A pilot’s preoccupation with automation leads to disaster
Illustration by Brett Affrunti
Summary
> A Pilatus PC–12’s autopilot disengages in cruise climb near FL250 in IMC.
> Pilot begins to troubleshoot and aircraft falls into spiral.
> Pilot extends landing gear but airframe fails well outside operating envelope.
The late comedian, George Carlin, offered solid advice to, “Always do what is next.” We aviators usually hear it as “Aviate, navigate, communicate.”
The en route phase of flight is usually benign unless weather is involved. So it was natural to suspect that the pilot of a Pilatus PC–12 had encountered thunderstorms, icing—or both—that brought down this highly capable single-engine turboprop. However, it turned out to be something much different. Regardless of what type of aircraft you fly, the process of dealing with abnormal and emergency situations is much the same.
The flight. On June 7, 2012, a Pilatus PC–12 with pilot and five passengers departed Fort Pierce, Florida, at 12:05 p.m. Eastern time en route to Junction City, Kansas. The pilot and his family were returning from a vacation in the Bahamas. After clearing Customs and refueling the aircraft for the second leg, it looked like a routine flight, with light to moderate icing forecast at 26,000 feet (flight level 260) and some scattered convective activity. The PC–12 is approved for flight in known icing; this flight should have been well within its capabilities.
Shortly after takeoff the pilot contacted Miami Air Route Traffic Control Center and was handed off through various sectors. There were several deviations around thunderstorms—typical for an early summer afternoon in Florida.
The flight continued northwest and was cleared to FL260 at 12:30 p.m. According to the NTSB report, “At 12:32:26, the aircraft’s Central Advisory and Warning System [CAWS] recorded that the pusher system went into ice mode.”
The PC–12 is equipped with a stick shaker and pusher to protect the aircraft from approaching a stall. In ice mode—initiated when the pilot activates propeller heat and opens the inertial separator—the system activates sooner to provide additional protection, in case the airframe is contaminated with ice. (The inertial separator protects the engine from ice, functioning like an alternate air door on piston aircraft.) These indicated the pilot expected or was encountering icing. The aircraft’s engine information system (EIS) recorded a pressure altitude of 24,668 feet, 110 knots indicated airspeed (about 160 knots true; a reasonable climb speed), and an outside air temperature of minus 11 degrees Celsius.
At 12:32 p.m., Center advised of moderate to extreme precipitation and suggested a north deviation. The pilot agreed and the controller approved deviations right of course, which the pilot acknowledged at 12:33 p.m. That was the last external communication.
Spiral dive. Between 12:33:08 p.m., and 12:33:31 p.m., the aircraft’s heading was approximately 290 degrees, and it climbed from FL250 to FL252, with an indicated airspeed of about 110 KIAS. According to the NTSB report, “At 12:33:30 p.m., while at slightly less than 25 degrees of right bank, 109 KIAS, 25,188 feet based on the data downloaded from the CAWS, the autopilot disconnected for undetermined reasons. In the next 10 seconds the bank angle increased to 50 degrees…(and) the airplane descended to FL249.”
The autopilot computer continuously checks the system, and if a failure occurs it will disengage and advise the pilot via annunciator and aural tone.
About 13 seconds after the autopilot disconnected, and in a descending right bank of about 50 degrees, the pilot began a test of the autopilot system, which it subsequently passed. The bank angle increased to beyond 75 degrees and the airspeed reached 338 knots.
While passing 15,511 feet, about 175 knots above maximum maneuvering speed, according to the NTSB report, “The pilot likely applied either abrupt or full aft elevator control input, resulting in overstress fracture of both wings in a positive direction. The separated section of right wing impacted and breached the fuselage, causing one passenger to be ejected from the airplane. Following the in-flight break-up, the airplane descended uncontrolled into an open field.” G forces were computed to be 4.6 at 12:34:08 p.m. There were no survivors.
The pilot. The 45-year-old pilot held a private pilot certificate with airplane single-engine land and instrument airplane ratings. His third class medical certificate was current and total flight time was computed to be about 755 hours acquired over an 18-year period. He obtained his instrument rating in November 1997, but had limited instrument time. Time in the PC–12 at the time of the accident was about 38 hours, about half of which was instruction.
Prior aircraft experience was mostly in high-performance, complex single-engine piston aircraft, including a Mooney M20J and a Beech Bonanza B36TC. There was a brief exposure of 7.5 hours dual in a turboprop Piper Meridian.
The first flight in the accident airplane was 4.1 hours to fly from Junction City, Kansas, to Scottsdale, Arizona, for initial PC–12 training in early May 2012—about a month before the accident. The pilot received four extra flight lessons in the accident airplane, accruing a total of approximately 19 hours, with about three hours of actual instrument time. The procedures portion of the training included about 20 hours of ground instruction covering the airplane and its systems, and 12 hours of instruction in a fixed training device.
The pilot’s training records were satisfactory. Unusual-attitude recovery with unscheduled trim activation (stabilizer, aileron, and rudder) was practiced in the FTD and in the accident airplane. Autopilot test procedures were demonstrated along with autopilot malfunction. The pilot was signed off for a flight review, instrument proficiency check, and high-altitude endorsement.
Weather. There was no record of the pilot receiving a weather briefing from an approved source, but he may have obtained weather from some other source. A stationary front across northern Florida was producing scattered light rainshowers and thunderstorms. However, no organized area of convective activity or icing was near the accident site and the NTSB did not consider weather to be a factor.
The aircraft. The Pilatus PC–12/47 is a low-wing, T-tail, single-engine airplane with flight load factor limits (flaps up) of plus 3.3 to minus 1.32 Gs. The maximum maneuvering speed is 163 KIAS, maximum operating speed is 236 KIAS, and maximum diving speed (VD) is 290 knots (an engineering flight test speed used during certification and well above the red line; it’s not something pilots should ever approach deliberately).
The airplane was manufactured in 2006, received its annual inspection in January 2012, and had less than 1,300 hours total flight time. There were no records of autopilot malfunction in the aircraft history.
The NTSB could find no preimpact failure in the flight control system, the aircraft structure, the engine, or the autopilot. The CAWS system provided investigators with a comprehensive view of aircraft history, performance, flight path, and systems function from well before the accident until impact. The investigation, much abbreviated here, went to great length to determine why the autopilot may have disconnected, and the components were extensively tested. Had the pilot disconnected the autopilot, it seems unlikely that he would have initiated a subsequent test.
According to the NTSB report, “The flaps were found in the retracted position, and the landing gear was extended; it is likely that the pilot extended the landing gear during the descent. The horizontal stabilizer trim actuator was positioned in the green arc takeoff range, the impact-damaged aileron trim actuator was in the left-wing-nearly-full-down position, and the rudder trim actuator was full nose right. The as-found positions of the aileron, rudder trim, and landing gear were not the expected positions for cruise climb (italics added).
“Examination of the relays, trim switch, and rudder trim circuit revealed no evidence of preimpact failure or malfunction, and examination of the aileron trim relays and aileron trim circuit revealed no evidence of preimpact failure or malfunction; therefore, the reason for the as-found positions of the rudder and aileron trim could not be determined (italics added). Impact-related discrepancies with the autopilot flight computer precluded functional testing. The trim adapter passed all acceptance tests with the exception of the aural alert output, which would not have affected its proper operation.”
It is also possible that the pilot, in the stress of the moment, manually applied trim through the yoke-mounted trim switch—but that is speculative.
The NTSB reviewed FAA Service Difficulty Reports (SDR) from 2009 through 2014 and found none for the accident aircraft, and only two that discussed rudder trim or yaw damper; neither was applicable to the accident aircraft. An aside: One of the largest PC–12 operators had no data concerning uncommanded autopilot disconnects.
Probable cause. “The NTSB determines the probable cause(s) of this accident as: The failure of the pilot to maintain control of the airplane while climbing to cruise altitude in instrument meteorological conditions following disconnect of the autopilot. The reason for the autopilot disconnect could not be determined during post-accident testing. Contributing to the accident was the pilot’s lack of experience in high-performance, turbo-propeller airplanes, and in IMC.”
Commentary. An obvious question is why a private pilot with fewer than 800 hours was flying a PC–12 solo. This is not to deny anyone the opportunity to fly high-end equipment, but history is illustrated with fatal accidents involving the financially gifted but aeronautically inexperienced. That’s a tough call, because many complete training and are successful by being cautious—and easing into the left seat.
Before getting too sanctimonious, however, let’s look at some facts. In 1987 the FAA amended FAR Part 61 to require anyone acting as PIC of a pressurized aircraft capable of flight above FL250 to receive ground and flight/simulator training, and have been signed off by an appropriately qualified CFI. The accident pilot did all that.
The NTSB reviewed accidents of low-time pilots in turboprops after August 4, 1987, involving pilots with 1,000 hours or less total flight time. Aerial application aircraft were not included. Out of 66 accidents and incidents, just 20 cases met the criteria. Only four had factors related to the pilot’s experience in make and model. It’s often a judgment call as to whether someone’s experience played into a crash. Investigators are very good at determining what happened; we often have to draw our own conclusions as to why.
Distraction often is present in accident scenarios and, in this case, autopilot disengagement appears to be the culprit. It’s unusual for an autopilot to quit, but they are designed to give control back to a higher authority (the PIC) to deal with a problem. Sometimes there’s a real fault, and sometimes just a transient “spike” falls outside preset parameters. It might be a good idea to hand-fly for bit to sort things out before troubleshooting.
Transient faults are tough to trace and it’s apparent here that something kicked the autopilot off line. But aircraft fly just fine without much of the equipment onboard today’s machines. If the engine is running and the airframe is intact, there’s plenty to work with.
Advise ATC of an abnormal situation and ask for a vector if needed. Just fly, follow the guidance, and sort things out on your terms. Overwhelmed and getting a little behind? Roll wings level, if appropriate; stop the descent, if any; and ask for help. Afterwards, file an ASRS (NASA Report) and don’t worry about the FAA coming to hassle you—chances are very good they won’t.
Recovery from spiral dives, as presented in training, seems simple. Distract the trainee; place the aircraft into an incipient dive; have the trainee recover by immediately reducing power, rolling wings level, and returning to a level pitch attitude. Unfortunately, this does not replicate reality. The trainee is primed to look for an unusual attitude, so distraction is absent. The recovery is started quickly for safety reasons, before the speed becomes a factor, so it’s a “baby” spiral—not its nasty big brother. It’s difficult to induce vertigo under these circumstances, and true vertigo is a big distraction.
In a well-developed spiral, the aircraft will quickly accelerate to well above trim airspeed. In this case, just more than 30 seconds elapsed from a climbing shallow bank to airframe failure. The pilot did extend the landing gear, which is good, but it doesn’t appear that he made a power reduction.
As soon as the aircraft is rolled to level—assuming the pilot gets that far into recovery—it will seek trim speed. If cruise (and trim) airspeed is 150 knots and the pilot manages to get wings level at around 210 knots (and the maneuvering speed is 130 knots), there will be a pitch up as the aircraft seeks to regain trim speed. The pilot must push forward—firmly—to unload the aircraft structure.
Being so far above maneuvering speed, and possibly above redline, it’s not surprising that many in-flight breakups follow a spiral. In some cases a trainee is told that since the aircraft is going down, they need to pull up. In a fully developed spiral, that’s exactly the wrong guidance! It’s going to be wings level and a push—if the aircraft continues to climb for a bit, getting away from Mother Earth is a great solution.
The pilot’s training record showed someone who had checked all the boxes but had little background in either turbine aircraft or high-altitude flight. The airlines and many corporate flight operations have initial operating experience, or IOE. After pilots complete academics, simulator training, and possibly a checkride, they fly a number of trips with experienced pilots. This is exposure to the real-world environment of weather, equipment, and ATC. Completing training is only the beginning and for low-time turbine pilots, it’s a wise investment to plan on 25 hours or more of IOE.
Autopilots seldom fail and I don’t believe that one should have to hand-fly every minute of a training flight. That’s not how we normally fly sophisticated aircraft. But we should be able to manage it as an abnormal procedure—and, most important, learn to set priorities. As Carlin so aptly put it, “Always do what is next.”
Bruce Landsberg is the former president of the AOPA Foundation and senior advisor to the AOPA Air Safety Institute.
Keeping it straight and level
Personal one-on-one training with an experienced flight instructor is probably the best way to develop techniques that reduce the risk of loss-of-control accidents. Maybe you can’t go to an instructor, but now an instructor can come to you. Famous spin doctor Rich Stowell recently presented a webinar on loss of control, one of many he’s done in recent years. You can learn more online.
