“Departure,” the pilot of the 1944 vintage B-17 bomber radioed to the air traffic controller now in charge of the flight, “N3012 is with you, stand by one, please.”
A few words can tell us a lot. It was clear that right after takeoff, the pilots were working a problem. N93012, known as “Nine-O-Nine,” was a historic Boeing B-17 World War II-era bomber starting a historic experience flight for paying passengers. Six minutes after that transmission, the aircraft would crash while the pilot attempted to bring it back to the airport. Most of the airframe was destroyed by impact forces and fire. Six people got out alive. Seven others, including the two pilots, died.
This was two years ago. Online there was a lot of immediate—and sometimes uninformed —speculation. In April, the National Transportation Safety Board (NTSB) issued its final report. Drawing from survivor accounts, video recordings, ADS-B data, engineering simulations and traditional wreckage analysis, it describes what happened in detail. I’ve reviewed the docket, climbed through B-17s, and discussed the accident with B-17 instructors, mechanics and loadmasters. There was a lot to be learned.
In all, 12,731 B-17s were built during the years 1935 to 1945. This massive fleet dropped more bombs during World War II than any other U.S. plane. With four big radial engines, a wingspan over 100 feet, a top speed of 287 mph, a 2,000-mile range with a 6,000-pound bombload, and bristling with guns, it was a battleship of the sky. In time and technology, it’s halfway between the Wright Flyer and the Lunar Lander. It was soon eclipsed, however, and many thousands of existing B-17s were relegated over the next several years to non-battle duty and aircraft boneyards.
Eighty years later, a few of them are still flying. On the morning of Wednesday, Oct. 2, 2019, at the Bradley International Airport (KBDL) in Windsor Locks, Connecticut, that number decreased from 10 to nine.
Weather certainly wasn’t a problem. At 9:51 a.m., the official KBDL observation was 73° Fahrenheit, with calm winds, few clouds at 11,000 feet, and ceiling broken at 18,000 feet. No obscuration, no precipitation.
Pilot experience wasn’t a problem, either. The 75-year-old aircraft commander had 20 years of flying the B-17. In fact, his over 7,000 B-17 hours were touted as more time in the Fortress than any other pilot ever. His 23-year-old chief pilot described him as “masterful in the airplane!he lived in that thing; cleaned it, worked on it, flew it. I can’t think of any negative aspect of his flying performance.” An experienced warbird examiner described his last yearly check ride as “very routine. [He] was a master in that airplane!he didn’t fly, he wore that airplane. I’ve never seen anybody that could fly and be as smooth and knowledgeable about an airplane.” In the right seat was a former USAF pilot and retired airline captain with about 22,000 total flight hours and multiple type ratings.
Ten passengers paid $450 each for a 25-minute ride in the 1944 B-17G on a national “Wings of Freedom” tour. Serial number 44-83575 was built too late to see combat and after the war was converted to an SB-17G variant, flying search and rescue missions in Puerto Rico. It ended its military service in the Nevada desert, subjected to nuclear weapons testing. After 13 years, enough time, they said, to allow the radiation to subside, the airframe was decommissioned. In civilian hands, it was restored as a bomber, a water and borate bomber. For two decades, it fought forest fires.
In 1986, the airframe was bought by the nonprofit The Collings Foundation and restored to a war-time configuration, complete with (non-functional) gun turrets. It was painted in the colors of the 323rd Bomb Squadron, becoming what’s referred to as a tribute ship for a war-time B-17G, serial number 42-31909. Those last three numbers, Nine-O-Nine, explain its nickname. That aircraft did fly in the war, completing an Eighth Air Force record of 140 combat missions without an abort or loss to the crews that flew it. After the war, after 21 engine changes, four wing-panel changes and 600 patched bullet holes, crews at a scrapping yard in Kingman, Arizona, did what the Luftwaffe never could, destroying the stately big bomber.
The Collings loadmaster/flight engineer/mechanic arrived on the ramp at 8:15 a.m. to start preparing the aircraft. He added oil and checked the maintenance logs. Passengers arrived around 8:30 a.m., signing liability releases in the FBO. The loadmaster helped a fueler with adding 160 gallons of 100LL, bringing the total gas onboard to 800 gallons, enough for both the planned morning and afternoon flights. There was a lot of eager anticipation. Friends and relatives recorded videos. Everybody walked out, loaded up, and waited for the four 1,200-horsepower Curtiss-Wright Cyclone R-1820 nine-cylinder engines to breathe life into the old plane.
Because the engine-numbering methodology is important to understand the accident, let’s review. The engines are numbered from left to right, from the pilot’s perspective, with the No. 1 engine being the one farthest from the left. The No. 2 engine is the other engine on the left, closer to the fuselage. The engines on the right wing, again, progressing from left to right, are Nos. 3 and 4, respectively.
The first engine to be started, No. 3, inboard right wing, proved problematic. It’s typically started first so that you can use its generator to start the other engines. The starter turned the prop just fine, but the engine wouldn’t run. The flight engineer got out, opened up the cowling and used pressurized nitrogen gas to dry some early-morning condensation from the magnetos.
No. 3 started successfully. At that point, a start of outboard right engine No. 4 was attempted, but it, too, would not run on the first attempt. So, No. 3 was shut down, and the same drying process was repeated for engine 4. At times, the pilot got out of the aircraft and directed actions. At times there was shouting. Eventually, engine 3 was started again and was followed by good starts of engines 4, 2 and 1.
After the oil warmed up, the flight engineer said there were engine and propeller system checks. All engines were run up and the magnetos checked. He remembered that “everything was perfect, I mean, we had no drop, we had no backfire. We had nothing. I mean, there was no reason not to fly.”
At 9:34 a.m., N93012 called Bradley clearance delivery for a 20-minute local VFR flight to the east, no further than 20 miles, 2,000 feet or below. While the pilots had their lap belts on, the flight engineer/loadmaster was unstrapped, sometimes standing between the two pilots and sometimes walking around in the back of the plane. He had no assigned actual seat.
The pilots contacted the Bradley International ground controller at 9:38, requesting takeoff from runway 6 at its intersection with runway 33. The full length of runway 6 is 9,509 feet, and from that intersection, there’s still almost 6,000 feet usable, well more than enough for a B-17, and the shortcut halved their taxi distance. Still, they had to wait for possible wake-turbulence from departing jet traffic to pass, but soon enough, at 9:46, Bradley Tower transmitted, “N93012, wind light and variable at three, turn right heading 095, Runway 6 at Runway 33, cleared for takeoff.”
The ground roll and initial climb appeared normal, and the flight crew started the right turn and was handed over to departure.
As soon as the landing gear had been retracted, airspeed at 124 mph, the flight engineer/loadmaster took off his headset, tapped the shoulders of two passengers to let them know they could go down into the nose, and went back through the plane to let everybody else know they could unstrap, walk around and look out.
One surviving passenger said he could hear an engine running rough.
A few seconds after telling the departure radar controller to standby, the pilots informed ATC, “Boeing 93012, we would like to return to the field.”
“N93012, sorry, say again.”
“Yeah, we are returning to the field immediately.”
“N93012, do you need any assistance?”
“Negative.”
“And what’s the reason for coming back?”
“We have a rough mag on No. 4 engine, we would like to return for it out.”
The plane’s airspeed was down to 110 mph on a right diagonal flight path at 675 feet AGL, the highest altitude of the flight.
There was, indeed, an engine problem. The right outboard, No. 4 engine, was losing power. The flight engineer saw the RPM falling. The pilot said he “wanted to cage it.” The flight engineer wasn’t ready to shut it down yet.
Regardless, the pilot unilaterally reached over and shut down the No. 4 engine. He then feathered the propellor. He didn’t coordinate or verify these actions with the co-pilot. The flight engineer/loadmaster went back into the aircraft to tell the passengers to sit down and strap in.
“Not yet lined up with the runway, N93012 crashed into the approach lights 1,000 feet short of the runway, then turned hard right.“
ATC cleared the flight onto the downwind leg for the northeast-facing Runway 6, a leg that is usually flown at nearly twice the altitude that the B-17 was then flying at, and requested confirmation that the crew wanted an immediate landing.
“When you get a chance, yeah.” The plane banked to enter right downwind on the 45-degree line, slowly losing altitude the whole time. The controller, who was also working inbound jet traffic, asked if they needed to be on the ground right now. The reply was, “I kinda would like to be on the ground as soon as possible.” The controller canceled the jet’s approach clearance and said, “N012, you can progress however necessary for Runway 6.” On the landline, he informed Bradley tower the B-17 was having a mag issue, coming back to the field, no emergency—it just needs to get on the ground.
Now the plane was joining downwind, flying parallel and backward to the runway, the standard procedure, before the base-leg turnaround to the runway. At the downwind point, however, the plane was only at about 475 feet AGL and still descending.
And there was another problem. The No. 3 engine, the other right side powerplant, was not producing enough power. The plane was slower than it should have been, too, its airspeed below 100 mph. Around this time, the pilots lowered the landing gear.
Bradley tower cleared the flight to land on Runway 6 and advised that the wind was calm. The crew acknowledged the landing clearance. Twenty seconds later, the tower asked, “N93012, uh, ahh, how’s your progress for Runway 6?” At that point, investigators determined, the plane was at 375 feet AGL. Almost stepping on each other, there are two transmissions. What sounds like the PIC says, “We’ll get there.” A second voice, most likely the co-pilot’s, chimes in with, “midfield downwind now.” Those were the crew’s final transmissions.
Continuing to descend, the Nine-O-Nine turned a base leg at 200 feet above the ground and far slower than is normal or safe. Its turn toward the runway was, again, low and too tight, but it looked as though they might just make it.
They didn’t. Not yet lined up with the runway, N93012 crashed into the approach lights 1,000 feet short of the runway, then turned hard right. Impact forces on the right wing, and power from engines 1 and 2 on the left wing, caused it to careen across the grass infield and a taxiway. It smashed hard into a huge metal tank and some storage sheds. Several passengers were thrown around inside the cabin, and the plane burst into flames. The tower controller closed the airfield and cleared all emergency ground vehicles to the crash site using any route, “the quickest way possible.”
The two pilots died in their seats. Five of the passengers died. The loadmaster and five passengers got out alive, most with serious burns, cuts and bruises.
“Backing up the accident sequence, being low and with multiple engine issues, why didn’t the plane get on the ground quicker by using another option?“
After the accident, the Safety Board survival factors group looked at why some of the occupants lived while others died. No one reason seems to have made a clear difference. The loadmaster, who wasn’t strapped in any seat, lived. The pilots, using lap belts, died. Neither pilot was using the provided shoulder harnesses. Some seatbelts failed. One passenger told the NTSB he was unfamiliar with the military-style seatbelt and was never able to close the buckle successfully. It was “missing the piece that allowed the two sides to clasp together.” Another remembers the loadmaster saying, “the belts would probably be loose but not to worry about it.”
Immediately after Nine-O-Nine came to a final stop, a fire burned fast and hot, fed by hundreds of gallons of gasoline on board. One passenger spent 78 days in the hospital recovering from burns. Only two occupants didn’t suffer burn injuries. One was a command chief master sergeant in the Air National Guard wearing his service-issue flight gloves. No one else had protective clothing. Two passengers wore shorts. A different warbird organization, the Commemorative Air Force (CAF), requires its flight crews to be outfitted in fire-protective Nomex flight suits and passengers to wear long pants and closed-toe shoes.
Why did Nine-O-Nine miss the runway and smash into buildings rather than sliding to a stop straight ahead on the runway? It’s important to understand that when the engine power to one or more engines on a multi-engine plane is interrupted, the plane’s natural tendency is to turn toward the side of the plane with reduced power.
Both of those malfunctioning engines, Nos. 3 and 4, were on the right side of the plane, so its natural tendency in the air would have been to turn to the right, toward those underpowered engines. The pilot can counteract this failed-engine effect through use of the rudder pedals, but there are limits to the ability to keep an airplane heading straight, especially when its airspeed is low, as Nine-O-Nine’s was.
The NTSB concluded, “a safer course of action would have been to retard all engines to idle and use maximum braking to stop the airplane, and/or to use differential braking and rudder to yaw the airplane back to the left and parallel to the runway while rolling to a stop.” They were too low and too slow to make a landing on the runway.
But why did the plane get so low on base? Even with No. 4 feathered and No. 3 failing, they still had two good engines. While performance-limited, the B-17G is controllable and flyable with two same-side engines out. There are data supporting this in the original flight manuals. Moreover, approaches and landings like this are practiced in B-17 training programs. But what you don’t do is lower the gear way back on midfield downwind. It’s too much added drag. NTSB performance and engineering analysis of the ADS-B data indicates, “if the landing gear had been kept retracted until the final approach, the airplane would likely have overflown the runway approach lights and touched down past the runway threshold.”
The Collings Foundation disputes this finding, claiming it takes one minute for the landing gear to extend. However, the original Field Service Manual for the B-17G states, “the motor should retract the landing gear in about 23 seconds and extend in about 20 seconds. (Replace motor unit if over 45 seconds.)” An instructor told me “his” B-17G main gear extends in 29 seconds. The Army Air Force Pilot Training Manual for the Flying Fortress is clear about the timing during two-engine landings: “Put down landing gear on base leg if the base leg is close to the field; otherwise, wait until you are close enough.”
Backing up the accident sequence again, being low and with multiple engine issues, why didn’t the plane get on the ground quicker by using another option? Look at the flight path laid over the aerial photograph. Runway 33 might have been a better choice than returning to the takeoff runway. To get back to the airport via 6,847-foot-long Runway 33 would have taken one turn to line up and land. It was closed, but the pilots knew its condition as it was the runway they taxied down before taking off. NTSB analysis found “an approach and landing on runway 33 (instead of runway 6) could likely have been accomplished more easily, at higher speeds and along a nominal glide path.”
The counterargument is that Runway 33 was temporally closed, except, that is, for taxiing. Still, in an emergency, all bets are off, and the pilots could have asked to land on Runway 33 despite its being officially closed. If the pilot had declared an emergency, he could have just announced to the controller that that was his intention.
Why didn’t the pilots declare an emergency? It seems clear that an engine failure right after takeoff in a historic WWII airplane carrying paying passengers is a prime example of an emergency situation. All the co-pilot had to do was say, “Mayday, Mayday, Mayday,” three times so there’s no doubt. It would have automatically triggered the controller to initiate the rolling of emergency services on the ground, maybe saving lives by having them already in position to fight the fire and pull people free.
Two of the NTSB’s primary areas of focus were airspeed and altitude. The B-17 still had two good engines, so why were they slowly descending? The answer is Nine-O-Nine was behind the power curve. It got too slow and stayed too slow. NTSB technical analysis found “the airplane was operating at or below 100 mph, below the airspeed for maximum g [flight path angle].” The current manual used by the EAA to fly its B-17G Aluminum Overcast states for double engine failures, “there is a critical airspeed of approximately 115-120 mph below which the airplane will not climb.”
“The NTSB found the Collings Foundation ’was not effective in identifying and mitigating safety risks.’“
Original B-17G manual AN 01-20EG-1 is very clear: “Do not try to climb or hold altitude at any speed before 120 MPH IAS. If at lower speed, dive (even when near ground) to reach 120 I.A.S. as soon as possible.” There were plausible pathways to a safe return to a normal landing on a runway. If the crew had flown straight out, pitched down to accelerate to a faster airspeed then, once at that critical airspeed, slowly climbed while maintaining airspeed discipline, they could have, the argument goes, made it back to a runway for a safe landing, even with two failed engines. So what were the engine problems?
No. 4 engine had multiple deficiencies with its magnetos. Both of the units, which supply the electrical impulses to the spark plugs, were seriously out of specification. In addition, the P-lead to both magnetos was separated, allowing a grounding tab to short out the left magneto. And leads that should have been clipped in position were held on by a single strand of loose safety wire.
No. 3 engine had pistons and spark plugs with “evidence of detonation that would have resulted in a significant loss of engine power,” the NTSB found.
Of the 18 spark plugs, all but two had a gap in excess of the manufacturer’s recommended 0.022 inches. Specks of lead found on the tips of the plugs were indictive of the fuel/air charge in the cylinders exploding rather than burning smoothly.
Engine 3 may have been running smoothly at low power settings during taxi, but there is clear evidence its performance would have been highly degraded at higher power settings.
Pilots perform engine runups before takeoff to try to catch these kinds of issues. But on this day, two factors may have intervened. The Collings checklist in Nine-O-Nine called for checking the magnetos at 1,600 rpm, while the original B-17G checklists state 1,900 to 2,000 rpm. Other operators currently check them during a runup at 2,350 rpm. These higher-power settings are more likely to reveal engine system problems. Additionally, there is testimony by some survivors that an engine runup wasn’t conducted. This is disputed by the Collings Foundation and the surviving flight engineer.
NTSB aerodynamic flight analysis is consistent with the evidence found during the physical engine teardowns. Nine-O-Nine was power limited. During the initial climb, the power delivered to the airplane was only equivalent to that of 3.5 engines at the nominal Flight Handbook climb power setting of 925 shaft horsepower per engine. With the feathering of engine 4, the power delivered dropped to the equivalent of two engines at climb power.
Losing two engines at the same time suggests a possible common cause. Sometimes that’s bad fuel or no fuel, or, in combat, it could be explained by enemy fire. The shared element here was the mechanic. The NTSB states the tolerances in the engine 3 spark plugs and engine 4 magnetos both should have been checked at the aircraft’s last 25-hour inspection, conducted nine days before the accident. All the recent work and inspections were performed on tour by the director of maintenance, who was also the pilot of the flight.
It would be easy to blame the accident on this one person. He shut down and feathered engine 4 without checklist or CRM. He failed to accelerate to critical airspeed. Investigators asked pointed questions about his checklist use. He almost never let co-pilots fly. He garnered public praise but also private grumblings. The NTSB Operational Group Chairman said, “We’ve got a lot of testimony that he was kind of crusty and ornery.” His reported flight times on FAA medical applications over the years didn’t add up, often showing implausibly large increases.
And indeed, the Safety Board’s finding of probable cause is clear. Nine-O-Nine crashed due to “the pilot’s failure to properly manage the airplane’s configuration and airspeed after he shut down the No. 4 engine following its partial loss of power during the initial climb. Contributing to the accident was the pilot/maintenance director’s inadequate maintenance.”
However, this kind of flying is not a one-person show. Above and around that pilot is a larger organizational safety structure and culture. Threat management models, manuals, checks and balances all fell short. The NTSB found the Collings Foundation “was not effective in identifying and mitigating safety risks.”
Other B-17 operators use a four-person crew, separating the flight engineer and loadmaster jobs. They don’t have passengers standing up below 1,000 feet. Their crews practice evacuations in smoke-filled cabins. They have flight department policy manuals modeled after modern airline operations. Training flights are structured events. Safety briefings for passengers and crew are mandatory. One Nine-O-Nine survivor said, “having flown many times before, I found it strange that the one time I really needed instructions on how to use a seatbelt, they were not provided.”
The Safety Board found contributing to the accident was “the Collings Foundation’s ineffective safety management system (SMS), which failed to identify and mitigate safety risks; and the Federal Aviation Administration’s inadequate oversight of the Collings Foundation’s SMS.” The FAA has since revoked the Collings Foundation’s authorization to fly passengers on warbirds.
The SMS existed on paper. But the lived reality was different. Asked in an NTSB interview if there was a safety management program, the flight engineer/loadmaster replied, “What do you mean ’safety management?'”
The investigator asked, “Do they have a safety program at all?”
To which the flight engineer/loadmaster replied, “That, I don’t know.”
