Aviation Investigation Report A10O0101

The Cirrus SR20 aircraft (registration C-GYPJ, serial number 1008) departed from the Toronto Buttonville Municipal Airport on a return flight to the Burlington Airpark, Ontario. Shortly after takeoff from Runway 15 the pilot reported a problem and initiated a left turn to return to the airport. At 1225 Eastern Daylight Time, the aircraft crashed onto the rooftop of a nearby building. A post-crash fire broke out shortly after impact and consumed most of the aircraft. The two occupants were fatally injured. Approximately 15 minutes after impact there was an explosion as the rocket from the Cirrus Airframe Parachute System ignited from the heat of the fire.

History of Flight

On the morning of the occurrence, the pilot and passenger flew from Burlington Airpark to the Toronto Buttonville Municipal Airport to have some radio work done on the aircraft. Once the work was completed, the pilot and two aircraft maintenance engineers carried out engine runs as a final check. Everything appeared to be functioning properly. The pilot and passenger then boarded the aircraft and prepared to depart for Burlington Airpark.

At approximately 1225^{Footnote 1} the aircraft was cleared for takeoff from Runway 15. Shortly after takeoff the pilot reported a problem and decided to return to the airport. As the aircraft target did not appear on radar, it is estimated that the aircraft did not reach an altitude of more than 500 feet above ground level (agl). Light grey smoke emanated from the aircraft as it started a shallow climbing left turn. The airport tower controller attempted to contact the aircraft, without success. The tower controller cleared the aircraft to land on any runway.

The aircraft's bank angle increased and its nose dropped suddenly. The aircraft descended quickly and entered a spin. Just before striking the building rooftop, the wings levelled and the nose came up. Approximately 5 minutes after impact a fire ensued. Fire and emergency services arrived within 10 minutes.

Approximately 15 minutes after impact there was an explosion: the heat of the fire had ignited the rocket from the Cirrus Airframe Parachute System (CAPS). Still partially tethered to the airframe by stainless steel cables, the rocket ricocheted across the roof before breaking free of the cables and landing in the street approximately 165 feet from the crash site.

Weather

The weather at the time was suitable for visual flight and was not considered a factor in this occurrence.

Pilot Information

Records indicate that the pilot was certified and qualified for the flight in accordance with existing regulations. The pilot held a private pilot license issued on 16 January 2009 valid for visual flight by day and night on all piston-powered, single-engine land airplanes. The pilot had accumulated approximately 225 hours of total flying time, including 100 hours on the SR20 aircraft. All of the pilot's initial training was completed on a Cessna 172, a slower aircraft with different handling characteristics than those of the Cirrus SR20. There is no indication that the pilot took any additional training on the Cirrus SR20.

Passenger Information

Records show that the passenger was also a licensed private pilot. The license was issued on 30 April 2010 and was valid for all piston-powered, single-engine land airplanes.

Aircraft Information

The aircraft was manufactured in 1999 and purchased by the pilot in March 2009. Records show that the aircraft was certified, equipped, and maintained in accordance with existing regulations and approved procedures.

The aircraft was used regularly by the pilot over the year following its purchase. During that period, the pilot flew approximately 100 hours, all of these on the incident aircraft. The last annual inspection was carried out in March 2010 at a total airframe time of 2201.1 hours. During the inspection the oil, oil filter and spark plugs were replaced and a compression check was carried out; no anomalies were detected.

During this last inspection, the pilot pointed out that there appeared to be an oil leak on the forward right cylinder. However, no leak could be found during the inspection and subsequent engine runs. Some minor defects were found on the aircraft during the inspection, all of which were repaired prior to the release of the aircraft. At the time of the accident, the last recorded total airframe time on 17 May 2010 was 2221.1 hours.

The aircraft was equipped with a Teledyne Continental Motors (TCM) model IO-360-ES engine, S/N 357146. At the time of the occurrence flight, it had accumulated a total of approximately 2221 flight hours, and 715 hours since it had been overhauled. The recommended time between overhauls by the manufacturer for this type of engine is 2000 hours.^{Footnote 2} This engine was overhauled early in 2005 due to a propeller strike. The original TCM cylinders were not replaced at this time. However, they were honed to 0.015 inches oversized and new TCM oversized pistons and rings were installed.

The Cirrus SR20 aircraft is equipped with an airframe-mounted emergency parachute system; the following description is taken from the Airplane Information Manual (AIM) for the Cirrus Design SR20:

The Cirrus Airframe Parachute System (CAPS) is designed to lower the aircraft and its passengers to the ground in the event of a life threatening emergency. However, because CAPS deployment is expected to result in damage to the airframe and, depending upon adverse external factors such as high deployment speed, low altitude, rough terrain or high wind conditions, may result in severe injury or death to the aircraft occupants, its use should not be taken lightly. Instead, possible CAPS activation scenarios should be well thought out and mentally practiced by every SR20 pilot.

The manual does not define a minimum altitude for deployment of the CAPS, because the actual altitude loss depends on the airplane's airspeed, altitude and attitude at deployment as well as other environmental factors. The AIM goes on to state:

As a guideline, the demonstrated altitude loss from entry into a one-turn spin until under a stabilized parachute was 920 feet. Altitude loss from level flight deployments was demonstrated at less than 400 feet. With these numbers in mind it might be useful to keep 2,000 feet AGL in mind as a cut-off decision altitude. Above 2,000 feet, there would normally be time to systematically assess and address the aircraft emergency. Below 2,000 feet, the decision to activate the CAPS has to come almost immediately in order to maximize the possibility of successful deployment. At any altitude, once the CAPS is determined to be the only alternative available for saving the aircraft occupants, deploy the system without delay.

The Cirrus SR20 aircraft was not certified for spin recovery; therefore Cirrus recommends deploying the CAPS if the aircraft departs from controlled flight.

Section 3 of the Cirrus SR20 AIM, "In-Flight Emergencies", gives the following information regarding in-flight emergencies:

Engine Failure On Takeoff (Low Altitude)

If the engine fails immediately after becoming airborne, abort on the runway if possible. If altitude precludes a runway stop but is not sufficient to restart the engine, lower the nose to maintain airspeed and establish a glide attitude. In most cases, the landing should be made straight ahead, turning only to avoid obstructions. After establishing a glide for landing, perform as many of the checklist items as time permits.

WARNING

If a turn back to the runway is elected, be very careful not to stall the airplane.

Wreckage Examination

The aircraft struck the top of the building in a slight nose-down attitude with the right wing low and an approximate heading of 300° magnetic. The aircraft struck a rooftop air conditioning unit, spun to the right and came to rest on a heading of approximately 060° magnetic. The post-crash fire destroyed most of the aircraft but there were no signs of any pre-impact failure of the flight control system that could have contributed to this accident.

The propeller blades were bent back and extensively damaged by fire. Damage was consistent with low or no power being produced by the engine at the time of impact.

Examination of the engine showed that the number 3 cylinder head had separated from the barrel (see Figure 1). The cylinder head remained held in place by the induction and exhaust systems. No other abnormalities were found with the engine that would have prevented it from producing power.

Image

Examination of the failed number 3 cylinder head showed it had failed near the second and third threads and there were visible signs of fatigue on the fracture surface; externally this would be at the roots of cooling fins 4, 5 and 6.^{Footnote 3}

The cylinder assembly consists of an aluminum head which is threaded onto a steel barrel. This is a tight interference fit that requires the head to be heated and the barrel cooled to predetermined values, after which they are fitted to a machine which screws the pieces together to a specified torque value. The interference fit assures an airtight seal of the mating surfaces. Once assembled, the cylinder assemblies are normally not taken apart.

All 6 of the cylinder heads were sent to the TSB Laboratory for a detailed metallurgical examination.

A high cycle fatigue crack originated from the notch ^{Footnote 4} created by the sharp edge of the steel barrel thread crest on the aluminum thread flank of cylinder 3. Once the crack dimension had grown to a critical size, the remaining load-bearing section could no longer withstand the load and the head separated in a single-cycle overstress. Although no specific defects were observed in the region of the cylinder where fatigue initiated, this region had post-fracture rubbing damage masking the original features.

The remaining cylinders were sectioned and examined; no signs of cracks were found in any of the remaining cylinders. It was determined that there would be no practical way of identifying any crack in this location without destructive testing. According to information received, this is the first crack of this nature on this series of engine.

Evidence of intergranular corrosion was found at several locations on the head threads of the cylinders; however, the origin of this corrosion could not be determined.

Emergency Response and Ballistic Projectiles

Airframe parachute systems installed on some aircraft (including the CAPS) provide occupants with an additional safety defence in the event of an in-flight emergency. As this occurrence has shown however, when the system has not been utilized before ground impact, a post-impact fire may cause the ballistic projectile to fire.

Information on the risks associated with the CAPS is available for first responders on websites maintained by Cirrus Aircraft ^{Footnote 5} and the FAA. In general, however, many first responders do not appear to be aware of these systems, nor are they trained in how to deal with them.

The following TSB Laboratory reports were completed:

• LP 077/2010 – Examination of Aircraft Cylinder
• LP 076/2010 – JPI Analysis

These reports are available from the Transportation Safety Board of Canada upon request.

While the aircraft was substantially damaged by fire, the wreckage examination did not reveal any pre-impact failures of the flight control systems that could have contributed to a loss of control of the aircraft.

The cylinder head failure of cylinder number 3 likely occurred during the later portion of the takeoff run or immediately following liftoff. Given the nature of the cylinder failure, the engine should have been capable of producing power with the remaining 5 cylinders; however, it could not be determined how much power would have been available.

Were corrosion damage to occur at a sharp corner of a burr on the aluminum thread (created by the contact with the steel barrel thread), a combination of factors favourable to fatigue could be initiated.

The fatigue crack in the number 3 cylinder head developed at the notch created by the steel threads of the barrel. Given its location, there are no practical means of non-destructive testing that would identify a crack. A crack in a cylinder head could go undetected and the engine would continue to operate normally until the crack reached a critical dimension, at which point the cylinder head would fail in overload without warning. This would result in a reduction of power, a rough running engine or a complete engine failure.

Given the dense build-up around the airport, the pilot likely decided the best course of action was to attempt to return to the airport. This would have required the pilot to induce significant bank, thereby increasing the speed at which the aircraft would stall. This is consistent with the behaviour of the aircraft after liftoff. The bank angle increased significantly, the aircraft stalled and entered a spin at an altitude from which recovery was impossible.

There is no evidence to suggest the pilot attempted to use the CAPS. Given the low altitude of the aircraft, it is likely that the CAPS would not have deployed completely.

While airframe parachute systems provide aircraft occupants with an additional safety defence in the event of an in-flight emergency, the ballistic projectiles that trigger these systems introduce additional risks. In this occurrence, a post-impact fire ignited the projectile; but ignition could also occur because of damage to the aircraft or as a result of first responder activities. Unless first responders are aware that some aircraft may be equipped with ballistic projectiles, and are trained in how best to deal with them, they will be placed at risk if there is ignition.

Findings as to causes and contributing factors

1. The number 3 cylinder head failed in fatigue and separated from the cylinder during takeoff, resulting in reduced power from the engine.
2. While manoeuvring, the aircraft stalled and entered a spin at an altitude from which recovery was impossible.

1. There is no practical, non-destructive method of testing the threads of cylinder heads for cracks. This could lead to cracks going undetected and result in the failure of the cylinder.
2. The Cirrus Airframe Parachute System activated post impact as a result of the post-crash fire and the rocket projectile landed in the street. Unless first responders are aware that some aircraft may be equipped with ballistic projectiles, and are trained in how best to deal with them, they will be placed at risk if there is ignition.

Transport Canada

Transport Canada has prepared and will publish an article in its July issue of the Aviation Safety Letter to provide first responders with safety information on rocket-deployed aircraft emergency parachute systems.

This report concludes the Transportation Safety Board's investigation into this occurrence. Consequently, the Board authorized the release of this report on 21 January 2011.