ERA23LA135

The flight crew’s failure to remove the right side pitot probe cover before flight, their decision to depart with a No-Go advisory message following an aborted takeoff, and their selection of the incorrect non-normal checklist in flight, which resulted in an in-flight upset that exceeded the maneuvering load factor limitations of the airplane and resulted in fatal injuries to a passenger whose seatbelt was not fastened. Contributing to the severity of the in-flight upset were the pilot-in-command’s (PIC) decision to continue the climb and use the autopilot while troubleshooting the non-normal situation, and the PIC’s pilot-induced oscillations following the autopilot disconnecting from the out-of-trim condition. Also contributing to the accident was the crew’s inadequate crew resource management.

The flight crew flew the passengers to their destination the day before the accident, and were conducting the return flight the following day. During the exterior preflight inspection, the second-in-command (SIC) was interrupted by line personnel delivering ice to the airplane and inadvertently failed to remove the right side pitot probe cover. The flight crew completed the remainder of their preflight activities, boarded the passengers, and taxied for takeoff. During takeoff, the SIC observed an anomaly with his right side primary flight display (PFD) airspeed indicator and he called for the pilot-in-command (PIC) to abort the takeoff. The PIC aborted the takeoff and taxied the airplane off the runway onto a taxiway. The SIC suspected that he may have forgotten to remove the pitot probe cover, and while stopped on the taxiway with the right engine running, he exited the airplane and removed the cover. Data recovered from the airplane’s flight data recorder (FDR) indicated that the crew aborted the takeoff 16 seconds after thrust application, and the airplane reached a maximum speed of 104 knots (kts) as indicated by the left PFD airspeed indicator. The right PFD airspeed indicator data was consistent with the pitot probe remaining covered. While on the taxiway, the PIC began troubleshooting a Crew Alerting System (CAS) cyan (blue) “RUDDER LIMITER FAULT” advisory message. He also noticed that the flight director was stuck in a pitch mode. He conducted multiple avionics stall tests, which had cleared the message on past flights; however, he was unable to clear the advisory message. The SIC initially indicated that he would call maintenance control; however, after a short discussion with the PIC, both flight crew members agreed to continue the flight with the advisory message posted. The flight crew did not consult the airplane’s “Go/No-Go” guide, but if they had, they would have found that the Rudder Limiter Fault advisory message was a “No-Go” item, and that the Minimum Equipment List provided no relief to depart with that message displayed. During the subsequent takeoff, the SIC noticed that the airplane’s V-speeds were no longer referenced (“bugged”) on the airspeed indicator, and he called the speeds from memory. When the airplane passed through about 400 ft radio altitude, an amber (yellow) caution “MACH TRIM FAIL” CAS message posted. The PIC turned the airplane on course and shortly after takeoff, turned on the autopilot (AP), after which the CAS immediately displayed an additional amber “AP STAB TRIM FAIL” caution message. During the climb to cruise altitude, the pilot disconnected the autopilot via his use of the horizontal pitch trim control wheel button. Following his trim adjustments and the resulting disconnect of the autopilot, he subsequently reengaged the autopilot two additional times. With each disengagement and reengagement, all AP-related caution messages would clear, and then reappear upon autopilot reengagement. Furthermore, during the second and third engagements, an additional “AP HOLDING NOSE DOWN” caution message was displayed as airspeed increased in the climb. According to the cockpit voice recorder (CVR), the SIC asked if the autopilot was failing to off, or if the PIC was disengaging the autopilot. The PIC informed the SIC that he disengaged the autopilot, but during the subsequent disengagements and reengagements, he never announced to the SIC that he was turning the autopilot on or off. The SIC advised the captain to not use the autopilot during the climb, to which the PIC agreed. Shortly after receiving the amber CAS caution messages, the PIC called for the SIC to “get the checklist,” but did not call for a specific checklist by name. The flight crew then became fixated on reprogramming the V-speeds into the Flight Management System (FMS), as the SIC believed that the caution messages may have been related to a configuration problem with the V-speeds and FMS since they had cleared following the aborted takeoff. About 8 minutes after the PIC called for the checklist, the SIC located the quick reference card (QRC) and the “PRI STAB TRIM FAIL” [Primary Stabilizer Trim Failure] checklist. The SIC reported in a postaccident interview that he selected this checklist because it was the only trim failure checklist on the QRC, and it seemed to address the root cause of the problem. Although there were multiple CAS messages displayed, he did not consider using any other checklist. The SIC reported that he visually showed the PIC the checklist, and they agreed to execute the checklist. The first action item was to move the stabilizer trim switch (“STAB TRIM”), located on the center console, from “PRI” (Primary) to “OFF.” The SIC read the checklist item aloud and subsequently moved the switch to off. Flight data recorder (FDR) information indicated that, as soon as the switch position was moved, the autopilot disconnected, and the airplane, which had been in a 3° nose-up attitude, rapidly pitched up to 11° in one second. The normal acceleration then rapidly rose to 4g. The PIC then pushed the control column forward with at least 90 lbs of force, the airplane pitched down to a near nose-level attitude, and the normal acceleration was reduced to -2.3g. The control column was subsequently pulled back through neutral, and the airplane rapidly pitched up to over 20° nose-up and more than 4g of normal acceleration. The FDR then stopped recording as the inertial g switch was triggered by the loading. As a result, the full extent of the pitch event was not recorded. The airplane’s maneuvering load factor limitation was +2.6g. The PIC reported that, immediately before the pitch oscillations, his left hand was on the flight controls and his right hand was guarding the right side of the flight controls. He reported that he did not anticipate the airplane pitching up so rapidly, but he did expect the autopilot to disconnect upon turning the stabilizer trim switch off. Shortly after the in-flight upset, the flight crew were alerted to a passenger that had been seriously injured. The SIC exited the flight deck to check on the passenger and to provide medical attention. He subsequently informed the PIC that there was a medical emergency and that they needed to land. About 17 minutes after the in-flight upset, the flight landed at the diversion airport. Later that day, the passenger succumbed to her injuries sustained during the in-flight upset. Postaccident download of the horizontal stabilizer trim electronic control unit (HSTECU) non-volatile memory found that, during the aborted takeoff, the speed mismatch between Air Data Computer 1 (ADC1) and ADC2 exceeded 20 kts for more than 5 seconds (due to the covered right pitot probe). This scenario resulted in key faults being recorded in the HSTECU. A review of the logic for these fault messages showed that the HSTECU latched an "ADC1/ADC2 Miscompare," indicating an airspeed data mismatch between ADC1 and ADC2, resulting in the HSTECU posting the Rudder Limiter Fault advisory message. In addition, a “Confirmed Mach Valid” latched to FALSE, which resulted in the Mach Trim Failure message, and the HSTECU inhibiting the autopilot trim function of the stabilizer. The manual stab trim operated at a reduced rate of movement, but was functional. The series of faults introduced into the HSTECU following the aborted takeoff resulted in the crew receiving the “AP STAB TRIM FAIL” CAS caution message upon autopilot engagement, due to the HSTECU inhibiting the autopilot trim function of the stabilizer. With the autopilot engaged and the trim function inhibited, the autopilot subsequently alerted the flight crew to “AP HOLDING NOSE DOWN,” which was meant to alert the crew that the autopilot was on, but that the airplane was out of trim and the autopilot was holding additional load on the flight controls. According

Review of weather conditions along the route of flight revealed found no evidence of convective activity, nor any evidence of significant turbulence (reported or forecast). The flight crew reported that they did not experience any remarkable turbulence during the flight, or during the time immediately surrounding the in-flight upset. According to Federal Aviation Administration (FAA) airman records, the PIC held an airline transport pilot certificate and held a PIC type rating in the accident airplane make and model, in addition to other type ratings. Executive Flight Services (EFS) reported that the PIC had accumulated 5,061 total hours of flight experience, and of those, 88 hours were in the accident airplane make and model. The SIC held an airline transport pilot certificate and held a PIC type rating in the accident airplane make and model, in addition to other type ratings. EFS reported that the SIC had accumulated 8,025 total hours of flight experience, and of those, 78 hours were in the accident airplane make and model. In October 2022, both pilots completed initial ground and simulator training and earned their PIC type ratings in the Challenger 300. CAE Training Curriculum According to the Simulator Instructor (S.I.) #5 “300/350 Instructor Guidance” for the “Initial Type Rating” provided by CAE, “AP STAB TRIM FAIL,” in addition to several other emergency and non-normal procedures, were listed in the topics to be covered outside of the simulator. There were no task items that required “AP STAB TRIM FAIL” or “AP HOLDING NOSE DOWN” to be experienced or examined in the simulator. According to the PIC’s interview, he stated, “I do not recall doing any training as far as autopilot stab trim fail or autopilot holding nose up or autopilot holding nose down.” The SIC did not recall that either of those CAS messages were presented to him during training. Simulator Testing The NTSB conducted simulator testing at CAE in Dallas, Texas, where the accident flight crew received their initial type ratings. The testing attempted to evaluate the accident scenario, to include a rejected takeoff with a failed right side airspeed indicator, followed by a takeoff with known faults on the airplane. The testing determined that the simulator was incapable of producing similar indications to that which the accident flight crew received without a considerable amount of human interaction and abnormal simulator settings not commonly used in training scenarios. Owner/Operator Executive Flight Services (EFS), LLC. held a 14 CFR Part 135 air operator certificate and also offered whole aircraft management services. A representative of EFS reported that they managed the accident airplane and employed the flight crew. EFS reported that the flight was operated as a non-revenue 14 CFR Part 91 flight by the owner of the airplane, Conexon LLC. According to their website, Conexon was a broadband network design and construction firm based in Kansas City, Missouri. Airplane The airplane was a Bombardier BD-100-1A10 Challenger 300. It was powered by two Honeywell HTF7000 engines, each capable of producing 6,944 lbs of thrust. According to the aircraft maintenance record, on February 2, 2023, the airplane had accumulated 2,307.6 total hours. On October 31, 2022, the airplane was inspected and complied with 14 CFR Part 135 inspection requirements, and at that time, had a recorded total time of 2,249.0 hours and 1,229 landing cycles. At the time of the accident, the airplane had accumulated 2,321 total hours. The airplane was configured with 9 passenger seats and 2 flight crew seats. It did not require a cabin attendant due to the number of seats. The minimum flight crew complement was a pilot and copilot. Within the limitations section of the Bombardier Challenger 300 Flight Crew Operating Manual (FCOM), the maneuvering load factors with flaps retracted were +2.6 g to -1.0 g. According to the FCOM, Chapter 1, “General,” the airplane was equipped with an Engine Indication and Crew Alerting System (EICAS). The EICAS system was designed to show system status with specified colors. The “Crew Alerting System” portion of the EICAS displayed indications within the CAS window, which was in the upper right portion of the same display (see Figure 3). Figure 3: View of the cockpit in the accident airplane with the CAS location annotated (Source of Photo: Aircraft.com) Final Aircraft Walk-Around Procedure The EFS General Operations Manual, revision 42, provided, in part, the following guidance about the “Final Aircraft Walk-Around Procedure”: Prior to closing the aircraft door with the intent of flight, the PIC shall ensure a final walk- around of the aircraft has been completed on each leg. This procedure will provide a “last chance” to review the exterior of the aircraft to ensure the aircraft is in an airworthy condition and to verify the surroundings of the aircraft. Pitot Probe Cover The aircraft was equipped with three pitot probes. Two of the pitot probes were located on the left side and the other was located on the right side, below the pilots’ side windows. Figure 4 contains photographs that were taken postaccident, which show the right pitot probe cover in place as it would have been on the day of the accident, in addition to a closer view of the red-colored cover. Figure 4: View of the right side forward area of the airplane showing the covered pitot probe. Rudder Limiter Fault Troubleshooting The Bombardier Quick Reference handbook (QRH) revision 71, Volume 2, was available to pilots in both electronic form via their EFB and via a paper copy that was stowed in the flight deck. The QRH non-normal advisory message section provided guidance on CAS advisory messages. Depending on the message that was displayed on the CAS, the QRH would provide Minimum Equipment List (MEL) relief, or be listed as a “GO” or “NO GO” item. Review of the list revealed that a “RUDDER LIMITER FAULT” CAS message was a “NO GO” item (see Figure 5.) Figure 5: Go/No Go QRH Guidance [Excerpt] with rudder limiter fault message annotated by red box. The PIC reported that he did not refer to the QRH Go/ No-Go Guide due to his past experience in receiving the advisory message, which he recalled that it was described in the QRH as a “redundancy” and that the advisory “can stay on for up to 10 landing without removing aircraft power.” The SIC, when asked about the Go/No-Go guide, stated that, “It’s an advisory, we understood it as an advisory and it didn’t lead us to looking in the …go/no-go guide.” when asked if there were paper manuals in the airplane, including the QRH, the SIC stated “No.” A paper QRH was located in the airplane during postaccident examination. According to the EFS Director of Operations (DO), the operator had a 24/7 maintenance control service available to all aircraft owned or managed by EFS. The DO was asked to explain what the accident crew would have been instructed to do had they called maintenance control regarding the Rudder Limiter Fault message. He reported that the crew would likely have been instructed to shut down both engines, depower the airplane, and start everything back up. The reset procedure was aimed at clearing computer-driven faults and anomalies. If that reset had not cleared the fault message, control would have determined if any MEL relief was available; if not available, the airplane would have been grounded until maintenance personnel could diagnose the issue. Autopilot/Flight Director Mode Confirmation The EFS, General Operations Manual, revision 42, “Autopilot/Flight Director Mode Confirmation” provided, in part, the following guidance on announcing the engagement or disengagement of the autopilot: Knowing the status of the autopilot system is critical to CRM and any changes to the autopilot status must be communicated and confirmed. When