The technological quirks behind the Pinnacle Airlines CRJ-200 Crash at Jefferson City

By LESLIE MILLER

The Associated Press
Monday, June 13, 2005; 11:16 AM

WASHINGTON -- Two pilots, in a jovial mood as they flew an empty commuter jet, wanted to "have a little fun" by taking the plane to an unusually high altitude last October, only to realize as the engines failed that they were not going to make it, according to transcripts released Monday.

The plane, which the two were ferrying from Little Rock, Ark. to Minneapolis, crashed and both Capt. Jesse Rhodes and First Officer Peter Cesarz perished.

The cockpit voice recording, released by the National Transportation Safety Board at the start of a three-day hearing into the Oct. 14, 2004 accident, revealed how the pilots cracked jokes and decided to "have a little fun" and fly to 41,000 feet _ the maximum altitude for their plane. Most commuter jets fly at lower altitudes.

"Man, we can do it, 41-it," said Cesarz at 9:48 p.m. A minute later, Rhodes said, "40 thousand, baby."

Two minutes later, "There's 41-0, my man," Cesarz said. "Made it, man."

At 9:52 p.m., one of the pilots popped a can of Pepsi and they joked about drinking beer. A minute later, Cesarz said, "This is the greatest thing, no way."

But at 10:03 p.m., the pilots reported their engine had failed. Five minutes later, they said both engines had failed and they wanted a direct route to any airport.

The transcript recounts their increasingly desperate efforts to restart the engines and regain altitude. They tried to land at the Jefferson City, Mo., airport but by 10:14 p.m., it was obvious they wouldn't reach it.

"We're not going to make it, man. We're not going to make it," Cesarz said. The plane crashed in a residential neighborhood of Jefferson City. No one was injured on the ground.

Accident investigators are examining how well the pilots were trained _ a key safety question as the number of regional jets keeps growing.

The crash involved a Bombardier regional jet plane operated by Pinnacle Airlines, an affiliate of Northwest Airlines. Like many regional carriers, Pinnacle is growing rapidly as it teams up with a traditional network airline looking to offer more seats to more places.

Memphis, Tenn.-based Pinnacle grew by 700 percent in the past five years, according to Phil Reed, its marketing vice president. During that time, it switched its fleet from propeller-driven planes to small turbojets, known as regional jets, or RJs.

link

In the Pinnacle CRJ2 accident there are many considerations for blameworthiness:

a. Were the pilots justified in being at that height? (Pinnacle later instantly reduced their SOP max operating height). I think the pilots were strictly in accordance with the book as it was then writ - so notwithstanding their injudicious throwaway comment about having a bit of fun, they should not now be pilloried just for being flippant. They did get unwittingly out of their depth however. Did they ever get any realistic simulator training on what I talk about below? I'd doubt it. Did they at least have the theory? Probably not. Were they ever hypoxic as cabin pressure was lost?

b. Did the DFDR disclose that they indiscreetly broached or approached coffin corner limits once at the maximum certified altitude? Did they hit an aerodynamic problem or just surge the engines (or did the latter put them into the former - i.e. critically lose thrust and so inevitably stall the airframe, then more deeply stall the engines due to not taking the appropriate action (of idling the remaining good engine and going for speed). Appropriate action? More like absolutely critical reaction. The only correct response to an engine stall in coffin corner is to stuff the nose down and restore axial through-flow. This might have avoided the loss of the second engine. What I suspect is that they tried to dutifully maintain the cleared height (and further bled airspeed) instead of instantly doing the smart thing and increasing speed (let's see if the DFDR discloses that I'm right - assuming the DFDR recorded enough data). If they didn't instantly descend, then the loss of the second engine was quite inevitable (and that leads directly to an electrical problem for later having the relight ergs - even enough to light off the APU). A military pilot used to operating at/near the limits would've known that the second engine was vulnerable and would've immediately gone for speed/sacrificed height. Why may they have been more vulnerable on that day? Maybe it was ISA +15degrees at that height (warmer less dense air meaning that that model engine was operating that much closer to its surge line). Perhaps the fuel control and bleed air adjustments on that first engine was none too finely done. Tapping bleed air for anti-ice (as well as cabin pressure) will bring the engine closer to its surge line. That means that acceleration will be very sensitive and a compressor stall always on the cards.

c. Were the engines just poorly maintained? (i.e. bearing in mind that you can reliably "get away with" a poorly adjusted engine's fuel control unit at lower altitudes but that it will always show up once you're operating at or near the limits of the engine's operating envelope). I could always compressor stall an engine at 40,000 ft or above by hard accelerating it. That would always mean flaming it out if it hadn't already - and diving down to below 20 thou for a cold relight - a hot relight on rundown just not being available at those greater heights). Keep in mind that an engine may be easily stalled due to momentary intake blanking (first engine stalls due to a maladjustment or being accelerated and the resulting involuntary airframe yaw partially blanks the "good" engine's intake, duly stalling it as well. Remember that locked compressor stalls are also possible (engine becomes locked in a destructive surging condition that can only be resolved by either/both diving for the axial through-flow and HP-cocking it. i.e. flaming it out if it hasn't already). I suspect that, through ignorance and poor training, the Pinnacle duo just ended up cluelessly out of their depth.

d. If they acted precipitately (too high) in trying to start the APU (and were having trouble doing so), then their chances of ever getting an engine relight were going to be diminished. If I recall correctly (but probably don't), the CRJ2's engines had two relight possibilities. Crank + ignition or higher airspeed +ignition. Low IAS would give too low an RPM for light-off. You'd need the APU for ATS "cranking". "Battery only" relight without air turbine starter motor cranking would require an airspeed generating a very high rate of descent - to be successful (and that complicates the forced landing considerations of gliding distance available). Engine relight attempts at too slow a speed/ too great a height will just stagnate and eventually cook the engine's innards due to an improperly shaped flame-front internally. In a normally operating engine the flame-front is kept "shaped" and internal "cooling" is achieved by the secondary and tertiary airflows.

Suffice to say that they innocently bit off much more than a mouthful and then found themselves way out of their depth. Dropping the maximum operating altitude is a sound first step however that is also a recognition of all the points that I make about the hazards of operating near the limits and the potential outcomes for doing so. I suspect that because they were light-weight (i.e. without pax) that the problems they encountered weren't the aerodynamic pitfalls of exceeding the coffin corner aerodynamic limits of the airframe/thrust combo. Instead they just ran engines that hadn't been fine-tuned (and confirmed by air-testing at that height) into their lesser rough-tuned brick walls. That the second engine followed the lead of the first would've been caused by the yaw of losing the first engine (and their not reacting by reducing thrust on it and diving off height - in fact they likely did the exact opposite, adding thrust and maintaining their cleared flight level). Hopefully the NTSB will reach these conclusions and recommend at least better theoretical training and more realistic simulator profiles. I'd be very surprised if the ab initio, LOFT or recurrent training included any high altitude experience or related emergencies. The checklists that they tried to follow will also bear close examination. Were they fully appropriate to the circumstances? Did it recommend them immediately going onto oxygen (and did they?). Did the Cxlist properly and promptly address the problem with conserving electrics? Should the CRJ2 and other similar regional jets require a larger Ram Air Turbine or at least heavier duty batteries and a separate APU starting battery?

Apart from closing down the wrong engine (British Midland 737 at Kegworth) by mistake or misidentification, there are a number of scenarios where the loss of one can lead directly or indirectly to the calamitous loss of the second (fuel cross-feed mismanagement or high altitude mishandling). It remains the lingering peril behind twin-engined ETOPS. Compounding the error by having marginal electrical provisions for engine relighting is one aspect of this. The onset of mild hypoxia and its effects upon pilot performance under stress is another. And lastly, did ATC help or hinder or just remain perplexed by developments?

How many other Regional Jet types are similarly vulnerable?

The Likely CORE of the Problem (see the attached file and its graphic and the revelations at foot of page)

core lock - The core of an engine is locked, specifically the high pressure compressor and turbine.

From the NTSB Agenda we find that they're calling what I've called "locked compressor stall" (above) a "core lock". I'm not 100% sure but I suspect that beyond what it says in the attachment, core-lock entertains the very next stage of locked compressor stall. In an engine with fine tolerances, if you suffer a surge without flame-out and it progresses into a locked compressor stall, there is essentially a sustained fuel-fed fire raging within the hot section of the engine -and loss of finely tuned clearances will lead to a friction-induced loss of N2 windmilling RPM.

Indeed, I've seen a locked compressor stall at night that projected two feet of white flame from the engine intake. That's a reverse flow induced by the back-pressure (the air can't get through the engine due to sudden loss of HP compressor and turbine RPM - so it blows back out the front). "Sustained fuel-fed fire?", you say. "Isn't that what's always going on inside that thar normally operating engine?"

Well not exactly. You will recall that I mentioned secondary and tertiary airflows that are present in addition to the primary axial airflow that's mixing with the fuel. Its role is to cool the engine's innards and to shape the flame in the combustion chamber so that things that aren't meant to get hot don't do so. These 2ndary/tertiary airflows even cool the interior of blades and disks. Once you lose RPM, you lose throughflow and the all-important shaped flames and cooling. The fire then impinges upon surfaces, dissimilar coefficients of expansion come into play and there are frictional losses as rotating components lose their fine tolerances and start rubbing on the rubbing strips. That makes it critical to shut down the engine straightaway if it has not flamed out - once it has lost thrust (as happens in a locked compressor stall - as against a momentary surge or "cough"). A reasonable analogy for normal combustion versus a locked compressor stall is to compare a bunsen burner with a puddle of fuel that's alight (or an LP gas line that's caught fire). The bunsen has its shaped flame and the other is shapeless.

A loss of windmilling RPM means that the likelihood of generating enough RPM that you can just crack the igniters and light off and accelerate that CF34 engine to idle is unlikely. You're then stuck with getting that APU running and cranking/igniting. I seem to recall that the Pinnacle crew couldn't get the APU running (or flattened their batteries attempting to - due to trying too high up (above 21,000ft or at too fast an IAS or both)).

If you look at the slides in today's presentation by the chief investigator, several show pages from the procedural manual for engine relights, both single and double, and there are different procedures for higher-altitude relights and lower-altitude relights. They also highlighted (in yellow) certain portions of these procedures, including the need to maintain maximum-glide-distance airspeed until advancing the airspeed to 300Kts to effect a windmill relight (at higher altitude), whereupon a 5000-ft reduction in altitude can be expected. One can make some inferences from what was highlighted -- essentially that these were important procedures that the crew needed to follow. Perhaps a failure to follow some of these procedures is suspected as a possible reason that the engines wouldn't relight.

There is also a graph from the FDR showing repeated activation of the stick pusher and stick shaker, as well as significant deflections of the control column; not clear where in the emergency period these occurred, but it's plainly something that the investigator would have been showing to the room and discussing. I read it as indicating that the crew WAS trying to maintain height.

It may well come down to engine design and testing/certification. In addition they might need to revisit the MEL conditions for flogging on with an unserviceable APU. I recall that a Canadian airframe icing accident on take-off (on 10 Mar 89) occurred because an F-28 (C-FONF) had to refuel with the engine running and therefore couldn't de-ice (because they would've had to shut down to do so - and there were no ground-carts at Dryden for an engine re-start. That was one reason for not carrying an APU on the MEL. The Pinnacle accident may have revealed another.

Hopefully the NTSB will be addressing whether or not the crew might have finally encountered a T-tail's unflapped deep-stall on finals - as the last straw in their bad day of discovery.

Finally, just as in the AA587 accident's yaw-damper glitch pre-start at JFK, one must not disregard that the airplane was being ferried because of a bleed air deficiency at Little Rock that excluded it from being used for revenue service. Bleed air problems and engine stalls at height are very sympatico conditions. A bleed air problem can make an engine hypersensitive to stalling on acceleration.

Here's the sad part, and I can now see why the start procedures were highlighted in the docket. It isn't that they didn't follow the procedures, although it was clear that they struggled with them a bit (i.e. training/practice issues). It was that the procedures talk about using windmilling to start the engine, and if that fails and you get below a certain altitude, using bleed air - which appears to be what they tried to do.

However, in the case of core lock, these procedures may not work -- and if you read the CVR, appear not to have worked, as the crew repeatedly wonders aloud why they can't get N2 using the procedures. The GE document in the link below, however, appears to say that the ATS starter has sufficient torque to overcome core lock. Turns out that a common procedure in pre-delivery testing was to "grind down" the engine's inclination to core lock by actually inducing a high-temperature in-flight shutdown and then seeing if the thing would windmill-start; if not, they use the ATS to get it turning (overcome the core lock) and repeat until it will windmill after a high-temperature in-flight shutdown. GE says that in every instance, the ATS has been able to get the engine turning. The sad part appears to be that if the crew were familiar with this procedure, they could have gone to the ATS. It's not clear to me from the CVR whether they ever thought on their own to try this as a last-ditch effort, or if there was some reason that they couldn't.

The link to the GE document is:

http://www.ntsb.gov/Events/2005/Pinnacle/exhibits/324090.pdf

You'll note in that GE file that (heretofore) it was strictly GE's proprietary info (i.e. no wonder pilots weren't aware of its lethal implications).

QUOTE
Release #05.022
June 13, 2005

Pilots Point to Poor Training, Engine Flaws in Fatal Pinnacle 3701 Accident

Carrier must fulfill pledge to change its approach to common-sense safety programs

WASHINGTON, D.C. -- Air Line Pilots Association Executive Air Safety Chairman Capt. Terry McVenes issued the following statement after day one of the National Transportation Safety Board Public Hearing on the Pinnacle Airlines Flight 3701 accident that took place on Oct. 14, 2004, in Jefferson City, Mo.

“The NTSB investigation makes it clear that if just one of the two stalled engines had restarted, this accident would never have occurred. The facts show that the pilots followed the proper procedures and attempted to restart their engines multiple times. But both engines failed to restart because they had suffered ‘core lock,’ a safety risk previously known only to engine and aircraft manufacturers until very recently--and about which the pilots knew nothing. While the FAA’s Special Airworthiness Information Bulletin issued on June 2, 2005 instructs pilots about how to avoid the ‘core lock’ danger, it comes far too late for our lost colleagues"

CVR transcript is here.

http://www.ntsb.gov/Events/2005/Pinnacle/exhibits/CVR_Factual.pdf

to Latest Additions