of falling off the plane, this slush mixture froze on the wings' leading edges and the engine inlet nose cone.

As the takeoff roll began, the first officer noted several times to the captain that the instrument panel readings he was seeing did not seem to reflect reality (he was referring to the fact that the plane did not appear to have developed as much power as it needed for takeoff, despite the instruments indicating otherwise). The captain dismissed these concerns and let the takeoff proceed. Investigators determined that plenty of time and space on the runway remained for the captain to have aborted the takeoff, and criticized his refusal to listen to his first officer, who was correct that the instrument panel readings were wrong. The pilot was told not to delay because another aircraft was 2.5 miles (4 km) out on final approach to the same runway. The following is a transcript of Flight 90's cockpit voice recorder during the plane's acceleration down the runway.

{{quote|15:59:32 CAM-1 Okay, your throttles.

15:59:35 [SOUND OF ENGINE SPOOLUP]

15:59:49 CAM-1 Holler if you need the wipers.

15:59:51 CAM-1 It's spooled. Really cold here, real cold.

15:59:58 CAM-2 God, look at that thing. That don't seem right, does it? Ah, that's not right.

16:00:09 CAM-1 Yes it is, there's eighty.

16:00:10 CAM-2 Naw, I don't think that's right. Ah, maybe it is.

16:00:21 CAM-1 Hundred and twenty.

16:00:23 CAM-2 I don't know.

16:00:31 CAM-1 V₁. Easy, V₂.|Transcript|Air Florida Flight 90 Cockpit Voice Recorder

As the plane became briefly airborne, the voice recorder picked up the following from the cockpit, with the sound of the stick-shaker (a device that warns that the plane is in danger of stalling) in the background:

16:00:39 [SOUND OF STICKSHAKER STARTS AND CONTINUES UNTIL IMPACT]

16:00:41 TWR Palm 90 contact departure control.

16:00:45 CAM-1 Forward, forward, easy. We only want five hundred.

16:00:48 CAM-1 Come on forward....forward, just barely climb.

16:00:59 CAM-1 Stalling, we're falling!

16:01:00 CAM-2 Larry, we're going down, Larry....

16:01:01 CAM-1 I know!

16:01:01 [SOUND OF IMPACT]

—Transcript, Air Florida Flight 90 Cockpit Voice Recorder

The aircraft traveled almost half a mile (800 m) farther down the runway than is customary before liftoff was accomplished. Survivors of the crash indicated the trip over the runway was extremely rough, with survivor Joe Stiley – a businessman and private pilot – saying that he believed that they would not get airborne and would "fall off the end of the runway". When the plane became airborne, Stiley told his co-worker (and survivor) Nikki Felch to assume the crash position, with some nearby passengers following their example.

Although the 737 did manage to become airborne, it attained a maximum altitude of just 350 ft before it began losing altitude. Recorders later indicated that the aircraft was airborne for just 30 seconds. At 4:01 pm EST, it crashed into the 14th Street Bridge across the Potomac River, less than a mile from the end of the runway. The plane hit six cars and a truck on the bridge, and tore away the bridge's rail and wall. The aircraft then plunged into the freezing Potomac River. It fell between two of the three spans of the bridge, between the I-395 northbound span (the Rochambeau Bridge) and the HOV north- and southbound spans, about 200 ft offshore. All but the tail section quickly became submerged.

Of the people on board the aircraft:

• Four of the crew members (including both pilots) died.
• One crew member was seriously injured.
• Seventy of the 74 passengers died.
• Nineteen occupants were believed to have survived the impact, but their injuries prevented them from escaping.

Of the motorists on the bridge involved:

• Four sustained fatal injuries
• One sustained serious injuries
• Three sustained minor injuries

Clinging to the tail section of the broken airliner in the ice-choked Potomac River were flight attendant Kelly Duncan and four passengers: Patricia "Nikki" Felch, Joe Stiley, Arland D. Williams Jr. (strapped and tangled in his seat), and Priscilla Tirado. Duncan inflated the only flotation device they could find, and passed it to the severely injured Felch. Passenger Bert Hamilton, who was floating in the water nearby, was the first to be pulled from the water.

Crash response

Many federal offices in downtown Washington had closed early that day in response to quickly developing blizzard conditions. Thus, a massive backup of traffic existed on almost all of the city's roads, making reaching the crash site by ambulances very difficult. The Coast Guard's harbour tugboat Capstan (WYTL 65601) and its crew were based nearby; their duties include ice breaking and responding to water rescues. The Capstan was considerably farther downriver on another search-and-rescue mission. Emergency ground response was greatly hampered by ice-covered roads and gridlocked traffic, ambulances dispatched at 4:07 pm took 20 minutes to reach the scene of the crash. Ambulances attempting to reach the scene were even driven down the sidewalk in front of the White House. Rescuers who reached the site were unable to assist survivors in the water because they did not have adequate equipment to reach them. Below-freezing waters and heavy ice made swimming out to them impossible. Multiple attempts to throw a makeshift lifeline (made out of belts and any other things available that could be tied together) out to the survivors proved ineffective. The rescue attempts by emergency officials and witnesses were recorded and broadcast live by area news reporters, and as the accident occurred in the nation's capital, large numbers of media personnel were on hand to provide quick and extensive coverage.

Roger Olian, a sheet-metal foreman at St. Elizabeth's Hospital, a Washington psychiatric hospital, was on his way home across the 14th Street Bridge in his truck when he heard a man yelling that an aircraft was in the water. He was the first to jump into the water to attempt to reach the survivors. At the same time, several military personnel from the Pentagon—Steve Raynes, Aldo De La Cruz, and Steve Bell—ran down to the water's edge to help Olian.

He only traveled a few yards and came back, ice sticking to his body. We asked him to not try again, but he insisted. Someone grabbed some short rope and battery cables and he went out again, maybe only going 30 feet. We pulled him back. Someone had backed up their jeep and we picked him up and put him in there. All anyone could do was tell the survivors was to hold on not to give up hope. There were a few pieces of the plane on shore that were smoldering and you could hear the screams of the survivors. More people arrived near the shore from the bridge, but nobody could do anything. The ice was broken up and there was no way to walk out there. It was so eerie, an entire plane vanished except for a tail section, the survivors, and a few pieces of plane debris. The smell of jet fuel was everywhere, and you could smell it on your clothes. The snow on the banks was easily two feet high and your legs and feet would fall deep into it every time you moved from the water.

At this point, flight controllers were aware only that the plane had disappeared from radar and did not respond to radio calls, but had no idea of either what had happened or the plane's location.

At approximately 4:20 pm EST, Eagle 1, a United States Park Police Bell 206L-1 Long Ranger helicopter (registry number N22PP), based at the "Eagles Nest" at Anacostia Park in Washington and manned by pilot Donald W. Usher and paramedic Melvin E. Windsor, arrived and began attempting to airlift the survivors to shore. At great risk to themselves, the crew worked close to the water's surface, at one time coming so close to the ice-clogged river that the helicopter's skids dipped beneath the surface.

The helicopter crew lowered a line to survivors to tow them to shore. First to receive the line was Bert Hamilton, who was treading water about 10 ft (3 m) from the plane's floating tail. The pilot pulled him across the ice to shore, while avoiding the sides of the bridge. By then, some fire/rescue personnel had arrived to join the military personnel and civilians who pulled Hamilton (and the next/last three survivors) from the water's edge up to waiting ambulances. The helicopter returned to the aircraft's tail, and this time Arland D. Williams Jr. (sometimes referred to as "the sixth passenger") caught the line. Williams, not able to unstrap himself from the wreckage, passed the line to flight attendant Kelly Duncan, who was towed to shore. On its third trip back to the wreckage, the helicopter lowered two lifelines, fearing that the remaining survivors had only a few minutes before succumbing to hypothermia. Williams, still strapped into the wreckage, passed one line to Joe Stiley, who was holding on to a panic-stricken and blinded (from jet fuel) Priscilla Tirado, who had lost her husband and baby. Stiley's co-worker, Nikki Felch, took the second line. As the helicopter pulled the three through the water and blocks of ice toward shore, both Tirado and Felch lost their grips and fell back into the water.

Priscilla Tirado was too weak to grab the line when the helicopter returned to her. A watching bystander, Congressional Budget Office assistant Lenny Skutnik, stripped off his coat and boots, and in short sleeves, dove into the icy water and swam out to successfully pull her to shore. The helicopter then proceeded to where Felch had fallen, and paramedic Gene Windsor stepped out onto the helicopter skid and grabbed her by the clothing to lift her onto the skid with him, bringing her to shore. When the helicopter crew returned for Williams, the wreckage he was strapped into had rolled slightly, submerging him; according to the coroner Williams was the only passenger to die by drowning. His body and those of the other occupants were later recovered.

While the weather had caused an early start to Washington's rush-hour traffic, frustrating the response time of emergency crews, the early rush hour also meant that trains on the Washington Metro were full when, just 30 minutes after Flight 90 crashed, the Metro suffered its first fatal crash at Federal Triangle station. This meant that Washington's nearest airport, one of its main bridges in or out of the city, and one of its busiest subway lines were all closed simultaneously, paralyzing much of the metropolitan area.

NTSB investigation and conclusion

The 737 had broken into several large pieces upon impact - the nose and cockpit section, the cabin up to the wing attachment point, the cabin from behind the wings to the rear airstairs, and the empennage. Although actual impact speeds were low and well within survivability limits, the structural breakup of the fuselage and exposure to freezing water nonetheless proved fatal for all persons aboard the plane except those seated in the tail section. The National Transportation Safety Board concluded that the accident was not survivable. Determining the position of the rudder, slats, elevators, and ailerons was not possible due to impact damage and the majority of the flight control system having been destroyed.

The National Transportation Safety Board determined that the probable cause of the crash included the flight crew's failure to enforce a sterile cockpit during the final preflight checklist procedure. The engines' anti-ice heaters were not engaged during the ground operation and takeoff. The decision to take off with snow/ice on the airfoil surfaces of the aircraft, and the captain's failure to reject the takeoff during the early stage when his attention was called to anomalous engine instrument readings also were erroneous.

The NTSB further stated:

"Contributing to the accident were the prolonged ground delay between deicing and the receipt of ATC takeoff clearance during which the aircraft was exposed to continual precipitation, the known inherent pitch up characteristics of the B-737 aircraft when the leading edge is contaminated with even small amounts of snow or ice, and the limited experience of the flight crew in jet transport winter operations.

Wildlife Encounters/Bird Strikes

Bird Strikes represent a major hazard to aircraft.

Bird strikes are a significant threat to flight safety, and have caused a number of accidents with human casualties. There are over 13,000 bird strikes annually in the US alone. However, the number of major accidents involving civil aircraft is quite low and it has been estimated that there is only about one accident resulting in human death in one billion flying hours. The majority of bird strikes (65%) cause little damage to the aircraft; however the collision is usually fatal to the bird(s) involved.

Most accidents occur when a bird collides with the windscreen or is sucked into the engine of a jet aircraft. Strikes to the propellers can also cause major problems. Bird strikes happen most often during takeoff or landing, or during low altitude flight. However, bird strikes have also been reported at high altitudes, some as high as 6,000 to 9,000m above the ground. For example, an aircraft over the Ivory Coast collided with a Rüppell's vulture at the altitude of 11,300m. The majority of bird collisions occur near or at airports (90%, according to the ICAO) during takeoff, landing and associated phases. According to the FAA wildlife hazard management manual for 2005, less than 8% of strikes occur above 900m and 61% occur at less than 30m.

The point of impact is usually any forward-facing edge of the vehicle such as a wing leading edge, nose cone, jet engine cowling or engine inlet.

Jet engine ingestion is extremely serious due to the rotation speed of the engine fan and engine design. As the bird strikes a fan blade, that blade can be displaced into another blade and so forth, causing a cascading failure. Jet engines are particularly vulnerable during the takeoff phase when the engine is turning at a very high speed and the plane is at a low altitude where birds are more commonly found.

The force of the impact on an aircraft depends on the weight of the animal and the speed difference and direction at the point of impact. The energy of the impact increases with the square of the speed difference. High-speed impacts, as with jet aircraft, can cause considerable damage and even catastrophic failure to the vehicle. The energy of a 5 kg (11 lb) bird moving at a relative velocity of 275 km/h (171 mph) approximately equals the energy of a 100 kg (220 lb) weight dropped from a height of 15 meters (49 ft). However, according to the FAA only 15% of strikes (ICAO 11%) actually result in damage to the aircraft.

Bird strikes can damage vehicle components, or injure passengers. Flocks of birds are especially dangerous and can lead to multiple strikes, with corresponding damage. Depending on the damage, aircraft at low altitudes or during take-off and landing often cannot recover in time.

Countermeasures

There are three approaches to reduce the effect of bird strikes. The vehicles can be designed to be more bird resistant, the birds can be moved out of the way of the vehicle, or the vehicle can be moved out of the way of the birds.

Vehicle design

Most large commercial jet engines include design features that ensure they can shut-down after "ingesting" a bird weighing up to 1.8 kg (4.0 lb). The engine does not have to survive the ingestion, just be safely shut down. This is a 'stand-alone' requirement, i.e., the engine, not the aircraft, must pass the test. Multiple strikes (from hitting a bird flock) on twin-engine jet aircraft are very serious events because they can disable multiple aircraft systems, requiring emergency action to land the aircraft.

Modern jet aircraft structures must be able to withstand one 1.8 kg (4.0 lb) collision; the empennage (tail) must withstand one 3.6 kg (7.9 lb) bird collision. Cockpit windows on jet aircraft must be able to withstand one 1.8 kg (4.0 lb) bird collision without yielding or spalling.

At first, bird strike testing by manufacturers involved firing a bird carcass from a gas cannon and sabot system into the tested unit. The carcass was soon replaced with suitable density blocks, often gelatin, to ease testing. Current testing is mainly conducted with computer simulation, although final testing usually involves some physical experiments.

Flight path

Pilots should not take off or land in the presence of wildlife and should avoid migratory routes, wildlife reserves, estuaries and other sites where birds may congregate. When operating in the presence of bird flocks, pilots should seek to climb above 3,000 feet (910 m) as rapidly as possible as most bird strikes occur below 3,000 feet (910 m). Additionally, pilots should slow down their aircraft when confronted with birds. The energy that must be dissipated in the collision is approximately the relative kinetic energy ($E_{k}$) of the bird, defined by the equation $E_{k}={\frac {1}{2}}mv^{2}$ where $m$ is the mass of the bird and $v$ is the relative velocity (the difference of the velocities of the bird and the plane, resulting in a lower absolute value if they are flying in the same direction and higher absolute value if they are flying in opposite directions). Therefore, the speed of the aircraft is much more important than the size of the bird when it comes to reducing energy transfer in a collision. The same can be said for jet engines: the slower the rotation of the engine, the less energy which will be imparted onto the engine at collision.

The body density of the bird is also a parameter that influences the amount of damage caused.

The US Military Avian Hazard Advisory System (AHAS) uses near real-time data from the 148 CONUS based National Weather Service Next Generation Weather Radar (NEXRAD or WSR 88-D) system to provide current bird hazard conditions for published military low-level routes, ranges, and military operating areas (MOAs). Additionally, AHAS incorporates weather forecast data with the Bird Avoidance Model (BAM) to predict soaring bird activity within the next 24 hours and then defaults to the BAM for planning purposes when activity is scheduled outside the 24-hour window. The BAM is a static historical hazard model based on many years of bird distribution data from Christmas Bird Counts (CBC), Breeding Bird Surveys (BBS), and National Wildlife Refuge Data. The BAM also incorporates potentially hazardous bird attractions such as landfills and golf courses. AHAS is now an integral part of military low-level mission planning, aircrew being able to access the current bird hazard conditions. AHAS will provide relative risk assessments for the planned mission and give aircrew the opportunity to select a less hazardous route should the planned route be rated severe or moderate. Prior to 2003, the US Air Force BASH Team bird strike database indicated that approximately 25% of all strikes were associated with low-level routes and bombing ranges. More importantly, these strikes accounted for more than 50% of all of the reported damage costs. After a decade of using AHAS for avoiding routes with severe ratings, the strike percentage associated with low-level flight operations has been reduced to 12% and associated costs cut in half.

Avian radar is an important tool for aiding in bird strike mitigation as part of overall safety management systems at civilian and military airfields. Properly designed and equipped avian radars can track thousands of birds simultaneously in real-time, night and day, through 360° of coverage, out to ranges of 10 km and beyond for flocks, updating every target's position (longitude, latitude, altitude), speed, heading, and size every 2–3 seconds. Data from these systems can be used to generate information products ranging from real-time threat alerts to historical analyses of bird activity patterns in both time and space. The United States Federal Aviation Administration (FAA) and the United States Department of Defense (DOD) have conducted extensive science-based field testing and validation of commercial avian radar systems for civil and military applications, respectively. The FAA used evaluations of commercial 3D avian radar systems developed and marketed by Accipiter Radar as the basis for FAA Advisory Circular 150/5220-25 and a guidance letter on using Airport Improvement Program funds to acquire avian radar systems at Part 139 airports. Similarly, the DOD-sponsored Integration and Validation of Avian Radars (IVAR) project evaluated the functional and performance characteristics of Accipiter® avian radars under operational conditions at Navy, Marine Corps, and Air Force airfields. Accipiter avian radar systems operating at Seattle-Tacoma International Airport, Chicago O'Hare International Airport, and Marine Corps Air Station Cherry Point made significant contributions to the evaluations carried out in the aforementioned FAA and DoD initiatives. Additional scientific and technical papers on avian radar systems are listed below, and on the Accipiter Radar web site.

A US company, DeTect, in 2003, developed the only production model bird radar in operational use for real-time, tactical bird-aircraft strike avoidance by air traffic controllers. These systems are operational at both commercial airports and military airfields. The system has widely used technology available for bird–aircraft strike hazard (BASH) management and for real-time detection, tracking and alerting of hazardous bird activity at commercial airports, military airfields, and military training and bombing ranges. After extensive evaluation and on-site testing, MERLIN technology was chosen by NASA and was ultimately used for detecting and tracking dangerous vulture activity during the 22 space shuttle launches from 2006 to the conclusion of the program in 2011. The US Air Force has contracted DeTect since 2003 to provide the Avian Hazard Advisory System (AHAS)previously mentioned.

Wildlife Encounters/Bird Strikes/Cactus 1549

A partially submerged Airbus A320 with front emergency slides deployed and people standing on its wings

On January 15, 2009, US Airways Flight 1549, an Airbus A320 on a flight from New York City's LaGuardia Airport to Charlotte, North Carolina, struck a flock of birds shortly after take-off, losing all engine power. Unable to reach any airport for an emergency landing, pilots Chesley Sullenberger and Jeffrey Skiles glided the plane to a ditching in the Hudson River off Midtown Manhattan. All 155 people on board were rescued by nearby boats, with a few serious injuries.

This water landing of a powerless jetliner became known as the "Miracle on the Hudson", and a National Transportation Safety Board official described it as "the most successful ditching in aviation history". The Board rejected the notion that the pilot could have avoided ditching by returning to LaGuardia or diverting to nearby Teterboro Airport.

The pilots and flight attendants were awarded the Master's Medal of the Guild of Air Pilots and Air Navigators in recognition of their "heroic and unique aviation achievement".

Background

N106US, the aircraft involved in the accident, at LaGuardia eight years earlier, while operating for US Airways Shuttle.

On January 15, 2009, US Airways Flight 1549 with call sign 'Cactus 1549' was scheduled to fly from New York City's LaGuardia Airport (LGA) to Charlotte Douglas (CLT), with direct onward service to Seattle–Tacoma International Airport. The aircraft was an Airbus A320-214 powered by two GE Aviation/Snecma-designed CFM56-5B4/P turbofan engines.

The captain and pilot in command was 57-year-old Chesley B. Sullenberger, a former fighter pilot who had been an airline pilot since leaving the United States Air Force in 1980. At the time, he had logged 19,663 total flight hours, including 4,765 in an A320; he was also a glider pilot and expert on aviation safety. First officer Jeffrey Skiles, 49, had accrued 20,727 career flight hours with 37 in an A320, but this was his first A320 assignment as pilot flying. There were 150 passengers and three flight attendants on board.

Accident

Takeoff and bird strike

The flight was cleared for takeoff to the northeast from LaGuardia's Runway 4 at 3:24:56 pm Eastern Standard Time (20:24:56 UTC). With Skiles in control, the crew made its first report after becoming airborne at 3:25:51 as being at 700 feet (210 m) and climbing.

The weather at 2:51 p.m. was 10 miles (16 km) visibility with broken clouds at 3,700 feet (1,100 m), wind Template:Convert/knots from 290°; an hour later it was few clouds at 4,200 feet (1,300 m), wind Template:Convert/knots from 310°. At 3:26:37 Sullenberger remarked to Skiles: "What a view of the Hudson today."

The Hudson River from above the Bronx, with Manhattan in the diagonal center and New Jersey in the distance. The George Washington Bridge is at right, Central Park Reservoir at upper left, and Teterboro Airport at the right center within the elbow of the Overpeck Creek.

Flight path flown (red). Alternative trajectories to Teterboro (dark blue) and back toward La Guardia (magenta) were simulated for the investigation.

At 3:27:11 during climbout, the plane struck a flock of Canada geese at an altitude of 2,818 feet (859 m) about Template:Convert/miles north-northwest of LaGuardia. The pilots' view was filled with the large birds; passengers and crew heard very loud bangs and saw flames from the engines, followed by silence and an odor of fuel.

Realizing that both engines had shut down, Sullenberger took control while Skiles worked the checklist for engine restart. The aircraft slowed but continued to climb for a further 19 seconds, reaching about 3,060 feet (930 m) at an airspeed of about 185 knots (Template:Convert/km/h mph), then began a glide descent, accelerating to 210 knots (Template:Convert/km/h mph) at 3:28:10 as it descended through 1,650 feet (500 m).

At 3:27:33, Sullenberger radioed a mayday call to New York Terminal Radar Approach Control (TRACON): "... this is Cactus 1539 [sicTemplate:Sndcorrect call sign was Cactus 1549], hit birds. We've lost thrust on both engines. We're turning back towards LaGuardia". Air traffic controller Patrick Harten told LaGuardia's tower to hold all departures, and directed Sullenberger back to Runway 31. Sullenberger responded, "Unable".

Sullenberger asked controllers for landing options in New Jersey, mentioning Teterboro Airport. Permission was given for Teterboro's Runway 1, Sullenberger initially responded "Yes", but then: "We can't do it  ... We're gonna be in the Hudson". The aircraft passed less than 900 feet (270 m) above the George Washington Bridge. Sullenberger commanded over the cabin address system, "Brace for impact", and the flight attendants relayed the command to passengers. Meanwhile, air traffic controllers asked the Coast Guard to caution vessels in the Hudson and ask them to prepare to assist with rescue.

Ditching and evacuation

Coast Guard video of the water landing, and rescue

About ninety seconds later, at 3:31 pm, the plane made an unpowered ditching, descending southwards at about 125 knots (140 mph; 230 km/h) into the middle of the North River section of the Hudson tidal estuary, at 40.769444°N 74.004444°W / 40.769444; -74.004444 on the New York side of the state line, roughly opposite West 50th Street (near the Intrepid Sea, Air & Space Museum) in Manhattan and Port Imperial in Weehawken, New Jersey. Flight attendants compared the ditching to a "hard landing" with "one impact, no bounce, then a gradual deceleration." The ebb tide then began to take the plane southward.

Sullenberger opened the cockpit door and gave the order to evacuate. The crew began evacuating the passengers through the four overwing window exits and into an inflatable slide/raft deployed from the front right passenger door (the front left slide failed to operate, so the manual inflation handle was pulled). The evacuation was made more difficult by the fact that someone opened the rear left door, allowing more water to enter the plane; whether this was a flight attendant or a passenger is disputed. Water was also entering through a hole in the fuselage and through cargo doors that had come open, so as the water rose the attendant urged passengers to move forward by climbing over seats. One passenger was in a wheelchair. Finally, Sullenberger walked the cabin twice to confirm it was empty.

The air and water temperatures were about −7 °C (19 °F) and 5 °C (41 °F), respectively. Some evacuees waited for rescue knee-deep in water on the partially submerged slides, some wearing life vests. Others stood on the wings or, fearing an explosion, swam away from the plane. One passenger, after helping with the evacuation, found the wing so crowded that he jumped into the river and swam to a boat.

Rescue

Sullenberger had ditched near boats, which facilitated rescue. Two NY Waterway ferries arrived within minutes and began taking people aboard using a Jason's cradle; numerous other boats, including from the US Coast Guard, were quickly on scene as well. Sullenberger advised the ferry crews to rescue those on the wings first, as they were in more jeopardy than those on the slides, which detached to become life rafts. The last person was taken from the plane at 3:55 pm.

About 140 New York City firefighters responded to nearby docks, as did police, helicopters, and various vessels and divers. Other agencies provided medical help on the Weehawken side of the river, where most passengers were taken.

Boats surround the tail of the sunken plane, visible just above the water line.

Aftermath

The partially submerged aircraft tied up alongside Battery Park City

Among the people on board there were 95 minor injuries and 5 serious, including a deep laceration in flight attendant Doreen Welsh's leg. Seventy-eight people were treated, mostly for minor injuries and hypothermia; twenty-four passengers and two rescuers were treated at hospitals, with two passengers kept overnight. One passenger now wears glasses because of eye damage from jet fuel. No pets were being carried on the flight.

Each passenger later received a letter of apology, $5,000 in compensation for lost baggage (and $5,000 more if they could demonstrate larger losses), and refund of the ticket price. In May 2009, they received any belongings that had been recovered. In addition, they reported offers of $10,000 each in return for agreeing not to sue US Airways.

Many passengers and rescuers later experienced post-traumatic stress symptoms such as sleeplessness, flashbacks, and panic attacks; some began an email support group. Patrick Harten, the controller who had worked the flight, said that "the hardest, most traumatic part of the entire event was when it was over", and that he was "gripped by raw moments of shock and grief".

In an effort to prevent similar accidents, officials captured and gassed 1,235 Canada geese at 17 locations across New York City in mid-2009 and coated 1,739 goose eggs with oil to smother the developing goslings. To date (2017) 70,000 birds have been intentionally slaughtered in NYC as a result of the Hudson ditching.

Investigation

The plane being recovered from the river during the night of January 17

The partially submerged plane was moored to a pier near the World Financial Center in Lower Manhattan, roughly 4 miles (6 km) downstream from the ditching location. The left engine, detached by the ditching, was recovered from the riverbed. On January 17 the aircraft was barged to New Jersey.

The initial National Transportation Safety Board (NTSB) evaluation that the plane had lost thrust after a bird strike was confirmed by analysis of the cockpit voice and flight data recorders.

Two days earlier the plane had experienced a less severe compressor stall, but the affected engine was restarted. A faulty temperature sensor was replaced, and inspection verified the engine had not been damaged in that incident.

On January 21, the NTSB found evidence of soft-body damage in the right engine along with organic debris including a feather. The left engine also evidenced soft body impact, with "dents on both the spinner and inlet lip of the engine cowling. Five booster inlet guide vanes are fractured and eight outlet guide vanes are missing." Both engines, missing large portions of their housings, were sent to the manufacturer for examination. On January 31, the plane was moved to Kearny, New Jersey. The bird remains were later identified by DNA testing to be Canada geese, which typically weigh more than engines are designed to withstand ingesting.

Because the plane was assembled in France, the European Aviation Safety Agency (EASA; the European counterpart of the FAA) and the Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile (BEA; the French counterpart of the NTSB) joined the investigation, with technical assistance from Airbus and GE Aviation/Snecma, respectively the manufacturers of the airframe and the engines.

Goose feather found in the left engine

The NTSB used flight simulators to test the possibility that the flight could have returned safely to LaGuardia or diverted to Teterboro; only seven of the thirteen simulated returns to La Guardia succeeded, and only one of the two to Teterboro. Furthermore, the NTSB report called these simulations unrealistic: "The immediate turn made by the pilots during the simulations did not reflect or account for real-world considerations, such as the time delay required to recognize the bird strike and decide on a course of action." A further simulation, in which a 35-second delay was inserted to allow for those, crashed. In testimony before the NTSB, Sullenberger maintained that there had been no time to bring the plane to any airport and that attempting to do so would likely have killed those onboard and more on the ground.

The Board ultimately ruled that Sullenberger had made the correct decision, reasoning that the checklist for dual-engine failure is designed for higher altitudes when pilots have more time to deal with the situation, and that while simulations showed that the plane might have just barely made it back to LaGuardia, those scenarios assumed an instant decision to do so, with no time allowed for assessing the situation.

On May 4, 2010, the NTSB issued its final report, which identified the probable cause as "the ingestion of large birds into each engine, which resulted in an almost total loss of thrust in both engines." The final report credited the outcome to four factors: good decision-making and teamwork by the cockpit crew (including decisions to immediately turn on the APU and to ditch in the Hudson); the fact that the A320 is certified for extended overwater operation (and hence carried life vests and additional raft/slides) even though not required for that route; the performance of the flight crew during the evacuation; and the proximity of working vessels to the ditching site. Contributing factors were good visibility and fast response times from the ferry operators and emergency responders. The report made 34 recommendations, including that engines be tested for resistance to bird strikes at low speeds; development of checklists for dual-engine failures at low altitude, and changes to checklist design in general "to minimize the risk of flight crewmembers becoming stuck in an inappropriate checklist or portion of a checklist"; improved pilot training for water landings; provision of life vests on all flights regardless of route, and changes to the locations of vests and other emergency equipment; research into improved wildlife management, and technical innovations on aircraft, to reduce bird strikes; research into possible changes in passenger brace positions; and research into "methods of overcoming passengers' inattention" during preflight safety briefings.

Author and pilot William Langewiesche asserted that insufficient credit was given to the A320's fly-by-wire design, by which the pilot uses a side-stick to make control inputs to the flight control computers. The computers then impose adjustments and limits of their own to keep the plane stable, which the pilot cannot override even in an emergency. This design allowed the pilots of Flight 1549 to concentrate on engine restart and deciding the course, without the burden of manually adjusting the glidepath to reduce the plane's rate of descent. However, Sullenberger said that these computer-imposed limits also prevented him from achieving the optimum landing flare for the ditching, which would have softened the impact.

Being a Survivor

Survival factors:

• Do your research before you book. Airlines going through a financial crunch may skimp on maintenance. Some regulators are a lighter touch than others - if the airline you've chosen is banned from flying in the EU or the US, perhaps you should choose another one.
• Choose your seat carefully.
• Listen to the safety instructions and make sure you know where the nearest exits are. All of them as the closest may be unavailable.
• If something seems wrong, speak up. Several accidents could have been avoided if passengers had told the cabin crew about a problem.
• Dress appropriately. Artificial fibres are far worse in a fire than natural fibres. The clothes you would have on the ground in an emergency are the clothes on your back, not in your luggage, so wear something generally appropriate for the region you are flying. Unnatural colors help others find you.
• When emergency oxygen masks fall, always put your own mask on first, then help nearby passengers. If you pass out yourself you aren't helping anyone, but once you have oxygen you can continue to assist others.
• When asked to stow away items, do so quickly and securely.
• Have a plan that you've mentally rehearsed. It will help you overcome shock and act quicker.

Style Guide and Authors

Please follow the style guide. Changes to the guide should be proposed on the Talk page here for agreement of consensus between contributors.

Style Guide

• This book is written in British English. Don't worry if you write in American English - it will be changed to British English by the next editor.
• This book is designed to be fully self contained. It is not an encyclopedic article and there are no links to Wikipedia. Where a term needs describing it is linked to the Glossary within the book.
• In line references are not used. Where a reference is quoted, please include it in the References chapter, not within the individual chapters. This also applies to bare URLs and external links - put them in the references chapter.