Saturday, January 28, 2023

Flight Control System Malfunction/Failure: Cessna 525A CitationJet CJ2+, N525EG; fatal accident occurred November 30, 2018 in Memphis, Clark County, Indiana

Wayne Estopinal, Sandy Johnson and Andrew Davis
~


The estates of three people who died in a 2018 plane crash in Southern Indiana have reached a settlement with the aviation company behind a winglet system scrutinized in the incident. 

Family and representatives of the three victims — Louisville City FC founder Wayne Estopinal, his architecture firm’s vice president, Sandra Holland Johnson, and pilot Andrew Davis — had sued Tamarack Aerospace Group in connection with the Nov. 30, 2018, crash of the Cessna 525A CitationJet CJ2+ in a field near Memphis, Indiana. 

The wrongful death suit, filed in 2020 in U.S. District Court for the Eastern District of Washington, accused Idaho-based Tamarack of making a winglet system that “was not reasonably safe as designed” and claimed “adequate warnings or instructions were not provided.” 

Winglets are the raised pieces at the edge of wings that reduce drag and help control the plane. 

Following an investigation, the National Transportation Safety Board said in a 2021 report on the crash that six pins in the wingtip extensions of the Cessna were “curled” and two pins were not aligned, which could have disrupted power. 

Without definitively blaming Tamarack, the NTSB described the official cause of the crash as “asymmetric deployment of the left wing load alleviation system for undetermined reasons.” 

Claims made in a lawsuit represent only one side of a case. 

Tamarack Aerospace Group said in a statement Thursday it “has reached a confidential resolution of all claims evolving from the November 30, 2018 Cessna mishap near Memphis, Indiana.” 

The company declined to provide further details in the statement to The Courier Journal. 

Online records in the case before U.S. District Judge Mary K. Dimke also confirmed the “parties have informed the Court that this matter settled during mediation.” Attorneys for the plaintiffs did not immediately return phone calls and emails seeking comment.

Each plaintiff sought to recover, at a minimum, $75,000 from Tamarack Aerospace Group and Cranfield Aerospace Solutions Limited, along with prejudgment interest, attorney fees and costs. 

The suit is separate from Tamarack’s pending petition to the NTSB that asks the federal board to reconsider its conclusion the 2018 crash was likely caused by the winglet system. 

Tamarack defends its winglets 

Tamarack previously argued its Active Winglets installed on the Cessna in the 2018 crash “were fully operational and did not cause or contribute to the accident.” 

Roughly six months after the crash, the Federal Aviation Administration announced it was grounding Cessna planes equipped with Tamarack's ATLAS winglets, mentioning reports of incidents in which the winglets appeared to have malfunctioned. 

The FAA alluded to the Indiana plane crash without specifically naming it, and the agency also cited a similar emergency directive issued a month earlier by the European Aviation Safety Agency. 

The European agency and FAA lifted the winglet directives in the summer of 2019 after Tamarack Aerospace Group announced it had found a fix to the system that improves reliability and safety. Since then, no accidents or crashes involving the Cessna fleet with the Tamarack winglet system have been reported.

Remembering the victims 

Davis, 32, Estopinal, 63, and Johnson, 54, died when the  Cessna 525A CitationJet CJ2+ crashed a few minutes after its 10:25 a.m. takeoff from Clark Regional Airport on the way to Chicago's Midway International Airport. 

Davis lived in Sellersburg and was an associate corporate pilot for TEG. He left behind a wife and two young children. 

Johnson was vice president of TEG and based in the firm's Shreveport, Louisiana, office. A mother of two sons, she was remembered as a caring friend and an energetic person with a zest for life. 

Estopinal was president of Jeffersonsville-based TEG Architects, where Davis and Johnson also worked, and Estopinal’s EstoAir LLC firm owned the plane. 

Estopinal was also behind the effort to bring a United Soccer League franchise to Louisville in 2014, with LouCity since becoming one of the USL's most successful clubs, and he was the architectural leader behind several local projects, including the University of Louisville’s Lynn Stadium and Jeffersonville’s Big Four Station Park.


















Andrew Dale Davis 


Aviation Accident Final Report - National Transportation Safety Board

Investigator In Charge (IIC): Aguilera, Jason

The National Transportation Safety Board traveled to the scene of this accident.

Additional Participating Entities:
Chris House; Federal Aviation Administration / Flight Standards District Office; Indianapolis, Indiana
Textron Aviation; Wichita, Kansas
Williams International; Pontiac, Michigan
Tamarack Aerospace Group; Sandpoint, Idaho
Rockwell Collins; Cedar Rapids, Iowa
Lee Air; Wichita, Kansas

Investigation Docket - National Transportation Safety Board:



Location: Memphis, Indiana 
Accident Number: CEN19FA036
Date and Time: November 30, 2018, 10:28 Local 
Registration: N525EG
Aircraft: Cessna 525
Aircraft Damage: Destroyed
Defining Event: Flight control sys malf/fail 
Injuries: 3 Fatal
Flight Conducted Under: Part 91: General aviation - Business

Analysis

The pilot and two passengers departed in instrument meteorological conditions on a crosscountry flight. According to the airplane’s automatic dependent surveillance–broadcast (ADSB) data, the airplane climbed to about 1,400 ft mean sea level (msl) before it turned left onto a track toward the assigned fix and continued to climb. The pilot contacted air traffic control and was assigned 10,000 ft; he turned the autopilot on and adjusted the selected altitude to 10,000 ft. The airplane passed 3,000 ft, with airspeed between 230 and 240 kts, and continued to climb. The airplane then began to bank to the left at a rate of about 5° per second. After the
onset of the roll, the airplane maintained airspeed and continued to climb for 12 seconds, which indicated that engine power was not reduced in response to the roll onset.

When the airplane reached about 30° of left bank, about 3 seconds after the onset of the roll, the autopilot disconnected accompanied by an aural alert. About 1 second later, the cockpit voice recorder (CVR) recorded a statement by the pilot consistent with surprise, likely made in response to the autopilot disconnect and/or the bank angle. Based on the pilot’s statement of surprise, it is unlikely that the pilot commanded the left bank. The airplane continued its climb and reached a maximum altitude of about 6,100 ft msl before it began to rapidly descend, with its left bank angle reaching near 90°. During the descent, the airplane’s enhanced ground proximity warning system announced eight “bank angle” annunciations and one “overspeed warning” annunciation.

About 23 seconds after the autopilot disconnected, the pilot made a mayday call shouting that he was “…in an emergency descent unable to gain control of the aircraft.” At the final ADS-B data point, the airplane was at an altitude of about 1,000 ft msl, at an airspeed of about 380 kts, and in a 53° left bank. The airplane impacted a wooded area about 8.5 miles northwest of the departure airport. The total time from the beginning of the left bank until ground impact was about 35 seconds.

The airplane was modified with a Tamarack Aerospace Group Active Technology Load Alleviation System (ATLAS), which operated independently of other airplane systems. The system included the installation of Tamarack Active Camber Surfaces (TACS), which are
aerodynamic control surfaces mounted on the wing extensions that either hold their position in trail with the wing or symmetrically deploy trailing edge up or trailing edge down to alleviate structural loads. The TACS are actuated by the TACS control units (TCUs) and are not controlled by the pilot.

Postaccident examination of the airplane’s left TACS control linkage assemblies revealed a witness mark on the bellcrank, consistent with contact with the trailing-edge-up mechanical stop and, thus, the TACS being in a trailing-edge-up position at the time of ground impact. Additional damage on the TACS inboard hinge fitting, consistent with over-deflection in the trailing-edge-up direction, was also consistent with the TACS being in a trailing-edge-up position at the time of ground impact. Examination of the left TCU showed contact marks on the ram guide housing and on the extend hard stop plate, which were consistent with the actuator being at a maximum extension position at the time of ground impact. These marks are not expected during normal operation of the actuator. The evidence indicates that the left TACS was in a position consistent with full trailing edge up position at the time of ground impact.

Examination of the right TACS control linkage assemblies revealed damage to the trailing edge-down bolt/stop. The drive that positions the TACS was found in the neutral position. Damage to the bolt was consistent with the bell-crank impacting the bolt with sufficient force to shear the bolt at the nut, which is consistent with the TACS moving to a trailing-edge-down position during the impact sequence. Additional damage on the TACS inboard hinge fitting, consistent with over-deflection in the trailing-edge-down direction, was consistent with the TACS being in a trailing-edge-down position. The forces required to cause this damage would likely be due to the control system moving with some speed toward the trailing-edge-down position.

Examination of the right TCU, which was found detached from its mounting location, did not find contact marks on the retract hard stop that would have been consistent with a full trailing edge-down position. Additionally, marks on the ram guide housing were consistent with the actuator being in a midtravel position, or a more neutral position of the TACS. These marks are not expected during normal operation of the actuator. The evidence indicates that the right TACS was in a neutral position at the time of ground impact. Because the right TCU and TACS were found separated from the control linkage assembly, it is likely that the TACS was able to move freely after initial ground impact and then cause the damage to the trailing-edge-down bolt/stop.

An asymmetric deployment of the TACS, with the left TACS likely in a position consistent with trailing edge up and the right TACS likely in a position consistent with neutral, would have induced a left rolling moment to the airplane.

Postaccident examination revealed that the left TCU’s 40-pin connector had 6 pins that were curled, with 2 of the pins not continuous, which could indicate an intermittent electrical connection in the left TACS that could interrupt power to the TACS, leading the left TACS to remain in a trailing-edge-up position while the right TACS floated to a neutral position.

However, it could not be determined how or when the pins had been curled, and the lack of fault recording capability in the ATLAS precluded the detection of any problems with the system.

According to the airplane performance study, certification failure assessment flight testing for the ATLAS found that at a speed of 240 kts, an initial bank angle of 30°, and a maximum unfavorable fuel imbalance (critical failure condition), a near full asymmetric deflection of the TACS resulted in a roll rate of greater than 20° per second. For the accident flight, at the start of the left roll, the airplane’s airspeed was calculated to be 240 kts with the wings about level. In the flight test, the pilot reacted to the full asymmetric TACS deflection within 3 seconds and was able to counteract the roll induced by the asymmetric TACS deflection.

The accident roll rate of 5° per second was significantly less than the flight test data provided for a fully asymmetric TACS deflection at a critical failure initial condition. It is possible that the system was not experiencing a full asymmetric failure or that the full possible roll rate could not be induced because the airplane was not in the critical failure condition. The roll rate
did change from negative to positive, and the roll angle did recover from 90° left wing down to about 53° left wing down before ground impact.

If an asymmetric TACS deflection caused the left roll, it is possible the pilot was able to roll the airplane back to the right but not enough to fully recover and arrest the descent. However, because the airplane was not equipped with a flight recorder, control surface deflections and pilot input are unknown. Further, the ATLAS is independent of other airplane systems, and it does not record any information about TCU actuation or TACS deflection.

The investigation found that five uncommanded roll incidents have been reported to either the European Union Aviation Safety Agency or the Federal Aviation Administration involving airplanes equipped with ATLAS. After this accident, the ATLAS manufacturer issued a service bulletin (SB) applicable to all TACS units in response to uncommanded roll events related to ATLAS failures. The SB stated that the aerodynamic overbalance of the TACS allowed for the TACS to remain deployed when power was removed from the TCU while the TACS are deployed or if unique aerodynamic conditions were encountered causing the TACS to deploy with the TCUs in an unpowered state. The SB specified the application of centering strips attached to the upper and lower trailing edge of the TACS that, in the event of a system fault, would aerodynamically force the TACS back to their faired position and reduce the impact of the fault. Because the SB was released after this accident occurred, the accident airplane was not equipped with these centering strips.

The investigation also examined the pilot’s actions before the left bank and his response to it. The CVR transcript showed that before the autopilot disconnected, the pilot had consistently verbalized his actions. These statements and the pilot’s exchanges with controllers were consistent with a pilot fully engaged in routine operations and did not suggest performance deficiency or impairment. In the moments before the autopilot disconnect, the pilot had been conducting a checklist, which was interrupted by a routine exchange with a controller to change frequencies. After the exchange, the pilot resumed the checklist and subsequently responded with surprise after the autopilot disconnect aural annunciation.

For about 15 seconds, while the bank angle warning sounded and the overspeed warning began to annunciate, the pilot did not make any statements. However, about 2 seconds after the onset of the overspeed warning, the pilot shouted three expletives followed about 6 seconds later by a mayday call. After the autopilot disconnect, the pilot’s statements were consistent with startle and surprise and, although he made no statements that described actions he was taking, his statement in the mayday call of “unable to gain control” is likely consistent with the pilot having taken some actions to regain control but an increasing recognition that they were not effective.

According to a supplement to the flight manual emergency procedures, during an ATLAS inoperative condition in flight, the pilot is to move the throttles to idle and extend the speed brakes to reach an airspeed below 161 kts. Warnings indicate that “LARGE AILERON INPUT MAY BE REQUIRED IF AN ATLAS FAILURE AT HIGH INDICATED AIRSPEED INCLUDES A TACS RUNAWAY” and “SPEED REDUCTION IS THE FIRST PRIORITY IN THESE FAILURE CONDITIONS.”

The airplane performance study found that after the autopilot disconnect, the airplane continued to climb, consistent with the engine at a high power setting. During the descent, airplane systems warned of an overspeed condition, and the last data point revealed that the airplane was traveling about 380 kts. Thus, it is unlikely that the pilot moved the throttles to the idle position as directed by the flight manual supplement. The ATLAS INOP button was not located in the wreckage, and it could not be determined if the button illuminated in flight to help the pilot identify a malfunction with the ATLAS.

In summary, the circumstances of the accident are consistent with asymmetric or trailing edge up deployment of the left TACS for reasons that could not be determined. The resultant roll rate, although above the nominal threshold for detection by the human vestibular system, likely went unrecognized by the pilot, due primarily to the pilot’s attention being directed toward a checklist and communications with a controller, a lack of visible horizon because the airplane was in the clouds, and the autopilot engagement. After the autopilot disconnected, the pilot was audibly surprised and did not reduce engine power or deploy the speed brakes. The pilot was not able to regain control before collision with terrain.

Probable Cause and Findings

The National Transportation Safety Board determines the probable cause(s) of this accident to be:
The asymmetric deployment of the left wing load alleviation system for undetermined reasons, which resulted in an in-flight upset from which the pilot was not able to recover.

Findings

Aircraft Control surface (fitting on wing) - Malfunction

Factual Information

History of Flight

Initial climb Flight control sys malf/fail (Defining event)
Initial climb Loss of control in flight
Uncontrolled descent Collision with terr/obj (non-CFIT)

**This report was modified on October 6, 2021. Please see the public docket for this investigation to view the original factual report.**

On November 30, 2018, about 1028 central standard time, a Cessna 525A (Citation) airplane, N525EG, was destroyed when it was involved in an accident near Memphis, Indiana. The pilot and two passengers were fatally injured. The airplane was operated as a Title 14 Code of Federal Regulations Part 91 business flight.

The cross-country flight originated from Clark Regional Airport (JVY), Jeffersonville, Indiana, and was en route to Chicago Midway International Airport (MDW), Chicago, Illinois. The airplane was equipped with automatic dependent surveillance–broadcast (ADS-B), which recorded latitude and longitude from GPS, pressure and geometric altitude, and selected altitude and heading. The airplane was also equipped with a cockpit voice recorder (CVR), which recorded the accident flight and annunciations from the enhanced ground proximity warning system (EGPWS). It was not equipped with a flight data recorder (FDR) nor was it required to be.

Review of the CVR transcript showed that the pilot operated as a single pilot but verbalized his actions as he configured the airplane before departure. He referenced items from the Before Taxi checklist and included in his crew briefing that in the event of a problem after takeoff decision speed, he would handle it as an in-flight emergency and “fly the airplane, address the problem, get the autopilot on, talk on the radios, divert over to Stanford.” The air traffic controller provided initial clearance for the pilot to fly direct to the STREP intersection and to climb and maintain 3,000 ft mean sea level. Before the departure from JVY, the pilot announced on the common traffic advisory frequency that he was departing runway 36 and verbalized in the cockpit “this is three six” before he advanced the throttles.

The flight departed JVY about 1024:36 into instrument meteorological conditions. The CVR recorded the pilot state that he set power to maximum cruise thrust, switched the engine sync on, and turned on the yaw dampers. The pilot also verbalized his interaction with the autopilot, including navigation mode, direct STREP, and vertical speed climb up to 3,000 ft. According to the National Transportation Safety Board’s (NTSB) airplane performance study, the airplane climbed to about 1,400 ft msl before it turned left onto a course of 330° and continued to climb. The CVR recorded the pilot state he was turning on the autopilot at 1025:22.

At 1025:39, the pilot was cleared up to 10,000 ft and asked to “ident,” and the airplane was subsequently identified on radar. The pilot verbalized setting the autopilot for 10,000 ft and read items on the After Takeoff/Climb checklist. The performance study indicated that the airplane passed 3,000 ft about 1026, with an airspeed between 230 and 240 kts, and continued to climb steadily.

At 1026:29, while the pilot was conducting the checklist, the controller instructed him to contact the Indianapolis Air Route Traffic Control Center; the pilot acknowledged. At 1026:38, the pilot resumed the checklist and stated, “uhhh lets seeee. Pressurization pressurizing anti ice de-ice systems are not required at this time.” The performance study indicated that, at 1026:45, the airplane began to bank to the left at a rate of about 5° per second and that after the onset of the roll, the airplane maintained airspeed while it continued to climb for 12 seconds, consistent with engine power not being reduced in response to the roll onset.

At 1026:48, the CVR recorded the airplane’s autopilot disconnect annunciation, “autopilot.” The performance study indicated that about this time, the airplane was in about a 30° left bank. About 1 second later, the pilot stated, “whooooaaaaah.” Over the next 8 seconds, the airplane’s EGPWS annunciated six “bank angle” alerts. At 1026:57, the airplane reached its maximum altitude of about 6,100 ft msl and then began to descend rapidly, in excess of 11,000 ft per minute. At 1026:58, the bank angle was about 70° left wing down, and by 1027:05, the airplane was near 90° left wing down.

At 1027:04, the CVR recorded a sound similar to an overspeed warning alert, which continued to the end of the flight. The performance study indicated that about the time of the overspeed warning, the airplane passed about 250 kts calibrated airspeed at an altitude of about 5,600 ft. After the overspeed warning, the pilot shouted three expletives, and the bank angle alert sounded two more times. According to the performance study, at 1027:18, the final ADS-B data point, the airplane was about 1,000 ft msl, with the airspeed about 380 kts and in a 53° left bank. At 1027:11, the CVR recorded the pilot shouting a radio transmission, “mayday mayday mayday citation five two five echo golf is in an emergency descent unable to gain control of the aircraft.” At 1027:16, the CVR recorded the EGPWS annunciating “terrain terrain.” The sound of impact was recorded about 1027:20. The total time from the beginning of the left roll until ground impact was about 35 seconds.

The accident site was located about 8.5 miles northwest of JVY.

Pilot Information

Certificate: Airline transport; Flight instructor 
Age: 32, Male
Airplane Rating(s): Single-engine land; Multi-engine land
Seat Occupied: Left
Other Aircraft Rating(s): None
Restraint Used: Unknown
Instrument Rating(s): Airplane
Second Pilot Present: No
Instructor Rating(s): Airplane multi-engine; Airplane single-engine; Instrument airplane
Toxicology Performed: No
Medical Certification: Class 1 Without waivers/limitations 
Last FAA Medical Exam: March 15, 2018
Occupational Pilot: Yes
Last Flight Review or Equivalent:
Flight Time: 3500 hours (Total, all aircraft)

The pilot received his single-pilot Cessna 525 type rating to his airline transport pilot certificate on February 28, 2018, after completing training at Simuflite and prior to the installation of the Tamarack Aerospace Group Active Technology Load Alleviation System (ATLAS) on the accident airplane. On his application to add the Cessna 525 type rating, the pilot reported 3,291 total hours of flight experience and 453 hours of instrument experience. On previous applications filed on February 14, 2017, and on August 29, 2016, the pilot reported the same hours. On his application for a Federal Aviation Administration (FAA) medical certificate dated March 15, 2018, the pilot reported 3,500 total hours. Logbooks for the pilot were not located, and no online logbook was discovered during the investigation. The pilot’s total hours and experience could not be verified.

Aircraft and Owner/Operator Information

Aircraft Make: Cessna 
Registration: N525EG
Model/Series: 525 A
Aircraft Category: Airplane
Year of Manufacture: 2009 
Amateur Built:
Airworthiness Certificate: Normal 
Serial Number: 525A0449
Landing Gear Type: Retractable - Tricycle
Seats: 10
Date/Type of Last Inspection: 
Certified Max Gross Wt.: 12500 lbs
Time Since Last Inspection:
Engines: 2 Turbo fan
Airframe Total Time: 3306.5 Hrs at time of accident
Engine Manufacturer: Williams International
ELT: C126 installed, not activated 
Engine Model/Series: FJ44-3A-24
Registered Owner: 
Rated Power: 2490 Lbs thrust
Operator: 
Operating Certificate(s) Held: None

Autopilot

The airplane was equipped with an autopilot system. The pilot can disengage the autopilot, and the autopilot can also disengage during abnormal situations. Abnormal disconnects can occur if the stick shaker activates, there is a yaw damper or internal autopilot failure (such as an excessive autopilot roll rate of 10°/second into a bank), there is an attitude heading reference system failure or miscompare, there is a loss of power to the normal (main) DC buses, or excessive attitudes are reached (25° nose up, 15° nose down, or 45° left or right wing down).

EGPWS

The airplane was equipped with a Honeywell Mark VIII EGPWS that interfaced with various airplane systems and provided six modes of alerts for the flight crew, including advisory callouts through the cockpit audio system for “bank angle” to alert the pilot to excessive bank angles. According to the Citation Aircraft Flight Manual, the aural advisory for bank angle above 2,450 ft above ground level occurs at 55°.

Aircraft Recording System

The airplane was equipped with an aircraft recording system (AReS), which recorded aircraft system maintenance data to help with maintenance troubleshooting procedures. Data were stored on a compact flash card installed in the AReS recording unit. The unit was not required to be installed, nor was it certified to FDR regulatory standards for crashworthy data storage or required parameters.

Active Technology Load Alleviation System

Tamarack Aerospace Group designed and manufactured the ATLAS and used Cranfield Aerospace Solutions Ltd. (CAeS) to provide support for a European Union Aviation Safety Agency (EASA) supplemental type certificate (STC). On December 22, 2015, EASA approved STC 10056170, and on December 27, 2016, the FAA issued STC SA03842NY after validation of the EASA STC.

Tamarack modified the original airplane design by removing the wing tip assemblies and adding winglets and wing extensions that contain active aerodynamic surfaces. The system was designed to provide increased aerodynamic efficiency without adverse structural effects due to the winglet installation. ATLAS operates independently of all other airplane systems. The main components of ATLAS consist of two wing extensions and two winglets with an ATLAS control unit (ACU), two Tamarack active camber surfaces (TACS), two TACS control units (TCUs), an annunciator line replaceable unit (LRU), and an ATLAS INOP button.

The TACS are active aerodynamic control surfaces mounted on the wingtip extensions that either hold their position in trail with the wing or deploy symmetrically to alleviate structural loads. The TACS attach to the wing-tip extensions through two hinges and connect to the TCUs via pushrods, a bellcrank, and a walking beam. The ACU, which was mounted to the fuselage near the airplane’s center of gravity, is an analog device with no software or nonvolatile memory, , contains two accelerometers to measure acceleration along the vertical axis, and provides commands to the TCUs to actuate the TACS symmetrically as required based on varying loading conditions.

The TCU communicates with the ACU for fault monitoring and system operation. In the event of a fault being detected, the ACU signals the TCU to depower the motor. The TCUs contain electronic limits to actuator travel (soft stops) and hardware limits (hard/mechanical stops).  (These hard stops are internal to the TCU; additional hard stops are located within the bellcrank.) When power is not applied to the TCUs, the TACS are free to move with an applied force of 10 lbs or less. The ATLAS installation allows the TACS to travel 21° ±1° trailing edge up and 10° ±1° trailing edge down to mechanical stops located in the bellcrank assembly. The nominal operational travel is 20° trailing edge up and 9° trailing edge down using the electronic stops within the TCU. During normal operations, due to the electronic limits, the bellcrank should not contact the hard stops. The bellcrank contains a TCU return spring and two hard stops, one in the trailing-edge-up direction and one in the trailing-edge-down direction.

The annunciator LRU contains relays to trigger the annunciation of the ATLAS INOP button, which was installed on the main instrument panel, in the event of a system fault signal or loss of power from the ACU. The ATLAS INOP button, illuminates in the event of a fault condition and provides the flight crew with a primary means of resetting the system during a faulted condition. The illumination of the ATLAS INOP button would not result in an aural annunciation.

Logic within the system depowers the TCUs if an asymmetric deployment of the TACS is sensed. In this situation, the TACS would be able to free float and could aerodynamically move to their full deflection hard stop. Centering strips introduced several months after the accident in a service bulletin (SB) would use aerodynamic forces to move the TACS to a streamlined position (see Additional Information section).

On May 27, 2018, the accident airplane was modified via STC SA03842NY to install the ATLAS. None of the installed components for the ATLAS were capable of recording a fault history, nor were they required to do so.

Maintenance

The left TCU, manufactured on December 18, 2017, and the right TCU, manufactured on November 14, 2017, were initially installed on the airplane on May 27, 2018. Both TCUs had been returned to the manufacturer per SB CAS/SB1467, which corrected the potential for a metal fastener inside the TCU to become loose and detach and were reinstalled on the airplane on July 13, 2018.

The last maintenance performed on the airplane occurred on November 20, 2018; at that time, the airplane had a total of 3,296.7 flight hours. At the time of the accident, the ATLAS had accrued about 250 flight hours and about 193 flight hours since SB CAS/1467 was accomplished. There were no reported discrepancies concerning the flight controls, autopilot, or ATLAS before the accident.

Meteorological Information and Flight Plan

Conditions at Accident Site: Instrument (IMC) 
Condition of Light: Day
Observation Facility, Elevation: KLOU, 540 ft msl
Distance from Accident Site: 16 Nautical Miles
Observation Time: 15:53 Local
Direction from Accident Site: 155°
Lowest Cloud Condition: 
Visibility: 9 miles
Lowest Ceiling: Overcast / 800 ft AGL 
Visibility (RVR):
Wind Speed/Gusts: 4 knots / 
Turbulence Type
Forecast/Actual: None / Clear air
Wind Direction: 50° 
Turbulence Severity Forecast/Actual: N/A / Moderate
Altimeter Setting: 30 inches Hg 
Temperature/Dew Point: 12°C / 8°C
Precipitation and Obscuration: No Obscuration; No Precipitation
Departure Point: Jeffersonville, IN (JVY)
Type of Flight Plan Filed: IFR
Destination: Chicago, IL (MDW) 
Type of Clearance: IFR
Departure Time: 10:25 Local
Type of Airspace:

A review of weather information for the accident flight revealed instrument flight rules conditions in the vicinity of the accident site. Sounding data revealed that conditions were conducive for light turbulence from the surface to about 2,500 ft, where the intensity increased to moderate through about 7,000 ft. Cloud coverage was present between about 1,200 ft to 10,000 ft msl.

Wreckage and Impact Information

Crew Injuries: 1 Fatal 
Aircraft Damage: Destroyed
Passenger Injuries: 2 Fatal
Aircraft Fire: On-ground
Ground Injuries: 
Aircraft Explosion: None
Total Injuries: 3 Fatal
Latitude, Longitude: 38.475276,-85.811111(est)

The debris field measured about 400 yards on an easterly heading through a wooded area. The first impact point consisted of treetops. The airplane was found fragmented in numerous pieces with the right engine being the farthest piece of wreckage. All major airplane components were accounted for at the accident site. There was evidence of a postimpact fire.

A layout reconstruction of the primary flight controls was conducted on scene. All flight control cables were broken in multiple locations, and all breaks displayed broom-strawing at the fracture points. No preimpact anomalies were noted with the flight controls.

Both engines’ full authority digital engine control units, which do not record continuous engine data, were recovered from the accident site and sent to the manufacturer for download. Data extracted from both units revealed that neither recorded any faults on the day of the accident. Each unit recorded a single data point at takeoff for the accident flight; no anomalies were recorded during the takeoff.

A portion of the EGPWS outer case was found along the wreckage path, but its internal components were not located. The AReS unit was also found along the wreckage path. The outer case of the unit was compromised, and the outer case of the compact flash card was breeched. Further examination revealed that the memory chip had separated from the compact flash card circuit board and was not located.

ATLAS Components

The ACU was found detached from its mounting location in the wing root fairing. The unit case showed signs of crush damage consistent with impact. The ACU cover screws were not present, and removal of the cover revealed multiple loose electrical components in the unit and missing components from the main circuit card. Damage to the ACU precluded any functional testing.

The ATLAS INOP button and annunciator LRU were not located in the wreckage.

Left TACS and TCU

Portions of the left TACS were located in the recovered wreckage. The recovered control linkages exhibited failures consistent with overload. A visual examination showed a witness mark on the bellcrank, which was consistent with contact with the trailing-edge-up mechanical stop. Additional damage consistent with overdeflection in the trailing-edge-up direction was noted to the inboard hinge fitting.

The left TCU was still attached to its wing-mounted location. Due to impact forces, an outline consistent with the TCU was impressed into the wing access panel. The unit’s case did not exhibit any signs of deformation, and the top and bottom covers were secured to the unit. A computed tomography (CT) scan found five screw heads loose within the unit. The screws were part of the linear variable differential transformer and motor cover assemblies, and the screw head damage was consistent with shearing due to the deformation of the actuator housing. In addition, the CT scan found 6 pins bent near the end of the 40-pin connector in the unit. The six bent pins corresponded with the following:

• 29 – Ground
• 31 – Ground
• 33 – Servo Enable
• 35 – Servo Command
• 37 – Servo Fault
• 39 – Position Output

Of the six bent pins, electrical continuity testing showed open connections between 33 – Servo Enable and the board and 35 – Servo Command and the board. As of August 10, 2021, the manufacturer had inspected 30% of the in-service TCUs and had not found any bent pins like those found in the accident unit.

The ram tube was bent and could not be removed using normal disassembly procedures without applying excessive force. There were visible markings on the retract hard stop consistent with acceptance testing, but no marks were visible that were consistent with a high-force impact. Examination of the extend hard stop found witness marks consistent with a high-energy impact.

A set of witness marks was found on the upper ram guide housing, consistent with contact from the ball screw nut that positions the TACS, in an area consistent with an intermediate extension position (left TACS trailing edge up). Another set of witness marks corresponded with a full extension position of the actuator. Additional marks were observed on the bottom ram guide housing, which would not normally be in contact with the ball nut. Due to damage, functional testing could not be performed.

Right TACS and TCU

Portions of the right TACS were located in the recovered wreckage. The recovered control linkages exhibited failures consistent with overload. A visual examination of the trailing-edge down mechanical stop revealed that the bolt/stop was deformed, and the nut and cotter pin were not located. The damage to the bolt was consistent with shear loading at the lower attachment fitting. Additional damage consistent with over-deflection in the trailing-edge-down direction was noted to the inboard hinge fitting.

The right TCU was found in the wreckage path, detached from its wing-mounted location. Its case was deformed and twisted, and the upper-case cover was found partially separated from the unit, consistent with impact damage. Internal components were found damaged. The ram tube assembly was fractured at the ball screw, and the remaining portion of the ram tube, internal to the actuator assembly, was bent. There were no discernable marks on the retract hard stop indicative of a high-force impact.

Witness marks were found on the upper ram guide housing consistent with contact from the ball screw nut. The location of the witness marks corresponded to a position of approximate mid-travel of the actuator (an intermediate extension position). An additional mark was observed on the bottom ram guide housing, which would not normally be in contact with the ball nut. There were no discernable markings on the extend hard stop plate. Due to damage, functional testing could not be performed.

Additional Information

Citation CJ2+ Operating Manual Unusual Attitude Recoveries

The Citation CJ2+ Operating Manual states that “unusual attitudes do not have to be severe to be unusual; they are simply not what you expected.” The recovery is to “recognize the attitude by looking at all three attitude indicators.” Reference airspeed, altitude, and heading changes and use the best instrument available to control the recovery. Return to wings-level flight before chasing command bars. For a “Nose High” recovery, the manual states “if needed, add power to preserve airspeed. Do not push the nose down. Relax any back pressure you may be applying. Consider using some bank to help lower the nose.”

ATLAS Emergency Procedures

According to an ATLAS supplement to the Cessna 525A flight manual, section V, ATLAS inoperative (ATLAS INOP button light on), in-flight procedures have the following warnings:

“LARGE AILERON INPUT MAY BE REQUIRED IF AN ATLAS FAILURE AT HIGH INDICATED AIRSPEED INCLUDES A TACS RUNAWAY” and “SPEED REDUCTION IS THE FIRST PRIORITY IN THESE FAILURE CONDITIONS.”

The first 5 steps of the Emergency Procedures are as follows:

1. Throttles - IDLE
2. Speed Brakes - EXTEND
3. AP/TRIM DISC Button - PUSH
4. Maintain lateral control
5. Airspeed - REDUCE TO 161 KIAS [kts indicated airspeed] OR LESS

Of note, the ATLAS INOP procedures differ with regard to power settings. On the CVR, the pilot did not mention the ATLAS INOP light, and due to impact damage, the light was not available for testing to determine whether the ATLAS INOP light illuminated.

Service Bulletins and Airworthiness Directives Related to ATLA

On April 25, 2018, CAeS/Tamarack issued SB CAS/SB1467, which required the removal and rework of the TCUs. The rework required an existing screw and split lockwasher to be removed and a new screw, split lockwasher, and flat washer to be installed. As previously noted, this SB was accomplished on the accident airplane’s TCUs.

On March 1, 2019, CAeS/Tamarack issued SB CAS/SB1475, applicable to all TACS units, in response to “three uncommanded roll events related to Tamarack ATLAS failures.” The SB stated the following:

The aerodynamic over balance of the Tamarack Active Camber Surface (TACS) is a primary contribution in all three [events] since the TACS will stay deployed if power is removed from the TACS CONTROL UNIT (TCU) while the TACS are deployed; or in unique aerodynamic conditions the TACS will aerodynamically deploy if the TCU is unpowered.

According to Tamarack’s website (https://tamarackaero.com/EASA-EAD-Resolution, accessed Dec. 21, 2020), CAS/SB1475: consists of centering strips attached to the upper and lower trailing edge of the… TACS. In the unlikely event of a system fault, the centering strips aerodynamically force the TACS back to their faired position, reducing the impact of the fault.

The SB was released after this accident occurred; thus, the accident airplane was not equipped with these centering strips.

On April 19, 2019, as an interim action, EASA issued Emergency Airworthiness Directive (EAD) 2019-0086-E due to reported occurrences of the ATLAS system experiencing malfunctions resulting in upset events; in some cases, the pilots had difficulty recovering the aircraft. The EAD included additional preflight inspection procedures and flight envelope limitations. Compliance was required before the next flight.

On May 24, 2019, the FAA issued AD 2019-08-13, applicable to all Cessna airplanes with the ATLAS system installed. The AD prohibited operation of the airplane with the ATLAS system installed until “a modification has been incorporated in accordance with an FAA-approved method” to address the malfunctions that prompted the EASA EAD.

On July 4, 2019, CAeS/Tamarack issued SB CAS/SB1480, which required operators to verify/modify their airplanes to be in accordance with SB CAS/SB1467 and SB CAS/SB1475.Operator compliance with the SB was mandatory, “[b]efore flight with the Tamarack ATLAS winglets installed.”

On July 10, 2019, the FAA issued an alternate means of compliance for AD 2019-08-13, which, if complied with, removed the flight restrictions put in place by the FAA AD and required operators to follow the instructions in SB CAS/SB1480.

On August 9, 2019, EASA issued a revision to EAD 2019-0086-E, effective August 23, 2019, that removed the restrictions put in place by the EASA EAD if operators complied with the instructions in SB CAS/SB1480. The original STC was also revised to include the modifications outlined in CAS/SB1480.

Additional Fleet Events

A review of manufacturer and FAA records was conducted to note any uncommanded roll events in the fleet of Cessna CitationJet 525 airplanes without the ATLAS installed; for the history of the airplane, without ATLAS installed, there have not been any reported events of uncommanded rolls.

Five incidents have been reported to either EASA or the FAA through the service difficulty reporting system for airplanes with the ATLAS system installed. None of the listed events reported injuries or airframe damage. The events are summarized as follows:
February 2018: The airplane banked to the right in cruise, achieving about 30° of bank as the pilot recovered. ATLAS would not reset in the air.

August 2018: The left-seat pilot was being trained by the right-seat pilot. The right-seat pilot told the left-seat pilot to recover, and the left-seat pilot did without the right-seat pilot touching controls. The left-seat pilot reported full aileron input for recovery. The right-seat pilot reported that he “was never out of training mode.”

February 2019: The pilot reported a “violent roll” input. The passenger did not notice the event until notified on landing.

March 2019: The pilot reported a roll input he assumed was an autopilot hard over: less than 45° bank during recovery, using 1/4 to 1/3 roll input.

April 2019: The pilot reported a large roll input with 75° bank during recovery and large yoke forces. This event was investigated by the Air Accident Investigation Branch as AAIB-25698. The final report (available at https://www.gov.uk/aaib-reports/aaib-investigation-to-cessnacitation-cj1-n680kh, accessed on January 4, 2021) notes the following:

The aircraft had been modified with a system intended to enhance its performance, which included supplementary control surfaces designed to deflect symmetrically and automatically to alleviate gust loads. Shortly after takeoff, an electrical failure in this system caused one of these control surfaces to deploy separately, causing an uncommanded roll. The resulting aircraft upset caused the pilot significant surprise and difficulty in controlling the aircraft. The pilot was not aware of supplementary procedures associated with the modification. The procedures did not adequately characterise the significance of the system failure, nor address the failure in all anticipated flight conditions. Certification flight tests of the system did not reveal the severity of possible outcomes.

Flight recorders

The airplane’s CVR, an L-3/Fairchild FA2100-1020, is a solid-state CVR that records 120 minutes of digital audio. Specifically, it contains a 2-channel recording of the last 120 minutes of operation and separately contains a 4-channel recording of the last 30 minutes of operation. The CVR sustained significant structural damage; the outer case was removed, and the interior crash-protected case did not appear to have any heat or structural damage. Digital audio was successfully downloaded from the crash-survivable memory unit at the NTSB Vehicle Recorder Division, and a transcript was prepared.

Medical and Pathological Information

The Clark County Coroner's Office, Jefferson, Indiana, recovered the remains of the pilot but was unable to perform an autopsy or obtain suitable samples for toxicology testing. The coroner ruled the cause of death as blunt force trauma.

Tests and Research

Airplane Performance

The airplane performance study compared the roll rate in the accident scenario to roll rates related to a possible ATLAS malfunction. Certification failure assessment flight tests for the system found that at speeds of 240 kts, an initial bank angle of 30°, and a maximum unfavorable fuel imbalance (critical failure condition), a near full asymmetric deflection of the TACS resulted in a roll rate of greater than 20° per second, but it was recoverable. In the flight test, the pilot reacted to the full asymmetric TACS deflection within 3 seconds and was able to counteract the roll induced by the asymmetric TACS deflection.

For the accident flight, at the start of the left roll, the airplane’s airspeed was calculated to be about 240 kts with the wings approximately level. The accident roll rate of 5° per second was significantly less than the flight test data provided for a fully asymmetric TACS deflection at a critical failure initial condition. It is possible that the system was not experiencing a full asymmetric failure or that the full possible roll rate could not be induced because the airplane was not initially in the critical failure condition. The roll rate did change from negative to positive, and the roll angle did recover from 90° left wing down to 60° left wing down before impact. If an asymmetric TACS deflection caused the left roll, it is possible the pilot was able to roll the airplane back to the right but not enough to fully recover and arrest the descent. Because the airplane was not equipped with a flight recorder, control surface deflections and pilot inputs are unknown.





20 comments:

  1. Very sad event. Reminds one that in any out of control sequence, removing power takes energy out of the system and lets the aerodynamics of flight work without additional complications. Nothing wrong with flying a sailplane for a few moments until you get control back. Fly the plane, then the system. With autopilots pilots are mentally out of the loop for those critical seconds. 737MAX being an example. Countless other commercial airline accidents too. All pilots should start with J3 Cubs and move up!

    ReplyDelete
  2. If pilot had closed throttles to slow plane could he have recovered ?

    ReplyDelete
  3. In reference to the "737MAX being an example", it might be of interest to watch Frontline "Boeings Fatal Flaw" episode 18 on PBS or youtube. They had a American Airline 737 pilot go through the black box data, from the Ethiopian crash, second by second to ascertain whether the correct actions were taken when MCAS was activated. The pilot, visibly shaken stated "the kid got it right". The problem was not with the pilots.

    ReplyDelete
    Replies
    1. Well he didn't get it right because he crashed killing over 100 people when he could have disconnected the ap and lived

      Delete
    2. He did disconnect it at first then the captain reconnected the AP.

      Delete
    3. Frontline "Boeings Fatal Flaw" episode 18 aired September 2021. NTSB issued comments on the investigation just a few days ago that represent a more up to date assessment. This link has that info:
      https://www.msn.com/en-us/travel/news/ntsb-says-bird-strike-likely-caused-deadly-ethiopian-airlines-737-max-crash/ar-AA16HO74

      Delete
  4. It would seem that any well designed enhancement to aircraft control should be able to be de-powered and return to neutral input status such that a human pilot can recover from an unusual attitude.

    Electric pitch trim systems have been known to short out or fail in some way and go to an extreme but there is enough slip-clutch for the pilot to recognize and overcome the immediate problem, pull a breaker and retrim mechanically.

    What is different for this jet? How did this accessory become approved without that criteria being met?

    ReplyDelete
  5. The pilot appears to have been both smart and capable, but I can't imagine what induced him to install an aftermarket flight control system on his jet. Nothing but pity for the passengers who put their lives into his hands.

    ReplyDelete
    Replies
    1. He was one of several contract pilots who flew the aircraft, wasn't the decision maker for how it was equipped.

      Interesting to read a discussion about the conditions required for the autopilot to react by disconnecting. Possible that an AHRS problem initiated the sequence.

      https://data.ntsb.gov/Docket/Document/docBLOB?ID=12879375&FileExtension=pdf&FileName=CEN19FA036%20Tamarack%20Supplemental%20Submission%2020211026-Rel.pdf

      Delete
  6. The pilot has themselves at the yoke. The pilot has an autopilot that works. The pilot has access to a TACS that has no connection with the autopilot but can malfunction and get into an argument with the pilot and autopilot as to who is going to have majority control in the roll axis.

    I vote the TACS gets off the bird and stays off.

    I

    ReplyDelete
    Replies
    1. I'm sick of these die-by-wire flight control systems overriding the pilot.

      Delete
  7. If you read the CVR transcript, you can tell this pilot was well disciplined and professional in his checklists and procedures. Definitely a stellar airman. If this could happen to him, it could happen to any of us!

    ReplyDelete
    Replies
    1. We need more of this... without it, half of this report would've been empty:

      "The airplane was equipped with an aircraft recording system (AReS), which recorded aircraft system maintenance data to help with maintenance troubleshooting procedures. Data were stored on a compact flash card installed in the AReS recording unit. The unit was not required to be installed, nor was it certified to FDR regulatory standards for crashworthy data storage or required parameters."

      Delete
  8. The lawsuit for this mishap was settled recently. Interesting the article notes that the manufacturer, Tamarack's appealing the NTSB's findings. https://darik.news/indiana/lawsuit-settled-in-indiana-plane-crash-that-killed-losity-founder/839219.html

    ReplyDelete
    Replies
    1. Been a while since Tamarack submitted the dispute to NTSB, but interesting to read their contention regarding conditions for autopilot disconnect:
      https://drive.google.com/file/d/1kLptI4tN9M8bXKEEFZSIwsL-MASG1qWL/view?usp=sharing

      Delete
    2. What's going on with KR? Seems like there's nothing new again for quite awhile

      Delete
    3. Kathryn is vacationing outside of the US. She will be returning in Spring 2023. Only 23 days, 9 hours, 40 minutes, and 5 seconds until Spring. Not that I'm counting... 💮

      Delete
  9. The total time from the beginning of the left roll until ground impact was about 35 seconds.

    ReplyDelete