N93012Boeing B-17G · 1944

On October 2, 2019, about 0953 eastern daylight time, a Boeing B-17G, N93012, was destroyed when it impacted terrain short of runway 6 at Bradley International Airport (BDL), Windsor Locks, Connecticut. The commercial pilot, airline transport pilot, and five passengers were fatally injured; the crew chief/flight engineer and four passengers were seriously injured; and one passenger and one person on the ground sustained minor injuries. The airplane was operated by the Collings Foundation as a Title 14 Code of Federal Regulations (CFR) Part 91 local commercial sightseeing flight.

The accident airplane, shown in figure 1, was a vintage, former US military bomber that was on a tour that allowed members of the public to purchase an excursion aboard the airplane for a living history flight experience (LHFE). After the passengers boarded the airplane, they were seated by the crew chief/flight engineer (referred to as the loadmaster). The 20- to 25minute flight included a planned in-flight walking tour of the airplane.

Source: Ms. Macey Lorden

Figure 1. Accident airplane

On the morning of the accident flight, a lineman at BDL assisted the loadmaster as he added 160 gallons of 100 lowlead aviation fuel to the accident airplane. The loadmaster stated, during a postaccident interview, that the pilot had difficulty starting the Nos. 3 and 4 engines (both of which were on the right wing of the airplane) because of moisture in the magnetos due to rain the day before. (A magneto is an electrical generator that uses a rotating magnet to produce high-voltage electricity that is distributed to the spark plugs). The loadmaster, who held a mechanic certificate with airframe and powerplant ratings, dried the magnetos by blowing compressed nitrogen into them, after which the engines started normally. Before takeoff, the pilot performed a magneto check at an engine speed of 1,700 rpm, and the loadmaster reported that everything seemed normal.

The accident flight was the airplane’s first flight of the day. The flight departed from runway 6 about 0947. During the initial climb, one of the pilots retracted the landing gear, and the loadmaster, who had been standing between the pilot and copilot in the cockpit, moved into the cabin to tell the passengers that they could leave their seats and walk through the airplane.

According to a transcript of radio communications between air traffic controllers and the pilots, at 0949:19, one of the pilots stated, “we would like to return to the field.” Automatic dependent surveillance-broadcast (ADS-B) data showed that, at the time, the airplane was about 600 ft above ground level (agl) on the right crosswind leg of the airport traffic pattern for runway 6. The approach controller asked the pilot if he required any assistance, to which the pilot replied “negative.” The controller then asked why the airplane would be returning to the airport, and the pilot replied that the airplane had a “rough mag[neto]” on the No. 4 engine.

During a postaccident interview, the loadmaster stated that, when he returned to the cockpit, he realized that the airplane was no longer climbing and that the pilot, realizing the same, instructed the copilot to extend the landing gear, which he did. The loadmaster also stated that he left the cockpit to instruct the passengers to return to their seats and fasten their seat belts. According to the loadmaster, after returning to the cockpit, the pilot indicated that the No. 4 engine was losing power and that he wanted to shut down that engine. (The loadmaster looked at the rpm gauge and confirmed that the No. 4 engine was losing power.) The pilot then shut down the No. 4 engine without any further coordination or discussion.

At 0949:42, the controller instructed the pilot to fly a right downwind leg for runway 6 and asked whether the airplane needed an immediate landing. One of the pilots responded that he wanted the airplane “to be on the ground as soon as possible.” The controller subsequently canceled another airplane’s approach to the airport and advised the pilot to “proceed however necessary” to runway 6.

At 0950:50, the approach controller instructed the pilot to contact the tower (local) controller, and the pilot acknowledged the instruction. After the pilot established contact, the tower controller reported that the wind was calm and that the airplane was cleared to land on runway 6. According to ADS-B data, starting about 0951:00, the airplane’s airspeed was at or below 100 mph. At 0951:08, the pilot acknowledged the landing clearance; ADS-B data indicated that the airplane was at an altitude of about 400 ft agl on a midfield right downwind leg for runway 6 at that time. Witness video confirmed the loadmaster’s report that the airplane’s landing gear had been extended by the time the airplane had entered the downwind leg of the airport traffic pattern (about 2.7 nautical miles in the traffic pattern from the runway 6 threshold).

At 0951:28, the tower controller asked about the airplane’s progress to the runway; 6 seconds later, one of the pilots replied, “we’ll get there midfield downwind now.” No further communications were received from the airplane.

The airplane was descending through an altitude of 300 ft as it turned onto the base leg of the traffic pattern for runway 6. The airplane then turned onto final approach at an altitude of 150 ft; at that time, the airplane was about 0.4 nautical mile from the runway threshold. Figure 2 depicts the airplane’s ADS-B-derived flightpath overlaid onto aerial imagery of the airport and surrounding area along with relevant voice radio transmissions between air traffic control (ATC) and the airplane.

Figure 2. ADS-B-derived flightpath and select voice radio transmissions

Note: The public docket for this accident contains the full ATC transcript. The crash location is shown in figure 4.

Witness statements and video indicated that the airplane struck the runway 6 approach lights in a rightwing-down attitude about 1,000 ft before the runway. The airplane contacted the ground about 500 ft before reaching runway 6. The engine noise increased, and the airplane accelerated as it veered to the right of the runway. The airplane then collided with vehicles and a deicing fluid tank before coming to rest upright about 940 ft to the right of the runway 6 centerline and oriented to the east. A postcrash fire ensued.

The pilot held a commercial pilot certificate with ratings that included airplane multiengine land as well as a type rating for the Boeing B-17. He also held a mechanic certificate with airframe and powerplant ratings. The pilot’s logbook was not recovered. The operator reported that the pilot had 7,300 hours of flight experience in the B-17G and that he completed his annual proficiency check in the airplane on February 26, 2019. The pilot was the director of maintenance for the Collings Foundation, which was a paid position. (The pilot flew the B-17G as a volunteer.)

The copilot held an airline transport pilot certificate with ratings that included airplane multiengine land as well as five type ratings for transport-category airplanes. He did not hold a type rating for the Boeing B-17 and was not required to hold that rating as a copilot. The copilot’s logbook was not recovered. The operator reported that the copilot had 23 hours of flight experience in the B17G and that he completed his annual proficiency check in the airplane on February 24, 2019.

The Federal Aviation Administration (FAA) issued a limited airworthiness certificate for the airplane in 1994, and most of the passenger seats were installed in 1995. According to operator and maintenance records, the airplane had 15 seats in the following configuration (forward to aft):

2 original-equipment seats in the lower nose area, which were not used for passengers;

2 original-equipment pilot seats on the flight deck (above the lower nose area);

2 aft-facing floor seats mounted to the structure behind the pilot seats;

3 seats in the radio room (2 side-facing seats on the floor and 1 swivel-style originalequipment radio operator seat);

1 aft-facing seat on the left-side bulkhead panel near the ball turret, which the operator reported was not used for passengers but was available to the loadmaster; and

5 side-facing seats on the floor in the waist gunner area (3 right-side seats and 2 left-side seats).

The passenger seats that were not original equipment were installed in the airplane according to an engineering document that conformed with the structural requirements of Civil Aviation Regulation 4b. Some of the seats consisted of a 5/8-inch-thick plywood seatback attached to the airframe with aluminum angles and brackets, as shown in figure 3. The other seats were secured directly to the structure on an airplane sidewall or bulkhead. All of the passenger seats included a seatback cushion secured with hook and loop fasteners and a seat bottom cushion secured to a floor panel. The passenger seats were equipped with a two-point military/aerobatic-style lap belt affixed to either the seat or structural areas on or near the floor.

Source: The Collings Foundation.

Figure 3. Accident airplane interior (forward looking aft)

The pilot and copilot seats were equipped with a four-point restraint—a two-point military/aerobatic-style lap belt and shoulder harnesses—but the loadmaster reported that the pilots did not use the shoulder harnesses. The loadmaster also reported that he did not have a dedicated seat (and thus no available restraint) and that he would “stand in between the copilot and the pilot” during flights.

The airplane was on tour each year for 10 months, and the pilot was responsible for performing the airplane’s maintenance during that time. (As previously stated, the pilot held a mechanic certificate and was the Collings Foundation’s director of maintenance.) The airplane’s continuous airworthiness inspection program included four 25-hour progressive inspections. Each of these inspections included one of the engines and its propeller. The inspected engine items included a check of the spark plugs, during which they were either cleaned, inspected, and tested or replaced with new plugs; a check of the gap between the spark plug electrodes; and a check of the point gap and timing for both engine magnetos.

The airplane’s most recent 25-hour inspection was performed on September 23, 2019, and included an examination of the No. 4 engine and propeller and the landing gear. The most recent 25-hour inspection of the No. 3 engine and propeller was performed on September 7, 2019. The pilot endorsed the work performed during these and other 25-hour inspections.

American Aero Services, a maintenance facility in New Smyrna Beach, Florida, performed annual inspections (which were not required according to the continuous airworthiness inspection program) when the airplane was not on tour. Review of maintenance records revealed that the most recent annual inspection was completed on January 16, 2019. At that time, the airframe had accumulated a total of about 11,121 hours. Between the time of the annual inspection and the most recent 25-hour inspection, the airplane had accumulated about 267 hours.

Each of the airplane’s four nine-cylinder supercharged radial engines was equipped with a threeblade, constantspeed propeller. Engine No. 1 (outboard on the left wing) was installed on February 21, 2019, and, as of September 23, 2019, had accumulated 250 hours since its overhaul on January 8, 2019. Engine No. 2 (inboard on the left wing) was installed on January 16, 2019, and had accumulated about 267 hours since its overhaul on December 10, 2018. Engine No. 3 (inboard on the right wing) was installed on September 15, 2018, and had accumulated about 291 hours since its overhaul on January 15, 2018. Engine No. 4 (outboard on the right wing) was installed on January 15, 2016, and had accumulated about 1,106 hours since its overhaul on May 13, 2015.

Review of the Engine and Accessories Ground Test checklist in the Pilot’s Manual for Boeing B17 Flying Fortress revealed instructions to test the magnetos at an engine speed between 1,900 and 2,000 rpm and noted that the rpm drop should not exceed 100 rpm when switching from one magneto to the other (for each engine). The Collings Foundation engine run-up and ignition checklist indicated that the magnetos were to be checked at an engine speed of 1,600 rpm. The B17 Field Service Manual stated that the presence of moisture in the magnetos should be removed with a cloth and solvent. The manual did not contain any checklist or approved procedure for using compressed nitrogen to dry moisture in the magnetos, but, according to the Collings Foundation, that was an accepted practice within the vintage warbird community.

No stall speeds were published in the B-17 pilot’s manual for the accident airplane model. Review of a B-17 performance chart from the Experimental Aircraft Association’s (EAA) flight training manual revealed that, at 45,000 pounds and with the flaps and landing gear up, the stall speed was about 95 mph. (The EAA’s manual did not contain B-17 performance information for the airplane in the flaps-up and landing geardown accident configuration).

BDL has three paved runway surfaces designated 6/24 (9,510 ft long), 15/33 (6,847 ft long), and 1/19 (4,269 ft long). At the time of the accident, a notice to airmen indicated that runway 15/33 was closed except for taxi operations.

The approach lighting system for runway 6 is 2,400 ft long. The lights are spaced at 100-ft intervals from the runway 6 threshold.

Figure 4 is an overhead image that shows the runway 6 approach area, the areas of impact damage to the instrument landing system (ILS) lighting equipment, and the location of witness marks from the airplane’s main landing gear (MLG) and right wing. The figure also shows the airplane’s final resting position about 940 ft to the right of the runway 6 centerline. Most of the cabin, cockpit, and right wing were consumed by a postcrash fire, as shown in figure 5.

Figure 4. Overhead image depicting the airplane’s path to final impact

Figure 5. Airplane wreckage

Measurement of the left- and right-wing flap jackscrews corresponded to the retracted flap setting. The left-wing flap and aileron remained attached to the wing, and a section of the flap was consumed by the postcrash fire. The right-wing flap remained attached to the wing; the aileron was consumed by the postcrash fire. The empennage, elevator, and rudder remained intact.

Control continuity was established for the elevator, rudder, and their trim tabs from each control surface to the respective cockpit controls (except for the area in the cabin that was consumed by the postcrash fire). The elevator trim and rudder trim cables were pulled by impact forces, so their preimpact position on the drum at their respective control surfaces could not be determined. The left-wing aileron trim tab remained intact, and its pushrod was connected but bent. The left aileron bellcrank separated from the wing, but the aileron cables remained attached to the bellcrank and in the cockpit. Examination of the airframe revealed no evidence of preimpact mechanical malfunctions.

The Nos. 1 and 2 engines remained partially attached to the left wing, and the propeller blades remained attached to each engine. One of the propeller blades attached to the No. 1 engine exhibited an 8-inch tip separation; the separated section traveled about 700 ft before coming to rest in an airport building. Another propeller blade on the No. 1 engine exhibited chordwise scratching and leading-edge gouging. The other propeller blade on the No. 1 engine was bent aft. All of the propeller blades on the No. 2 engine exhibited leading-edge gouges and chordwise scratches.

The No. 3 engine had separated from the right wing and was recovered on top of the airport’s deicing fluid tank, which was adjacent to the main wreckage. All of the propeller blades were attached. One of the propeller blades exhibited a 5-inch tip separation, and the separated tip section had fragmented and was recovered from two locations that were 100 and 700 ft from the main wreckage.

Teardown examination of the No. 3 engine revealed that the Nos. 2, 4, 5, and 8 cylinder piston heads exhibited areas of dark gray and white coloration that were consistent with detonation rather than normal combustion, with the No. 4 cylinder exhibiting the most evidence of detonation. (Detonation in a piston engine occurs when the fuel-air mixture in the cylinder detonates or explodes prematurely instead of being ignited by spark plugs and burning evenly and smoothly, as occurs with normal combustion. Detonation can cause rough engine operation and a loss of power and, if unaddressed, can progress to catastrophic engine failure.) Most of the spark plugs on the No. 3 engine were worn with gaps between the electrodes that were beyond the manufacturer’s specifications. Teardown examination of the No. 3 propeller showed that its internal components displayed signatures consistent with it being in the lowpitch position at the time of impact.

A fuel sample recovered from one of the No. 3 engine’s two fuel tanks had a visual appearance and smell consistent with 100 low-lead aviation fuel. The sample showed no evidence of debris or water contamination. Examination of the fuel truck used to service the airplane revealed no equipment or fuel supply anomalies.

The No. 4 engine had separated from the right wing and was recovered partially embedded in an airport building. All of the propeller blades were attached. Teardown examination of the No. 4 propeller showed that its internal components displayed signatures consistent with it being in the feathered position at the time of impact.

Teardown examination of the No. 4 engine revealed no evidence of abnormal combustion or detonation on the cylinders or pistons. The left magneto’s P-lead (the electrical connection between a magneto and the cockpit ignition switches) was partially pulled out of the magneto housing, and the grounding tab was in contact with the housing. Figure 6 shows a generic radial engine ignition system (similar to the one on the accident airplane) and the location of the left and right magnetos (for informational purposes only.) A single strand of safety wire was observed around the retaining nut. A functional test of the magneto showed that the contact between the grounding tab and the housing resulted in the magneto being shorted to ground and unable to function. When a piece of cardboard was placed between the grounding tab and the housing, the ignition leads for all nine cylinders produced a strong spark when the drive spline was rotated.

Source: Aviation Maintenance Technician Handbook–Powerplant Volume 1 (FAA-H-8083-32A).

Figure 6. Radial engine ignition system.

The right magneto’s P-lead was partially engaged in its fitting, and the grounding tab did not contact the magneto housing. The right magneto’s gap between the points was 0.004 inch, which was less than the minimum gap (0.008 to 0.010 inch) that the manufacturer required. When the magneto was tested, the ignition leads for the No. 8 cylinder did not spark; the ignition leads for the other eight cylinders produced sparks that were weak and intermittent. In addition, the right magneto’s compensator cam and associated cam follower were worn.

Ten personal electronic devices were found in the wreckage and were forwarded to the National Transportation Safety Board’s (NTSB) Vehicle Recorders Laboratory in Washington, DC. No data were recovered from eight of the devices due to extensive heat damage. Video recorded before the accident flight was recovered from the other two devices; no in-flight video was recovered.

The Office of the Chief Medical Examiner of the State of Connecticut, Farmington, Connecticut, performed autopsies on the pilot, copilot, and five passengers who died. The cause of death for the pilot was smoke inhalation and thermal injury. The cause of death for the copilot was smoke inhalation, thermal injury, and blunt trauma of the trunk. The cause of death for the five passengers was blunt impact injury and/or thermal injury and smoke inhalation.

Toxicology testing was performed at the FAA Forensic Sciences Laboratory. The pilot’s testing identified elevated blood carboxyhemoglobin as well as atenolol and amlodipine in his blood and urine specimens. The copilot’s testing identified elevated blood carboxyhemoglobin.

Carboxyhemoglobin is formed when carbon monoxide binds to hemoglobin in blood, impairing the blood’s ability to deliver oxygen to body tissues. Carbon monoxide exposure usually occurs by inhalation of smoke or exhaust fumes. Atenolol and amlodipine are prescription medications commonly used to treat high blood pressure and are generally considered not impairing.

The loadmaster stated that he provided a passenger briefing before every flight, which included information regarding seating locations, seat belt use, emergency exits, and prohibitions about touching flight control cables and distracting the flight crew (including taking photographs with the crew). The loadmaster also stated that he instructed passengers to be seated during taxi, takeoff, and landing and, when it was safe to move about the airplane, to limit the number of people in the nose area to two people at a time. The loadmaster indicated that he did not specifically show the passengers how to fasten their seat belts because that was “self-explanatory.”

Multiple surviving passengers reported that the loadmaster’s briefing covered tour and logistical topics but did not include information about the seat belts, exits, or emergency equipment. According to one of the passengers, the loadmaster reminded the passengers to buckle their seat belts and indicated that the passengers should not be concerned if the seat belts were loose.

After the accident, a passenger who was seated in the rear of the airplane opened the aft right door and exited the airplane with two other passengers. The loadmaster and the two passengers who sat behind the pilot and copilot seats exited the airplane by climbing out of the upper turret located above and behind the pilot seat.

Eleven of the 13 airplane occupants received serious burn injuries. Two of the passengers who evacuated quickly from the aft right door avoided burn injuries (but received other injuries).

The NTSB’s aircraft performance study found that the extension of the landing gear at an altitude of about 400 ft agl (before the airplane was on a midfield right downwind leg for runway 6) would have steepened the descent angle at a given engine power setting and increased the power required to maintain level flight. The study also found that, during the airplane’s return to the airport from about 0951 to 0953, the airplane’s airspeed was 100 mph or below, which was less than the calculated airspeed necessary to achieve the shallowest descent angle—about 120 mph. (The shallowest descent angle minimizes the altitude lost for a given horizontal distance flown.)

According to the study, if the airplane had been flown at an airspeed that was closer to 120 mph, and with the landing gear retracted until the final approach, the airplane would likely have been at an altitude that would have allowed it to overfly the approach lights and touch down beyond the runway threshold. The study further found that, if the Nos. 1 and 2 engines had been operating at full takeoff power, the airplane should have had enough thrust to maintain level flight and approach the runway along a normal glidepath rather than land short into the approach lights. However, given the available evidence, the study was unable to determine whether the airplane would have had enough rudder authority to counteract the asymmetric thrust resulting from the Nos. 1 and 2 engines operating at full takeoff power, an unknown level of thrust from the No. 3 engine, and no thrust from the No. 4 engine.

In its October 5, 2020, submission to the NTSB as a party to this investigation, the Collings Foundation provided its assessment of the airplane’s performance with one or two inoperative engines. (The Collings Foundation became a party to this investigation on February 26, 2020.) The submission stated that “the general consensus in the B-17 community is that for one outboard engine out, 135 mph is a satisfactory speed for some climb performance, and a speed of 145-155 mph is needed for two failed engines on one wing.” The submission also stated that, during annual ground school training, the Collings Foundation taught its pilots that the B-17 “critical airspeed is 115 - 125 mph. Below this speed the aircraft will not sustain flight - 145 [mph] ideal” and “the airplane will not accelerate on two engines below critical airspeed, regardless of power, it is only possible through lowering the nose.”

Operator Information

According to its website, the Collings Foundation is a nonprofit, educational foundation that began in 1979 and is headquartered in Stow, Massachusetts. The purpose of the foundation is “to organize and support ‘living history’ events and the presentation of historical artifacts and content that enable Americans to learn more about their heritage through direct participation” (www.collingsfoundation.org/, accessed March 24, 2021). During the mid-1980s, these activities were broadened to include aviation-related events. At the time of the accident, the Collings Foundation operated 10 aircraft, including the B-17G and a Consolidated B-24 (another former US military bomber airplane).

Living History Flight Experience Exemption

An LHFE exemption provides operators with relief from certain FAA regulations, allowing exemption holders to carry passengers for compensation or hire in historically significant aircraft that were formerly operated in US military service. These aircraft have been issued either a limited or an experimental airworthiness certificate. According to the FAA, as of February 25, 2021, 20 operators held LHFE exemptions. These exemption holders operated a fleet of 87 aircraft that ranged from small single-engine aircraft to large four-engine aircraft. Some exemption holders operated 1 aircraft each, and the exemption holder with the largest fleet operated 23 aircraft.

The Collings Foundation had conducted LHFE flights since 1996 under exemption No. 6540P, which exempted the foundation’s operations from the requirements of the following Federal Aviation Regulations:

91.9, which prescribed flight manual, marking, and placard requirements;

91.315, which prohibited carrying persons for compensation or hire in limited-category aircraft;

91.319(a), which prohibited carrying persons for compensation or hire in experimentalcategory aircraft;

119.5(g), which prescribed the need for a commercial operator certificate and operating specifications; and

119.21(a), which prescribed certification and operations specifications requirements for intrastate common carriage operations.

About every 2 years, the Collings Foundation was required to petition the FAA to extend the foundation’s LHFE exemption. In a September 11, 2017, letter, the Collings Foundation petitioned the FAA to extend the LHFE exemption. The FAA’s March 22, 2018, response letter extended the exemption until March 31, 2020 (unless superseded or rescinded). All of the aircraft in the Collings Foundation’s fleet at that time were covered by the exemption. According to the FAA’s letter, the petition noted that the Collings Foundation met the criteria specified in the FAA’s LHFE policy (80 Federal Register 43012, July 21, 2015). The FAA’s exemption letter also noted that the Collings Foundation was required to maintain and provide the FAA with certain manuals and documents, including at least the following: the company’s general operations manual, pilot qualifications and training manual, general maintenance manual, safety management system (SMS) manual, and approved inspection program.

On August 22, 2019, the Collings Foundation again petitioned the FAA to extend the foundation’s LHFE exemption. (The accident occurred while the FAA was reviewing the exemption extension request.) On March 25, 2020, the FAA issued a “Rescission of Existing Exemptions and Denial of Petition to Extend Exemption.” The rescission letter stated the FAA found that the Collings Foundation was not “operating in compliance with the conditions and limitations of the 6540P exemption” and that the exemption was “rescinded in full, effective immediately.” The rescission letter also stated the following:

A grant of the exemption is not in the public interest because it would adversely affect the safety of Collings Foundation’s US-registered aircraft, the FAAcertificated airmen that would be participating in the operations, the passengers on board the aircraft, and others involved in or affected by the operations.

Safety Management System

The FAA’s March 2018 letter granting the extension of the Collings Foundation’s exemption stated the following as a condition for the exemption:

Collings must maintain and apply on a continuous basis its safety and risk management program that meets or exceeds the criteria specified in the FAA Policy for all operations subject to this exemption. This includes, at a minimum, the Collings SMS Manual, used as a basis for an equivalent level of safety.

The FAA’s policy regarding LHFE exemptions stated that each operator should be guided by criteria including “an understanding and use of Safety Risk Management…principles” and “a plan to mitigate risks as they become known, or to correct an unsafe condition or practice.” The policy further stated that such risks included, but were not limited to, those involving maintenance and operations.

The Collings Foundation implemented an SMS in May 2017 and issued an SMS manual in September 2017. The SMS manual stated, in the “Background” section, “this is not a regulatory or approved document.”

The Collings Foundation’s SMS safety officer was responsible for managing the foundation’s SMS. The SMS safety officer was a part-time, volunteer pilot for the Collings Foundation and, as such, interacted with the foundation’s management and personnel on a sporadic basis. The SMS manual stated, “if a hazard is recognized the observer shall complete a Wings of Freedom Safety report through [the foundation’s] anonymous Online system or directly submit it to the Safety Officer.” (Wings of Freedom was the name of the airplane’s tour.) The Collings Foundation pilots who were interviewed after the accident indicated that, although they discussed safety issues that arose with the chief pilot, they did not submit safety reports about these issues to the safety officer or SMS.

According to the SMS safety officer, between May 2017 and January 29, 2020 (the date of the postaccident interview with the safety officer), 33 safety reports from foundation personnel had been received. The safety officer did not recall any trends and indicated that some of the reports addressed maintenance issues, birdstrikes, and spectators on the ground. The safety officer stated that the reports were reviewed before each year’s ground school training to determine if any changes to the training were warranted. The safety officer further stated that, for the January 2019 ground school training, presentation slides included examples of the safety reporting form, the link to the safety reporting form, and pages from the SMS manual. The ground school training for January 2020 was not developed at the time of the accident but included slides to encourage pilots to submit safety reports.

According to the Collings Foundation party submission for this accident, 2 of the 33 safety reports submitted to the SMS pertained to the B17G. Those reports addressed passengers moving during taxi operations for a May 2017 flight and a cowling panel that separated from the airplane during a May 2018 flight. The Collings Foundation indicated that these issues, as well as the issues raised in the other 31 reports, were “addressed promptly,” but the specific actions taken in response were not mentioned.

Federal Aviation Administration Oversight

The 6540P exemption letter specified that the FAA’s flight standards district office (FSDO) in Orlando, Florida, was responsible for oversight of the Collings Foundation’s operations involving reciprocating engine-equipped aircraft. An aviation safety inspector was assigned to the operator as a point of contact only. The point of contact was responsible for answering regulatory questions and did not conduct ramp inspections (surveillance of a pilot, an operator, or an aircraft during operations at an airport) or en route surveillance. (The FAA was not required to perform comprehensive oversight of Part 91 operations, including LHFE operations.)

The point of contact died in 2017 and was not replaced by the FSDO. The Collings Foundation then sent regulatory questions via e-mail to another FSDO inspector (who was not assigned as the point of contact); this inspector advised the company to send questions or concerns to the Orlando FSDO’s general e-mail address. According to the Collings Foundation’s chief pilot, after several messages were not answered, foundation staff members stopped sending messages.

According to the Orlando FSDO office manager, after the accident, two people were assigned to be the points of contact for the Collings Foundation certificate, and they were intended to provide oversight for the foundation’s operations as the principal maintenance inspector and the principal operations inspector. The office manager stated that the FSDO had also provided surveillance in various cities after the accident to ensure that the Collings Foundation “was doing static display only with the B-24.”

The FAA issued Notice N 8900.568 with an effective date of November 3, 2020. The purpose of the notice was to provide FSDO inspectors with increased oversight procedures for LHFE operators. The notice indicated that the B-17 accident “revealed the need to bolster surveillance and oversight of LHFE exemption holders.” The notice instructed inspectors to perform an audit of all LHFE operators within their FSDO’s jurisdiction by the end of calendar year 2021 to “ensure compliance with regulations, the C/Ls [conditions and limitations] of the exemptions, and manual systems, utilizing FAA Order 8900.1, Volume 6, Chapter 1, Section 8, Inspect a Living History Flight Experience Exemption Holder.” According to the FAA, the information in this notice will be incorporated into Order 8900.1 before November 3, 2021, the expiration date of the notice, and the inspection will be added to the next revision of FAA Order 1800.56, National Flight Standards Work Program Guidelines, as an annual requirement.

Title 14 CFR 5.5 defines an SMS as “the formal, top-down, organization-wide approach to managing safety risk and assuring the effectiveness of safety risk controls. It includes systematic procedures, practices, and policies for the management of safety risk.” The regulation defines safety risk management as “a process within the SMS composed of describing the system, identifying the hazards, and analyzing, assessing and controlling risk.” As previously stated, the Collings Foundation was required to have a “safety and risk management program.”

Title 14 CFR 91.107 states that each person aboard a USregistered civil aircraft “must occupy an approved seat or berth with a safety belt and, if installed, shoulder harness, properly secured about him or her during movement on the surface, takeoff, and landing.” As previously stated, during flights aboard the accident airplane, the pilots did not use the shoulder harnesses, and the loadmaster was not restrained in a seat.