Manufacturer's Inadequate Software Design Requirements Of The Engine's Full Authority Digital Electronic Controls (FADEC) Fault Logic

Location: Chicago, Illinois Incident Number: CHI08IA152
Date & Time: June 5, 2008, 13:00 Local Registration: N612KB
Aircraft: Eclipse Aviation Corporation EA500 Aircraft Damage: None
Defining Event: Powerplant sys/comp malf/fail Injuries: 4 None
Flight Conducted Under: Part 91: General aviation - Business

Analysis: The flying pilot of a very light jet airplane encountered windshear and a high sink rate on approach which he arrested by applying engine power. During landing he lightly applied brakes and observed that the airplane was accelerating. The pilot initiated a go-around. The engines were at maximum power and the crew alerting system illuminated left and right engine control failure messages. The automatic power reserve armed light was also illuminated. The crew maneuvered the airplane and troubleshot the engine control fail indication using the quick reference handbook while on downwind. The right engine was shutdown and the left engine would not respond to throttle movements during the remainder of the incident flight. The crew subsequently completed the emergency landing. On scene and subsequent throttle quadrant assembly examinations showed the assembly could produce an out of specified range signal when the throttles had forward force applied to them. Diagnostic storage unit data showed both engines' full authority digital engine control (FADEC)s encountered a fault signal from the engine controls about the time of the pilot's reported application of the throttles in response to the windshear during the incident approach. The airplane's FADEC fault logic was designed to "latch" or hold the last good value when the upper specified parameter limit was exceeded.

The data showed the left engine went to flight idle when the right engine was shut down in accordance with the fault logic. The airplane's design was Federal Aviation Administration (FAA) certified with that fault logic. As a result of the investigation, the National Transportation Safety Board issued two urgent recommendations to the FAA. A-08-46 recommended an immediate inspection of all throttle quadrants to ensure that pushing the throttle levers against the maximum power stops will not result in an engine control failure, and further require that any units that fail the inspection be replaced and that the replacement parts be similarly inspected. A-08-47 recommended an immediate emergency procedure for a dual engine control failure on the incident airplane model and incorporate the procedure into the airplane flight manual and quick reference handbook via an airworthiness directive.

Probable Cause and Findings: The National Transportation Safety Board determines the probable cause(s) of this incident to be -- The airplane manufacturer's inadequate software design requirements of the engine's full authority digital electronic controls (FADEC) fault logic that resulted in a simultaneous unrecoverable loss of thrust control on both engines when the FADEC's input data values exceeded specified ranges during the approach. Contributing to the incident was the Federal Aviation Administration's failure to recognize and correct this condition during the certification of the airplane.

FMI: www.ntsb.gov