Understanding Air Safety in the Jet Age

The current, editable version of this book is available in Wikibooks, the open-content textbooks collection, at
https://en.wikibooks.org/wiki/Understanding_Air_Safety_in_the_Jet_Age

Permission is granted to copy, distribute, and/or modify this document under the terms of the Creative Commons Attribution-ShareAlike 3.0 License.

The Dawn of the Jet Age

The British de Havilland Comet was the first jet airliner to fly (1949), the first in service (1952), and the first to offer a regular jet-powered transatlantic service (1958). One hundred and fourteen of all versions were built but the Comet 1 had serious design problems, and out of nine original aircraft, four crashed (one at takeoff and three broke up in flight), which grounded the entire fleet. The Comet 4 solved these problems but the program was overtaken by the Boeing 707 on the trans-Atlantic run. The Comet 4 was developed into the Hawker Siddeley Nimrod which retired in June 2011.

Following the grounding of the Comet 1, the Tu-104 became the first jet airliner to provide a sustained and reliable service, its introduction having been delayed pending the outcome of investigations into the Comet crashes. It was the world's only jet airliner in operation between 1956 and 1958 (after which the Comet 4 and Boeing 707 entered service). The plane was operated by Aeroflot (from 1956) and Czech Airlines ČSA (from 1957). ČSA became the first airline in the world to fly jet-only routes, using the Tu-104A variant.

The first western jet airliner with significant commercial success was the Boeing 707. It began service on the New York City|New York to London route in 1958, the first year that more trans-Atlantic passengers traveled by air than by ship. Comparable long-range airliner designs were the DC-8, VC10 and Il-62. The Boeing 747, the "Jumbo jet", was the first widebody aircraft that reduced the cost of flying and further accelerated the Jet Age.

One exception to the domination by turbofan engines was the turboprop-powered Tupolev Tu-114 (first flight 1957). This airliner was able to match or even exceed the performance of contemporary jets, however the use of such powerplants in large airframes was restricted to the military after 1976.

Jet airliners are able to fly much higher, faster, and further than piston-powered propliners, making transcontinental and intercontinental travel considerably faster and easier than in the past. Aircraft making long transcontinental and trans-oceanic flights could now fly to their destinations non-stop, making much of the world accessible within a single day's travel for the first time. As demand grew, airliners became larger, further reducing the cost of air travel. People from a greater range of social classes could afford to travel outside of their own countries.

General aviation

The use of mass-production techniques similar to those of the motor industry lowered the cost of private aircraft, with types such as the Cessna 172 and Beechcraft Bonanza seeing widespread use, the 172 eclipsing even wartime production levels.

Aircraft came to be used increasingly in specialist roles such as crop spraying, policing, fire fighting, air ambulances and many others.

As helicopter technology developed, they also came into widespread use, dominated by Sikorsky's approach of a single main rotor plus tail counter-torque rotor.

Sport flying also developed, with both powered aeroplanes and gliders becoming more sophisticated. The introduction of glass fibre construction allowed sailplanes to achieve new levels of performance. In the 1960s the re-introduction of the hang-glider, now using the flexible Rogallo wing, ushered in a new era of ultralight aircraft.

The development of safe gas burners led to the re-introduction of hot air ballooning, and it became a popular sport.

Supersonic transport

The introduction of the Concorde supersonic transport (SST) airliner to regular service in 1976 was expected to bring similar social changes, but the aircraft never found commercial success. After several years of service, the fatal crash of Air France Flight 4590 near Paris in July 2000 and other factors eventually caused Concorde flights to be discontinued in 2003. This was the only loss of an SST in civilian service. Only one other SST design was used in a civilian capacity, the Soviet era Tu-144, but it was soon withdrawn due to high maintenance and other issues. McDonnell Douglas, Lockheed and Boeing were three U.S. manufacturers that had originally planned to develop various SST designs since the 1960s, but these projects were eventually abandoned for various developmental, cost, and other practical reasons.

Ground activities

Manufacturing

The fabrication of riveted stressed-skin aluminium airframes was widespread by the end of the Second World War, although the use of wood for private aviation continued. The pursuit of greater strength for less weight led to the introduction of advanced, and often expensive, manufacturing techniques. Key developments during the 1960s and 70s included; milling a complex part from a solid billet rather than building it up from smaller parts, the use of synthetic resin adhesives in place of rivets to avoid stress concentrations and fatigue around the rivet holes, and electron beam welding.

The development of composite materials such as fibreglass and, later, carbon fibre, freed up designers to make more fluid, aerodynamic shapes. However the unknown properties of these novel materials meant that introduction has been slow and methodical.

Airports

Many military aerodromes became civilian airports after the war, while pre-war airports reverted to their former role. The rapid growth in air travel ushered in by the jet age required an equally rapid enlargement of airport facilities worldwide.

As jet airliners grew larger and passenger numbers per flight increased, larger and more sophisticated equipment was developed for handling the aircraft, passengers and baggage.

Radar systems became commonplace, with Air traffic control facilities needed to manage the large number of aircraft in the sky at any one time.

Runways were made longer and smoother to accommodate new, larger and faster aircraft, while safety considerations and night flying led to much improved runway lighting.

Major airports became such vast and busy places that their environmental impact became substantial and the siting of any new airport, or even the expansion of an existing one, became a major social and political affair.

Metal Fatigue

Without exception modern airliners rely almost exclusively on metal for their structure. All metals suffer from fatigue to some degree. Fatigue occurs when repeated loading leads to progressive structural damage and the growth of cracks. Once a fatigue crack has started, it will grow slightly with each loading cycle. The crack will continue to grow until it reaches a critical size at which point it will grow rapidly and lead to the complete fracture of the structure. Because of the dangers of fatigue, the concept of a failsafe was introduced. A failsafe is a secondary structure that will carry the load if the primary mechanism fails. Unfortunately it is usually weaker than the primary structure and provides only a short window for the failure to be found if disaster is to be avoided.

Accidents involving metal fatigue have been happening since the very first jet airliner took to the sky. They all have at least one of the following characteristics: poor design, flawed maintenance or inadequate repairs. Unfortunately the industry as a whole doesn't seem to have learnt and fatigue induced accidents continue with frightening regularity. Therefore vigilant maintenance is the only solution for an aircraft with a metal structure.

Terror at 22,000 ft - United Airlines Flight 811

On 24 February 1989 when 59 year old Captain David M. Cronin, a hugely experienced pilot, just two flights from retirement, with 28,000 flight hours, took charge of United Airlines Flight 911 little did he know that he'd soon be fighting to save his passengers - and crew - from an entirely avoidable accident. Soon after taking off from Honolulu, the cargo-door failed. The resulting explosive decompression blew out several rows of seats, killing nine passengers, at least one of whom ended up in the engine. The unfortunate victims remains were never found. Shockingly, the fault that caused this accident was well known in the industry.

The aircraft involved was a Boeing 747-122 that was delivered to United Airlines on 3 November 1970. It was well used having accumulated over 58,000 flight hours and 15,000 pressurisation cycles. On the day of the accident it was scheduled to fly from Los Angeles International Airport to Sydney Airport with intermediate stops at Honolulu International Airport and Auckland Airport in New Zealand. There were no problems on the first legs of the flight. Alongside Cronin was First Officer Gregory Allen "Al" Slader, aged 48, also hugely experienced with more than 14,000 hours, and Flight Engineer Randal Mark Thomas, 46. Looking after the 337 passengers were 15 flight attendants.

Flight 811 took off from Honolulu International Airport at 01:52. During the climb, the crew made preparations to detour around thunderstorms along the plane's track; the captain anticipated turbulence and kept the passenger seatbelt sign lit.

The aircraft had been flying for 17 minutes and was passing 22,000 ft when the flight crew heard a loud "thump", which shook the plane. About a second and a half later, the forward cargo door separated from the aircraft. It swung out with such force that it tore a massive hole in the fuselage. This caused the plane to slightly bank to the left. The pressure differential and aerodynamic forces caused the cabin floor to cave in, and 10 seats (G and H of rows 8 through 12) were ejected from the cabin along with their unfortunate occupants along with the passenger in seat 9F who hadn't fastened his seatbelt. By luck the plane wasn't full and seats 8G and 12G were unoccupied. A gaping hole was left in the aircraft, through which a flight attendant, Mae Sapolu, in the business class cabin, was almost blown out. Purser Laura Brentlinger hung on to the steps leading to the upper deck and was dangling from them when the decompression occurred. Passengers and crew members saw her clinging to a seat leg and were able to pull her back inside the cabin, although she was severely injured.

The pilots initially believed that a bomb had gone off inside the airliner, as this accident happened just two months after Pan Am Flight 103 was blown up over Lockerbie, Scotland. They began an emergency descent to reach an altitude where the air was breathable while also performing a 180° left turn to fly back to Honolulu. Adding to the passenger's terror and panic as they struggled to breathe, the explosion damaged components of the emergency oxygen supply system as it was primarily located in the forward cargo sidewall area, just aft of the (now missing) cargo door. They would have been even more terrified - if that was even possible - if they had known the pilots also had no oxygen. The flight attendants had portable oxygen bottles, but even these were problematic as the masks were not fitted to the bottles and the attendants struggled to attach them while struggling to breathe.

As well as dealing with the depressurisation and the need to descend, the pilots had to deal with the potential loss of two of the four engines. The debris ejected from the aircraft during the explosive decompression damaged the Number 3 and 4 engine - engine 3 was experiencing heavy vibration, and showed zero revolutions on the tachometer as well as a low exhaust-gas temperature and engine-pressure ratio leaving the crew with no choice but to shut it down. At 02:20, an emergency was declared, and the crew began dumping fuel to reduce the aircraft's landing weight. Engine number 4 soon also fell to almost zero revs, and it was emitting flames, so the pilots shut it down as well. Some of the explosively ejected debris also damaged the right wing's leading edge, dented the horizontal stabilizer on that side, and damaged the vertical stabilizer. It was a miracle it was still flying.

During the descent, Captain Cronin ordered Flight Engineer Thomas to tell the flight attendants to prepare for an emergency landing, but Thomas could not contact them through the intercom. Thomas asked the captain for permission to go down to find out what was happening, and Cronin agreed. Thomas saw severe damage immediately upon leaving the cockpit; the aircraft skin was peeled off in some areas on the upper deck, revealing the frames and stringers. As Thomas went down to the lower deck, the magnitude of the damage became apparent as he saw the large hole in the side of the cabin. Thomas returned to the cockpit and reported that a large section of the fuselage was open aft of the Number 1 exit door. Thomas concluded that it was probably a bomb and that considering the damage, slowing below the plane's stall speed by more than a small margin would be unwise.

As the airliner neared the airport, the landing gear was extended, but the flaps could only be partially deployed as a result of damage sustained following the decompression. This necessitated a higher-than-normal landing speed around 190 knots. Despite all these problems, Captain Cronin was able to bring the aircraft to a halt without overrunning the runway. Fourteen minutes since the emergency was declared, all the remaining passengers and crew were able to evacuate the plane although every flight attendant suffered some injury during the evacuation, ranging from scratches to a dislocated shoulder.

Despite extensive air and sea searches, no remains of the nine victims lost in flight were found at sea.

Investigation

The National Transportation Safety Board (NTSB) immediately commenced an investigation into the accident. An extensive aerial and surface search of the ocean had initially failed to locate the aircraft's cargo door. The NTSB proceeded with its investigation, without the cargo door to inspect, issuing a final report on 16 April 1990.

The investigation relied heavily on circumstantial evidence, including prior incidents involving cargo doors. On 10 March 1987, Pan Am Flight 125, another Boeing 747, outbound from London Heathrow Airport, had pressurisation problems at 20,000 f, causing the crew to abort the flight and return to the airport. After that aircraft landed safely back at London Heathrow Airport, the aircraft's cargo door was found to be ajar by about 1.5 inches along its ventral edge. When the aircraft was examined further, all of the door's locking arms were found to be either damaged or entirely sheared off. Boeing initially attributed this to mishandling by ground crew. To test this theory, Boeing instructed 747 operators to shut and lock the cargo door with the external handle and then activate the door-open switch with the handle still in the locked position. Nothing should have happened since the S-2 switch was designed to deactivate the door motors if the handle was locked. Some airlines reported that the door motors did indeed begin running; however, they attempted to force the door open against the locking sectors and caused damage to the mechanism.

Based on the evidence available and the attribution of prior cargo door malfunctions to damage caused by ground crew mishandling, the NTSB's investigative findings were rooted in the supposition that a properly latched and locked 747 cargo door could not open in flight:

There are no reasonable means by which the door locking and latching mechanisms could open mechanically in flight from a properly closed and locked position. If the lock sectors were in proper condition and were properly situated over the closed latch cams, the lock sectors had sufficient strength to prevent the cams from vibrating to the open position during ground operation and flight. Nonetheless, there are two possible means by which the cargo door could open while in flight. Either the latching mechanisms were forced open electrically through the lock sectors after the door was secured, or the door was not properly latched and locked before departure. Then, the door opened when the pressurization loads reached a point that the latches could not hold.

The NTSB learned that in N4713U's case, the aircraft had experienced intermittent malfunctions of its forward cargo door in the months before the accident. Based on this information and the presumption of in-service damage, the NTSB concluded in its April 1990 report that these malfunctions had damaged the door locking mechanism, in a way that caused the door to show a latched and locked indication without being fully latched and locked. The report criticized the component design; it also criticized the airline for improper maintenance and inspection and thus failing to identify locking mechanism damage.

The Boeing 747 was designed with an outward-hinging cargo door, unlike a plug door, which opens inward and jams against its frame when closed as the pressure drops outside in flight, making accidental opening at high altitude impossible. The outward-swinging door increases the aircraft's available cargo capacity (less room inside the fuselage must be kept clear to accommodate the door's range of motion) but requires a strong locking mechanism to keep it closed. Deficiencies in the design of wide-body aircraft cargo doors have been known since the early 1970s due to flaws in the McDonnell Douglas DC-10 cargo door. These problems were not fully addressed by the aircraft industry or the Federal Aviation Administration despite the warnings and deaths from the DC-10's cargo door-related accidents.

The 747's cargo door used a series of electrically operated latch cams into which the door-edge latch pins closed. The cams then rotated into a closed position, holding the door closed. A series of L-shaped arms (called locking sectors) were actuated by the final manual movement of a lever to close the door; these were designed to reinforce the unpowered latch cams and prevent them from rotating into an unlocked position. The locking sectors were made out of aluminium, however, and they were too thin to keep the latch cams from moving into the unlocked position against the power of the door motors. Electrical switches cut electrical power to the cargo door when the outer handle was closed; if one was faulty, the motors could still draw power and rotate the latch cam to the open position. The same event could happen if frayed wires could power the cam motor, even if the safety switch cut the circuit power.

As early as 1975, Boeing realised that the aluminium locking sectors were too thin to be effective and recommended the airlines add doublers to the locking sectors. After the 1987 Pan Am incident, Boeing issued a service bulletin notifying operators to replace the aluminium locking sectors with steel locking sectors and conduct various inspections. In the United States, the FAA mandated this service through an airworthiness directive in July 1988 and gave U.S. airlines 18 to 24 months to comply with it. After the Flight 811 accident, the FAA shortened the deadline to 30 days.

On 26 September and 1 October 1990, two halves of Flight 811's cargo door were recovered by the crewed deep-sea submersible Sea Cliff from the Pacific Ocean at a depth of 14,000 feet. The cargo door had fractured lengthwise across the centre. No other debris or evidence of human remains was discovered. The NTSB inspected the cargo door and determined that the condition of the locking mechanism did not support its original conclusions.

Additionally, in 1991, an incident occurred at New York's John F. Kennedy International Airport involving the malfunction of another United Airlines Boeing 747 cargo door. At the time, United Airlines' maintenance staff was investigating the cause of a circuit-breaker trip. In diagnosing the cause, an inadvertent operation of the electric door latch mechanism caused the cargo door to open spontaneously despite being closed. An inspection of the door's electrical wiring discovered insulation breaches, and isolating certain electrical wires allowed the door to operate normally again. The lock sectors, latch cams, and latch pins on the door were inspected, and did not show any signs of damage of the type predicted by the NTSB's original hypothesis.

Based on developments after it issued its original report in April 1990, the NTSB issued a superseding accident report on 18 March 1992. In this report, the NTSB determined that the probable cause of the accident was the sudden opening of the cargo door, which was attributed to improper wiring and deficiencies in the door's design. It appeared in this case that a short circuit caused an unordered rotation of the latch cams, which forced the weak aluminium locking sectors to distort and allow the rotation, thus enabling the air pressure differential and aerodynamic forces to blow the door off the fuselage, ripping away the hinge fixing structure, the cabin floor, and the side fuselage skin, and causing the explosive decompression.

The NTSB recommended that all 747-100s in service at the time replace their cargo door latching mechanisms with new, redesigned locks. What can we conclude? That the airline industry learns too slowly.

Fire Down Below - ValuJet Flight 592

Fires can occur anywhere. The most common, perhaps unsurprisingly, are engine fires. But bad decisions and bad practice can put a plane at risk from fire in more unusual ways. ValuJet Flight 592 was a DC-9 on a domestic passenger flight between Miami International Airport, in Florida, and Hartsfield-Jackson Atlanta International Airport in Georgia. It disappeared over the Florida Everglades on 11 May 1996.

There were 105 passengers on board, as well as a crew of two pilots and three flight attendants, bringing the total number of people on board to 110. At 2:04 pm, 10 minutes before the disaster, the DC-9 took off from runway 9L and began a normal climb.

At 2:10 pm, Captain Candalyn Kubeck and First Officer Richard Hazen heard a loud bang in their headphones, and noticed the plane was losing electrical power. Seconds later, flight attendant Mandy Summers entered the cockpit and advised the flight crew of a fire in the passenger cabin. Passengers' shouts of "fire, fire, fire" were recorded on the plane's cockpit voice recorder when the cockpit door was opened. Though the ValuJet flight attendant manual stated that the cockpit door should not be opened when smoke or other harmful gases might be present in the cabin, the intercom was disabled and there was no other way to inform the pilots of what was happening.

Kubeck and Hazen immediately asked air traffic control for a return to Miami due to smoke in the cockpit and cabin, and were given instructions for a return to the airport. One minute later, Hazen requested the nearest available airport. Kubeck began to turn the plane left in preparation for the return to Miami.

Flight 592 disappeared from radar at 2:13:42 pm. It rolled onto its side and crashed to the ground nose-first in the Francis S. Taylor Wildlife Management Area in the Everglades, a few miles west of Miami, at a speed in excess of 500 mph. The crew continued to fly the plane until about seven seconds before impact, likely until the front left floor beams collapsed and caused failure of the flight controls. Everyone on board was killed. Recovery of the aircraft and victims was made extremely difficult by the location of the crash. The nearest road of any kind was more than a quarter of a mile away from the crash scene, and the location of the crash itself was a deep-water swamp. The DC-9 shattered on impact leaving very few large portions of the plane intact. Sawgrass, alligators, and risk of bacterial infection from cuts plagued searchers involved in the recovery effort. No intact bodies were ever recovered, only human remains.

Investigation

The NTSB investigation eventually determined that the fire that downed Flight 592 began in a cargo compartment below the passenger cabin. The cargo compartment was of a Class D design, in which fire suppression is accomplished by sealing off the hold from outside air. Any fire in such an airtight compartment will in theory quickly exhaust all available oxygen and then burn itself out. As the fire suppression is accomplished without any intervention by the crew, such holds are not equipped with smoke detectors. However, the NTSB determined that just before takeoff, expired chemical oxygen generators were placed in the cargo compartment in five boxes marked COMAT (Company-Owned MATerial) by ValuJet's maintenance contractor, SabreTech, in contravention of FAA regulations forbidding the transport of hazardous materials in aircraft cargo holds. Failure to cover the firing pins for the generators with the prescribed plastic caps made an accidental activation much more likely. Rather than covering the firing pins, the SabreTech workers simply taped the cords around the cans, or cut them, and used tape to stick the ends down. It is also possible that the cylindrical, tennis ball can-sized generators were loaded on board in the mistaken belief that they were just empty canisters, thus being certified as safe to transport in an aircraft cargo compartment. SabreTech employees indicated on the cargo manifest that the "oxy canisters" were "empty" instead of being expired oxygen generators. ValuJet employees interpreted this to mean that they were empty oxygen canisters, when in fact they were neither simple oxygen canisters, nor empty.

Chemical oxygen generators, when activated, produce oxygen. As a byproduct of the exothermic chemical reaction, they also produce a great quantity of heat. These two together were sufficient not only to start an accidental fire, but also to produce enough oxygen to keep the fire burning. The fire risk was made much worse by the presence of combustible aircraft wheels in the hold. Two main tyres and wheels and a nose tyre and wheel were also included in the COMAT. NTSB investigators theorized that when the plane experienced a slight jolt while taxiing on the runway, an oxygen generator activated, producing oxygen and heat. Laboratory testing showed that canisters of the same type could heat nearby materials up to 250C, enough to ignite a smouldering fire. The oxygen from the generators fed the resulting fire in the cargo hold without any need for outside air, defeating the airtight fire suppression design. A pop and jolt heard on the cockpit voice recorder and correlated with a brief and dramatic spike in the altimeter reading in the flight data recorder were attributed to the sudden cabin pressure change caused by a semi-inflated aircraft wheel in the cargo hold exploding in the fire.

Smoke detectors in the cargo holds can alert the flight crew of a fire long before the problem becomes apparent in the cabin, and a fire suppression system buys valuable time to land the plane safely. In February 1998, the FAA issued revised standards requiring all Class D cargo holds to be converted by early 2001 to Class C or E; these types of holds have additional fire detection and suppression equipment. For the victims it was far too late.

The NTSB report placed responsibility for the accident on three parties:

SabreTech, for improperly packaging and storing hazardous materials,
ValuJet, for not supervising SabreTech, and
the FAA, for not mandating smoke detection and fire suppression systems in cargo holds.

ValuJet was grounded by the FAA on June 16, 1996. It was allowed to resume flying again on September 30, but never recovered from the crash. In 1997, the company merged with AirTran Airways. Although ValuJet was the nominal survivor, the ValuJet name was so tarnished by this time that it was scrapped in favor of the AirTran name. In 2006, AirTran did not make any major announcements on the crash's 10th anniversary out of respect for the victims' families.

Many families of the Flight 592 victims were outraged that ValuJet was not prosecuted, given the airline's poor safety record. ValuJet's accident rate was not only one of the highest in the low-fare sector, but 14 times higher than those of the major airlines. In the aftermath of the accident, an internal FAA memo surfaced questioning whether ValuJet should have been allowed to stay in the air. The victims' families also point to statements made by ValuJet officials immediately after the crash that appeared to indicate the company knew the generators were on the plane, and in fact had ordered them returned to Atlanta rather than properly disposed of in Miami.

Hanging on by the Fingertips - British Airways Flight 5390

When British Airways Flight 5390 took off from Birmingham Airport for the short hop to Málaga nobody could have predicted the dramatic events that would follow 15 minutes later. Extraordinary airmanship and courage from the crew would return the BAC One-Eleven, registration GBJRT, to the ground with no loss of life. The captain was 42-year-old Tim Lancaster, who had logged 11,050 flight hours, including 1,075 hours on the BAC One-eleven; the copilot was 39-year-old Alastair Atchison, with 7,500 flight hours, with 1,100 of them on the BAC One-eleven. Atchison would need every hour of that experience to save the 81 passengers and four cabin crew.

After a routine take-off at 08:20, the plane climbed out of Birmingham. With everything normal, both pilots released their shoulder harnesses and Captain Lancaster loosened his lap belt. By 08:33 the plane had climbed through about 17,300 ft and was passing over Oxfordshire. The cabin crew began preparing the meal service. Checking in with the flight crew, Air Steward Nigel Ogden had just entered the cockpit when there was a loud bang as the left windscreen panel, in front of Captain Lancaster, exploded outwards, decompressing the plane and filling the cabin with condensation. With his seat belt loose, Lancaster was propelled out of his seat by the rushing air from the decompression and forced head first out of the flight deck. His knees were caught on the flight controls and his upper torso remained outside the aircraft, exposed to extreme wind and cold. To make matters worse, the autopilot disengaged, causing the plane to descend rapidly. The decompression had also blown the flight deck door onto the control console, blocking the throttle control and causing the aircraft to gain speed as it descended. Adding to the confusion, papers and debris blew into the flight deck from the passenger cabin. Reacting with astonishing speed, Ogden grabbed Lancaster's belt, preventing him from being dragged out of the plane - something that would have both killed the captain and imperilled the plane if his body had impacted the wings or engines. Meanwhile the other two air stewards secured loose objects, reassured passengers, and instructed them to adopt brace position] in anticipation of an emergency landing.

Atchison had taken control immediately after the decompression and continued the emergency descent to reach an altitude with sufficient air pressure. Once low enough, he re-engaged the autopilot and broadcast a distress call, requesting clearance for an immediate approach to the nearest airport, but he was unable to hear the response from air traffic control because of wind noise; the difficulty in establishing two-way communication led to a delay in initiation of emergency procedures.

Ogden was still holding on to Lancaster, but was reaching the limit of his endurance and was developing frostbite. Chief steward John Heward and air steward Simon Rogers took over the task of holding on to the captain. By this time Lancaster had shifted several inches farther outside and his head was repeatedly striking the side of the fuselage. The crew believed him to be dead, but Atchison told the others to continue holding onto him, out of fear that letting go of him might cause him to strike the left wing, engine, or horizontal stabiliser, potentially damaging it.

Eventually, Atchison was able to hear the clearance from air traffic control to make an emergency landing at Southampton Airport. The air stewards managed to free Lancaster's ankles from the flight controls while still keeping hold of him. At 08:55 , the aircraft landed at Southampton and the passengers disembarked using boarding steps. Miraculously, Lancaster survived with relatively minor injuries: frostbite, bruising, shock, and fractures to his right arm, left thumb and right wrist. Later Atchison and cabin crew members Susan Gibbins and Nigel Ogden were awarded the Queen's Commendation for Valuable Service in the Air for their actions.

Police found the windscreen panel and many of the 90 bolts securing it near Cholsey, Oxfordshire. Investigators found that when the windscreen was installed 27 hours before the flight, 84 of the bolts used were too small in diameter and the remaining six were the correct diameter but too short. How had such an error occurred? The previous windscreen had also been fitted using incorrect bolts, which were replaced by the shift maintenance manager on a like-for-like basis without reference to maintenance documentation, as the plane was due to depart shortly. The undersized bolts were unable to withstand the air pressure difference between the cabin and the outside atmosphere during flight. The final report was particularly telling. Not only had the shift maintenance manager responsible for installing the incorrect bolts failed to follow British Airways policies but he had not been wearing his normal spectacles, which impacted his ability to read the documentation. The policies compounded the problem by not requiring supervision or checking of work. Without extraordinary luck, and incredible airmanship, 87 people could have lost their lives due to a failure to wear glasses.

Disaster Foreshadowed - American Airlines Flight 96

On 12 June 1972 Captain Bryce McCormick (age 52), First Officer Peter "Page" Whitney (34), and Flight Engineer Clayton Burke (50) were in the cockpit of American Airlines Flight 96. McCormick was a highly experienced pilot, having amassed more than 24,000 flight hours throughout his flying career. Whitney and Burke were also seasoned airmen with approximately 7,900 flight hours and 13,900 flight hours, respectively. Flight 96 was supposed to be just an ordinary domestic flight operated from Los Angeles to New York, one of hundreds of similar flights that take off every day in the United States. On 12 June it became anything but ordinary.

The flight left Los Angeles 46 minutes after its scheduled 13:30 departure due to passenger loading and traffic, and arrived in Detroit at 18:36. In Detroit, the majority of the passengers disembarked, and the aircraft took on new passengers and cargo. Leaving Detroit, the aircraft had 56 passengers and 11 crew. At 19:25, while climbing through 11,750 ft the crew heard a distinct "thud" and dirt in the cockpit flew up into their faces. The "thud" was the sound of the rearmost cargo door breaking off, causing a sudden decompression that also caused part of the floor at the rear of the cabin to partially give way. Captain McCormick momentarily believed they had suffered a mid-air collision and the cockpit windows had been smashed. At the same time, the rudder pedals moved to their full-right position and the engine controls moved to idle. McCormick immediately took manual control of the aircraft and attempted to re-apply power, finding that both wing mounted engines were responsive but engine number 2, in the tail, would not allow its controls to be moved, as control cables had been severed when the floor gave way. Despite the engine failure, and the jammed rudder, McCormick managed to level off and stabilise the speed at 250 knots, although at this speed control was very sluggish. They declared an emergency and requested routing back to Detroit.

In the cabin, the flight attendants saw a "fog" form within the cabin and immediately recognized it as a depressurisation. Two crew were in the rear lounge area, and the floor under their feet partially collapsed into the cargo hold, giving them both minor injuries. In spite of this, the cabin crew immediately attempted to ensure the oxygen masks had deployed properly, but having occurred below the 14,000 ft limit, the masks had not deployed. One of the attendants obtained a walk-around oxygen bottle and called the cockpit on the intercom to inform them that the damage was in the rear of the aircraft. On instructions from the cockpit, the attendants instructed the passengers on emergency landing procedures.

The aircraft returned to Detroit, but, when the crew set the flaps for landing, the aircraft stabilised in a 1,900 ft/min descent rate that was far too fast for landing. By applying power to the two working engines, McCormick managed to level off the nose and reduce the descent rate to a much better 700 ft/min. At 19:44 the aircraft touched down immediately veering to the right and eventually leaving the runway surface. First Officer Whitney applied full reverse thrust to the left engine and idled the right one, straightening the aircraft's path, and eventually starting to bring the aircraft back to the runway. The aircraft stopped less than 1,000 ft from the end of the runway, with the nose and left gear on the runway and the right on the grass beside it. By great skill and a fair amount of luck a disaster had been averted - McCormick had practiced, in a simulator, controlling the plane with the throttles in this fashion, in the worst-case scenario of a hydraulic failure.

So what had caused the door to blow out? Bad design and bad engineering. Passenger doors on the DC-10 are of the plug variety, which prevents the doors from opening while the aircraft is pressurized. The cargo door, however, is not. Due to its large area, the cargo door on the DC-10 could not be swung inside the fuselage without taking up a considerable amount of valuable cargo space. Instead, the door swung outward, allowing cargo to be stored directly behind it. The outward-opening door, in theory, allowed it to be "blown open" by the pressure inside the cargo area. To prevent this, the DC-10 used a supposedly "fail-safe" latching system held in place by "over top dead centre latches", five C-shaped latches mounted on a common torque shaft that are rotated over fixed latching pins ("spools") fixed to the fuselage. Because of their shape, when the latches are in the proper position, pressure on the door does not place torque on the latches that could cause them to open, and further seats them on the pins. Normally the latches are opened and closed by a screw jack powered by an electric actuator motor.

Because the wiring powering the actuator motor was too small, it was possible for the voltage delivered to the motor to drop too low for it to operate as designed under high loads. In these cases, the motor would stop turning even if the latches had not rotated over the pins. Since the operators listened for the motors to stop as an indication of their complete rotation, a failure in the drive system during operation would erroneously indicate that the door was properly latched.

To ensure this rotation had completed and the latches were in the proper position, the DC-10 cargo door also included a separate locking mechanism. The locks consisting of small pins that were slid horizontally through holes on the back of the latches, between the latch and the frame of the aircraft. When the pins were in place, they mechanically prevented movement back into the open position, so even the actuator motor could no longer open them. If the latches were not in their correct positions, the pins could not enter the holes, and the operating handle on the outside of the door would remain open and visually indicate that there was a problem. Additionally, the handle moved a metal plug into a vent cut in the outer door panel; if the vent was not plugged the door would not retain pressure, eliminating any force on the door. Lastly, there was an indicator light in the cockpit that would remain on if the door was not correctly latched.

In theory, motor failure on the plane could not present a problem because it would fail to close the locking lever. During the investigation, however, a McDonnell Douglas test rig demonstrated that the entire locking pin operating system was too weak, allowing the handle to be forced closed even with the pins out of the locking holes. This occurred on Flight 96, when the handler forced the handle closed with his knee. In spite of the vent not closing completely, neither the handler nor the engineer considered this to be serious. Although the vent door remained partially open, it closed enough to cause it to "blow shut", and thereby allow pressurization of the cargo hold. Although the handle did not seat the pins entirely, the small amount of motion it managed to cause was enough to press on the warning indicator switch, deactivating the cockpit warning light. It was only the combination of all of these failures that allowed the accident to happen. Yet all of these indicators shared a single point of failure: the mechanical weakness of the locking system that allowed the handle to be moved.

The cabin floor failure was also a matter of poor design. All other areas of the cargo holds had holes cut into the cabin floor above the cargo areas. In the case of a pressure loss on either side of the floor, the air would flow through the vents and equalize the pressure, thereby eliminating any force on the floor. Only the rearmost portion of the cabin lacked these holes, and it was that portion that failed. Because control cables ran through the floor for the entire length of the aircraft, a failure at any point on the floor could cut control to the tail section.

The National Transportation Safety Board suggested two changes to the DC-10 to ensure that a similar accident couldn't happen again: changes to the locking mechanism to ensure it could not be forced closed, as well as vents in the rear cabin floor. However, in an example of regulators being too close to the industry they regulate, the Federal Aviation Administration, in charge of implementing these recommendations, agreed with McDonnell Douglas that the additional venting would be difficult to install. Instead, they proceeded with the modification of the locking system and additionally added a small clear window set into the bottom of the cargo door that allowed operators to directly inspect whether or not the latches were in place. Combined with the upgrades to the wiring that had already been on the books, this was expected to prevent a repeat of the accident. Added to this, shortly after the event, Dan Applegate, Director of Product Engineering at Convair, wrote a memo to Convair management pointing out several problems with the door design. McDonnell Douglas had subcontracted design and construction of the DC-10 fuselage to Convair, and Applegate had overseen its development in ways that he felt were reducing the safety of the system. In particular, he noted that the actuator system had been switched from a hydraulic system to an electrical one, which he felt was less safe. He also noted that the floor would be prone to failure if the door was lost, and this would likely sever the control cables, leading to a loss of the aircraft. Finally, he pointed out that this precise failure had already occurred in ground testing in 1970, and he concluded that such an accident was almost certain to occur again in the future. If only someone had listened...

In spite of these recommendations, on 3 March 1974, less than two years after the near-loss of Flight 96, Turkish Airlines Flight 981 crashed outside Paris, killing all 346 passengers and crew on board in an identical rear cargo door failure. Unlike Flight 96, where the crew still managed to keep enough flight controls to safely return to Detroit, the pilots of Flight 981 completely lost control of the tail surfaces and all hydraulics. Investigators discovered that the upgrades had never been carried out on this airframe, although the construction logs claimed they had been. One modification had been carried out, the installation of the inspection window, along with a placard beside the door controls printed in English and Turkish that informed the operators how to inspect the latches. The operator in Paris was Algerian and could not read either language and had been instructed that as long as the locking handle closed, the door was safe. He also noted that he did not have to force the handle, and investigators concluded that it had already been bent on a prior flight.

In the aftermath of Flight 981, the Applegate memorandum was discovered and introduced into evidence during the massive civil lawsuit that followed. Many commentators subsequently blamed the aircraft manufacturer, McDonnell Douglas, and other aviation authorities, for failing to learn lessons from the Flight 96 accident. Although there had been some redesign of the DC-10 cargo door system, it had only been implemented voluntarily and haphazardly by various airlines. If the warning signs of Flight 96 had been heeded, it is likely that the crash of Flight 981 would have been prevented. Too late for 346 innocent victims of a failed system - a complete redesign of the entire door system followed, and no DC-10 or MD-11 ever suffered a similar accident again but it was all far, far too late.

Bad Design, Bad Maintenance - TWA 800

The investigation that followed the midair explosion of TWA 800 on 17 July 1996 would be the longest, most complex and expensive in U.S. history. It would also prove to be controversial and give rein to accusations of cover-up and conspiracy. Ultimately though, the disaster would be shown to be due to the most prosaic of causes: bad design and shoddy maintenance.

Trans World Airlines Flight 800 was a Boeing 747-131. The aircraft, registration N93119, was manufactured in July 1971; it had been ordered by Eastern Air Lines, but after Eastern canceled its 747 orders, the plane was purchased new by Trans World Airlines. It had completed 16,869 flights with 93,303 hours of operation. The day of the accident, the plane departed from Athens and arrived at John F. Kennedy International Airport (JFK) where it was refueled and the crew changed. The crew for the upcoming flight was 58-year-old Captain Ralph G. Kevorkian, with 18,800 flight hours, 57-year-old Captain/Check Airman Steven E. Snyder with 17,000 flight hours, and 63-year-old Flight Engineer/Check Airman Richard G. Campbell, as well as 25-year-old flight engineer trainee Oliver Krick, who was starting the sixth leg of his initial operating experience training. While Snyder was officially the captain, the planned flight was a training flight for Kevorkian and he was, therefore, seated in the captain's (left) seat.

The ground-maintenance crew locked out the thrust reverser for engine #3 because of technical problems with the thrust reverser sensors during the inbound landing at JFK, prior to Flight 800's departure. Additionally, severed cables for the engine #3 thrust reverser were replaced. During refueling of the aircraft, the volumetric shutoff (VSO) control was believed to have been triggered before the tanks were full. To continue the pressure fueling, a TWA mechanic overrode the automatic VSO by pulling the volumetric fuse and an overflow circuit breaker. Maintenance records indicate that the airplane had numerous VSO-related maintenance writeups in the weeks before the accident.

TWA 800 was scheduled to depart JFK for Charles de Gaulle Airport around 7:00 p.m., but the flight was delayed until 8:02 p.m. by a disabled piece of ground equipment and a passenger/baggage mismatch. After the owner of the baggage in question was confirmed to be on board, the flight crew prepared for departure and the aircraft pushed back from Gate 27 at the TWA Flight Center. The flight crew started the engines at 8:04 pm. however, because of the previous maintenance undertaken on engine #3, the flight crew only started engines #1, #2, and #4. Engine #3 was started ten minutes later at 8:14 pm. Taxi and takeoff proceeded uneventfully.

TWA 800 then received a series of heading changes and generally increasing altitude assignments as it climbed to its intended cruising altitude. Weather in the area was benign with light winds and scattered clouds. The last radio transmission from the airplane occurred at 8:30 p.m. when the flight crew received and then acknowledged instructions from Boston Air Route Traffic Control Center to climb to 15,000 ft. The last recorded radar transponder return from the airplane was recorded by the Federal Aviation Administration (FAA) radar site at Trevose, Pennsylvania at 8:31:12 p.m.

What happened next stunned onlookers. Thirty-eight seconds after the last contact the captain of an Eastwind Airlines Boeing 737 reported to Boston ARTCC that he "just saw an explosion out here", adding, "we just saw an explosion up ahead of us here... about 16,000 ft or something like that, it just went down into the water." Subsequently, many air traffic control facilities in the New York/Long Island area received reports of an explosion from other pilots operating in the area. Many witnesses in the vicinity of the crash stated that they saw or heard explosions, accompanied by a large fireball or fireballs over the ocean, and observed debris, some of which was burning while falling into the water.

Various civilian, military, and police vessels reached the crash site and searched for survivors within minutes of the initial water impact, but found none, making TWA 800 the second-deadliest aircraft accident in United States history at that time.

The NTSB was notified about 8:50 p.m. the day of the accident; a full "go team" was assembled in Washington, D.C. and arrived on scene early the next morning. Meanwhile, initial witness descriptions led many to believe the cause of the crash was a bomb or surface-to-air missile attack. Given the potential for criminal causes, the FBI initiated a parallel investigation alongside the NTSB's accident investigation.

The search-and-rescue began immediately: a helicopter of the New York Air National Guard saw the explosion from approximately eight miles away, and arrived on scene so quickly that debris was still raining down, and the aircraft had to pull away. They reported their sighting to the tower at Suffolk County Airport. Later, remote-operated vehicles (ROVs), side-scan sonar, and laser line-scanning equipment were used to search for and investigate underwater debris fields. Victims and wreckage were recovered by scuba divers and ROVs; later scallop trawlers were used to recover wreckage embedded in the sea floor. In one of the largest diver-assisted salvage operations ever conducted, often working in very difficult and dangerous conditions, over 95% of the airplane wreckage was eventually recovered. The search and recovery effort identified three main areas of wreckage underwater :the yellow zone, red zone, and green zone contained wreckage from front, centre, and rear sections of the airplane, respectively. The green zone with the tail section of the aircraft was located the furthest along the flight path.^:71–74

Pieces of wreckage were transported by boat to shore and then by truck to leased hangar space at the former Grumman Aircraft facility in Calverton, New York, for storage, examination, and reconstruction. This facility became the command centre and headquarters for the investigation. NTSB and FBI personnel were present to observe all transfers to preserve the evidentiary value of the wreckage. The cockpit voice recorder and flight data recorder were recovered by U.S. Navy divers one week after the accident; they were immediately shipped to the NTSB laboratory in Washington, D.C., for readout. The victims' remains were transported to the Suffolk County Medical Examiner's Office in Hauppauge, New York.

With lines of authority unclear, differences in agendas and culture between the FBI and NTSB resulted in discord. The FBI, from the start assuming that a criminal act had occurred saw the NTSB as indecisive. Expressing frustration at the NTSB's unwillingness to speculate on a cause, one FBI agent described the NTSB as "No opinions. No nothing." Meanwhile, the NTSB was required to refute or play down speculation about conclusions and evidence, frequently supplied to reporters by law enforcement officials and politicians. The International Association of Machinists and Aerospace Workers, an invited party to the NTSB investigation, criticized the undocumented removal by FBI agents of wreckage from the hangar where it was stored.

Although there were considerable discrepancies between different accounts, most witnesses to the accident had seen a "streak of light" that was described by 38 of 258 witnesses as ascending,^[2]^:232 moving to a point where a large fireball appeared, with several witnesses reporting that the fireball split in two as it descended toward the water.^[2]^:3 There was intense public interest in these witness reports and much speculation that the reported streak of light was a missile that had struck TWA 800, causing the airplane to explode.^[2]^:262 These witness accounts were a major reason for the initiation and duration of the FBI's criminal investigation.^[3]^:5

Approximately 80 FBI agents conducted interviews with potential witnesses daily.^[3]^:7 No verbatim records of the witness interviews were produced; instead, the agents who conducted the interviews wrote summaries that they then submitted.^[3]^:5 Witnesses were not asked to review or correct the summaries.^[3]^:5 Included in some of the witness summaries were drawings or diagrams of what the witness observed. Witnesses were not allowed to testify at the court hearings.^[1]^:165^[4]^:184

Within days of the crash the NTSB announced its intent to form its own witness group and to interview witnesses to the crash.^[3]^:6 After the FBI raised concerns about non-governmental parties in the NTSB's investigation having access to this information and possible prosecutorial difficulties resulting from multiple interviews of the same witness,^[3]^:6 the NTSB deferred and did not interview witnesses to the crash. A Safety Board investigator later reviewed FBI interview notes and briefed other Board investigators on their contents. In November 1996, the FBI agreed to allow the NTSB access to summaries of witness accounts in which personally identifying information had been redacted and to conduct a limited number of witness interviews. In April 1998, the FBI provided the NTSB with the identities of the witnesses but due to the time elapsed a decision was made to rely on the original FBI documents rather than reinterview witnesses.^[2]^:229

Further investigation and analysis

Examination of the cockpit voice recorder (CVR) and flight data recorder data showed a normal take off and climb,^[5]^:4 with the aircraft in normal flight^[6]^:2 before both abruptly stopped at 8:31:12 pm.^[2]^:3 At 8:29:15 pm, Captain Kevorkian was heard to say, "Look at that crazy fuel flow indicator there on number four... see that?"^[2]^:2 A loud noise recorded on the last few tenths of a second of the CVR was similar to the last noises recorded from other airplanes that had experienced in-flight breakups.^[2]^:256 This, together with the distribution of wreckage and witness reports, all indicated a sudden catastrophic in-flight breakup of TWA 800.^[2]^:256

Possible causes of the in-flight breakup

Investigators considered several possible causes for the structural breakup: structural failure and decompression, detonation of a high-energy explosive device, such as a missile warhead exploding either upon impact with the airplane, or just before impact, a bomb exploding inside the airplane, or a fuel-air explosion in the centre wing fuel tank.^[2]^:256–257

Structural failure and decompression

Close examination of the wreckage revealed no evidence of structural faults such as fatigue, corrosion or mechanical damage that could have caused the in-flight breakup.^[2]^:257 It was also suggested that the breakup could have been initiated by an in-flight separation of the forward cargo door like the disasters on board Turkish Airlines Flight 981 or United Airlines Flight 811, but all evidence indicated that the door was closed and locked at impact.^[2]^:257 The NTSB concluded that "the in-flight breakup of TWA flight 800 was not initiated by a pre-existing condition resulting in a structural failure and decompression."^[2]^:257

Missile or bomb detonation

A review of recorded data from long-range and airport surveillance radars revealed multiple contacts of airplanes or objects in TWA 800's vicinity at the time of the accident.^[2]^:87–89 None of these contacts intersected TWA 800's position at any time.^[2]^:89 Attention was drawn to data from the Islip, New York, ARTCC facility that showed three tracks in the vicinity of TWA 800 that did not appear in any of the other radar data.^[2]^:93 None of these sequences intersected TWA 800's position at any time either.^[2]^:93 All the reviewed radar data showed no radar returns consistent with a missile or other projectile traveling toward TWA 800.^[2]^:89

The NTSB addressed allegations that the Islip radar data showed groups of military surface targets converging in a suspicious manner in an area around the accident, and that a 30-knot radar track, never identified and 3 nautical miles from the crash site, was involved in foul play, as evidenced by its failure to divert from its course and assist with the search and rescue operations.^[2]^:93 Military records examined by the NTSB showed no military surface vessels within 15 NM of TWA 800 at the time of the accident.^[2]^:93 In addition, the records indicated that the closest area scheduled for military use, warning area W-387A/B, was 160 NM south.^[2]^:93

The NTSB reviewed the 30-knot target track to try to determine why it did not divert from its course and proceed to the area where the TWA 800 wreckage had fallen. TWA 800 was behind the target, and with the likely forward-looking perspective of the target's occupant(s), the occupants would not have been in a position to observe the aircraft's breakup or subsequent explosions or fireball(s).^[2]^:94 Additionally, it was unlikely that the occupants of the target track would have been able to hear the explosions over the sound of its engines and the noise of the hull traveling through water, even more so if the occupants were in an enclosed bridge or cabin.^[2]^:94 Further, review of the Islip radar data for other similar summer days and nights in 1999 indicated that the 30-knot track was consistent with normal commercial fishing, recreational, and cargo vessel traffic.^[2]^:94

Recorded radar data
Radar data showing vehicle and/or object tracks within 10 NM of TWA flight 800 just before the accident.^[2]^{(fig. 25, p. 90)}
Three sequences of primary returns near TWA 800 that were only recorded by the Islip radar.^[2]^{(fig. 26, p. 91)}
Primary radar returns that appeared near the TWA 800 after 8:31:12 pm. The 30-knot track is at the bottom centre of the image.^[2]^{(fig. 27, p. 92)}

Trace amounts of explosive residue were detected on three samples of material from three separate locations of the recovered airplane wreckage (described by the FBI as a piece of canvas-like material and two pieces of a floor panel).^[2]^:118 These samples were submitted to the FBI's laboratory in Washington, D.C., which determined that one sample contained traces of cyclotrimethylenetrinitramine (RDX), another nitroglycerin, and the third a combination of RDX and pentaerythritol tetranitrate (PETN);^[2]^:118 these findings received much media attention at the time.^[7]^[8] In addition, the backs of several damaged passenger seats were observed to have an unknown red/brown-shaded substance on them.^[2]^:118 According to the seat manufacturer, the locations and appearance of this substance were consistent with adhesive used in the construction of the seats, and additional laboratory testing by NASA identified the substance as being consistent with adhesives.^[2]^:118

Further examination of the airplane structure, seats, and other interior components found no damage typically associated with a high-energy explosion of a bomb or missile warhead ("severe pitting, cratering, petalling, or hot gas washing").^[2]^:258 This included the pieces on which trace amounts of explosives were found.^[2]^:258 Of the 5 percent of the fuselage that was not recovered, none of the missing areas were large enough to have covered all the damage that would have been caused by the detonation of a bomb or missile.^[2]^:258 None of the victims' remains showed any evidence of injuries that could have been caused by high-energy explosives.^[2]^:258

The NTSB considered the possibility that the explosive residue was due to contamination from the aircraft's use in 1991 transporting troops during the Gulf War or its use in a dog-training explosive detection exercise about one month before the accident.^[2]^:258–259 Testing conducted by the FAA's Technical Center indicated that residues of the type of explosives found on the wreckage would dissipate completely after two days of immersion in sea water (almost all recovered wreckage was immersed longer than two days).^[2]^:259 The NTSB concluded that it was "quite possible" that the explosive residue detected was transferred from military ships or ground vehicles, or the clothing and boots of military personnel, onto the wreckage during or after the recovery operation and was not present when the aircraft crashed into the water.^[2]^:259

Although it was unable to determine the exact source of the trace amounts of explosive residue found on the wreckage, the lack of any other corroborating evidence associated with a high-energy explosion led the NTSB to conclude that "the in-flight breakup of TWA flight 800 was not initiated by a bomb or missile strike."^[2]^:259

Fuel-air explosion in the center wing fuel tank

Scale-model test of a CWT fuel/air vapor explosion

In order to evaluate the sequence of structural breakup of the airplane, the NTSB formed the Sequencing Group,^[2]^:100 which examined individual pieces of the recovered structure, two-dimensional reconstructions or layouts of sections of the airplane, and various-sized three-dimensional reconstructions of portions of the airplane.^[2]^:100 In addition, the locations of pieces of wreckage at the time of recovery and differences in fire effects on pieces that are normally adjacent to each other were evaluated.^[2]^:100 The Sequencing Group concluded that the first event in the breakup sequence was a fracture in the wing center section of the aircraft, caused by an "overpressure event" in the center wing fuel tank (CWT).^[9]^:29 An overpressure event was defined as a rapid increase in pressure resulting in failure of the structure of the CWT.^[2]^:85

Because there was no evidence that an explosive device detonated in this (or any other) area of the airplane, this overpressure event could only have been caused by a fuel/air explosion in the CWT.^[2]^:261 There were 50 gallons of fuel in the CWT of TWA 800; tests recreating the conditions of the flight showed the combination of liquid fuel and fuel/air vapor to be flammable. A major reason for the flammability of the fuel/air vapor in the CWT of the 747 was the large amount of heat generated and transferred to the CWT by air conditioning packs located directly below the tank; with the CWT temperature raised to a sufficient level, a single ignition source could cause an explosion.

Computer modelling^[2]^:122–123 and scale-model testing^[2]^:123 were used to predict and demonstrate how an explosion would progress in a 747 CWT. During this time, quenching was identified as an issue, where the explosion would extinguish itself as it passed through the complex structure of the CWT.^[2]^:123 Because the research data regarding quenching was limited, a complete understanding of quenching behavior was not possible, and the issue of quenching remained unresolved.^[2]^:137

In order to better determine whether a fuel/air vapor explosion in the CWT would generate sufficient pressure to break apart the fuel tank and lead to the destruction of the airplane, tests were conducted in July and August 1997, using a retired Air France 747 at Bruntingthorpe Airfield, England. These tests simulated a fuel/air explosion in the CWT by igniting a propane/air mixture; this resulted in the failure of the tank structure due to overpressure.^[2]^:261 While the NTSB acknowledged that the test conditions at Bruntingthorpe were not fully comparable to the conditions that existed on TWA 800 at the time of the accident,^[2]^:261 previous fuel explosions in the CWTs of commercial airliners such as Avianca Flight 203 and Philippine Airlines Flight 143 confirmed that a CWT explosion could break apart the fuel tank and lead to the destruction of an airplane.^[2]^:261

Ultimately, based on "the accident airplane's breakup sequence; wreckage damage characteristics; scientific tests and research on fuels, fuel tank explosions, and the conditions in the CWT at the time of the accident; and analysis of witness information,"^[2]^:271 the NTSB concluded that "the TWA flight 800 in-flight breakup was initiated by a fuel/air explosion in the CWT."^[2]^:63

In-flight breakup sequence and crippled flight

Debris fields
Map showing the locations of the red, yellow, and green zones.^[2]^{(fig.22a, p.66)}
Wreckage found in each zone corresponded to specific areas of the aircraft.^[2]^{(fig.22b, p.67)}
The pathways the wreckage took as it fell to the ocean.^[2]^{(fig.22c, p.68)}

Recovery locations of the wreckage from the ocean (the red, yellow, and green zones) clearly indicated that: (1) the red area pieces (from the forward portion of the wing center section and a ring of fuselage directly in front) were the earliest pieces to separate from the airplane; (2) the forward fuselage section departed simultaneously with or shortly after the red area pieces, landing relatively intact in the yellow zone; (3) the green area pieces (wings and the aft portion of the fuselage) remained intact for a period after the separation of the forward fuselage, and impacted the water in the green zone.^[10]

Fire damage and soot deposits on the recovered wreckage indicated that some areas of fire existed on the airplane as it continued in crippled flight after the loss of the forward fuselage.^[2]^:109 After about 34 seconds (based on information from witness documents), the outer portions of both the right and left wings failed.^[2]^{:109, 263} Shortly after, the left wing separated from what remained of the main fuselage, which resulted in further development of the fuel-fed fireballs as the pieces of wreckage fell to the ocean.^[2]^:263

Only the FAA radar facility in North Truro, Massachusetts, using specialized processing software from the United States Air Force 84th Radar Evaluation Squadron, was capable of estimating the altitude of TWA 800 after it lost power due to the CWT explosion.^[2]^:87 Because of accuracy limitations, this radar data could not be used to determine whether the aircraft climbed after the nose separated.^[2]^:87 Instead, the NTSB conducted a series of computer simulations to examine the flightpath of the main portion of the fuselage.^[2]^:95–96 Hundreds of simulations were run using various combinations of possible times the nose of TWA 800 separated (the exact time was unknown), different models of the behavior of the crippled aircraft (the aerodynamic properties of the aircraft without its nose could only be estimated), and longitudinal radar data (the recorded radar tracks of the east/west position of TWA 800 from various sites differed).^[2]^:96–97 These simulations indicated that after the loss of the forward fuselage the remainder of the aircraft continued in crippled flight, then pitched up while rolling to the left (north),^[2]^:263 climbing to a maximum altitude between 15,537 and 16,678 feet (4,736 and 5,083 m)^[2]^:97 from its last recorded altitude, 13,760 feet (4,190 m).^[2]^:256

Analysis of reported witness observations

At the start of FBI's investigation, because of the possibility that international terrorists might have been involved, assistance was requested from the CIA (US Central Intelligence Agency.^[11]^:2 CIA analysts, relying on sound-propagation analysis, concluded that the witnesses could not be describing a missile approaching an intact aircraft, but were seeing a trail of burning fuel coming from the aircraft after the initial explosion.^[11]^:5–6 This conclusion was reached after calculating how long it took for the sound of the initial explosion to reach the witnesses, and using that to correlate the witness observations with the accident sequence.^[11]^:5 In all cases the witnesses could not be describing a missile approaching an intact aircraft, as the plane had already exploded before their observations began.^[11]^:6

As the investigation progressed, the NTSB decided to form a witness group to more fully address the accounts of witnesses.^[3]^:7 From November 1996 through April 1997 this group reviewed summaries of witness accounts on loan from the FBI (with personal information redacted), and conducted interviews with crewmembers from a New York Air National Guard HH-60 helicopter and C-130 airplane, as well as a U.S. Navy P-3 airplane that was flying in the vicinity of TWA 800 at the time of the accident.^[3]^:7–8

In February 1998, the FBI, having closed its active investigation, agreed to fully release the witness summaries to the NTSB.^[3]^:10 With access to these documents no longer controlled by the FBI, the NTSB formed a second witness group to review the documents.^[3]^:10 Because of the amount of time that had elapsed (about 21 months) before the NTSB received information about the identity of the witnesses, the witness group chose not to re-interview the witnesses, but instead to rely on the original summaries of witness statements written by FBI agents as the best available evidence of the observations initially reported by the witnesses.^[2]^:230 Despite the two and a half years that had elapsed since the accident, the witness group did interview the captain of Eastwind Airlines Flight 507, who was the first to report the explosion of TWA 800, because of his vantage point and experience as an airline pilot.^[3]^:12

The NTSB's review of the released witness documents determined that they contained 736 witness accounts, of which 258 were characterized as "streak of light" witnesses ("an object moving in the sky... variously described [as] a point of light, fireworks, a flare, a shooting star, or something similar.")^[2]^:230 The NTSB Witness Group concluded that the streak of light reported by witnesses might have been the actual airplane during some stage of its flight before the fireball developed, noting that most of the 258 streak of light accounts were generally consistent with the calculated flightpath of the accident airplane after the CWT explosion.^[2]^:262

Thirty-eight witnesses described a streak of light that ascended vertically, or nearly so, and these accounts "seem[ed] to be inconsistent with the accident airplane's flightpath."^[2]^:265 In addition, 18 witnesses reported seeing a streak of light that originated at the surface, or the horizon, which did not "appear to be consistent with the airplane's calculated flightpath and other known aspects of the accident sequence."^[2]^:265 Regarding these differing accounts, the NTSB noted that based on their experience in previous investigations "witness reports are often inconsistent with the known facts or with other witnesses' reports of the same events."^[2]^:237 The interviews conducted by the FBI focused on the possibility of a missile attack; suggested interview questions given to FBI agents such as "Where was the sun in relation to the aircraft and the missile launch point?" and "How long did the missile fly?" could have biased interviewees' responses in some cases.^[2]^:266 The NTSB concluded that given the large number of witnesses in this case, they "did not expect all of the documented witness observations to be consistent with one another"^[2]^:269 and "did not view these apparently anomalous witness reports as persuasive evidence that some witnesses might have observed a missile."^[2]^:270

After missile visibility tests were conducted in April 2000, at Eglin Air Force Base, Fort Walton Beach, Florida,^[2]^:254 the NTSB determined that if witnesses had observed a missile attack they would have seen:

a light from the burning missile motor ascending very rapidly and steeply for about 8 seconds;
the light disappearing for up to 7 seconds;
upon the missile striking the aircraft and igniting the CWT, another light, moving considerably more slowly and more laterally than the first, for about 30 seconds;
this light descending while simultaneously developing into a fireball falling toward the ocean.^[2]^:270 None of the witness documents described such a scenario.^[2]^:270

Because of their unique vantage points or the level of precision and detail provided in their accounts, five witness accounts generated special interest:^[2]^:242–243 the pilot of Eastwind Airlines Flight 507, the crew members in the HH-60 helicopter, a streak-of-light witness aboard US Airways Flight 217, a land witness on the Beach Lane Bridge in Westhampton Beach, New York, and a witness on a boat near Great Gun Beach.^[2]^:243–247 Advocates of a missile-attack scenario asserted that some of these witnesses observed a missile;^[2]^:264 analysis demonstrated that the observations were not consistent with a missile attack on TWA 800, but instead were consistent with these witnesses having observed part of the in-flight fire and breakup sequence after the CWT explosion.^[2]^:264

The NTSB concluded that "the witness observations of a streak of light were not related to a missile and that the streak of light reported by most of these witnesses was burning fuel from the accident airplane in crippled flight during some portion of the post-explosion, preimpact breakup sequence".^[2]^:270 The NTSB further concluded that "the witnesses' observations of one or more fireballs were of the airplane's burning wreckage falling toward the ocean".^[2]^:270

Possible ignition sources of the center wing fuel tank

To determine what ignited the flammable fuel-air vapor in the CWT and caused the explosion, the NTSB evaluated numerous potential ignition sources. All but one were considered very unlikely to have been the source of ignition.^[2]^:279

Missile fragment or small explosive charge

Although the NTSB had already reached the conclusion that a missile strike did not cause the structural failure of the airplane, the possibility that a missile could have exploded close enough to TWA 800 for a missile fragment to have entered the CWT and ignited the fuel/air vapor, yet far enough away not to have left any damage characteristic of a missile strike, was considered.^[2]^:272 Computer simulations using missile performance data simulated a missile detonating in a location such that a fragment from the warhead could penetrate the CWT.^[2]^:273 Based on these simulations, the NTSB concluded that it was "very unlikely" that a warhead detonated in such a location where a fragment could penetrate the CWT, but no other fragments impact the surrounding airplane structure leaving distinctive impact marks.^[2]^:273

Similarly, the investigation considered the possibility that a small explosive charge placed on the CWT could have been the ignition source.^[2]^:273 Testing by the NTSB and the British Defence Evaluation and Research Agency demonstrated that when metal of the same type and thickness of the CWT was penetrated by a small charge, there was petalling of the surface where the charge was placed, pitting on the adjacent surfaces, and visible hot gas washing damage in the surrounding area.^[2]^:273–274 Since none of the recovered CWT wreckage exhibited these damage characteristics, and none of the areas of missing wreckage were large enough to encompass all the expected damage, the investigation concluded that this scenario was "very unlikely."^[2]^:274

Other potential sources

The NTSB also investigated whether the fuel/air mixture in the CWT could have been ignited by lightning strike, meteor strike, auto-ignition or hot surface ignition, a fire migrating to the CWT from another fuel tank via the vent system, an uncontained engine failure, a turbine burst in the air conditioning packs beneath the CWT, a malfunctioning CWT jettison/override pump, a malfunctioning CWT scavenger pump, or static electricity.^[2]^:272–279 After analysis the investigation determined that these potential sources were "very unlikely" to have been the source of ignition.^[2]^:279

Fuel quantity indication system

Because a combustible fuel/air mixture will always exist in fuel tanks, Boeing designers had attempted to eliminate all possible sources of ignition in the 747's tanks. To do so, all devices are protected from vapor intrusion, and voltages and currents used by the Fuel Quantity Indication System (FQIS) are kept very low. In the case of the 747-100 series, the only wiring located inside the CWT is that which is associated with the FQIS.^{[citation needed]}

In order for the FQIS to have been Flight 800's ignition source, a transfer of higher-than-normal voltage to the FQIS would have needed to occur, as well as some mechanism whereby the excess energy was released by the FQIS wiring into the CWT. While the NTSB determined that factors suggesting the likelihood of a short circuit event existed, they added that "neither the release mechanism nor the location of the ignition inside the CWT could be determined from the available evidence." Nonetheless, the NTSB concluded that "the ignition energy for the CWT explosion most likely entered the CWT through the FQIS wiring".^{[citation needed]}

Though the FQIS itself was designed to prevent danger by minimizing voltages and currents, the innermost tube of Flight 800's FQIS compensator showed damage similar to that of the compensator tube identified as the ignition source for the surge tank fire that destroyed a 747 near Madrid in 1976.^[2]^:293–294 This was not considered proof of a source of ignition. Evidence of arcing was found in a wire bundle that included FQIS wiring connecting to the center wing tank.^[2]^:288 Arcing signs were also seen on two wires sharing a cable raceway with FQIS wiring at station 955.^[2]^:288

The captain's cockpit voice recorder channel showed two "dropouts" of background power harmonics in the second before the recording ended (with the separation of the nose).^[2]^:289 This might well be the signature of an arc on cockpit wiring adjacent to the FQIS wiring. The captain commented on the "crazy" readings of the number 4 engine fuel flow gauge about 2 1/2 minutes before the CVR recording ended.^[2]^:290 Finally, the Center Wing Tank fuel quantity gauge was recovered and indicated 640 pounds instead of the 300 pounds that had been loaded into that tank.^[2]^:290 Experiments showed that applying power to a wire leading to the fuel quantity gauge can cause the digital display to change by several hundred pounds before the circuit breaker trips. Thus the gauge anomaly could have been caused by a short to the FQIS wiring.^[2]^:290 The NTSB concluded that the most likely source of sufficient voltage to cause ignition was a short from damaged wiring, or within electrical components of the FQIS. As not all components and wiring were recovered, it was not possible to pinpoint the source of the necessary voltage.

Report conclusions

The NTSB investigation ended with the adoption of the board's final report on August 23, 2000. The Board determined that the probable cause of the TWA 800 accident was:^[2]^:308

[An] explosion of the center wing fuel tank (CWT), resulting from ignition of the flammable fuel/air mixture in the tank. The source of ignition energy for the explosion could not be determined with certainty, but, of the sources evaluated by the investigation, the most likely was a short circuit outside of the CWT that allowed excessive voltage to enter it through electrical wiring associated with the fuel quantity indication system.

In addition to the probable cause, the NTSB found the following contributing factors to the accident:^[2]^:308

The design and certification concept that fuel tank explosions could be prevented solely by precluding all ignition sources.

The certification of the Boeing 747 with heat sources located beneath the CWT with no means to reduce the heat transferred into the CWT or to render the fuel tank vapor non-combustible.

During the course of its investigation, and in its final report, the NTSB issued fifteen safety recommendations, mostly covering fuel tank and wiring-related issues.^[2]^:309–312 Among the recommendations was that significant consideration should be given to the development of modifications such as nitrogen-inerting systems for new airplane designs and, where feasible, for existing airplanes.^[12]^:6

Air Florida Flight 90

On a freezing night in Washington in 1982 Captain Larry M. Wheaton, aged 34, climbed into the cockpit of Air Florida Flight 90. He was an experienced pilot with 8,300 total flight hours, with 2,322 hours of commercial jet experience, all logged at Air Florida. In the seat next to him was first officer, Roger A. Pettit, aged 31, a former US Air Force fighter pilot, and instructor, with 3,353 flight hours. Wheaton was described by fellow pilots as a quiet person, with good operational skills and knowledge, who had operated well in high-workload flying situations. His leadership style was described as similar to those of other pilots. However, on 8 May 1980 he was suspended after failing a Boeing 737 company line check and was found to be unsatisfactory in several areas including adherence to regulations, checklist usage, flight procedures such as departures and cruise control, and approaches and landings. He resumed his duties after passing a retest on 27 August 1980. On April 24, 1981 he received another unsatisfactory grade, this time on the company recurrent proficiency check, when he showed deficiencies in memory items, knowledge of aircraft systems, and aircraft limitations. Three days later, he satisfactorily passed a proficiency recheck. Failure to follow procedures was a critical factor in what was to come.

In contrast, there were no concerns about Pettit. He was described by friends and pilots as a witty, bright, outgoing individual with an excellent command of physical and mental skills in aircraft piloting. Those who had flown with him during stressful flight operations said that during those times, he remained the same witty, sharp individual, "who knew his limitations." Several persons said that he was the type of pilot who would not hesitate to speak up if he knew something specific was wrong with flight operations.

The flight was scheduled to depart on 13 January 1982 from Washington National Airport (now Ronald Reagan Washington National Airport) to Fort Lauderdale–Hollywood International Airport with an intermediate stopover at Tampa International Airport. That morning the airport was closed by a heavy snowstorm that produced 6.5 inches of snow. It reopened at noon under marginal conditions as the snowfall began to slacken. Nearly two hours late, as the plane readied for departure, a moderate snowfall continued and the air temperature was well below freezing.

In these conditions, icing was the main concern. Multiple critical instruments can be affected by ice, and ice on the wings can quite literally stop a plane flying by changing the shape of the wings. Every airline and airport has procedures to deal with ice on the ground and in the air. Unfortunately the captain of this plane wasn't great at following procedures. At the gate, Flight 90 was de-iced with a mixture of heated water and monopropylene glycol by American Airlines, under a ground-service agreement with Air Florida. That agreement specified that covers for the pitot tubes, static ports, and engine inlets had to be used, but the American Airlines employees did not comply with those rules. One de-icing vehicle was used by two different operators, who chose widely different mixture percentages to de-ice the left and right sides of the aircraft. Subsequent testing of the de-icing truck showed that "the mixture dispensed differed substantially from the mixture selected" (18% actual vs. 30% selected). The inaccurate mixture was the result of the replacement of the standard nozzle, "...which is specially modified and calibrated, with a non-modified, commercially available nozzle." The operator had no means to determine if the proportioning valves were operating properly because no "mix monitor" was installed on the nozzle. Or put more simply, the de-icing was ineffective due to multiple errors.

The plane had trouble leaving the gate when the ground-services tow motor could not get traction on the ice. For roughly 30 to 90 seconds, the crew attempted to back away from the gate using the reverse thrust of the engines which proved futile. Boeing operations bulletins had warned against using reverse thrust in those kinds of conditions. Eventually, a tug ground unit properly equipped with snow chains was used to push the aircraft back from the gate. After leaving the gate, the aircraft waited in a taxi line with many other aircraft for 49 minutes before reaching the take-off runway. The pilot apparently decided not to return to the gate for reapplication of de-icing, fearing that the flight's departure would be even further delayed. More snow and ice accumulated on the wings during that period, and the crew was aware of that fact when they decided to make the take-off. Heavy snow was still falling during their take-off roll just before 4:00 pm.

The crew then ran through the take-off checklist

Captain Pitot heat?
First Officer On.
Captain Engine anti-ice?
First Officer Off.

Despite the icing condition the crew had failed to activate the engine anti-ice systems, which caused the engine pressure ratio thrust indicators to provide false readings. The correct engine power setting for the temperature and airport altitude of Washington National at the time was 2.04 EPR, but it was later determined from analysis of the engine noise recorded on the cockpit voice recorder that the actual power output corresponded with an engine pressure ratio of only 1.70.

Neither pilot had much experience flying in snowy, cold weather. The captain had made only eight take-offs or landings in snowy conditions on the 737, and the first officer had flown in snow only twice.

Adding to the plane's troubles was the pilots' decision to manoeuvre closely behind a DC-9 that was taxiing just ahead of them prior to take-off, due to their mistaken belief that the warmth from the DC-9's engines would melt the snow and ice that had accumulated on Flight 90's wings. This action, which went specifically against flight-manual recommendations for an icing situation, actually contributed to icing on the 737. The exhaust gases from the other aircraft melted the snow on the wings, but during take-off, instead of falling off the plane, this slush mixture froze on the wings' leading edges and the engine inlet nose cone.

As the take-off roll began, the first officer noted several times to the captain that the instrument panel readings he was seeing did not seem to reflect reality (he was referring to the fact that the plane did not appear to have developed as much power as it needed for take-off, despite the instruments indicating otherwise). The captain dismissed these concerns and let the take-off proceed. Investigators determined that plenty of time and space on the runway remained for the captain to have aborted the take-off, and criticised his refusal to listen to his first officer, who was correct that the instrument panel readings were wrong. The pilot was told not to delay because another aircraft was 2.5 miles out on final approach to the same runway. All the pieces were in place for a disaster. The plane began to accelerate down the runway.

15:59:32 First Officer Okay, your throttles.
15:59:35 [SOUND OF ENGINE SPOOLUP]
15:59:49 First Officer Holler if you need the wipers.
15:59:51 First Officer It's spooled. Really cold here, real cold.
15:59:58 Captain God, look at that thing. That don't seem right, does it? Ah, that's not right.
16:00:09 First Officer Yes it is, there's eighty.
16:00:10 Captain Naw, I don't think that's right. Ah, maybe it is.
16:00:21 First Officer Hundred and twenty.
16:00:23 Captain I don't know.
16:00:31 First Officer V₁. Easy, V₂.

As the plane became briefly airborne, the voice recorder picked up the following from the cockpit, with the sound of the stick-shaker (a device that warns that the plane is in danger of stalling) in the background:

16:00:39 [SOUND OF STICKSHAKER STARTS AND CONTINUES UNTIL IMPACT]
16:00:41 TWR Palm 90 contact departure control.
16:00:45 First Officer Forward, forward, easy. We only want five hundred.
16:00:48 First Officer Come on forward....forward, just barely climb.
16:00:59 First Officer Stalling, we're falling!
16:01:00 Captain Larry, we're going down, Larry....
16:01:01 First Officer I know!
16:01:01 [SOUND OF IMPACT]

The aircraft travelled almost half a mile farther down the runway than is customary before lift-off was accomplished. Survivors of the crash indicated the trip over the runway was extremely rough, with survivor Joe Stiley – a businessman and private pilot – saying that he believed that they would not get airborne and would "fall off the end of the runway". When the plane became airborne, Stiley told his co-worker (and survivor) Nikki Felch to assume the crash position, with some nearby passengers following their example.

Although the 737 did manage to become airborne, it attained a maximum altitude of just 350 ft before it began losing altitude. Recorders later indicated that the aircraft was airborne for just 30 seconds. It then fell from the sky crashing into the 14th Street Bridge across the Potomac River, less than a mile from the end of the runway. The plane hit six cars and a truck on the bridge, and tore away the bridge's rail and wall. The aircraft then plunged into the freezing Potomac River. It fell between two of the three spans of the bridge, between the I-395 northbound span (the Rochambeau Bridge) and the HOV north- and southbound spans, about 200 ft offshore. All but the tail section quickly became submerged.

Of the people on board all but five died including both pilots. Four motorists on the bridge were also killed. Clinging to the tail section of the broken airliner in the ice-choked Potomac River were flight attendant Kelly Duncan and four passengers: Patricia "Nikki" Felch, Joe Stiley, Arland D. Williams Jr. (strapped and tangled in his seat), and Priscilla Tirado. Duncan inflated the only flotation device they could find, and passed it to the severely injured Felch. Passenger Bert Hamilton, who was floating in the water nearby, was the first to be pulled from the water. Without rapid rescue, their lives would be measured in minutes.

Many federal offices in downtown Washington had closed early that day in response to quickly developing blizzard conditions. Thus, a massive backup of traffic existed on almost all of the city's roads, making reaching the crash site by ambulances very difficult. The Coast Guard's harbour tugboat Capstan (WYTL 65601) and its crew were based nearby; their duties include ice breaking and responding to water rescues. The Capstan was considerably farther downriver on another search-and-rescue mission. Emergency ground response was greatly hampered by ice-covered roads and gridlocked traffic, ambulances dispatched at 4:07 pm took 20 minutes to reach the scene of the crash. Ambulances attempting to reach the scene were even driven down the sidewalk in front of the White House. Rescuers who reached the site were unable to assist survivors in the water because they did not have adequate equipment to reach them. Below-freezing waters and heavy ice made swimming out to them impossible. Multiple attempts to throw a makeshift lifeline (made out of belts and any other things available that could be tied together) out to the survivors proved ineffective. The rescue attempts by emergency officials and witnesses were recorded and broadcast live by area news reporters, and as the accident occurred in the nation's capital, large numbers of media personnel were on hand to provide quick and extensive coverage.

Luckily for the survivors there were heroes nearby. Roger Olian, a sheet-metal foreman at St. Elizabeth's Hospital, a Washington psychiatric hospital, was on his way home across the 14th Street Bridge in his truck when he heard a man yelling that an aircraft was in the water. He was the first to jump into the water to attempt to reach the survivors. At the same time, several military personnel from the Pentagon—Steve Raynes, Aldo De La Cruz, and Steve Bell—ran down to the water's edge to help Olian.

He only traveled a few yards and came back, ice sticking to his body. We asked him to not try again, but he insisted. Someone grabbed some short rope and battery cables and he went out again, maybe only going 30 feet. We pulled him back. Someone had backed up their jeep and we picked him up and put him in there. All anyone could do was tell the survivors was to hold on not to give up hope. There were a few pieces of the plane on shore that were smoldering and you could hear the screams of the survivors. More people arrived near the shore from the bridge, but nobody could do anything. The ice was broken up and there was no way to walk out there. It was so eerie, an entire plane vanished except for a tail section, the survivors, and a few pieces of plane debris. The smell of jet fuel was everywhere, and you could smell it on your clothes. The snow on the banks was easily two feet high and your legs and feet would fall deep into it every time you moved from the water.

At this point, flight controllers were aware only that the plane had disappeared from radar and did not respond to radio calls, but had no idea of either what had happened or the plane's location. About 20 minutes after the crash a United States Park Police Bell 206L-1 Long Ranger helicopter based at the "Eagles Nest" at Anacostia Park in Washington and manned by pilot Donald W. Usher and paramedic Melvin E. Windsor, arrived and began attempting to airlift the survivors to shore. At great risk to themselves, the crew worked close to the water's surface, at one time coming so close to the ice-clogged river that the helicopter's skids dipped beneath the surface.

The helicopter crew lowered a line to survivors to tow them to shore. First to receive the line was Bert Hamilton, who was treading water about 10 ft (3 m) from the plane's floating tail. The pilot pulled him across the ice to shore, while avoiding the sides of the bridge. By then, some fire/rescue personnel had arrived to join the military personnel and civilians who pulled Hamilton (and the next/last three survivors) from the water's edge up to waiting ambulances. The helicopter returned to the aircraft's tail, and this time Arland D. Williams Jr. (sometimes referred to as "the sixth passenger") caught the line. Williams, not able to unstrap himself from the wreckage, passed the line to flight attendant Kelly Duncan, who was towed to shore. On its third trip back to the wreckage, the helicopter lowered two lifelines, fearing that the remaining survivors had only a few minutes before succumbing to hypothermia. Williams, still strapped into the wreckage, passed one line to Joe Stiley, who was holding on to a panic-stricken and blinded (from jet fuel) Priscilla Tirado, who had lost her husband and baby. Stiley's co-worker, Nikki Felch, took the second line. As the helicopter pulled the three through the water and blocks of ice toward shore, both Tirado and Felch lost their grips and fell back into the water.

Priscilla Tirado was too weak to grab the line when the helicopter returned to her. A watching bystander, Congressional Budget Office assistant Lenny Skutnik, stripped off his coat and boots, and in short sleeves, dove into the icy water and swam out to successfully pull her to shore. The helicopter then proceeded to where Felch had fallen, and paramedic Gene Windsor stepped out onto the helicopter skid and grabbed her by the clothing to lift her onto the skid with him, bringing her to shore. When the helicopter crew returned for Williams, the wreckage he was strapped into had rolled slightly, submerging him; according to the coroner Williams was the only passenger to die by drowning. His body and those of the other occupants were later recovered.

The subsequent investigation found that the 737 had broken into several large pieces upon impact - the nose and cockpit section, the cabin up to the wing attachment point, the cabin from behind the wings to the rear airstairs, and the empennage. Although actual impact speeds were low and well within survivability limits, the structural breakup of the fuselage and exposure to freezing water nonetheless proved fatal for all persons aboard the plane except those seated in the tail section. The National Transportation Safety Board concluded that the accident was not survivable. Determining the position of the rudder, slats, elevators, and ailerons was not possible due to impact damage and the majority of the flight control system having been destroyed. The National Transportation Safety Board determined that the probable cause of the crash included the flight crew's failure to enforce a sterile cockpit during the final preflight checklist procedure. The engines' anti-ice heaters were not engaged during the ground operation and take-off. The decision to take off with snow/ice on the airfoil surfaces of the aircraft, and the captain's failure to reject the take-off during the early stage when his attention was called to anomalous engine instrument readings also were erroneous.

The NTSB further stated:

"Contributing to the accident were the prolonged ground delay between de-icing and the receipt of ATC take-off clearance during which the aircraft was exposed to continual precipitation, the known inherent pitch up characteristics of the B-737 aircraft when the leading edge is contaminated with even small amounts of snow or ice, and the limited experience of the flight crew in jet transport winter operations.

Wildlife Encounters/Bird Strikes

Bird strikes are a significant threat to flight safety, and have caused a number of accidents with human casualties. There are over 13,000 bird strikes annually in the US alone. However, the number of major accidents involving civil aircraft is quite low and it has been estimated that there is only about one accident resulting in human death in one billion flying hours. The majority of bird strikes (65%) cause little damage to the aircraft; however the collision is usually fatal to the bird(s) involved.

Most accidents occur when a bird collides with the windscreen or is sucked into the engine of a jet aircraft. Strikes to the propellers can also cause major problems. Bird strikes happen most often during takeoff or landing, or during low altitude flight. However, bird strikes have also been reported at high altitudes, some as high as 6,000 to 9,000m above the ground. For example, an aircraft over the Ivory Coast collided with a Rüppell's vulture at the altitude of 11,300m. The majority of bird collisions occur near or at airports (90%, according to the ICAO) during takeoff, landing and associated phases. According to the FAA wildlife hazard management manual for 2005, less than 8% of strikes occur above 900m and 61% occur at less than 30m.

The point of impact is usually any forward-facing edge of the vehicle such as a wing leading edge, nose cone, jet engine cowling or engine inlet.

Jet engine ingestion is extremely serious due to the rotation speed of the engine fan and engine design. As the bird strikes a fan blade, that blade can be displaced into another blade and so forth, causing a cascading failure. Jet engines are particularly vulnerable during the takeoff phase when the engine is turning at a very high speed and the plane is at a low altitude where birds are more commonly found.

The force of the impact on an aircraft depends on the weight of the animal and the speed difference and direction at the point of impact. The energy of the impact increases with the square of the speed difference. High-speed impacts, as with jet aircraft, can cause considerable damage and even catastrophic failure to the vehicle. The energy of a 5 kg (11 lb) bird moving at a relative velocity of 275 km/h (171 mph) approximately equals the energy of a 100 kg (220 lb) weight dropped from a height of 15 meters (49 ft).^[13] However, according to the FAA only 15% of strikes (ICAO 11%) actually result in damage to the aircraft.^{[citation needed]}

Bird strikes can damage vehicle components, or injure passengers. Flocks of birds are especially dangerous and can lead to multiple strikes, with corresponding damage. Depending on the damage, aircraft at low altitudes or during take-off and landing often cannot recover in time.

Countermeasures

There are three approaches to reduce the effect of bird strikes. The vehicles can be designed to be more bird resistant, the birds can be moved out of the way of the vehicle, or the vehicle can be moved out of the way of the birds.

Vehicle design

Most large commercial jet engines include design features that ensure they can shut-down after "ingesting" a bird weighing up to 1.8 kg (4.0 lb). The engine does not have to survive the ingestion, just be safely shut down. This is a 'stand-alone' requirement, i.e., the engine, not the aircraft, must pass the test. Multiple strikes (from hitting a bird flock) on twin-engine jet aircraft are very serious events because they can disable multiple aircraft systems, requiring emergency action to land the aircraft.

Modern jet aircraft structures must be able to withstand one 1.8 kg (4.0 lb) collision; the empennage (tail) must withstand one 3.6 kg (7.9 lb) bird collision. Cockpit windows on jet aircraft must be able to withstand one 1.8 kg (4.0 lb) bird collision without yielding or spalling.

At first, bird strike testing by manufacturers involved firing a bird carcass from a gas cannon and sabot system into the tested unit. The carcass was soon replaced with suitable density blocks, often gelatin, to ease testing. Current testing is mainly conducted with computer simulation, although final testing usually involves some physical experiments.

Flight path

Not taking off or landing in the presence of wildlife and avoiding migratory routes, wildlife reserves, estuaries and other sites where birds may congregate would avoid most bird strikes. Unfortunately planes don't have unlimited fuel, or a free choice of when and where to operate - so sometimes they will inevitably be flying where birds might be. Most bird strikes occur below 3,000 ft, so staying higher increases safety - but eventually the plane has to land.

The US Military Avian Hazard Advisory System (AHAS) uses near real-time data from the 148 CONUS based National Weather Service Next Generation Weather Radar (NEXRAD or WSR 88-D) system to provide current bird hazard conditions for published military low-level routes, ranges, and military operating areas (MOAs). Additionally, AHAS incorporates weather forecast data with the Bird Avoidance Model (BAM) to predict soaring bird activity within the next 24 hours and then defaults to the BAM for planning purposes when activity is scheduled outside the 24-hour window. The BAM is a static historical hazard model based on many years of bird distribution data from Christmas Bird Counts (CBC), Breeding Bird Surveys (BBS), and National Wildlife Refuge Data. The BAM also incorporates potentially hazardous bird attractions such as landfills and golf courses. AHAS is now an integral part of military low-level mission planning, aircrew being able to access the current bird hazard conditions. AHAS will provide relative risk assessments for the planned mission and give aircrew the opportunity to select a less hazardous route should the planned route be rated severe or moderate. Prior to 2003, the US Air Force BASH Team bird strike database indicated that approximately 25% of all strikes were associated with low-level routes and bombing ranges. More importantly, these strikes accounted for more than 50% of all of the reported damage costs. After a decade of using AHAS for avoiding routes with severe ratings, the strike percentage associated with low-level flight operations has been reduced to 12% and associated costs cut in half.

Avian radar is an important tool for aiding in bird strike mitigation as part of overall safety management systems at civilian and military airfields. Properly designed and equipped avian radars can track thousands of birds simultaneously in real-time, night and day, through 360° of coverage, out to ranges of 10 km and beyond for flocks, updating every target's position (longitude, latitude, altitude), speed, heading, and size every 2–3 seconds. Data from these systems can be used to generate information products ranging from real-time threat alerts to historical analyses of bird activity patterns in both time and space. The United States Federal Aviation Administration (FAA) and the United States Department of Defense (DOD) have conducted extensive science-based field testing and validation of commercial avian radar systems for civil and military applications, respectively. The FAA used evaluations of commercial 3D avian radar systems developed and marketed by Accipiter Radar^[14] as the basis for FAA Advisory Circular 150/5220-25^[15] and a guidance letter^[16] on using Airport Improvement Program funds to acquire avian radar systems at Part 139 airports.^[17] Similarly, the DOD-sponsored Integration and Validation of Avian Radars (IVAR)^[18] project evaluated the functional and performance characteristics of Accipiter® avian radars under operational conditions at Navy, Marine Corps, and Air Force airfields. Accipiter avian radar systems operating at Seattle-Tacoma International Airport,^[19] Chicago O'Hare International Airport, and Marine Corps Air Station Cherry Point made significant contributions to the evaluations carried out in the aforementioned FAA and DoD initiatives. Additional scientific and technical papers on avian radar systems are listed below,^[20]^[21] and on the Accipiter Radar web site.

A US company, DeTect, in 2003, developed the only production model bird radar in operational use for real-time, tactical bird-aircraft strike avoidance by air traffic controllers. These systems are operational at both commercial airports and military airfields. The system has widely used technology available for bird–aircraft strike hazard (BASH) management and for real-time detection, tracking and alerting of hazardous bird activity at commercial airports, military airfields, and military training and bombing ranges. After extensive evaluation and on-site testing, MERLIN technology was chosen by NASA and was ultimately used for detecting and tracking dangerous vulture activity during the 22 space shuttle launches from 2006 to the conclusion of the program in 2011. The US Air Force has contracted DeTect since 2003 to provide the Avian Hazard Advisory System (AHAS)previously mentioned.

Wildlife Encounters/Bird Strikes/Cactus 1549

On January 15, 2009, US Airways Flight 1549, an Airbus A320 on a flight from New York City's LaGuardia Airport to Charlotte, North Carolina, struck a flock of birds shortly after take-off, losing all engine power. Unable to reach any airport for an emergency landing, pilots Chesley Sullenberger and Jeffrey Skiles glided the plane to a ditching in the Hudson River off Midtown Manhattan. All 155 people on board were rescued by nearby boats, with a few serious injuries.

This water landing of a powerless jetliner became known as the Miracle on the Hudson and a National Transportation Safety Board official described it as "the most successful ditching in aviation history".^[22] The pilots and flight attendants were awarded the Master's Medal of the Guild of Air Pilots and Air Navigators in recognition of their "heroic and unique aviation achievement". But what went wrong to make this superb airmanship necessary?

Background

US Airways Flight 1549 with call sign 'Cactus 1549' was scheduled to fly from New York City's LaGuardia Airport Charlotte Douglas International Airport. The aircraft was an Airbus A320-214 powered by two GE Aviation/Snecma-designed turbofan engines. Delivered in 1999, the plane, registered N106US, was one of 74 A320s then in service at US Airways. At the time of the accident, the aircraft was 9.6 years old. The captain and pilot in command, 57-year-old Chesley Sullenberger, was a former fighter pilot who had been an airline pilot since leaving the United States Air Force in 1980. He was also a qualified glider pilot which would stand him in good stead as the accident developed.

Accident

Takeoff and bird strike

The flight was cleared for take off to the northeast from LaGuardia's Runway 4 at 3:24:56 pm Eastern Standard Time. With Skiles in control, the crew made its first report after becoming airborne at 3:25:51 as being at 700 feet and climbing.

At 3:27:11 during the climb, the plane struck a flock of Canada geese at an altitude of 2800 feet about 4.5 miles north-northwest of LaGuardia. The pilots' view was filled with the large birds; passengers and crew heard very loud bangs and saw flames from the engines, followed by silence and an odour of jet fuel. Realising that both engines had shut down, Sullenberger took control while Skiles worked the checklist for engine restart. With the engines stopped, the plane lost its primary source of electrical and hydraulic power for the flight control systems. However, an auxiliary power unit and a ram air turbine can provide backup hydraulic pressure and electrical power at certain speeds. Both backup systems began to operate as the plane descended onto the river. The aircraft slowed but continued to climb for a further 19 seconds then began a glide descent.

At 3:27:33, Sullenberger radioed a mayday call "... this is Cactus 15, hit birds. We've lost thrust on both engines. We're turning back towards LaGuardia". New York air traffic controller Patrick Harten told LaGuardia's air traffic control tower to hold all departures, and directed Sullenberger back to Runway 31. Sullenberger responded, "Unable".

Sullenberger asked controllers for landing options in New Jersey, mentioning Teterboro Airport. Permission was given for Teterboro's Runway 1. Sullenberger initially responded "Yes", but then: "We can't do it... We're gonna be in the Hudson".> The aircraft passed less than 900 feet above the George Washington Bridge. Sullenberger commanded over the cabin address system, "Brace for impact", and the flight attendants relayed the command to passengers. Meanwhile, air traffic controllers asked the Coast Guard to caution vessels in the Hudson and ask them to prepare to assist with rescue.

Ditching and evacuation

Coast Guard video of the water landing, and rescue

About ninety seconds later, at 3:31 pm, the plane made an unpowered ditching, descending southwards into the middle of the North River section of the Hudson tidal estuary roughly opposite West 50th Street. Flight attendants compared the ditching to a "hard landing" with "one impact, no bounce, then a gradual deceleration." The ebb tide began to take the plane southward.

Sullenberger opened the cockpit door and gave the order to evacuate. The crew began evacuating the passengers through the four overwing window exits and into an inflatable slide/raft deployed from the front right passenger door (the front left slide failed to operate, so the manual inflation handle was pulled). The evacuation was made more difficult by the fact that someone opened the rear left door, allowing more water to enter the plane. Water was also entering through a hole in the fuselage and through cargo doors that had come open, so as the water rose the attendant urged passengers to move forward by climbing over seats. The situation may have been improved if the pilots had activated the Airbus A320 system that closes valves and other openings in the fuselage, in order to slow flooding after a water landing. Sullenberger later said this would have made little difference since the water impact tore substantial holes in the fuselage. Sullenberger walked the cabin twice to confirm it was empty before himself abandoning the plane.

The air and water temperatures were about -7 Celsius and 5 Celsius respectively. Some evacuees waited for rescue knee-deep in water on the partially submerged slides, some wearing life vests. Others stood on the wings or, fearing an explosion, swam away from the plane. One passenger, after helping with the evacuation, found the wing so crowded that he jumped into the river and swam to a boat.

Rescue

The plane had ditched near boats, which facilitated rescue. Two NY Waterway ferries arrived within minutes and began taking people aboard; numerous other boats, including from the US Coast Guard, were quickly on scene as well. Sullenberger advised the ferry crews to rescue those on the wings first, as they were in more jeopardy than those on the slides, which detached to become life rafts. The last person was taken from the plane at 3:55 pm. About 140 New York City firefighters responded to nearby dock while other agencies provided medical help on the Weehawken side of the river, where most passengers were taken.

Investigation

The initial (NTSB) evaluation that the plane had lost thrust after a bird strike was confirmed by analysis of the cockpit voice and flight data recorders. On January 21, the NTSB found evidence of soft-body damage in the right engine along with organic debris including a feather. The left engine also evidenced soft body impact, with "dents on both the spinner and inlet lip of the engine cowling. Five booster inlet guide vanes are fractured and eight outlet guide vanes are missing." Both engines, missing large portions of their housings, were sent to the manufacturer for examination. The bird remains were identified by DNA testing to be Canada geese, which typically weigh more than engines are designed to withstand ingesting.

The NTSB used flight simulators to test the possibility that the flight could have returned safely to LaGuardia or diverted to Teterboro; only seven of the thirteen simulated returns to La Guardia succeeded, and only one of the two to Teterboro. Furthermore, the NTSB report called these simulations unrealistic: "The immediate turn made by the pilots during the simulations did not reflect or account for real-world considerations, such as the time delay required to recognize the bird strike and decide on a course of action." A further simulation, in which a 35-second delay was inserted to allow for those, crashed. In testimony before the NTSB, Sullenberger maintained that there had been no time to bring the plane to any airport and that attempting to do so would likely have killed those onboard and more on the ground.

The Board ultimately ruled that Sullenberger had made the correct decision, reasoning that the checklist for dual-engine failure is designed for higher altitudes when pilots have more time to deal with the situation, and that while simulations showed that the plane might have just barely made it back to LaGuardia, those scenarios assumed an instant decision to do so, with no time allowed for assessing the situation.

On May 4, 2010, the NTSB issued its final report, which identified the probable cause as "the ingestion of large birds into each engine, which resulted in an almost total loss of thrust in both engines." The final report credited the outcome to four factors: good decision-making and teamwork by the cockpit crew (including decisions to immediately turn on the auxiliary power unit and to ditch in the Hudson); the fact that the A320 is certified for extended overwater operation (and hence carried life vests and additional raft/slides) even though not required for that route; the performance of the flight crew during the evacuation; and the proximity of working vessels to the ditching site. Contributing factors were good visibility and fast response times from the ferry operators and emergency responders. The report made 34 recommendations, including that engines be tested for resistance to bird strikes at low speeds; development of checklists for dual-engine failures at low altitude, and changes to checklist design in general "to minimize the risk of flight crewmembers becoming stuck in an inappropriate checklist or portion of a checklist"; improved pilot training for water landings; provision of life vests on all flights regardless of route, and changes to the locations of vests and other emergency equipment; research into improved wildlife management, and technical innovations on aircraft, to reduce bird strikes; research into possible changes in passenger brace positions; and research into "methods of overcoming passengers' inattention" during preflight safety briefings.

Author and pilot William Langewiesche asserted that insufficient credit was given to the A320's fly-by-wire design, by which the pilot uses a side-stick to make control inputs to the flight control computers. The computers then impose adjustments and limits of their own to keep the plane stable, which the pilot cannot override even in an emergency. This design allowed the pilots of Flight 1549 to concentrate on engine restart and deciding the course, without the burden of manually adjusting the glidepath to reduce the plane's rate of descent. However, Sullenberger said that these computer-imposed limits also prevented him from achieving the optimum landing flare for the ditching, which would have softened the impact.

Conclusion

This isn't the first time a pilot who knows how to fly a glider has, potentially, increased the chances of surviving an accident. It's also an interesting insight into the benefits - or not - of automation. If everyone had died, maybe the A320's automation would have come in for criticism (like the later 737 MAX problems) for preventing the pilot doing what was needed. What we can say is that having a seasoned ex-military pilot is definitely a good thing because calm heads are more likely to save your life than someone panicking.

References

↑ ^a ^b "Documents Pertaining to Witnesses 300-399" (PDF). Docket No. SA-516, Appendix E. National Transportation Safety Board. Retrieved March 4, 2010.
↑ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^l ^m ⁿ ^o ^p ^q ^r ^s ^t ^u ^v ^w ^x ^y ^z ^aa ^ab ^ac ^ad ^ae ^af ^ag ^ah ^ai ^aj ^ak ^al ^am ^an ^ao ^ap ^aq ^ar ^as ^at ^au ^av ^aw ^ax ^ay ^az ^ba ^bb ^bc ^bd ^be ^bf ^bg ^bh ^bi ^bj ^bk ^bl ^bm ^bn ^bo ^bp ^bq ^br ^bs ^bt ^bu ^bv ^bw ^bx ^by ^bz ^ca ^cb ^cc ^cd ^ce ^cf ^cg ^ch ^ci ^cj ^ck ^cl ^cm ^cn ^co ^cp ^cq ^cr ^cs ^ct ^cu ^cv ^cw ^cx ^cy Invalid <ref> tag; no text was provided for refs named Final Report
↑ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k "Witness Group Chairman's Factual Report" (PDF). Docket No. ?, Exhibit 4-A. National Transportation Safety Board. Retrieved January 12, 2010.
↑ National Transportation Safety Board. "Documents Pertaining to Witnesses 1-99" (PDF). Docket No. SA-516, Appendix B. Retrieved March 4, 2010.
↑ Invalid <ref> tag; no text was provided for refs named CVR Report
↑ "Flight Data Recorder Group Chairman's Factual Report" (PDF). Docket No. 5A-516, Exhibit No. 10A. National Transportation Safety Board. Retrieved January 15, 2010.
↑ van Natta Jr., Don (August 31, 1996). "More Traces Of Explosive In Flight 800". The New York Times. ISSN 0362-4331. https://www.nytimes.com/1996/08/31/nyregion/more-traces-of-explosive-in-flight-800.html.
↑ "Source: Traces of 2nd explosive found in TWA debris". CNN. August 30, 1996. http://www.cnn.com/US/9608/30/twa.pm/index.html.
↑ "Metallurgy/Structures Group Chairman Factual Report Sequencing Study" (PDF). Docket No. 5A-516, Exhibit No. 18A. National Transportation Safety Board. Retrieved January 31, 2010.
↑ "Metallurgy/Structures Group Chairman Factual Report Sequencing Study" (PDF). Docket No. 5A-516, Exhibit No. 18TWA800A. National Transportation Safety Board: 3–4. Retrieved January 31, 2010.
↑ ^a ^b ^c ^d Tauss, Randolph M. "Solving the Mystery of the "Missile Sightings"" (PDF). The Crash of TWA Flight 800. Central Intelligence Agency. Retrieved April 6, 2011.
↑ "National Transportation Safety Board Safety Recommendation" (PDF). National Transportation Safety Board. Archived from the original (PDF) on June 8, 2010. Retrieved January 16, 2010.
↑ Note however that the momentum (as distinct from the kinetic energy) of the bird in this example is considerably less than that of the tonne weight, and therefore the force required to deflect it is also considerably less.
↑ "Accipiter Radar: Bird Strike Prevention Applications"
↑ "Airport Avian Radar Systems"
↑ "Program Guidance Letter 12-04" Template:Webarchive
↑ "Part 139 Airport Certification"
↑ "Validation and Integration of Networked Avian Radars: RC-200723" Template:Webarchive
↑ "Sea-Tac Airport's Comprehensive Program for Wildlife Management". Archived from the original on 2015-02-25. Retrieved 2015-03-03.
↑ Nohara, Tim J., "Reducing Bird Strikes – new Radar Networks Can Help Make Skies Safer" ^{[dead link]}, Journal of Air Traffic Control, Summer 2009
↑ Klope, Matthew W., et al., "Role of near-miss bird strikes in assessing hazards.", Human-Wildlife Interactions, Fall 2009
↑ Olshan, Jeremy; Livingston, Ikumulisa (January 17, 2009). "Quiet Air Hero Is Captain America". New York Post. http://www.nypost.com/seven/01172009/news/regionalnews/quiet_air_hero_is_captain_america_150593.htm.

Being a Survivor

Survival factors:

Do your research before you book. Airlines going through a financial crunch may skimp on maintenance. Some regulators are a lighter touch than others - if the airline you've chosen is banned from flying in the EU or the US, perhaps you should choose another one.
Choose your seat carefully.
Listen to the safety instructions and make sure you know where the nearest exits are. All of them as the closest may be unavailable.
If something seems wrong, speak up. Several accidents could have been avoided if passengers had told the cabin crew about a problem.
Dress appropriately. Artificial fibres are far worse in a fire than natural fibres. The clothes you would have on the ground in an emergency are the clothes on your back, not in your luggage, so wear something generally appropriate for the region you are flying. Unnatural colors help others find you.
When emergency oxygen masks fall, always put your own mask on first, then help nearby passengers. If you pass out yourself you aren't helping anyone, but once you have oxygen you can continue to assist others.
When asked to stow away items, do so quickly and securely.
Have a plan that you've mentally rehearsed. It will help you overcome shock and act quicker.

Style Guide and Authors

Please follow the style guide. Changes to the guide should be proposed on the Talk page here for agreement of consensus between contributors.

Style Guide

This book is written in British English. Don't worry if you write in American English - it will be changed to British English by the next editor.
This book is designed to be fully self contained. It is not an encyclopedic article and there are no links to Wikipedia. Where a term needs describing it is linked to the Glossary within the book.
In line references are not used. Where a reference is quoted, please include it in the References chapter, not within the individual chapters. This also applies to bare URLs and external links - put them in the references chapter.

[Witness_Appendix_E-1] "Documents Pertaining to Witnesses 300-399" (PDF). Docket No. SA-516, Appendix E. National Transportation Safety Board. Retrieved March 4, 2010.

[Final_Report-2] ↑ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k ^l ^m ⁿ ^o ^p ^q ^r ^s ^t ^u ^v ^w ^x ^y ^z ^aa ^ab ^ac ^ad ^ae ^af ^ag ^ah ^ai ^aj ^ak ^al ^am ^an ^ao ^ap ^aq ^ar ^as ^at ^au ^av ^aw ^ax ^ay ^az ^ba ^bb ^bc ^bd ^be ^bf ^bg ^bh ^bi ^bj ^bk ^bl ^bm ^bn ^bo ^bp ^bq ^br ^bs ^bt ^bu ^bv ^bw ^bx ^by ^bz ^ca ^cb ^cc ^cd ^ce ^cf ^cg ^ch ^ci ^cj ^ck ^cl ^cm ^cn ^co ^cp ^cq ^cr ^cs ^ct ^cu ^cv ^cw ^cx ^cy Invalid <ref> tag; no text was provided for refs named Final Report

[Witness_Report-3] ↑ ^a ^b ^c ^d ^e ^f ^g ^h ⁱ ^j ^k "Witness Group Chairman's Factual Report" (PDF). Docket No. ?, Exhibit 4-A. National Transportation Safety Board. Retrieved January 12, 2010.

[Witness_Appendix_B-4] National Transportation Safety Board. "Documents Pertaining to Witnesses 1-99" (PDF). Docket No. SA-516, Appendix B. Retrieved March 4, 2010.

[CVR_Report-5] Invalid <ref> tag; no text was provided for refs named CVR Report

[NTSB_FDR-6] "Flight Data Recorder Group Chairman's Factual Report" (PDF). Docket No. 5A-516, Exhibit No. 10A. National Transportation Safety Board. Retrieved January 15, 2010.

[NYT_Explosives-7] van Natta Jr., Don (August 31, 1996). "More Traces Of Explosive In Flight 800". The New York Times. ISSN 0362-4331. https://www.nytimes.com/1996/08/31/nyregion/more-traces-of-explosive-in-flight-800.html.

[CNN_Explosives-8] "Source: Traces of 2nd explosive found in TWA debris". CNN. August 30, 1996. http://www.cnn.com/US/9608/30/twa.pm/index.html.

[NTSB_Seq_p.29-9] "Metallurgy/Structures Group Chairman Factual Report Sequencing Study" (PDF). Docket No. 5A-516, Exhibit No. 18A. National Transportation Safety Board. Retrieved January 31, 2010.

[NTSB_Seq_pp.3-4-10] "Metallurgy/Structures Group Chairman Factual Report Sequencing Study" (PDF). Docket No. 5A-516, Exhibit No. 18TWA800A. National Transportation Safety Board: 3–4. Retrieved January 31, 2010.

[Tauss_CIA_report-11] Tauss, Randolph M. "Solving the Mystery of the "Missile Sightings"" (PDF). The Crash of TWA Flight 800. Central Intelligence Agency. Retrieved April 6, 2011.

[A-96-174-177-12] "National Transportation Safety Board Safety Recommendation" (PDF). National Transportation Safety Board. Archived from the original (PDF) on June 8, 2010. Retrieved January 16, 2010.

[13] Note however that the momentum (as distinct from the kinetic energy) of the bird in this example is considerably less than that of the tonne weight, and therefore the force required to deflect it is also considerably less.

[14] "Accipiter Radar: Bird Strike Prevention Applications"

[15] "Airport Avian Radar Systems"

[16] "Program Guidance Letter 12-04" Template:Webarchive

[17] "Part 139 Airport Certification"

[18] "Validation and Integration of Networked Avian Radars: RC-200723" Template:Webarchive

[19] "Sea-Tac Airport's Comprehensive Program for Wildlife Management". Archived from the original on 2015-02-25. Retrieved 2015-03-03.

[20] Nohara, Tim J., "Reducing Bird Strikes – new Radar Networks Can Help Make Skies Safer" ^{[dead link]}, Journal of Air Traffic Control, Summer 2009

[21] Klope, Matthew W., et al., "Role of near-miss bird strikes in assessing hazards.", Human-Wildlife Interactions, Fall 2009

[NewYorkPost-22] Olshan, Jeremy; Livingston, Ikumulisa (January 17, 2009). "Quiet Air Hero Is Captain America". New York Post. http://www.nypost.com/seven/01172009/news/regionalnews/quiet_air_hero_is_captain_america_150593.htm.

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

[14]

[15]

[16]

[17]

[18]

[19]

[20]

[21]

[22]