The Oct. 14, 2004, crash of a Pinnacle Airlines [PNCL] regional jet illustrates how aircrews are not adequately protected against multi-engine flameout, and better training and recovery procedures may be in order. This may well be the central National Transportation Safety Board (NTSB) conclusion, based on everything that has come to light in the case. The training of captains and first offers at rapidly expanding carriers like Pinnacle, which flies as Northwest Airlink, was questioned in three days of hearings on the crash held by the NTSB earlier this month.
Recommendations will be issued some months hence, when the investigation is completed.
The aircraft, a Bombardier [BBD] CRJ-600-200 flying as Flight 3701, was on a positioning flight from Little Rock, Ark., to Minneapolis-St. Paul, Minn., when it crashed near Jefferson City Memorial Airport in Missouri around 10:15 p.m. after climbing to 41,000 feet and suffering a dual-engine flameout. As a non-revenue positioning flight, only the captain and first officer were aboard, and both were killed in the crash.
The dispatcher cleared the crew, Capt. Jesse Rhodes, 31, and First Officer (F.O.) Peter Cesarz, 23, for 33,000 feet, but the crew decided to climb to 41,000 feet, without informing the dispatcher. In fact, the crew did quite a bit without advising the dispatcher. Shortly after takeoff, according to NTSB investigator in charge, the crew did an abrupt pitch-up maneuver that resulted in a load of 1.8 Gs and caused the airplane’s stall protection system to activate. The crew reduced the pitch angle and continued to climb.
At about 14,000 feet, the crew activated the autopilot for about 80 seconds and, during this time, Rhodes and Cesarz switched seats. This would have consequences later in the flight. The right side of the instrument panel is not equipped with an EFIS, or a primary flight display.
At 15,000 feet, the autopilot was disengaged. Cesarz, the pilot flying, pitched the aircraft up to 17 degrees, resulting in a load of 2.3 Gs, and then the control column was pushed forward, so that the loads dropped to 0.3 G. This was done twice. Then a series of rudder reversals was input, contrary to everything that’s been learned about the hazards of doing so in the American Airlines A300 accident (see ASW, Nov. 1, 2004, p. 1).
The crew climbed to 41,000 feet on autopilot. Instead of specifying the speed at which it should fly while climbing, they specified the rate of climb. A slow deceleration began at approximately 38,000 feet, from a climb speed of 200 knots. As airspeed decreased, angle of attack increased. When the jet reached its assigned altitude, it was flying relatively slowly. This is not the first time that an autopilot climb in VS mode (vertical speed) has resulted in a stall; speed reduces as required to match the dialed up rate of climb, with the hazard that speed will reduce to stall speed. One wonders why the Federal Aviation Administration (FAA) certifies autopilots that allow airspeed to decay as much as happened here. A minimum airspeed of best angle/rate of climb (no matter what the autopilot mode) should be decreed by the flight management system (FMS). Ending up at 41,000 feet, behind the drag curve, with insufficient excess power to accelerate, and engines on the verge of an intake stall, is almost a preordained outcome.
The airplane was at 41,000 feet for about three minutes, during which time Capt. Rhodes left the cockpit for a brief time to get congratulatory soda pops.
The stick shaker activated, which disengaged the autopilot. The flight crew then pulled back the control column, increasing the angle of attack sufficiently to activate the stick pusher. In fact, the stick pusher was activated three times. As the stick pusher moved the control column forward, the airplane’s pitch angle changed from 7 degrees nose up to 30 degrees nose down, followed by 30 degrees nose up pitch.
The stick pusher, which forcibly drops the nose, protects the engines from pressure drops and flame outs. Not in this case. During this time, the engine core rotation speed, or N2, began to decrease, and the engines flamed out (trying to maintain the cleared height led to a drop in airspeed and axial flow through the engines). The captain declared an emergency.
The inexperience and lack of training may have played a role from here on out. For example, do you drift down initially to evaluate the situation? If you decide to do this, you initially decrease the airspeed to about 210 knots for a very leisurely descent. This low speed would probably cause the engine cores to stop rotating, and returning to windmilling speed would require giving up a great deal of altitude. The engines feature a 6.21 ratio (bypass to core engine airflow), so a very lackadaisical response from the N2 would be expected. A dive would have to be held for quite a while.
As altitude decreased, the drift down speed would have to be decreased, and this would be the slowest speed flown, another page in the quick reference handbook (QRH). Or do you immediately point the nose to the ground, right after staff recovery, and effectively dive the aircraft to get the cores to spin, and decreasing the time to “manage” the event. The accident crew had never been faced with these kind of choices, even in the simulator.
The flight crew recovered from the stall at 38,000 feet, but both engines were still inoperative. At 20,000 feet the flight crew reported to air traffic control (ATC) that an engine failure had occurred – not a dual engine failure, which was actually the case. With the benefit of hindsight, concealing the fact that both engines were out may not have been wise. If the crew hadn’t done that, then ATC might have volunteered the vector to the nearest airfield without any prompting.
Although an airspeed of 300 knots was needed for a windmilling restart, the crew never achieved this speed. At 300 knots, N2 of 9-12 percent is necessary for relight. A minimum airspeed of 240 knots is needed for 4 percent of N2, which is enough for limited hydraulics and some core rotation. The crew failed to achieve this speed, also.
Attempts to start both the right and left engines were unsuccessful, in part because airspeed was insufficient. The airplane dropped below 21,000 feet, the minimum altitude for a windmilling restart.
The crew then attempted assisted restarts with the auxiliary power unit (APU) at 13,000 feet. The bleed air from the APU is used to drive a gearbox starter on the engine, which is intended to rotate the core sufficiently. In an assisted restart, the torque is about 10 times higher than in a windmilling restart. However, N2 remained at zero, and the engines refused to start.
At 10,000 feet, the crew changed back into their designated seats, informed ATC of the double engine failure, and requested a direct route to any airport. They were given Jefferson City, which was just outside the airplane’s best glide range due to changes in airspeed.
With the airport beacon in sight, the rest is history, as the saying goes. The airplane crashed short of the field.
NTSB member Deborah Hersman, who chaired the recent hearings, asked Pinnacle chief pilot, Terry Mefford, if he was aware of a so-called “4-1-0 club.”
“I heard some pilots like to go there, who had never been to 410 before,” he replied. “I hadn’t heard about it until this incident.”
Changes since the accident
Since the accident, there have been numerous changes at Pinnacle. For one thing, maximum altitude is restricted to 37,000 feet. “There is no advantage to operating above 37,000 feet, and we want to wait until all aspects of the investigation are completed,” said Mefford.
Capt. Thomas Palmer, manager of flight standards for Pinnacle, said the first officer and the captain are not permitted to switch seats, and this policy was reiterated on May 20.
The airline will also start downloading flight data recorder (FDR) information on repositioning flights. Prior to the accident, it was only doing this for Part 121 revenue flights. Repositioning flights are carried out under Part 91, which operate under more relaxed flight and duty time provisions (e.g., a pilot can fly to the limit under Part 121, then be assigned a repositioning flight under Part 91).
Mefford said also, “We’re looking at ways to improve CRM [crew resource management] training. They’re pending.”
Capt. Wake Gordon, chairman of the Air Line Pilots Association (ALPA) master executive council (MEC) at Pinnacle, said the airline committed shortly before the hearings to flight operations quality assurance (FOQA) and aviation safety action programs (ASAP). FOQA provides the data from each flight, and ASAP captures the flight crew’s recollections. In brief, the two programs tell “what” happened and “why” it happened.
“Any company this size needs these programs in place,” Gordon said. The pilot workforce has grown in recent years from about 300 to 1,000 pilots. As an example of the growth, Rhodes had been a captain for three months, and Cesarz had been employed by the company for three months.
Changes have also been incorporated into the flight manuals. On May 13, Bomdardier issued a temporary revision to the airplane flight manual (AFM), indicating the following under a double engine failure:
| Minimum airspeed | Establish |
| Airplane Flight Level | Minimum Airspeed |
| Above FL 340 | 0.7 Mach |
| Below FL 340 | 240 KIAS |
| Maintain airspeed until ready to restart engines. | |
CAUTION
Failure to maintain positive N2 may preclude a successfulrelight. If required, increase airspeed to maintain positive N2 indication. [This note is a veiled reference to the “core lock” problem mentioned below.]
If above 13,000 feet, relight using windmilling procedure.
If below 13,000 feet, relight using APU Bleed Air procedure.
To Relight Using Windmilling Procedure: NOTE
An altitude loss of approximately 5,000 feet can be expected when accelerating from 240 to 300 KIAS and may require pitch attitudes of 10 degrees nose down.
Attempt to start both engines at the same time.
Airspeed ………………. Accelerate to 300 KIAS or greater
CAUTION
300 KIAS or greater is required to achieve sufficient N2 for start.
Airspeed must be maintained until at least one engine relights stable idle) or start attempts abandoned.
In addition, on May 17 Pinnacle issued the following changes to its flight crew operating manual (FCOM):
“Climbing at speeds less than 250/.70 Mach may lead to reduced climb performance and most importantly may lead to an unsafe margin above stall.”
Lastly, Pinnacle has changed its simulator training. Since the accident, a dual engine flameout has been added to the simulator training, with the captain taking control. “It wasn’t regarded as high probability at altitude” before, explained Palmer. Prior to the accident, he explained, the crews trained for a single engine failure and total electrical loss, which looks the same on the cockpit instruments (and in fact in this case the first officer loses his instruments). Crews were given a powerpoint presentation on dual engine loss.
The core lock problem
Considerable time was spent at the hearings dealing with the fact that the engine cores on the accident aircraft spun down to zero percent (N2 = 0). This phenomena is known as “core lock,” and it prevents restarting of the engines. With core lock, the secondary and tertiary airflows that cool the interior of blades and disks is interrupted; the fire in the engine then impinges upon surfaces, dissimilar coefficients of expansion come into play, and there are frictional losses as rotating components lose their fine tolerances and start rubbing on the rubbing strips. A reasonable analogy for normal combustion versus core lock is to compare a Bunsen burner with a puddle of fuel that’s alight. The Bunsen has a shaped flame and the other is shapeless.
“The core has to be turning for ignition,” said Greg Browning, a Bombardier propulsion systems expert. The problem of core lock was discovered in 1986 (other experts say 1985) during Challenger business jet testing, he said. “The core wouldn’t rotate by the time we got to the relight envelope.” The regional jet involved in the accident was a variant of the Challenger.
This discovery in the mid-1980s led to discussions with engine manufacturer General Electric [GE], which changed clearances and other aspects of the design to alleviate the problem. Contact between the shafts and seals is the cause of core lock. In addition, Bombardier initiated flight testing of all engines installed on its aircraft, in which core lock is eliminated through a break-in procedure referred to as a seal “grind in.” The engines are forced to zero percent core speed, and the aircraft is then accelerated to confirm that the engines will not lock up and can be restarted via the windmilling procedure. Should a tight engine be discovered, a break-in procedure is executed, which wears the seals at the more aft axial location encountered during windmilling in flight.
How long can core lock persist? Limited data is available, said Ed Orear of GE engines, but about eight minutes elapses in the Bombardier qualification tests “before relight is initiated.”
From an initial figure of 80 percent, about 1.5 percent of engines now fail this break in procedure and have to be shipped back to the manufacturer, according to Bombardier officials. NTSB member Hersman questioned this value, referring to a sample of 660 engines where 4 percent failed.
Spare engines do not undergo this “grind in” procedure. Of interest, the right engine on the accident aircraft was one of these engines and had not undergone the qualification flight test. It did not restart during the accident sequence. However, the left engine, which had undergone the flight test as part of acceptance testing, failed to start also (probably because the speed was insufficient).
Core lock is not considered a safety of flight issue, according to Bombardier officials, and it was not considered as part of engine certification.
An APU-assisted start is considered a backup means of relighting the engines. While an APU-assisted restart can be attempted at 13,000 feet, the airplane can be dispatched with an inoperative APU under the Minimum Equipment List (MEL) concept.
“How can the APU be on the MEL?” asked the NTSB’s Tom Haueter.
Peter White, from the FAA’s engine directorate, explained that the APU is a “back up to the windmill start.”
However, below 5,000 feet, a windmill start is not possible, in part because of the altitude loss associated with it.
Which prompted Hersman to point to Advisory Circular (AC) 25.903(e) dealing with engine restarting capability for transport category airplanes. The AC lists six categories of all-engine power loss that have occurred:
- Weather (Low altitude to FL410)
- Volcanic Ash (FL370, FL330, FL250, low altitude possible)
- Crew Error (FL030 to FL410)
- Compressor Surge (Takeoff to cruise altitude)
- Maintenance Error (Takeoff to cruise altitude)
- Other/Unknown (Takeoff to cruise altitude)
“These can all occur at low altitude, where you need the APU [to start the engines], but it’s not required,” she said.
Since APUs fail more frequently than engines, requiring operational APUs for every flight would mark a major departure from the existing MEL proviso.
The NTSB will probably have a few things to say about MEL and, more particularly, about engine certification as the investigation concludes in coming months. In May 2000, well before the accident, the FAA prepared an issue paper to guide U.S. certification of the -700 model of the accident aircraft. This is a stretched variant of the CL-600-200, and the experience with that airplane’s engines shaped the guidance for the -700 certification. The issue paper says, “At this time, the inflight engine restart characteristics of the Model CL-600-2C10 have been identified for further review and evaluation as a potential unsafe condition.” The Model CL-600-2C10 is a reference to the -700 model.
Turbine Engines and Core Lock
When the airflow into a turbine engine is disrupted, it can cause the compressor airfoils to stall (just like a wing), which can then result in the “stalling” of the engine. Due to the forward speed of the aircraft, the rotors will generally continue to spin, albeit at a slower rate than if the engine is operating. This condition is known as “windmilling.” However, in a multi-spool engine, if there is insufficient airspeed and consequently insufficient airflow through the engine, the inner spool (core) may cease to rotate. In a worst-case situation, differential cooling can cause differential contraction that results in the core binding to the point that it cannot rotate until the component temperatures reach some equilibrium value. This phenomenon is known as “core lock” because the core is locked or seized. The engine cannot be restarted until the core is free to rotate again.
Source: ALPA
‘Neither Engine’s Started Right Now’
(Extracts of cockpit voice recording from Pinnacle Air Flight 3701)
9:48:44 (F.O) Man, we can do it. Forty one it.
9:48:59 (Capt.) I know, dude.
9:51:51 (F.O.) There’s four one, oh my man.
9:51:53 (Capt.) Made it man.
9:52:22 (Capt.) Want anything to drink?
9:52:29 (F.O.) A Pepsi if you don’t mind.
9:52:30 (Capt.) A Pepsi? I thought you said a beer, man. [With the captain briefly out of the cabin, the first officer should have donned his oxygen mask]
9:52:35 (F.O.) Is that a seal on the liquor cabinet? [Sound of laughing]
9:53:28 (F.O.) It ain’t speeding up worth (expletive).
9:53:29 (Capt.) Look how high we are. [Sound of laughing]
9:53:42 (ATC) Flagship thirty seven zero one, are you an RJ two hundred?
9:53:47 (Capt. to ATC) Thirty seven zero one, that’s affirmative.
9:53:50 (ATC) I’ve never seen you guys up at forty one there.
9:53:51 (Capt. to ATC) We don’t have any passengers on board so we decided to have a little fun and come on up here.
9:54:10 (Capt.) This thing ain’t gonna (expletive) hold altitude, is it?
9:54:16 (F.O.) It can’t man. We (expletive) (cruised/greased) up here but it won’t stay.
9:54:22 (F.O.) Dude it’s (expletive) losing it. [Sound of laughter]
9:54:38 [Sound of stick shaker]
9:55:06 [Unclear who’s speaking] Declaring emergency. Stand by.
9:55:23 [Unclear who’s speaking on radio] We don’t have any engines.
9:55:28 [Sound of increased background noise, similar to air driven generator operation]
9:56:12 (F.O.) We’ve got a little bit of engine (windmill) in one of them.
9:54:14 (Capt.) (Really)? Okay we gotta go to emergency [unclear].
9:56:19 (Capt.) Okay. Ahh flashlights. (Expletive) (Dude).
9:56:24 (F.O.) Flashlight’s in my bag.
9:56:33 (Capt.) Double engine failure. You holding altitude?
9:56:39 (F.O.) Ahh, no I’m not.
9:56:42 (Capt.) Okay. Continuous ignition on.
9:57:18 (Capt.) A-D-G [air driven generator] below thirty thousand feet. Okay, descend below thirty thousand feet.
9:57:26 [Sound similar to page turning]
9:58:09 (F.O.) That was a dutch roll I believe.
9:58:12 (Capt.) It was pulling and pushing.
9:58:15 (F.O.) We were descending at two thousand feet per minute.
9:58:37 (F.O.) Go on oxygen?
9:58:39 (Capt.) You know what. Yeah we need to go on oxygen. [The environment would have been instantly alien, talking like Darth Vader through the oxygen mask mike, fumbling for checklists, and doing so with flashlights]
9:59:51 (Capt. radios to ATC) Yeah we’re still descending. We’re gonna need to descend down, ah, probably lower. Probably gonna descend down to right now to about thirteen thousand feet. Is that okay? [13,000 feet is the altitude at which they can try an assisted restart with the APU; they probably should have been thinking by this time of forced landing profiles and asking for vectors to the nearest available airport]
9:58:58 (ATC) Flagship thirty seven oh one, affirmative, descend and maintain one three thousand …
10:00:33 [Sound similar to page turning]
10:01:39 (Capt.) Airspeed not less than three hundred knots. You wanna push it up there three hundred knots. Altitude loss approximately can be expected from two hundred forty to three hundred knots … N two is at least twelve percent … [Apparently reading from manual; for a windmilling start they need to be at 300 knots]
10:01:51 (Capt.) No we’re not getting any N two at all … thirteen thousand feet we gotta go down here, dude. We’re going to use the APU bleed air procedures.
10:03:15 (Capt. to ATC) Ah, we had an engine failure up there at altitude …. Airplane, ah, went into a stall and one of our engines failure … so we’re gonna descend now to start our other engine.
10:03:25 (ATC) Okay that’s kinda what we were figuring here and, ah, understand you’re controlled flight and, ah, you’re gonna be able to return to normal when you get to lower altitude.
10:03:30 (Capt. to ATC) Ah, right now we’re not, we’re – stand by for that. We’re descending down to thirteen thousand to start this other engine. We’ll tell you.
10:04:26 (Capt.) Okay, it’s gonna be from thirteen thousand feet and below target airspeed established it’s a hundred seventy knots … left or right engine start. Let’s start number two first. [The right engine was a replacement engine; as such, it had not been part of Bombardier’s acceptance testing of engines for core lock]
10:05:33 (Capt.) As soon as we get a thousand, you want a hundred and seventy knots like we, that’s all we need. So we can pull it up a little bit and slow the rate of descent okay? You with me on this? You clear? All right, we’re gonna get this going. Don’t worry, bro. All right? You okay? Seriously? All right.
10:07:02 (Capt.) Okay, thirteen thousand feet. It says … right left tenth stage closed. They’re closed (APU isolation) valve’s open. It’s open. Dude, let’s check … ready to start. Here goes number one.
10:07:34 (Capt.) (Expletive)
10:09:02 (Capt.) Tell her we need to get direct to airport, neither engine’s started right now.
10:09:06 (F.O. on radio to ATC) Thirty seven zero one, we need direct to any airport. We have a double engine failure.
10:09:21 (ATC) Flagship thirty seven zero one, cleared direct for JEF.
10:10:05 (Capt.) This (expletive). Where do we have to go?
10:10:06 (F.O.) JEF … right in front of you, fifteen miles.
10:11:15 (Capt.) (We’re in the middle of the) (expletive) dark here.
10:12:05 (F.O.) Why isn’t the (expletive) engine going anywhere?
10:12:07 (Capt.) I dunno. We not getting any N two.
10:14:38 (Capt.) Is there a road? Tell her we’re not gonna make this runway.
10:14:51 (F.O.) (Expletive) road right there.
10:15:03 (Capt.) Aw (expletive). We’re gonna hit houses dude.
10:15:05 Whoop whoop, pull up.
10:15:06 Sound of impact.
Source: NTSB