CEN19FA036

The pilot’s inability to regain airplane control after a left roll that began for reasons that could not be determined based on the available evidence.

**This report was modified on February 23, 2024.** The pilot and two passengers departed in instrument meteorological conditions on a crosscountry flight. According to the airplane’s automatic dependent surveillancebroadcast (ADSB) data, the airplane climbed to about 1,400 ft mean sea level (msl) before it turned left onto a track toward the assigned fix and continued to climb. The pilot contacted air traffic control and was assigned 10,000 ft; he turned the autopilot on and adjusted the selected altitude to 10,000 ft. The airplane passed 3,000 ft, with airspeed between 230 and 240 kts, and continued to climb. The airplane then began to bank to the left at a rate of about 5° per second. After the onset of the roll, the airplane maintained airspeed and continued to climb for 12 seconds, which indicated that engine power was not reduced in response to the roll onset. When the airplane reached about 30° of left bank, about 3 seconds after the onset of the roll, the autopilot disconnected accompanied by an aural alert. About 1 second later, the cockpit voice recorder (CVR) recorded a statement by the pilot consistent with surprise, likely made in response to the autopilot disconnect and/or the bank angle. Based on the pilot’s statement of surprise, it is unlikely that the pilot commanded the left bank. The airplane continued its climb and reached a maximum altitude of about 6,100 ft msl before it began to rapidly descend, with its left bank angle reaching near 90°. During the descent, the airplane’s enhanced ground proximity warning system announced eight “bank angle” annunciations and one “overspeed warning” annunciation. About 23 seconds after the autopilot disconnected, the pilot made a mayday call shouting that he was “…in an emergency descent unable to gain control of the aircraft.” At the final ADS-B data point, the airplane was at an altitude of about 1,000 ft msl, at an airspeed of about 380 kts, and in a 53° left bank. The airplane impacted a wooded area about 8.5 miles northwest of the departure airport. The total time from the beginning of the left bank until ground impact was about 35 seconds. The airplane was modified with a Tamarack Aerospace Group Active Technology Load Alleviation System (ATLAS), which operated independently of other airplane systems. The system included the installation of Tamarack Active Camber Surfaces (TACS), which are aerodynamic control surfaces mounted on the wing extensions that either hold their position in trail with the wing or symmetrically deploy trailing edge up or trailing edge down to alleviate structural loads. The TACS are actuated by the TACS control units (TCUs) and are not controlled by the pilot. Postaccident examination of the airplane’s left TACS control linkage assemblies revealed a witness mark on the bellcrank, consistent with contact with the trailing edge up mechanical stop, which is slightly beyond the trailing-edge-up soft stop limit of the TCU. Additional damage on the left TACS inboard hinge fitting, consistent with overdeflection in the trailing edge up direction, indicated that the left TACS was well beyond the trailing edge up hard stop limit of the TCU at some point in the impact sequence. Computed tomography (CT) scans revealed that the left TCU ball nut was near the actuator extension limit in the TACS trailing edge up position. Examination of the left TCU showed contact marks on the ram guide housing that corresponded with the TACS in a neutral position, in an intermediate trailing edge up position, and with the TCU fully extended in the TACS trailing edge up position. Also, witness marks appeared on the TCU extend hard stop, consistent with a high-energy impact. The evidence was insufficient to determine which witness mark occurred at initial impact. Examination of the right TACS control linkage assemblies revealed damage to the trailingedgedown bolt/stop. Damage to the bolt was consistent with the bellcrank impacting the bolt with sufficient force to shear the bolt at the nut, which is consistent with the TACS moving to a trailingedgedown position during the impact sequence. Additional damage on the TACS inboard hinge fitting, consistent with overdeflection in the trailingedgedown direction, was consistent with the TACS being in a trailingedgedown position. The forces required to cause this damage would likely be due to the control system moving with some speed toward the trailingedgedown position. Examination of the right TCU, which was found detached from its mounting location, did not find contact marks on the retract hard stop that would have been consistent with a full trailingedgedown position. CT scans revealed that the right TCU ball nut was in a position that corresponded to a TACS intermediate trailing edge up position. Witness marks observed on the ram guide housing corresponded (approximately) to this position of the ball nut. Because the right TCU and TACS were found separated from the control linkage assembly, it is likely that the TACS was able to move freely after initial ground impact and then cause the damage to the trailingedgedown bolt/stop. Postaccident examination revealed that the left TCU’s 40-pin connector had 6 pins that were bent. The bent pins were near the end of the connector, and two of the pins did not have electrical continuity. The NTSB could not determine when or how the pins were bent but recognizes the possibility that the pins were bent during the impact sequence. According to the airplane performance study, certification failure assessment flight testing for the ATLAS found that at a speed of 240 kts, an initial bank angle of 30°, and a maximum unfavorable fuel imbalance (critical failure condition), a near full asymmetric deflection of the TACS resulted in a roll rate of greater than 20° per second. For the accident flight, at the start of the left roll, the airplane’s airspeed was calculated to be 240 kts with the wings about level. In the flight test, the pilot reacted to the full asymmetric TACS deflection within 3 seconds and was able to counteract the roll induced by the asymmetric TACS deflection. The accident roll rate of 5° per second was significantly less than the flight test data provided for a fully asymmetric TACS deflection at a critical failure initial condition. It is possible that the system was not experiencing a full asymmetric failure or that the full possible roll rate could not be induced because the airplane was not in the critical failure condition. The roll rate did change from negative to positive, and the roll angle did recover from 90° left wing down to about 53° left wing down before ground impact. If an asymmetric TACS deflection caused the left roll, it is possible the pilot was able to roll the airplane back to the right but not enough to fully recover and arrest the descent. However, because the airplane was not equipped with a flight recorder, control surface deflections and pilot input are unknown. Further, the ATLAS is independent of other airplane systems, and it does not record any information about TCU actuation or TACS deflection. After this accident, the ATLAS manufacturer issued a service bulletin (SB) applicable to all TACS units in response to uncommanded roll events related to ATLAS failures. The SB stated that the aerodynamic overbalance of the TACS allowed for the TACS to remain deployed when power was removed from the TCU while the TACS are deployed or if unique aerodynamic conditions were encountered causing the TACS to deploy with the TCUs in an unpowered state. (The available evidence for this investigation did not allow the National Transportation Safety Board to determine whether these circumstances occurred during this accident.) The SB specified the application of centering strips attached to the upper and lower trailing edge of the TACS that, in the event of a system fault, would aerodynamically force t

The pilot received his single-pilot Cessna 525 type rating to his airline transport pilot certificate on February 28, 2018, after completing training at Simuflite and prior to the installation of the Tamarack Aerospace Group Active Technology Load Alleviation System (ATLAS) on the accident airplane. On his application to add the Cessna 525 type rating, the pilot reported 3,291 total hours of flight experience and 453 hours of instrument experience. On previous applications filed on February 14, 2017, and on August 29, 2016, the pilot reported the same hours. On his application for a Federal Aviation Administration (FAA) medical certificate dated March 15, 2018, the pilot reported 3,500 total hours. Logbooks for the pilot were not located, and no online logbook was discovered during the investigation. The pilot’s total hours and experience could not be verified. Autopilot The airplane was equipped with an autopilot system. The pilot can disengage the autopilot, and the autopilot can also disengage during abnormal situations. Abnormal disconnects can occur if the stick shaker activates, there is a yaw damper or internal autopilot failure (such as an excessive autopilot roll rate of 10°/second into a bank), there is an attitude heading reference system failure or miscompare, there is a loss of power to the normal (main) DC buses, or excessive attitudes are reached (25° nose up, 15° nose down, or 45° left or right wing down). EGPWS The airplane was equipped with a Honeywell Mark VIII EGPWS that interfaced with various airplane systems and provided six modes of alerts for the flight crew, including advisory callouts through the cockpit audio system for “bank angle” to alert the pilot to excessive bank angles. According to the Citation Aircraft Flight Manual, the aural advisory for bank angle above 2,450 ft above ground level occurs at 55°. Aircraft Recording System The airplane was equipped with an aircraft recording system (AReS), which recorded aircraft system maintenance data to help with maintenance troubleshooting procedures. Data were stored on a compact flash card installed in the AReS recording unit. The unit was not required to be installed, nor was it certified to FDR regulatory standards for crashworthy data storage or required parameters. Active Technology Load Alleviation System Tamarack Aerospace Group designed and manufactured the ATLAS and used Cranfield Aerospace Solutions Ltd. (CAeS) to provide support for a European Union Aviation Safety Agency (EASA) supplemental type certificate (STC). On December 22, 2015, EASA approved STC 10056170, and on December 27, 2016, the FAA issued STC SA03842NY after validation of the EASA STC. Tamarack modified the original airplane design by removing the wing tip assemblies and adding winglets and wing extensions that contain active aerodynamic surfaces. The system was designed to provide increased aerodynamic efficiency without adverse structural effects due to the winglet installation. ATLAS operates independently of all other airplane systems. The main components of ATLAS consist of two wing extensions and two winglets with an ATLAS control unit (ACU), two Tamarack active camber surfaces (TACS), two TACS control units (TCUs), an annunciator line replaceable unit (LRU), and an ATLAS INOP button. The TACS are active aerodynamic control surfaces mounted on the wingtip extensions that either hold their position in trail with the wing or deploy symmetrically to alleviate structural loads. The TACS attach to the wing-tip extensions through two hinges and connect to the TCUs via pushrods, a bellcrank, and a walking beam. The ACU, which was mounted to the fuselage near the airplane’s center of gravity, is an analog device with no software or nonvolatile memory, , contains two accelerometers to measure acceleration along the vertical axis, and provides commands to the TCUs to actuate the TACS symmetrically as required based on varying loading conditions. The TCU communicates with the ACU for fault monitoring and system operation. In the event of a fault being detected, the ACU signals the TCU to depower the motor. The TCUs contain electronic limits to actuator travel (soft stops) and hardware limits (hard/mechanical stops). (These hard stops are internal to the TCU; additional hard stops are located within the bellcrank.) When power is not applied to the TCUs, the TACS are free to move with an applied force of 10 lbs or less. The ATLAS installation allows the TACS to travel 21° ±1° trailing edge up and 10° ±1° trailing edge down to mechanical stops located in the bellcrank assembly. The nominal operational travel is 20° trailing edge up and 9° trailing edge down using the electronic stops within the TCU. During normal operations, due to the electronic limits, the bellcrank should not contact the hard stops. The bellcrank contains a TCU return spring and two hard stops, one in the trailing-edge-up direction and one in the trailing-edge-down direction. The annunciator LRU contains relays to trigger the annunciation of the ATLAS INOP button, which was installed on the main instrument panel, in the event of a system fault signal or loss of power from the ACU. The ATLAS INOP button, illuminates in the event of a fault condition and provides the flight crew with a primary means of resetting the system during a faulted condition. The illumination of the ATLAS INOP button would not result in an aural annunciation. Logic within the system depowers the TCUs if an asymmetric deployment of the TACS is sensed. In this situation, the TACS would be able to free float and could aerodynamically move to their full deflection hard stop. Centering strips introduced several months after the accident in a service bulletin (SB) would use aerodynamic forces to move the TACS to a streamlined position (see Additional Information section). On May 27, 2018, the accident airplane was modified via STC SA03842NY to install the ATLAS. None of the installed components for the ATLAS were capable of recording a fault history, nor were they required to do so. Maintenance The left TCU, manufactured on December 18, 2017, and the right TCU, manufactured on November 14, 2017, were initially installed on the airplane on May 27, 2018. Both TCUs had been returned to the manufacturer per SB CAS/SB1467, which corrected the potential for a metal fastener inside the TCU to become loose and detach and were reinstalled on the airplane on July 13, 2018. The last maintenance performed on the airplane occurred on November 20, 2018; at that time, the airplane had a total of 3,296.7 flight hours. At the time of the accident, the ATLAS had accrued about 250 flight hours and about 193 flight hours since SB CAS/1467 was accomplished. There were no reported discrepancies concerning the flight controls, autopilot, or ATLAS before the accident. The Clark County Coroner’s Office, Jefferson, Indiana, recovered the remains of the pilot but was unable to perform an autopsy or obtain suitable samples for toxicology testing. The coroner ruled the cause of death as blunt force trauma. The debris field measured about 400 yards on an easterly heading through a wooded area. The first impact point consisted of treetops. The airplane was found fragmented in numerous pieces with the right engine being the farthest piece of wreckage. All major airplane components were accounted for at the accident site. There was evidence of a postimpact fire. A layout reconstruction of the primary flight controls was conducted on scene. All flight control cables were broken in multiple locations, and all breaks displayed broomstrawing at the fracture points. No preimpact anomalies were noted with the flight controls. Both engines’ full authority digital engine control units, which do not record continuous engine data, were recovered from the accident site and sent to the manufacturer for download. Data extracted from both units revealed that neith