N900KN
SOCATA TBM 700
The commercial pilot and his wife departed New York in their turboprop airplane on a cross-country flight to Florida. About 1 hour 40 minutes into the flight and while cruising at flight level (FL) 280, the pilot notified air traffic control (ATC) of an abnormal indication in the airplane and requested a descent to FL180. The responding controller instructed the pilot to descend to FL250 and turn left 30°, and the pilot acknowledged and complied with the instruction; he then again requested a lower altitude. Although the pilot declined emergency handling and did not specify the nature of the problem, the controller independently determined that the flight had encountered a pressurization issue and immediately coordinated with another ATC facility to clear nearby traffic. The controller then issued instructions to the pilot to descend to FL200 and change course; however, the pilot did not comply with the assignments despite acknowledging the instructions multiple times. The pilot's failure to comply with the controller's instructions, his long microphone pauses after concluding a statement over the radio, and his confusion were consistent with cognitive impairment due to hypoxia. Further, the pilot's transmissions to ATC indicated impairment within 2 minutes 30 seconds of reporting the abnormal indication, which is consistent with the Federal Aviation Administration's published time of useful consciousness/effective performance time ranges for the onset of hypoxia. Military airplanes were dispatched about 30 minutes after the pilot's final transmission to ATC to intercept and examine the airplane. The pilots of the military airplanes reported that the airplane appeared to be flying normally at FL250, that both occupants appeared to be asleep or unconscious, and that neither occupant was wearing an oxygen mask. Photographs taken from one of the military airplanes revealed that the airplane's emergency exit door was recessed into the fuselage frame, consistent with a depressurized cabin. The military airplanes escorted the airplane as it continued on a constant course and altitude until it approached Cuban airspace, at which point they discontinued their escort. Radar data indicated that the airplane continued on the same flight track until about 5 hours 48 minutes after takeoff, when it descended to impact in the Caribbean Sea north of Jamaica. The flight's duration was consistent with a departure with full fuel and normal cruise endurance. Some of the wreckage, including fuselage and engine components, was recovered from the ocean floor about 4 months after the accident. Data recovered from nonvolatile memory in the airplane's global air system controller (GASC) indicated that several fault codes associated with the cabin pressurization system were registered during the flight. These faults indicated that the overheat thermal switch (OTSW), which was associated with overheat protection, had activated, which resulted in a shutdown of the engine bleed air supply to the cabin pressurization system. Without a bleed air supply to maintain selected cabin pressure, the cabin altitude would have increased to the altitude of the outside environment over a period of about 4 minutes. The faults recorded by the GASC's nonvolatile memory and associated system alerts/warnings would have been displayed to the pilot, both as discrete system anomaly messages on the crew alerting system (CAS) and as master warning and/or master caution annunciations. A witness report indicated that the pilot was known to routinely monitor cabin altitude while flying in the airplane and in his previous pressurized airplanes. Based on his instrument scanning practices and the airplane's aural warning system, he likely would have observed any CAS message at or near its onset. Thus, the CAS messages and the associated alerts were likely the precipitating event for the pilot's call to ATC requesting a lower altitude. The pilot was likely not familiar with the physiological effects of hypoxia because he had not recently been in an altitude chamber for training, but he should have been familiar with the airplane's pressurization system emergency and oxygen mask donning procedures because he had recently attended a transition course for the accident airplane make and model that covered these procedures. However, the pressurization system training segment of the 5-day transition course comprised only about 90 minutes of about 36 total hours of training, and it is unknown if the pilot would have retained enough information to recognize the significance of the CAS messages as they appeared during the accident flight, much less recall the corresponding emergency procedures from memory. Coupled with the pilot's reported diligence in using checklists, this suggests that he would have attempted a physical review of the emergency procedures outlined in the Pilot's Operating Handbook (POH). A review of the 656-page POH for the airplane found that only one of the four emergency checklist procedures that corresponded to pressurization system-related CAS messages included a step to don an oxygen mask, and it was only a suggestion, not a mandatory step. The combined lack of emergency guidance to immediately don an oxygen mask and the rapid increase in the cabin altitude significantly increased the risk of hypoxia, a condition resistant to self-diagnosis, especially for a person who has not recently experienced its effects in a controlled environment such as an altitude chamber. Additionally, once the pilot reported the problem indication to ATC, he requested a descent to FL180 instead of 10,000 ft as prescribed by the POH. In a second transmission, he accepted FL250 and declined priority handling. These two separate errors were either early signs of cognitive dysfunction due to hypoxia or indications that the pilot did not interpret the CAS messages as a matter related to the pressurization system. Although the cabin bleed-down rate was 4 minutes, the pilot showed evidence of deteriorating cognitive abilities about 2 minutes 30 seconds after he initially reported the problem to ATC. Ultimately, the pilot had less than 4 minutes to detect the pressurization system failure CAS messages, report the problem to ATC, locate the proper procedures in a voluminous POH, and complete each procedure, all while suffering from an insidious and mentally impairing condition that decreased his cognitive performance over time. Following the accident, the airplane manufacturer revised the emergency procedures for newly manufactured airplanes to require flight crews to don their oxygen masks as the first checklist item in each of the relevant emergency checklists. Further, the manufacturer has stated that it plans to issue the same revisions for previous models in 2017. The airplane manufacturer previously documented numerous OTSW replacements that occurred between 2008 and after the date of the accident. Many of these units were removed after the GASC systems in their respective airplanes generated fault codes that showed an overheat of the bleed air system. Each of the OTSWs that were tested at the manufacturer's facility showed results that were consistent with normal operating units. Additionally, the OTSW from the accident airplane passed several of the manufacturer's functional tests despite the presence of internal corrosion from sea water. Further investigation determined that the pressurization system design forced the GASC to unnecessarily discontinue the flow of bleed air into the cabin if the bleed air temperature exceeded an initial threshold and did not subsequently fall below a secondary threshold within 30 seconds. According to the airplane manufacturer, the purpose of this design was to protect the structural integrity of the airplane, the system, and the passengers in case of overheat detection. As a result of this accident and the ensuing investigation, the manufacturer made changes to the programming of the GASC and to the airplane's wiring that are designed to reduce the potential for the GASC to shut off the flow of bleed air into the cabin and to maximize the bleed availability. Contrary to its normal position for flight, the cockpit oxygen switch was found in the "off" position, which prevents oxygen from flowing to the oxygen masks. A witness's description of the pilot's before starting engine procedure during a previous flight showed that he may not have precisely complied with the published procedure for turning on the oxygen switch and testing the oxygen masks. However, as the pilot reportedly was diligent in completing preflight inspections and checklists, the investigation could not determine why the cockpit oxygen switch was turned off. Further, because the oxygen masks were not observed on either occupant, the position of the oxygen switch would not have made a difference in this accident. See the public docket for this accident for comments from the Bureau d'Enquêtes et d'Analyses.
HISTORY OF FLIGHT On September 5, 2014, about 1410 eastern daylight time (EDT), a Daher-Socata TBM700 (marketed as a TBM900 model), N900KN, was destroyed when it impacted open water in the Caribbean Sea near the northeast coast of Jamaica. The commercial pilot and the passenger were fatally injured. An instrument flight rules flight plan was filed for the cross-county flight that originated from Greater Rochester International Airport (ROC), Rochester, New York, at 0826 and was destined for Naples Municipal Airport (APF), Naples, Florida. The personal flight was conducted under the provisions of Title 14 Code of Federal Regulations (CFR) Part 91. The pilot used a fixed based operator (FBO) at ROC, his home airport, to hangar the airplane. On the day of the accident, FBO personnel towed the airplane to the ramp in advance of the pilot's arrival. The pilot arrived at the airport before the passenger, who was his wife, and briefly spoke with two of the FBO employees, who described his demeanor as relaxed. Once his wife arrived, they loaded their bags and then boarded the airplane. An FBO employee pulled the chocks and marshalled the airplane off the FBO ramp. Surveillance video retrieved from the ROC airport showed that the airplane departed at 0826. According to recorded Federal Aviation Administration (FAA) air traffic control (ATC) information, a controller instructed the pilot to climb to 9,000 ft mean sea level (msl) and fly direct to a waypoint on the pilot's flight plan. Several minutes later, the controller instructed the pilot to climb to Flight Level (FL) 280, and the pilot complied. The flight proceeded without incident for about 45 minutes. About 0912, ATC lost communications with the airplane for a few minutes. The airplane was operating in Cleveland Center's airspace at FL280 when the pilot was instructed to contact the controller of the next sector; however, he did not acknowledge the handoff or attempt to contact the handoff controller on the provided frequency. The controllers made multiple attempts to contact the pilot, but the pilot did not respond until about 4 minutes 30 seconds after the controller's initial handoff instruction. The pilot reported to the controller that "ah something happened I don't know what happened to you but we're back." The controller subsequently issued a new frequency, which the pilot acknowledged. About 0917, the passenger contacted the new sector as previously instructed. The sector controller instructed the flight to contact Washington Center and provided a new frequency. The passenger acknowledged the instruction and checked in with the controller at Washington Center. All further radio communications from the airplane were made by the pilot. At 1003:11, the pilot checked in with an Atlanta Center controller as instructed and confirmed that the flight was level at FL280. About 1 minute later, the pilot radioed "nine hundred kilo november we need to descend ah down to about one eight zero we ah have an indication that's not correct in the plane." The controller cleared the flight to FL250, and the pilot acknowledged, "two five zero and we need to get lower nine hundred kilo november." The controller asked whether the pilot was declaring an emergency, and at 1004:50, the pilot replied, "ah not yet but we'll let you know;" radar data indicated that the airplane had started to descend from FL280 and was at FL277 when this transmission occurred. The controller instructed the flight to turn left 30°, and at 1005:02, the pilot acknowledged, "thirty left nine hundred kilo November." The pilot's speech during this period did not display any anomalies. About 1005, the controller contacted another ATC facility to coordinate the airplane's clearance to a lower altitude. Although the pilot had not declared an emergency and had not specified the nature of his problem, the second facility agreed to redirect another airplane after the controller reported that the pilot had "a pressurization issue." By 1006, the controller had coordinated efforts to descend the airplane to FL200 and then to FL180. At 1006:35, while the airplane was at FL250, the controller cleared the flight to descend and maintain FL200. After receiving no acknowledgement, the controller repeated his instruction at 1006:43, and the pilot quickly acknowledged, "two zero zero nine hundred kilo november." A continuation of the carrier signal on the audio recording indicated that the airplane transmit switch remained keyed (activated) for about 4 seconds after the pilot concluded his statement. Radar data showed that the airplane remained at FL250 instead of descending as cleared by ATC and acknowledged by the pilot. At 1007:17, the controller cleared the flight direct to the Taylor VOR. No verbal response from the flight occurred, but the audio recording contained about 2 seconds of carrier signal, indicating that the airplane's radio transmit switch was keyed. The controller repeated his clearance, and at 1007:36, the pilot immediately responded, "direct taylor nine hundred kilo november." Radar data shows the airplane did not alter its course toward the Taylor VOR. At 1008:10, the controller asked the flight to confirm that it had received the descent clearance to FL200. At 1008:15, the pilot replied, "two zero zero kilo November." Review of the audio recording indicated that the pilot's voice was faint during this transmission. At 1008:40, the controller stated, "November zero kilo November descend and maintain flight level two zero zero and you are cleared direct taylor." The pilot responded immediately with, "direct kilo November nine hundred kilo November." Review of the audio recording indicated that the faintness in the pilot's voice associated with the previous call was gone. Subsequently, the controller made numerous attempts to contact the pilot, but no further radio transmissions (either verbal or carrier signal) from the flight were received. About 1039, two Air National Guard (ANG) F-16s from McEntire Joint National Guard Base (MMT), Eastover, South Carolina, were vectored to intercept N900KN about 40 miles southeast of MMT. Minutes later, the F-16s intercepted the airplane on a 165° magnetic heading at FL250 and 175 knots indicated airspeed. One of the ANG pilots made several radio calls to the accident airplane but did not receive a response. The F-16s completed a visual inspection of the airplane, which did not reveal any visible damage to the airplane or an accumulation of ice; however, there was a small line of condensation noted along the bottom of the right cockpit window. The engine was running, and the anti-collision lights were operating normally. According to a statement from one of the ANG pilots, he observed two occupants in the cockpit. The left seat was occupied by a male seated with his back straight, while the right seat occupant's torso and head were slouched against the fuselage aft of the right cockpit window. The ANG pilot also observed headsets on both occupants and noted that the left seat occupant's boom mic was pointed straight up. About 1 hour 20 minutes after the airplane was first intercepted, the left seat occupant's head slumped forward, which enabled the ANG pilots to see his chest rising and falling. Neither occupant was wearing an oxygen mask. Two F-15s from Homestead Air Reserve Base (HST), Homestead, Florida, relieved the F-16s about 70 miles east of Daytona Beach, Florida about 1 hour after the initial intercept. According to one of the F-15 pilots, the airplane maintained the same heading, airspeed, and altitude as noted by the F-16 intercept from MMT. According to one of the F-15 pilot's statement, he did not observe any signs of smoke or fluids coming from the engine, which continued to function normally. The exterior lights and instrument panel were illuminated; however, the distance between the airplanes prevented the intercept pilots from reading the indications on the glass panel display. According to one of the F-15 pilots, the intercept group disengaged from the airplane before the flight reached Cuba. The intercept from HST captured several digital camera photographs of the airplane that were forwarded to the NTSB. Review of the photographs confirmed that neither occupant was wearing an oxygen mask. Magnification of the photographs showed that the bottom corners of the emergency exit door on the right side of the cabin appeared to be recessed into the fuselage frame. A postaccident demonstration by the manufacturer revealed that the airplane's emergency exit door protruded out from the fuselage frame when the airplane was pressurized. According to a review of FAA radar data, about 1409, the airplane entered a high rate of descent from FL250. The last radar target was recorded over open water about 10,000 ft msl, about 20 nautical miles north of Port Antonio, Jamaica. Search aircraft and watercraft from the Jamaican Defense Authority and the United States Coast Guard observed an oil slick and small pieces of debris scattered over 1/4 mile near the last radar target. The airplane was subsequently located by an autonomous underwater vehicle and recovered by a salvage effort about 4 months after the accident. PERSONNEL INFORMATION Pilot The pilot, age 68, held a commercial pilot certificate with ratings for airplane single-engine land and instrument airplane. His most recent FAA third-class medical certificate was issued on August 6, 2013, with the limitation "must wear glasses for distant [vision], [and] have glasses for near vision." A pilot data information sheet provided by SIMCOM Aviation Training showed that, at the time of his most recent training, which took place 1 week before the accident, the pilot reported a total of 7,100 flight hours with 240 hours within the preceding 12 months. The pilot's personal logbook(s) were not located after the accident. According to a friend of the pilot, the pilot had a high altitude endorsement, but he may not have received any training experience in an altitude chamber. Before he purchased the accident airplane, the pilot had owned two other Daher-Socata TBM700 airplanes, a TBM700 "A" model (N51HT) and a TBM850 "Legacy" model (N51LG). According to a service center, the pilot purchased the A model in 1994 and accumulated about 2,700 flight hours in the airplane. He subsequently purchased the TBM850 model without a G1000 avionics suite, which he flew for about 1,250 hours before buying the accident airplane in April 2014. The pilot's insurance policy authorized only the pilot and one other person to act as pilot in command of the accident airplane. Maintenance records indicated that the airplane was flown about 52 hours between the time the pilot purchased it and June 20, 2014. Data retrieved from a public flight tracking service showed that the airplane had accumulated about 50 additional flight hours between June 20, 2014, and the date of the accident. A cross-check of the flight tracking service's data with the FBO's departure/arrival log validated each flight with the exception of two arrivals. Thus, the maintenance records and flight tracking service data indicated that the airplane had been flown about 102 hours since the pilot acquired it. The pilot completed a 5-day training course on the TBM900 at SIMCOM Aviation Training Center, Orlando, Florida on August 29, 2014, to satisfy an insurance policy requirement. According to a representative of SIMCOM, the course duration would have been about 8 hours per day for the first 3 days and about 6 hours per day for the remaining 2 days. The representative stated that the course's ground training addressed the technical aspects of the TBM900's airframe, engine, and avionics and included a review of the environmental system. The course's simulator training included environmental system inspections, failures, the controls for smoke or fume elimination, and emergency descent procedures. Proper oxygen mask donning procedures were also demonstrated and discussed. The pilot's instructor at SIMCOM stated that he instructs students to don their oxygen masks before troubleshooting any pressurization problems. The instructor further stated that he likely spent 45 minutes on pressurization system training in the classroom and another 45 minutes in the simulator. The airplane manufacturer reported that, at the time of the accident, SIMCOM had the only simulator that could present crew alerting system (CAS) messages related to the TBM900 pressurization system. The pilot attended the course with a friend who was the other named pilot on the airplane's insurance policy, frequently accompanied him during personal flights, and commonly shared crewmember duties. According to the friend, who attended the first 3 days of the 5-day course, the pilot used a Garmin G1000 simulator program on his personal computer to familiarize himself with the system in advance of the SIMCOM course as this was his first airplane with a full glass cockpit display. The pilot and his friend completed numerous flights together, including twelve flights in the accident airplane. He stated that the pilot was "religious" about adjusting the cabin altitude in flight; in the TBM850, the pilot would normally enter a climb and adjust cabin altitude simultaneously. During flights in the TBM900, he observed the pilot monitor cabin altitude by placing his finger on the multi-function display to verify cabin altitude during each instrument scan. According to the pilot's friend, the pilot completed an "external walk around" inspection of the airplane before each flight. During inspections, the pilot's friend observed him physically open the door to the oxygen bottle and verify that the oxygen cylinder's valve was on. The pilot further used a gauge in the cockpit to confirm the flow of oxygen after he turned the cockpit oxygen switch on and tested the oxygen masks. Family and friends indicated that the pilot was in excellent health. He was an occasional cigar smoker, took one medication for cholesterol, rarely consumed alcohol, and exercised regularly. The family did not report any unusual behaviors with the pilot or his wife in the 72 hours before the accident. A friend of the pilot stated that the pilot appeared to be in "excellent health and spirits" when he met with him the day before the accident. Pilot-Rated Passenger The pilot-rated passenger, age 68, held a private pilot certificate with a rating for airplane single-engine land. She reported a total flight experience of 410 hours on her latest third-class medical certificate application, dated July 1, 1992. The pilot-rated passenger's personal logbook(s) were not located after the accident. AIRCRAFT INFORMATION According to FAA records, the Daher-Socata TBM900 model, serial number 1003, was manufactured in 2014 and powered by a single Pratt and Whitney PT6A-66D turbo-prop engine. A standard airworthiness certificate was issued on March 6, 2014, and the airplane was subsequently registered to the pilot on April 8, 2014. In March 2014, the factory-new airplane was delivered from the manufacturer's facility in France to an airplane sales and service company in Connecticut with a total of 37.6 flight hours. The service center completed several flights in the airplane before the pilot took possession of it in April 2014, at a total time of 44.3 flight hours. The first in-service inspection prescribed by the manufacturer was performed on June 20, 2014, at which time, the airplane and engine had accrued an additional 52 flight hours. Airplane Fuel Performance A report furnished by the FBO indicated that the airplane was last serviced with 177 gallons of fuel on August 29, 2014. According to the manufacturer's performance calculations, the airplane would have consumed about 23 gallons of fuel in 20 minutes during its climb to cruise altitude (FL280). After reaching FL280, the airplane then flew for about 5 hours 25 minutes. Based on the manufacturer's computation, this corresponds to a mean fuel flow of about 49 gallons per hour, which is consistent with normal cruise flight fuel performance. Bleed Air and Cabin Pressurization System The pilot's operating handbook (POH) st
The design of the cabin pressurization system, which made it prone to unnecessary shutdown, combined with a checklist design that prioritized troubleshooting over ensuring that the pilot was sufficiently protected from hypoxia. This resulted in a loss of cabin pressure that rendered the pilot and passenger unconscious during cruise flight and eventually led to an in-flight loss of power due to fuel exhaustion over the open ocean.
Source: NTSB Aviation Accident Database
Aviation Accidents App
In-Depth Access to Aviation Accident Reports
