N557XJBombardier BD-100-1A10 · 2005

On July 27, 2022, about 1236 Pacific daylight time, a Bombardier Inc BD-100-1A10 (marketed as a Challenger 300), N557XJ, was involved in an accident near San Francisco, California. The cabin attendant was seriously injured; the pilot and co-pilot were not injured. The airplane was operated as a Title 14 Code of Federal Regulations (CFR) Part 91 positioning flight.

The pilot-in-command (PIC) reported that the airplane arrived at San Francisco International Airport (SFO) San Francisco, California, about 1130 from Shively Field Airport, Saratoga, Wyoming. Five passengers deplaned and a new cabin attendant joined the current crew. After a briefing and compliance with the required checklists for the airplane, the flight crew departed to the east to Page, Arizona, with the second-in-command (SIC) as the pilot flying.

The PIC indicated that, as the airplane continued to climb through 20,000 ft msl, an amber CAS “AP STAB TRIM FAIL” message appeared. The PIC began to review a checklist to troubleshoot the amber message when a second amber CAS message, “AP HOLDING NOSE DOWN” appeared. The PIC assumed control of the airplane after a positive exchange of the flight controls. The PIC stated the autopilot then “disconnected on its own just as I was going to push the disconnect button.” The airplane immediately pitched up, and after “several hard oscillations,” according to the SIC, the PIC was able to recover the airplane into straight and level flight. During this time, the cabin attendant in the aft cabin crawled up to the cockpit and reported to the crew that she was seriously injured.

The PIC reported that he did not feel comfortable reengaging the autopilot and continued to manually fly the airplane. After being cleared to return to SFO, the crew landed the airplane without further incident and the cabin attendant received medical treatment. No damage was sustained to the airplane or engines.

The cabin attendant later reported that she received a preflight briefing indicating that she should be seated and belted until the airplane reached 10,000 ft msl. She stated that, about 15 minutes after takeoff, she unbelted and moved about the cabin to perform her duties; she was not seated or secured with a seatbelt at the time of the in-flight upset (company policy allowed cabin crew to maneuver around the cabin above 10,000 ft msl).

The audition of the cockpit voice recorder (CVR) revealed that the event was not captured due to being overwritten on the continuous recording loop of the CVR. Although the FDR “Master Caution” parameter recorded the posting of multiple caution messages around the time of the event, the FDR did not record which caution messages were posted. The FDR did not contain any telemetry about the “AP STAB TRIM FAIL” or “AP HOLDING NOSE DOWN” annunciations.

FDR Data

Figure 1. FDR data of flight track

· At 1230:51, the airplane departed runway 28R at SFO. As the airplane climbed, the magnetic heading changed from 282° to 54° (right turn).

· At 1232:19, the autopilot was engaged while the airplane was at 4,265 ft pressure altitude, 220 knots (kts) indicated airspeed (244 kts ground speed), and a magnetic heading of 54°; the left elevator was at 5° while the right elevator was at 7°.

· At 1232:24, the master caution activated for 5 seconds. The autopilot remained engaged, and the master caution was active again at 1232:38 (for 6 seconds).

· At 1236:39, both the Master Disconnect parameter and the Automatic Flight Control System (AFCS) Abnormal Disconnect parameter changed from “Not Disconnected" to “Disconnected” (abnormal disconnect is any autopilot disconnect caused by any method other than the AP button on the flight guidance panel [FGP]). At this time, vertical acceleration increased from 0.985g to 2.221g in less than a second.

· At 1236:40, the autopilot state was changed from engaged to disengaged. Vertical acceleration (sampled 8 times per second) reached -0.426g during this second.

· At 1236:41, vertical acceleration was 2.096g and reduced within the second to 0.176g. The autopilot remained off for the remainder of the flight.

· At 1236:48, the pilot and copilot manual trim enabled was active seven times within the minute following the autopilot becoming disengaged. For each occurrence where the pilot manual trim enabled was active, a respective pitch trim command nose down flag was active. At each occurrence, the stabilizer trimmed nose down.

· At 1238:21, the right primary flight display (PFD) flag showed it failed for 3 seconds.

· At 1238:22, the master caution activated for 16 seconds.

· At 1239:08, the right multifunction display (MFD) flag showed it failed for 14 seconds.

· At 1242:50, the left MFD flag showed it had failed and remained in this state for the rest of the flight. At this time, the airplane began to return to SFO. The remainder of the flight was uneventful.

· At 1302:12, the weight on wheels on the left and right main landing gear registered a change from AIR to GND. The airplane landed on runway 28R without incident and taxied normally off the runway.

Quick Reference Handbook (QRH)

The airplane’s manufacturer’s QRH contained procedures for responding to the presented CAS messages. The QRH available and used by the flight crew was last revised on June 14, 2022:

“Condition: Autopilot pitch trim has failed.

Objective: Assume manual control.

WARNING: An abrupt change in control force, or an out of trim situation may be experienced when disconnecting the autopilot. SMKG /BELTS should be selected on.

CAUTION: Minimize changes to airspeed and configuration to minimize control forces and out of trim situation.

(1) Flight controls ........................................................................................... HOLD FIRMLY

(2) Autopilot ..............................................DISCONNECT using control wheel MSW switch

(3) Retrim airplane if necessary.

(4) Autopilot ...................................................................................................... DO NOT USE”

“Condition: Autopilot is holding control force in the direction indicated.

Objective: Correct mistrim condition.

WARNING: An abrupt change in control force, or an out of trim situation may be experienced when disconnecting the autopilot. SMKG / BELTS should be selected on.

CAUTION: Minimize changes to airspeed and configuration to minimize control forces and out of trim situation.

(1) Flight controls ........................................................................................ HOLD FIRMLY

(2) Autopilot ..................................................................DISCONNECT using control wheel MSW switch

(3) Retrim airplane if necessary.

(4) Autopilot .....................................................................................................AS DESIRED”

The flight attendant reported that the BELTS light was on during departure, but could not recall if the light extinguished at any point during the flight. In addition, the FDR data did not include any information about the BELTS light indication. According to the operator, company procedures allowed the cabin attendant to be moving about the cabin at the time of the accident.

Manufacturer Reference Information of AP STAB TRIM FAIL and Autopilot

According to the airplane manufacturer,

The purpose of the AP STAB TRIM FAIL Caution message is to advise flight crew[s] that the autopilot is no longer able to command horizontal stabilizer trim. In isolation, this has no effect on autopilot engagement, i.e. the message itself does not cause the autopilot to disengage. Inability to command horizontal trim or an out-of-trim condition will not result in autopilot disengagement; in such cases, the autopilot continues to control pitch using only the elevator.

The autopilot is designed to remain engaged for all but a few specific failure conditions; when the autopilot disengages due to one of these failure conditions, it is referred to as abnormal automatic disengagement. There are also a number of pilot actions which will cause the autopilot to disengage: use of the master disconnect switches on the control wheels, the AP or YD button on the Flight Guidance Panel (FGP), the AP/YD disconnect bar on the FGP, use of the Takeoff/Go-around (TOGA) switches, use of manual trim, or setting the pitch trim select switch to SEC or OFF. When the autopilot disengages due to one of these pilot actions, it is referred to as normal disengagement. When the autopilot is disengaged with the aircraft in an out-of-trim condition, the elevator is released and free to move until the flight crew take manual control via the control columns; this can result in pitch oscillations driven by the aerodynamic forces from the horizontal stabilizer and lack of counter-balancing aerodynamic forces from the now-released elevator moving back to a neutral position. The pitch oscillations are a natural result of an out-of-trim aircraft and an unrestrained elevator. Maintaining a solid grip on the control column so as to prevent the elevator from moving back to neutral when it is released by the autopilot, reduces or can even prevent pitch oscillations upon autopilot disengagement.

With the autopilot engaged and unable to command trim, and depending on changes to airspeed, altitude and aircraft configuration (flaps position, etc.) the aircraft can enter an out-of-trim condition. Regardless of how out-of-trim the aircraft becomes, the autopilot will remain engaged and continue to attempt to maintain desired pitch attitude with the elevator.

If the out-of-trim condition exceeds a pre-defined threshold, as determined via a voltage feedback loop between the elevator servo and autopilot, an AP HOLDING NOSE DOWN or AP HOLDING NOSE UP Caution message will post on the CAS. The purpose of these messages is to advise the flight crew that the autopilot is using significant elevator deflection to maintain desired pitch, i.e. that the aircraft is flying in an out-of-trim condition.

When the autopilot is disengaged with the aircraft in an out-of-trim condition, the elevator is released and free to move until the flight crew take manual control via the control columns; this can result in pitch oscillations driven by the aerodynamic forces from the horizontal stabilizer and lack of counter-balancing aerodynamic forces from the now-released elevator moving back to a neutral position. The pitch oscillations are a natural result of an out-of-trim aircraft and an inadequately restrained elevator. Maintaining a solid grip on the control column to prevent the elevator from moving back to neutral when it is released by the autopilot prevents or reduces pitch oscillations upon autopilot disengagement.

During the certification flight test program for the Challenger 300, Bombardier demonstrated that the autopilot can be safely disengaged when the AP HOLDING NOSE DOWN or AP HOLDING NOSE UP Caution messages are posted, with no resulting pitch oscillations and minimal control column forces. However, if disengagement of the autopilot is delayed beyond the posting of these messages, and the aircraft continues to become more out-of-trim, pitch oscillations upon eventual autopilot disengagement can be significant.

There are multiple conditions which can lead to the inability of the autopilot to command trim and cause an AP STAB TRIM FAIL Caution message to post. One such example is seen in NTSB investigation reference ERA23LA135.

Another source of inability of the autopilot to command trim is the software in the autopilot itself. The autopilot system is comprised of two Flight Guidance Computers (FGC). Each FGC has two independent processors (Main and I/O) and each processor hosts a set of monitors. At the system level, there are a total of four independent sets of monitors. Each monitor from each set can disable the autopilot pitch trim function. Each monitor receives as input the filtered elevator servo motor voltage (an indication of force being held by the servo) and horizontal stabilizer movement rate feedback from the Horizontal Stabilizer Electronic Trim Control Unit (HSTECU).

These monitors check for the following conditions when the autopilot is engaged and latch a fault (except where noted otherwise):

· wrong direction monitor; horizontal stabilizer trim rate is opposing servo force (this monitor also covers the uncommanded trim/trim runway);

· no trim monitor; servo force is present and horizontal stabilizer trim motion is not above the running threshold;

· post-engagement built-in test; ensures that each FGC’s analog discrete can disable autopilot trim;

· HSTECU availability monitor; can also disable autopilot pitch trim (but does not latch).

Triggering of any of the monitors will result in the disabling of the autopilot pitch trim function and the posting of the AP STAB TRIM FAIL Caution message on the CAS. The monitors are cleared when the autopilot is disengaged. When a monitor trips, the enable analog discrete and the ARINC 429 trim arm signals from the FGC to the HSTECU are removed. When this occurs, the HSTECU ignores autopilot trim commands. The autopilot trim command generation is independent from the trim arm. As such, non-zero command values continue to be sent after a monitor trips.

Postaccident Examinations

A postaccident functional check of the autopilot system revealed no anomalies. This included the successful operational airplane level testing of the elevator servo, pitch trim system, the HSTECU, the interrogation of the flight guidance computer (FGC), and component level testing of the FGC, HSTECU, elevator autopilot servo and servo mount. All components functioned normally and there were no faults recorded in the HSTECU non-volatile memory.

Data retrieved from the maintenance diagnostic computer (MDC) revealed that the MDC fault history showed both FGCs flagged the pitch trim system as inoperative/failed at the same time but did not provide any data as to its cause. Furthermore, the MDC did not log a system-induced disengage code for the autopilot (disengagement due to pilot actions, also referred to as normal disengagement, are not logged in the MDC). If the autopilot disconnects due to a malfunction or failure, the MDC will report a fault. If the autopilot disconnects due to a fault (i.e., without pilot intervention), the "cavalry charge" auditory warning will sound continually until the crew recognizes the disconnect by pressing either master disconnect switch.

The FGC and autopilot elevator servo were examined and tested at the manufacturer's facility, revealing no failure anomalies that would impede normal operation of the autopilot system.

An analysis of the HSTECU and retrieval of the non-volatile memory (NVM) at the manufacturer's facility indicated that no failure conditions were present within the unit, nor were any problems observed that would impede the proper functioning of the pitch trim control system.

The airplane manufacturer conducted numerous test flights on its Challenger 300 flight test airplane with the intention of producing an AP STAB TRIM FAIL message to be shown in conditions comparable to, or worse than, the event flight. The test flights were unable to reproduce the AP STAB TRIM FAIL and AP HOLDING NOSE DOWN cautionary messages.

The manufacturer identified several occurrences of AP STAB TRIM FAIL from the aggregate aircraft health management system (AHMS) it had available from a newer airplane on which the system was installed. The AHMS has the capability to capture a significantly wider variety of data than the FDR. The manufacturer’s review and comparison of the accident airplane to the AHMS data allowed the manufacturer to state that the most likely cause of the AP STAB TRIM FAIL caution message on the accident airplane was that after the autopilot was engaged in an out-of-trim condition, dynamic forces existed such that, in combination with the initial out-of-trim condition, the triggering of an FGC monitor was probable, due to satisfying internal monitor thresholds and acting as designed. This resulted in the autopilot disabling automatic pitch trim. No observed or known event would rule out a monitor triggering scenario on the accident airplane, as was concluded from the events for which AHMS data were available.