NTSB Accident Report, subject to further review, issued at today's public meeting:
NATIONAL TRANSPORTATION SAFETY BOARD Public Meeting of December 10, 2019 (Information subject to editing)
Aircraft Accident Report: Inadvertent Activation of the Fuel Shutoff Lever and Subsequent Ditching Liberty Helicopters Inc., Operating a FlyNYON Doors-Off Flight Airbus Helicopters AS350 B2, N350LH New York, New York March 11, 2018 NTSB/AAR-19/04
This is a synopsis from the NTSB’s report and does not include the Board’s rationale for the conclusions, probable cause, and safety recommendations. NTSB staff is currently making final revisions to the report from which the attached conclusions and safety recommendations have been extracted. The final report and pertinent safety recommendation letters will be distributed to recommendation recipients as soon as possible. The attached information is subject to further review and editing to reflect changes adopted during the Board meeting.
Executive Summary
On March 11, 2018, about 1908 eastern daylight time, an Airbus Helicopters AS350 B2, N350LH, lost engine power during cruise flight, and the pilot performed an autorotative descent and ditching on the East River in New York, New York. The pilot sustained minor injuries, the five passengers drowned, and the helicopter was substantially damaged. The FlyNYON-branded flight was operated by Liberty Helicopters Inc. (Liberty), per a contractual agreement with NYONair; both companies considered the flight to be an aerial photography flight operated under the provisions of Title 14 Code of Federal Regulations (CFR) Part 91. Visual flight rules (VFR) weather conditions prevailed, and no flight plan was filed for the intended 30-minute local flight, which departed from Helo Kearny Heliport, Kearny, New Jersey, about 1850.
Liberty operated the accident flight as a FlyNYON-branded, doors-off helicopter flight that allowed the five passengers (one in the front seat, four in the rear seats) to take photographs of various landmarks while extending their legs outside the helicopter during portions of the flight. For the accident flight (and other FlyNYON flights that Liberty operated), Liberty configured its Airbus AS350 B2 helicopter with the two right and the front left doors removed and the left sliding door locked open. Before departure, each passenger was fitted with a NYONair-provided harness/tether system that NYONair developed with the intent to prevent passengers from falling out of the helicopter. The harness/tether system used on the accident flight consisted of a full-body, workplace fall-protection harness that was secured (with a locking carabiner) to a tether, the other end of which was secured (with another locking carabiner) to an anchor point in the cabin. Each passenger also wore the helicopter’s installed, Federal Aviation Administration (FAA)-approved restraints. The pilot (who was seated in the front right seat) wore only an installed, FAA-approved restraint.
After the flight departed, it traveled past various scenic landmarks. Consistent with the standard operating procedures (SOPs) used for FlyNYON flights, the passengers were allowed (when instructed by the pilot) to position themselves to extend their legs outside the helicopter. The two passengers who had been seated in the rear inboard seats removed their installed, FAAapproved restraints and sat on the cabin floor, wearing their harness/tether systems. The passengers seated in the outboard seats were allowed to rotate outboard in their seats. To enable such freedom of movement, the SOPs allowed the passengers to wear their installed, FAA-approved restraint with the lap belt adjusted loosely and the shoulder harness routed under the arm.
A review of radar data and onboard video showed that, when the flight was proceeding northwest over Manhattan toward Central Park at an altitude of 1,900 ft mean sea level, the front passenger, who was facing outboard in his seat with his legs outside the helicopter, leaned back several times to take photographs using a smartphone. The onboard video showed that, each time he leaned back, the tail of the tether attached to the back of his harness hung down loosely near the helicopter’s floor-mounted controls. At one point, when he pulled himself up to adjust his seating position, his tether tail remained taut but appeared to pop upward. Two seconds later, the helicopter’s engine sounds decreased, and the helicopter began to descend.
As the pilot performed the emergency procedures to perform an autorotation and address the apparent loss of engine power, he noticed that the fuel shutoff lever (FSOL) was in the shutoff position and that it had been inadvertently moved to that position by the tail of the front passenger’s tether, which had become caught on it.
Although the pilot pushed the FSOL down to restore fuel flow to the engine and attempted to relight the engine, the helicopter was too low to allow engine power to be restored in time to prevent the emergency landing. The pilot pulled the activation handle to deploy the helicopter’s emergency flotation system, and he ditched the helicopter on the East River. However, the helicopter’s floats did not fully inflate, and the helicopter rolled right in the water and became fully inverted and submerged about 11 seconds after it touched down.
The pilot was able to release his installed, FAA-approved restraint after he was under water and successfully egress from the helicopter; however, none of the passengers were able to egress, and they all drowned.
The NTSB identified the following safety issues as a result of this accident investigation:
• Effect of the harness/tether system on the ability of each passenger to rapidly egress from the capsizing helicopter. The investigation found that minimally trained passengers would have great difficulty extricating themselves from the harness/tether system, each of which was equipped with locking carabiners and an ineffective cutting tool, during an emergency requiring a rapid egress.
• Emergency flotation system design, maintenance, and certification issues. The manufacturer of the helicopter’s emergency flotation system did not provide information to help operators recognize the presence of unacceptably high pull forces when activating the system; the high pull forces on the accident helicopter’s activation system (which resulted from an installation anomaly) contributed to the pilot’s mistaken belief that he had taken the necessary action to fully inflate the floats. The FAA’s certification review of the emergency flotation system design installed on the accident helicopter did not identify the manufacturer’s omission of an activation handle pull-force limitation.
• Ineffective safety management at both Liberty and NYONair. Liberty’s managers repeatedly lacked involvement in key decisions related to Libertyoperated FlyNYON flights and allowed NYONair to influence core aspects of the operational control of those flights. Ineffective safety management at both companies allowed foreseeable safety risks to remain unmitigated; these included the potential for passenger interference with the helicopter’s floor-mounted controls, partial inflation of the emergency float system, and difficulties passengers would have with the locking carabiners and cutting tools as a means to rapidly release from the harness/tether system.
• Liberty and NYONair’s exploitation of the aerial work/aerial photography exception at 14 CFR 119.1(e) to operate FlyNYON flights under Part 91 with limited FAA oversight. Federal regulations do not define the terms “aerial work” and “aerial photography” to include only business-like, work-related aerial operations. Both Liberty and NYONair demonstrated deliberate efforts to operate the FlyNYON revenue passenger-carrying flights under Part 91 as aerial photography flights and to avoid any indication that the flights may be commercial air tours, which would be subject to additional FAA requirements and oversight that did not apply to aerial photography flights.
• Lack of policy and guidance for FAA inspectors to perform a comprehensive inspection of Part 91 operations conducted under any of the 14 CFR 119.1(e) exceptions. During the investigation, the FAA determined that the accident flight was a nonstop commercial air tour operated under Part 91 per the 14 CFR 119.1(e)(2) exception. Although an air tour operated under Part 91 is subject to FAA requirements and oversight that exceed what applies to aerial photography flights, the FAA lacks policy and guidance for FAA inspectors to support a comprehensive inspection of Part 91 operations conducted under any of the exceptions in 14 CFR 119.1(e) to ensure that operators are appropriately managing any associated risks.
• Lack of FSOL protection from inadvertent activation. The certification basis for the accident helicopter’s FSOL did not require protection from inadvertent activation due to external influences, such as interference from a passenger. However, a design modification that includes protection from external influences could enhance safety.
• Need for guidance and procedures for operators to assess and address passenger intoxication. Although the passenger in the front seat on the accident flight was intoxicated, it was not possible to determine whether alcohol played a role in his inadvertent activation of the FSOL. Despite the existence of an FAA regulation prohibiting the carriage of any passenger who appears to be intoxicated or impaired, neither Liberty nor NYONair had any documented policy or guidance materials, including training, for their employees to identify impaired passengers or for denying boarding of such individuals. While FAA guidance does exist on identifying intoxicated or impaired passengers, operators that conduct revenue passenger-carrying flights under Part 91 or 135 in small aircraft could benefit from guidance specific to their operations, particularly if they have passengers seated in close proximity to the aircraft controls.
• Inadequacy of the review and approval process for supplemental passenger restraint systems (SPRSs) that the FAA implemented after the accident. The FAA’s SPRS approval process that it implemented after the accident appears to focus primarily on the SPRS release mechanism without consideration of the expected operational environment or whether the use of an SPRS is warranted. The NTSB is concerned that, without an assessment of the specific need for and use of an SPRS, the addition of an SPRS may unnecessarily complicate the emergency egress of passengers. Further, without a comprehensive hazard analysis for the use of an SPRS in the operational environment (including aircraft-specific installations), factors that could impede passenger egress, such as the potential for entanglement with headset cords, other equipment, or the SPRS itself; or adversely affect flight safety, such as the potential for the SPRS to interfere with an equipment or controls in a specific aircraft, may be present but go unidentified.
Findings
1. None of the following were factors in this accident: (1) the pilot’s qualifications, which were in accordance with federal regulations and company requirements; (2) pilot fatigue or medical conditions; and (3) the airworthiness of the helicopter.
2. The tail of the front passenger’s tether caught on the fuel shutoff lever (FSOL) during the flight, which resulted in the inadvertent activation of the FSOL, interruption of fuel flow to the engine, and loss of engine power.
3. The pilot autorotated the helicopter successfully and pulled the emergency flotation system activation handle to deploy the floats at an appropriate time; however, the floats inflated partially and asymmetrically.
4. Liberty Helicopters Inc.’s and NYONair’s decision to use locking carabiners and ineffective cutting tools as the primary means for passengers to rapidly release from the harness/tether system was inappropriate and unsafe.
5. The helicopter’s landing was survivable; however, the NYONair-provided harness/tether system contributed to the passenger fatalities because it did not allow the passengers to quickly escape from the helicopter.
6. The Federal Aviation Administration’s (FAA) approval process for supplemental passenger restraint systems (SPRS) that was implemented after the accident is inadequate because it does not provide guidance to inspectors to evaluate any aircraft-specific installations or the potential for entanglement that passengers may encounter during emergency egress.
7. Although the crossover hose in the accident helicopter’s emergency flotation system design did not perform its intended function to alleviate asymmetric inflation of the floats during a single-reservoir discharge event, buoyancy stability testing showed that even symmetric distribution of the gas from only one reservoir would not enable the helicopter to remain upright in water.
8. In the absence of information from Dart specifying pull-force limitations for the emergency flotation system’s activation handle, Liberty and other operators lack a means to inspect for and correct high pull forces that may result from an installation anomaly or other issues.
9. Although the accident pilot was aware that each gas reservoir may not discharge simultaneously, the high forces required to pull the activation handle, along with the aural and visual cues following a single-reservoir discharge, led the pilot to mistakenly believe that he had successfully pulled the handle fully aft to fully inflate the floats.
10. The Federal Aviation Administration’s certification review of the emergency flotation system design installed on the accident helicopter did not identify Dart’s omission of an activation handle pull-force limitation; thus, the FAA’s reviews of other approved emergency flotation system designs may not have identified similar omissions.
11. Improved guidance for aircraft certification offices for assessing design features, usability, and inspection methods that ensure successful deployment of an emergency flotation system could help ensure that these important aspects are considered during the certification review process for such systems.
12. Through their repeated lack of involvement in key decisions related to Liberty Helicopters-operated FlyNYON flights, Liberty’s managers allowed NYONair personnel, particularly NYONair’s chief executive officer, to influence core aspects of the operational control of those flights.
13. Ineffective safety management at both Liberty Helicopters Inc. and NYONair resulted in a lack of prioritization and mitigation of foreseeable risks.
14. Liberty Helicopters and NYONair exploited the exception at Title 14 Code of Federal Regulations 119.1(e)(4)(iii) allowing aerial photography flights to be operated under Part 91, thereby avoiding the additional Federal Aviation Administration requirements and oversight that apply to commercial air tours conducted under either Part 135 or Part 91 with an air tour letter of authorization.
15. Without regulatory language that defines the terms “aerial work” and “aerial photography” to include only business-like, work-related aerial operations, operators may attempt to take advantage of the exception at Title 14 Code of Federal Regulations 119.1(e)(4)(iii) to carry revenue passengers for personal, entertainment, or leisure purposes without the additional Federal Aviation Administration requirements and oversight that apply to other commercial, revenue passenger-carrying operations.
16. The Federal Aviation Administration principal operations inspector assigned to oversee Liberty Helicopters Inc. did not conduct additional surveillance of Liberty’s operations after being made aware of its FlyNYON flights and failed to ensure that Liberty was appropriately managing the risks associated with the significant change in operations.
17. Because the Federal Aviation Administration (FAA) continues to allow passenger revenue operations to be conducted under Title 14 Code of Federal Regulations Part 91—some of which, like the FlyNYON flight operations, transport thousands of passengers annually— the FAA must provide inspectors with sufficient guidance to pursue more comprehensive oversight with regard to potential hazards they observe and to ensure that operators sufficiently mitigate risks.
18. Although the certification basis for the accident helicopter’s fuel shutoff lever did not require protection from inadvertent activation due to external influences, a design modification that includes such protection could enhance safety more effectively than continued reliance on operational measures.
19. The risk of the NYONair-provided harness/tether system tether tail becoming entangled with the floor-mounted fuel shutoff lever existed independently from passenger intoxication and most likely depended primarily on the passenger’s positioning in the cabin.
20. When passengers are seated in close proximity to an aircraft’s controls, it is critical that they not be impaired to reduce the likelihood of interference with the pilot’s ability to safely fly the aircraft.
Probable Cause
The NTSB determines the probable cause of this accident was Liberty Helicopters’ use of a NYONair-provided passenger harness/tether system, which caught on and activated the floormounted engine fuel shutoff lever and resulted in the in-flight loss of engine power and the subsequent ditching. Contributing to this accident were (1) Liberty’s and NYONair’s deficient safety management, which did not adequately mitigate foreseeable risks associated with the harness/tether system interfering with the floor-mounted controls and hindering passenger egress; (2) Liberty allowing NYONair to influence the operational control of Liberty’s FlyNYON flights; and (3) the Federal Aviation Administration’s inadequate oversight of Title 14 Code of Federal Regulations Part 91 revenue passenger-carrying operations. Contributing to the severity of the accident were (1) the rapid capsizing of the helicopter due to partial inflation of the emergency flotation system and (2) Liberty and NYONair’s use of the harness/tether system that hindered passenger egress.
Recommendations
To the Federal Aviation Administration
1. Modify the supplemental passenger restraint system (SPRS) approval process to (1) require letter of authorization (LOA) applicants to specify a need for and the intended use of an SPRS for each aircraft; (2) require the Federal Aviation Administration to evaluate and review, for each specified aircraft, the need for the SPRS on that aircraft for all intended uses; all SPRS design, manufacture, installation, and operational considerations, including, at a minimum, the potential for passengers to become entangled during emergency egress; the adequacy of passenger emergency egress briefings; and the potential for the SPRS to interfere with aircraft controls; and (3) ensure that each LOA lists the specific aircraft on which the holder is authorized to use an SPRS.
2. Until you implement the supplemental passenger restraint system (SPRS) approval process as recommended in Safety Recommendation [1], prohibit the use of SPRS for passenger-carrying doors-off operations.
3. Review the activation system designs of Federal Aviation Administration-approved rotorcraft emergency flotation systems for deficiencies that may preclude their proper deployment, such as a lack of a means to identify high pull forces on manual activation handles or inadequate guidance on the intended use of the activation system, and require corrective actions based on the review findings.
4. Revise Miscellaneous Guidance 10 in Advisory Circular (AC) 27 and AC 29 to include design objectives for emergency flotation systems that consider human factors design objectives, such as activation handle pull-force characteristics; provisions for clear, unambiguous, and positive feedback to pilots to indicate that the float system was successfully deployed; and inspections to ensure that an installation of a manual activation system does not preclude a pilot’s ability to deploy the floats, as designed, after it has been fielded.
5. Require all commercial air tour operators, regardless of their operating rule, to implement a safety management system.
6. Revise Title 14 Code of Federal Regulations 1.1, “General Definitions,” to include definitions for the terms “aerial work” and “aerial photography” that specify only business-like, work-related aerial operations, as originally intended.
7. Revise Order 8900.1, Flight Standards Information Management System, to include guidance for inspectors who oversee Title 14 Code of Federal Regulations (CFR) Part 91 operations conducted under any of the 14 CFR 119.1(e) exceptions to identify potential hazards and ensure that operators are appropriately managing the associated risks.
8. Develop and implement national standards within 14 Code of Federal Regulations (CFR) Part 135, or equivalent regulations, for all air tour operations with powered airplanes and rotorcraft to bring them under one set of standards with operations specifications, and eliminate the exception currently contained in 14 CFR 135.1.
9. After the actions requested in Safety Recommendation [11] are completed, require owners and operators of existing AS350-series helicopters to incorporate the changes.
10. Develop guidance on how to identify intoxicated or impaired passengers and distribute it to operators who carry passengers for hire under Title 14 Code of Federal Regulations Part 91 and Part 135.
To Airbus: 11. Modify the floor-mounted fuel shutoff lever in AS350-series helicopters to protect it from inadvertent activation due to external influences.
To the European Union Aviation Safety Agency:
12. After the actions requested in Safety Recommendation [11] are completed, require owners and operators of existing AS350-series helicopters to incorporate the changes.