CEN18FA400

The pilot's incapacitation resulted in impact with the Gulf of Mexico. The reason the hypoxia recognition system did not descend the airplane as designed could not be determined as the airplane was not located.

The pilot was in cruise flight at 19,000 ft mean sea level when he became unresponsive to air traffic control. Military pilots dispatched to intercept the airplane reported that the pilot was seated upright with his head tilted back against his seat and was unresponsive. The airplane continued on its established course at 19,000 ft over the Gulf of Mexico, where radar contact was lost about 3.75 hours after the pilot's last communication with air traffic control. The engine likely lost total power due to fuel exhaustion and the airplane descended into the water. The airplane was equipped with a hypoxia recognition system which was designed to descend the airplane to a lower altitude in the event of pilot incapacitation. Given the altitude of the accident airplane, the system should have activated about 17 minutes after the pilot's last input or interaction with the system. Following the accident, the manufacturer identified a condition under which uncommanded inputs could be made to the airplane's avionics, which could interfere with the normal function of the hypoxia recognition and automated descent features; however, the reason for the accident airplane's continued flight at 19,000 ft could not be determined, as the airplane was not recovered. The last few transmissions by the pilot to air traffic control illustrated a degradation in communication consistent with incapacitation. Given this interaction with the pilot and the lack of response from the pilot when the airplane was intercepted, it is likely that the pilot became incapacitated due to hypoxic hypoxia.

The pilot’s personal flight logbooks were not located. On September 15, 2018, the United States Coast Guard recovered an airplane piece that washed up on Surfside Beach, near Freeport, Texas. The piece was confirmed to be from the accident airplane. No other pieces from the accident airplane were recovered. The airplane was equipped with two fuel tanks with a total fuel capacity of 94.5 gallons, 92 gallons of which was usable. Depending on the engine power setting, the airplane had an endurance between 3.8 and 5.5 hours. The airplane was equipped with a Cirrus Perspective+ integrated flight deck, which comprised of a primary flight display (PFD) and a multi-function display (MFD). All displays offer control for communication and navigation frequency selection. The Perspective+ system on the accident airplane was configured with an Emergency Descent Mode (EDM) function. This was a standard “feature” on all Perspective (0764.09 software and later) and all Perspective+ avionics equipped aircraft. According to the airplane records, the airplane had Garmin Software version 0764.32 (P/N: 006-B0764-32) which included the EDM function. Garmin Hypoxia Recognition with Automatic Descent Mode: The airplane was equipped with a hypoxia recognition system for the purpose of detecting pilot incapacitation because of hypoxia or other physical conditions by continuously monitoring the pilot’s interaction with the Garmin Perspective+ system. If the system determines that the pilot is not responding, the Emergency Descent Mode function is engaged. When activated, the system commands the airplane to descend to a lower altitude to provide the pilot and passengers an opportunity to recover from the effects of hypoxia. The system is only operative when the airplane’s altitude is above 14,900 ft (pressure altitude) and the Garmin automatic flight control system (AFCS) is engaged. Pilot interaction with the Perspective+ system is monitored by detecting key presses and turns of the knobs (audio panel and push-to-talk switch excluded). If a period of inactivity, time dependent on altitude, is detected, the hypoxia recognition system will initiate the Emergency Descent Mode. The accident airplane was at an altitude of about 19,000 ft which would result in an activation time of about 17 minutes. Upon activation of the Emergency Descent Mode, there are four sequential phases employed by the system; determining pilot alertness, descent to 14,000 ft MSL, and descent to 12,500 ft MSL. The Phases are: • Advisory Annunciation: When the system detects a sufficient period of inactivity, the Advisory Annunciation “ARE YOU ALERT?” is displayed. Selecting the ALERT Softkey will acknowledge the message and reset the system. Pressing any other softkey or turning a knob will also reset the system. • Caution Annunciation: When no pilot interaction is detected for an additional 60 seconds, the Caution Annunciation “HYPOXIA ALERT” is displayed. Again, selecting the ALERT Softkey will acknowledge the message and reset the system. Pressing any other softkey or turning a knob will also reset the system. • Warning Annunciation: When no pilot interaction is detected for an additional 60 seconds, the Warning Annunciation “AUTO DESCENT” is displayed in the Annunciation Window and “Automatic descent to 14,000FT in 60 seconds” is displayed in the Alerts Window. Once again, selecting the ALERT Softkey will acknowledge the message and reset the system. Pressing any other softkey or turning a knob will also reset the system. • Descent: When no interaction is detected for another 60 seconds, the system will automatically proceed with the descent. As the system prepares for descent, the Selected Altitude is set to 14,000 and the AFCS enters Indicated Airspeed (IAS) mode with the airspeed reference set to the maximum allowable airspeed setting for the specific aircraft model. AFCS lateral mode settings are not affected. As the descent begins, an “AUTO DESCENT” warning is displayed in the Annunciation Window. “AUTO DESCENT - Aircraft Descending to 14,000FT” is displayed in the Alerts Window. “EDM” is shown as an AFCS Status Annunciation indicating the system has entered Automatic Descent Mode. “EDM” A continuous repeating chime will be heard as long as Automatic Descent Mode is active. After the descent begins, Automatic Descent Mode can only be canceled by disconnecting the autopilot. As the airplane reaches 14,000 ft the system sets the AFCS to Altitude Hold mode. The AFCS will also remain in Automatic Descent Mode as indicated by “EDM” continuing to be displayed as an AFCS Status Annunciation. The system again begins monitoring for pilot interaction. If no pilot interaction is detected for four minutes, the system initiates the second descent. As the system prepares for this descent, the Selected Altitude is set to 12,500 ft msl and the AFCS again enters IAS mode with the airspeed reference set to the maximum allowable airspeed for the specific aircraft model. As the descent begins, an “AUTO DESCENT” warning is displayed in the Annunciation Window. “AUTO DESCENT - Aircraft Descending to 12,500FT” is displayed in the Alerts Window. “EDM” is shown as an AFCS Status Annunciation. Also, the continuous repeating chime is heard. As the airplane reaches 12,500 ft the system sets the AFCS to Altitude Hold mode. The AFCS will also remain in Automatic Descent Mode as indicated by “EDM” continuing to be displayed as an AFCS Status Annunciation as well as the continuing presence of the repeating chime. At this point, the AFCS must be disconnected to cancel Automatic Descent Mode. Cirrus Service Advisory: According to Cirrus Service Advisory SA19-09, dated April 26, 2019, Cirrus was made aware of a condition where the Dual Concentric Knob (DCK) on certain Garmin PFD and MFD units can exhibit uncommanded inputs, resulting in unintentional standby frequency changes, MFD page navigation, or similar behavior. In addition, these uncommanded inputs may interfere with the normal function of the Hypoxia Recognition System feature in the Garmin System Software. For the SR22T, the Service Advisory is effective for airplanes with the Perspective Avionics having software version v0764.09 (and later) or Perspective+ Avionics (all software versions). The accident airplane was equipped with Garmin Software version 0764.32 (P/N: 006-B0764-32). Cirrus provided the National Transportation Safety Board (NTSB) with a description of a software change that Garmin made to their Perspective+ system. According to Cirrus, Garmin revised the software responsible for resetting the hypoxia alert system. Before the change, the hypoxia alert would be reset when the system software detected when a dual concentric knob on the PFD or MFD had been turned (audio panel and push-to-talk switch excluded) or when a key was pressed. On December 6, 2019, Garmin released software update 02647.N4 for new Cirrus production aircraft manufactured after that date. With this software update, the alert will only be reset when the system detects that a key has been pressed.” Garmin has developed a software update “0764.38”, for aircraft delivered prior to December 6, 2019. The software is currently in testing with a release date to be determined. Oxygen System: The airplane was equipped with a Precise Flight, Inc. fixed oxygen system. This system was designed to provide supplemental oxygen for the pilot and passengers. The system consisted of a 77 cu ft bottle and a pressure regulator assembly located in the aft fuselage, a four or five place distribution manifold located in the headliner, a control panel located in the center console next to the flap switch, and up to five (5) flow devices consisting of either constant flow meters or demand regulators, with either a cannula or face mask for each user. Fo