Windsor Locks, CT, USA
N93012
Boeing B17
The National Transportation Safety Board (NTSB) identified the following safety issues during this accident investigation: the need for an appropriate regulatory framework for living flight history experience (LHFE) flights, including maintenance and management policies and procedures; the need for increased Federal Aviation Administration (FAA) oversight of LHFE operations; and the need for FAA oversight of LHFE operators’ safety management systems (SMS). These safety issues are discussed in the NTSB’s aviation investigation report addressing broader systemic safety issues associated with revenue passenger-carrying operations currently conducted under Title 14 Code of Federal Regulations Part 91, including LHFE flights. That aviation investigation report, titled Enhance Safety of Revenue Passenger Carrying Operations Conducted Under Title 14 Code of Federal Regulations Part 91 (NTSB/AAR-21/03), can be accessed from the Aviation Accident Reports page of the NTSB’s website. This report includes references to safety recommendations from the Part 91 aviation investigation report. The vintage, former US military bomber airplane was on a tour that allowed members of the public to purchase an excursion aboard the airplane for an LHFE flight. The accident flight was the airplane’s first flight of the day. During the initial climb, one of the pilots retracted the landing gear, and the crew chief/flight engineer (referred to as the loadmaster) left the cockpit to inform the passengers that they could leave their seats and walk around the airplane. One of the pilots reported to air traffic control that the airplane needed to return to the airport because of a rough magneto. At that time, the airplane was at an altitude of about 600 ft above ground level (agl) on the right crosswind leg of the airport traffic pattern for runway 6. The approach controller asked the pilot if he needed any assistance, to which the pilot replied, “negative.” When the loadmaster returned to the cockpit, he realized that the airplane was no longer climbing, and the pilot, realizing the same, instructed the copilot to extend the landing gear, which he did. The loadmaster left the cockpit to instruct the passengers to return to their seats and fasten their seat belts. When the loadmaster returned again to the cockpit, the pilot stated that the No. 4 engine was losing power; the pilot then shut down that engine and feathered the propeller without any further coordination or discussion. When the airplane was at an altitude of about 400 ft agl, it was on a midfield right downwind leg for runway 6. Witness video showed that the landing gear had already been extended by that time, even though the airplane still had about 2.7 nautical miles to fly in the traffic pattern before reaching the runway 6 threshold. During final approach, the airplane struck the runway 6 approach lights in a right-wing-down attitude about 1,000 ft before the runway and then contacted the ground about 500 ft before the runway. After landing short of the runway, the airplane traveled onto the right edge of the runway threshold and continued to veer to the right. The airplane collided with vehicles and a deicing fluid tank before coming to rest upright about 940 ft to the right of the runway. A postcrash fire ensued. Postaccident examination of the airframe revealed no preimpact mechanical anomalies that would have precluded normal operation. Teardown examination of the Nos. 3 and 4 propellers revealed that their blades were in the low-pitch and feathered positions, respectively. Teardown examination of the No. 4 engine revealed that the left magneto’s P-lead was partially pulled out of the magneto housing and that a single strand of safety wire was around the retaining nut. Although the No. 4 engine’s left magneto produced a strong spark on the ignition leads for all nine cylinders, the grounding tab contacted the housing and caused the magneto to short and not function during a postaccident test. The No. 4 engine’s right magneto produced no spark on one of the nine ignition leads and a weak and intermittent spark on the other eight ignition leads because of wear to the compensator cam. The shorted out left magneto would have caused rough engine operation and a partial loss of engine power that would have been exacerbated by the weak right magneto, which is likely what prompted the pilot to shut down the No. 4 engine and return to the airport. With the No. 4 engine shut down, the pilot would have had to use a higher power setting for the No. 3 engine to compensate for the loss of power from the No. 4 engine. Teardown examination of the No. 3 engine revealed evidence of detonation on four of the nine cylinders. In addition, the teardown examination revealed that the spark plugs were worn and had gaps between the electrodes that were beyond the manufacturer’s specifications. The condition of the spark plugs likely resulted in detonation and a partial loss of engine power that further reduced the total thrust available and exacerbated the thrust asymmetry. The pilot likely did not recognize, or recognized too late, the extent of the loss of engine power on the airplane’s right side. The pilot had performed a preflight run-up check of the magnetos at an engine speed of 1,700 rpm, which was higher than the 1,600-rpm speed in the Collings Foundation’s run-up checklist; after the check, the magnetos appeared to perform normally. However, a B-17 engine ground test checklist included instructions to check the magnetos at an engine speed between 1,900 and 2,000 rpm. If the pilots had been required to perform the magneto check at the higher rpm, they might have detected the detonation on the No. 3 engine and/or the magneto anomalies on the No. 4 engine (if either resulted in an rpm drop that exceeded 100 rpm, which would have been inconsistent with the B 17’s acceptable limits) and taken action before the flight to resolve the issues. During the return to the airport, the pilot flew the traffic pattern at an airspeed of 100 mph and below, and he allowed the airspeed to decay far below that required to minimize the loss of altitude over a given distance flown (about 120 mph). It is likely that the airplane was unable to maintain altitude at the lower airspeeds because the pilot could apply only a limited amount of power to the left-wing engines while simultaneously trimming the asymmetric thrust with the available rudder authority. Extending the landing gear created additional drag that exacerbated this situation; the landing gear should not have been extended until it became evident that the airplane could reach the runway. If the pilot had lowered the airplane’s nose to maintain the airspeed that was initially achieved during the climb and kept the landing gear retracted until landing on the runway was assured, the NTSB’s airplane performance study showed that the airplane could likely have overflown the approach lights and touched down beyond the runway threshold. Thus, the pilot did not appropriately manage the airplane’s configuration and airspeed after he shut down the No. 4 engine. The accident pilot was also the Collings Foundation’s director of maintenance and was responsible for performing the airplane’s maintenance while it was on tour. However, the teardown examinations of the Nos. 3 and 4 engines revealed maintenance issues that were not addressed during the airplane’s current tour. For example, the No. 3 engine’s 25-hour inspection occurred less than 1 month before the accident. As part of that inspection, the spark plugs should either have been cleaned, inspected, and tested or replaced with new plugs, and the gap between the electrodes should have been checked. The teardown examination found worn spark plugs with gaps between the electrodes that were beyond the manufacturer’s specifications, which should have been identified and corrected during the inspection of the No. 3 engine. As previously stated, the worn spark plugs would have contributed to the partial loss of power on the No. 3 engine and the asymmetric thrust. The 25-hour inspection also includes a check of the point gap for each magneto. The No. 4 engine had its 25-hour inspection 9 days before the accident, but the teardown examination found that the gap between the points on the right magneto was less than the minimum gap that the manufacturer required, indicating that this check was either not performed or was improperly performed. As a result of the point gap, most of the ignition leads produced sparks that were weak or intermittent, adding to the loss of engine power caused by the short in the left magneto. To address the aircraft maintenance deficiencies found in this and other accident investigations discussed in the Part 91 aviation investigation report, the NTSB issued Safety Recommendation A-21-9 in April 2021. This safety recommendation asked the FAA to “develop national safety standards, or equivalent regulations, for revenue passenger-carrying operations that are currently conducted under Title 14 Code of Federal Regulations Part 91, including, but not limited to…living history flight experience and other vintage aircraft flights.” The recommendation stated that these standards, or equivalent regulations, should include (among other things) operationally specific maintenance requirements. At the time of the accident, the Collings Foundation was operating with an LHFE exemption that provided the operator with relief from specific FAA regulations. The FAA’s most recent letter granting the Collings Foundation’s exemption stated that the foundation “must maintain and apply on a continuous basis its safety and risk management program that meets or exceeds the criteria specified in the FAA [LHFE] Policy.” The FAA’s policy stated that LHFE operators, including the Collings Foundation, were required to have a plan to mitigate risks that followed safety risk management principles. The Collings Foundation implemented an SMS about 2 1/2 years before the accident, which could have met the requirements of the FAA’s LHFE policy and the FAA’s letter that granted the foundation’s LHFE exemption. However, the SMS was not an effective safety risk management program. The SMS safety officer, who was responsible for managing the SMS, was a part-time, volunteer pilot and, as such, interacted with the foundation’s management and personnel on a sporadic basis only. Further, the SMS did not detect and appropriately manage the risks associated with safety issues related to the pilot’s inadequate maintenance of the airplane while it was on tour. The SMS also did not detect that the Collings Foundation’s engine run-up checklist was inconsistent with the B-17 engine ground test checklist or that the pilot and copilot did not wear their shoulder harnesses during flights (as reported by the loadmaster). In addition, the SMS did not detect that the loadmaster’s passenger briefings might have been insufficient (as indicated by statements from multiple surviving passengers that the briefing did not include information about seat belts, exits, or emergency equipment) or that he would stand unrestrained between the pilot and copilot during takeoff and landing, even though the foundation indicated that the seat to the left of the ball turret was available for him. The pilots’ failure to use their shoulder harnesses and the loadmaster’s failure to be restrained during takeoff and landing were inconsistent with federal regulations addressing the use of safety belts and shoulder harnesses. Even though the Collings Foundation was not specifically required to have an SMS, the FAA’s most recent letter granting the Collings Foundation’s exemption stated that the foundation was required to have an SMS manual (used as a basis for an equivalent level of safety) and provide it to the Orlando, Florida, Flight Standards District Office (FSDO). However, the manual was not a regulatory or an approved document, and the FSDO did not review the manual or the safety reports submitted as part of the SMS to ensure that the SMS met or exceeded the safety risk management criteria in the FAA’s policy for operators with LHFE exemptions. As a result, the FAA’s oversight of the Collings Foundation’s SMS was not effective in identifying and mitigating safety risks. In April 2021, the NTSB issued Safety Recommendations A-21-13, which asked the FAA to require SMS for the revenue passenger-carrying operations discussed in the Part 91 aviation investigation report; these operations included LHFE flights. The NTSB also issued Safety Recommendation A 21-14, which asked the FAA to provide ongoing oversight of each operator’s SMS once established.
HISTORY OF FLIGHT On October 2, 2019, about 0953 eastern daylight time, a Boeing B-17G, N93012, was destroyed when it impacted terrain short of runway 6 at Bradley International Airport (BDL), Windsor Locks, Connecticut. The commercial pilot, airline transport pilot, and five passengers were fatally injured; the crew chief/flight engineer and four passengers were seriously injured; and one passenger and one person on the ground sustained minor injuries. The airplane was operated by the Collings Foundation as a Title 14 Code of Federal Regulations (CFR) Part 91 local commercial sightseeing flight. The accident airplane, shown in figure 1, was a vintage, former US military bomber that was on a tour that allowed members of the public to purchase an excursion aboard the airplane for a living history flight experience (LHFE). After the passengers boarded the airplane, they were seated by the crew chief/flight engineer (referred to as the loadmaster). The 20- to 25 minute flight included a planned in-flight walking tour of the airplane. Source: Ms. Macey Lorden Figure 1. Accident airplane On the morning of the accident flight, a lineman at BDL assisted the loadmaster as he added 160 gallons of 100 low lead aviation fuel to the accident airplane. The loadmaster stated, during a postaccident interview, that the pilot had difficulty starting the Nos. 3 and 4 engines (both of which were on the right wing of the airplane) because of moisture in the magnetos due to rain the day before. (A magneto is an electrical generator that uses a rotating magnet to produce high-voltage electricity that is distributed to the spark plugs). The loadmaster, who held a mechanic certificate with airframe and powerplant ratings, dried the magnetos by blowing compressed nitrogen into them, after which the engines started normally. Before takeoff, the pilot performed a magneto check at an engine speed of 1,700 rpm, and the loadmaster reported that everything seemed normal. The accident flight was the airplane’s first flight of the day. The flight departed from runway 6 about 0947. During the initial climb, one of the pilots retracted the landing gear, and the loadmaster, who had been standing between the pilot and copilot in the cockpit, moved into the cabin to tell the passengers that they could leave their seats and walk through the airplane. According to a transcript of radio communications between air traffic controllers and the pilots, at 0949:19, one of the pilots stated, “we would like to return to the field.” Automatic dependent surveillance-broadcast (ADS-B) data showed that, at the time, the airplane was about 600 ft above ground level (agl) on the right crosswind leg of the airport traffic pattern for runway 6. The approach controller asked the pilot if he required any assistance, to which the pilot replied “negative.” The controller then asked why the airplane would be returning to the airport, and the pilot replied that the airplane had a “rough mag[neto]” on the No. 4 engine. During a postaccident interview, the loadmaster stated that, when he returned to the cockpit, he realized that the airplane was no longer climbing and that the pilot, realizing the same, instructed the copilot to extend the landing gear, which he did. The loadmaster also stated that he left the cockpit to instruct the passengers to return to their seats and fasten their seat belts. According to the loadmaster, after returning to the cockpit, the pilot indicated that the No. 4 engine was losing power and that he wanted to shut down that engine. (The loadmaster looked at the rpm gauge and confirmed that the No. 4 engine was losing power.) The pilot then shut down the No. 4 engine without any further coordination or discussion. At 0949:42, the controller instructed the pilot to fly a right downwind leg for runway 6 and asked whether the airplane needed an immediate landing. One of the pilots responded that he wanted the airplane “to be on the ground as soon as possible.” The controller subsequently canceled another airplane’s approach to the airport and advised the pilot to “proceed however necessary” to runway 6. At 0950:50, the approach controller instructed the pilot to contact the tower (local) controller, and the pilot acknowledged the instruction. After the pilot established contact, the tower controller reported that the wind was calm and that the airplane was cleared to land on runway 6. According to ADS-B data, starting about 0951:00, the airplane’s airspeed was at or below 100 mph. At 0951:08, the pilot acknowledged the landing clearance; ADS-B data indicated that the airplane was at an altitude of about 400 ft agl on a midfield right downwind leg for runway 6 at that time. Witness video confirmed the loadmaster’s report that the airplane’s landing gear had been extended by the time the airplane had entered the downwind leg of the airport traffic pattern (about 2.7 nautical miles in the traffic pattern from the runway 6 threshold). At 0951:28, the tower controller asked about the airplane’s progress to the runway; 6 seconds later, one of the pilots replied, “we’ll get there midfield downwind now.” No further communications were received from the airplane. The airplane was descending through an altitude of 300 ft as it turned onto the base leg of the traffic pattern for runway 6. The airplane then turned onto final approach at an altitude of 150 ft; at that time, the airplane was about 0.4 nautical mile from the runway threshold. Figure 2 depicts the airplane’s ADS-B-derived flightpath overlaid onto aerial imagery of the airport and surrounding area along with relevant voice radio transmissions between air traffic control (ATC) and the airplane. Figure 2. ADS-B-derived flightpath and select voice radio transmissions Note: The public docket for this accident contains the full ATC transcript. The crash location is shown in figure 4. Witness statements and video indicated that the airplane struck the runway 6 approach lights in a right wing-down attitude about 1,000 ft before the runway. The airplane contacted the ground about 500 ft before reaching runway 6. The engine noise increased, and the airplane accelerated as it veered to the right of the runway. The airplane then collided with vehicles and a deicing fluid tank before coming to rest upright about 940 ft to the right of the runway 6 centerline and oriented to the east. A postcrash fire ensued. PILOT INFORMATION The pilot held a commercial pilot certificate with ratings that included airplane multiengine land as well as a type rating for the Boeing B-17. He also held a mechanic certificate with airframe and powerplant ratings. The pilot’s logbook was not recovered. The operator reported that the pilot had 7,300 hours of flight experience in the B-17G and that he completed his annual proficiency check in the airplane on February 26, 2019. The pilot was the director of maintenance for the Collings Foundation, which was a paid position. (The pilot flew the B-17G as a volunteer.) The copilot held an airline transport pilot certificate with ratings that included airplane multiengine land as well as five type ratings for transport-category airplanes. He did not hold a type rating for the Boeing B-17 and was not required to hold that rating as a copilot. The copilot’s logbook was not recovered. The operator reported that the copilot had 23 hours of flight experience in the B 17G and that he completed his annual proficiency check in the airplane on February 24, 2019. AIRCRAFT INFORMATION The Federal Aviation Administration (FAA) issued a limited airworthiness certificate for the airplane in 1994, and most of the passenger seats were installed in 1995. According to operator and maintenance records, the airplane had 15 seats in the following configuration (forward to aft): 2 original-equipment seats in the lower nose area, which were not used for passengers; 2 original-equipment pilot seats on the flight deck (above the lower nose area); 2 aft-facing floor seats mounted to the structure behind the pilot seats; 3 seats in the radio room (2 side-facing seats on the floor and 1 swivel-style original equipment radio operator seat); 1 aft-facing seat on the left-side bulkhead panel near the ball turret, which the operator reported was not used for passengers but was available to the loadmaster; and 5 side-facing seats on the floor in the waist gunner area (3 right-side seats and 2 left-side seats). The passenger seats that were not original equipment were installed in the airplane according to an engineering document that conformed with the structural requirements of Civil Aviation Regulation 4b. Some of the seats consisted of a 5/8-inch-thick plywood seatback attached to the airframe with aluminum angles and brackets, as shown in figure 3. The other seats were secured directly to the structure on an airplane sidewall or bulkhead. All of the passenger seats included a seatback cushion secured with hook and loop fasteners and a seat bottom cushion secured to a floor panel. The passenger seats were equipped with a two-point military/aerobatic-style lap belt affixed to either the seat or structural areas on or near the floor. Source: The Collings Foundation. Figure 3. Accident airplane interior (forward looking aft) The pilot and copilot seats were equipped with a four-point restraint—a two-point military/aerobatic-style lap belt and shoulder harnesses—but the loadmaster reported that the pilots did not use the shoulder harnesses. The loadmaster also reported that he did not have a dedicated seat (and thus no available restraint) and that he would “stand in between the copilot and the pilot” during flights. The airplane was on tour each year for 10 months, and the pilot was responsible for performing the airplane’s maintenance during that time. (As previously stated, the pilot held a mechanic certificate and was the Collings Foundation’s director of maintenance.) The airplane’s continuous airworthiness inspection program included four 25-hour progressive inspections. Each of these inspections included one of the engines and its propeller. The inspected engine items included a check of the spark plugs, during which they were either cleaned, inspected, and tested or replaced with new plugs; a check of the gap between the spark plug electrodes; and a check of the point gap and timing for both engine magnetos. The airplane’s most recent 25-hour inspection was performed on September 23, 2019, and included an examination of the No. 4 engine and propeller and the landing gear. The most recent 25-hour inspection of the No. 3 engine and propeller was performed on September 7, 2019. The pilot endorsed the work performed during these and other 25-hour inspections. American Aero Services, a maintenance facility in New Smyrna Beach, Florida, performed annual inspections (which were not required according to the continuous airworthiness inspection program) when the airplane was not on tour. Review of maintenance records revealed that the most recent annual inspection was completed on January 16, 2019. At that time, the airframe had accumulated a total of about 11,121 hours. Between the time of the annual inspection and the most recent 25-hour inspection, the airplane had accumulated about 267 hours. Each of the airplane’s four nine-cylinder supercharged radial engines was equipped with a three blade, constant speed propeller. Engine No. 1 (outboard on the left wing) was installed on February 21, 2019, and, as of September 23, 2019, had accumulated 250 hours since its overhaul on January 8, 2019. Engine No. 2 (inboard on the left wing) was installed on January 16, 2019, and had accumulated about 267 hours since its overhaul on December 10, 2018. Engine No. 3 (inboard on the right wing) was installed on September 15, 2018, and had accumulated about 291 hours since its overhaul on January 15, 2018. Engine No. 4 (outboard on the right wing) was installed on January 15, 2016, and had accumulated about 1,106 hours since its overhaul on May 13, 2015. Review of the Engine and Accessories Ground Test checklist in the Pilot’s Manual for Boeing B 17 Flying Fortress revealed instructions to test the magnetos at an engine speed between 1,900 and 2,000 rpm and noted that the rpm drop should not exceed 100 rpm when switching from one magneto to the other (for each engine). The Collings Foundation engine run-up and ignition checklist indicated that the magnetos were to be checked at an engine speed of 1,600 rpm. The B 17 Field Service Manual stated that the presence of moisture in the magnetos should be removed with a cloth and solvent. The manual did not contain any checklist or approved procedure for using compressed nitrogen to dry moisture in the magnetos, but, according to the Collings Foundation, that was an accepted practice within the vintage warbird community. No stall speeds were published in the B-17 pilot’s manual for the accident airplane model. Review of a B-17 performance chart from the Experimental Aircraft Association’s (EAA) flight training manual revealed that, at 45,000 pounds and with the flaps and landing gear up, the stall speed was about 95 mph. (The EAA’s manual did not contain B-17 performance information for the airplane in the flaps-up and landing gear down accident configuration). AIRPORT INFORMATION BDL has three paved runway surfaces designated 6/24 (9,510 ft long), 15/33 (6,847 ft long), and 1/19 (4,269 ft long). At the time of the accident, a notice to airmen indicated that runway 15/33 was closed except for taxi operations. The approach lighting system for runway 6 is 2,400 ft long. The lights are spaced at 100-ft intervals from the runway 6 threshold. WRECKAGE AND IMPACT INFORMATION Figure 4 is an overhead image that shows the runway 6 approach area, the areas of impact damage to the instrument landing system (ILS) lighting equipment, and the location of witness marks from the airplane’s main landing gear (MLG) and right wing. The figure also shows the airplane’s final resting position about 940 ft to the right of the runway 6 centerline. Most of the cabin, cockpit, and right wing were consumed by a postcrash fire, as shown in figure 5. Figure 4. Overhead image depicting the airplane’s path to final impact Figure 5. Airplane wreckage Measurement of the left- and right-wing flap jackscrews corresponded to the retracted flap setting. The left-wing flap and aileron remained attached to the wing, and a section of the flap was consumed by the postcrash fire. The right-wing flap remained attached to the wing; the aileron was consumed by the postcrash fire. The empennage, elevator, and rudder remained intact. Control continuity was established for the elevator, rudder, and their trim tabs from each control surface to the respective cockpit controls (except for the area in the cabin that was consumed by the postcrash fire). The elevator trim and rudder trim cables were pulled by impact forces, so their preimpact position on the drum at their respective control surfaces could not be determined. The left-wing aileron trim tab remained intact, and its pushrod was connected but bent. The left aileron bellcrank separated from the wing, but the aileron cables remained attached to the bellcrank and in the cockpit. Examination of the airframe revealed no evidence of preimpact mechanical malfunctions. The Nos. 1 and 2 engines remained partially attached to the left wing, and the propeller blades remained attached to each engine. One of the propeller blades attached to the No. 1 engine exhibited an 8-inch tip separation; the separated section traveled about 700 ft before coming to rest in an airport building. Another propeller blade on the No. 1 engine exhibited chordwise scratching and leading-edge gouging. The other propeller blade on the No. 1 engine was bent aft. All of the propeller blades on the No. 2 engine exhibited leading-edge gouges and chordwise scratches. The No. 3 engine had separated from the right wing and was recovered on top of the airport’s deicing fluid tank, which was adjacent to the main wreckage. All of the propeller blades wer
The pilot’s failure to properly manage the airplane’s configuration and airspeed after he shut down the No. 4 engine following its partial loss of power during the initial climb. Contributing to the accident was the pilot/maintenance director’s inadequate maintenance while the airplane was on tour, which resulted in the partial loss of power to the Nos. 3 and 4 engines; the Collings Foundation’s ineffective safety management system (SMS), which failed to identify and mitigate safety risks; and the Federal Aviation Administration’s inadequate oversight of the Collings Foundation’s SMS.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
