A cabin pressurization system that was prone to unnecessary shutdowns and an emergency checklist that placed system troubleshooting over ensuring continued consciousness were involved in the loss of two lives and a Daher-Socata TBM 900 the morning of Sept. 5, 2014, according to the U.S. National Transportation Safety Board (NTSB).
The TBM 900 was on a private flight from New York to Florida when its airflow ducts overheated and the environmental control system reacted by stopping the flow of pressurizing bleed air into the cabin. The pilot told air traffic control (ATC) that he needed to descend but declined to declare an emergency, which would have prompted priority handling. Controllers kept the airplane high while coordinating a progressive descent. Without the flow of bleed air, the TBM’s cabin depressurized within four minutes. Neither the pilot nor his passenger donned their oxygen masks; after they lost consciousness, the airplane continued flying on autopilot for several hours until the fuel was exhausted. It then descended into the Caribbean Sea.
The pilot, 68, had recently purchased the TBM 900 after owning two previous models, a 700 and an 850, in which he had logged nearly 4,000 flight hours. He had a total of about 7,100 flight hours and held a commercial pilot certificate and an instrument rating. The pilot had completed TBM 900 transition training at SIMCOM Aviation Training about a week before the accident. The five-day course included about 45 minutes of classroom instruction and 45 minutes of simulator training on the airplane’s pressurization system.
“The course’s simulator training included environmental system inspections, failure, the controls for smoke or fume elimination, and emergency descent procedures,” the NTSB report said. “Proper oxygen mask donning procedures were also demonstrated and discussed. The pilot’s instructor at SIMCOM stated that he instructs students to don their oxygen masks before troubleshooting any pressurization system problems.”
There was no record that the pilot had received physiological training in a hypobaric (altitude) chamber. Thus, he “likely was not familiar with the physiological effects of hypoxia,” the report said. “But he should have been familiar with the airplane’s pressurization system emergency and oxygen mask donning procedures [due to his recent training at SIMCOM].”
The passenger, the pilot’s wife, held a private pilot certificate and had about 410 flight hours. She assisted the pilot with radio communications at the beginning of the flight.
Unfamiliar Glass Cockpit
The airplane departed from Rochester, New York, at about 0826 local time for the intended flight to Naples, Florida. The pilot initially was cleared to climb to 9,000 ft and subsequently to Flight Level (FL) 280 (approximately 28,000 ft), the filed cruise altitude.
“The flight proceeded without incident for about 45 minutes,” the report said. “About 0912, ATC lost communications with the airplane for a few minutes.” A Cleveland Center controller attempted several times to assign a new radio frequency for Washington Center, but there was no acknowledgement. Nearly five minutes lapsed before the pilot said, “Ah, something happened. I don’t know what happened to you, but we’re back.” The report did not comment on the possible significance of this incident but said that after the passenger acknowledged a subsequent frequency change, to Atlanta Center, “all further radio communications from the airplane were made by the pilot.”
The report noted that the airplane was equipped with a Garmin G1000 avionics suite, which the pilot and his wife had not used before they acquired the TBM 900. A friend of the pilot’s, who often flew with him and attended the first three days of the SIMCOM training, told investigators that the pilot “used a Garmin G1000 simulator program on his personal computer to familiarize himself with the system in advance of the SIMCOM course as this was his first airplane with a full glass cockpit display.”
‘We Have an Indication That’s Not Correct’
Shortly after establishing radio communication with Atlanta Center at 1003 — about 1 hour and 40 minutes into the flight — the pilot told the controller, “We need to descend, ah, down to about [flight level] one eight zero. We, ah, have an indication that’s not correct in the plane.”
The controller told the pilot to stand by and then coordinated with another sector controller to reroute a nearby airliner so that he could “descend” the TBM 900. The controller then cleared the TBM pilot to descend to FL 250.
“Two five zero, and we need to get lower,” the pilot replied.
“Working on that,” the controller said. “You have traffic [at] twelve o’clock and, ah, fifteen miles northbound [at] flight level two four zero. … Are you declaring an emergency, sir?”
“Ah, not yet, but we’ll let you know,” the pilot replied.
“OK, and, ah, to help you get down … turn, ah thirty degrees left,” the controller said. The pilot acknowledged the instruction.
Although the pilot had not provided specific information on why a descent was necessary, the controller assumed that the pilot was experiencing a problem with the airplane’s pressurization system. He coordinated with another controller to facilitate further descent for the TBM 900. He told the other controller that the pilot was “having a pressurization problem, non-emergency [emphasis added].” The controllers agreed to have the TBM descend to FL 200 and then to FL 180 when the traffic situation allowed.
Overheat Thermal Switch Opens
A brief description of the airplane’s environmental control system and emergency checklists might help to explain what happened aboard the airplane. The TBM 900 uses bleed air taken from two ports in the compressor section of the 850-shp Pratt & Whitney PT6A-66D engine to pressurize, heat and cool the cabin and cockpit, and to defog the windows. These functions are managed by a digital air system controller.
The air system controller normally is set to operate automatically. The controller adjusts the position of a flow control valve to maintain a cabin altitude of zero when the airplane is between mean sea level and 13,500 ft, and subsequently to a maximum of 10,000 ft as the airplane climbs higher.
An overheat thermal switch in the bleed air ducting is designed to open — to protect the cabin from excessive heat (for example, from an engine fire) — when the temperature of the air within the duct reaches 315 degrees C (599 degrees F). When the switch opens, the air system controller closes the flow control valve, which stops pressurizing and air-conditioning airflow into the cabin. The overheat thermal switch will close again, and the air system controller will reopen the flow control valve, if duct temperature decreases below 295 degrees C (563 degrees F) within 30 minutes.
If duct temperature does not decrease, the overheat thermal switch remains open and the flow control valve remains closed. “Without a bleed air supply to maintain selected cabin pressure, the cabin altitude will continue to increase until it equalizes with the ambient altitude,” the report said. “At 28,000 ft, once pressurized air ceases to be supplied, the cabin pressure would bleed down to the ambient atmospheric pressure in about four minutes.”
When a duct overheat occurs, aural and visual warnings are generated, and a BLEED TEMP message is displayed on the crew alerting system (CAS) in the cockpit. The report noted that this message also is a warning that the flow of bleed air into the cabin may be discontinued. However, the BLEED TEMP checklist does not advise the pilot to don an oxygen mask or consider an emergency descent.
If duct temperature does not decrease and the flow control valve remains closed, a BLEED OFF message is annunciated. The seventh step on the BLEED OFF checklist is: “If necessary (no oxygen available) — [conduct an] emergency descent.”
Another condition related to a TBM 900 depressurization is an increase of cabin altitude above 10,000 ft. When this happens, aural and visual warnings are generated, and a CABIN ALTITUDE message appears on the CAS. The second step on the CABIN ALTITUDE checklist is: “Oxygen — use if necessary.” The seventh step is to conduct an emergency descent “if necessary.”
Acknowledgement but No Action
After coordinating with another controller to enable further descent for the TBM 900, the Atlanta Center controller cleared the pilot to descend to FL 200. There was no immediate response from the pilot. The controller tried again, and the pilot responded with the TBM’s call sign (N900KN) and “two zero zero.” The ATC audio recording contained about four seconds of carrier signal after the pilot’s response, indicating that he had kept his radio transmit switch depressed (keyed) momentarily.
The controller then tried twice to clear the pilot to fly directly to TAYLOR, a VOR (VHF omnidirectional radio) in northern Florida. Initially, the pilot keyed his radio transmit switch but said nothing. After the controller repeated the instruction, he replied, “direct TAYLOR, nine hundred kilo november.”
“And november zero kilo november, copy that you got descent to flight level two zero zero,” the controller said. The pilot replied with his call sign. The report said that his voice was faint during this radio transmission.
Although the pilot had acknowledged both the descent clearance and the course change, the airplane neither began the descent to FL 200 nor turned toward TAYLOR. At 1008, the controller repeated the clearances: “November zero kilo november, descend and maintain flight level two zero zero, and you are cleared direct TAYLOR.”
The pilot replied, “direct kilo november nine hundred kilo november.” This was the last radio transmission that ATC received from the airplane.
At 1009, the controller radioed, “November zero kilo november, I don’t know if you’re, ah, understanding me but descend and maintain flight level two zero zero, flight level two zero zero for november niner zero zero kilo november.”
The controller tried several more times to contact the TBM 900 pilot. He also obtained assistance from the pilots of two other airplanes in attempting to contact the TBM, but they, too, had no success.
According to U.S. Federal Aviation Administration (FAA) guidance on high altitude flight, the time of useful consciousness during a slow cabin depressurization at 28,000 ft is 2.5 to 3 minutes.1 The TBM 900 pilot’s speech during radio transmissions began to be slurred about three minutes after he told ATC that he needed to descend. “The pilot’s failure to comply with the controller’s instructions, his long microphone pauses after concluding a statement over the radio and his confusion were consistent with cognitive impairment due to hypoxia,” the report said.
‘Neither Occupant Was Wearing an Oxygen Mask’
About 30 minutes after the pilot’s final radio transmission to ATC, two General Dynamics F-16s launched from McEntire Joint National Guard Base in South Carolina intercepted the airplane at FL 250 and about 40 nm (74 km) southeast of the base. “One of the ANG [Air National Guard] pilots made several calls to the accident airplane but did not receive a response,” the report said. “The F-16s completed a visual inspection of the airplane, which did not reveal any visible damage to the airplane or an accumulation of ice; however, there was a small line of condensation noted along the bottom of the right cockpit window. The engine was running, and the anti-collision lights were operating normally.”
One of the ANG pilots “observed two occupants in the cockpit,” the report said. “The left seat was occupied by a male seated with his back straight, while the right seat occupant’s torso and head were slouched against the fuselage of the right cockpit window. … Neither occupant was wearing an oxygen mask.”
After about an hour, the F-16s were relieved by two McDonnell Douglas F-15s from Homestead (Florida) Air Reserve Base. The F-15s intercepted the TBM 900 about 70 nm (130 km) east of Daytona Beach, Florida. The F-15 pilots said that the TBM 900 remained at the same altitude and on the same heading. Photographs taken by the pilots confirmed that neither occupant was wearing an oxygen mask.
“Magnification of the photographs showed that the bottom corners of the emergency exit door on the right side of the cabin appeared to be recessed into the fuselage frame,” the report said. “A post-accident demonstration by the manufacturer revealed that the airplane’s emergency exit door protruded out from the fuselage frame when the airplane was pressurized.”
The F-15 pilots disengaged from the TBM 900 when it neared Cuban airspace. ATC radar data showed that the airplane continued on the same flight track at FL 250 for about 5 hours and 48 minutes until the fuel supply was exhausted. It then entered a rapid descent and struck the sea about 20 nm (37 km) north of Port Antonio, Jamaica. “The airplane impacted the water at more than 300 knots and separated into small fragments.” the report said. “Fuselage and engine components of the wreckage were recovered about four months after the accident.”
System Design, Checklists Faulted
Based on the findings of the investigation, the NTSB concluded that the probable cause of the accident was “the design of the cabin pressurization system, which made it prone to unnecessary shutdown, combined with a checklist design that prioritized troubleshooting over ensuring that the pilot was sufficiently protected from hypoxia. This resulted in a loss of cabin pressure that rendered the pilot and passenger unconscious during cruise flight and eventually led to an in-flight loss of power due to fuel exhaustion over the open ocean.”
The pilot also was faulted for not declaring an emergency and initiating an emergency descent when he saw the CAS messages. “These two separate errors were either early signs of cognitive dysfunction due to hypoxia or indications that the pilot did not interpret the CAS messages as a matter related to the pressurization system,” the report said.
The pilot was known to be diligent in the use of checklists, and investigators assumed that he had consulted the pertinent emergency checklists in response to the CAS messages. “A review of the 656-page POH [pilot’s operating handbook] for the airplane found that only one of the four emergency checklist procedures that corresponded to pressurization-system-related CAS messages included a step to don an oxygen mask, and it was only a suggestion, not a mandatory step,” the report said. “The combined lack of emergency guidance to immediately don an oxygen mask and the rapid increase in the cabin altitude significantly increased the risk of hypoxia, a condition resistant to self-diagnosis, especially for a person who has not recently experienced its effects in a controlled environment such as an altitude chamber.”
After the accident, Daher-Socata revised the emergency checklists to advise pilots, as the first step, to don their oxygen masks. The revision initially affected only the current production model, the TBM 930, but the manufacturer told investigators that similar revisions were planned for prior models.
NTSB also determined that the shutdown of airflow into the cabin in response to a duct overheat was “unnecessary.” Records provided by the manufacturer showed that at least 18 overheat thermal switches were replaced in TBM airplanes between 2008 and October 2015. “At least 12 of the records included statements from pilots or mechanics that the cabin had depressurized in flight,” the report said.
In November 2015, about 14 months after the accident, the manufacturer issued a service bulletin (SB70-226) that implemented a software revision preventing automatic shutdown of pressurizing bleed air after the overheat thermal switch opens in response to a duct overheat. “The service bulletin results in the cabin losing heat without depressurizing,” the report said.
‘Help ATC Help You’
The NTSB report concluded with guidance urging pilots to obtain ATC assistance during an in-flight emergency. “ATC can be a powerful tool to a pilot in distress, offering priority handling, information about weather and traffic conflicts and other emergency services to help the pilot complete the flight safely,” the report said.
However, “pilots may hesitate to declare an emergency to [ATC] because they are embarrassed about asking for help or think that they can handle it on their own,” the report said. In some cases, a controller will provide priority handling for an aircraft that appears to be in an emergency situation even if the pilot has not declared an emergency. However, the report noted, “Even if pilots indicate that they have a problem or need help, the controller may not treat the situation as an emergency unless the pilot specifically declares it as such.” (This appears to be the case in the TBM 900 accident; the controller suspected that the pilot had a pressurization problem but did not provide priority handling because the pilot had declined to declare an emergency.)
Furthermore, “controllers may not be pilots or have detailed knowledge of aircraft systems,” the report said. “If pilots are not specific and only provide ATC with minimal information about the situation, ATC might not fully understand the seriousness of the situation and, as a result, may be unable to provide timely, relevant assistance or recognize an emergency.”
Noting that an aircraft in distress has the right-of-way over all other traffic, the report stressed that “if you find yourself in a situation in which you are in distress and need help, do not hesitate to contact ATC and declare an emergency.”
This article is based on NTSB Aviation Accident Final Report ERA14LA424 and the associated public docket.
Note
- FAA Advisory Circular 61-107B, Aircraft Operations at Altitudes Above 25,000 Feet Mean Sea Level or Mach Numbers Greater Than .75.”
Featured image: U.S. Air Force
Cockpit warnings: U.S. National Transportation Safety Board
Emergency exit door: U.S. Air Force
Safety alert: U.S. National Transportation Safety Board
