NTSB Factual Report

HISTORY OF FLIGHT

On June 5, 2008, about 1300 central daylight time, an Eclipse Aviation Corporation EA500 airplane, N612KB, sustained no damage when its flight crew encountered a loss of thrust control with both engines at maximum power thrust during an approach to land on runway 22L at the Chicago Midway International Airport (MDW), Chicago, Illinois. A go-around was performed and the crew shut down the right engine on base leg. The left engine went to flight idle and the crew encountered a total loss of thrust and continued loss of thrust control. The crew declared an emergency and performed a forced landing on runway 22R. The airplane was operating on an activated instrument flight rules flight plan under the provisions of 14 Code of Federal Regulations Part 91. The two airline transport rated pilots and two passengers were uninjured. The business flight originated from the Cleveland-Hopkins International Airport, Cleveland, Ohio, about 1145 and was destined for MDW.

The left seated pilot who was the flying pilot reported that as the airplane was crossing the runway 22L threshold during the initial approach to land, he and the non-flying pilot encountered a 10 to 15-knot wind shear and the airplane developed a high sink rate that he arrested by applying power. The flying pilot further stated that after the airplane had touched down about 83 knots and, after he had lightly applied the brakes, he noted that the airplane was rapidly accelerating through 100 knots and that the engines were at maximum power. Both pilots reported seeing on the crew alerting system (CAS) display, "L ENG CONTROL FAIL" and "R ENG CONTROL FAIL" and the Automatic Power Reserve armed light was illuminated, as the airplane climbed out during the go-around. The flying pilot stated that although he had lowered the landing gear and brought the flaps from the landing to the takeoff position to remain below 200 knots, it was still necessary to maintain a shallow climb so as to not exceed 200 knots.

The pilots stated that they declared an emergency, and air traffic control cleared them to land on any runway. The pilots stated that after referencing the quick reference handbook emergency procedures section "2.5 Engine Control Fail," they elected to shut down the right engine. The flying pilot stated that as they were maneuvering to land, they got a stall warning and he noticed the airspeed was decreasing. The flying pilot further reported that the left engine was at idle power and would not respond to throttle movements. The airplane landed and stopped on the runway. It was reported that the two main landing gear tires were found to be flat after the airplane came to rest on the runway.

PERSONNEL INFORMATION

The flying pilot held a Federal Aviation Administration (FAA) airline transport pilot certificate with airplane single-engine and multiengine land ratings. He held commercial pilot privileges with an airplane single-engine sea rating. He held a flight engineer certificate with a turbojet powered rating. He held a first class medical certificate with no limitations. He held a control tower operator certificate limited to Wiesbaden Tower, Wiesbaden AB, Germany. He reported that he had accumulated 21,500 hours of total flight time and 300 hours of total time in the EA500. He held type ratings in Boeing 727 and 737 airplanes, in Convair 240, 340, and 440 airplanes, in McDonnell Douglas DC-3 and DC-9 airplanes, in Eclipse Aviation EA500 airplanes, in Lockheed L-382 (C-130) and L-1329 (Jetstar) airplanes, and in Saberliner N-265 airplanes.

The non-flying pilot held a FAA airline transport pilot certificate with an airplane multiengine land rating. He held commercial pilot privileges with rotorcraft and instrument helicopter ratings. He held private pilot privileges with an airplane single engine rating. He held a first class medical certificate with no limitations. He reported that he had accumulated about 2,400 hours of total flight time and 89 hours of total time in the EA500.

AIRCRAFT INFORMATION

N612KB, an Eclipse Aviation Corporation EA500 airplane, was a five-place, pressurized, retractable tri-cycle landing gear, twin-engine monoplane of predominately aluminum construction. The airplane's serial number was 000026. The airplane was powered by two Pratt & Whitney Canada PW610F-A turbo-fan engines, each producing 950 pounds of takeoff thrust. The airplane's maximum gross weight was 5,800 pounds.

The pilot's report indicated that the airplane was last inspected on May 31, 2008 in accordance with a continuous airworthiness program. The report indicated that the airplane had accumulated 238.9 hours of flight time at the time of the incident.

The airplane's flight manual, in part, stated:

Each engine is controlled by a dual-channel Full Authority Digital

Engine Control (FADEC) unit. Either channel is capable of controlling

its engine. All engine parameters are displayed on the Multifunction

Display. Primary parameters are continuously displayed, while

secondary parameters are displayed on the ENG [engine] synoptic page.

Each engine has individual flight deck controls. Thrust is set by

positioning the throttles ... manually by the pilot. ...

Each of the two FADEC units is co-located with an Aircraft Computer

System (ACS) within the Avio Processing Center (APC). To provide

redundant control in the event of a failure, each FADEC has two

control channels, one for each engine. All critical sensors are dual

element, providing dedicated inputs to both FADEC channels. To

further protect against potential local events that may affect an APC,

each APC houses one channel for each engine. ...

Automatic Power Reserve

The PW610F FADEC has an Automatic Power Reserve (APR) feature

that automatically increases thrust, on the operating engine, in the event

an engine fails during takeoff. APR is automatically armed when both

throttles are at the takeoff power setting. The APR system can be

disarmed with a line select key on the ENG synoptic page.

The Eclipse Aviation Corporation EA500 airplane was certified by the FAA under 14 Code of Federal Regulations Part 23 and was issued type certificate number A00002AC dated September 30, 2006.

METEOROLOGICAL INFORMATION

At 1151, the recorded weather at MDW was: Wind 190 degrees at 13 knots gusting to 22 knots; visibility 10 statute miles; sky condition few 2,200 feet, scattered 5,000 feet, overcast 15,000 feet; temperature 28 degrees C; dew point 23 degrees C; altimeter 29.72 inches of mercury.

At 1251, the recorded weather at MDW was: Wind 200 degrees at 18 knots gusting to 26 knots; visibility 10 statute miles; sky condition scattered 2,900 feet, broken 3,700 feet, broken 5,000 feet, overcast 15,000 feet; temperature 29 degrees C; dew point 22 degrees C; altimeter 29.71 inches of mercury.

AIRPORT INFORMATION

MDW was located approximately 9 miles southwest of Chicago, Illinois, and was owned and operated by the city of Chicago, Illinois. MDW was a certificated airport under 14 CFR Part 139.

MDW's field elevation was 620 feet above mean sea level (MSL). The airport had five runways: Runway 13C/31C - 6,522 feet by 150 feet, concrete/grooved; runway 4R/22L - 6,446 feet by 150 feet, asphalt/concrete/grooved; runway 4L/22R - 5,507 feet by 150 feet, asphalt/grooved; runway 13L/31R - 5,141 feet by 150 feet, asphalt/grooved; and runway 13R/31L - 3,859 feet by 60 feet, concrete.

FLIGHT RECORDERS

N612KB was not required to be equipped with a flight data recorder. However, the airplane was equipped with a Diagnostic Storage Unit (DSU) which recorded aircraft-related data in its solid state memory. Much of the data was collected at 1 second intervals, although some individual parameters were collected more frequently and some were collected less frequently.

WRECKAGE AND IMPACT INFORMATION

An on-scene examination of the incident airplane was conducted after the airplane's main tires were replaced. The examination revealed that the airplane sustained no damage other than the tires. Debris, consistent with small bits of rubber, was observed aft of the landing gear on the underside of each wing inline with the main tires.

The non-volatile memory in the airplane's DSU was downloaded under National Transportation Safety Board supervision and its data was sent to the airplane manufacturer for decoding.

TESTS AND RESEARCH

The engine manufacturer provided a diagnostic computer that was connected to the airplane. The computer displayed the data that was being received by the engines' FADECs when their respective throttle levers were moved. When moving the throttle levers, the range of motion that was detected by the FADECs was between approximately 1.7 degrees and 71 degrees. When moderate forward pressure was applied to the throttle levers at the maximum power stop, engine control fail messages would appear on the CAS display. This was repeatable and demonstrated several times. The fault message could be cleared by cycling the electrical power to the FADECs off and then back on. There was no fault observed when applying moderate back pressure against the idle power stops.

The airplane's engines were started and the airplane was taxied to a remote site on the airport where it was safe to operate the engines at high power settings when the throttle levers were moved throughout their range of travel. Several tests were performed on the airplane with the engines running to simulate the events that occurred on the incident flight and to introduce throttle faults. The first test was three throttle lever excursions that were made from off idle to about the 60 degrees throttle lever range of travel to simulate the pilot's wind shear recovery. The engines responded to the throttles and the engine control failure message did not illuminate. The throttles were then advanced from idle to maximum power over a three-second period. Again, the engines responded to the throttles and the engine control failure message did not illuminate. The throttles were then advanced and pushed against the maximum power stop. The left and right engine control failure message appeared on the CAS panel. When the throttles were retarded to idle, the engines remained at high power. With both throttles at idle and when one of the engines was shutdown, the opposite engine immediately went to idle power and would not respond to throttle movements. When the FADECs' power was cycled off and on, the engine would then respond to the throttle.

The incident airplane's throttle quadrant assembly (TQA), serial number J6864, was removed from the airplane and the TQA was subsequently non-destructively documented with a computed tomography (CT) scanning examination.

The incident TQA was replaced with a new TQA. The new TQA was ground tested at MDW by an airplane manufacturer's maintenance technician. The new TQA displayed a CAS control fail message when the throttles were advanced. Both the incident and replacement TQAs were subsequently examined at an airplane manufacturer's facility.

The incident TQA passed the TQA manufacturer's Acceptance Test Procedure when the procedure was conducted at the airplane manufacturer's facility. The TQA's cover was removed for a visual examination of its internal components. The TQA's internal hardware and fasteners were intact and secure. The TQA was mounted in a testing rig and a forward weight load was applied to its thrust levers at the lever's forward position. The weight was incrementally increased. The uncovered TQA produced a signal that exceeded the manufacturer's specified parameters when 38.5 pounds was applied. The incident TQA cover was reinstalled and the TQA produced a signal that exceeded the specified parameters when 44.5 pounds was applied.

The new TQA passed the TQA manufacturer's Acceptance Procedure. The new TQA was mounted in the testing rig and it was found to exceed specified parameters when 40 pounds was applied in the forward direction.

The airplane's FADEC fault logic was designed to "latch" or hold the last good value when the upper specified parameter limit was exceeded. The FADEC logic also allowed for an engine with a loss of FADEC to use the throttle setting of the other engine when that throttle was greater than 65 degrees. If the other engine throttle setting was below 65 degrees then the thrust on the engine with the loss of FADEC would go to idle.

Downloaded diagnostic storage unit data showed that both engines' FADECs encountered a fault signal from the engines' throttle controls about the time of the pilot's reported application of the throttles in response to the windshear during the incident approach. The data showed left engine went to flight idle when the right engine was shut down with the thrust lever at idle. The act of shutting down the right engine also reset the right engine FADEC. With the right engine thrust lever at idle (below 65 degrees) the left engine was brought to idle in accordance with the fault logic.

The airplane was FAA certified with Eclipse's specified parameters and fault logic.

ADDITIONAL DATA/INFORMATION

As a result of the investigation, the National Transportation Safety Board recommended to the Federal Aviation Administration:

Require an immediate inspection of all Eclipse 500 airplane throttle

quadrants to ensure that pushing the throttle levers against the

maximum power stops will not result in an engine control failure, and

further require that any units that fail the inspection be replaced and

that the replacement parts be similarly inspected. (A-08-46) Urgent

Require Eclipse to immediately develop an emergency procedure for

a dual engine control failure on the Eclipse 500 airplane and incorporate

the procedure into the airplane flight manual and quick reference

handbook via an airworthiness directive. (A-08-47) Urgent

Subsequent to the TQA examinations, the airplane manufacturer issued Alert Service Bulletin 500-76-001, Rev A, dated July 01, 2008. The service bulletin indicated testing in-service throttle quadrant assemblies to determine if applying a pre-determined load to the thrust levers will result in the throttle position signal to exceed its design range.

In contrast, the Cessna Citation Mustang is powered by two Pratt & Whitney Canada PW615F dual channel FADEC controlled engines. The airplane is equipped with a "FADEC RESET" switch. The Mustang's flight manual indicated that the switch allows FADEC faults to be reset.

The incident flying pilot was given a copy of the Mustang flight manual. The flying pilot, in part, reported:

I can assure you that if such a switch had existed on my aircraft during

the MDW incident, and if it had given me control of the engines power

through the throttles, it would have been a tremendous asset. As it is now,

in a similar situation, I would have to go to the Electric Circuit Breaker

(ECB) page, locate, pull and reset 8 CBs (4 per Engine) to regain

engine control while flying the aircraft [presumably] single pilot. In

my opinion, if the work load can be reduced on a pilot during an

emergency, safety is greatly enhanced.

Parties to the investigation included the FAA and Eclipse Aviation Corporation. In accordance with the provisions of Annex 13 paragraph 5.18 to the Convention on International Civil Aviation, the Transportation Safety Board of Canada (TSB) participated in the investigation as the representative of the State of Design and Manufacture and provided an accredited representative to the investigation. Pratt & Whitney Canada and Curtis-Wright Corp./Novatronics Inc. participated in the investigation as technical advisors to the TSB.

NTSB Probable Cause

The airplane manufacturer's inadequate software design requirements of the engine's full authority digital electronic controls (FADEC) fault logic that resulted in a simultaneous unrecoverable loss of thrust control on both engines when the FADEC's input data values exceeded specified ranges during the approach. Contributing to the incident was the Federal Aviation Administration's failure to recognize and correct this condition during the certification of the airplane.