Automation Failure induced Loss of Control Upsets
Bears some relationship to the two recent QANTAS A330-200 incidents off Learmonth?
Incident Rpt# NYC05MA083 05/12/2005 2316 CDT Regis# N910ME
Union Star, MO
Acft Mk/Mdl BOEING 717-200
Eng Mk/Mdl ROLLS ROYCE BR700-715A1
Acft Dmg: NONE Rpt Status: Unk Prob Caus: Pending
Acft TT 4806
Acft SN 55174
Flt Conducted Under: FAR 121
Aircraft Fire: NONE
Fatal 0 Ser Inj 0
Opr Name: Opr dba:
HISTORY OF FLIGHT
On May 12, 2005, about 2316 central daylight time, a Boeing 717-200, N910ME, operated by Midwest Airlines, Inc., as flight 490, experienced a series of pitch
oscillations while climbing to cruise altitude over Union Star, Missouri. The flight crew declared an emergency, and diverted to Kirksville Regional Airport (IRK),
Kirksville, Missouri. There were no injuries to the 2 certificated airline transport pilots, 2 flight attendants, and 76 passengers. Night instrument meteorological
conditions (IMC) prevailed for the flight, which was operating on an instrument flight rules flight plan from Kansas City International Airport (MCI), Kansas City,
Missouri, to Ronald Reagan Washington National Airport (DCA), Washington, D.C. The scheduled passenger flight was conducted under 14 Code of Federal
Regulations Part 121.
According to flight crew statements, the flight had initially originated in Los Angeles, California, and landed at Omaha, Nebraska, due to weather, before
continuing on to Kansas City. Once in Kansas City, the captain was briefed by company dispatch personnel regarding significant weather in the area, and noted
the weather on a display screen that was located in the operations area.
As the airplane was taxied for departure at 2231, the captain elected to delay the takeoff, and wait for the weather to pass further to the east. Once the weather
passed, and the flight crew received a "ride report" from a departing flight, the incident flight departed from runway 1L.
The captain performed the takeoff, and afterwards engaged the autopilot with a configuration selected, vertical profile guidance was provided by the flight
management system. The crew requested a northeasterly departure, and flew a 010-degree heading, taking the airplane away from weather cells that were about
25 miles away. The crew did not observe any weather cells or lightning on the departure path, and as the airplane climbed, the captain observed only green areas
on the airborne radar, despite adjusting radar pitch and tilt.
After departure, the airplane entered IMC, but no turbulence was noted. The captain turned to a heading of 060 degrees, and about flight level (FL) 230, the crew
was advised to change radio frequencies and was cleared to climb to FL 270. At that point in the flight the airplane was under the control of the autopilot, and was
climbing at airspeeds between 280 and 300 knots. The closest weather cell was about 20 to 25 miles away, and the crew felt they did not need to utilize airplane
anti-icing because the outside temperature was still too warm to require it.
The first indication of something abnormal was when the captain noticed the master caution light was illuminated. After commenting to the first officer, he looked
down at the center pedestal and notice that the CONFIG cue switch was illuminated. He then pushed the CONFIG key, located on the center instrument panel,
and noted the "RUDDER LIM FAIL" alert on the engine and alert display unit. He looked at the alert for about 10 seconds, and was about to ask the first officer to
retrieve the quick reference handbook (QRH) when the event began.
The airplane initially pitched down, to what the first officer recalled was in excess of 20 degrees. The captain remembered hearing the autopilot disconnect aural
signal. When the pitch down occurred, the captain was still the pilot flying, but the first officer then began assisting him on the controls. The airplane continued in
a steep dive, which the first officer felt was "almost beyond recovery." Both pilots recalled saying, "up, up, up" during the initial descent, and noted that the
airplane did not respond to control inputs at first and that the flight controls felt very heavy. The first officer thought that the airplane lost at least 5,000 feet of
altitude during the first descent. The captain recalled that the elevator response was "not normal," and that he was not getting the amount of response he
expected from the flight control inputs. At times he would get little response from the elevator control inputs, but then it would quickly change to "a lot" of
response, unlike any training scenario or airplane flight characteristics he had previously experienced.
The airplane then pitched up, and the first officer stated that he told the captain to push forward on the control wheel, and assisted him in pushing forward. As the
airplane pitched up the airspeed decreased, and slowed to about 190 knots. At that point the autothrottles were not engaged, and the first officer increased the
engine power to about 3/4 of the "throttle throw," which equated to about 80 percent N1. The first officer stated that the power levers felt "normal." The captain
stated that while he was trying to recover the airplane, he attempted to maintain a level pitch attitude by placing the pitch of the airplane in a fixed position, and
tried to level the wings of the airplane, but altitude control was unobtainable.
The airplane entered another dive, and the first officer stated to the captain, "I have the airplane," and said that the captain responded, "Okay." The first officer
continued manipulating the flight controls with inputs from the captain, and was able to bring the airplane under control with his help. The captain, however, stated
that he heard the first officer state, "I'm flying," and the captain took that to mean, "He was with me on the flight controls." The captain continued operating the
flight controls until he later began to communicate with ATC, and it was at that point that he relinquished control of the airplane to the first officer. He did not recall
"formally" transferring control of the airplane to the first officer, but stated that it was "understood."
During the event, the airplane went through a series of climbs and descents before the flight crew was able to recover. The first officer stated that during the
recovery he was trying to keep the airspeed away from the stall speed and away from the overspeed red zone. The captain stated that the airspeed changed
instantaneously from low to high, at points becoming greater than 400 knots with an overspeed warning in literally seconds. The airspeed went from the bottom of
the airspeed tape to the top so quickly, that the captain could not visualize the airplane doing this. When the airspeed was indicating over 400 knots on his
Primary Flight Display (PFD), the captain stated that he glanced at the integrated standby instrument system (ISIS), and noted that there was a difference in the
two displayed speeds. He could not recall the difference in the two speeds.
The captain did not report any fluctuations in the instruments prior to the event, but that during the event there was a "blinking" or flashing on and off of the PFD.
He would notice a very high airspeed during a pitch down, and then would see a "flicker" or "flash," and when the display came back, it would indicate a reversal
of information, with the airspeed low and the pitch high. He only recalled seeing the PFD flash, and was not sure if the navigation display (ND) did so as well. He
was not using the flight director bars during the recovery, nor did he recall seeing them.
As the flight crew began to recover from the event, the captain felt that they needed to get the airplane on the ground, and elected to divert to IRK. As there were
many tasks to be accomplished, the captain began making arrangements with ATC and briefed the passengers, while the first officer continued to fly the airplane.
The first officer had the captain re-engage the autopilot, and they continued using the autopilot until they were on the approach to IRK. Following the recovery, the
crew noted a "COLUMN DISC" alert on the engine and alert display. The entire event and recovery occurred in IMC.
During the descent the captain performed the in-range checklist silently. The flight crew then performed the before landing procedures and entered a right traffic
pattern for runway 18 at IRK. The first officer flew the airplane during the landing, while the captain operated the speedbrakes and the throttles. The crew did not
re-engage the autothrottles. The first officer stated that while on approach, the elevator response seemed "normal." The airplane subsequently landed
The captain held an airline transport pilot certificate with ratings for airplane single and multiengine land, which was issued on December 7, 1988, as well as a
type rating for DC-9 aircraft. His most recent Federal Aviation Administration (FAA) first-class medical certificate was issued on January 17, 2005, with the
limitation, "Holder shall wear lenses that correct for distant vision and possess glasses that correct for near vision." According to company records, and
interviews, the captain had accumulated 18,000 total hours of flight experience, including 203 hours in the Boeing 717 (B-717). A review of FAA records found no
accident, incident, or enforcement actions pertaining to the captain.
The captain was hired by Midwest Airlines in January 1987, and subsequently upgraded to captain in December 1988. While working at Midwest Airlines he had
flown as captain on DC-9, MD-80, and B-717 airplanes. He worked in the Flight Standards and Training department at the airline for about 12 years in various
positions, including check captain, ground instructor, simulator instructor, proficiency check airman, and aircraft instructor. He returned to line flying in 2001, and
at the time of the event he was no longer a check airman. He transitioned to captain in the B-717 on February 11, 2005, and the requirements for his most recent
proficiency check were also completed on that date.
The first officer held an airline transport pilot certificate with a rating for airplane single and multiengine land, which was issued on September 14, 2004, as well as
a type rating for BA-3100 aircraft. His most recent FAA first-class medical certificate was issued on January 25, 2005, and was issued without any limitations.
According to company records, and interviews, the first officer had accumulated 12,000 total hours of flight experience, including 1,313.5 hours in the B-717.
The first officer was hired by Midwest Airlines in January 1993. His most recent proficiency check was completed on October 13, 2004, in the B-717.
Review of the first officer's FAA airman file revealed that he had received several notices of disapproval for previous pilot proficiency check flights between 1978
and 1991. These included checks for the instrument airplane rating, flight instructor airplane single engine, flight instructor instrument airplane, flight instructor
multiengine airplane, airline transport pilot, and a type rating. He additionally received notices of disapproval during a proficiency checks for the DC-9 type rating
and an upgrade to captain in 1997 and 2000.
Crew Warning and Alerting System
The incident airplane was equipped with a Crew Warning and Alert System, an integrated system that provided the crew information about the status of the
airplane with alerts of varying severity. The crew was notified of these alerts via several components of the system, including the Engine and Alert Display (EAD),
System Synoptic Pages, Status Page, System Control Panel (SCP), Master Warning and Master Caution Lights, and an Aural Warning. The EAD was located on
Display Unit (DU) number 3 (a display screen located near the center of the instrument panel). The System Synoptic Pages, Status Page was located on DU 4
(immediately right of DU 3), and the SCP was located on the center pedestal.
There were four levels of alerts (0, 1, 2, and 3), which could appear on the EAD, System Synoptic Pages, Status Page, or the SCP. The system cue switches (on
the SCP) illuminated to identify the associated system that was generating an alert or warning. Pushing the associated cue switch would extinguish the master
Caution (if illuminated), and display the appropriate configuration synoptic in the lower left hand corner on the Secondary Engine Page on DU 4.
Level 1 alerts indicated abnormal operational or airplane system conditions, which required crew awareness and may have required subsequent compensatory
action. However, they normally did not affect safety of flight. Level 1 alerts were amber, and not enclosed in a rectangular box. They may have been displayed on
the EAD or only on the system synoptic display. The two MASTER CAUTION lights may have illuminated simultaneously with the display of a Level 1 alert on the
EAD. Other Level 1 alerts would be annunciated by a flashing reminder message in the lower right-hand corner of the EAD and illumination of a Systems Display
(SD) cue switch. Level 1 alerts that appeared on the EAD were generally resettable.
Level 2 alerts indicated abnormal operational or airplane system conditions that required immediate crew awareness and subsequent compensatory action. Level
2 alerts were displayed in amber on the EAD, and enclosed within an amber rectangular box accompanied by two amber MASTER CAUTION lights, as well as an
illuminated cue light on the SCP. Pressing the cue switch extinguished the Master Caution, displayed the Synoptic Page, and removed the alert from the EAD. At
that time, the "MISC" reminder message appeared on the EAD.
Level 3 alerts indicated abnormal operational or airplane system conditions which required immediate crew response. Level 3 alerts were displayed on the EAD
in red and enclosed within a red rectangular box. The two red MASTER WARNING lights would illuminate simultaneously, an aural warning sounded (for some
alerts), and the appropriate cue light on the SCP illuminated. The Master Warning was extinguished by pressing either Master Warning light or the SCP Cue
Light. The alerts remained on the EAD until the condition no longer existed.
Air Data System
The incident airplane's air data system was comprised of a pitot-static system and an air data sensor heating system. The pitot-static system provided dynamic
(pitot) and ambient (static) pressure information to various flight instruments and airplane systems via eleven air data system sensors. Seven of those sensors
provided air data information that was used by the captain's, first officer's and auxiliary airspeed indicators. These sensors were: three pitot probes, one left (captain), one center (auxiliary) and one right (first officer), which were located just below the cockpit windshield; and two main static plates along with two alternate static ports.
Each of the three pitot probes was connected to a condensation sump via drain lines. The drains allowed for the removal of moisture which may have accumulated in
the pitot system. Each pitot probe and static port supplied a pressure input to its related Air Data Module (ADM), which converted the air pressure into digital
pressure data. Once converted, the ADM supplied the digital air pressure data to its respective Air Data Inertial Reference Unit (ADIRU), which provided input
signals to the Flight Control Computer (FCC) and the flight instruments by the Versatile Integrated Avionics (VIA) unit. The digital air data from the auxiliary ADM
was sent directly to the Integrated Standby Instrument System (ISIS).
There was a static plate located symmetrically on each side of the forward fuselage. Each plate had four static ports that were part of the plate; only two ports
provided pressure, the other two were capped off at the plate. There was an alternate static port aft of and below each static plate. There were three ADMs that
sensed and supplied static air pressure to the ADIRUs. Each static port was cross-connected to a port on the opposite side of the airplane. An ADM would
convert the average of the left and right static port air pressure into ARINC 429 digital pressure data. The data was then sent to its respective ADIRU, or to the
The air data sensor heating system operated electrically to prevent the formation of ice on each of the eleven air data system sensors. Ice protection for the pitot
probes (including the captain's, first officer's, auxiliary, and rudder limiter), static plates, static ports, Ram Air Temperature (RAT), and angle of attack transducers
was provided by electrical heating elements. The air data heating system was electrically controlled by one "Air Data Heat" (ADH) switch. The switch was located
on the overhead panel in the flightdeck. When manually pressed, the switch activated all of the internal electrical heaters in each of the eleven system sensors.
All heaters except the heater in the RAT probe would operate in-flight and on the ground when the ADH switch was activated. The RAT probe heater operated
only in-flight; it required the air data heat switch to be activated and the left nose wheel air/ground sensing relays positioned to "air" mode.
The air data heating system included nine current monitor relays, located in the electronic equipment compartment, which measured the electrical current in the
heater circuits. A current monitor relay was connected in series to each of the four pitot probes, RAT probe, angle-of attack transducers, and the static plate
heater circuits. The relays were energized when the respective heater current was flowing. When the circuit current was less than a satisfactory value, the current
monitor relay sent a signal (ground) to the Data Concentrator Unit (DCU), then to the VIA that would display the applicable sensor heater failure alert message on DU 3, as well as illuminate the MISC (Miscellaneous) light on the SCP. The alert would also illuminate the Master Caution lights when the heater failed in five of the eleven sensors.
The air data sensor heating system alerts that made the Master Caution lights illuminate included:
-Left or right AOA heaters fail
-captain's, first officer's, or auxiliary pitot heat fail
Other alerts that did not trigger the Master Caution lights included:
-AIR DATA HEAT OFF (air data heat switch/light is off)
-RAT PROBE HEAT FAIL
-RUD Q-LIMITER PITOT HEAT FAIL
-STATIC L (or R) HEAT (these alerts showed only on the status page)
Both ADIRUs used sensed air data that was supplied from its respective ADM to provide digital navigation and air data information to the VIA units, each FCC,
and the Enhanced Ground Proximity Warning (EGPWS) computer. The information from the VIA, (airspeed, mach number, vertical speed, and barometric
altitude) was then presented to the flight crew on their PFDs. ADIRU-1 provided information to the captain's instruments, and ADIRU-2 provided information to the
first officer's instruments. Each ADIRU also connected with the centralized fault display interface unit. The interface supplied a flight compartment display or fault.
Rudder Limiting System
To supply structural load protection at high airspeeds, the incident airplane's rudder control system contained a limiting system (primary and secondary). This
system reduced the maximum allowable rudder deflection as airspeed increased. Specifically, the primary rudder throw limiter reduced the maximum rudder
deflections from 28.9 degrees to a maximum restricted rudder deflection of approximately 4 degrees. The rudder limiting system included a primary rudder limiter
and a secondary rudder limiter (stop limiter). Both of these limiters operated independently as a function of airspeed.
The primary rudder limiter actuator assembly operated mechanically by pitot pressure input supplied from a separate pitot probe located on the vertical stabilizer
to the rudder throw limiter actuator bellows. Movement of the bellows resulted in the throw limiter hook moving into a slot in the piston rod of the rudder power
cylinder. The hook position changed continuously with the pitot pressure input.
As the hook moved into the slot, the rudder deflection decreased. With the hook positioned fully into the rod, the limiter prevented rudder movement of more than
approximately 4 degrees left or right of center. The rudder limiter hook position was detected via two position synchros. These synchros sent the rudder hook
position signals to the airplane's two FCCs. The FCCs received calibrated airspeed data from the Air ADIRU, and calculated the necessary rudder limiter hook
position. The FCC's then compare calculated position with the position from the rudder limiter position synchros. If the hook was not in the correct position, the
FCC's supplied data to the VIA, which then supplied a related alert in the flight compartment.
The secondary limiter provided system redundancy to the primary rudder limiter. When the airplane's airspeed was greater than 218 knots, or the flaps were retracted, the FCCs would electrically command the rudder secondary limiter to prevent rudder movement of more than 15 degrees (hingewise) left or right of center. The FCCs received calibrated airspeed data from the ADIRU, and inputs from each flap position transmitter. Two rudder stop switches supplied the position of the limiter back to the FCC's. When the limiter position was not correct, the FCC supplied data to the VIA units for rudder alerts.
When the limiter position was not correct, an alert was displayed in the cockpit. There were two levels of alerts for the rudder limiting system. Level 1 alerts
consisted of "RUDDER LIM FAULT" and "RUDDER RESTRICTED," while the level 2 alert was "RUDDER LIM FAIL."
The level 1 "RUDDER LIM FAULT" alert message was generated when either the primary rudder limiter or the secondary rudder limiter fail to the rudder unrestricted position. This alert also occurred if the FCCs detected a fault in a rudder limiter position synchro or the rudder stop switch. When the FCCs detected that the position of the rudder throw limiter was not within the pre-defined scheduled limits, the FCC would send data, via an ARINC 429 bus, to the VIA, which supplied a related alert to the flight crew. For this alert, the VIA had a 1.0 second delay built in before it will send a RUDDER LIM FAULT.
The RUDDER LIM FAULT message was annunciated to the flight crew by a flashing reminder message "CONFIG" in the lower right hand corner on the EAD and
the illumination of the CONFIG key located on the SCP. Pushing the associated cue switch would display the Configuration systems synoptic on DU 4 with the
"RUDDER LIM FAULT" alert displayed in the lower left hand corner. Once the CONFIG cue button was pressed, the flashing level 1 alert on the EAD would be
replaced by a steady (non-flashing) reminder message. The Master Caution light would not illuminate for this level 1 fault.
The level 2 "RUDDER LIM FAIL" alert was displayed when the primary rudder limiter and the secondary rudder limiter systems were defective and did not supply
a rudder travel limit. This level 2 alert inhibited ("trumped") the level 1 "RUDDER LIM FAULT" alert.
The RUDDER LIM FAIL message was initially annunciated in amber on the EAD DU 3 enclosed within an amber rectangular box, the illumination of the system "CONFIG" display cue on the SCP, and the illumination of the two amber Master Caution lights. Pushing the CONFIG cue switch would reset the Master Caution lights and display the "RUDDER LIM FAIL" alert in the lower left hand corner of the Configuration systems synoptic on DU 4 (Figure 8). In addition, this alert also had two consequences messages associated with it. The consequence messages may have included both the consequences of the malfunction and/or operational guidance for crew action. During this action, the "RUDDER LIM FAIL" alert on the EAD, DU 3, would be replaced by a "CONFIG" reminder message in the lower right hand corner of the EAD. If the logic within the VIA determined that the fault was a RUDDER LIM FAIL, there would not be a 1.0 second delay.
A National Weather Service (NWS) Surface Analysis Chart depicted an occluded front and occluded frontal system moving across the area with the upset
location near the triple point of the front, where the front separated into cold and warm fronts. A squall line was also between the upset location and St. Louis that
would have impacted the route of flight. The NWS Area Forecast for northern Missouri and Iowa included widely scattered thunderstorms and moderate rain, with
cumulonimbus tops from 40,000 to 45,000 feet. The forecast included a risk of possible severe thunderstorms over northern Missouri.
The synoptic situation was conducive to the formation of strong to severe thunderstorms across the region and was identified by the NWS Storm Prediction
Center (SPC) as a moderate to slight risk of severe thunderstorm over the upset location. The NWS SPC identified the area over the upset location as a
Mesoscale Convective System (MCS) and was characterized by an intense line of thunderstorms along the leading edge and a trailing area of stratified rain
where the upset occurred. The MCS was documented as having produced damaging winds and large hail across the region.
The NWS Radar Summary Chart for 2319 depicted the upset location within a large area of echoes identified with thunderstorms and rain showers with
reflectivities of VIP Level 3 to 4 "strong-to-very strong" intensity echoes, with echo tops near 42,000 feet. Multiple weather watches were indicated east and
south-southeast of the upset location. The NWS Kansas City/Pleasant City WSR-88D base reflectivity images for 0.5 degree elevation scan for 2317 depicted
reflectivity values of 42 dBZ or VIP Level 3 "strong" intensity under the flight track at the time of the upset. At the 1.5 degrees elevation scan the reflectivity values
decreased to 30 dBZ or VIP Level 2 "moderate" intensity. Similar intensity echoes were observed at 2322 at both elevation scans. The Kansas City, Missouri,
WSR-88D echo tops product detected reflectivity values of 18.5 dBZ from 25,000 to 34,000 feet along the flight track. The maximum heights detected were east
and southeast of the MCI area and were reported to 44,000 feet.
The closest operational upper air sounding representative of the airmass was from the NWS Omaha, Nebraska site, located about 112 miles northwest of the
upset location, at an elevation of 1,148 feet. The 1900 sounding indicated that the freezing level was located at 11,921 feet, and conditions supporting icing up to
25,000 feet. Around 19,000 feet, the sounding indicated a 40 percent probability of severe clear icing conditions. Convective activity would also increase the
likelihood and probability of icing conditions.
The incident airplane was equipped with an airborne weather radar system, which was reported to be working normally. The radar had a peak power output of
125 watts, gain of 35 dBZ, and a 30-inch planar array antenna, which resulted in a 3.4-degree beam width. The system displayed three levels of precipitation;
green, yellow, and red, with an additional turbulence mode in magenta. Generally, airborne X-band radar systems are designed for avoidance of convective
activity, and due to their low power output and wavelength are prone to attenuation. The hazard of attenuation is further aggravated when the airplane is
operating in precipitation and/or icing conditions.
Given reflectivity values of 20 to 34 dBZ along the flight track prior to the upset, a calculation performed by the National Transportation Safety Board indicated a
potential reduction of 5 to 32 dBZ at 20 miles was likely encountered by the incident flight crew, with the reduction increasing with distance. Based on the echoes
observed by ground radar stations, and the attenuation encountered by the crew, the airborne radar would have only displayed green, or light, returns on the
route northward away from the leading edge of the weather system.
The reported weather at MCI, at 2317, included winds from 130 degrees at 7 knots, 8 miles visibility in thunderstorms and light rain; an overcast ceiling at 3,900
feet in cumulonimbus clouds; temperature 64 degrees Fahrenheit (F); dew point 64 degrees F; altimeter 29.99 inches of mercury. The report also noted that
frequent lighting was observed in-cloud, cloud-to-cloud, and cloud-to-ground in all quadrants, and that the thunderstorms in all quadrants were moving east.
Cockpit Voice Recorder
The incident airplane was equipped with a Honeywell model 6022 SSCVR. The solid-state cockpit voice recorder (CVR) had not sustained any heat or structural
damage, and was forwarded to the Safety Board's Vehicle Recorder Laboratory for readout. The audio information was extracted from the recorder normally and
without difficulty. The 2-hour and 58-second recording consisted of four channels of usable audio, and the quality of the audio recorded on each channel was
excellent. The recording began at 2155:49, while the airplane was parked at the gate at MCI.
At 2255, the crew made the final assessment of the conditions prior to departure, and spent several minutes discussing the weather and trying to decide the best
route for departure. The flight was cleared for takeoff at 2307. At 2316, the captain stated, "rudder limiter fault," and the autopilot disconnect aural alert was
recorded. The crew then both stated "down, down, down" several times, before the captain declared an emergency to ATC. About 2 seconds later, the first officer
declared an emergency to ATC, which was subsequently repeated by both crew several times. The overspeed aural alert was later recorded, and the crew
stated, "up, up, up" several times, followed by "down, down, down" several times.
At 2320, the captain stated, "Get the ice on," followed by "ice protection, ice protection." Immediately thereafter the sound of a double click, similar in sound to a
switch being actuated, was recorded. Shortly thereafter the captain advised ATC that there was a "column disconnect," and that they did not have any "elevator
control." There were several more cycles where the crew stated "down, down, down," followed by "up, up, up," until 2324, when the crew began the diversion to
IRK. At 2325, the first officer referenced the "anti ice," and asked if it was on. The captain replied, "Yeah everything's on now," which was followed by the sound
of a double click. At 2330 the captain relayed to ATC that they seemed to have the airplane under control, and the flight subsequently landed at 2335 without
further incident. The recording ended at 2356.
Flight Data Recorder
The incident airplane was equipped with a Honeywell model 980-4700-042 solid state digital flight data recorder (FDR). The recorder appeared to be in good
condition, with no external damage noted. The FDR was forwarded to the Safety Board's Vehicle Recorder Laboratory, where the data were extracted normally.
The downloaded information contained over 26 hours of data, and the event flight was contained within the last 27 minutes of data.
According to the data, the airplane lifted off at 2308. Shortly after takeoff, the autopilot engaged and the airplane was in the climb thrust vertical mode. About
2315:30, the captain and first officer's computed airspeed values began to decrease, before beginning to diverge about one minute later. While climbing through
19,000 feet, at 2316:26, the Systems Display (SD) page changed from the EICAS Secondary Engine page to the Configuration page. At 2316:38 the autopilot
system registered disengaged. Many of the recorded discrete parameters associated with various flight systems and modes toggled around this time.
The airplane then pitched down and the groundspeed began to increase, the recorded computed airspeed, which also reflected what was displayed in the
cockpit, initially decreased, and the captain and first officer's values continued to be split. The airplane then went through a series of altitude excursions over the
next 8 minutes, during which the airspeed values fluctuated between 52 knots and 460 knots. The altitudes during the pitch up and pitch down cycles varied
between a minimum altitude of 10,600 feet and 23,300 feet. It should be noted that due to the nature of the event, the computed airspeeds recorded may not
actually represent the actual airspeeds. The recorded groundspeed values varied between 290 and 552 knots.
The FDR recorded the movement of the flight control surfaces, and the movement and the amount of input on the flight controls. Normally, since the captain and
first officer's flight controls were linked together, the control column and control wheel parameters would register similar values for each side. The elevator control
system was designed with a breakout capability in case of a jam of the system. If this mechanism was disconnected by exceeding a differential force limit
between the two columns, the column position parameters would record the independent positions. Additionally, if the elevator spring clapper interconnect was
overridden, the left and right elevator parameters would reflect being controlled by the individual columns.
During the event flight, a difference between the two control column positions first occurred at 2318, and lasted over 20 seconds. This coincided with a difference
in the right and left elevator values. There were several additional instances of differences between the captain and first officer's values during the pitch
oscillations. While the parameters related to the left and right engine anti-ice systems were active for the entirety of the flight, the parameters associated with the
wing and tail anti-ice systems switched on at 2320, and remained active for about 10 minutes. There was no parameter recorded by the FDR that indicated the
status of the air data heat system. (i.e. no records kept on DFDR of Pitot heat being on or OFF)
The airplane achieved a level pitch attitude about 2324, shortly after the DU4 format parameter changed from "MfdConfig" to "MfdMisc." Also at this time, the last
airspeed discrepancy between the two flight crewmember's systems was recorded and the airplane started descending through 23,300 feet. The autopilot was
engaged 5 minutes later, and the airplane touched down at IRK at 2335.
An assessment of the incident airplane's FDR data indicated that the flight crew engaged the autopilot system during takeoff at reference time 2308:26. The
autopilot remained engaged during climbout and up through 19,300 ft, at which time the FDR data indicated it disengaged (reference time 2316:38). The data
also indicated that a disconnect switch ("Ctl Wheel Disc 2" discrete) on one of the control yokes was activated one second (reference time 2316:39) after the
autopilot disconnected and then again about 12 seconds later (reference time 2316:51).
The airframe manufacturer subsequently conducted a survey of the FDR recordings from twenty-eight flights in other airplanes of the same make and model as
the incident airplane. The objective of the survey was to observe the timing relationship between the "Autopilot Engaged" discrete FDR parameter(s) and the "Ctl
Wheel Disc" discrete FDR parameters(s) as the autopilot was manually disconnected during normal descents and approaches.
The survey indicated that there were no cases where the "Ctl Wheel Disc" discrete was recorded as active during a subframe (second) while the autopilot
engaged discrete "AP_ENGAGED" remained active.
TESTS AND RESEARCH
On May 13, 2005, the Safety Board convened a Systems Group at IRK in order to examine the incident airplane's various systems. Tests were also conducted on
May 15, 2005, after the airplane was ferried to the operator's maintenance facility in Milwaukee, Wisconsin.
The Systems Group conducted a visual inspection of the airplane's exterior for indications of lightning strikes, performed aircraft system functional tests on all
flight control and air data systems, and downloaded fault history data from the FCC.
Maintenance technicians from the operator, and representatives of the airframe manufacturer, the FAA, and the Safety Board performed a visual inspection of the
exterior of the airplane in order to identify any lightning attach points. The lightning strike inspection was conducted in accordance with the manufacturer's
maintenance manual. A second inspection was also conducted on June 15, 2005, by representatives of the pilots' union and employees of the operator's
engineering division. The detailed visual examinations of the exterior of the airplane revealed evidence of two lightning attach points. One attach point was
located on the aft edge of the tail cone, and the other was located on the lower aft edge of the number 3 Very High Frequency (VHF) communications antenna.
Further examination of the exterior did not reveal obvious evidence of any other lightning attach points on the airplane's structure, flight control surfaces, pitot
static probes, static plates, or any other antennas. There were no missing or damaged static wicks on the airplane, and the bonding strap that provided an
electrical connection between the fuselage and the tail cone was properly attached with no evidence of discoloration or heat damage.
Functional testing of the airplane's flight control systems and avionics was conducted after the incident, with no abnormalities noted except for a disconnect of the
flight control columns. Subsequent functional testing of the disconnect mechanism revealed that it operated within the parameters prescribed in the aircraft
maintenance manual, and that each time the mechanism was disconnected, a level 1 alert "COLUMN DISC" was displayed on the configuration page of the
Systems Display (SD). During the test the mechanism disconnected when pulling the captain's control column aft, from neutral, with 124 pounds of force, and
when pushing forward, from neutral, with 110 pounds of force.
Rudder System Investigation
The flight crew reported seeing the alert "RUDDER LIM FAIL" during the climbout, so the systems group conducted a test of the airplane's rudder limiter system.
The tests were performed utilizing both flight control computers and were conducted per the aircraft maintenance manual. All tests passed with no faults found
with any of the rudder limiter system components.
Air Data Heat Switch
The ADH system switch was an Eaton series 584, four pole, double throw, alternate action, illuminated pushbutton switch. The lamps (4 total) within the ADH
switch would amber illuminate "OFF" when the switch was inactive (switch button in, all heaters off) and will not illuminate when the switch was activate (switch
button out, all heaters on).
The Systems Group conducted several tests of the incident airplane's ADH switch, including visual inspections, and electrical and functional testing. The results
of the test revealed that when the ADH switch was in the inactivated position (switch button in, heaters off), the switch illuminated an amber "OFF" and the "AIR
DATA HEAT OFF" message was displayed on the EAD. Activating the switch (switch button out, heaters on) resulted in the lamps extinguishing and power
provided to all system heaters (no alert messages were shown on the EAD. The overhead panel containing the ADH switch was lowered to gain access to the
back of the switch. Visual examination of the switch and its connecting wiring did not reveal any signs of arcing, or evidence of overheating. All electrical
connections were found secure.
The switch was then partially disassembled, and its components were visually examined including the switch assembly, mounting sleeve, over centering
mechanism, and the contacts. The switch body exhibited no deformities, no discolorations, and all electrical connection pins were of like color (gold), straight and
not loose. Examination of the lamp capsule assembly revealed four incandescent lamps, one of which was burnt out.
Prior to additional functional testing, the switch was x-rayed to determine the initial condition of the switch mechanism and components. Four x-ray plates of the
switch were taken displaying two opposite sides of the switch in both the normally closed (NC) and normally open (NO) position. No anomalies were noted within
the switch mechanism.
The switch was tested for function in accordance with the switch manufacturer's acceptance test procedure, during which the switch was cycled over 100 times.
For each of the four poles, the switch contact resistance was measured between the terminals of the contacts of the same pole forming a switching circuit. For a
newly manufactured switch, the contact resistance should not exceed 25 milliohms. The contact resistance test revealed that pole 2 (pins number 7 and 6) had
an initial normally open NO resistance of up to 116 milliohms. When the ADH switch was activated, pole 2 provided a ground to energize two heater relays. After
about 50 cycles, the measured resistance between pins number 7 and 6 dropped to between 6 and 50 milliohms. The first cycle, from NO to NC, performed
revealed that the switch resistance on pole 3 (pins number 9 and 11) was greater than 1 ohm or the switch did not close. This single event did not repeat itself for
100 plus cycles afterwards. All other poles had a measured resistance of about 1 milliohm.
Following the X-ray evaluation and functional testing, the switch was disassembled from its housing. An examination revealed that all of the components
contained within the switch mechanism were assembled correctly and aligned properly. Transferring from common (C) to NO and back to (C-NC) was crisp for
poles 2, 3, & 4. Transfer for pole 1 was not as crisp as the other three poles and sometimes did not transfer at all. In normal switch operation, the switch contacts
were operated very rapidly by a stored-energy actuator, which provided simultaneous transfer of all four contacts within 0.0005 seconds.
Examination of the switch contacts with special attention to the mating surfaces revealed arcing through the gold plating to the silver base material and lightly
peened contact surfaces.
Air Data Sensor Heating Displays and Indications - Simulator Testing
Using a fixed-based simulator of the same make and model as the incident airplane, the airplane manufacturer observed the indications and alerts that would be
displayed to the flight crew for the ADH switch position to "ON" (button out) and "OFF" (button pushed in) prior to takeoff.
Scenario 1: ADH switch "ON" (activated) prior to takeoff:
When the ADH switch was positioned to "ON" prior to takeoff, there were no warning messages displayed before, during or just after takeoff on the flight displays.
Scenario 2: ADH switch "OFF" (not activated) prior to takeoff:
Before takeoff, the "AIR DATA HEAT OFF" alert was displayed in the lower left hand corner on the EAD, DU 3. In addition, the MISC cue light on the SCP was
illuminated and "OFF" was illuminated on the ADH switch on the overhead panel.
Pushing the MISC cue switch on the SCP resulted in the following:
-The "AIR DATA HEAT OFF" alert was removed from the EAD and the MISC reminder message appeared on the bottom right hand corner of the EAD.
-The MISCELLANEOUS synoptic page was displayed on DU 4 with the "AIR DATA HEAT OFF" alert displayed.
-The amber "OFF" light remained illuminated on the ADH switch.
Selecting the ENG push button on the SCP resulted in the display of the default secondary engine page on DU 4. This scenario resulted in only the MISC
reminder message on the EAD.
The airplane manufacturer also tested three alternative scenarios involving the failure of individual switch poles on the ADH switch. They assembled the likely
sequences following the individual loss of each of three poles on the switch, which control the air data system heaters.
Alternative Scenario 1: Loss of the switch pole 2 (pin 6) controlling the captain, first officer, and auxiliary pitot heaters resulted in display of "PITOT AUX FAIL",
"PITOT F/O FAIL," and "PITOT CAPT FAIL" on the EAD. The MISC pushbutton on the SCP was illuminated and pushing the button selected the SD's
miscellaneous page on DU 4 and removed the messages from the EAD leaving only a steady MISC reminder message on the lower right corner of the EAD.
Alternative Scenario 2: Loss of the switch pole 1 (pin 2) controlling the rudder limiter pitot heater, the RAT probe heater, the right angle of attack sensor heater,
and the right static plate heater resulted in display of "AOA HEAT R FAIL" on the EAD with a flashing MISC reminder message and a master caution. The MISC
pushbutton on the SCP was illuminated and pushing the button removed the message from the EAD, but the "RAT PROBE FAIL" and "RUD PITOT FAIL"
messages remained on the miscellaneous page of the SD with. The "STATIC R HEAT" message was on the STATUS page. Since the loss of rudder pitot heat
would result in icing of the rudder pitot, the manufacturer changed the value of the simulated rudder limit synchro. This resulted in a flashing CONFIG reminder
alongside the steady MISC reminder on the EAD. The CONFIG pushbutton on the SCP was illuminated, and pushing the button displayed "RUDDER LIM
FAULT" on the configuration page of the SD.
Alternative Scenario 3: Loss of the switch pole 3 (pin 10) controlling the left angle of attack sensor heater and the left static plate heater resulted in display of
"AOA HEAT L FAIL" on the EAD with a master caution. The MISC pushbutton on the SCP was illuminated and pushing the button removed the message from the
EAD, but the message remained on the SD's miscellaneous page. A steady MISC reminder message was displayed on the lower right corner of the EAD. The
"STATIC L HEAT" message was displayed on the SD's status page.
Pitot Static System Investigation
The systems group conducted several tests to check the pitot/static system for leaks and to ensure that the airspeed differences between the captain and first
officer's primary displays were within the aircraft maintenance manual requirements. The following tests were performed with no faults found: Functional test of
the air data system pressure; operation test of the air data system indications; pitot/static system leak tests to include the captain, first officer, auxiliary, and
rudder pitot/static systems; the maximum differences between the two PFDs, and between the PFDs and the ISIS. Examination of the pitot system drains and
sump revealed that no visible moisture was present.
An on-ground temperature test with the captain, first officer, and auxiliary pitot probe heaters energized was conducted. A subsequent test, conducted by the
airplane manufacturer on a newly manufactured B-717, revealed that the heaters on both the incident airplane and the newly manufactured airplane heated to
over 500 degrees F.
ADIRU and FCC Investigation
Under the supervision of FAA inspectors, maintenance technicians removed both FCCs and both ADIRUs, and forwarded them to their respective manufacturers
Post-incident acceptance tests performed on both ADIRU's demonstrated that there were no failures or functional anomalies with their performance. Review of
the non-volatile memory data extracted from both units revealed that no external failures were logged into the memory during the incident flight.
Post-incident acceptance testing of both FCC's was successful for all tests with the exception of two test anomalies related to the testing software and a
known-problem regarding the return-to-service testing of the units.
A review of the FCC fault data from the incident flight indicated that Pitch Flight Director Biased Out of View (P F/D BOV) faults were recorded by both FCCs just
after the autopilot disconnect. The data indicated that neither FCC recorded an "A/P DISC" fault, nor did they record any faults of a higher priority, which might
prevent the display of an "A/P DISC" fault.
To help understand the faults that were recorded by both FCCs during the incident flight at the time of the autopilot disconnection, the airframe manufacturer
conducted simulator testing. The purpose of the testing was to determine what faults were recorded by the FCCs for two-test scenarios: (1) autopilot
disconnection due to a split in calibrated airspeed (CAS), and (2) a manual disconnection of the autopilot prior to a CAS split.
The objective of the first test was to create a CAS split that would result in the disconnection of the autopilot, and then to examine the faults recorded by the
FCCs. For the test, A/P 1 was engaged. The results indicated that after the automatic autopilot disconnect, FCC-1 showed the fault "A/P DISC" in the header for
both CPU1A and CPU1B. FCC-2 did not show faults with this header.
The objective of the second test was to manually disconnect the autopilot before the CAS split was applied. The results of the test indicated that neither FCC
showed the fault "A/P DISC" in any of the fault headers nor did they show any faults of a higher priority, which might prevent the display of an "A/P DISC" fault.
Aircraft Performance Study
An aircraft performance study was conducted to evaluate the available ATC radar, FDR, and CVR data. Radar data for the incident flight were consistent with the
reported MCI departure, ATC provided vectors, and diversion to IRK. The calculated groundspeed data from two independent radar sources were consistent with
the FDR groundspeed data.
The FDR data and the Boeing 717-200 engineering simulation tool (GSC) were used to estimate the actual airspeeds required to replicate the recorded aircraft
motion and to estimate the external wind environment acting on the airplane.
The nominal simulation airplane matched the recorded flight 490 motion with either flight control inputs (e.g., control column, control wheel, rudder pedal), flight
control surface inputs (e.g., elevator, aileron, rudder), or a hybrid combination of flight control inputs and control surface inputs. Attempts to match the simulation
airplane motion to the flight 490 FDR data revealed no direct evidence of any airplane configuration, engine, flight control input, or flight control surface issues.
The results of the simulation study indicated that the FDR airspeed data contained intermittent streams of anomalous data, generally identified by gross
differences between calculated simulation airspeed values and FDR airspeed values. The anomalous FDR airspeed data were generally preceded by periods of
increasing pressure altitude and decreasing total air temperature. The FDR total air temperature was 6 degrees C or less prior to each period of anomalous FDR
airspeed data. As pressure altitude decreased and total air temperature increased during each cycle, the FDR airspeed data consistently returned to match the
simulation airspeed data.
When noise artifacts due to angle of attack and normal load factor were ignored, the calculated wind results aligned with the recorded FDR wind data prior to the
event and during intermittent periods during the event. Gross differences between the calculated simulation wind results and the FDR recorded wind generally
aligned with intermittent time periods of anomalous FDR airspeed data.
The incident flight pilot applied control column, control wheel, and rudder pedal forces were calculated based on the available FDR data and the proprietary
equations documented in Boeing report MDC 06K9011,1 "Boeing 717 Interpretation of Flight Control Input Force Data for FDR Parameter 88," Revision A
(originally issued on May 16, 2006, revised on March 27, 2008).
The results of the pilot applied control input force calculations indicated that subsequent to autothrottle and autopilot disconnect, both the captain and the first
officer applied concurrent control wheel forces prior to the initial airplane nose down pitch upset. Subsequent to autothrottle and autopilot disconnect and prior to
the initial airplane nose down pitch upset, the net pilot applied control column force transitioned from about 20 pounds airplane nose up (ANU) to about 25
pounds airplane nose down (AND) over a period of 1 second. Both the captain and the first officer applied concurrent control wheel force inputs during the pitch
upset event for a time period in excess of 5 minutes. The captain's and the first officer's control columns disconnected about two minutes into the event upset,
and the captain and the first officer applied opposing control column input forces that differed in magnitude by about 100 pounds within 2 seconds of the time of
the calculated control column disconnect.
Lost, Suspect, or Erratic Airspeed
The Midwest Airlines Flight Crew Operating Manual (FCOM), Volume 1, EMER NON-ALERT section, pages 3 to 6 contained information on the operation of the
B-717 if the airspeed indication was lost, suspect, or erratic. The FCOM stated in part:
"Unreliable airspeed/Mach, vertical speed and altitude information can be caused by pitot static system or air data inertial reference unit malfunctions. This may
or may not be accompanied by Level 1 or Level 2 alerts, autopilot/autothrottle disconnects and/or instrument failure indications. In flight, recognition occurs by
normal monitoring of basic flight instruments and crew familiarity with pitch, power and airspeed relationships.
It is important that the flight crews recognize an unreliable airspeed condition in a timely fashion, and imperative that their initial action is to maintain aircraft
control. Air data and pitot system malfunctions can result in different EIS [electronic instrument system] alerting system displays or erroneous indications
depending on the nature of the cause of the malfunction. Not all malfunctions will be readily obvious or result in specific alerts."
The FCOM stated that one of the indications the flight crew might see if a malfunction occurred was that the indicated airspeed was not consistent with normal
pitch attitude for the phase of flight.
The FCOM indicated that the pilot should "stabilize" the airplane by use of "Airplane Pitch/Thrust". Pilots were instructed to "disregard IAS [indicated
airspeed]/flight director pitch bars and high speed warnings." They were also instructed to "use pitch attitude or FPA [flight path angle] as the primary flight
reference." (no mention of cross-checking against non-digital (i.e. analog) displays)
The incident airplane's QRH had an emergency, non-alert, procedure titled, "Airspeed: Lost, Suspect or Erratic" that directed pilots to disengage the autoflight
systems, stabilize airplane pitch and thrust, disregard indicated airspeed/flight director pitch bar and high speed warnings, use pitch attitude (or flight path angle)
as the primary flight reference, and use the appropriate tables to determine the thrust/pitch relationship for the remainder of the flight. Based on the QRH
emergency procedure thrust/pitch tables for the climb, cruise, and descent phases of flight, controlled flight pitch attitude should range between approximately 5
degrees and 11 degrees for climb at maximum thrust, between 1 degrees and 3 degrees for cruise at 62 to 82 percent engine N1, and between -1 degrees and 1
degree for descent at idle thrust.
Transfer of Control of the Airplane
The Midwest Airlines General Operating Manual Flight Operations section, page 9 (revision 02) stated in part:
"The captain shall designate the pilot responsible for flying the aircraft and that pilot will maintain responsibility for aircraft control.... The primary responsibility of
the PM [pilot monitoring] will be to monitor flight path and airspeed. Change in aircraft control is a matter of notification and acknowledgement and should be
accomplished using the following terminology:
Notification - "I have the aircraft".
Acknowledgement - "You have the aircraft". Or vice versa."
Both pilots stated during post-incident interviews that there was no formal transfer of control during the event.
Unusual Attitude/Upset Training and Recovery
Midwest Airlines conducted upset or unusual attitude training during all of their training modules for the B-717, including Initial Flight Training, Differences Flight
Training, Transition Flight Training, Upgrade Flight Training, Recurrent Maneuvers Training, and Upgrade Qualification [proficiency check]. This training was
designed to aid the student in recognizing and recovering from an upset or unusual attitude.
The Midwest Airlines B-717 Instructors Guide FFS Period 02, page 5 (revision 3), contained guidance for the instructors to use during upset/unusual attitude
training. The techniques were the same as in the FCOM but the Instructors Guide identified the pilot flying (PF) as the pilot who would use the techniques to
recover. The pilot not flying (PNF) was directed to (1) call out altitude and airspeed throughout the recovery and (2) verify all required actions have been
completed and call out any omissions.
Safety Board investigators observed three B-717 simulator sessions that included Upset/ Unusual Attitude training. During the observations, the pilots were given
a pre-simulator briefing that included the same information included in the FCOM techniques and were also informed of the roles and duties of the PF and PNF.
During the training sessions that were observed, the pilots performed the roles and duties as directed for recovery.
Interviews with pilots, instructors and management pilots and reviews of Midwest Airlines manuals indicated that Midwest Airlines did not have any procedure for
both pilots to provide simultaneous input during recovery from an upset or unusual attitude.
Both of the incident pilots indicated that, during the event, both pilots were often providing inputs to the flight controls at the same time. The flight data recorder
indicated a Control Column Disconnect alert appeared at some point during the event. This light indicated that the two control columns had disconnected from