Category Archives: Transportation History

San Bruno Victims and Their Families Deserve Long-Overdue Action

By Member Jennifer Homendy

Today marks 10 years since the devastating natural gas pipeline rupture that shattered a residential neighborhood in San Bruno, California. The September 9, 2010, explosion destroyed 38 homes and damaged 70 others. Even worse, 8 people were killed, 10 people sustained serious injuries, and many others suffered minor injuries.

The Accident

When I think of San Bruno, I struggle with the ‘right’ words to describe the horrific events that unfolded shortly after 6:00 p.m.—a time when many families across our nation are just sitting down for dinner.

In the moments after the rupture, calls flooded into 911, with reports of what many thought was a plane crash, a gas station explosion, or some combination of the two. One caller said it felt like an earthquake, and a fire captain who was on scene said, “It looked like Armageddon.” In fact, the rupture was so explosive that it produced a crater about 72 feet long by 26 feet wide and launched a 28-foot section of failed pipe about 100 feet south of the crater. The released gas almost immediately ignited. Emergency responders arrived within minutes to battle the ensuing inferno, yet it took Pacific Gas & Electric (PG&E) an astonishing 95 minutes to shut off the flow of gas that was intensifying the destruction. Firefighting efforts continued for 2 days, with 600 firefighters and 325 law enforcement personnel on scene.  

San Bruno, CA, accident scene with the crater in the foreground and the ruptured pipe section in the background
San Bruno, CA, accident scene with the crater in the foreground and the ruptured pipe section in the background

NTSB Warnings

I’m not going to get into the numerous failures at PG&E that led to the rupture. I want to focus on those 95 minutes. In December 1970, the NTSB released a Special Study of Effects of Delay in Shutting Down Failed Pipeline Systems and Methods of Providing Rapid Shutdown. You read that right—1970. We found that delays in shutting down pipelines increase the magnitude of catastrophe, and that, when the flow of gas or hazardous liquid is stopped soon after an initial rupture, the effects of many accidents would have been minimized or eliminated. In other words, numerous lives could’ve been saved, and injuries prevented.

Our report highlighted the 1968 rupture of a medium-pressure gas line in front of a daycare in Hapeville, Georgia. Construction crews on scene were unable to locate the buried valve to shut off the gas flow. A few minutes later, an explosion occurred inside the daycare. The ensuing fire engulfed the building and nine people were killed, including seven children. Three other children were seriously injured.

Nine other incidents—all involving failures to shut down pipelines—were cited in the report, and many more have occurred since it was published. The common theme? What we said in 1970 held true in San Bruno and holds true today: “For every one of the accidents cited, there are devices or equipment currently available which probably could have prevented the accident or greatly minimized its effect.”

We’ve been urging federal regulators to require those devices for 50 years! In fact, they’re still on our Most Wanted List of transportation safety improvements.

The San Bruno Investigation

Getting back to San Bruno. In those crucial 95 minutes during which the gas continued to flow, PG&E control center staff knew there had been a rupture along the pipeline, but never once called 911. The three PG&E employees who first arrived on scene, two of whom were supervisors, had no idea how to operate mainline valves. They had to call people who were qualified to operate them, and by the time those mechanics located the valves and got to the first one, it was 7:20 p.m., over an hour after the rupture occurred. Meanwhile, the fire, described by NTSB investigators as a massive blowtorch, was still raging.

Because gas was being supplied to the break from both the north and the south, the shutoff valves closest to the break had to be closed to shut down and isolate the rupture. The shutoff valves were located about 1.5 miles apart, on either end of the break, and they had to be shut manually. Had PG&E installed readily available technology—valves with remote closure capability or ones that would automatically shut off the gas flow in response to pressure changes in the line—the amount of time the fire burned, and thus, the severity of the accident, could’ve been significantly reduced. In fact, this technology could’ve stopped the flow of gas the moment the rupture was detected.

In our final report on the accident, we recommended that federal regulators—the Pipeline and Hazardous Materials Safety Administration (PHMSA)—require  pipeline companies to install automatic shutoff valves or remote shutoff valves in High Consequence Areas (defined as populated areas, drinking water sources, and unusually sensitive ecological areas).

PHMSA’s Response

On February 6, 2020, PHMSA published a notice of proposed rulemaking (NPRM), “Pipeline Safety: Valve Installation and Minimum Rupture Detection Standards,” claiming the NPRM responds to recommendations from the NTSB. It doesn’t. It requires automatic shutoff valves, remote-control valves, or equivalent technology to be installed only on newly constructed or entirely replaced onshore natural gas transmission and hazardous liquid pipelines that are larger than 6 inches in diameter.

Remember the daycare accident I mentioned? The pipeline that ruptured in that tragedy was only 1 inch in diameter. Existing gas transmission lines (like the PG&E line that ruptured in San Bruno), newly constructed or entirely replaced lines that are less than 6 inches in diameter, gas distribution systems, and offshore transmission lines are completely excluded from the NPRM’s requirements.

In other words, PHMSA’s solution won’t prevent another San Bruno disaster. Given that there are 2.6 million miles of gas pipelines in the United States, most of which date back to the 1950s and the NPRM doesn’t address any of them. With those numbers, another tragic accident is destined to occur, and if I’m the member on scene—or even if I’m not—I’ll remind PHMSA and industry, yet again, of all the ruptures we’ve investigated and all the opportunities they had to save lives.

To all those who lost loved ones in San Bruno or in another pipeline tragedy, you remain in our hearts. We are still fighting for you.

Arriving Soon: Fully Implemented Positive Train Control

By Member Jennifer Homendy

December 31, 2020—not only will it be the last day of an incredibly challenging year that I think we’ll all be happy to put behind us, it’s also a significant day for railroad safety. It’s the final deadline for all 41 railroads to fully implement Positive Train Control (PTC). It’s been a long journey to get to this point and I’m thrilled to see the great progress that’s been made over the years. There were times no one believed we’d get to where we are today, so how did we get here?

PTC is a communications-based system designed to automatically stop a train before certain accidents occur. It won’t prevent all train accidents, like vehicle-train accidents at grade crossings or those caused by track and equipment failures, but it is designed to prevent train-to-train collisions, overspeed derailments, incursions into established work zones, and train movement through switches left in the wrong position.

The concept of PTC isn’t new. In fact, the NTSB has been urging railroads to implement PTC in some form—and federal regulators to mandate it—for over 50 years. Our first recommendation related to PTC (Safety Recommendation R‑70‑20) was issued following a deadly train collision in Darien, Connecticut, in August 1969, when two Penn Central commuter trains collided head on, killing 3 crew members and 1 passenger, and injuring 43 others. Twenty years later, the NTSB included PTC on its first Most Wanted List of transportation safety improvements (MWL), and, with the exception of 4 years following enactment of the Rail Safety Improvement Act of 2008 (RSIA; Public Law 110-432, Division A), it’s remained on the list to this day.


Before the passage of the RSIA, we had been recommending this lifesaving technology for decades, yet little action had been taken to implement its use. Even the Federal Railroad Administration (FRA), which is the federal agency charged by Congress with ensuring “the assignment and maintenance of safety as the highest priority,” had rebuffed repeated NTSB calls for implementing PTC, asserting that the technology was too expensive and that it would provide little safety benefit—a claim that was seemingly inconsistent with the August 1999 Railroad Safety Advisory Committee report, Implementation of Positive Train Control Systems, which found that, out of a select group of 6,400 rail accidents that occurred from 1988 to 1997, 2,659 could have been prevented if some form of PTC had been implemented.

Most people who follow the history of PTC will say it was the 2008 Metrolink crash in Chatsworth, California, that really brought PTC to the attention of Congress, but that’s not entirely true. In fact, it was a string of PTC‑preventable accidents that occurred in the early to mid-2000s that finally caused the issue to make headway. Six of these accidents were accidents that we investigated in 2004 and 2005. They occurred in Macdona, Texas; Graniteville, South Carolina; Anding, Mississippi; Shepherd, Texas; Chicago, Illinois; and Texarkana, Arkansas.

The ones I remember most were Macdona and Graniteville; they were, in part, the reason the PTC mandate applies, not just to main lines over which passengers are transported, but also to main lines over which poisonous or toxic-by-inhalation hazardous materials are transported.

On June 28, 2004, a Union Pacific (UP) freight train struck the midpoint of a BNSF freight train traveling on the same main line track as the BNSF train was entering a siding. Chlorine escaping from a punctured tank car immediately vaporized into a cloud of chlorine gas that engulfed the area. The conductor of the UP train and two Macdona residents died as a result of chlorine gas inhalation. About 30 others were treated for respiratory distress or other injuries related to the collision and derailment.

Just 6 months later, on January 6, 2005, a Norfolk Southern train transporting chlorine encountered a misaligned switch that diverted the train from the main line onto an industry track, where it struck an unoccupied, parked Norfolk Southern train, killing the 28-year-old train engineer, Chris Seeling, and eight others as a result of chlorine gas inhalation. About 554 people suffering from respiratory difficulties were taken to local hospitals; 5,400 others within a 1-mile radius of the derailment site were evacuated for several days.

Both accidents were preventable with PTC.

I wasn’t at the NTSB at the time. I was serving as staff director of the US House of Representatives Subcommittee on Railroads, Pipelines, and Hazardous Materials. Congressman James Oberstar (D-MN) had just been named chairman of the committee, and one of his first acts as chair was to launch a series of hearings focused on rail safety. (Coincidentally, the subcommittee’s first hearing on the topic was the first time Chairman Sumwalt, then an NTSB board member, testified before Congress.)

One of those was a field hearing held in March 2007 in San Antonio, Texas, where Ralph Velasquez, a resident of Macdona, described his family’s escape from “the cloud of chlorine” and the tremendous physical, mental, and emotional toll the accident had taken on his family and the entire community. Mr. Velasquez’s words were similar to those of Chris Seeling’s parents, who had visited me and Chairman Oberstar months earlier. Both families wanted action, including implementation of NTSB recommendations.

Two months later, Chairman Oberstar delivered on his promises. The House approved legislation that mandated longstanding NTSB recommendations and established a deadline for PTC implementation. The Senate passed its bill in 2008, and we were in the process of finalizing a bipartisan, bicameral bill to include PTC when a Metrolink commuter train collided head-on with a Union Pacific freight train, killing 25 people in Chatsworth, California.

The tragedy in Chatsworth—which the NTSB later determined was preventable with PTC—gave the legislation its final push, and in October, the RSIA was signed into law, mandating PTC implementation by December 31, 2015. This deadline was later extended by Congress to 2018, and then again by the FRA on a case-by-case basis to 2020.

Since the RSIA was signed into law in 2008, the NTSB has investigated 25 accidents that would’ve been prevented had PTC been implemented, including the overspeed derailments of Amtrak passenger train 188 in Philadelphia, Pennsylvania, which killed eight people onboard, and Amtrak passenger train 501 near DuPont, Washington, which took three lives and injured more than 50 others. In all, since that first accident investigation in 1969, over 300 people have been killed and almost 7,000 others have been injured in 154 accidents that the NTSB determined could have been prevented if PTC had been operational. When people think about the 2008 mandate and how long it’s taken the railroads to implement that mandate, they get frustrated with Congress for extending the deadline, but what they fail to remember is, if it weren’t for congressional action, we wouldn’t be where we are today. The railroads wouldn’t have implemented PTC voluntarily.

Today, PTC data submitted to the FRA is looking far more positive than in the past. Since I joined the Board in 2018, I’ve visited or spoken to a majority of the 41 railroads regarding their PTC status, and they’re mostly reporting good progress. Most railroads are expected to meet the end-of-year deadline, and I’m cautiously optimistic that all 41 will succeed.

Because of the NTSB’s tireless advocacy, beginning long before I joined the Board, and the hard work of our investigators, the finish line is at last in sight. Our investigators work diligently to prevent tragedies like Macdona and Graniteville from recurring. If Chairman Oberstar was alive today, he would call them heroes for their dedication and for all they’ve done to save lives.

Today marks 154 days until the latest deadline for PTC implementation. That’s also the number of PTC-related accidents we’ve investigated over the years. For the rest of this year, stay tuned to our social media channels, where we’ll share information daily about each of the accidents (look for #PTCdeadline). These accidents are a reminder of how much we’ve lost while waiting for the implementation of PTC.




Remembering Marshall, Michigan

By Member Jennifer Homendy

This Saturday marks the 10th anniversary of one of the largest and most expensive inland oil spills in our nation’s history.

At 5:58 p.m. on July 25, 2010, a 30-inch diameter pipeline owned and operated by Enbridge ruptured, releasing nearly a million gallons of heavy crude oil into Talmadge Creek, which feeds into the Kalamazoo River – a tributary of Lake Michigan – and flowed about 35 miles downstream before it was contained.

Hazardous Liquid Pipeline Rupture and Release, Marshall, Michigan, July 25, 2010
The ruptured segment of Line 6B in the trench following the July 25, 2010, rupture. The fracture face measured about 6 feet 8.25 inches long and was 5.32 inches wide at the widest opening. The fracture ran just below the seam weld that was oriented just below the 3 o’clock position. A red circle shows a location where the coating was wrinkled and had separated from the pipe surface.

Although numerous alarms were triggered in Enbridge’s control center, located in Edmonton, Alberta, Canada, control center staff failed to recognize a rupture occurred for well over 17 hours, until an outside caller contacted the control center. Enbridge attributed the alarms to an earlier planned shutdown and column separation (a vapor-liquid void), and instead re-started the line twice for a period of 1.5 hours, pumping massive amounts of oil (81 percent of the total release, or over 600,000 additional gallons) into the pipeline. Once Enbridge realized there was a release, it was too little too late. Enbridge had only four maintenance personnel on scene; the closest trained responders – their oil spill response contractors – were 10 hours away.

At the time, I served as the Democratic Staff Director of the Subcommittee on Railroads, Pipelines, and Hazardous Materials for the U.S. House of Representatives, which had jurisdiction over the safety of oil and gas pipelines in the United States. About 24 hours after the rupture, the Chairman of the Committee, Congressman Jim Oberstar, and Congressman Mark Schauer who represented Marshall, Michigan, asked that I travel to Marshall and lead the Committee’s oversight investigation of the spill, which is different than an NTSB investigation (for example, we looked at claims and HIPAA violations).

I wish I had the right words to describe what it was like when we arrived in Marshall. Utter devastation doesn’t seem to do it justice. Oil blanketed the creek and river, the river’s banks, and flood plains, severely impacting the environment. Rescue and rehabilitation efforts for oiled birds and wildlife continued for months; river restoration went on for years. Clean-up costs totaled $1.2 billion, and Enbridge received the largest civil penalty for a Clean Water Act violation in U.S. history, and the second-largest penalty overall, after Deepwater Horizon.

July 25, 2010, Marshall, Michigan pipeline rupture
Cleanup efforts in an oil-soaked wetland near the rupture site. Saturated soil complicated the cleanup and excavation efforts. An excavator with a vacuum attachment is shown situated on wooden matting near the rupture site.

While, thankfully, no lives were lost, people lost homes and businesses, as well as income, and about 320 residents suffered symptoms consistent with exposure to crude oil.

Perhaps the most memorable moments for me were with the residents in Baker Estates in Battle Creek, Michigan, a community of about 70 mobile homes right along the river. I walked the oil-saturated river banks with them and was invited into their homes to hear about financial and medical impacts of the spill. See, no one evacuated the mobile home park. In fact, no one evacuated anyone along the river. County health officials issued a voluntary notice for homeowners to self-evacuate, which was noted in the NTSB accident report.

Meanwhile, NTSB’s investigation focused on the cause of the rupture and the oil spill response. NTSB’s former chairman Debbie Hersman was on scene. I ran into her and Peter Knudson, who is still a crucial part of NTSB’s media relations team, eating dinner one night in Marshall. Who knew we’d one day work together at the agency?

Through the investigation, the NTSB identified numerous gaps in Enbridge’s integrity management program, control room operations, training, and leak detection. To address the multitude of deficiencies, NTSB recommended that the pipeline industry develop an industry standard for a comprehensive safety management system (SMS) specific to pipelines.

Years later, I’m pleased to say that the industry didn’t just meet the intent of our recommendation; they exceeded it with the development of API Recommended Practice 1173, which also focused on safety culture and other safety-related issues. Since then, many pipeline operators have adopted and implemented the standard. The NTSB is working to encourage others, from the largest pipeline operators to the smallest municipalities, to implement SMS.

NTSB’s oil spill response investigation identified issues with the advance preparation and execution of the response that could be traced to the Pipeline and Hazardous Materials Safety Administration’s (PHMSA) regulations implementing the Oil Spill Prevention Act of 1990.

The PHMSA-approved Enbridge facility response plan did not provide for sufficient resources to deal with an oil spill of this magnitude. Furthermore, the NTSB investigation found that the severity of the oil spill could have been minimized had Enbridge focused more on source control and used oil containment methods that were appropriate for the environmental conditions. In response to NTSB recommendations, PHMSA undertook an effort to update the regulations and harmonize them with U.S. Coast Guard regulations for oil spills in navigable waterways.

Overall, there were a lot of safety gaps identified because of the Marshall spill. The NTSB’s work and the Committee’s oversight investigation led to a series of hearings that culminated in passage of sweeping legislation in 2011, which is still being implemented, albeit slowly, a decade later.

But looking back, a decade later, well after our investigators have left the scene, our final report has been issued, and recommendations are being acted upon, I think about the residents of Baker Estates and the other communities and business owners that suffered tremendous losses. For them, the work is just beginning, and Marshall will never be forgotten.

And it shouldn’t be forgotten because when the industry fails to learn from previous accident investigations and fails to make necessary changes, those accidents and the underlying issues that caused them are destined to repeat themselves.

In fact, as I sat down to write this blog, I recalled our 2005 safety study on Supervisory Control and Data Acquisition (SCADA) in pipelines. SCADA systems are essentially a computer system that allows control center staff to monitor and control the pipeline from a remote location. The study was prompted by 12 hazardous liquid accidents investigated by the NTSB in which leaks went undetected after indications of a leak were provided on the SCADA system: Brenham, Texas (1992), Gramercy, Louisiana (1996), Fork Shoals, South Carolina (1996), Murfreesboro, Tennessee (1996), Knoxville, Tennessee (1999), Bellingham, Washington (1999), Winchester, Kentucky (2000), Greenville, Texas (2000), Chalk Point, Maryland (2000), and Kingman, Kansas (2004).

Fork Shoals was eerily similar to Marshall. The pipeline owned and operated by Colonial Pipeline ruptured, releasing nearly one million gallons of fuel oil into the Reedy River and surrounding areas at Fork Shoals. Like Marshall, the SCADA alarms and alarm messages had activated, and the controller acknowledged them, but he failed to recognize that a rupture had occurred and continued pumping more and more fuel oil into the line after several shutdowns and re-starts. And like Enbridge, Colonial knew of the corrosion in the line in the months leading up to the rupture.

If you’re on the fence on SMS, I hope this prompts you to take heed and not wait for a rupture to occur to act.


NTSB Office of Rail, Pipeline and Hazardous Materials Investigations Director, Rob Hall, contributed to the writing of this blog.

Remembering Tenerife

By Jeff Marcus, Chief, NTSB Safety Recommendations Division

Forty-three years ago, on March 27, 1977, two Boeing 747s, KLM flight 4805 and Pan Am flight 1736, collided on a runway at Los Rodeos Airport in Tenerife, Canary Islands, killing 583 people. It was the single greatest loss of life in aviation accident history.

The crash was the result of an unlikely series of events—and a flight crew’s responses to them.

To begin with, neither of the two aircraft was initially supposed to be at Los Rodeos Airport in the first place. Both planes had been scheduled to arrive at Las Palmas Airport, also in the Canary Islands; however, Las Palmas had just been the target of a terrorist attack, and the terminal had been evacuated and the airport closed. The two 747s, as well as other arriving traffic, were diverted to the smaller Los Rodeos airport in Tenerife, where they landed safely.

The Los Rodeos Airport had not been equipped to handle the influx of diverted flights and, because of that, on March 27, the airport was congested, and maneuverability issues arose when the airplanes were ready to depart. Pan Am 1736 was ready to depart Los Rodeos to resume its itinerary, but had to wait until KLM 4805, which was obstructing the taxiway, had completed taking on fuel from a refueling vehicle. The captain of the KLM flight was instructed to back taxi down the entire runway, then perform a 180-degree turn in preparation for departure. The Pan Am captain was instructed by air traffic control to back taxi down the runway, then exit on the third taxiway to their left, and to report leaving the runway. The taxiways at the airport were unmarked and the centerline lights were out of service.

Los Rodeos airport was subject to fast-appearing, thick fog, and as the KLM airplane lined up for its takeoff roll, fog enveloped the runway. The Pan Am airplane missed its exit, and its crew did not appear to know their position on the runway. Neither crew could see the other plane, and the tower couldn’t see either plane. The airport was not equipped with ground radar.

Having lost so many sources of information, one last source of information failed: verbal communication between the airplanes and the tower.

Immediately after lining up, the KLM captain who had a sense of urgency to depart before exceeding duty limits advanced the throttles and the aircraft started to move forward. The KLM first officer advised the captain that air traffic control (ATC) clearance had not yet been given. The captain replied, “No, I know that. Go ahead, ask.” The first officer radioed the tower that they were ready for takeoff and waiting for ATC clearance. The KLM crew then received instructions that specified the route that the aircraft was to follow after takeoff. The instructions used the word “takeoff,” but didn’t include an explicit statement that the aircraft was cleared for takeoff. The first officer then read the clearance back to the controller, completing the readback with the nonstandard statement: “We are now at takeoff.” The KLM captain interrupted the first officer’s read-back with the comment, “We’re going.”

The controller, who could not see the runway due to the fog, initially responded with the nonstandard terminology “OK,” which reinforced the KLM captain’s misinterpretation that they had been cleared for takeoff. The controller then immediately added “stand by for takeoff, I will call you,” indicating that he had not intended the clearance to be interpreted as a takeoff clearance. However, a simultaneous radio call from the Pan Am crew caused mutual interference on the radio frequency, which was audible in the KLM flight deck as a 3-second-long shrill sound. This caused the KLM crew to miss the crucial latter portion of the tower’s response. The simultaneous message from the Pan Am crew, “We’re still taxiing down the runway, the Clipper 1736!” was also blocked by the interference and inaudible to the KLM crew. Either message, if heard in the KLM flight deck, would have alerted the crew to the situation and given them time to abort the takeoff attempt.

After the KLM plane started its takeoff roll, the tower instructed the Pan Am crew to “report when runway clear.” The Pan Am crew replied, “OK, will report when we’re clear.” On hearing this, the KLM flight engineer expressed his concern about the Pan Am aircraft not being clear of the runway by asking the pilots in his own cockpit, “Is he not clear, that Pan American?” The KLM captain emphatically replied, “Oh, yes,” and continued with the takeoff.

By the time the KLM captain saw the Pan Am airplane, he could only try to fly over it. The tail of the KLM airplane struck the Pan Am airplane, tearing through the center of its fuselage above the wing. Fuel spilled and ignited on impact. Of the Pan Am passengers and crew, 335 died, mainly as a result of ensuing fire and explosions, and 61 survived.

The KLM airplane lost one engine on impact, and the wings were damaged. The airplane rolled sharply and crashed about 500 feet past the point of collision. All 248 passengers and crew died in the crash and the post-crash fire.

The Tenerife accident provided early lessons for the concept of crew resource management (CRM), which emphasizes that all flight crew members should actively voice their safety concerns, and all crew, particularly senior crew members like the captain, must acknowledge the safety concerns of any crew member. In the Tenerife accident, the captain rushed the takeoff, despite the first officer pointing out that they had not received clearance, and the flight engineer recognizing that the Pan Am airplane had not yet cleared the runway. Despite the flight engineer highlighting the dangerous situation, the KLM captain dismissed the concern and continued the takeoff, which resulted in the tragedy a few seconds later.

The Tenerife accident was a milestone in the study of human factors in aviation accidents. The pressures of the day’s events and delays; the logistics pressures in a regional airport handling a major airport’s arrivals; the communications misunderstanding; and the failure to understand and use CRM practices all led to bad decisions at various points in the accident chain.

Aviation has changed and become safer by leaps and bounds since the crash. As a result of Tenerife, there has been greater emphasis on English as the single working language of aviation, and on the use of standard, concise, and unequivocal aeronautical language.

Tenerife was influential in recognizing that all crew members should feel empowered to speak up, and captains should listen to their safety concerns—an important principle of CRM. The principles of CRM have even been extended beyond aviation  to marine safety, where it is known as bridge resource management, and to medicine, where all doctors and technicians in an operating room are encouraged to voice their concerns, and senior, highly esteemed surgeons are trained to listen to and evaluate any safety concern expressed, regardless of who has the concern.

Humans are an integral part of the aviation system and the system must protect for human error. In 2017, many links of an accident chain were in place at San Francisco International Airport when an Air Canada airplane almost landed on a taxiway occupied by four airliners waiting to takeoff. There were over 1,000 people in those four airliners; the accident would have equaled or even surpassed the death toll at Tenerife more than 40 years earlier. That close call was another reminder of how much is on the line every time human pilots and passengers take to the skies—and how much of a role human factors can play in such tragedies and near misses.

A Tribute to NTSB Employees

By Chairman Robert L. Sumwalt

What do you get when you cross a transportation-related life-saving mission with some of the best people in the federal government?

 The National Transportation Safety Board, of course!

 And that is no April Fool’s joke.

 On this day 53 years ago, the NTSB was formed by an act of Congress. The agency’s mission is to investigate every civil aviation accident in the United States and significant accidents in other modes of transportation, determine their probable causes, and issue safety recommendations aimed at preventing future accidents. In addition, we conduct special studies concerning transportation safety, and we coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members impacted by major transportation disasters. We also adjudicate appeals from civil enforcement actions by the Federal Aviation Administration and the United States Coast Guard.


Since 1967, the NTSB has investigated more than 149,000 aviation accidents and thousands of surface transportation accidents. We’ve issued more than 15,000 safety recommendations—the vast majority of which ultimately are implemented. Some of the safety measures that have arisen, at least in part, from our safety recommendations include:


  • Floor-level escape lighting, fire-blocking seat coverings, lavatory smoke detectors, stronger cabin seats
  • Terrain avoidance and warning systems requirements
  • Inert gas use to eliminate fuel tank explosions
  • Shoulder harnesses in general aviation


  • Raising the legal drinking age to 21 and .05 percent BAC drinking and driving laws
  • Child passenger safety
  • Enforcement of commercial vehicle regulations


  • Boating-while-intoxicated laws
  • Cruise ship fire safety
  • Emergency position-indicating radio beacons (EPIRBs) on vessels

Railroad & Rail Transit

  • Positive train control
  • Passenger rail car safety standards
  • Toll-free emergency number posting at grade crossings
  • Tank car enhancements


  • One-call systems before excavation (“Call 811 Before You Dig”)
  • Integrity management programs
  • Facility response plan effectiveness and oversight


  • Hazard communications training for first responders, community planning, and preparedness

I’m often reminded that you can have an important mission, but if you don’t have devoted, talented employees, you really don’t have a great agency. Fortunately, the NTSB has both.

Our mission generates dedication, which often translates to retention; some of our longest-serving employees have been at the agency for over 40 years. But don’t misinterpret that longevity as complacency. In the most recent Federal Employee Viewpoint Survey, of the 70% of NTSB employees who completed the survey, 97% responded favorably to the statement, “When needed I am willing to put in the extra effort to get a job done.” Bear in mind that in many cases, “extra effort” is in addition to routine travel to remote accident sites with only hours’ notice!

During more than 13 years at the agency, including the past 3 as Chairman, I’ve had the pleasure to be surrounded by, and to work with, these professionals. As Chairman, I have relied on them to help formulate strategic decisions, advise me on technical details, and echo and amplify my own thirst for safety improvements.

Many of our air safety investigators are pilots and aircraft mechanics themselves—and each of them can tear down an engine. Several have built their own airplanes. Many of our highway safety investigators come from law enforcement backgrounds. Our marine investigators generally maintain licenses first earned as deck and engine officers or have Coast Guard investigative or regulatory experience. Our railroad and pipeline investigators are veterans of those industries and their regulators as well. Although doctoral degrees are common throughout the agency, the environment is as far as you can imagine from an ivory tower.

The NTSB workforce is among the best in the federal government, which is what fuels my desire to make the NTSB the best place to work in the federal government—even if, for now, we have temporarily moved that workplace into our homes.

Today, like many workforces, we are physically distant from one another, but we are not alone. We are physically separate, but we will get through this together. I’m grateful for the dedication and resilience of every one of NTSB’s employees. And that, too, is no April Fool’s joke.