In Part 1, we discussed a loss-of-control accident involving a Cessna Citation CJ2 and the NTSB’s investigation into it.

As is common with most business jets of this size, a flight data recorder (FDR) was not installed. An aircraft performance specialist at the NTSB used ADS-B data to reconstruct the airplane’s flight path and tied in EGPWS aural alerts taken from the CVR as well.

The performance study calculated the airplane’s airspeed to be 240 kt. when the roll began, and its roll rate to be 5 deg. per second. This roll rate was significantly less than the roll rate achieved during flight test of the Tamarack Atlas system.

During those certification test flights, a roll rate of greater than 20 deg. per second was achieved with a speed of 240 kt., an initial bank of 30 deg., an adverse fuel imbalance, and almost full asymmetric deflection of the TACS. The test pilots were able to safely recover from this condition.

The performance study also determined that because the airplane continued to climb after the roll onset, the pilot did not reduce thrust. As the airplane rolled and began to descend, the airspeed continued to increase rapidly, consistent with thrust still being applied. Only 39 sec. elapsed from the time the roll began until the airplane crashed.

The study showed that the airplane began to roll back to the right just before it crashed, going from 90 deg. to about 53 deg. of bank. It was possible that the pilot was attempting to roll the airplane back toward wings level, but his effort was not enough to fully recover and stop the descent. Without the parameters of control surface deflection and pilot input that would be provided by an FDR, the pilot’s actions could not be determined with certainty.

An NTSB meteorologist found that cloud tops were near 10,000 ft., meaning the airplane would have been in instrument conditions for most of the short flight. In addition, light to moderate turbulence was present.

The pilot, who was 32 years old, had an airline transport pilot certificate with a Cessna 525 type rating. He completed the type rating at SimuFlite nine months before the accident and three months before the winglets were installed. He reported 3,500 hr. of total flight time when he obtained his last Class 1 medical certificate in March 2018. His logbook was not recovered.

According to FAA records, the pilot had flown the Raytheon 390 and Cessna 510 as a single pilot and had a current flight instructor certificate. There were some discrepancies in his flight time reported to the FAA and it was not clear how much total jet flight time he had prior to qualifying on the Cessna 525A. Investigators did not review his training record at SimuFlite or interview instructors or other pilots who had flown with him.

An Atlas supplement to the CJ2 operating manual provided a procedure for when the ATLAS INOP button light came on.

The five-step procedure was:
(1) Throttles--IDLE
(2) Speed brakes--EXTEND
(3) AP/TRIM disc button--PUSH
(4) Maintain lateral control
(5) Airspeed--REDUCE TO 161 KIAS OR LESS
The supplement also provided a warning: “LARGE AILERON INPUT MAY BE REQUIRED IF AN ATLAS FAILURE AT HIGH INDICATED AIRSPEED INCLUDES A TACS RUNAWAY” and “SPEED REDUCTION IS THE FIRST PRIORITY IN THESE FAILURE CONDITIONS.”

Other Incidents Involving Atlas
The NTSB systems group found five other incidents of Atlas-related control problems. Two took place before the CJ2 accident and three were after it. In February 2018, a pilot recovered after an uncommanded 30-deg. bank.

In August of that year, another pilot reported needing full aileron input to recover after an uncommanded roll. A pilot reported a violent roll in February 2019, and in March 2019, a pilot reported what he thought was an autopilot hardover with a bank of less than 45 deg. In April 2019, a pilot reported needing large yoke forces to recover from a 90-deg. bank.

Investigators did not find any record of an uncommanded roll event for the Cessna CitationJet 525 fleet without the Atlas system installed.

The April 2019 event took place in Bournemouth, England, and was investigated by the Air Accident Investigation Board (AAIB) of the U.K. The upset was quite similar to the Indiana accident. The airplane rolled sharply shortly after takeoff and descended rapidly, but the pilot was able to recover the airplane at an altitude of 2,300 ft. The AAIB found the left TCU failed due to a short circuit caused by a loose screw or washer within the unit.

Analysis and Findings
The NTSB’s analysis of the accident depended heavily on witness marks. Witness marks are marks or dents left when one object strikes another.

There were witness marks on the left TACS bell crank and inboard hinge fitting that resulted from the left TACS being overdeflected in the trailing-edge up position. Contact marks on the left TCU ram guide housing and extend hard plate stop also showed the left TACS was full up at the time of ground impact.

Marks on the right TCU ram guide housing showed the TCU was in a neutral position at the time of ground impact.

A 40-pin connector in the left TCU had six curled pins, which could have caused electrical power to the left TACS to be interrupted. A power interruption could account for the left TACS remaining extended when the right TACS was neutral. However, without fault recording capability in the Atlas system, the power interruption theory could not be verified.

The left TACS at full trailing-edge up and the right TACS in a neutral position accounted for the left roll. What caused this condition was not determined.

The pilot’s verbalizations and radio calls with ATC showed he was engaged in routine operations and was not impaired or procedurally deficient. He showed surprise when the autopilot disconnected and the roll began, and he said nothing for 15 sec. while the bank angle warning was sounding. He lacked a visible horizon, did not reduce engine power, and did not deploy the speed brakes. His failure to control the roll was likely a result of being startled and unable to recognize the cause of the roll.

The NTSB’s probable cause was “the asymmetric deployment of the left-wing load alleviation system for undetermined reasons, which resulted in an inflight upset from which the pilot was not able to recover.”

The Safety Board did not explain why the system malfunctioned and did not put forth any recommendations to fix the problem.

The NTSB’s final report was issued on Nov. 1, 2021. Two days later, Tamarack issued a press release strongly disputing the Safety Board’s findings.

It argued in the release that the active winglets were deployed properly and symmetrically as a result of a 2G load on the airplane and that examination of the winglet components confirmed this. Tamarack suggested that a failure in the AHRS might have caused the autopilot disconnect and that the pilot’s failure to reduce thrust made recovery from the upset more difficult.

In January, it filed a Petition for Reconsideration with the NTSB. In its petition, Tamarack alleges that forensic evidence cited in Tamarack’s supplemental party submission to the NTSB four days before the final report was released had been ignored or misinterpreted. 

“The agency relies on mere possible scenarios and misapplies scientific, engineering and design criteria to invent a probable cause statement that is simply wrong,” Tamarack said in its petition. The NTSB has 90 days to respond from the time of the filing.

One issue, Tamarack says, is that the NTSB report states that the autopilot prematurely disconnected at a 30-deg. bank angle, but the autopilot system threshold is 45 deg.—15 deg. more than the bank angle at which the jet’s autopilot disconnected. “Therefore, the autopilot clearly did not disconnect because of excessive bank angle,” Tamarack says.

After entering and exiting bankruptcy as a response to a temporary grounding of Atlas-equipped airplanes, Tamarack has rebounded and now boasts a list of about 150 customers. The benefits of the Tamarack winglets are undeniable. However, something caused multiple uncommanded rolls in Tamarack winglet-equipped airplanes, and uncertainty about the cause casts a shadow on the system. Let’s hope we figure that out before there are any more fatal accidents.

The pilot could not have received simulator training for a TACS asymmetry since his last simulator training was before Atlas was installed on his airplane. There’s also no requirement for such training for anyone. That’s a problem to be addressed.

The AAIB may have offered the best insight on both the Indiana accident and its own Bournemouth incident.
It pointed out that the test pilot’s preparedness for a TACS failure removed the time needed to diagnose and recognize it. Recognition time for unexpected events averaged 11 sec. in an FAA study, and the 1- to 3-sec. time expected during certification is unrealistic. The changes to certification standards as a result of the Boeing 737 MAX accidents should address this.

The AAIB also recommended that Tamarack improve its guidance for Atlas inoperative events and provide more detail about the escalating nature of TACS failures. It further recommended that both EASA and the FAA require additional training for airplanes fitted with supplementary systems like winglets and determine what that training should be.