At 1100 universal coordinated time (UTC) on December 31, 2013, a Cessna 525A Citation CJ2+ was flying from Leeds Bradford Airport in the UK to Palma de Majorca in Spain. Seated in the cabin was one female passenger and three dogs. The occupants were no doubt looking forward to spending New Year’s Eve in the somewhat warmer climate of their Mediterranean island destination.
Nearing its cruising altitude of 43,000 feet (FL430), the aircraft suddenly stalled and departed controlled flight in a series of five rapid 360-degree rolls to the right. The pilot briefly regained control before the aircraft stalled a second time. The aircraft’s wings were structurally damaged as excessive g-force was applied during the recovery from this second stall.
The aircraft was being flown by its owner as a single pilot. He had a Private Pilot licence with 3900 hours, of which 600 hours were on type. He had flown 16 hours in the last 90 days and five hours in the last 28 days. The passenger sat in the middle of the cabin on the right side. She was (fortunately) secured by a three-point harness. The three small dogs were also in the cabin.
Smaller business jets such as the Citation CJ2+ are certificated under FAR Part 23 airworthiness requirements in the Normal Category. These requirements specify a maximum positive load factor (limit load) of +3.6g with flaps retracted. The limit load is the load level that the aircraft’s structure must be capable of sustaining without permanent deformation or damage to the structure. In addition, FAR Part 23 also prescribes a safety factor of 1.5. Taking the limit load value of +3.6g and multiplying it by the safety factor, we get an “ultimate” positive load factor of +5.4g. When the structure is subjected to a load between limit load (+3.6g) and ultimate load (+5.4g), it must be able to withstand that load, but the structure may suffer permanent deformation.
The CJ2+ is equipped with one angle of attack (AOA) sensing system. This consists of a rotatable vane on the side of the fuselage to measure airflow and suitable avionics which convert the sensed position of the vane into “normalised” AOA data. Normalised angle of attack is the ratio of actual angle of attack to stalling angle, a stall being indicated by a value of 1.
For stall warning, the aircraft is equipped with a stick shaker which should trigger at a normalised AOA value of 0.87 to 0.88. This gives warning of an approaching stall at least 5 knots before it occurs. In addition, the aircraft is equipped with stall strips on the inboard leading edge of each wing, which create turbulent airflow at high AOA. The resulting aerodynamic buffet also warns the pilot of approaching stall conditions.
The aircraft was not fitted with a flight data recorder or a cockpit voice recorder and this was not required by the certification regulations. Like many modern aircraft, the Citation is fitted with an electronic Aircraft Recording System (AReS). This is primarily a maintenance tool, however it does record data that can be useful to an accident investigation.
On the day of the flight, the owner/pilot conducted a pre-flight inspection and noted no defects. The forecast weather was occasional stratus cloud at 600 ft above ground level (AGL) with tops at 1000 ft AGL. The freezing level was 4300 ft. There was broken cumulus and stratocumulus between 2000 ft and 8000 ft, with altocumulus and altostratus forecast above these heights. Between FL290 and FL350, cirrus cloud was forecast as likely. The temperature was -57 deg C at FL400, rising slightly to -55 deg C at FL430.
The passenger and her dogs boarded and the flight departed. Takeoff and initial climb proceeded without incident. The climb was conducted with the autopilot on. Maximum continuous thrust (MCT) was set for the duration of the climb. The vertical autopilot mode used was Vertical Speed (VS) mode. Initially a VS of 2000 ft/min was selected. As the aircraft climbed, the pilot gradually reduced the commanded VS as the available engine thrust reduced in the thinner air at altitude.
1053:45 UTC – The aircraft is passing FL356 with speed at 180 knots indicated airspeed (KIAS). Commanded VS is 1400 ft/min.
1056:41 – The aircraft is passing FL395 with speed at 158 KIAS and commanded VS has been reduced to 1000 ft/min. Passing FL410, the aircraft is climbing at the commanded rate 1000 ft/min, but the speed has now dropped to 150 KIAS and continues to reduce to 140 KIAS one minute later. The pilot notices that the IAS is now below the green “donut” index on the speed tape which depicts 1.3X stall speed (1.3Vs).
Realising that the aircraft is now too slow, the pilot reduces the demanded VS from 1000 ft/min to 500 ft/min. He is familiar with this aircraft and believes that this reduction in commanded VS should be sufficient to trade climb energy for acceleration and allow the aircraft to accelerate to a more appropriate climb speed. The data recording shows that this VS reduction to 500 ft/min occurred at 1059:17. The speed at the time was 128 KIAS. However, over the next 50 seconds, the speed gradually reduces to 116 KIAS. Pitch attitude slowly increases to 11.5 degrees nose up in order to produce the demanded 500 ft/min vertical speed.
1100:08 – Climbing between FL420 and FL430 the pilot goes “head down” and looks inside at his tablet on the right seat. He wants to compare the indicated upper wind readout displayed on his primary flight display (PFD) with the forecast wind chart of his preflight briefing. He hears a click and looks up to find the aircraft rolling right to 57-degree bank with the nose pitching down to 9.5 degrees. The click is the autopilot disengaging.
The roll attitude reverses rapidly to 66 degrees left and then, in the space of the next 23 seconds, the aircraft completes five complete rolls to the right at an increasing rate. The roll rate recorded on the last roll is 181 degrees per second. The rolls are accompanied by pitch oscillations with nose-down values reaching -68 degrees.
1100:34 – Engine power is reduced to idle. The nose rises from -68 degrees to -3.6 degrees in a +3.25g pull-out. The airspeed reduces rapidly to zero in this pull-out and the aircraft departs controlled flight again, with a further complete roll to the right. The nose pitches down into the vertical at -89.7 degrees. Pointed straight down, the airspeed rises rapidly.
1100:58 – In the recovery from the vertical pitch down, the pull-out registers +4.48g with the trajectory bottoming out at FL270. There is an overspeed, with the aircraft reaching 297 KIAS or Mach 0.77. The average rate of descent has been about 20,000 ft/min.
1101:13 – The aircraft then continues to pitch nose-up to +70 degrees, with speed reducing to 44 KIAS at the top of the trajectory, then rolling 115 degrees to the right in a fully stalled condition.
1101:28 – The aircraft now pitches 40 degrees nose-down and bank angle reaches 80 degrees left. The aircraft descends out of cloud. With a visible external horizon to aid recovery, the pilot regains control at around FL280.
1101:43 – The nose is roughly level. The pilot believes he has engaged the autopilot and releases the controls. The aircraft immediately adopts a nose-up attitude and climbs 2000 feet.
1101:58 – The pitch attitude reaches 40 degrees nose-up with speed reducing to 93 KIAS before control is finally regained. At around this time, the pilot realises that the autopilot did not engage and that the pitch trim is fully nose-up.
1103:10 – The airspeed increases through 200 KIAS. Pitch, roll and heading begin to stabilize over the next 90 seconds. The aircraft is trimmed and the autopilot is re-engaged.
The pilot confirms that his passenger (and three small dogs) are not injured, but notes damage to the upper surface of the left wing. His passenger reports similar damage to the right. Weighing all factors, he decides to return to his departure airfield, Leeds Bradford, which is some 25 to 30 minutes behind him. He notes that the aircraft handling appears to be unchanged despite the damage that it has sustained.
Inspection after the accident flight revealed that the aircraft wings were damaged in positive overload. Five ribs in the outboard wingbox were damaged by buckling and the bonded joints between the ribs and the upper and lower wing skins failed. The upper and lower wing skins were permanently deformed with significant loss of aerofoil shape. The Cessna wings contain integral fuel tanks; fortunately, this part of the structure maintained its integrity and there were no fuel leaks, with the wing skins remaining attached to the front and rear wing spars. There was also wing skin buckling above the main wheel wells close to the fuselage. The damage was consistent with symmetrical pull-out loads between +3.6g (limit load) and +5.4g (ultimate load). Both ailerons showed evidence of skin wrinkling along the trailing edge of the upper and lower surfaces.
This accident presents us with many learning opportunities. In the interest of brevity, we will limit our discussion to the following.
Upset Prevention and Recovery Training programs commonly emphasize the following:
- Upset prevention (timely action to avoid progression toward a potential upset)
- Recognition (timely action to recognise divergence from the intended flight path and interruption from the progression toward a potential upset)
- Recovery (timely action to recover from an upset in accordance with manufacturer procedures).
Prevention incorporates such topics as crew discipline, situational awareness, monitoring, aircraft/system knowledge, and adherence to standard operating procedures (SOPs).
Aircraft climb speeds are established during certification. Generally, best rate of climb is achieved at an indicated airspeed where excess power is greatest. This speed will decrease with altitude. It also follows that flying at a speed faster or slower than the specified climb speed will result in degraded climb performance. The optimum climb speed should be known and flown accurately.
Climb profile information is available to Citation CJ2+ pilots in a number of documents. The CJ2+ Pilot Training Manual specifies the following: “Climb at 230 KIAS until reaching 0.55 indicated Mach at approximately 30,000 feet.”
The CJ2+ Operating Manual, Flight Planning and Performance section, provides greater detail in a number of Cruise Climb Table pages which cater to various conditions. Each Cruise Climb Table page specifies the basic profile: “CRUISE CLIMB 230 KIAS/0.55 INDICATED MACH.” This is followed by four tables providing data for:
- Time, distance, fuel and rate of climb
- Wind effect on climb distance
- Step climb
- Cruise climb speed
One of the four tables, Cruise Climb Speed, is reproduced in below.
This table provides more detailed indicated speed information versus pressure altitude. The data agrees with the basic 230 KIAS/M0.55 profile. There is a small area of the envelope between 25,000 feet and 30,000 feet where the pilot may have to climb at a slightly reducing IAS until achieving M0.55 at about 30,000 feet, should it be necessary to extract optimum climb performance from the aircraft. Above 30,000 feet, the KIAS values specified correspond to a constant M0.55.
Like many business jet types, the CJ2+ has a number of auto-flight system vertical modes that can be used to guide the aircraft in climb or descent either with the autopilot engaged, or via flight director guidance to the pilot in manual flight. These modes are typically Pitch, Flight Level Change (FLC), Vertical Navigation (VNAV), and Vertical Speed (VS). The FLC and VS modes are pertinent to this accident.
How do these modes work? Assume our aircraft needs to climb from FL200 to FL430 and that the pilot has set Maximum Continuous Thrust (MCT). The current speed target is 230 KIAS.
If FLC is engaged, the autopilot elevator channel will simply command a pitch attitude (within certain limits) that will maintain 230 KIAS. About the time the aircraft passes 30,000 ft., the avionics will change the speed reference from KIAS to a corresponding Mach number. As the aircraft continues to climb, the autopilot elevator channel will maintain a constant M0.55 which, as it turns out, mirrors the constantly reducing IAS in the Cruise Climb Table above. By design, the system is climbing at very close to optimum rate of climb. As the thrust produced by the engines decreases with increasing altitude, the autopilot will counter the resulting tendency for the speed to decay by lowering the nose to maintain the target speed of M0.55 throughout the climb. Conversely, should there be a momentary speed increase (due to turbulence, for example), the autopilot will raise the nose slightly until the speed is stabilized once more at M0.55. FLC mode is therefore inherently safe as it protects the aircraft speed.
Under certain circumstances such as turbulence, rapidly changing upper winds, or rapidly changing upper air temperature, FLC mode can result in pitch variations—which some may find uncomfortable. As an alternative in these circumstances, the aircraft can be climbed in VS mode.
Assume once again that MCT is set and the current target speed is 230 KIAS. If VS is engaged, the autopilot elevator channel will command a pitch attitude (within certain limits) that will maintain whatever vertical speed the pilot has requested. Should the requested VS be less than the what the MCT thrust can produce, the elevator channel will still maintain the desired VS, but the speed will increase above the optimum 230 KIAS.
Conversely, should the requested VS be more that what the MCT thrust setting can produce, the elevator channel will again maintain the desired VS, but the speed will begin to decay below the optimum 230 KIAS.
In VS mode then, the pilot is required to pay careful attention to what his speed is doing. Should the speed increase, he will need to increase the VS target until the optimum 230 KIAS (or M0.55 above 30,000 ft.) is regained, and then adjust it again to maintain that speed. Conversely, should the speed decrease, he will have to reduce the VS.
As the aircraft climbs, the thrust produced by the engines is decreasing. This will require constant VS target adjustment on the part of the pilot to maintain optimum climb speed. It can be a demanding task. Inattention can result in off-optimum climb, overspeed or worse: entering the area of reversed command (back of the drag curve) and getting close to the stall.
The manufacturer and training organisations therefore recommend FLC.
As an aside, I am told that to really extract maximum climb performance from the CJ2+, the pros will climb in FLC and gradually reduce the speed target from 230 KIAS at around FL200 to around 203 KIAS passing FL300. Thereafter the climb will be continued at a constant M0.55 that is the “sweet spot” optimum climb speed.
Getting back to our accident flight, we know that the pilot elected to use the autopilot VS mode. The accident report does not mention what speed target was set by the pilot, but given the final outcome, we know that during the latter stages of climb the VS selected was clearly too high for the for the energy state of the aircraft:
1053:43 Passing FL356 at VS+1750 fpm airspeed M0.55
1056:41 Passing FL395 at VS+1400 fpm airspeed M0.53
1057:38 Passing FL410 at VS +1000 fpm airspeed M0.52
1058:24 Passing FL417 at VS+1000 fpm airspeed M0.49
1059:17 Passing FL420 at VS+500 fpm airspeed M0.46
1100:08 Passing FL426 at VS+500 fpm airspeed M0.43—stall
From this timeline we can see that this climb really started going wrong passing FL395. A timely correction at 1056, either selecting FLC or setting the VS to a more reasonable value, may well have made all the difference. At altitude, where the speed has dropped significantly below climb speed, it may be necessary to set VS to 0—or even a small negative value—in order to regain sufficient energy to accelerate back to climb speed. After 1056, with speed decaying, the undesired aircraft state took just four minutes to develop.
Apart from the obvious speed cue, in the latter stages of the climb, the pitch angle rose above 10 degrees. Above FL400, for any aircraft other than a fighter, that could be considered excessive.
The pilot needs to avoid distraction at all costs when climbing in vertical speed, particularly at high altitude.
To recover from undesired aircraft states, typical methodologies entail generic memory items similar to those in the table below. In all cases, specific manufacturer guidance will be overriding.
These simple actions may create the impression that recovery is straightforward. It is not. There would be significant startle factor as the aircraft stalls, pitches, and rolls. We can imagine all the horizon displays on the PFDs filling with brown earth symbology and rotating rapidly anti-clockwise as they faithfully indicate this extreme nose-down, rapid right roll. There would be disorienting physiological sensations of pitching down, fluctuating g forces and rapid rolling motion.
These confusing cues are accompanied by loud aural warnings and flashing warning lights. Tremendous resilience would be required to quickly recognise and recover the situation before more extreme attitudes develop, limitations are exceeded, and the possibility of recovery diminishes.
With regard to the autopilot pitch control, most business jets will have an autopilot pitch channel providing elevator commands to a servomotor, which in turn moves the elevator either directly or indirectly via hydraulic actuators. The system will also be equipped with an auto-trim system.
Following an autopilot pitch input, the auto-trim winds in an appropriate amount of pitch trim to provide a stick-free control so that the autopilot pitch servomotor no longer has to apply any torque to the elevator circuit to hold the desired attitude.
Autopilots will typically disconnect under the following conditions:
- Attitude limits are exceeded
- Running out of aileron authority
- Running out of elevator authority
- Running out of elevator trim authority
- Activation of high-speed warning
- Activation of stall warning
- Pushing disconnect buttons or manual operation of trim
The operation of the stall warning is important to this accident. With the autopilot engaged and the aircraft approaching an unaccelerated stall, the activation of the stall warning about five knots prior to the stall would result in autopilot disconnect. Importantly, the auto-trim would also stop trimming at this point and the aircraft would essentially be flying in trim at five knots above the stall. Re-establishing a safe flight condition would simply require keeping the wings level and a gentle push forward on the control column. Such is the safety inherent in the design logic.
On the accident aircraft, it could be deduced from the AReS data that the AOA vane would intermittently stick, despite aircraft pitch changes. Investigation of the AOA unit showed that a seal inside the unit was displaced. This allowed moisture to enter which could freeze and restrict the movement of the AOA vane.
This subtle, dormant failure removed the protection offered by the stall warning and stick shaker. With the pilot’s attention diverted, there was no timely warning of the impending stall to the distracted pilot. In addition, without the stall warning to signal an automatic disconnect, the autopilot kept flying and importantly, kept trimming the aircraft until it was actually fully stalled. The autopilot eventually disengaged when full left aileron input could not prevent the right wing from dropping to 57 degrees right bank.
The recovery of a fully stalled aircraft in an unusual attitude is complicated at the best of times. The fact that it had been trimmed into the stall added a whole new level of difficulty to the recovery. Who looks at trim position during a dynamic unusual attitude recovery? Abnormally high forward elevator control inputs would be required to recover from the stall. Imagine a stall recovery with a powerful bungee cord pulling the control column fully back to the aft stop—that’s how it would feel.
With the aircraft in an extremely nose-down attitude, the speed would tend to build up rapidly. Elevator trim is a powerful control and can be difficult or impossible to overpower at high speed. Very strong pitch-up forces would be experienced stick-free as the aircraft naturally attempts to regain its low in-trim speed.
It is said that the superior pilot is one who uses his superior judgement to avoid situations which may require the use of his superior skill. The adage has a lot in common with the Prevention – Recognition – Recovery philosophy applicable to upset training.
The best strategy is to avoid upsets and loss of control altogether. How do we do this?
Preflight, be aware of aircraft weight, tropopause height, and still air temperature at cruise altitude. Observe upper winds and consider any resulting mountain wave activity. They are a clue as to the performance you can expect. Keep an eye on these parameters during the climb.
Know the manufacturer’s climb profile, associated ballpark pitch settings, and the resulting performance you could expect throughout the flight envelope. In the CJ2+, any speed less than M0.55 above FL300 should be cause for concern to a situationally aware pilot. In most business jets, you never want to see pitch attitudes above 5 degrees above FL400. If you find that the aircraft cannot climb to its cruise level at optimum climb speed, then the climb should be stopped and a lower level requested. Most aircraft are going to perform marginally at high altitude and need to be flown with care. Always be prepared for the unexpected when operating at the edge of the aircraft’s performance.
Understand how to get the auto-flight system to achieve the climb profile safely and accurately. Understand its limitations. FLC is a mode with inherent safety advantages, the main one being speed protection. In a busy flight environment with many distractions and adverse weather, FLC can reduce workload while keeping you safe.
As always, if automation is not producing the flight path or smoothness desired, then the pilot should intervene. If VS must be used, understand the safety implications. VS mode should imply a more sterile cockpit environment and acknowledgement that the pilot flying (or single pilot) cannot be distracted from the primary task of flying the aircraft. If distraction subsequently becomes unavoidable, go back to FLC mode while you deal with it.
In this unfortunate accident, the pilot had received Upset Recovery Training. It is highly recommended that all pilots do so. The goal however, is to pay sufficient attention to prevention and recognition, so that the only time you are called upon to exercise your recovery skills, is during recurrent training.
Take care up there.
- The safety window – Raytheon Premier accident analysis - April 14, 2023
- Accident report: losing control at 43,000 feet - January 2, 2023