Socata TBM-900

Sterna Aviation

The accident occurred as the aircraft was preparing to land at Fairoaks Airport at the end of a private flight from Ronaldsway Airport on the Isle of Man. On board were the aircraft commander and a passenger who occupied the front right seat. As the aircraft neared Fairoaks, the pilot listened to the Farnborough ATIS broadcast, which reported a visibility of 4,000 m in mist. He and the passenger discussed the visibility, and agreed that they would proceed to Fairoaks while retaining the option to divert to Farnborough Airport (9 nm to the south-west) if a landing was not possible. The visibility at Fairoaks was recorded as 4,500 m, with ‘few’ clouds at 4,000 ft and a surface wind of 3 kt from 240°. Runway 24 was in use with a left-hand circuit. The circuit height, based on the Fairoaks QNH was 1,100 ft (the elevation of Fairoaks Airport is 80 ft amsl). Runway 24 is a hard runway, 813 m long and 27 m wide. The pilot identified the airfield visually, although there was low lying mist in the area. In order to maintain visual contact with the landing area he joined the circuit and flew a downwind leg that was closer to the runway than usual. He recalled carrying out the pre-landing checks while downwind, including lowering the landing gear and extending the flaps to the takeoff position2 . Based on a final approach with flaps at the landing setting, the pilot planned for an initial approach speed of 90 kt, reducing to a final approach speed of 80 kt. The pilot recalled the aircraft being slightly low as it turned from the downwind leg onto its final approach track. He believed he had selected flaps to the landing position, and recalled seeing the airspeed just below 90 kt, which prompted him to increase power slightly. The aircraft flew through the extended runway centreline and the pilot increased the bank angle to regain it. The pilot’s next recollection was of being in a right bank and seeing only sky ahead. He pushed forward on the control column and attempted to correct the bank with aileron. The aircraft then rolled quickly in the opposite direction and he again applied a correction. He became aware of being in an approximately wings-level attitude and seeing the ground approaching rapidly. He responded by pulling back hard on the control column, but was unable to prevent the aircraft striking the ground. He did not recall hearing a stall warning, or any other audio warning, before the loss of control occurred. The aircraft struck flat ground and slid for about 85 m before coming to rest against a treeline, about 500 m from Runway 24 and approximately on the extended centreline. The propeller was destroyed in the accident sequence and the landing gear legs detached, causing damage to the wings which included a ruptured fuel tank. In the latter stages of the slide the aircraft yawed right, coming to rest heading approximately in the direction from which it had come. The pilot and passenger remained conscious but had both suffered injury. The passenger saw flames from the region of the engine and warned the pilot that they needed to evacuate. He went to the rear of the cabin, opened the main door and left the aircraft. The pilot initially attempted to open his side door, but his right arm was injured and he was unable to open the door with only his left. He therefore followed the passenger out of the rear door.

Private Brazilian

The single engine aircraft departed Florianópolis-Hercilio Luz Airport at 0515LT on a private flight to Ji-Paraná, carrying one passenger and one pilot. While climbing by night at an altitude of 3,600 feet, the pilot initiated a right turn. Then the aircraft completed a 360 turn and crashed in the sea off Campeche Island. Few debris were found the following morning floating on water and the main wreckage was found two weeks later. Both occupants were killed.

New 51LG

The commercial pilot and his wife departed New York in their turboprop airplane on a crosscountry flight to Florida. About 1 hour 40 minutes into the flight and while cruising at flight level (FL) 280, the pilot notified air traffic control (ATC) of an abnormal indication in the airplane and requested a descent to FL180. The responding controller instructed the pilot to descend to FL250 and turn left 30°, and the pilot acknowledged and complied with the instruction; he then again requested a lower altitude. Although the pilot declined emergency handling and did not specify the nature of the problem, the controller independently determined that the flight had encountered a pressurization issue and immediately coordinated with another ATC facility to clear nearby traffic. The controller then issued instructions to the pilot to descend to FL200 and change course; however, the pilot did not comply with the assignments despite acknowledging the instructions multiple times. The pilot's failure to comply with the controller's instructions, his long microphone pauses after concluding a statement over the radio, and his confusion were consistent with cognitive impairment due to hypoxia. Further, the pilot's transmissions to ATC indicated impairment within 2 minutes 30 seconds of reporting the abnormal indication, which is consistent with the Federal Aviation Administration's published time of useful consciousness/effective performance time ranges for the onset of hypoxia. Military airplanes were dispatched about 30 minutes after the pilot's final transmission to ATC to intercept and examine the airplane. The pilots of the military airplanes reported that the airplane appeared to be flying normally at FL250, that both occupants appeared to be asleep or unconscious, and that neither occupant was wearing an oxygen mask. Photographs taken from one of the military airplanes revealed that the airplane's emergency exit door was recessed into the fuselage frame, consistent with a depressurized cabin. The military airplanes escorted the airplane as it continued on a constant course and altitude until it approached Cuban airspace, at which point they discontinued their escort. Radar data indicated that the airplane continued on the same flight track until about 5 hours 48 minutes after takeoff, when it descended to impact in the Caribbean Sea north of Jamaica. The flight's duration was consistent with a departure with full fuel and normal cruise endurance. Some of the wreckage, including fuselage and engine components, was recovered from the ocean floor about 4 months after the accident. Data recovered from nonvolatile memory in the airplane's global air system controller (GASC) indicated that several fault codes associated with the cabin pressurization system were registered during the flight. These faults indicated that the overheat thermal switch (OTSW), which was associated with overheat protection, had activated, which resulted in a shutdown of the engine bleed air supply to the cabin pressurization system. Without a bleed air supply to maintain selected cabin pressure, the cabin altitude would have increased to the altitude of the outside environment over a period of about 4 minutes. The faults recorded by the GASC's nonvolatile memory and associated system alerts/warnings would have been displayed to the pilot, both as discrete system anomaly messages on the crew alerting system (CAS) and as master warning and/or master caution annunciations. A witness report indicated that the pilot was known to routinely monitor cabin altitude while flying in the airplane and in his previous pressurized airplanes. Based on his instrument scanning practices and the airplane's aural warning system, he likely would have observed any CAS message at or near its onset. Thus, the CAS messages and the associated alerts were likely the precipitating event for the pilot's call to ATC requesting a lower altitude. The pilot was likely not familiar with the physiological effects of hypoxia because he had not recently been in an altitude chamber for training, but he should have been familiar with the airplane's pressurization system emergency and oxygen mask donning procedures because he had recently attended a transition course for the accident airplane make and model that covered these procedures. However, the pressurization system training segment of the 5-day transition course comprised only about 90 minutes of about 36 total hours of training, and it is unknown if the pilot would have retained enough information to recognize the significance of the CAS messages as they appeared during the accident flight, much less recall the corresponding emergency procedures from memory. Coupled with the pilot's reported diligence in using checklists, this suggests that he would have attempted a physical review of the emergency procedures outlined in the Pilot's Operating Handbook (POH). A review of the 656-page POH for the airplane found that only one of the four emergency checklist procedures that corresponded to pressurization system-related CAS messages included a step to don an oxygen mask, and it was only a suggestion, not a mandatory step. The combined lack of emergency guidance to immediately don an oxygen mask and the rapid increase in the cabin altitude significantly increased the risk of hypoxia, a condition resistant to self-diagnosis, especially for a person who has not recently experienced its effects in a controlled environment such as an altitude chamber. Additionally, once the pilot reported the problem indication to ATC, he requested a descent to FL180 instead of 10,000 ft as prescribed by the POH. In a second transmission, he accepted FL250 and declined priority handling. These two separate errors were either early signs of cognitive dysfunction due to hypoxia or indications that the pilot did not interpret the CAS messages as a matter related to the pressurization system. Although the cabin bleed-down rate was 4 minutes, the pilot showed evidence of deteriorating cognitive abilities about 2 minutes 30 seconds after he initially reported the problem to ATC. Ultimately, the pilot had less than 4 minutes to detect the pressurization system failure CAS messages, report the problem to ATC, locate the proper procedures in a voluminous POH, and complete each procedure, all while suffering from an insidious and mentally impairing condition that decreased his cognitive performance over time. Following the accident, the airplane manufacturer revised the emergency procedures for newly manufactured airplanes to require flight crews to don their oxygen masks as the first checklist item in each of the relevant emergency checklists. Further, the manufacturer has stated that it plans to issue the same revisions for previous models in 2017. The airplane manufacturer previously documented numerous OTSW replacements that occurred between 2008 and after the date of the accident. Many of these units were removed after the GASC systems in their respective airplanes generated fault codes that showed an overheat of the bleed air system. Each of the OTSWs that were tested at the manufacturer's facility showed results that were consistent with normal operating units. Additionally, the OTSW from the accident airplane passed several of the manufacturer's functional tests despite the presence of internal corrosion from sea water. Further investigation determined that the pressurization system design forced the GASC to unnecessarily discontinue the flow of bleed air into the cabin if the bleed air temperature exceeded an initial threshold and did not subsequently fall below a secondary threshold within 30 seconds. According to the airplane manufacturer, the purpose of this design was to protect the structural integrity of the airplane, the system, and the passengers in case of overheat detection. As a result of this accident and the ensuing investigation, the manufacturer made changes to the programming of the GASC and to the airplane's wiring that are designed to reduce the potential for the GASC to shut off the flow of bleed air into the cabin and to maximize the bleed availability. Contrary to its normal position for flight, the cockpit oxygen switch was found in the "off" position, which prevents oxygen from flowing to the oxygen masks. A witness's description of the pilot's before starting engine procedure during a previous flight showed that he may not have precisely complied with the published procedure for turning on the oxygen switch and testing the oxygen masks. However, as the pilot reportedly was diligent in completing preflight inspections and checklists, the investigation could not determine why the cockpit oxygen switch was turned off. Further, because the oxygen masks were not observed on either occupant, the position of the oxygen switch would not have made a difference in this accident.