Aviation Investigation Report A08W0068

The privately operated Piper PA-46-350P Jetprop DLX (registration C-FKKH, serial number 4622092) had departed from Edmonton, Alberta, at about 0733 mountain daylight time en route to Winnipeg, Manitoba, on an instrument flight rules flight plan. Shortly after the aircraft levelled off at its cleared altitude of flight level (FL) 270, the aircraft was observed on radar climbing through FL 274. When contacted by the controller, the pilot reported autopilot and gyro/horizon problems and difficulty maintaining altitude. Subsequently, he transmitted that his gyro/horizon had toppled and could no longer be relied upon for controlling the aircraft.

The aircraft was observed on radar to make several heading and altitude changes, before commencing a right turn and a steep descent, after which the radar target was lost. An emergency locator transmitter signal was received by the Lloydminster, Alberta, Flight Service Station for about 1 ½ minutes before it stopped. The wreckage was found by the Royal Canadian Mounted Police about 16 nautical miles northeast of Wainwright at about 1205. None of the five people on board survived.

Ce rapport est également disponible en français.

History of the Flight

The Piper PA-46-350P Jetprop DLX (C-FKKH) departed the Edmonton City Centre Airport (CYXD) at 0733 ^{Footnote 1} with the pilot and four passengers on board. After the pilot reported level at flight level (FL) 270 at 0751, the Edmonton Area Control Centre (ACC) radar confirmed that the aircraft was tracking 080° magnetic (M) with a ground speed of 250 knots.

At 0755, the ACC noticed the aircraft climbing above the assigned altitude and queried the pilot, who reported that he had an autopilot problem. The aircraft returned to FL 270 about three minutes later, but within the next two minutes, descended to FL 269, then climbed to FL 274 before returning to FL 270. At 0806, the pilot advised the ACC that his gyro/horizon had toppled and requested weather for Saskatoon and Regina, Saskatchewan, which he promptly received. At 0807, the pilot advised the ACC that he had lost his gyro/horizon again and requested a block of airspace ^{Footnote 2} as well as the Regina weather. The ACC responded by advising the pilot that he was turning south through a track of 186°M and descending. At 0808, the aircraft levelled off at FL 260 with a track of 195°M. It then climbed to FL 265 while tracking 230°M before beginning a constant descent. In this descent, the track varied from 218°M to 243°M. Over the next minute, the ACC advised the pilot that he was descending through FL 244 and then FL 232.

An emergency locator transmitter (ELT) signal began transmitting at about 0810:30. The last encoded radar return from the aircraft was at 0811 at 9000 feet above sea level (asl). The last non-encoded return (no altitude information) was about 30 seconds later. The ELT transmission ceased at 0812. Until the final descent, the aircraft ground speed remained constant between 240 and 260 knots. On final descent, the ground speed dropped to 100 knots, indicating a near vertical flight path. The aircraft was not equipped with a flight data recorder or a cockpit voice recorder, nor were they required by regulation.

Wreckage Information

The main aircraft wreckage was located in scrub brush approximately 16 nautical miles (nm) northeast of Wainwright, Alberta, at 53°02.461′ N and 110°35.939′ W at an elevation of 1901 feet asl. The aircraft was oriented at 090°M on a slight slope on the upper banks/river valley of the Battle River in about 18 inches of snow.

The lower fuselage was extensively crumpled, which is consistent with the aircraft striking the ground in a level attitude with a high vertical rate of descent. There were indications of a slight counter-clockwise rotation (yaw) as viewed from above. Propeller blade damage indicated that the propeller was rotating at the time of impact, although not under positive load. The right wing had failed under positive loading about 54 inches outboard of the fuselage, and the outer panel struck the top of the cabin as indicated by the damage and paint and rubber transfers. Failure of the left wing was at about 88 inches outboard of the fuselage, with the fracture surfaces displaying distortion under both positive and negative loading. There were no paint or material transfers on the outer panel. The vertical fin and the upper aft fuselage section, with about the lower third of the rudder attached, had separated as a unit. Both stabilizers, elevators, and trim tab had departed the aft fuselage, initiated by the failure of the right front stabilizer attachment fitting.

The usual breakup sequence of an aircraft in a spiral dive is for the tail surfaces to fail under excessive negative aerodynamic loading as the pilot attempts to raise the nose to recover from the dive. Relieved of the aerodynamic download and the weight of the tail, the nose then rotates downward and unloads the wings, which fail under negative aerodynamic loading (bunting). C-FKKH's breakup sequence was initiated by the right wing failing under a positive load, followed by the left wing under a positive/negative load, then the tail from a twisting rotational load.

All detached parts were found scattered along a narrow track for a distance of about 1.92 nm, on a bearing of 333°M from the fuselage. Examination of the fracture surfaces by the TSB Laboratory revealed that all failures were caused by structural overload, with no pre-existing deficiencies found.

Analysis of the radar data indicated that the aircraft was in descent between 20 000 and 16 000 feet asl when breakup occurred. The descent rate was in excess of 30 000 feet per minute with a peak forward speed of about 460 knots calibrated airspeed (KCAS) or about 390 knots indicated airspeed (KIAS). Certification testing on the original PA-46-350P included flutter dive testing up to about 266 KIAS.

Pilot History

The pilot was an executive within the A.D. Williams Group of companies who flew the corporate aeroplanes periodically. The pilot began his flight training in July 1983 and held a Commercial Pilot Licence with a Group 3 instrument flight rules (IFR) rating issued on 06 December 2007. At the time of the occurrence, the pilot had flown about 2200 hours, of which about 987 hours were in the PA-46-310P model and 166 hours were on C-FKKH.

On 02 and 03 August 2006, for his transition to the turbine-powered PA-46P Jetprop, the pilot received 5.7 hours of training from Eclipse International, a company that specialized in training on the PA-46 series of aircraft. In addition to ground school, flight training included exercises in aircraft handling as well as instrument procedures, avionics, and autopilot/flight director failures, and recovery from unusual attitudes. Partial (limited) panel exercises were not included nor was there any requirement to do so.

The pilot successfully passed his IFR proficiency flight test (PFT) on 05 December 2007. Partial panel exercises were not conducted during this PFT because they are not required as part of the Transport Canada (TC) IFR PFT. His last documented partial panel training was on 06 May 2001 during recurrent training on the previous company aircraft, a PA-46-310P. There was no record of whether the pilot had previously hand-flown C-FKKH without the assistance of the autopilot at altitude, in IFR conditions, for any period of time.

The ground school portion of the initial PA-46P Jetprop training received by the pilot in August 2006 covered aircraft weight and balance, gross take-off weight (GTOW), and centre of gravity (C of G) limits. Also covered were the actual payload the aircraft could handle and the weight limitations of the forward and aft cargo areas. A subsequent safety seminar attended by the occurrence pilot in June 2007 emphasized the weight and balance issues, and the aft C of G issues in relation to stall speed, spins, and spirals.

All pilot information was assembled from TC files, pilot and aircraft logbooks, courses, and seminar information because there were no company pilot training and qualification records as required by the company operations manual (COM). The COM is required under Section 9.11 by the Canadian Business Aviation Association (CBAA) program.

The instructors of three of the ground and flight safety courses on the PA-46 series aircraft stress that a partial panel is to be utilized in case of a gyro/horizon failure, instead of attempting to transition to the use of the backup electric gyro/horizon in the right side panel, due to the width of the panel and parallax issues.

Weather

The pilot obtained a verbal weather briefing from the Edmonton Flight Information Centre (FIC) based on Meteorological Service of Canada (MSC) forecasts. The pilot was advised that he may expect light mixed icing on the climb from 7000 to 12 000 feet with cloud tops at FL 220. Clouds were expected to clear once in the vicinity of Lloydminster, Alberta.

No significant meteorological condition was evident in the data for the departure and climb-out phases of this flight. The conditionally unstable atmosphere, local cloud decks, and weak shear layers might have resulted in occasional light-to-moderate turbulence on climb-out, but nothing that would normally have caused a problem for the aircraft. The relatively dry mid-levels through climb-out would have also minimized any icing potential beyond occasional light rime while traversing through cloud.

Flight through mid-cloud layers to the east of CYXD would have increased the potential for icing as indicated by the Graphical Area Forecast (GFA) panels issued on that day. That the aircraft attained FL 270 without incident, however, suggests that no difficulties were encountered on climb-out.

Satellite imagery showed that later stages of the flight would have been over-flying extensive cloud layers associated with an inverted trough over east-central Alberta. With limited representative upper air information in the area, it was difficult to determine with certainty the actual height of the top of the main cloud deck associated with this system. Infrared satellite imagery indicates that cirrus cloud would have been associated with this system at or near FL 270, but it would seem likely that the more active cloud decks were well below the FL 270 cruising altitude of the aircraft.

There was convective activity originating from the main cloud deck of the inverted trough. Radar echo tops during the flight indicated precipitation returns up to 20 000 feet asl. Forecaster assessments on that morning indicated scattered to numerous altocumulus castellanus cloud topped at FL 220. An assessment of the 0600 Stony Plain, Alberta, upper air data, however, indicated the potential for additional isolated altocumulus castellanus development as high as FL 250. As such, the possibility of significant turbulence and/or icing associated with altocumulus castellanus at that altitude cannot be ruled out.

It is also important to note that, from the last recorded position of the aircraft at assigned altitude, any descent would have occurred through the extensive cloud layers below and likely resulted in minimal visual references to the ground or horizon.

A Pilatus PC12 flew the route of the accident aircraft at FL 270 approximately 15 minutes behind C-FKKH. The pilot reported light to nil icing in the climb with light turbulence through FL 230. Once at FL 270, the pilot was in and out of the cloud tops with no turbulence or icing, and with an outside temperature of −55°C. The pilot reported that he was clear of cloud and had ground contact when he was east of Lloydminster, about 20 nm east of the accident site.

Aircraft Information

The occurrence aircraft, originally a PA-46-350P, was manufactured in 1989. It had been modified in October 2000 at 1265.4 hours total time since new (TTSN) to the Jetprop DLX model with a PT6A-34 engine and Hartzell HC E4N 3N propeller in accordance with Supplemental Type Certificate (STC) ST00541SE by Jetprop L.L.C. The conversion also entailed major changes to the existing airframe, such as a new engine mount, redesigned cowling, fuel system (header tank), engine controls, indicating instruments, electrical systems, pressurization system, control switches, and backup vacuum system. The primary purpose of the conversion was to increase engine reliability. In March 2003, at 1385.6 hours total time (TT), the PT6A-34 engine was replaced with a PT6A-35 engine for better climb and high-altitude performance. Also incorporated at this time was STC SA00859AT to allow an additional 10 US gallons of fuel in each wing tank, for a total fuel capacity of 151 US gallons (1070.6 pounds). The aircraft was imported into Canada in July 2006 with 1609.9 hours TTSN.

The original PA-46-350P's maximum structural cruise speed (Vno) was 168 KIAS, with the maximum speed (Vne) of 198 KIAS at maximum gross weight. Following conversion, the more stringent United States Federal Aviation Administration (FAA) Part 25 requirements applied, resulting in a maximum operating speed (Vmo) of 172 KIAS as the sole limitation.

The original life limit for C-FKKH's wing was 15 580 hours time in service (TIS) and, for the fuselage, 10 145 hours TIS. After conversion, the reduced limits were calculated for the wing at 14 148.5 hours and the fuselage at 9257.0 hours TIS due to the higher stresses of turbine operation.

The Operating Altitude Limitations section of the PA-46-350P Pilot's Operating Handbook (POH) states "Flight above 25 000 feet pressure altitude is not approved." STC ST00541SE, Section 2.25 states "Flight up to and including FL 270 is approved if equipped with avionics in accordance with Federal Aviation Regulations (FAR) 91 or FAR 135." ^{Footnote 3} The STC further states "...supplemental oxygen and a quick-donning mask must be available for the pilot for flight above FL 250."

Paragraph 605.32(3)(a) of the Canadian Aviation Regulations (CARs) states "The pilot at the flight controls of an aircraft shall use an oxygen mask if the aircraft is not equipped with quick-donning oxygen masks and is operated at or above FL 250." There were no quick-donning masks on board and the pilot was not wearing an oxygen mask at the time of the occurrence. There was no record of the pilot having received high-altitude indoctrination training as required in Section 9.6 of the COM.

Weight and Balance

The aircraft weight was calculated to have been about 5157 pounds at take-off and about 5012 pounds at the time of the occurrence, with the C of G at 147.97 inches aft of the datum. Maximum allowable GTOW was 4300 pounds, with the C of G limits from 143.3 inches to 147.1 inches aft of the datum. As equipped and with full fuel, C-FKKH would have had a useful load of about 267 pounds.

Section 6.3, Weight and Balance (W&B) Control, of the COM states:

The pilot-in-command is responsible for the proper loading, including load security, weight, and weight distribution. The load shall be distributed to ensure that the C of G will remain within the prescribed limits throughout the entire flight. The takeoff and landing limits shall not exceed the maximum weights specified in the approved Aircraft Flight Manual.

There was no record of weight and balance calculations for any flights of this aircraft as required by Section 3.3 of the COM. Company trip sheets recorded passenger names, thus the weight of passengers and fuel loads (unrecorded) were estimated according to trip segment times. During the period from 01 June 2007 to 30 January 2008, there were 12 flights that departed with the GTOW of the aircraft above the maximum weights specified. Several additional flights most likely had departed with weights above maximum GTOW when IFR fuel reserves were included.

Aircraft Handling

The PA-46 series of aircraft have been characterized as having a sensitive (light) pitch control, which means that the elevator control requires very little effort to change the pitch attitude (nose up or nose down). The horizontal stabilizer and attached elevators normally operate under an aerodynamic download to balance the weight of the forward fuselage and engine.

Manufacturer's calculations have determined that, due to the excess weight and out-of-envelope aft C of G position, the aerodynamic loading on the horizontal stabilizers on C-FKKH would have been reversed, from negative (download) to positive (upload). This condition would result in an increase in the pitch control sensitivity and a decrease in aircraft longitudinal stability. Control forces also become lighter with the lower air densities at higher altitudes. Lighter control forces would allow the pilot to induce higher loads (g) on the airframe with less effort.

Aircraft Maintenance

As per the requirements of subpart 605 of the CARs, an aircraft being operated on a private operator certificate (POC) can be maintained by an appropriately licensed and qualified aircraft maintenance engineer (AME). An approved maintenance program is required as well as the appropriate manuals and AME qualifications. The occurrence aircraft was being maintained by a local approved maintenance organization (AMO) approved for Piper single-engine, piston-powered aeroplanes but not the PA-46 Jetprop DLX.

The last maintenance performed on C-FKKH was the removal, bench test, and reinstallation of the pilot's gyro/horizon and autopilot computer shortly before the occurrence flight. Previously, on 04 February 2008, a number of repairs were completed and some engine and airframe components were replaced. The last inspection was a 100-hour inspection on 08 November 2007 at 1810.1 airframe hours. Other than the gyro/horizon instability, there were no other reported unserviceabilities before the flight.

Vacuum System

The original factory-installed vacuum system consisted of two engine-driven vacuum pumps, one primary and one backup, and associated components and plumbing. C-FKKH's system was modified by the Jetprop DLX conversion to incorporate one engine-driven primary pump and a backup ejector-type vacuum system. The vacuum system operated the gyro/horizon on the left (the pilot's) side instrument panel and the directional indicator gyro on the right side instrument panel. All system components were examined and the only anomaly found was the vacuum gauge, an original factory-installed unit. Normal system operating vacuum is 4.8 to 5.2 inches of mercury (in Hg), which is determined by using the aircraft's vacuum gauge as the reference for adjustment. Examination revealed that the gauge was reading higher than the actual vacuum in the system. At 4.8 in Hg indicated on the gauge, the actual value was about 4.16 in Hg, and at 5.2 in Hg indicated, the actual value was about 4.58 in Hg. There was no record of the gauge having been checked or calibrated since manufacture or during the engine conversion in October 2000, nor was there required to be. The gyro/horizon manufacturer has advised that the minimum vacuum required for operation of the instrument was 4.5 in Hg.

Instrument Examination

All of the flight instruments, avionics, and autopilot components were examined in detail by the TSB with the manufacturers' representatives assisting. The autopilot components were sent to the manufacturers for further testing under TSB supervision. Particular emphasis was placed on the pilot's King KI256 Flight Command Indicator gyro/horizon, serial number X16749.

The primary trait of a rotating gyroscopic rotor is rigidity in space, or gyroscopic inertia. The spinning rotor maintains a constant attitude in space as long as no outside forces change its motion. This makes it ideal for use as an unchanging reference in such devices as attitude and heading indicators. The gyroscopic inertia of a spinning rotor increases as its mass and spin rate increase. Another characteristic of a gyroscope is precession, which is the tilting or turning of the gyro axis as a result of applied forces. The axis may therefore wobble when deflecting forces are applied. It may even fall over or topple when the applied force overpowers the gyroscopic inertia.

The pilot reported failure of his King KI256 gyro/horizon shortly after deviations from controlled flight were noticed. As the KI256 supplies pitch and roll attitude information to the autopilot as well as directly to the pilot, it could not be determined when the autopilot was disconnected and the pilot assumed control. If the autopilot had been connected when the gyro toppled, it would have automatically disconnected when the gyro exceeded programmed parameters.

The pilot had noticed problems with the unit on previous flights. He had the KI256 and the associated KC192 autopilot computer removed and bench tested before the occurrence flight. The KI256 signal outputs to the autopilot computer were found to be too unstable (jittery) to adjust, and the rotor bearings were noisy when operating. An overhaul was recommended but could not be performed until the following week, and a replacement or exchange instrument was not available. Because the KI256 display appeared to be within bench test parameters, the pilot requested that the units be reinstalled to complete the occurrence flight before further repairs were completed, with the knowledge that the autopilot problems had not been rectified. Section 1.1.1 of Appendix A of the COMstated "Autopilot must be serviceable for planned single pilot operations."

The KI256 was manufactured in 1989 and was initially installed in an aircraft in 1994, then returned to the factory for overhaul in January 1995. After overhaul, the instrument was installed in the occurrence aircraft in February 1995. There is no record of the instrument having been serviced since this date and the factory seals from overhaul were intact. The aircraft TTIS since overhaul was 1236.3 hours; a calendar time of 13 years. There is no recommended overhaul life on these units, but the manufacturer has advised the TSB that average overhaul life is about three years.

TSB examination of the KI256 gyro/horizon revealed significant internal wear and damage that pre-dated the occurrence:

• the rotor bearings and shaft had excessive wear and fretting damage; and
• the gimbal roll shaft had considerable fretting damage.

Paint transfer from the rotor to the housing at impact did not exhibit smearing, indicating that the rotor was stationary at the time of impact.

Examination of the other gyro instruments (the second gyro/horizon, both directional gyros, and both electrically operated turn coordinators) revealed scoring consistent with spinning at a high rate of speed at impact.

Piper PA-46-310P and PA-46-350P Series Accident History

About 1016 PA-46-310P and PA-46-350P aircraft have been built, of which 165 have been involved in serious accidents (16 per cent). Of these accidents, 12 involved in-flight breakups, of which 7 occurred in less than two years. The United States National Transportation Safety Board (NTSB) initiated a special investigation in 1990 on the airworthiness of the PA-46 series. Its report, published in 1992, concluded that there were no deficiencies in the design and construction, citing a combination of pilot error and omissions in the aeroplane's operating manual regarding the use of pitot heat in icing conditions.

C-FKKH's right pitot heat switch was on, and the position of the left pitot heat switch could not be determined due to impact damage.

Safety Management and Canadian Business Aviation Association Oversight

The Canadian Business Aviation Association (CBAA) is an industry association representing business aircraft operators, ranging from small, one-person pilot/owner operations to large corporate flight departments.

TC and the CBAA conducted a joint study of the feasibility of self-regulating business aviation in Canada and released a report in 2000 ^{Footnote 4} that concluded that it was feasible to amend subpart 604 of the CARs to enable the transfer of regulatory responsibilities to the CBAA. The proposed regulatory approach included designing a set of performance-based rules linked directly to the operator's safety management system (SMS). In keeping with International Civil Aviation Organization (ICAO) developments, SMS is the strategy TC has adopted for improving safety within the commercial and business sectors of the aviation industry. These performance-based rules are contained in standards developed by the CBAA and called the Business Aviation Operational Safety Standards System (BA-OSS System).

On 01 January 2003, the CBAA began to administer the certification of CARs subpart 604 operators in Canada. The main condition for obtaining a private operator certificate (POC) is that the operator must successfully undergo a third-party audit of its SMS. Audits are required to ensure that the operator complies with the CBAA's BA-OSS and that the operator's SMS meets the initial requirements.

The CBAA does not recommend any particular auditor, nor does the CBAA facilitate contact. It does provide a list of accredited auditors and their contact information on its website. The CBAA takes pains to remove any perception of an employee-employer relationship between it and the accredited auditors. Notwithstanding the inherent conflict of interest or potential capture of the accredited auditors by the companies they serve, the CBAA is reluctant to direct auditors to cycle between operators based on what the CBAA perceives as interference in the auditor-client business relationship.

Company Operations

The aircraft was being operated by ADWEL Investments Ltd. (ADWEL) under a POC issued by the CBAA. A company operations manual (COM) was developed to conform to the POC program. It defined the duties and requirements of all persons associated with flight operations.

In order to obtain the POC, a company SMS had to be developed and approved by the CBAA. The SMS program required the operator to analyze all aspects of the operation to identify all perceived hazards, define the characteristics of the hazard, the associated risks, and arrive at an effective mitigation strategy. A risk assessment was to be completed annually or whenever a safety issue dictated that a new risk assessment should be completed.

There was no record of a risk assessment having been completed since the POC was issued in October 2006. The contract pilot, hired to share flying duties when the primary pilot was not available, would not fly above FL 250 because of the lack of quick-donning oxygen masks and would not take more than three passengers and two hours of fuel due to weight limitations on the aircraft. None of these operational situations were identified in either the original 2006 CBAA audit or the December 2007 audit.

Operators are responsible for contracting the services of an accredited auditor from a list supplied by the CBAA, and the agreement between the auditor and the operator is solely the responsibility of the two parties involved. Therefore, the operator controls the audits by choosing the auditor and negotiating the scope of the audit. On 05 December 2007, an audit was required due to a change in the executive structure at ADWEL. A partial audit was conducted which addressed 5 of the 124 items on the CBAA Certification Audit Checklist-2007. There is no reference in the CBAA POC program for a partial audit, nor are there any guidelines or checklists. The interval between the initial certification audit and the next mandatory audit had been assessed to be three years, the maximum interval allowed.

Regulatory Framework for Business Aviation – Other Occurrence

In considering the transfer of regulatory responsibilities to a delegated authority, TC and the CBAA had identified a number of risks in their initial joint studies. To address these risks, the proposed approach included designing a set of performance-based rules directly linked to an operator's SMS. Recognizing that oversight of operators would still be required upon assuming regulatory responsibility, the CBAA would have to audit for operator compliance with the rules and standards, and develop and maintain a quality assurance program for its audit processes.

On 11 November 2007, a business jet operated by Jetport Inc. on a flight from Hamilton, Ontario, to Fox Harbour, Nova Scotia, touched down seven feet short of the runway (TSB investigation report A07A0134). The right landing gear collapsed and the aeroplane came to a stop 1000 feet further down and off the runway. Two occupants suffered serious injuries while the other eight occupants received minor injuries. Jetport held a POC issued by the CBAA under the auspices of subpart 604 of the CARs.

The TSB investigated this occurrence and identified the following safety issues in its final report:

• The CBAA did not believe it could force its operators to comply with the requirements of the POC program and was not insisting that milestones for SMS implementation and development be followed. Therefore, some POC operators might never reach full SMS compliance.
• Contrary to the recommendations made in the TC/CBAA feasibility studies, the CBAA did not have a quality assurance program for its audit process.
• Since the inception of this new approach to regulating subpart 604 operators, TC did not exercise effective oversight of the CBAA, its accredited auditors or POC holders. It did not have a program established to observe or participate in audits conducted by the CBAA–accredited auditors in order to verify that this new approach was meeting its safety objectives.

As a result, the TSB recommended that:

The vacuum system appeared to have been operating normally, although possibly at a lower setting than specified by the manufacturer due to an over-reading gauge. Given the problems with the KI256 gyro/horizon noted on previous flights, such as the unstable autopilot outputs from the gyro/horizon and noisy bearings, the instrument shop recommended that it be replaced or overhauled. Although there was no specified overhaul/replacement life on the instrument, the condition of the bearings and other internal components indicates that 13 years and 1200 hours were excessive intervals between service or overhaul.

The lack of maintenance on the KI256 gyro/horizon resulted in considerable internal component drag from the deteriorated bearings. This drag, possibly in combination with the system vacuum that was not operating at the minimum required, would have resulted in the attitude gyro spinning at a speed considerably below the value required for proper stabilization, causing the autopilot to become unusable, while the subsequent toppling of the gyro deprived the pilot of attitude information.

The aircraft GTOW exceeded the maximum limit by about 857 pounds at take-off and about 712 pounds at the time of the occurrence. The C of G was beyond the aft limit by about 0.87 inches, approximately 23 per cent of the 3.8-inch C of G range. During the pilot's upgrade training and on the safety seminars he had attended, the issues of weight and balance were emphasized as concerns with this particular model of aircraft. The non-standard breakup pattern and the level fuselage attitude at impact are consistent with an extreme aft C of G loading before and after the in-flight breakup.

The extreme aft C of G loading of the aircraft increased the elevator sensitivity of an aircraft known for its light elevator control forces and decreased the aircraft's longitudinal stability. This decrease in stability would have resulted in an increase in pilot workload because the aircraft would not easily maintain its trimmed airspeed. Any nose-down divergence from level flight would continue to increase the angle of dive or spiral, leading to a very high airspeed excursion within a very short period of time. The constant ground speed indicates that the pilot was maintaining a high cruise speed for several minutes as he attempted to maintain control before entering the spiral, thus reducing the margin before the speeds and aerodynamic loads exceeded structural limits.

The pilot's last recorded partial panel training was on 06 May 2001 during recurrent training on the company's previous aircraft, a PA-46-310P. There was no requirement for partial panel exercises during his recurring proficiency flight tests or his transition training from the PA-46-310P to the PA-46P Jetprop aircraft. It is likely that the pilot was not proficient in partial panel flight. The reduced aircraft handling characteristics, combined with the malfunction of the KI256 gyro/horizon, exceeded the pilot's ability to control the aircraft in instrument meteorological conditions.

Single-pilot IFR operations in this type of high-altitude, turbine-powered and pressurized aircraft requires a high level of proficiency. The COM required the aircraft to have a functional autopilot to relieve part of the pilot's workload, with the autopilot normally used to fly the aircraft from shortly after take-off to final approach. The pilot normally would not hand-fly the aircraft other than for take-off and landing, and therefore would not likely be prepared to deal with an unserviceable autopilot as well as a primary attitude indicator failure in instrument meteorological conditions.

There were no indications of structural or other deficiencies prior to the in-flight breakup. The calculated airspeed at breakup was about 390 KIAS, which was more than double the Vmo and about 46 per cent above the flutter dive test airspeed during certification. The structural limitations of the aircraft were exceeded during the uncontrolled descent; this resulted in the in-flight breakup.

TC was previously responsible for inspections and audits of POC holders until the POC program was transferred to the CBAA. Audits are now conducted by independent CBAA–accredited auditors, chosen by the POC holder, and the conditions of the audit negotiated between the two parties.

There were a number of deficiencies identified in this investigation, such as no pilot records, no quick-donning oxygen masks, flying overweight and out of C of G range, no records of weight and balance, and unapproved maintenance. In accordance with the CBAA standards, the company was required to have a SMS to detect and mitigate such deficiencies, and a risk assessment should have been completed within 12 months of the issue of the POC. However, a risk assessment was not done.

The partial audit conducted in December 2007 was not designed to detect any risks or deficiencies and did not identify that the SMS of this new POC operator was ineffective. One of the most powerful monitoring tools is independent auditing, an effective way to avoid complacency and highlight slowly deteriorating conditions. Audits that simply seek to confirm the existence of controls required by regulation are ineffective; good audits look at how effective the controls are in practice and whether the control strategy is functional. In this occurrence, there were several organizational and human performance deficiencies that contributed to the occurrence chain of events. Subsequent monitoring of the developing SMS program of this new POC operator was ineffective due to the auditing interval being set at the maximum allowed of three years.

If effective oversight of POC holders is not exercised by the regulator or its delegated organization, there is an increased risk that safety deficiencies will not be identified and properly addressed.

The following TSB laboratory reports were completed:

• LP 060/2008 – Instrument Examination
• LP 064/2008 – Structural Examination
• LP 092/2008 – Breakup Analysis

These reports are available from the Transportation Safety Board of Canada upon request.

Findings as to causes and contributing factors

1. The gyro/horizon failed due to excessive wear on bearings and other components, resulting from a lack of maintenance and due to a vacuum system that was possibly not at minimum operating requirements for the instrument.
2. The gyro/horizon was reinstalled into the aircraft to complete the occurrence flight without the benefit of the recommended overhaul.
3. The autopilot became unusable when the attitude information from the gyro/horizon was disrupted.
4. The pilot had not practised partial panel instrument flying for a number of years, was not able to transition to a partial panel situation, and lost control of the aircraft while flying in instrument meteorological conditions.
5. The aircraft was loaded in excess of its certified gross weight and had a centre of gravity (C of G) that exceeded its aft limit. These two factors made the aircraft more difficult to handle due to an increase of the aircraft's pitch control sensitivity and a reduction of longitudinal stability.
6. The structural limitations of the aircraft were exceeded during the uncontrolled descent; this resulted in the in-flight breakup.
7. There were a number of deficiencies with the company's safety management system (SMS), in which the hazards should have been identified and the associated risks mitigated.
8. The company did not conduct an annual risk assessment as required by its SMS; this increased the risk that a hazard could go undetected.
9. The Canadian Business Aviation Association (CBAA) audit did not identify the risks in the company's operations.

Findings as to risk

1. Lack of adequate instrument redundancy increases the risk of loss of control in single-pilot instrument flight rules (IFR) aircraft operations.
2. The pilot did not reduce his airspeed while attempting to maintain control of the aircraft; a lower speed would have allowed a greater margin to maximum operating speed (Vmo) while manoeuvring.
3. There were no quick-donning oxygen masks on board and the pilot was not wearing an oxygen mask at the time of the occurrence, as required by regulation.
4. If effective oversight of private operator certificate (POC) holders is not exercised by the regulator or its delegated organization, there is an increased risk that safety deficiencies will not be identified and properly addressed.

Other Finding

1. The approved maintenance organization (AMO) that was maintaining the aircraft did not have the approval to maintain PA-46 turbine aircraft.

Action Taken

Transport Canada

In November 2007, the responsibility for providing oversight of the Canadian Business Aviation Association (CBAA) was transferred from the Standards Branch to the National Operations Branch of Transport Canada (TC). In February 2008, a project manager was deployed to the National Operations Branch to develop and implement an oversight program of the CBAA. In January 2009, this person was appointed as the Chief of the Airlines Division in the National Operations Branch and continued to have overall responsibility for oversight of the CBAA. To assist, two operations inspectors were assigned directly to CBAA oversight responsibilities.

Following a review of the private operator certificate (POC) program on 11 March 2009, TC considered the findings of the assessment it conducted and originally closed on 21 September 2007 to have not been fully addressed. TC has taken steps to ensure the CBAA takes action to properly address outstanding findings.

In April 2009, TC initiated meetings, to be held monthly, between its inspectors and the CBAA to review occurrences and safety reports with a view to monitoring the CBAA's management of safety information, adherence to its processes and procedures, and follow-up of cases requiring corrective action.

Canadian Business Aviation Association

The CBAA undertook an internal review of the POC program in 2008 to identify areas beyond the scope of the 2007 TC assessment that could be subject to revision or amendment. As a result of that process, recommendations were made to improve certain areas. In keeping with those recommendations, the following changes have been implemented.

The CBAA has amended Part 2 of the Business Aviation Operational Safety Standards (BA-OSS) to eliminate ambiguities regarding audit frequency and to clarify where an updated risk profile is required and whether an audit, including a partial audit, is required. The requirement for a recurrent audit within one year from the initial certification audit has been added. These amendments also describe the process and procedure for determining POC validity based on audit requirements. In addition, the POC Program Manual (Section III, Audit Procedures) has been amended to describe how an audit for cause is convened and managed.

The CBAA reported having implemented changes to its accredited auditor program in the area of auditor oversight. It has adopted a quality assurance framework for the POC program, which has been documented in the POC Program Manual by adding a new section (Section IV, POC Program Quality Assurance (QA) Framework). This section describes CBAA's procedures for its Witness Audit program. The CBAA reports having established a procedure for monitoring the quality of the CBAA POC Program to provide assurance that audit activities are standardized and audit policies and procedures are uniformly applied.

Safety Concern

In this occurrence, a single pilot was flying a turbine aircraft at high speed and altitude in instrument flight rules (IFR) conditions, for which autopilot availability was mandatory. Both the autopilot and the primary attitude instrumentation were dependent upon the same gyro. In the event of a failure of the primary gyro, the pilot would not only have to fly the aircraft manually, he would also have to immediately transition to either partial panel flying or make use of the backup gyro/horizon in the co-pilot's panel. Both options are demanding.

Partial panel flying expertise can only be acquired through training and experience, while using the co-pilot's instrument is not recommended due to parallax associated with panel width. The likelihood of a pilot being overwhelmed by the complexity of this situation and becoming task saturated is significant.

There appears to be at least two alternatives to resolving this safety deficiency. Either additional redundancy is required—probably by separating the input sources for the autopilot and gyro/horizon—or there needs to be an assurance that the pilot is proficient in partial panel flying.

This pilot had not practiced partial panel flying for a number of years and was not required to do so for his IFR renewal. Indeed, it is likely that he had not been required to demonstrate partial or limited panel skills since either his original commercial pilot test or his initial instrument training. Such skills deteriorate over time if not exercised.

Many high-performance aircraft in Canada are operated in IFR conditions by single pilots. The Board is therefore concerned that, without either additional instrument redundancy, partial panel currency, or both, there is a risk that this type of accident will be repeated.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 03 November 2009.