It is midday on Thursday 12 March 2015. A Premier I business jet is descending to its destination, Blackpool (EGNH), UK. The aircraft experiences intermittent hydraulic pressure fluctuations with associated indications and warnings. The copilot actions the appropriate checklist. The pressure is fluctuating, but remains mostly within its acceptable ‘green arc’ pressure range, so the flight is continued.
Just before the aircraft is about to make its approach, there are two further cautions for roll spoiler failure and speed brake failure. Again, the copilot actions the relevant checklists and calculates the revised landing distance resulting from these failures to be 5,950 ft. (1,810 m). Runway (RWY) 10 at Blackpool has a landing distance available of 6,131 ft. (1,870 m). The flight continues the NDB approach to RWY 10. The gear takes longer than usual to lower and is accompanied initially by unsafe warnings. These later disappear and the gear locks down.
The aircraft touches down 1,500 ft. from the threshold. The commander applies toe brakes but there appears to be no response. The copilot selects lift dump, but it too fails to function. The aircraft overruns the end of the runway at 80 kts. It continues across rough, uneven ground which collapses the nose gear and severely damages the wing to fuselage attachments. The passengers and crew are able to evacuate safely after the aircraft comes to a stop.
The 34 year old commander has an ATPL with 3,455 hours of which 408 are in type. The commander was the pilot flying (PF) while the copilot was the pilot monitoring (PM) on the accident sector. The commander is a CRM instructor as well as a Line Trainer.
The Raytheon (Beechcraft) 390 Premier I is a low-wing, T-tail business jet. The composite fuselage usually has a capacity of six passengers, depending upon the configuration. It is certified for operation by one or two pilots.
The tricycle undercarriage is operated hydraulically and can be lowered by gravity in an emergency. Each oleo leg has a single wheel.
Each main wheel is fitted with an anti-lock multiple-disc hydraulic brake operated by the toe pedals. There is also a parking and emergency braking system which can operate the brakes using hydraulic pressure supplied by a hydraulic accumulator. The accumulator has a precharge of 800 psi and is further pressurized via a non-return valve to 3,000 psi whenever hydraulic pressure is available from the engines. Anti-skid is not available via the emergency brake system. The emergency accumulator should be able to provide approximately 20 brake applications.
The primary flight control system is manually powered and conventional. The aircraft is also equipped with three hydraulically operated spoiler panels on each wing. These aid lateral control, act as speed-brakes, and provide lift dumping on the ground. The wing flaps are electrically powered.
There is a 1.6 US gallon (6.04 liter) hydraulic reservoir and associated filters and plumbing, known as the hydraulic package, located in the rear equipment bay. The reservoir is equipped with a glass sight gauge to assess hydraulic quantity during the preflight. It is pressurized by engine bleed air at 20 psi to ensure positive feed of fluid to the two engine driven hydraulic pumps. There is a hydraulic pump on each engine capable of producing a nominal 3,000 psi of pressure. Hydraulic pressure is displayed on an analogue gauge in the cockpit. The system is also fitted with left and right warning lights on the cockpit annunciator panel. The lights illuminate when the pressure output of the corresponding engine pump drops below a nominal 2,400 psi.
For preflight checks of the hydraulic system, there is a test switch in the rear equipment bay that should be pressed. If the associated warning light illuminates during the test, it means that the reservoir contains less than 1.2 gallons.
The flight is planned from Avignon France (LFMV) to Blackpool, UK (EGNH). The nominated alternate airport is Liverpool (EGGP) some 27 nm to the south east, while Warton (EGNO) lies just six miles southeast. The aircraft takes on a fuel load of 3,000 lbs. in Avignon which will result in a planned landing weight in Blackpool of 10,450 lbs. with about 1,000 lbs. of fuel remaining.
According to the aircraft flight manual (AFM), the unfactored landing distance at 10,450 lbs. on a dry runway should be 2,807 ft. (860 m), which means that prior to dispatch, the required landing distance would be 4,680 ft. (1,430 m) for a dry runway and 5,380 (1,640 m) if the runway was expected to be wet. The runway at Blackpool is 6,131 ft. (1,870 m) long, so no issues at the dispatch phase.
As far as we know from the accident report, the take-off, climb and cruise are all uneventful. Just another late-winter morning of flying in Europe.
The aircraft starts descending towards its destination. As it passes Flight Level (FL) 120 in the descent, the left, followed by the right, hydraulic low-pressure caution lights start cycling on and off irregularly. The analogue pressure gauge is cycling up and down in a corresponding fashion but “most of the time” reads within the instrument’s ‘green arc’ at +/- 2,800 psi. Pressure from the left engine hydraulic pump appears to activate its low-pressure light more than that of the right.
The copilot actions the ‘HYDRAULIC SYSTEM – HYDRAULIC PUMP FAILURE’ checklist. This checklist states that if the pressure is 2,800 psi minimum, then the flight can be continued. Since the ‘mean value’ on the fluctuating gauge indication is assessed to be about 2,800 psi, the crew elect to continue. In any event, the aircraft is already on the descent and only about 40 nautical miles from its destination. The checklist goes on to mention that should the pressure fall below 2,800 psi, the crew need to plan for a landing without hydraulic power which entails landing with flaps up and an associated higher VREF + 20 kts final approach speed. In addition, the procedure will require alternate landing gear extension and use of emergency brakes.
As the aircraft approaches the Blackpool NDB to commence its approach, the commander comments “it’s dropping”, but could later not recall what he was referring to. The ‘ROLL FAIL’ and ‘SPEEDBRAKE FAIL’ caution messages now illuminate. The copilot actions the associated checklists.
The ROLL SPOILER FAILURE checklist warns that speedbrakes will not extend and lift dump will be available via the inboard spoiler panels only. The ensuing landing would have to be made with flaps up which entails flying at VREF + 20 kts as for the hydraulic failure. Landing distance is increased by approximately 65%.
The SPEEDBRAKE FAILURE checklist warns that the speedbrake will not extend and that lift dump on landing will be available via the inboard spoiler panels only. Landing distance is increased by approximately 21%.
The copilot calculates an approach speed with the failures of 132 kts (VREF + 20 kts) and a landing distance of 5,950 ft. (1,820 m). The RWY 10 at Blackpool is 6,131 ft. (1,870 m) long and the commander elects to continue the approach.
During the approach (height about 1,200 ft.) the landing gear is lowered. As this takes place, the commander states “just lost it all”. This is followed almost immediately by the landing gear unsafe warning as the main landing gear is not indicating down and locked. Descending through a height of 1,000 ft. at just over three miles from the threshold, the ‘ALTERNATE GEAR EXTENSION’ checklist is requested. The commander discontinues the approach by engaging altitude hold mode on the autopilot. He then increases thrust and sets + 500 fpm rate of climb. Before the copilot has time to action the checklist, the gear indicates down and locked. The commander quickly disconnects the autopilot and continues the approach manually.
The flight is cleared to land on RWY 10 with the wind indicating 140 degrees at 17 kts. (10 kt headwind component). At about 500 ft. on the approach, the commander instructs the copilot to inform ATC that they have a hydraulic problem and to request rescue and firefighting services (RFFS) to be put on standby.
The aircraft touches down 1,500 ft. (460 m) beyond the threshold at 132 kts. The commander applies the pedal brakes but does not feel any significant deceleration. The copilot asks if he should operate the lift dump, but it fails to function. The end of the runway is rapidly approaching. The copilot transmits a MAYDAY call to ATC. As an overrun appears likely, the commander shuts down the engines. The aircraft runs off the end of the runway at 80 kts and the commander steers it slightly to the right over rough, uneven ground in order to avoid a shallow downslope to the left. The nose gear collapses and the nose crashes to the grassy surface in the overrun area. The wing to fuselage attachments are severely damaged by the violent forces experienced as the aircraft decelerates in the soft ground. The aircraft comes to a stop 400 ft. (120 m) after leaving the paved surface and the crew and passengers evacuate. The RFFS arrive shortly after.
Following the accident, evidence was found of a hydraulic fluid leak in the left engine nacelle in the vicinity of the hydraulic pump. The hydraulic reservoir was found to be empty with a small amount of fluid remaining in the filter housings. The hydraulic system blockage indicators had not ‘popped’ and the remaining fluid and filters were found clean and uncontaminated.
Operational Procedures and Checklists
It is extremely difficult for a manufacturer to provide a specific checklist to cover every eventuality, particularly those concerning multiple failures. The Raytheon Premier I Abnormal section contains the following guidance: ‘Certain component failures are capable of compromising multiple airplane systems. It is possible that the root failure may not be annunciated or otherwise apparent to the pilot. In these cases, the pilot must respond directly to the annunciated, or otherwise identified, system failures and consult the AFM/Checklist for each corresponding individual abnormal or emergency procedure. Where different procedures result in conflicting aircraft configurations for safe recovery to landing, the most restrictive is to be used. Where different procedures identify landing distance factors to increase the required landing distance, the factors are additive and are always applied to the applicable normal landing distance’.
Based on the warnings received, the checklists with possible relevance would have been the following:
Hydraulic System – this checklist in the AFM required alternate (gravity) gear extension, a flaps- up landing with associated 20 kt VREF speed increment and use of the emergency braking system. The checklist provided the following notes: ‘The following hydraulically powered systems may not operate normally or may be inoperative: Landing Gear, Speed brakes, Roll Spoilers, Lift Dump and Power Brakes.’ and ‘Landing distance will increase approximately 133%’.
Roll Spoiler System – this checklist also required a flaps-up landing with associated 20 kt VREF speed increment. As implied by the title, roll spoilers would not be available and nor would the speedbrake, while lift dump on landing would be available via the inboard panels only. The checklist provided the following note: ‘Landing distance will increase approximately 65%’. (assuming hydraulic power was available of course).
Speedbrake System – this checklist simply warns the pilot that the speedbrake is inoperative and will not extend. For landing, lift dump would be available via the inboard panels only. The checklist provided the following note: ‘Landing distance will increase approximately 21%’ (again, assuming hydraulic power was available).
Power Brake System – this checklist requires the pilot to use the emergency (parking) brake system which, without anti-skid and its limited hydraulic power is not as effective. The checklist provided the following note: ‘Landing distance will increase approximately 48%’.
There were no landing performance issues during the dispatch phase and the planned landing at Blackpool was well within the capabilities of the Premier I, provided it was flown in accordance with the correct procedure. The AFM actual landing distance (ALD) was 2,807 ft. When faced with the failures inflight, the copilot calculated the ALD at 3,000 ft. which was conservative and appropriate. He then applied the most limiting landing distance increment arising from the ROLL SPOILER FAILURE and SPEEDBRAKE FAILURE checklists, which was 65%. This should have resulted in a landing distance of 4,950 ft. (1,510 m), however, the copilot erroneously calculated the revised landing distance at 5,950 ft. (1,820 m).
In actual fact, the true cause of the failure was not correctly diagnosed – loss of hydraulic fluid – which would ultimately lead to hydraulic pump failure with pressure below 2,800 psi. The correct landing distance correction was in fact 133%. Interestingly, if one takes all the associated failures and adds the landing distance penalties the answer is 134% (48% + 21% + 65%).
This accident provides useful CRM lessons as it illustrates the importance of a number of CRM concepts.
Situational Awareness (SA) or ‘knowing what is going on’ can be classified over three consecutive ‘levels’ and refers to:
- Level 1: Perception of important elements, e.g. seeing a low hydraulic pressure indication;
- Level 2: Comprehension of their meaning, e.g. is there a leak, is it a faulty indication, have both pumps failed?
- Level 3: Projection of their status into the future, e.g. what is the impact of the failure, how can I mitigate the consequences?
Each level is reliant on the one preceding it and unfortunately, situational misunderstandings are possible at each level.
It is useful to review the accident with reference to this SA model. As the more perceptive readers will by now have realized, the root cause of this accident was a depletion of hydraulic fluid. When the failure initially presented itself, there was very little load on the hydraulic system. Both hydraulic pumps continued to run, albeit with some cavitation, which caused the fluctuating indications. The fact that both pumps were producing a fluctuating output was a clue that it could be a fluid problem rather than a pump problem, but such is the benefit of hindsight. It is far more difficult to diagnose problems when airborne. Remember also that there is no hydraulic quantity indication in the cockpit.
So while the failure initially presented and was perceived as a low/fluctuating pressure, there was a failure to comprehend the situation. Poor comprehension can be caused by the lack of a mental model, a poor mental model, or use of the incorrect mental model. It is likely that both of these factors affected the comprehension of the situation.
Having failed to comprehend the situation accurately, this SA deficiency now goes on to affect being able to correctly project the status into the future – how is this situation going to affect my approach and landing.
In a dynamic environment, it may be necessary to revisit a situation and our perception of it. Having run the hydraulic pump failure checklist and decided that no further action was necessary, the Premier I now presented its crew with further warnings which were a clue as to the failing health of its hydraulic system. As the approach continued, the spoiler system, which operates by means of hydraulic actuators, began to display warnings. Since the crew actioned the Roll Spoiler Failure and Speedbrake Failure checklists, it is likely that the level 1 Perception of this situation led them to erroneously believe that they were dealing with spoiler problems affecting two of the spoiler system components.
Finally, when the gear was lowered but did not extend immediately, the aircraft provided a final clue that all was not well with the hydraulic system. Although the commander initially does the smart thing and levels off, the gear finally locks down in a ‘last gasp’ effort from the malfunctioning hydraulic system, assisted by gravity. The situation has been incorrectly perceived and comprehended and the crew has failed to project the true state of the aircraft into the landing that is now just over a minute away.
CRM training equips pilots with a number of decision-making tools which provide a structured approach to problem solving and decision making, either for routine or novel situations. Conventional wisdom used to hold that judgement was something you were born with – it could not be taught. Although judgement is difficult to describe in concrete terms, the elements that go into decision-making can be taught and enable the individual to render decisions in a rational manner, even under stressful conditions and high workload.
Some of the barriers to good decision-making are lack of time, inaccurate or ambiguous data (as described above), rank difference (cockpit authority gradient) and personal attitudes.
Let us review this accident using a typical decision-making model. We shall use the mnemonic DODAR which is explained below. There are other models your company may use. Regardless, they all entail steps to assess, action and manage a failure.
Remember however, that when things go wrong, we are not sitting in the calm environment of our annual CRM recurrent training classroom. As always, the golden rules of flying have to be applied: AVIATE, NAVIGATE, COMMUNICATE – in that order. There must be one ‘head up’ flying the aircraft at all times.
The problem presents itself passing FL120 in the descent. No problems there, the Hydraulic Pump Failure Checklist is actioned, albeit incorrectly as it would later transpire.
As the aircraft approaches the Blackpool NDB to commence its approach at 3,000 ft., further Roll Spoiler Failure and Speed Brake Failures are indicated. These are both hydraulically operated controls. There is a published hold overhead the Blackpool NDB at 3,000 ft. This presents the crew with an ideal opportunity to make time for themselves by entering the hold. In the hold, they have some time to diagnose the spoiler problems and perhaps even re-visiting the earlier hydraulic problem.
In the event, the crew elect not to do this, perhaps they felt that there was sufficient time without having to interrupt their approach. The copilot has calculated a revised VREF speed and landing distance.
The final clue as to the true nature of the failure comes late in the flight when the gear is selected down, but does not lower at first. Initially the captain does the right thing and abandons the approach, but then the gear locks down and he elects to continue.
With the benefit of hindsight, it is easy to see the wisdom of leaving the gear down, going around and entering the hold at 3,000 ft. to re-assess the situation. The concept of the ‘Safety Window’ is useful when we have failures which manifest themselves close to the ground. The safety window can be thought of as a large frame placed 2,000 ft. above the runway in the vicinity of the airfield. (see diagram).
How do we use the safety window? Simple: ambiguity, fixation and confusion are not permitted below the safety window. Do not descend or remain below the safety window unless all checklists, procedures and briefings are complete. If a failure occurs below the safety window, go around, get above it and resolve the issue before descending below the safety window again.
It is likely that at gear-down selection, when having to power the large main-gear hydraulic actuators, the true nature of the hydraulic failure would have been more apparent. Before that time, the hydraulic system was not called upon to do much other than move spoilers which have relatively small actuators. Landing gear actuators are high volume units requiring a larger movement of fluid (in this case, 0.6 USG – or about 1/3 of the total quantity) and it is likely that the hydraulic pressure gauge would now properly indicate the failure of the system.
With all the ‘holes in the cheese’ starting to line up, this would be a good time to observe the safety window, climb above 2,000 ft., enter the hold, and then use our decision-making model. So here it is: DODAR
D = Diagnose. Utilize all available resources and view differing opinions as being helpful rather than a hinderance. Make time available if possible, so that this phase is not rushed. Focus on the problem for now – do not rush to a solution. Considering the indications, both Left and Right Hydraulic low-pressure lights indicating intermittently. It is unlikely that both pumps would fail simultaneously. The gauge, which measures the combined output of both pumps is fluctuating. Even if one pump had failed completely, the other should continue to produce a nominal 3,000 psi all day, provided it had fluid. So the fault would probably be something common to both – hydraulic leak or the rupture of a hydraulic line. Remember that the hydraulic quantity gauge was in the rear of the aircraft and not visible to the pilots in flight. Diagnosis is dependent upon system knowledge. The total hydraulic failure may have been recognized at this time. The Roll Spoilers and Speed Brake Faults experienced were due to those controls having no hydraulic power to move them. The correct landing distance is now 2,807 ft. X 2.33 = 6,540 ft. (plus a bit more for ‘normal pilot’ technique, call it 7,000 ft. minimum).
O = Options. Work out what options are available. The aircraft is in the hold with gear down and burning large amounts of fuel at low level, so there is not much time. At 6,131 ft., the runway at Blackpool is no longer an option. Liverpool is 27 nm to the south (12 to 14 mins) with a runway 7,497 ft. long. Warton is six miles (about three minutes) to the southeast with a runway 7,946 ft. long. That could also work. Get weather and runway condition for both.
D = Decide. Decide on the best course of action considering pros’ and cons’. Warton or Liverpool?
A = Assign. Assign the tasks but remember that there should be one ‘head up’ at all times flying the aircraft. It may be necessary for the PF to do the ATC radio in order to unload the PM. He will be busier than a desert cobra at a mongoose convention at this point.
R = Review. Keep reviewing the decision at intervals. In the example above, this would be difficult if Warton was chosen as the flight time was only a few minutes. Should the crew have elected to divert to Liverpool, then the short gear-down cruise would certainly have allowed the opportunity for a quick review of the plan, particularly with regard to fuel remaining etc. At this point it would be best to keep speed and consequently fuel consumption low.
The comments and suggested actions above are not meant to criticize the actions of the crew on the day. This is not about what this crew did, but rather about what we can learn. CRM concepts can at times be a little dry and theoretical. We have used this accident to show how CRM concepts can be applied to a failure scenario in a practical way.
The accident highlights the need for pilots to have a thorough understanding of the aircraft systems, performance and checklists. As we assess any failure, we need to consider whether it is an isolated/primary failure, or if it is a secondary failure – a consequence of something else.
Care needs to be taken when applying performance penalties. Often, they are cumulative and can quickly exceed the landing distance available, particularly in wet or contaminated conditions.
When faced with any loss of situational awareness, ambiguity, confusion or failure which requires time to address, keep the safety window in mind. We do not resolve issues below the 2,000 ft. safety window.
Aviate, Navigate and Communicate in that order. There must be one ‘head up’ flying the aircraft. This task shall be protected at all costs.
Take care up there.
- The safety window – Raytheon Premier accident analysis - April 14, 2023
- Accident report: losing control at 43,000 feet - January 2, 2023