How Plane Crash Investigations Work, From Wreckage to Report

A plane crash investigation usually takes between one and two years. The NTSB, the US investigator, says it tries to complete an investigation within 12 to 24 months, and the international rules ask for a final report within a year where possible. The largest cases take longer. The final report on TWA Flight 800 was adopted in August 2000, four years after the accident.

The time goes into proof. Investigators do not publish a cause because it seems likely. They test each possible explanation against the wreckage, the recorders, the maintenance records and the people involved, until only one explanation fits, or until they can show that the evidence cannot decide.

The first hours: the go-team, the site and the evidence

When a major accident happens, the investigating body sends a team to the site as quickly as it can. The NTSB calls this its “Go Team”. When American Airlines Flight 587 crashed in New York on 12 November 2001, the NTSB was notified at about 09:30, and its go-team arrived on scene later that day. It split into groups for aircraft operations, human performance, structures, systems, powerplants, maintenance records, air traffic control, meteorology, aircraft performance, witnesses and materials.

The first jobs are to protect the evidence and to find the flight recorders. Rescue comes first, of course, but investigators need the wreckage left where it fell as far as possible, because the position of each piece tells part of the story. They map the wreckage field, photograph everything and start asking for records: air traffic control recordings, radar data, weather observations, and the aircraft’s maintenance history.

Some evidence disappears fast. Witness memories fade, weather changes and wreckage can be moved by tides. That is why investigators interview crews, controllers and witnesses in the first days.

Who leads, and who else takes part

Under the international rules, ICAO Annex 13, the country where the accident happened leads the investigation. It can hand all or part of the work to another country, or to a regional investigation organisation.

Four other countries have a right to take part, each through an accredited representative:

the State of Registry, where the aircraft is registered,
the State of the Operator, where the airline has its main place of business,
the State of Design, responsible for the aircraft’s type design,
the State of Manufacture, responsible for its final assembly.

A country with a special interest, for example because many of its citizens were on board, can appoint an expert.

Air Transat Flight 236 shows how this works. A Canadian airline’s Airbus A330 lost all its fuel over the Atlantic in August 2001 and glided to a landing in the Azores. Because the landing was in Portugal, Portugal’s investigating body, the GPIAA, led the investigation, and the Transportation Safety Board of Canada took part. When American Airlines Flight 587 crashed in New York in 2001, the NTSB led and France’s BEA took part as the representative of the State of Design and Manufacture of the Airbus A300.

Inside a country, the investigator also calls on the companies and organisations that know the aircraft best. The NTSB calls this the party system. In the Flight 587 investigation the parties included the Federal Aviation Administration, American Airlines, the pilots’ union and the engine maker. Parties supply expertise and information. The investigator alone writes the analysis and the conclusions.

Our guide Who Investigates Plane Crashes? introduces each of the main investigating bodies.

The recorders and the lab

The cockpit voice recorder and the flight data recorder are usually the most valuable evidence. They go to a specialist laboratory, often the investigating body’s own, sometimes another country’s. After Helios Airways Flight 522 crashed near Athens in 2005, the memory module of the voice recorder had separated from its protective case. Searchers found it five days after the accident, using a photograph of what the module looked like. Both recorders were then read out by the BEA in France for the Greek investigators.

The data recorder gives hundreds of measurements, such as altitude, speed, control positions and engine settings, many times a second. The voice recorder gives what the crew said and heard, and background sounds that can be analysed later. Together they let investigators rebuild the flight second by second.

Our guide Black Boxes Explained covers how the recorders are built and what they hold.

Wreckage reconstruction

When an aircraft breaks up in flight, the order in which it came apart is often the key question. The answer lies in the fracture surfaces, the soot patterns and the distribution of the debris.

TWA Flight 800 exploded off Long Island in July 1996, and its wreckage fell into the Atlantic. The recovery took more than ten months, and more than 95 percent of the aircraft was eventually recovered. The pieces were taken to a leased hangar in Calverton, New York, where investigators laid them out on grids marked on the floor. In the spring of 1997 they built a 93-foot-long, three-dimensional reconstruction of the centre of the fuselage around the centre fuel tank. It showed how the damage spread and confirmed that the explosion started inside that tank. See TWA Flight 800: How a Wiring Fault Ignited an Empty Fuel Tank.

Swissair Flight 111 shows the same patience applied to wiring. The MD-11 crashed into the sea off Nova Scotia in September 1998 after a fire above the cockpit ceiling. Canada’s TSB recovered 98 percent of the aircraft by structural weight, using barges and a heavy-lift crane to scoop wreckage from the sea floor. The aircraft had about 250 kilometres of wire. Investigators examined every recovered wire for melted copper, the sign of electrical arcing, and logged about 3,000 wire segments in a database. They also built a full-scale mock-up of the forward fuselage and fitted the recovered pieces to it to map where the fire had burned.

Interviews, maintenance records and weather

While the hardware is examined, other groups work through the paper trail and the people:

Operations and human performance: the crew’s training, experience, rest and medical history, and interviews with people who flew with them.
Maintenance: every work order and inspection for the aircraft. Many accidents start in a hangar months or years before the flight.
Air traffic control: radar data and recordings of radio and phone calls.
Weather: observations, radar images and forecasts for the time and place.
Survival factors: how the cabin, the exits and the rescue performed.

Each group writes a factual report. In the United States these, with photographs and transcripts, go into a public docket.

The preliminary report, interim statements and the final report

Annex 13 sets out three kinds of public document.

Preliminary report. Due within 30 days of the accident. It states basic facts. The state in charge decides whether to make it public.
Interim statement. If the final report cannot be made public within twelve months, the state conducting the investigation must publish an interim statement on each anniversary, describing the progress and any safety issues raised.
Final report. The full account: facts, analysis, conclusions and safety recommendations. In the United States, a major report is adopted by the Board at a public meeting, while smaller reports are approved under delegated authority.

Our guide How to Read an Air Accident Final Report walks through the sections of a final report.

Why it takes 12 to 24 months, or longer

The NTSB says the time between the start of an investigation and its report depends on how complex the case is and on its investigators’ workload. Some things simply take a long time:

Recovering wreckage from the sea or from difficult ground.
Laboratory testing, such as metallurgy, fire tests or recreating a failure on a test rig.
Simulation, where test pilots fly the recorded flight in a simulator to see what the crew faced.
Working with other countries, whose accredited representatives take part and see the evidence.

The three examples above each took years. The TWA Flight 800 report was adopted on 23 August 2000, four years after the accident. The TSB released its Swissair Flight 111 report on 27 March 2003, four and a half years after the crash. The NTSB adopted its report on American Airlines Flight 587 on 26 October 2004, almost three years after the accident.

Investigators do not wait for the final report to act on urgent dangers. When they find a safety problem early, they issue recommendations straight away. On Swissair Flight 111, the TSB issued four recommendations on cockpit voice recorder duration and recorder power supply in March 1999, six months after the accident.

Safety recommendations, and why investigations do not assign blame

The purpose of an accident investigation is to stop the next accident. Annex 13 says investigations under its rules are not concerned with apportioning blame or liability. The TSB puts it this way: it is not the function of the Board to assign fault or determine civil or criminal liability, but the Board reports fully on causes and contributing factors, even where fault might be inferred from its findings.

The output that matters most is the list of safety recommendations. They go to regulators, manufacturers, airlines and other organisations. The investigator cannot make anyone adopt them. The NTSB, for example, tracks each recommendation and campaigns for the ones it considers most important.

Separating safety from blame protects the evidence, because people talk more openly to an investigator who cannot punish them. The law protects some evidence as well. In the United States, for example, the NTSB may not release cockpit voice recorder audio, only relevant parts of a transcript.

Our guide The Swiss Cheese Model explains why investigators look beyond the last mistake to the conditions that made it possible.

When it is a crime: Pan Am Flight 103

Sometimes the evidence shows a deliberate act. In the United States, the NTSB hands the lead to the FBI when an accident is found to be criminal. Elsewhere the police take over the criminal case, and the safety investigation continues alongside it.

Pan Am Flight 103 broke up over Lockerbie, Scotland, on 21 December 1988. One week later, forensic scientists found conclusive evidence of a detonating high explosive on recovered pieces of a baggage container. From that point the disaster was also a criminal investigation. The UK’s AAIB continued its safety work and published Aircraft Accident Report 2/90, which found that the in-flight break-up was caused by an improvised explosive device in the forward cargo hold. The criminal case took more than ten years longer and ended with a conviction at a Scottish court sitting in the Netherlands in 2001. The forensic trail is covered in Pan Am Flight 103: How a Tiny Fragment Traced the Lockerbie Bomb.

Questions people ask

How long does a plane crash investigation take? The NTSB aims to finish within 12 to 24 months. International rules ask for a final report within 12 months if possible, and an interim statement on each anniversary if not. Complex cases take longer: the TWA Flight 800 report was adopted four years after the accident.

Who investigates a plane crash? The country where the accident happened leads the investigation, through its independent investigating body, such as the NTSB in the US or the AAIB in the UK. The countries where the aircraft was registered, designed and built, and where the airline is based, can each send an accredited representative.

Are accident reports made public? Final reports from the major investigating bodies are published free online, with their findings and safety recommendations. International rules require a preliminary report within 30 days, though a state can choose whether to publish it.

Do investigators decide who is to blame? No. Under ICAO Annex 13 the sole aim of a safety investigation is prevention. Bodies such as the TSB in Canada state that it is not their function to assign fault or determine civil or criminal liability, even where their findings describe errors.

What happens if a crash was a crime? The police take the lead on the criminal case, and the safety investigation continues alongside it. In the United States, the NTSB hands the lead to the FBI if an accident is found to be criminal. Pan Am Flight 103 is an example of both running side by side.

Watch in the library

Sources

NTSB, The Investigative Process.
ICAO Annex 13 provisions, as summarised by Uniting Aviation (ICAO), 30 August 2021; Annex 13 paragraph 6.6 on interim statements, as quoted in Hong Kong AAIA Interim Statement 13/2022.
NTSB/AAR-00/03, TWA Flight 800, adopted 23 August 2000.
TSB Canada A98H0003, Swissair Flight 111, released 27 March 2003.
AAIB Aircraft Accident Report 2/90, Pan Am Flight 103.
AAIASB report 11/2006, Helios Airways Flight 522.
NTSB/AAR-04/04, American Airlines Flight 587, adopted 26 October 2004.
TSB Canada, About the TSB.
49 U.S.C. 1114(c) (cockpit recordings).
GPIAA (Portugal), final report on Air Transat Flight 236, 2004.

Read how we use these sources in How We Check Facts.