Eclipse 500 FADEC failure at Chicago Midway

[Rooster Cruiser]

http://charterx.com/resources/article.aspx?id=3398

A very hairy episode that happened a month ago with the Eclipse 500.  Makes me question the overall airworthiness of the airplane...

Pilot of Eclipse Jet Emergency Shares Personal Experience
29-Jun-2008
By Karen Di Piazza

Capt. Chuck Nealy has logged more than 22,000 hours of incident and accident free flights in military and airline transport aircraft. Flying military aircraft, he became trained in how to perform simulated flameout (SFO) approaches for emergency landing patterns. That training instinctually came into play on June 5, when he was forced to declare an emergency landing at Chicago Midway International Airport (MDW) in Illinois.
On that day, while flying an Eclipse very light jet, Nealy noticed that both engines were unresponsive to his throttle commands. He landed at MDW, but the engines rapidly increased airspeed as he was running out of runway, forcing him to abort the landing and get the plane airborne.

Several minutes after becoming airborne again, Nealy realized that both engines were stuck on max power. When he shut down one engine, the other engine went to idle mode. Nealy was able to make a successful emergency landing, resulting in no injuries to himself or the three other people on board: his "unofficial" King Air copilot, who was sitting in the right seat getting some jet time; Don Bourn, who owns the VLJ, registration N612KB with Kevin Kiernan (hence the last two letters of the tail number); and an unidentified business associate. 

Nealy, who became type rated in the Eclipse as pilot-in-command in September 2007, said he only flies the Eclipse under FAR Part 91 corporate rules for Coronado, Calif.-based Kiernan Companies LLC, listed as the registered owner. The aircraft is managed by nearby San Diego-based Jimsair Aviation Services Inc., dba as Jimsair Charter and Management, which employs both Nealy and the unidentified copilot.

On July 12, the National Transportation Safety Board addressed a letter to the Federal Aviation Administration. The letter stated that just as the airplane was landing at MDW, the Eclipse experienced a failure that resulted in an uncontrollable increase in the thrust from the two Pratt & Whitney Canada PW610F turbofan engines to maximum power. The NTSB noted that the Eclipse 500's crew alerting system (CAS) display showed both left and right engine control failure messages, as the airplane "climbed out following the balked landing" initially at MDW.

The NTSB noted that although the Eclipse 500's airplane flight manual (AFM) and Eclipse's quick reference handbook (QRH) provided an emergency procedure for a single-engine control failure, no procedures were available for dual-engine control failure, which occurred in this incident. "Had it not been for the resourcefulness of the pilots, the visual meteorological conditions that prevailed at the time, and the airplane's proximity to the airport, the successful completion of this flight would've been unlikely," the NTSB stated.

The VLJ was operating on an instrument flight rules flight, flying from Cleveland Hopkins International Airport (CLE) in Ohio to MDW, 266 nautical miles for the planned one-way flight. Nealy said that after referencing Eclipse's emergency procedures in the plane's QRH and finding no procedure for dual-engine control failure messages, he aborted the landing. The NTSB's letter said that the pilot flying the plane reported that as the airplane was crossing the runway threshold for the initial landing attempt, it encountered a 10- to 15-knot wind shear and developed a high sink rate, which the pilot arrested by applying power.

According to the NTSB, Nealy stated that as the airplane landed at about 83 knots, he retarded the throttles to idle. About three seconds later, he lightly touched the brakes to slow the airplane down. Although the throttles were at idle, the airplane was accelerating rapidly through 100 knots.

The NTSB also stated that the pilots said they retracted the flaps to the take-off position and retracted the landing gear as the airplane was climbing out from the balked landing. However, because the airspeed continued to increase through 190 knots, the flying pilot lowered the landing gear again to try to increase drag and slow the airplane. He stated that even with the landing gear down and the flaps in the take-off position, the airplane continued to accelerate. To remain below 200 knots, which is the maximum operating speed for the flaps and landing gear, the pilots had to maintain a shallow climb.

The NTSB also noted that the dual-channel failure of both throttle levers occurred after the airplane had accumulated only 238 hours and 192 cycles since new. The throttle levers are part of the throttle quadrant assembly. The safety agency said it's concerned about the reliability of an assembly that fails in such a short time. The board also found that when the "failed throttle quadrant assembly was replaced, pushing the throttle levers on the replacement unit against the maximum power stops, [it] caused a right engine control fail message" to appear on the CAS display. "The immediate failure of the replacement part suggests that there may be a design or quality problem in the Eclipse 500's throttle quadrant assembly," the NTSB stated.

The NTSB advised the FAA to require an immediate inspection of all Eclipse 500 airplane throttle quadrants "to ensure that pushing the throttle levers against the maximum power stops will not result in an engine control failure." The NTSB further advised that it should be required "that any units that fail the inspection be replaced and that the replacement parts be similarly inspected (A-08-46 urgent)."

The NTSB additionally recommended that Eclipse Aviation Corp., manufacturer of the Eclipse 500, be required to immediately develop an emergency procedure for a dual-engine control failure on the Eclipse 500 airplane and to incorporate the procedure into the airplane flight manual and quick reference handbook via an airworthiness directive (A-08-47 urgent).

Later that evening, on June 12, after the NTSB put heat on the the FAA, it issued an "emergency airworthiness directive" (AD), directing plots, rather than aircraft maintenance personnel, to evaluate the E500's throttles, to determine if they needed repair or replacement as necessary, prior to flight. By 6 a.m. EDT, charter operators DayJet Services LLC and North American Jet Charter Group reported that its aircraft used in commercial, FAR Part 135 air charter were cleared for flight.

In a June 13 email to Industry Headline News, Vicky Harris, DayJet spokesperson, said, "The maintenance and flight operations teams were prepared and responded efficiently, completing the required fleet inspections before the start of our revenue operations at 6 a.m. The safety of our flight operations wasn't compromised, and not a single customer was disrupted."

On June 24, Eclipse Aviation announced in a press release that it would make design improvements to its aircraft's software, to increase the range limit of the plane's throttle quadrant assembly, to prevent the fault condition. Pending the FAA's approval, software updates will be disbursed to all Eclipse 500 owners and operators.

Nealy Fills in Eclipse's CPC Gaps

On June 9, four days following the Eclipse VLJ dual-engine failure, the plane maker issued a   "customer pilot communication" for "informational purposes only." (Reference our June 12 report,  "Eclipse 500 Jet Twin-Engine Control Failures Investigated"). However, when interviewed from his cell phone while at a construction site on June 11, Nealy said he didn't receive Eclipse's CPC until that morning. "First thing this morning, we flew the aircraft from San Diego to Telluride," he said at the time.

Regarding Eclipse's CPC, Nealy acknowledged, "It leads you to believe that I sustained a force on the throttles in excess of 30 pounds. That's not what occurred. When we were in the landing, we were less than 100 feet above the ground. We encountered a wind shear. I lost between 10 and 15 knots of speed, as the aircraft descended rather rapidly. The typical recovery procedure for wind shears is to add power."

He said the wind shear at landing made being less than 100 feet above the ground an unsafe condition, so he increased power, to avoid hitting too firmly or possibly causing damage to the airplane. "Using the recovery procedure--adding power--is how this situation developed," he said. "I added a small amount of power, but it seemed insufficient to overcome the sink rate and speed loss, so I pushed the power up firmly. I don't remember hitting the mechanical stop--the end of the thrust lever. I just pushed it up and immediately brought it back to the three-quarter-power position. That stopped my speed loss, reduced the sink rate and allowed me to make a normal touchdown at MDW."

Nealy said that after he did, he reduced the power to idle--the normal position of flight on the ground. "This all happening very, very fast; I was viewing outside, not inside the airplane, at that moment," he explained. "Typically, you check your brakes to see that they're working. I applied a very light touch on the brakes to ensure they were fine; if you do a very hard brake at a very high speed, then you'll blow the tires. You'll skid them, and they'll skid through a hole and deflate."

The Eclipse VLJ doesn't have anti-lock/anti-skid brakes. His opinion is that if the aircraft had this braking system, it might've helped. "You can operate without the anti-skid, but inexperienced pilots can blow tires even without having the conditions that I did, because they may be overanxious to get on the brakes," he said. 

He said the landing gear tires didn't blow when he landed, as some reports have suggested. "When I first applied the brakes, I realized that I wasn't slowing down," he said. "I couldn't feel the effect of braking; there was no appreciable sensation of speed reduction due to braking. In fact, I felt no speed reduction. I reached over and raised the flaps from the landing to the take-off position, in an effort to try to reduce lift and decrease speed, or increase weight on the wheels. I then gently reapplied the brakes, but we weren't slowing down."

Meanwhile, as the plane was going faster and faster, Nealy was careful to stay on the runway, looking diligently outside. "I looked at my airspeed, and instead of what I had anticipated--a decrease--it was rapidly increasing to 90 to 100 knots," he said. "I couldn't get that sensation of braking."

Thinking he had brake failure, Nealy looked at his engine instruments. "I determined that the engines were at maximum operating thrust!" he said.

Since the engine/software fault mode was caused by invalid position signals, the system logic held the engine thrust settings at the last known throttle position, which was at maximum. "Yes, it [the system] was talking to itself, and it determined that there was a logic that was set up for this particular malfunction," he said. "It worked, but the system didn't anticipate something like this occurring (dual-engine failure). At that moment, there was nothing I could do about it. I had airspeed; I was running out of runway, so we took off."

Once airborne, with power accelerating and both the left and right control engine fail messages displayed, Nealy and the copilot immediately checked the QRH. But there was no procedure on how to handle this emergency, and the aircraft was "uncontrollable." He said that in the event of uncontrollable power, it could occur at maximum or minimum power, depending on where the fault occurs. In his case, the fault occurred at maximum power on both engines.

Preparing for Flameout

Nealy's vast piloting expertise saved the day. In the Air Force, he was captain of the four-engine Lockheed C-130 Hercules and the Lockheed C-140 (known as the JetStar.) He also flew the T-39 Sabreliner, T-29 Convair, T-37 and T-38. His lifelong flying career includes flying the Boeing 737, 727 and MD-80 airliners as captain.

That day at MDW, Nealy did some familiar maneuvers to keep airspeed under control. He also said having a pilot next to him allowed for the most advantageous outcome. While he was adjusting gears and flaps, the copilot read a caution in the Eclipse's QRH: if you change your flight conditions, the engines could flameout. "When I realized that was the case, I maneuvered the aircraft into a very familiar procedure," he said. "It's a simulated flameout approach--what the military calls ‘fly in circles.' That's an approved practice in the military with certain aircraft, which I've performed many times."

The plane was uncontrollable and accelerating as Nealy did a visual maneuver, trying to come back around, with the plane's airspeed in excess of 190 knots. He knew he had to shut down an engine. "I had to reduce thrust," he said. "I had to reduce my power. My throttles weren't effective; the only alternative method I had was to shut down an engine. The speed was between 190 and less than 200 knots when I turned the one engine off. Then I began my maneuver to try to get back to MDW for landing."

As he was making his maneuver, the plane's speed decreased rapidly. "My airspeed was on order of 90 knots," he said. "I had to bank the aircraft immediately. I lowered the nose and tried to gain airspeed; I kept looking at power, trying to add power on the operating engine--the left engine. But the left engine wouldn't respond to the throttle movement; it had gone from max power to idle, where it remained unresponsive to my throttle movement."

A stall warning confirmed that the situation was serious. "It's a feature designed in the aircraft that alerts the pilot that a stall is approaching," he said. "You're not in a stall, but a stall is approaching."

Nealy said that with one engine on idle, he and the copilot remained calm. "I had to make Midway, and there are a lot of houses, a lot of population," he said. "The only place for me to safely get on the ground was Midway. So, I traded out altitude for airspeed; the only way I could do that was to descend. I came down and reduced bank, because I didn't want to stall the aircraft. It was very important not to stall. If I stalled, I wouldn't be having this conversation with you. I had no room to recover; that's my my job. So I did what I had to do to get the plane down safely."

During the ordeal, Nealy was constantly manipulating airspeed, which he gained and then lost. Once the airspeed increased, he'd stop the descent by gradually pitching attitude. "The plane would slow down slightly, but as soon as I got the stall warning notice, again, I pushed the nose down to get more airspeed," he said. "In other words, I'm riding right on the verge of a stall warning, until I got to a point where I realized that I could make the runway. I was going to touch down on the ground--I was going to land on that runway! When this was occurring, I lowered the flaps to landing position, pushed them, as it reduced my stall speed, and increased my drag. This procedure ensured I would touch down on the runway in control. I knew I was going to make the runway, so I pushed the nose forward to get as much speed as I could to use for flair. And a normal touchdown was made--not firm, not hard. The landing gear tires absolutely, positively didn't blow with touchdown; I could tell they were flat when I landed. There's a sensation that you receive from the tires not being inflated, and the tires were flat, in my opinion."

There's been controversy about when the Eclipse's tires were blown. Nealy believes the tires did not deflate on the original touchdown, but deflated during the first landing at MDW, as he was rolling down the runway and the plane's engines were stuck on max power. "When you have a normal landing, which we did the first time, you expect power to decrease, not increase," he said.

When asked what he thought might have been the outcome, without a copilot that day, Nealy replied, "I've thought about that. You know the aircraft is certified for single pilot; I can't overemphasize that this was an unprecedented, unanticipated event. I'm not saying that the aircraft should be operated with two people. I'm telling you that Eclipse is, I believe, working diligently to address this issue and come up with a procedure that a single pilot can operate with. Had I known about this event prior to my experience and training, procedures would've been in place that a single pilot could probably, easily take off and deal with the situation. I believe Eclipse, the FAA and NTSB are working on that right now."

Nealy added that having an extra set of eyes--another pilot next to him--definitely helped him to expedite decisive action.

[Frank N. O.]

I thought this hi-tech stuff was supposed to be fool-proof?

Btw, before I read what actually happend I paused for a second when I saw the pilot's firstname

If I ever get to start a pilot-career then I think I'd rather specialize in conventional aircraft and not those new-fangled fadec glass-cockpit thingies.

Frank

[Rooster Cruiser]

I thought this hi-tech stuff was supposed to be fool-proof?

We need to keep in mind this airplane's electronics were designed by former Microsoft Engineers.  Those guys are never worried if an Operating System has a system crash... they just reboot it.  They haven't ever had to think about what happens when lives are at stake.   

There's gonna be a lot of fallout over this incident.  Thankfully it was ONLY an incident and not an accident with fatalities.

[Frank N. O.]

I thought this hi-tech stuff was supposed to be fool-proof?

We need to keep in mind this airplane's electronics were designed by former Microsoft Engineers.  Those guys are never worried if an Operating System has a system crash... they just reboot it.  They haven't ever had to think about what happens when lives are at stake.   

There's gonna be a lot of fallout over this incident.  Thankfully it was ONLY an incident and not an accident with fatalities.

Microsoft! Porsche are great at making boxer-engines for cars, but their aircraft engine was mostly a failure, despite good intentions, that should be a hint that aviation is in a class of it's own and you just don't jump over there from other areas without extensive re-education.

I will say though that it was great work by the pilot(s) and I take that as an example that a cool head, knowledge and practice can save lives! (I hope I worded that right)

Frank

[TheSoccerMom]

Gee, what a bargain.   

I'd sure like to have that happen at treetop.   

Think I'll stick with my 29-year-old tank...   

[airtac]

The guy had to have been misquoted---I can't imagine someone trying to maintain best glide using the technique described---whoever wrote that made the pilot sound like an idiot.

I'm with you SoccerMom, I want  something more solid than a computer program between my right hand and the friggin engine

[AirScorp]

I've got mixed feelings about this one. One one hand, a simple, proven for decades mechanical design just spells reliable. On the other hand, when electronics are everywhere nowadays (electronic fuel injection engines to electric flaps and trims) I'm not willing to write off every technological evolution because sh$t happens when something leaves the testbed and enters real life. Every new system will have that, whether mechanical or electronic, and we've learned that from countless years of failures.

I think for me, the guy had a stuck throttle (on both engines  ) and managed it magnificently. What HAS to be done now is the manufacturers must focus on learning from the incident and make it safer. And they will, I'm sure. Still, FADECs haven't proven themselves yet and I'd hesitate a million times over if there's no manual override or something on that thing. 

Question about a word now, how do you call that flexible wire thingy that for example goes from the throttle control to the engine? I wanted to make a point that I've had a couple of these fail in my car and yet, it's as mechanical as it gets

[Oddball]

i just cal it a throttle cable or bowden cable nick . and that just shows how unreliable Micrsoft products really can be at times.

[Rooster Cruiser]

The guy had to have been misquoted---I can't imagine someone trying to maintain best glide using the technique described---whoever wrote that made the pilot sound like an idiot.

I'm with you SoccerMom, I want  something more solid than a computer program between my right hand and the friggin engine

I agree Airtac.  As I read the article I kept thinking to myself, "Why didn't he use an AOA, or at least fly best glide?"  I can't believe a 22000hr pilot would hang it on the edge of a stall, that's not how we train.

Other companies have been making FADEC's for years now.  The trouble here is that the FADEC in the Eclipse will control BOTH engines!  In a case like this, the one thing you want is some redundancy.  I cannot see the point of having two engines if you cannot control them independently.   

[leiafee]

The guy had to have been misquoted---I can't imagine someone trying to maintain best glide using the technique described---whoever wrote that made the pilot sound like an idiot.

It was a badly written article all round I thought.  The grammar and phrasing was ruddy awful too.

"the engines rapidly increased airspeed"  Huh?

"directing plots, rather than aircraft maintenance personnel"  When a specialist aviation publication cant spell "pilot" something's wrong!

"so I pushed the nose forward to get as much speed as I could to use for flair."  I'm sure he did land with flair...  possibly also with panache...  But what one does with a landing aircraft is "flare" is it not...  Back to homophone school Mr Editor.

Garbled, repetitious and littered with errors.  Dreadful writing.  If I was at work it'd be covered in red ink ;-)

[Baradium]

I think for me, the guy had a stuck throttle (on both engines  ) and managed it magnificently. What HAS to be done now is the manufacturers must focus on learning from the incident and make it safer. And they will, I'm sure. Still, FADECs haven't proven themselves yet and I'd hesitate a million times over if there's no manual override or something on that thing. 

I hope you never fly commercially then.  So many airliners these days have fadec.  Anything past the CRJ 200 has FADEC, but the CRJ is a hybrid combination of cables, hydraulic, and electronic, with no one of the three able to operate without both of the others.

[AirScorp]

So many airliners these days have fadec.  Anything past the CRJ 200 has FADEC, but the CRJ is a hybrid combination of cables, hydraulic, and electronic, with no one of the three able to operate without both of the others.

Hehe, got me there! I'd fly it if they gave me one  I just ruuuuuushed into that comment

And that's why I have mixed feelings about this! It's obviously better than the system you describe for CRJ (didn't know about that btw) because it's less complex. Still, is it "foolproof" yet? I'm skeptical. Told you they tried to instill some engineer thinking in me.  And the Eclipse is a relatively new aircraft. Why couldn't they build some redundancy to their FADEC instead of doing the opposite?

Don't get me wrong, I'm all for glass cockpits, FADECs, lands-by-itself APs and all that. Still like to have a little compass and a watch there if a GPS fails though

I hope you never fly commercially then.

I hope quite the opposite, thank you 

[Rooster Cruiser]

Why couldn't they build some redundancy to their FADEC instead of doing the opposite?

This certainly is the question of the day.  More importantly, why and how did the FAA sign off on a FADEC that lacked the necessary redundancy for certification?

In the 10 years since Eclipse was formed as a company and announced their initial design, there have been plenty of aeronautical engineers who have attempted to point out to Eclipse and others some of the more blaring shortcomings of the design.  They have all been brushed aside by what some have described as the "arrogance" of Eclipse's senior management.  Now I fear the chickens are coming home to roost.

It was announced on Monday July 28 2008 that Eclipse founder and CEO Vern Rayburn was stepping down, effective immediately.  Too early to tell how all this will shake out, but this may be the beginning of the end for Eclipse.  If so, it will be a sad ending to the company that first sold General Aviation on the concept of the VLJ.  Cessna has the Citation Mustang in production.  Embraer, Honda, Diamond, Piper, Grob, and Cirrus are either in development or flight testing of single and multi engine VLJ's.  The airport ramps of the future promise to have a lot of these tiny jets on them, and we may credit Mr Rayburn for that at the very least.

RC

[Paradox]

I know blue mountain avionics http://www.bluemountainavionics.com/ uses Linux kernels because they are about idiot proof. I fix computers all teh time, I see windows vista. Never linux thought the distribution is about equal at my college. Why are they using Windows? I mean come on, that is asking for problems. But awesome job to the pilots,  god knows I want people like that at the helm if I am a passenger.