CHI08IA152

The airplane manufacturer's inadequate software design requirements of the engine's full authority digital electronic controls (FADEC) fault logic that resulted in a simultaneous unrecoverable loss of thrust control on both engines when the FADEC's input data values exceeded specified ranges during the approach. Contributing to the incident was the Federal Aviation Administration's failure to recognize and correct this condition during the certification of the airplane.

The flying pilot of a very light jet airplane encountered windshear and a high sink rate on approach which he arrested by applying engine power. During landing he lightly applied brakes and observed that the airplane was accelerating. The pilot initiated a go-around. The engines were at maximum power and the crew alerting system illuminated left and right engine control failure messages. The automatic power reserve armed light was also illuminated. The crew maneuvered the airplane and troubleshot the engine control fail indication using the quick reference handbook while on downwind. The right engine was shutdown and the left engine would not respond to throttle movements during the remainder of the incident flight. The crew subsequently completed the emergency landing. On scene and subsequent throttle quadrant assembly examinations showed the assembly could produce an out of specified range signal when the throttles had forward force applied to them. Diagnostic storage unit data showed both engines' full authority digital engine control (FADEC)s encountered a fault signal from the engine controls about the time of the pilot's reported application of the throttles in response to the windshear during the incident approach. The airplane's FADEC fault logic was designed to "latch" or hold the last good value when the upper specified parameter limit was exceeded. The data showed the left engine went to flight idle when the right engine was shut down in accordance with the fault logic. The airplane's design was Federal Aviation Administration (FAA) certified with that fault logic. As a result of the investigation, the National Transportation Safety Board issued two urgent recommendations to the FAA. A-08-46 recommended an immediate inspection of all throttle quadrants to ensure that pushing the throttle levers against the maximum power stops will not result in an engine control failure, and further require that any units that fail the inspection be replaced and that the replacement parts be similarly inspected. A-08-47 recommended an immediate emergency procedure for a dual engine control failure on the incident airplane model and incorporate the procedure into the airplane flight manual and quick reference handbook via an airworthiness directive.

HISTORY OF FLIGHT On June 5, 2008, about 1300 central daylight time, an Eclipse Aviation Corporation EA500 airplane, N612KB, sustained no damage when its flight crew encountered a loss of thrust control with both engines at maximum power thrust during an approach to land on runway 22L at the Chicago Midway International Airport (MDW), Chicago, Illinois. A go-around was performed and the crew shut down the right engine on base leg. The left engine went to flight idle and the crew encountered a total loss of thrust and continued loss of thrust control. The crew declared an emergency and performed a forced landing on runway 22R. The airplane was operating on an activated instrument flight rules flight plan under the provisions of 14 Code of Federal Regulations Part 91. The two airline transport rated pilots and two passengers were uninjured. The business flight originated from the Cleveland-Hopkins International Airport, Cleveland, Ohio, about 1145 and was destined for MDW. The left seated pilot who was the flying pilot reported that as the airplane was crossing the runway 22L threshold during the initial approach to land, he and the non-flying pilot encountered a 10 to 15-knot wind shear and the airplane developed a high sink rate that he arrested by applying power. The flying pilot further stated that after the airplane had touched down about 83 knots and, after he had lightly applied the brakes, he noted that the airplane was rapidly accelerating through 100 knots and that the engines were at maximum power. Both pilots reported seeing on the crew alerting system (CAS) display, "L ENG CONTROL FAIL" and "R ENG CONTROL FAIL" and the Automatic Power Reserve armed light was illuminated, as the airplane climbed out during the go-around. The flying pilot stated that although he had lowered the landing gear and brought the flaps from the landing to the takeoff position to remain below 200 knots, it was still necessary to maintain a shallow climb so as to not exceed 200 knots. The pilots stated that they declared an emergency, and air traffic control cleared them to land on any runway. The pilots stated that after referencing the quick reference handbook emergency procedures section "2.5 Engine Control Fail," they elected to shut down the right engine. The flying pilot stated that as they were maneuvering to land, they got a stall warning and he noticed the airspeed was decreasing. The flying pilot further reported that the left engine was at idle power and would not respond to throttle movements. The airplane landed and stopped on the runway. It was reported that the two main landing gear tires were found to be flat after the airplane came to rest on the runway. PERSONNEL INFORMATION The flying pilot held a Federal Aviation Administration (FAA) airline transport pilot certificate with airplane single-engine and multiengine land ratings. He held commercial pilot privileges with an airplane single-engine sea rating. He held a flight engineer certificate with a turbojet powered rating. He held a first class medical certificate with no limitations. He held a control tower operator certificate limited to Wiesbaden Tower, Wiesbaden AB, Germany. He reported that he had accumulated 21,500 hours of total flight time and 300 hours of total time in the EA500. He held type ratings in Boeing 727 and 737 airplanes, in Convair 240, 340, and 440 airplanes, in McDonnell Douglas DC-3 and DC-9 airplanes, in Eclipse Aviation EA500 airplanes, in Lockheed L-382 (C-130) and L-1329 (Jetstar) airplanes, and in Saberliner N-265 airplanes. The non-flying pilot held a FAA airline transport pilot certificate with an airplane multiengine land rating. He held commercial pilot privileges with rotorcraft and instrument helicopter ratings. He held private pilot privileges with an airplane single engine rating. He held a first class medical certificate with no limitations. He reported that he had accumulated about 2,400 hours of total flight time and 89 hours of total time in the EA500. AIRCRAFT INFORMATION N612KB, an Eclipse Aviation Corporation EA500 airplane, was a five-place, pressurized, retractable tri-cycle landing gear, twin-engine monoplane of predominately aluminum construction. The airplane's serial number was 000026. The airplane was powered by two Pratt & Whitney Canada PW610F-A turbo-fan engines, each producing 950 pounds of takeoff thrust. The airplane's maximum gross weight was 5,800 pounds. The pilot's report indicated that the airplane was last inspected on May 31, 2008 in accordance with a continuous airworthiness program. The report indicated that the airplane had accumulated 238.9 hours of flight time at the time of the incident. The airplane's flight manual, in part, stated: Each engine is controlled by a dual-channel Full Authority Digital Engine Control (FADEC) unit. Either channel is capable of controlling its engine. All engine parameters are displayed on the Multifunction Display. Primary parameters are continuously displayed, while secondary parameters are displayed on the ENG [engine] synoptic page. Each engine has individual flight deck controls. Thrust is set by positioning the throttles ... manually by the pilot. ... Each of the two FADEC units is co-located with an Aircraft Computer System (ACS) within the Avio Processing Center (APC). To provide redundant control in the event of a failure, each FADEC has two control channels, one for each engine. All critical sensors are dual element, providing dedicated inputs to both FADEC channels. To further protect against potential local events that may affect an APC, each APC houses one channel for each engine. ... Automatic Power Reserve The PW610F FADEC has an Automatic Power Reserve (APR) feature that automatically increases thrust, on the operating engine, in the event an engine fails during takeoff. APR is automatically armed when both throttles are at the takeoff power setting. The APR system can be disarmed with a line select key on the ENG synoptic page. The Eclipse Aviation Corporation EA500 airplane was certified by the FAA under 14 Code of Federal Regulations Part 23 and was issued type certificate number A00002AC dated September 30, 2006. METEOROLOGICAL INFORMATION At 1151, the recorded weather at MDW was: Wind 190 degrees at 13 knots gusting to 22 knots; visibility 10 statute miles; sky condition few 2,200 feet, scattered 5,000 feet, overcast 15,000 feet; temperature 28 degrees C; dew point 23 degrees C; altimeter 29.72 inches of mercury. At 1251, the recorded weather at MDW was: Wind 200 degrees at 18 knots gusting to 26 knots; visibility 10 statute miles; sky condition scattered 2,900 feet, broken 3,700 feet, broken 5,000 feet, overcast 15,000 feet; temperature 29 degrees C; dew point 22 degrees C; altimeter 29.71 inches of mercury. AIRPORT INFORMATION MDW was located approximately 9 miles southwest of Chicago, Illinois, and was owned and operated by the city of Chicago, Illinois. MDW was a certificated airport under 14 CFR Part 139. MDW's field elevation was 620 feet above mean sea level (MSL). The airport had five runways: Runway 13C/31C - 6,522 feet by 150 feet, concrete/grooved; runway 4R/22L - 6,446 feet by 150 feet, asphalt/concrete/grooved; runway 4L/22R - 5,507 feet by 150 feet, asphalt/grooved; runway 13L/31R - 5,141 feet by 150 feet, asphalt/grooved; and runway 13R/31L - 3,859 feet by 60 feet, concrete. FLIGHT RECORDERS N612KB was not required to be equipped with a flight data recorder. However, the airplane was equipped with a Diagnostic Storage Unit (DSU) which recorded aircraft-related data in its solid state memory. Much of the data was collected at 1 second intervals, although some individual parameters were collected more frequently and some were collected less frequently. WRECKAGE AND IMPACT INFORMATION An on