Where the Action is in Safety

By Dolline Hatchett, Director, Office of Safety Recommendations and Communications

As the Director of the NTSB’s Office of Safety Recommendations and Communications (SRC), I lead a group that is focused on getting the whole story of accident investigations to the public. When there is a transportation disaster, my group is on scene alongside the frontline investigators, recording B-roll (video imagery of the accident site), and helping prepare NTSB spokespeople for on-scene press conferences.

But that’s just the leading edge of the investigation—and of our communications responsibility. For major investigations, we also focus attention on the public Board meeting. And, equally important but often overlooked, we help craft safety recommendations and advocate for them to be enacted, following up with recipients—sometimes for years—to see the job through.

My division’s mission runs the gamut, from fine points of grammar and usage to getting the right information out so that the people who need it have access to it. And lately, I’ve been thinking about how our language affects how we think—and what we do—about safety.

The Chairman of the NTSB has said that safety is not something that you can get or own, it’s something that you do, day after day. How does that relate to how we talk and write about safety? Well, if safety is something that we do, it’s not safety the noun (or the modifiers safe or safely). At heart, safety is a verb: to save.

To save lives. To save people from injury, and to save property and the environment from damage. How do we do this? By identifying hazards and mitigating risk (more action words—things we do to save ourselves, others, and our world!).

Why is this important? I notice too often that things that we do “for safety” are easily waved off. They’re thought of as things we do just in case something unlikely happens, but that cost time and money for the usual case when those measures aren’t needed. But the unlikely occurrence is out there, ready to happen, if that procedure isn’t followed or that safe design fails. We can’t be lax about safety, even if the likelihood of something going wrong is very low.

Those who are not deeply passionate about safety might dismissively explain that a feature is “for safety.” Think about the last automobile commercial you saw. I’m certain you heard something like “safety features” mentioned as flashy footage of that new car raced around coastline curves. I bet you weren’t thinking at all about what that term—safety features—even meant. It wasn’t made out to be as important as the car’s horsepower or built-in infotainment system. But what if the commercial narrator used a different term? Would you pay more attention if the narrator said, “To save your life, this vehicle is equipped with . . .” before summarizing the car’s safety features?

As you may have concluded, I truly appreciate the power of verbs—as far as language goes, they’re where the action is, where the rubber meets the road. By the same token, safety recommendations are where the rubber meets the road in the NTSB’s mission to improve safety. They’re about actions that can be taken to save people from death or injury, or to save property or the environment.

For example, although we recommend and advocate for transportation operators to use safety management systems (SMSs), implementing an SMS means starting and continuing a process. Although this process does include documents (safety policy), it does not begin and end there. A company must also do safety every day. Complying with rules is a good foundation, but to move ahead in a safety journey, we need the verb to save, which means making an ongoing, active effort. What does it mean to continually save in all that we do? It means following all the safety rules, of course, as a first step. But it also means continually scanning the horizon for the next hazard, to save lives, save others or ourselves from injuries, and save property and the environment from damage. This continual vigilance aligns with the proactive, recurring feedback necessary for a successful SMS.

We can all take a page from the safety professional’s book and forget safety the noun. Especially in today’s environment, safety is not something that we get or own. It’s something that we do, and continue to do, every day.

Safety is, by all rights, a verb. It calls for action. Make safety something you do, and keep doing it.

General Aviation’s Silent Killer in the Sky

By Michelle Watters, MD, PhD, MPH

As the weather gets colder and using your aircraft’s cabin heater becomes more of a necessity than a luxury, there’s no better time to start thinking about a plan for handling carbon monoxide. Commonly called the “silent killer,” carbon monoxide is best known as the cause of household poisonings from oil or gas furnaces, stoves, water heaters, or portable generators or fireplaces. For general aviation pilots, carbon monoxide exposure poses a particularly concerning threat because impairing levels can build quickly in an enclosed cabin, and even nonfatal levels can lead to tragic consequences in flight.

For example, in 2017, a private pilot was flying his newly purchased Varga 2150A airplane on a visual flight rules cross-country flight. After flying for about 80 minutes, the airplane suddenly entered a spiraling descent from cruise flight. Witnesses observed the airplane flying erratically at low altitude before it impacted an open field near Bowling Green, Ohio; they stated that the engine was running until impact. Toxicological testing of the pilot’s blood found 55% carbon monoxide saturation (toxic level is 20 percent).

Carbon Monoxide and the Danger of Exposure

So, what is carbon monoxide and why is it dangerous? Carbon monoxide is a simple chemical formed from the incomplete combustion of carbon-containing compounds, such as aviation fuel. It’s odorless, tasteless, and colorless, so your senses don’t provide much of a warning if you’re exposed! (Although, if you do smell exhaust fumes, always assume they contain carbon monoxide.) Carbon monoxide is harmful to people because it competes with oxygen to bind to hemoglobin, an iron-containing protein in your red blood cells. Not only does it outcompete oxygen—which means there’s less oxygen circulating in your blood—but it prevents the blood from unloading oxygen to the tissues and vital organs that need it—including your brain.

What happens when you’re exposed? At low concentrations, symptoms of exposure are mild and vague, and include headache, nausea, and fatigue. You might think you’re just feeling a bit off that day. As the concentration of carbon monoxide in your blood increases, so does impairment, and you’ll start experiencing dizziness, confusion, and disorientation. For longer exposures or high enough concentration levels in your blood, symptoms can be incapacitating and include unconsciousness, coma, and even death.

In the case of the Varga pilot, exposure to carbon monoxide explains his loss of control—he likely suffered confusion, disorientation, and loss of consciousness. But how was he exposed to carbon monoxide in the first place? Examination of the Varga’s heat exchanger showed that the outside casing had either previously been repaired or had been originally constructed of metals with different properties. About half the casing was discolored and exhibited varying signs of corrosion. Small holes from corrosion were found in the casing material, which provided a means for carbon monoxide to enter the cockpit from the exhaust system.

Internal Combustion Engines and Carbon Monoxide Exposure

Wherever there’s an operating internal combustion engine, carbon monoxide is likely being produced. Many airplanes with internal combustion engines are heated by air warmed from circulating around the exhaust system using a heater shroud. As in the case of the Varga pilot, a defect or leak in the exhaust pipes or muffler can introduce carbon monoxide into the cockpit. Although piston engines produce the highest concentrations of carbon monoxide, exhaust from turbine engines can also cause carbon monoxide poisoning.

Our accident investigations show that there are one or two fatal or serious aircraft accidents each year in which carbon monoxide is a finding, contributing factor, or probable cause. Although these accidents are more prevalent in colder months, carbon-monoxide-related accidents happen throughout the year (for instance, the Varga accident occurred in June).

Maintenance and Inspection Issues

Maintenance logbooks indicated that the Varga’s most recent annual inspection was completed less than a month before the accident, and the logbooks didn’t contain any record of heat exchanger repair or replacement. The heat exchanger’s condition at the time of the accident indicates an insufficient annual inspection.

A Federal Aviation Administration (FAA) report found that inadequate maintenance and inspection has contributed to many carbon-monoxide–related accidents. Deficiencies included poor welds, unapproved modifications, and missed holes or cracks on visual inspection. The FAA also found that, for carbon-monoxide–related accidents involving mufflers, there was a strong relationship between the muffler’s lifespan and its failure—the mufflers in the majority of these accidents had more than 1,000 hours of use.

Preventing Carbon Monoxide Exposure

So, how do you prevent carbon monoxide exposure? The first key step is preventing exposure—make sure to routinely inspect your aircraft’s exhaust system and replace when warranted. During each 100‑hour or annual aircraft inspection, ensure your mechanic thoroughly inspects the exhaust systems, air ducting firewalls, and door and window seals. During preflight inspections, look for cracking at the ends of your muffler and evidence of soot, which might indicate cracking in the muffler. Follow the manufacturer’s recommendations for the lifetime limit on your muffler and schedule for replacement parts.

Even with best efforts, leaks may happen. Secondary prevention involves being alerted to the danger before it becomes a problem. Don’t rely solely on knowing the symptoms of carbon monoxide as your warning system—they’re not specific enough to be recognized as exposure before impairment sets in. You might have heard that your skin, lips, or fingernails turn red when you’re exposed to carbon monoxide, but discoloration only happens sometimes, and only at very high levels of exposure. If you do turn red, you’re probably already too impaired to realize it, and it’s probably too late to recover.

So how can you be alerted to dangerous levels of carbon monoxide? Just like for your home, multiple types of carbon monoxide detectors are available for your aircraft and can be placed on your instrument panel. Detectors that only change color when carbon monoxide reaches a certain level are undesirable. The color change may be subtle in some lighting, and these detectors require that you regularly scan the device. Also, color-change devices need to be replaced regularly, and their useful lives may be shortened by exposure to direct sunlight—there’s often no way to tell when they’ve stopped working. Detectors mounted on the instrument panel with audible alerts or flash notifications provide the best warning. The FAA report mentioned earlier in this article found that electrochemical sensors were most suitable for use in general aviation due to their relatively high accuracy, quick response time, and low power consumption.

The next thing to consider is what you’ll do if your carbon monoxide detector goes off, you feel symptoms, or you suspect carbon monoxide in your aircraft. Unlike other medical emergencies where your crew may be able to assist, carbon monoxide exposure affects everyone on your aircraft. Communicate with air traffic control immediately and tell them you suspect carbon monoxide leak and exposure. When flying to the nearest airfield, descend to the lowest safe altitude, as carbon monoxide binds hemoglobin more readily and strongly at higher altitudes. Turn off the heater. Maximally increase cabin fresh air ventilation, open windows if permissible. Consider supplemental oxygen if it’s safe to use. Once on the ground, seek medical attention and do not continue your flight until the aircraft is inspected and repaired.

The NTSB determined that the probable cause of the Varga aircraft accident was the pilot’s loss of control due to impairment from carbon monoxide poisoning. Contributing to the accident was the corrosion of the heat exchanger and the failure of maintenance personnel to adequately inspect and repair or replace the exchanger during the most recent annual inspection. These factors were all avoidable with a little extra care. Inspect your aircraft. Know the symptoms of carbon monoxide poisoning, but don’t rely on them for warning. Install a carbon monoxide detector. Take immediate action.

Interested in more information?

You can learn more by viewing these NTSB and FAA resources:

• NTSB Safety Alert—Pilots: Prevent Carbon Monoxide Poisoning
• NTSB Safety Alert companion video—Pilots: Prevent Carbon Monoxide Poisoning features a pilot who shares his personal story on carbon monoxide poisoning and prevent it from happening to you.
• Carbon Monoxide (CO) Contamination in Aircraft – Detection and Prevention (Advisory Circular [AC] 20-32B) contains information on the potential dangers of CO exposure from faulty engine exhaust systems or cabin heaters, means of detecting CO, and procedures to follow when exposure is suspected.
• Acceptable Methods, Techniques, and Practices—Aircraft Inspection and Repair (AC 43-13-1B) contains inspection methods and repair techniques in chapter 8 to prevent exhaust system failures that could lead to CO exposure.
• Engine Exhaust and Carbon Monoxide Detectors (Special Airworthiness Information Bulletin CE-10-19R1) informs owners and operators of the importance of installing CO detectors.
• FAA brochure Carbon Monoxide: A Deadly Menace contains medical information concerning the symptoms of CO exposure and methods of avoiding exposure. 

Rail Safety Week 2020

By Member Jennifer Homendy

Today kicks off Operation Lifesaver’s 2020 Rail Safety Week in North America. In normal years, Operation Lifesaver and its partners hold events across the country to educate the public on rail safety issues and promote safe actions around railroad tracks. Those efforts will be focused on virtual outreach this year. This is important work because, tragically, hundreds of people are fatally struck by trains in incidents that could have been avoided, and there are far too many close calls. Federal Railroad Administration (FRA) data shows there were 422 total fatalities on US railroads last year, the majority of which were trespassing or highway–rail grade crossing incidents.

It isn’t uncommon to witness risky behavior on or near railroad tracks. Have you ever seen a car, pedestrian, or cyclist ignore warnings that a train is approaching and cross tracks anyway? How about those family photos taken on train tracks? In May, I wrote a blog about the dangers of trespassing and risky behavior at rail grade crossings—behavior I witnessed myself on a recent visit to Alaska.

Railroad tracks are private property, and trespassing is not only unlawful, it’s dangerous. In 2014, the NTSB investigated an accident involving a film crew trespassing on CSX tracks near Jesup, Georgia. The actions of the film crew, who were not authorized to film on CSX right‑of-way, resulted in the death of one crewmember and caused injuries to six others when a freight train passed on the bridge where the crew was filming.

Trains have the right of way to pass through highway–rail grade crossings without stopping for road traffic. In fact, it’s our responsibility—the road users—to stop for train traffic. There are both passive and active highway–rail grade crossings. At passive crossings, signage will warn road users to be vigilant when crossing tracks and to look for oncoming trains. At active crossings, often found in more populated areas, flashing lights, audible alarms, and automatic gates will warn of an approaching train. If you are a Waze user, the app will now alert drivers that they are approaching railroad crossings.  

Have you ever noticed the blue and white signs posted near grade crossings? The Emergency Notification System (ENS) signs include a phone number and the crossing’s USDOT number so the railroads can be notified of an emergency or warning device malfunction. If, for some reason, you become stuck on the tracks at a grade crossing, immediately get out of your vehicle and move to safety. Then, find this sign to alert the railroad. If you do not see a sign, call 911.

I think it’s also important to mention that September is National Suicide Prevention Awareness Month. This year has been challenging for all of us and paying attention to our mental health is more important than ever. There are resources that can help: The National Suicide Prevention Lifeline (1-800-273-8255) is available 24/7 for English or Spanish speakers, and for those who are hard of hearing. There is absolutely nothing wrong with seeking support when we’re feeling vulnerable.

Let’s take care of ourselves—and each other—and take rail safety seriously. Remember: trains are heavy, moving fast, and take over a mile to come to a stop. It’s up to us to obey warnings, be vigilant, and stay off the tracks.

Episode 35: School Transportation Safety

In this episode of Behind-the-Scene @NTSB, Member Michael Graham and Highway Investigators Michele Beckjord and Meg Sweeney share lessons learned from our school-transportation-related crash investigations and discuss why school buses are the safest form of transportation for students.

For more information about NTSB school transportation-related investigations, safety recommendations and presentations, visit the NTSB School Bus Safety page.

The NTSB final reports for the investigations mentioned in this episode are available here.

The previously released podcast featuring Member Graham, is available here.

Get the latest episode on Apple Podcasts , on Google Play, Stitcher, or your favorite podcast platform.

And find more ways to listen here: https://www.blubrry.com/behind_the_scene_ntsb/

San Bruno Victims and Their Families Deserve Long-Overdue Action

By Member Jennifer Homendy

Today marks 10 years since the devastating natural gas pipeline rupture that shattered a residential neighborhood in San Bruno, California. The September 9, 2010, explosion destroyed 38 homes and damaged 70 others. Even worse, 8 people were killed, 10 people sustained serious injuries, and many others suffered minor injuries.

The Accident

When I think of San Bruno, I struggle with the ‘right’ words to describe the horrific events that unfolded shortly after 6:00 p.m.—a time when many families across our nation are just sitting down for dinner.

In the moments after the rupture, calls flooded into 911, with reports of what many thought was a plane crash, a gas station explosion, or some combination of the two. One caller said it felt like an earthquake, and a fire captain who was on scene said, “It looked like Armageddon.” In fact, the rupture was so explosive that it produced a crater about 72 feet long by 26 feet wide and launched a 28-foot section of failed pipe about 100 feet south of the crater. The released gas almost immediately ignited. Emergency responders arrived within minutes to battle the ensuing inferno, yet it took Pacific Gas & Electric (PG&E) an astonishing 95 minutes to shut off the flow of gas that was intensifying the destruction. Firefighting efforts continued for 2 days, with 600 firefighters and 325 law enforcement personnel on scene.  

San Bruno, CA, accident scene with the crater in the foreground and the ruptured pipe section in the background

NTSB Warnings

I’m not going to get into the numerous failures at PG&E that led to the rupture. I want to focus on those 95 minutes. In December 1970, the NTSB released a Special Study of Effects of Delay in Shutting Down Failed Pipeline Systems and Methods of Providing Rapid Shutdown. You read that right—1970. We found that delays in shutting down pipelines increase the magnitude of catastrophe, and that, when the flow of gas or hazardous liquid is stopped soon after an initial rupture, the effects of many accidents would have been minimized or eliminated. In other words, numerous lives could’ve been saved, and injuries prevented.

Our report highlighted the 1968 rupture of a medium-pressure gas line in front of a daycare in Hapeville, Georgia. Construction crews on scene were unable to locate the buried valve to shut off the gas flow. A few minutes later, an explosion occurred inside the daycare. The ensuing fire engulfed the building and nine people were killed, including seven children. Three other children were seriously injured.

Nine other incidents—all involving failures to shut down pipelines—were cited in the report, and many more have occurred since it was published. The common theme? What we said in 1970 held true in San Bruno and holds true today: “For every one of the accidents cited, there are devices or equipment currently available which probably could have prevented the accident or greatly minimized its effect.”

We’ve been urging federal regulators to require those devices for 50 years! In fact, they’re still on our Most Wanted List of transportation safety improvements.

The San Bruno Investigation

Getting back to San Bruno. In those crucial 95 minutes during which the gas continued to flow, PG&E control center staff knew there had been a rupture along the pipeline, but never once called 911. The three PG&E employees who first arrived on scene, two of whom were supervisors, had no idea how to operate mainline valves. They had to call people who were qualified to operate them, and by the time those mechanics located the valves and got to the first one, it was 7:20 p.m., over an hour after the rupture occurred. Meanwhile, the fire, described by NTSB investigators as a massive blowtorch, was still raging.

Because gas was being supplied to the break from both the north and the south, the shutoff valves closest to the break had to be closed to shut down and isolate the rupture. The shutoff valves were located about 1.5 miles apart, on either end of the break, and they had to be shut manually. Had PG&E installed readily available technology—valves with remote closure capability or ones that would automatically shut off the gas flow in response to pressure changes in the line—the amount of time the fire burned, and thus, the severity of the accident, could’ve been significantly reduced. In fact, this technology could’ve stopped the flow of gas the moment the rupture was detected.

In our final report on the accident, we recommended that federal regulators—the Pipeline and Hazardous Materials Safety Administration (PHMSA)—require  pipeline companies to install automatic shutoff valves or remote shutoff valves in High Consequence Areas (defined as populated areas, drinking water sources, and unusually sensitive ecological areas).

PHMSA’s Response

On February 6, 2020, PHMSA published a notice of proposed rulemaking (NPRM), “Pipeline Safety: Valve Installation and Minimum Rupture Detection Standards,” claiming the NPRM responds to recommendations from the NTSB. It doesn’t. It requires automatic shutoff valves, remote-control valves, or equivalent technology to be installed only on newly constructed or entirely replaced onshore natural gas transmission and hazardous liquid pipelines that are larger than 6 inches in diameter.

Remember the daycare accident I mentioned? The pipeline that ruptured in that tragedy was only 1 inch in diameter. Existing gas transmission lines (like the PG&E line that ruptured in San Bruno), newly constructed or entirely replaced lines that are less than 6 inches in diameter, gas distribution systems, and offshore transmission lines are completely excluded from the NPRM’s requirements.

In other words, PHMSA’s solution won’t prevent another San Bruno disaster. Given that there are 2.6 million miles of gas pipelines in the United States, most of which date back to the 1950s and the NPRM doesn’t address any of them. With those numbers, another tragic accident is destined to occur, and if I’m the member on scene—or even if I’m not—I’ll remind PHMSA and industry, yet again, of all the ruptures we’ve investigated and all the opportunities they had to save lives.

To all those who lost loved ones in San Bruno or in another pipeline tragedy, you remain in our hearts. We are still fighting for you.