The following information provides an awareness of problems that might be avoided in the future. The information is based on final reports by official investigative authorities on aircraft accidents and incidents.
Jets
Fly-by-Wire Protections Degraded
Airbus A330s. No damage. No injuries.
Ice crystals blocked the pitot probes on two Airbus A330s that were cruising at high altitudes in the vicinity of convective weather activity, causing erroneous airspeed indications and reduced autoflight systems operation, according to a report issued in June by the U.S. National Transportation Safety Board (NTSB).
The incidents reported by NTSB involved an A330-200 of Brazilian registry that was en route with 176 people aboard from Miami to São Paulo, Brazil, on May 21, 2009, and an A330-300 of U.S. registry that was en route with 217 people from Hong Kong to Tokyo on June 23, 2009.
“Crew statements and recorded data for both flights did not indicate any airplane anomalies prior to the events,” the report said.
The Brazilian airplane was at Flight Level (FL) 370 (approximately 37,000 ft) over Haiti when the flight crew noticed an abrupt decrease in outside air temperature and observed St. Elmo’s fire, a coronal discharge of plasma that produces a faint flame-like glow on an aircraft flying through an electrically charged atmosphere. The airplane’s air data reference system ceased operating, primary displays of airspeed and altitude were lost, the autopilot and autothrottle disengaged, and the fly-by-wire system reverted from normal control law to alternate control law, which provides fewer protections against exceeding performance limitations.
“The flight crew continued using backup instruments,” the report said. “After approximately five minutes, primary data was restored. … The crew determined they could not restore normal law and continued the flight under the appropriate procedures.” The airplane was landed in São Paulo without further incident.
In the second incident, the crew of the U.S. airplane was using the on-board weather radar system to avoid thunderstorms while flying over Japan at FL 390. However, “just prior to the event, the airplane entered an area of cirrus clouds with light turbulence and moderate rain, with a brief period of intense rain and hail aloft,” the report said.
The autopilot and autothrottle disengaged, fluctuating airspeed indications were displayed, and a stall warning was generated. The crew “reported that the airspeed fluctuations and warnings lasted about one minute, and they controlled the airplane by pitch and power reference, per applicable checklist procedures, until normal airspeed indications returned,” the report said.
Airspeed fluctuations occurred again briefly as the crew turned the airplane farther away from the convective activity. After about two minutes, “the airspeed indicators returned to normal, and the crew re-engaged the autopilot and completed the flight in alternate [control] law,” the report said.
Investigators determined that the incidents were initiated when at least two of the three pitot probes on each airplane were blocked by an accretion of ice crystals.
The electrically heated pitot probes measure total air pressure, which is converted by three air data modules (ADMs) into electronic signals that are used — along with static pressure measured by the airplane’s static ports — by three associated air data inertial reference units to calculate airspeed. The data generated by the ADMs are compared by independent flight control computers that disengage autoflight systems and adjust the flight control law if discrepancies exceed programmed limits.
A330s originally were equipped with Goodrich 0851GR pitot probes. “In 2001, following some inconsistent speed problems, Airbus replaced the original 0851GR probes with either Goodrich 0851HL probes or Thales [C16195QAA] probes,” the report said. “Operators had the option to install either of those probes in any location and could have any mix of both types on the same airplane.”
The Thales “AA” probes have been found to be more susceptible to high-altitude ice crystal icing than other approved probe designs. In 2007 and 2008, Airbus recommended that A330 operators replace any AA-series probes with Thales C16195BA (“BA”) probes. Tests performed by Thales in an icing wind tunnel have shown that the BA probes are more resistant than the AA probes to blockage.
The European Aviation Safety Agency (EASA) and the U.S. Federal Aviation Administration in August 2009 issued airworthiness directives requiring the replacement of all AA probes on A330s and A340s. The directives required Goodrich 0851HL probes at the no. 1 (captain’s) and no. 3 (standby) positions, and either a 0851HL probe or a Thales BA probe at the no. 2 (first officer’s) position.
The NTSB report discussed two other occurrences — an accident and an incident — involving “unreliable airspeed events” in A330s. The accident, which is being investigated by the French Bureau d’Enquêtes et d’Analyses (BEA), occurred on June 1, 2009, when an A330-200 — Air France Flight 447 — equipped with Thales AA probes descended into the Atlantic Ocean during a flight from Rio de Janeiro, Brazil, to Paris.
All 228 people aboard the airplane were killed. Based on preliminary findings, the BEA has called on EASA to review icing-certification standards for pitot probes.
EASA in August proposed an airworthiness directive that would require A330/340 flight control computer software changes to prevent re-engagement of autoflight systems with unreliable airspeed data.
The incident cited by the NTSB report involved an A330, equipped with Goodrich 0851HL pitot probes, near Guam on Oct. 28, 2009. The incident was investigated by the Australian Transport Safety Bureau (ATSB), which reported in January 2011 that the flight crew had been maneuvering at FL 390 to avoid cumulus buildups during a flight from Japan to Australia with 214 people aboard.
Shortly after the A330-200 entered an area of light precipitation, St. Elmo’s fire appeared on the windshield, and “there was a brief period of disagreement between the aircraft’s three sources of airspeed information,” the ATSB report said. The autopilot and autothrottle disengaged, the flight control system reverted to alternate law, and several warning and cautionary messages were generated.
“The airspeed disagreement was due to a temporary [about five-second] obstruction of the captain’s and [the] standby pitot probes, probably due to ice crystals,” the report said, noting that the aircraft had experienced a similar incident eight months earlier. “Both of the events occurred in environmental conditions outside those specified in the certification requirements for the pitot probes.”
Faulty Coupling Leaks Fuel
Boeing 757-28A. No damage. No injuries.
The 757 was at FL 360, en route from Turkey to London Gatwick Airport with 226 passengers and eight crewmembers aboard the morning of June 12, 2010, when a “FUEL CONFIG” warning appeared on the engine indicating and crew alerting system. The flight crew noticed a fuel imbalance, with 800 kg (1,764 lb) more fuel in the right wing tanks than in the left wing tanks.
While performing the quick reference handbook procedure for the fuel imbalance, the commander found a discrepancy of 800 kg between the fuel-consumed and the fuel-remaining indications. This discrepancy indicated a fuel leak because “fuel flow indications remained equal for both engines,” said the report by the U.K. Air Accidents Investigation Branch (AAIB).
The commander considered diverting the flight to Paris but decided to continue to London because the aircraft was nearing the beginning-of-descent point to Gatwick. “He made a PAN call [a declaration of an urgency] to London ATC [air traffic control], who cleared the aircraft for an immediate approach to Runway 26L with no speed or altitude constraints,” the report said.
The crew shut down the left engine during the landing roll as a precaution against fire and parked and secured the aircraft on Runway 08L, where it was inspected by airfield fire and rescue services personnel. A substantial amount of fuel had spilled from the left wing, but there was no fire.
The aircraft then was towed to a remote stand, where the passengers and crew disembarked normally.
A total of 3,800 kg (8,378 lb) of fuel remained in the aircraft’s tanks. The commander estimated that 1,300 kg (2,866 lb) of fuel had leaked from the left wing.
A company maintenance engineer traced the leak to a sealing ring in a coupling between the left engine’s high-pressure fuel pump and fuel governor overspill return tube. The sealing rings in both engines were replaced, and ground runs at maximum power revealed no further leakage.
“Further detailed investigation into the fuel leak was not possible, as the seals removed from the aircraft were discarded, rather than being retained as is required by the operator’s engineering organization’s procedures,” the report said.
Gust Launches Jet Bridge
Embraer 135KL. Minor damage. No injuries.
The airplane was at a gate at Dubuque (Iowa, U.S.) Regional Airport, being prepared for takeoff with 44 passengers and three crewmembers the morning of April 3, 2011, when a strong gust pushed the jet bridge about 25 ft (8 m) into the Embraer’s forward fuselage, creating a 20-in (51-cm) gash below the captain’s side window.
“The airport had deactivated the brake system on the jet bridge during the winter months since the brakes would routinely freeze,” the NTSB report said. “The gate agents who were operating the jet bridge attempted to keep it from being blown into the airplane, but, with the brake system deactivated, they were unable to do so.”
A further complication was that the emergency stop button inside the jet bridge not only was ineffective in applying the brakes, it also isolated power to the control panel, rendering the steering system inoperative.
The report noted that the day before the incident, a technician had encountered problems while trying to reactivate the jet bridge’s brake system. Repairs to complete the scheduled reactivation of the system had not been performed when the incident occurred.
Unstable Approach Leads to Overrun
Cessna Citation CJ2. Minor damage. No injuries.
Excessive airspeed throughout the descent, approach and landing was a factor in the CJ2’s runway excursion at Kassel, Germany, the afternoon of March 24, 2010, said a report on the serious incident by the German Federal Bureau of Aircraft Accident Investigation.
The aircraft was inbound with a passenger and two pilots from Stuttgart. The second-in-command was flying from the left seat. Both pilots were familiar with Kassel-Calden Airport, having flown there several times. The weather at the airport was clear, and surface winds were from 160 degrees at 10 kt.
Nearing the airport from the southwest, the crew established the CJ2 on a left downwind leg to land on Runway 22, which was 1,500 m (4,921 ft) long and 30 m (98 ft) wide.
From recorded ATC radar data, investigators estimated that indicated airspeed had averaged 295 kt during the descent and 210 kt during the initial approach. On final approach, indicated airspeed was 190 kt.
“The crew subsequently reported that the aircraft crossed the Runway 22 threshold at about 130 kt, with the flaps set at the first position (15 degrees),” the report said, noting that the recommended procedure was to use a reference landing speed (VREF) of 103 kt and full flaps (35 degrees). “Throughout, the speed was too high for a stable and well-controlled approach, even under visual flight conditions.”
Neither pilot called for a go-around. The CJ2 touched down at about 120 kt and 572 m (1,877 ft) from the runway threshold, “from which point continual wheel/brake marks were left by both main landing gear,” the report said.
Realizing that the aircraft could not be stopped on the runway, the crew intentionally steered it off the left side. This action “prevented a collision with the Runway 04 approach lights and possibly also the localizer antenna, which are all mounted on concrete plinths [pedestals],” the report said.
“The decision to guide the aircraft toward open space avoided serious damage to the aircraft.”
The CJ2 came to a stop, with the wheels and tires on the main landing gear sunk deeply in soft ground, 53 m (174 ft) from the runway edge.
Crewmember Falls From Door
Boeing 717-200. No damage. One serious injury.
While preparing the 717 for departure from Ayers Rock, Northern Territory, Australia, the afternoon of March 4, 2010, a cabin crewmember had difficulty unlatching the open left forward door from the fuselage. Another cabin crewmember, who had shut the right forward door, came to help.
“The assisting cabin crewmember placed one foot outside the aircraft onto the portable stairs to assist with closing the door,” the ATSB report said.
“At this point, ground personnel commenced moving the portable stairs [away from the aircraft], and the assisting cabin crewmember fell through the open door onto the apron, [sustaining] a fractured left arm, a sprained right wrist and some other minor injuries.”
The marshaler and the operator of the portable stairs had not been able to see the door from their positions. The report said that after the accident, the ground handling services provider adopted a requirement for one ground crewmember to remain at the top of the portable stairs and observe the door being closed and locked before signaling for the stairs to be removed.
Turboprops
Turbine Blades Shed
Cessna 208 Caravan. Destroyed. No injuries.
The Caravan had been chartered to transport five employees of an industrial services company and a cargo of hazardous material — including blasting detonators, ammonium nitrate and nitromethane — the afternoon of Sept. 15, 2009. The airplane was climbing through 8,500 ft when a catastrophic engine failure occurred.
The pilot declared an emergency and prepared to land the 208 in a field near Sheffield, Massachusetts, U.S. The right wing struck a tree and separated on approach to the field, but the airplane came to a stop upright, the NTSB report said. The passengers and the pilot were able to exit the Caravan before it was engulfed in flames. The ammonium nitrate and nitromethane were consumed by the fire, but none of the detonators, which were stored in a metal box, ignited.
Investigators determined that the engine’s first-stage sun gear splines had failed, causing the power turbine disk to overspeed and release turbine blades. The engine had accumulated 7,620 hours, including 65 hours since it was overhauled 19 months before the accident.
Maintenance records showed that “the sun gear found on the accident engine was previously removed from another engine due to ‘spalled gear teeth’ about seven years prior to the accident,” the report said. “The condition of the sun gear when installed on the accident engine could not be determined.”
Control Lost in Crosswind
CASA 212-200. Substantial damage. No injuries.
The flight crew was conducting a cargo flight the afternoon of Sept. 18, 2009, from Nome, Alaska, U.S., to Savoonga, which had surface winds from 010 degrees at 26 kt, gusting to 34 kt, 5 mi (8 km) visibility in light rain and an overcast at 800 ft.
The captain used full flaps for the approach to Runway 05, which was 4,400 ft (1,341 m) long and 100 ft (30 m) wide, and constructed of gravel. “The captain reported that during the landing roll, despite the use of differential power and other control adjustments, he could not maintain directional control,” the NTSB report said. The CASA veered off the right side of the runway and struck a ditch.
The report noted that the maximum demonstrated crosswind component for the airplane is 20 kt. The operating manual recommends reducing the crosswind component by 25 to 75 percent for landing on a slippery runway and limiting flap extension to 15 degrees in a strong crosswind.
Oil Leaks Traced to Damaged Seals
Bombardier DHC-8-102. Minor damage. No injuries.
After a maintenance inspection at Exeter, England, the Dash 8, which was of Greek registry, was flown to East Midlands for repainting on April 16, 2010. The flight was uneventful; but, after the aircraft was parked, an engineer observed oil spots beneath both engine nacelles. The engineer tightened oil-system elbow joints on both engines and observed no leaks during a brief ground run following repainting.
During the positioning flight back to Exeter eight days later, a master warning was generated about 10 minutes after takeoff, and the crew noticed a loss of oil pressure in the right engine. “The copilot went into the cabin and observed what appeared to be a major oil leak coming from the right engine, with oil flowing down the right side of the aircraft fuselage,” said the AAIB report.
The crew shut down the right engine, declared an urgency and requested ATC vectors directly to Exeter. Five minutes later, left-engine oil pressure began to fluctuate. “The copilot again entered the cabin and, this time, observed an oil leak from the left engine,” the report said. “The commander made the decision to divert to the nearest suitable airfield and, with ATC assistance, diverted to Bristol, which was 25 nm [46 km] ahead of the aircraft.” The Dash 8 was landed at Bristol International Airport without further incident.
“The oil leaks were traced to damaged O-ring seals within the oil cooler fittings on both engines,” the report said. “Both oil coolers had been removed and refitted during the base maintenance check at Exeter. It was probably during reinstallation that the O-ring seals were damaged,” in part by overtightening and misalignment of the fittings.
The technician who had reinstalled the oil coolers told investigators that he was under some time pressure to complete the job, which was difficult because of the small space in which the components are located. “He needed two hands to install each pipe and used a torch [flashlight], held in his mouth, to illuminate the pipe and oil cooler fitting,” the report said.
When the maintenance inspection was completed, engine ground runs were performed per the aircraft maintenance manual to test systems and check for oil leaks, the report said. “However, a leak check of the oil cooler fittings was not specifically called for.”
Parking Brake Set Improperly
Beech King Air E90. Substantial damage. No injuries.
After landing at Colorado Springs, Colorado, U.S., the night of Sept. 4, 2010, the pilot taxied the King Air to the ramp and was marshaled by ground personnel to a parking spot. He then set the parking brake and continued conducting a checklist with the engines running.
“Unbeknownst to the pilot, the airplane began to roll forward until it impacted a tug and ground power unit located approximately 25 ft [8 m] across the ramp,” the NTSB report said. The nose landing gear collapsed, and the nose of the airplane came to rest atop the tug. The pilot shut down the engines, and he and his three passengers exited the King Air without assistance.
NTSB determined that the probable cause of the accident was “the pilot’s failure to ensure that the airplane’s parking brake was properly set before diverting his attention to other tasks.”
Piston Airplanes
Upside-Down in a Thunderstorm
Cessna 421C. Destroyed. Five fatalities.
The pilot was aware of convective activity on his route from McKinney, Texas, U.S., to Tampa, Florida, and planned to use the airplane’s weather radar system and lightning detector, pilot reports and ATC assistance to avoid the thunderstorms during the July 8, 2009, afternoon flight.
The 421 was over the Gulf of Mexico when the pilot requested assistance from ATC to exit an area of turbulence. The Jacksonville Center controller told the pilot that if he continued straight ahead for about two minutes, he should be clear of the weather, according to the NTSB report.
A few seconds later, the pilot reported significant turbulence and downdrafts of 2,000 fpm. “He then requested a course reversal to exit the weather before he declared an emergency and advised ATC that the airplane was upside-down,” the report said. “There were no further transmissions from the pilot, and radar contact with the airplane was lost.”
Recorded ATC radar data showed that the 421 had entered rapidly developing cumulonimbus and an area of radar echoes indicating extreme precipitation intensities. Investigators concluded that the pilot lost control of the airplane, which subsequently broke up and descended into the gulf about 25 nm (46 km) northwest of Port Richey, Florida.
“The airplane’s airborne weather radar may have been unable to provide an accurate representation of the radar echoes along the aircraft’s flight path” due to attenuation, or the weakening and scattering of the transmitted radar energy by the intense precipitation, the report said. “Therefore, the final penetration of the intense portion of the storm was likely unintentional.”
Engine-Out Simulation at VMC
Beech 60 Duke. Destroyed. One fatality, one serious injury.
Shortly after takeoff from Edenton, North Carolina, U.S., for an instrument proficiency check the evening of June 7, 2010, the flight instructor retarded the left throttle to simulate an engine failure. The airplane was less than 100 ft above ground level, and indicated airspeed was at, or a few knots below, the Duke’s minimum single-engine control speed (VMC), according to the NTSB report.
“The pilot attempted to advance the throttles but was unable [to] since the flight instructor’s hand was already on the throttles,” the report said.
“The airplane veered sharply to the left and rolled. The pilot was able to level the wings just prior to the airplane colliding with trees and terrain.” The pilot sustained serious injuries, and the flight instructor was killed.
The pilot told investigators that before beginning the proficiency check, the flight instructor had not briefed him on procedures for simulating an engine failure and had mentioned that he had not flown a Duke “in a while.”
On Auxiliary Tanks Too Long
Cessna 401. Substantial damage. Three serious injuries.
After a three-hour aerial mapping flight the afternoon of June 18, 2010, the 401 was on a 3-nm (6-km) final to land at Plymouth, Massachusetts, U.S., when both engines lost power.
While trying unsuccessfully to restart the engines, the pilot noticed that the fuel quantity indicators showed about 25 gal (95 L) remaining in the main tanks and 2–5 gal (8–19 L) remaining in the auxiliary tanks.
“The pilot then selected a forced-landing site between two large trees and landed the airplane in heavily wooded terrain,” the NTSB report said.
Investigators determined that the pilot had not ensured that the fuel selectors were positioned to the main tanks, which is the first task on the “Before Landing” checklist. The 401’s auxiliary tanks are designed for use only in cruise flight.
Fuel-Fed Fire Erupts on Departure
Piper Chieftain. Destroyed. One fatality, one minor injury.
Extensive maintenance, including the installation of four extra fuel tanks, had been performed to prepare the Chieftain to be ferried from the United States to Korea. Shortly after the airplane departed from Las Vegas for the first leg of the flight the afternoon of Aug. 28, 2008, a fire erupted in the right engine compartment.
The airplane, a Colemill Panther conversion, was about 7 nm (13 km) from North Las Vegas Airport when the pilot reversed course and declared an emergency. He feathered the right propeller but did not accelerate to best single-engine rate of climb speed or complete other actions required to configure the airplane for single-engine flight, said a report issued by NTSB in July 2011. As a result, the pilot was unable to arrest the descent rate.
The Chieftain struck trees and power lines, and came to a stop upside-down next to a house about 1.25 nm (2.3 km) from the runway. The pilot was killed, and one of the five people in the house received minor injuries.
The report said that the fire had originated in the vicinity of the engine-driven fuel pump and its fittings. Although extensive damage precluded a definitive conclusion about the cause of the fire, the report said that it likely had been fed by fuel leaking from either a supply line “B” nut, a broken fuel line or the fuel pump itself.
Helicopters
Fuel Cross-Check Neglected
Bell 206B. Substantial damage. Two serious injuries.
The JetRanger was about 15 minutes into a 20-minute sightseeing flight along the coast near Coomera, Queensland, Australia, the afternoon of June 10, 2009, when the “FUEL PUMP” warning light illuminated, indicating low fuel pressure. “The pilot believed he had sufficient fuel on board and continued the flight,” said the ATSB report.
The helicopter was descending to land at the Coomera helipad when the engine lost power due to fuel exhaustion. “During the final stages of the autorotative landing, the pilot was unable to arrest the helicopter’s descent rate, and the helicopter struck the ground heavily,” the report said. Two of the four passengers sustained serious injuries.
Examination of the JetRanger showed that the fuel gauge may have been over-reading. “The operator’s practice when calculating the quantity of fuel to be added during refueling relied on the fuel gauge reading, without using an independent method to cross-check that reading against the actual fuel tank quantity,” the report said.
Downdraft Causes Hard Landing
Aerospatiale AS 355F-1. Substantial damage. One serious injury, three minor injuries.
The pilot was maneuvering the helicopter to film an automobile participating in a hill climb at Pikes Peak, Colorado, U.S., on Sept. 17, 2010. A sharp turn in the racecourse near the top of the peak required the pilot to fly away from the mountain and then perform a 180-degree turn back toward the peak.
“After turning 180 degrees and on the inbound leg toward the mountain, the helicopter encountered a downdraft and was pushed toward rising terrain,” the NTSB report said. “Helicopter performance at that altitude did not provide the pilot with a power margin great enough to arrest the descent.”
The pilot attempted to land on a road, where the helicopter touched down hard and rolled over. The pilot sustained serious injuries.
Fatigue Cited in Rotor Blade Failure
Bell 206L-1. Destroyed. Three fatalities.
The emergency medical services crew was returning from a fund-raising event in Burney, Indiana, U.S., to their base in Rushville, Indiana, the afternoon of Aug. 31, 2008, when an 8-ft (2-m) section of a main rotor blade separated, rendering the LongRanger uncontrollable. The helicopter crashed in a corn field, killing the pilot, flight nurse and paramedic.
“Metallurgical examination determined that the blade failed as a result of fatigue cracking,” the NTSB report said. “The origin of the fatigue crack coincided with a large void between the blade spar and an internal lead weight.
“Further investigation determined that the presence of residual stress in the spar from the manufacturing process, in combination with excessive voids between the spar and the lead weight, likely resulted in the fatigue failure of the blade.”
Download the PDF of this article, which includes the Preliminary Reports table.