On October 15th, 2022, N84LT departed from Winston Field Airport (KSNK) in Snyder, Texas, for an hour-and-a-half flight to Dallas Executive Airport (KRBD). On board the twin-engine Diamond DA62 was the owner/pilot, Gary, and his wife. As Gary ran the engines up before departure, everything seemed normal. The runup procedure for the DA62 is highly automated. Press a button, observe “L/R ECU A/B fail” on the Garmin G1000, wait as the propellers cycle, and verify that the failure messages disappear. The Electrical Engine Control Units (ECU) are the principal components being tested. Long gone are the days of throttles being mechanically attached to carburetors. Instead, the two JET A reciprocating engines on the DA62 are controlled by computers (an increasingly common feature in aviation). Per the POH, “The ECU monitors, controls and regulates all important parameters for engine operation.” The ECUs are redundant, one for each engine, with two channels per unit. As is typical with ECU (or FADEC) equipped aircraft, a total failure of the computers will cause the respective engine to shut down.
Under normal conditions, two engine-driven alternators provide electrical power to the various aircraft components. A main battery provides a backup source in the event neither alternator is available. In addition, the ECUs are supplied with four extra backup batteries (two for each engine), which can provide at least 30 minutes of power if all other electrical sources fail. These 12-volt backup batteries are wired in series to match the 24-volt requirement of the ECUs. Aircraft mechanics must be careful when connecting the cables. If they inadvertently wire the backup system in parallel instead of in series, the fuses between the batteries and the ECUs will blow.
The flight to Dallas Executive Airport was uneventful. On final approach, 1,300 feet above the field, Gary selected the gear down concurrent with a transmission to the air traffic control tower. There was an audible pop. The G1000 screens went blank. A sudden deceleration occurred, which Gary attributed to drag on the gear. He quickly checked the breakers and switches. Nothing out of place. Not realizing the full scope of his situation, he was initially focused on whether he had received a clearance to land. He attempted to declare an emergency (which was inaudible in his headset). Somewhere amid this, Gary realized he had lost power to both engines. As the 902-hour commercial pilot kept the nose down to maintain airspeed, the threshold to runway 13 slid upwards in a telltale that 1,300 feet of elevation would not be enough for the five-mile glide. Dallas Executive is centrally nestled in the massive Dallas-Fort Worth metroplex. Dense commercial plots give way to dense residential neighborhoods. Real estate is priced by the square foot. Gary turned to his wife and uttered the only reasonable thing under the circumstance: “We’re about to die. Call someone.” He meant 911.
Running at a 45-degree angle to runway 13 was Keist Blvd. It was draped
in afternoon traffic and power lines. Gary would later refer to Keist as his “third-best choice.” The airport was his first choice. The “second-best choice” was never specified (whatever it was, it was not a congested city street). In a moment of luck, a gap in the traffic materialized. Just before touching down, N84LT clipped a power line. Despite this, the twin Diamond completed the landing. As it rolled out, the right-hand wing struck two road signs, resulting in substantial damage. The aircraft was totaled, but both occupants were unhurt. In the cleanest definition of aviation, it was a good landing.
Dual Engine Failure
The NTSB knew early on what had caused the simultaneous loss of both engines. A preliminary inspection revealed that the ECU backup batteries had been improperly connected and that the in-line fuses for both had blown as a result. Logbook entries detailed that all four backup batteries had been replaced during the annual four months prior to the accident. Per the NTSB: “It is likely that during this maintenance, the batteries were incorrectly rewired in parallel.” Still, the backup batteries are the third source of power for the ECUs. Primary power is provided by the alternators. The main battery provides secondary power. The NTSB attempted unsuccessfully to recreate the failure of the normal electrical system (powered by the alternators) on the ground. The only discrepancy they found was that the alternators had also been wired incorrectly. Per the NTSB: “the alternator relays were wired such that the alternator would not disconnect the alternator power from the main electrical system. The relays would cut power to the glow plugs for the respective engines [instead].” The pump pressure switch associated with the landing gear hydraulic pack was also found damaged. The NTSB summed up the dilemma with this: “While multiple anomalies with the wiring and battery system were documented, a definitive root cause of the initial power failure could not be determined.”
The failure of the main battery was a different matter. A few months before the accident, a reconditioned battery had been installed in the aircraft. Following the crash, the capacitance of this battery was tested at 81.2%. Concorde (the battery manufacturer) specified that a capacity test below 85% represented a failure. The battery had tested at 90.9% 15 months before the accident by Concorde, apparently the last test result on the unit prior to the fateful flight (the battery is normally capacity checked during each annual). In the final report, the NTSB referred to the main battery as “worn,” listing it as one of the probable causes of the crash.
Though the cause of the initial electrical failure could not be duplicated, the inciting cause was not hard to decipher. The landing gear system on the DA62 utilizes a dedicated hydraulic pump to raise and lower the gear. The hydraulic system produces a high electrical load (the NTSB measured a peak of 200 amps). The electrical interruption apparently occurred immediately after the pump had been activated, but the reason the system failed during gear extension (following an hour-and-a-half battery charge during flight) as opposed to gear retraction is uncertain. The Austo Engine ECUs, for their part, contained non-volatile memory that stored operational data. For an undetermined reason, the left ECU only recorded a short portion of the flight, but the right ECU was complete. At 1447:41 (the accident occurred at 1448), the unit depicted a sudden drop to 11.7 volts (consistent with a transfer to the incorrectly wired, 12-volt backup batteries), after which the recording stopped.
In the final report, the NTSB noted a peculiar aspect of the backup battery system for the DA62. Per the NTSB: “A review of the aircraft maintenance manual showed it did not provide a procedure to verify the ECU backup batteries were functioning correctly after replacement. The last step in the ECU backup battery installation was to run engines and verify that the electrical system operated correctly. However, this step does not verify that the ECU backup batteries were installed correctly and were ready to provide power to the ECUs. In addition, there was no ECU backup battery [preflight] operational test.” Following the accident (per the NTSB): “Diamond Aircraft issued a service information letter requiring inspection of ECU backup batteries wiring installation on all DA 62 aircraft.”
The pilot makes the difference
Most accidents are the result of a combination of unlikely events occurring simultaneously. Pilot error is, unfortunately, far too often a major contributor to the accident chain. Break one link (as the saying goes), and the accident is averted. Or, as in this case, the occupants survive. NTSB reports are centrally concerned with the causes of crashes, not the links that are broken. There is no reporting requirement for a safe landing. The only acknowledgment that a pilot did their job is when the pilot is not listed as a probable cause. The NTSB is not in the business of congratulating pilots for doing their job. Yet the accident record is full of fatal, low-altitude spins following a loss of engine power. Gary broke a link in the accident chain. It did not save his airplane, but that was already a lost cause. Lousy options are not a guarantee of fatalities. A little bit of luck combined with a great deal of airspeed discipline was enough for both occupants to walk away. This is, as the accident record indicates, easier said than done. Gary had to compress all five stages of grief into a twenty-second response. Yes, both engines had failed. No, the airport was not an option. Keist was a rotten choice. Maybe a better option was out there, but there was not enough time to suss it out. An imperfect plan that is executed is better than no plan at all.
The difficulties in implementing this are, unfortunately, easy to articulate. On the fourth anniversary of 9/11, a Cessna 152 experienced a partial engine failure over Long Beach, California. This one is personal. I had declared an emergency in that aircraft a couple of months prior for the exact same cause. I had been at 6,000 feet above the coast on my way to Monterey for some clam chowder and was able to drift down to Camarillo after power was restored following a flurry of emergency procedures. The flight school owner was convinced it was carburetor ice and pressured me to return the aircraft to Long Beach. But the left magneto was weak, so I abandoned the Cessna a hundred miles north and never flew one of his aircraft again. On the fatal flight, the instructor and student pilot perished after the aircraft spun into a parking lot following a partial loss of engine power. They attempted to return to the airfield but did not have enough altitude for the glide. The NTSB found the ignition switch in the proper position. They also discovered the engine was a mess of bad spark plugs and broken piston rings. It was also nearly three hundred hours past TBO. I have no idea why the flight school owner was not alarmed by a weak magneto and partial power loss on a worn engine two months prior when I had declared my emergency. The net result was an overwhelmed 25-year-old flight instructor with 800 hours at low altitude over a congested city just past the boundary of Long Beach Airport.
This quandary does not get easier in turbine aircraft, where pilot experience is often higher, but so is aircraft complexity. The recent crash of Jeju Air flight 2216 in South Korea occurred after a gear-up, flaps-up landing on runway 19 at Muan International Airport. Bird remains were discovered in both engines, and the crew had communicated with air traffic control that they had experienced a bird strike. Initial information suggests that the crew simultaneously experienced a significant loss of engine thrust and a total loss of normal electrical power. The combination was enough to send the skidding aircraft down 5,000 feet of runway in a blaze of sparks, even though backup electrical power may well have been available via the auxiliary power unit and backup gear extension through gravity override. They exited the runway at approximately 150 knots, striking a concrete structure associated with the runway localizer and bursting into flames, killing all but two of the 181 occupants. This occurred after the crew elected to execute a missed approach following the bird strike (likely with the aircraft already configured for landing). The situation was highly compressed and likely overwhelming. It was an unfair time to demand cool thinking, and any blame must be handicapped by the extraordinary circumstances. Every pilot eventually has a scary moment, but not every scary moment is equal. If you can buy time, then slow things down and think it over. If not, commit to the best available solution and execute it. Whatever you do, do not get stuck in neutral, a passenger on an aircraft instead of a pilot-in-command. Diagnose, accept, and execute. Fate will figure out the rest.
