Resource Hub A failure to “mitigate foreseeable risks” proves lethal. Aviation’s approach to risk management has evolved into a two-pronged strategy: Try to identify every potential failure point and update your equipment, systems, and procedures to reduce or eliminate those hazards Devise strategies, preferably multilayered, for coping with whatever emergencies arise from the hazards that remain. The results are safety features that have become so common that they’re taken for granted, from the redundancy of essential equipment to guards protecting flight-critical switches to company procedures limiting pilot discretion in marginal weather. And the risk mitigation process is necessarily iterative: when previously overlooked hazards or rare combinations of circumstances result in accidents or emergencies, the industry responds with a fresh round of analysis, ideally leading to further improvements. Human nature and the high cost of equipment retrofits have made progress on some fronts very slow, but the long-term trend of aviation safety should arc toward the reduction of all risks not intrinsic to the act of flight itself. The March 11, 2018, ditching of a Liberty Helicopters AS350 B2 in New York’s East River drew widespread attention for several reasons, from the sequence of events that brought down the ship to the peculiarly awful manner in which all five passengers lost their lives. The accident triggered renewed scrutiny of the controversial practice of claiming exemption under 14 CFR 119.1(e)(4)(iii) to operate air tours under Part 91 without a letter of authorization through advertising them as photo flights, a practice that the National Transportation Safety Board (NTSB) for many years has urged the FAA to ban.The incomplete inflation of the AS350 B2’s emergency floats prompted a fresh look at the rigging and maintenance of those systems. Most fundamental, though—and most damning—was the failure the NTSB called out as the first contributing factor in its finding of probable cause: the two operators’ “deficient safety management, which did not adequately mitigate foreseeable risks.” The accident helicopter before the crash (passengers’ faces redacted). Note the configuration require for FlyNYON’s doors-off operation. The Operation NYONair offered low-altitude doors-off photo flights over New York landmarks under the brand name FlyNYON. As demand grew to exceed the company’s capabilities, it contracted with sightseeing tour company Liberty Helicopters Inc. to conduct additional flights using Liberty’s aircraft and pilots. To open the field of view and allow the passengers to swing their legs outside the cabin, both right doors and the front left door were removed from the helicopter, and the sliding door on the left rear side was locked open. The arrangement accommodated five passengers, one in front and four in back. To prevent passengers from falling out in flight, FlyNYON devised its own restraint system consisting of a commercial fall-protection harness of the type used by window washers or ironworkers and a tether made by a supplier of climbing gear. The tether, fabricated from multiple loops of 11 mm webbing, was secured to a D-ring on the back of the harness and to an anchor point within the cabin. Locking carabiners with screw-type threaded sleeves to secure their gates were used to connect the tethers to the various anchor points; unlocking each carabiner required multiple turns of the sleeves. To accommodate passengers of different sizes, the D-ring on the harness could be clipped to any one of the tether’s loops. The remaining length of the tether was allowed to dangle free. A pouch containing a seat-belt–cutting tool was attached to one of the harness’s upper shoulder straps. The front-seat passenger’s tether was fastened to a floor anchor located just behind that seat’s right armrest. The rear-seat passengers’ tethers were routed in a crisscross fashion, with each outboard seat secured to the outboard anchor point on the opposite side of the aircraft and the inboard tethers likewise crossed over. Notably, the anchors to which the rear-seat passengers were tethered were designed by their manufacturer for lap-belt installation only. Post-accident testing showed that unless the inboard passengers were to lean forward, they would obstruct the outboard passengers’ access to their tethers. Additionally, outboard passengers’ efforts to turn to reach their restraints would end up tightening the tethers enough to restrict their ability to reach the straps. Rapid evacuation thus would require a degree of coordination unlikely to be achieved without practice. The passengers were required to fasten the helicopter’s installed, FAA-approved occupant restraints over FlyNYON’s harnesses during takeoff and landing. Once authorized by the pilot, the two inboard rear-seat passengers were allowed to unbuckle those restraints and sit on the cabin floor with their legs outside, while the front and two outboard rear-seat passengers could loosen their lap belts and run their shoulder harnesses under their arms to pivot in their seats. The March 11, 2018, accident flight route. The Flight The flight departed from New Jersey’s Helo Kearny Heliport at about 6:50 pm and flew south to the Statue of Liberty, past other landmarks, and then northward along the East River. The helicopter climbed to 1,900 feet after the pilot received clearance from LaGuardia Airport’s (KLGA) control tower to continue to the north end of Central Park at or below 2,000 feet. Just after 7:06, the pilot heard an alert for low main-rotor rpm and saw the engine-oil and fuel-pressure warning lights illuminate. He immediately lowered collective and entered autorotation. Ruling out landing in Central Park because of the number of people on the ground, he turned toward the river. He found the fuel-flow control lever secure in its detent and turned the starter, but the engine didn’t respond. At about 600 feet above the river, the pilot reached down for the fuel-shutoff lever (FSOL) to prepare for ditching and found it already turned off. He “slammed it down” and tried the starter again, but though the engine temperature immediately began to rise, the engine didn’t have time to catch. At about 100 feet above the water, the pilot pulled the handle to deploy the emergency floats. He recalled hearing a “pop” sound, seeing parts of both front floats, and noticing additional drag; onboard recording equipment captured “a ‘click’ sound followed by noise associated with float deployment.” After a brief cyclic flare, the helicopter touched down in a somewhat shallow attitude into the East River and immediately began to roll right. Within 11 seconds, it had rolled inverted with the cabin completely submerged. The pilot was unable to free the front-seat passenger and was himself under water before he could release his four-point harness, but he managed to escape. Unable to extricate themselves from their harnesses, all five passengers drowned. At least two never removed the cutters from their pouches. (One harness and part of another weren’t recovered, presumably having been lost during extrication efforts by first responders, and one cutter was found loose in the cabin.) The pilot was rescued by a tugboat crew; divers reached the scene and began recovery efforts about 18 minutes after touchdown. What Went Wrong Footage captured by a camera mounted inside the cabin showed that several times during the six minutes before the power loss, the front-seat passenger leaned backward over the center console with the tail of his tether hanging down by the helicopter’s floor-mounted controls. At 7:06:08, as he pulled himself upright, the tail of the tether pulled taut and then popped loose; the engine noise began to diminish two seconds later. The pilot told investigators that the tether had gotten snagged on the FSOL and pulled it up, breaking the safety wire intended to prevent unintended activation. Photographs of the submerged wreckage showed the left skid’s floats more fully inflated than those on the right. Subsequent examination found that only the left air reservoir had discharged, and the crossover hose included for that purpose hadn’t fully balanced inflation pressures on both sides. (Follow-up testing showed that even with balanced pressures, one reservoir’s supply didn’t provide enough buoyancy to keep the helicopter upright on its floats.) The right reservoir’s failure to discharge was traced to a kink in its activation cable. The manufacturer’s instructions for continued airworthiness only require checking the rigging every 18 months. The 36-month inspection includes a full inflation test; it had last been completed on the helicopter 15 months earlier. The Takeaway At first glance, this accident sequence might seem like a constellation of individually unlikely events: an accidental fuel shutoff that initially went unnoticed in the darkness; an autorotation from an altitude too low to allow a restart after fuel flow was restored; and a malfunction of the emergency floats that left the passengers without time to escape their harnesses. But a closer look confirms the NTSB’s view that this tragedy was entirely foreseeable. On a low-altitude flight over an urban area offering few emergency landing sites, preventing inadvertent passenger interference with the floor-mounted engine controls should have been an urgent priority, and any passenger-carrying operation should anticipate that the cabin might have to be evacuated quickly. Overlooking or ignoring those concerns created vulnerability to a single-point failure almost guaranteed to cascade out of control in the abbreviated time available to respond—particularly in an operation serving “off-the-street” customers with little training regarding the flight’s risks and how to mitigate them.
