The private pilot of a Cessna 421 departed about 90 minutes after sunset on the cross-country flight. The climb and level-off at cruise altitude were uneventful and, based on the radar data, appeared to have been accomplished with the use of the autopilot. The cruise altitude of 27,000 feet was the highest the airplane had been flown in recent history, and the highest altitude it had been operated at with the pilot flying.
The pilot made a routine radio exchange with air traffic control personnel shortly after leveling for cruise. Five minutes later, the airplane, with no further radio transmissions, rolled to the right and rapidly descended 10,000 feet, where it subsequently broke apart. Analysis of fractured surfaces, the debris field distribution and radar data revealed that the breakup sequence was most likely inadvertently induced by the pilot as he attempted to recover control of the airplane during the dive.
Examination of the engine components, surviving primary airframe components, the cabin heater, and the autopilot system remnants did not reveal any mechanical malfunctions or failures that would have precluded normal operation. There was no evidence of bird strike, inflight fire, or that the engine fire extinguisher system had been activated.
The airplane was flying toward an uninhabited mountain range and a largely unpopulated desert area at the time of the upset. The moon had set, and the pilot would have had limited reliable external visual cues should the airplane have experienced a failure of either the flight instruments or autopilot. The pilot was instrument rated, however the majority of his flight experience was garnered in aircraft equipped with modern “glass cockpit” avionics, as opposed to the traditional flight instruments installed in the accident airplane (which he had recently purchased).
The airplane was equipped with a dual vacuum pump system that drove the primary flight instruments and, in turn, the autopilot. One of the vacuum pumps had failed on the previous flight, and the pilot was unable to get it repaired in time for the accident flight. The dual nature of the vacuum system allowed for flight with a single failed pump. However, failure of the remaining pump or associated vacuum system components would have left the pilot to hand-fly the airplane, using backup flight instruments, at an altitude perilously close to the limit of the airplane’s flight envelope. Examination revealed that the second pump was most likely operational; however, fire damage precluded an accurate assessment of the remaining vacuum system components. Although operation of the airplane did not require adherence to a minimum equipment list, the airplane’s FAA Master Minimum Equipment List stated that one of the vacuum pumps can be inoperative, provided the airplane is operated under VFR and not operated at night.
The airplane had experienced multiple anomalies with the autopilot and vacuum system prior to the accident flight. Maintenance records indicated that these discrepancies had been resolved; however, damage to the airplane precluded a substantive confirmation of their operation. Additionally, an oversight by an avionics repair facility one week before the accident resulted in the airplane’s pitot/static system being inadvertently tested and certified to 20,000 feet, rather than the airplane’s service ceiling of 30,200 feet. The relevance of this finding, if any, could not be determined.
The airplane was equipped with a supplemental oxygen system; however, maintenance records indicated that the pilot’s mask, while operational, had degraded. Additionally, the mask had been relocated to a position behind the pilot’s seat, which would have been hard to reach in the event of a rapid decompression. Ultimately, the NTSB was unable to determine the cause of the rapid descent because of the postcrash damage to the airplane systems and components.
The National Transportation Safety Board determines the probable cause(s) of this accident to be: The pilot’s failure to regain airplane control following a sudden rapid descent during cruise, which resulted in an in-flight breakup. Contributing to the accident was the pilot’s decision to make the flight with a failed vacuum pump, particularly at high altitude in night conditions.
Two died in the crash of this pressurized piston twin. Although there is no definitive determination, the NTSB clearly considers failure of the Cessna’s remaining vacuum pump, and the “glass cockpit” pilot’s lack of recent experience in legacy-panel instrument flight, possibly in a partial panel condition, to be a likely scenario. The NTSB report includes an unusually frank statement: “Given the pilot’s overwhelming experience with ‘glass cockpit’ instruments, as opposed to the traditional type in the accident airplane, along with the failure of one of the vacuum pumps, he should have reconsidered making the flight, particularly during night conditions.”
Most reviews of crashes of this sort would focus on the skills needed to fly partial panel, the uniquely different scan techniques for glass cockpit versus traditionally-instrumented cockpits, and–as has rightfully received so very much attention in the last couple of years–the topic of Loss of Control – Inflight (LOC-I). In this and many other crashes involving deaths in piston twin airplanes, however, there is a deeper issue we must consider: pilots’ failure to uphold their responsibility to their passengers, their families, the employees and co-workers who depend upon them, and the persons on the ground under the flight path of the airplane. The deeper issue in a great many fatal general aviation accidents is that of pilot professionalism, to live up to the responsibility we freely accept as pilot-in-command.
It’s fashionable to think of Federal Aviation Regulations as putting limitations on our freedom to fly. The reality, however, is that the FARs put amazingly few restrictions on the pilot-in-command, except when he or she takes a passenger along. Take, for instance, the requirements for pilot currency. FAR 61 tells us the pilot-in-command must receive a Flight Review or equivalent every two years. You can take your Flight Review today, not get near an airplane for one year, 11 months and 29 days, and jump into a piston twin and fly as pilot-in-command–probably not a good idea, but it’s perfectly legal. Sure, you must log a small number of procedures by reference to instruments if you wish to fly on an instrument flight plan. But you don’t need anything more than an hour of ground instruction and an hour of flight instruction every two years.
To carry passengers, the rules are far more strict. You must log at least three takeoffs and landings as pilot-in-command within the previous 90 days. In some cases, these landings must be full-stop, and at night for carrying passengers at night. The limitations on what we can do as PIC are in place primarily to protect the public, not the pilot. The FARs are all about upholding the public trust.
Meanwhile, passengers have an expectation that the pilot meets this standard. As far as they know, the pilot is just as disciplined and well-trained as the pilot of a TransPacific Boeing. It’s up to us to live up to that expectation.
One of the significant factors that make corporate and airline flying so incredibly safe is crew adherence to OpSpecs, or operating specifications. OpSpecs make many of the decisions for a flight crew, so when they are faced with fatigue, stress or temptation–times when decision-making is compromised–critical decisions are already made. For example, if a flight department’s OpSpec is that the airplane must have at least one hour of fuel remaining on board when it lands, the crew won’t take off with less fuel than needed to meet this requirement, and will monitor fuel status and ground speed en route, landing early if less than one hour’s worth of fuel will remain at the estimated time of arrival.
At a bare minimum, your per-sonal OpSpec should include a requirement to meet all airworthiness requirements for the airplane. It should also restrict you from flying in instrument meteorological conditions or at night with any known discrepancies with the instruments and navigation systems. Your personal OpSpec should require higher minimums and daytime-only operation when you move from glass cockpit to traditionally-instrumented airplanes, or between different models of Technologically Advanced avionics.
I’ve spoken to many pilots who have survived crashes or near-accidents. Most report they knew they were doing something wrong before the event unfolded. I suspect the pilot of the C421 felt he shouldn’t be flying night IFR in an airplane with a failed vacuum pump and an instrument layout he had not flown in a long time. I suspect also the passenger who rode with the pilot to his death thought the pilot would never put him in that sort of position. Yet the flight went anyway. Even though the Federal regulations don’t require it, your responsibility to your passen-gers – the public trust – demands a strict adherence to limitations, and conservative decisions made based not only on the airplane and environment, but also your recent experience with the type of airplane
and its specific equipment.•T&T