N54PVCessna 510 · 2010

On April 19, 2008, about 1010 Pacific daylight time, a Cessna 510 Citation Mustang, N54PV, sustained substantial damage following the pilot's intentional ground loop maneuver during the landing roll on runway 24 at McClellan-Palomar Airport, Carlsbad, California. California Natural Products was operating the airplane under the provisions of 14 Code of Federal Regulations Part 91. The commercial pilot and three passengers were not injured. The personal flight departed from Lincoln Regional Airport, Lincoln, California, about 0854, with a planned destination of Carlsbad. At the time of the accident, the pilot had canceled his instrument flight rules (IFR) flight plan, and was executing a visual flight rules (VFR) approach to runway 24 in visual meteorological conditions.

The pilot was interviewed by a National Transportation Safety Board investigator both immediately after the accident and the following day with regards to his recollections of events that transpired. He affirmed that he is the president of the company operating the airplane. The pilot reported that on the morning of the accident, he flew the accident airplane from Stockton, California, to Lincoln, which consisted of a 16-minute flight. After landing in Lincoln he picked up passengers. He subsequently departed at 0854, and was cleared to 35,000 feet mean sea level (msl) as requested on his IFR flight plan. The en route cruise was normal as the airplane approached Carlsbad and the pilot began a standard terminal arrival route (STAR). During the initial segment of the STAR the pilot configured the autopilot in vertical speed mode.

The pilot further stated that as the airplane crossed over the Avenal transition [waypoint on the SADDE6 STAR] about 30,000 feet msl, the right [copilot's] Primary Flight Display (PFD) began to flicker. About 5 minutes later, as the airplane continued to descend through 28,000 feet msl, the left PFD flashed an alert indicating that the autopilot had disconnected. The pilot immediately felt the disengagement of the autopilot from the heavy control forces on the control yoke that he had to exert to fly the airplane. He additionally noted that the autopilot activation light was not illuminated, further confirming that the system had disengaged. Shortly thereafter, the pilot discovered that the electric pitch trim [located on the control yoke] was not operational. After establishing that the pitch trim was not functional, he ultimately began using the trim wheel located on the center consol, which operated normally. The pilot noted that following the autopilot failure, the flight director bars overlaid about a 10-degree pitch up attitude despite the descending flight path.

Flying the airplane by physical manipulation (i.e., "by hand"), the pilot continued the STAR and reported to air traffic control (ATC) that he had an autopilot malfunction. As the pilot descended to 5,000 feet msl, the airplane encountered instrument meteorological conditions (IMC). Controllers vectored the pilot to the instrument landing system (ILS) to runway 24. The airplane broke out of the overcast conditions at 2,600 feet msl and the pilot relayed to controllers that he would make a visual approach to the runway. The pilot noted that he was overwhelmed with the electrical failures and fatigued from maneuvering the airplane by hand for such a long duration (which he approximated was around 45 minutes).

The airplane crossed the runway threshold configured with the wing flaps fully extended [30 degrees] and flying about 15 knots faster than the predetermined landing speed, which the pilot had previously calculated as a Vref speed of 87 knots. From looking at the airspeed indicator, he noted that the airplane was fast for landing but thought the runway would be long enough to accommodate the likely delayed touchdown. As the airplane progressed down the runway he approached a small uphill slope that was located around the middle. The airplane approached the apex of the sloping runway and the pilot began to clearly distinguish where the runway surface ended, which was sooner than he had anticipated.

The airplane touched down beyond the midpoint of the 4,897-foot-long runway. The pilot realized that despite his braking attempts and extension of speed brakes, the airplane was going to continue off the runway surface over a small downsloping cliff at the end. He determined that he would not be able to abort the landing due to the airplane's diminished groundspeed and elected to perform a 180-degree course reversal by rapidly turning the control yoke and depressing the left rudder pedal. The airplane ground looped, coming to rest in a dirt area south of the runway; the main landing gear collapsed and the flaps folded under the wings.

The pilot noted that during the event he never attempted to reset the autopilot system. He did not recall hearing an audible autopilot disconnect warning and did not think the airplane had such a function. He could not remember the exact error message when the autopilot disconnected, but thought it may have been "PFD" or "PTF."

A Federal Aviation Administration (FAA) inspector spoke with a controller that was in contact with the pilot during the accident sequence. She observed the airplane approaching runway 24 and noted that it appeared to be quite high in altitude. In a radio transmission she queried, "do you think you can make it," to which the pilot replied "yes." The airplane then touched down on the runway past taxiway A4 and subsequently ground looped.

The 57-year-old pilot was certified to operate the accident airplane (Cessna Mustang CE510) in accordance with existing Federal Aviation Regulations (FARs). A review of the FAA Airman and Medical Records database disclosed that the pilot held a commercial pilot certificate, with an airplane single and multiengine land rating; the certificate listed the type rating of CE510 (s). The pilot additionally held an instrument rating. His second-class medical certificate was issued on August 01, 2007, with the limitation that he must have glasses available for near vision.

The pilot's self-reported flight time indicated he had amassed 1,398 hours total flight experience, with 140 hours accumulated in Cessna 510 airplanes. The pilot reported a total of 279 hours of instrument experience and 35 hours of night flight. During the preceding 90 days, 30 days, and 24 hours, the pilot reported that he had flown in the capacity of pilot-in-command approximately 78, 38, and 2 hours, respectively.

A review of flight training records revealed that the pilot completed training for his initial CE510 type rating at Flight Safety Training Centers on September 17, 2007, which held the limitation that he may not act as pilot-in-command until reaching 25 hours of supervised operating experience in the CE510; he accomplished those flight hours following the training with the operator's chief pilot.

The accident airplane was a Cessna Mustang CE510, serial number 510-0028, manufactured in 2007. Its standard airworthiness certificate (normal category) was issued on September 19, 2007. The airplane was certified in accordance with FAR Part 23 airworthiness standards, and could be operated by either single or two pilot crews. A type rating is required to operate the airplane, and a waiver is required to operate the airplane with one pilot.

The aircraft underwent its last periodic inspection on April 14, 2008. At the time of the accident, the airframe and both engines had accumulated 120 hours total time.

As originally provided by Cessna, the airplane was equipped with a Garmin G1000 Integrated Flight Deck with a GFC700 autopilot.

Autopilot and Yaw Damper

The Cessna Citation Mustang's autopilot and yaw damper operate the flight control surface servos to provide automatic flight control. The autopilot controls the aircraft pitch and roll attitudes following commands received from the flight director. Pitch auto-trim provides trim commands to the pitch trim servo to relieve any sustained effort required by the pitch servo. The servo gearboxes are equipped with slip-clutches set to certain values, enabling the servos to be overridden in case of an emergency.

The autopilot pitch axis uses pitch rate to stabilize the aircraft pitch attitude during upsets and flight director maneuvers. Flight director pitch commands are rate and attitude limited, combined with pitch damper control, and sent to the pitch servo motor. The pitch servo measures the output effort (torque) and provides this signal to the pitch trim servo. The pitch trim servo commands the motor to reduce the average pitch servo effort. The autopilot roll axis uses roll rate to stabilize aircraft roll attitude during upsets and flight director maneuvers. The flight director roll commands are rate and attitude limited, combined with roll damper control, and sent to the roll servo motor. The yaw damper uses yaw rate and roll attitude to dampen the aircraft's natural dutch roll response. It also uses lateral acceleration to coordinate turns. Yaw damper operation is independent of autopilot engagement.

The autopilot can be disengaged by the pilot via activation of the Autopilot Disengage (AP DISC) Switch. Additional methods to disengage the autopilot are threefold: depressing the Autopilot (AP) Key on the Automatic Flight Control System (AFCS) Control Unit, activating the Go-Around (GA) switch, or activating the Manual Electric Pitch Trim (MEPT ARM) switch. Positive confirmation of manual autopilot disengagement is indicated by both a five-second visual warning (yellow "AP" flashes) and three-sound audible warning.

Automatic disengagement of the autopilot can occur from the following events transpiring: system failure, invalid sensor data, yaw damper failure, stall warning, inability of system to compute default flight director modes. Following an automatic disconnect a red and white "AP" annunciation will flash accompanied by an autopilot disconnect aural alert (which will continue to sound until the pilot depresses either the "AP DISC" or "MEPT ARM" switches).

Cessna and Garmin Literature

According to both the Cessna Airplane Flight Manual (AFM) and Emergency Procedure Checklist, in the event of a red "PTRM" warning on the PFD, the autopilot, yaw damper, and manual electric pitch trim will be inoperative. The checklist dictates that following such a warning, the pilot should disconnect the autopilot (if required) and trim the airplane with the manual trim wheel. The pilot should then actuate each half of the pilot and copilot manual electric trim switches separately. If the "PTRM" message remains, the pilot should not re-engage the autopilot.

On November 02, 2007, Cessna issued a "Temporary Pilots' Abbreviated Checklist Change," revision 5, which was to be inserted in the Pilots' Abbreviated Checklist, Emergency Procedures section. The revision states that an autopilot preflight test fail warning (red "PFT" warning on the PFD) indicates a failure of the autopilot system preflight test. The test is performed automatically in response to some detected anomalies while in flight, and its failure will result in the autopilot, yaw damper, and electric pitch trim becoming inoperative.

In the event that a pilot receives such a warning, revision 5 states that the pilot should reset the AFCS circuit breaker (pull, wait for 5 seconds, and push back in). If the message clears the pilot may engage the autopilot as desired; if the message persists, the pilot should pull the circuit breaker, advise Air Traffic Control of non-RVSM (reduced vertical separation minimum) status and continue operating the airplane by utilization of the manual trim wheel. A copy of this revision was found in the cockpit during the post-accident examination.

According to a Cessna representative, at no time during the aforementioned reset process, would a flight display go off-line or discontinue normal operation.

Following the accident, the airport issued a special routine aviation weather report (METAR) at 1012. It stated: winds from 130 degrees at 8 knots; overcast at 2,700 feet; visibility 8 miles; temperature 14 degrees Celsius; dew point 08 degrees Celsius; and altimeter 29.95 inHg.

The McClellan-Palomar Airport is a FAR Part 139 certificated facility that has one hard-surfaced asphalt runway (runway 6/24). Runway 6/24 is 4,897 feet long and 150 feet wide. Runway 24 is equipped with a Medium Intensity Approach Lighting System with Runway Alignment Indicator Lights (MALSR), Runway End Identifier Lights (REIL) and a 4-light Precision Approach Path Indicator (PAPI) with a 3.2-degree visual glide path angle. The PAPI array is located on the south (left) side of the runway. According to FAA and San Diego County survey data, the terrain elevation at the west end of the runway 24 centerline was 328.15 feet mean sea level (msl).

The airport is serviced by an ATC tower, which is staffed by FAA personnel. Southern California (SOCAL) terminal radar approach control (TRACON) provides approach/departure control services for the airport on a continuous basis.

A post-accident examination was performed at the facilities of West Coast Jet Services, located at Carlsbad. Present to the investigation was the National Transportation Safety Board investigator-in-charge, a representative from Cessna Aircraft Company and two inspectors from the FAA. The owner of West Coast Jet Services, who aided in recovering the airplane, stated that at the accident site the airplane's wing flaps were hyper-extended and folded under the wings, consistent with them being in the full extended position at impact; the main landing gear were folded under the airplane.

The external examination disclosed the airplane had sustained damage consistent with the reported ground loop the pilot intentionally performed. Removal of the access door for the main junction box (J-Box) revealed that all circuit breakers were in. Investigators connected the battery and noted the cockpit control positions: elevator trim wheel [takeoff], landing gear level [down], antiskid [on], flaps [full]. The Hobbs meter displayed an airplane total time of 120.4 hours.

Investigators applied power to the airplane initially leaving the avionic switch off. The battery level indication on the multi function display (MFD) showed 23 volts. The display gave the error message "G1000 failed path- the data path has failed." The right primary functional display (PFD) was dim and continuously flickered with a static actively skipping around the screen.

Following the initial documentation, investigators shut the airplane power off and connected a ground power unit providing 28 volts. The airplane was powered back on with the accompaniment of the avionics power switch. There were no faults with the exception of the "GCU" light flashing (generator). The right PFD continued to flicker. The electric pitch trim split-element centering thumb switches on the outboard side of the pilot's control yoke were manipulated from the full forward (nose down) position to the full aft (nose up) position. No anomalies were noted as the elevator trim tabs appeared to move simultaneously from stop to stop.

Investigators activated the autopilot, noting no anomalies in the system. Selecting the red "display backup" button located adjacent to the screen on the right PFD resulted in the multi-function display (MFD) screen displaying the image of the right PFD (reversion mode), with no static. The airplane was powered off and the right PFD screen removed and exchanged with the left PFD screen. The airplane was powered back on and the right PFD screen (now affixed in the left PFD position) was observed flickering with the same static observed when positioned on the ride side. The left PFD screen was operating normally in the right PFD position.

There were no malfunctions found in the system during the examination. A complete examination report is contained in the public docket for this accident.

Fault Logs

Following the accident, investigators downloaded the fault codes recorded for the MFD and PFD. A copy of the fault codes were provided to Garmin for decoding and translation. After reviewing the codes, a Garmin representative imparted the following assessment:

At 09:19:45 on the day of the accident, GIA1 [integrated avionics unit 1] logged the fault "PRMTR:AP TDM Comm Valid MODE:YD Engaged Parameter lost," which indicates that the yaw damper was disengaged; a yaw damper disconnect results in an autopilot disconnect by design. GIA2 [integrated avionics unit 2] logged the same fault about 2 seconds earlier, which according to Garmin, indicates that the yaw servo dropped out of time-division multiplexed (TDM) communication, which is the servo's main protocol used in normal mode.

Further review of the faults revealed that 18 seconds after the initial fault, GIA1 logged the fault "PFT FAIL: Verify servo PFT status," which indicates that the preflight test sequence failed; GIA2 logged the same fault 1 second prior. The Garmin representative stated that the sequence of faults observed occurs when one processor within a servo resets, which causes the autopilot to disconnect. When the servo processor comes back online following the reset, it initiates its preflight test by design. She opined that the internal communication failure is consistent with the behavior when one processor initiates preflight test while the other processor in the same servo continues to operate in normal mode (because it did not reset). This in turn results in the system preflight test to fail, as indicated by the logged "PFT FAIL" fault. She noted that the system preflight test is initiated with each system power up in order to ensure that all aspects of the autopilot are functioning as intended by design. The Garmin representative additionally stated that the failed preflight test condition can be remedied by cycling power to the autopilot system.

Cessna Service Bulletin SB510-34-02 requires an upgrade in the G1000 software. Among a variety of fixes, the software update provides "improvements to the yaw servo load cell monitor and monitor time-out to reduce potential autopilot abnormal disconnects" as well as fixes the issue where "flash memory sector erase errors can cause the autopilot to abnormally disconnect."