Cessna Citation Tamarack Winglets Safety; a loose screw?
Updated: Dec 12, 2021
In the Aviation world there are many engineering activities going on that improve existing certified aircraft types or optimise them to a specific type of operation. The many cargo conversions are a good example. Another example is performance improvement of an existing aircraft type.
This can be accomplished in a number of ways; by structural, powerplant or aerodynamic modifications.
As simple as some may look externally, there is more engineering and certification work behind them than meets the eye.
A popular performance enhancement are the addition of winglets.
This may look like a simple modification by replacing wingtips by a snazzy looking winglets.
There are many changes in characteristics as a result;
Change in stall speed which affects take off and landing speeds, requiring a Aircraft Flight Manual (AFM) supplement
Change in landing and take off distances
Change in climb performance and service ceilings, possibly affecting pressurisation and engine controls
Change in range and speed as a result of altered L/D curve
Increase in Wing bending moments, affecting structural damage tolerance characteristics and life, requiring AWL supplement.
Change in aerodynamic load spectrum, requiring (apart from a damage tolerance review as indicated above) certified damage limitations review, resulting in Structural Repair Manual (SRM) supplements.
In addition to the above analyses, conformation flight tests have to be conducted in order to confirm flutter resistance and flight handling characteristics throughout the flight envelope.
Tamarack Aerospace Group (formerly Cranfield Aerospace) took this a step further with an advanced aerodynamic improvement for the Cessna Citation 525 (also called a "nearjet" in some circles due to the simplicity of its design)
The Tamarack "Active Winglet" design consists of a wing extension, increasing the wing span of the aircraft, which increases the wing aspect ratio, hence reduces induced drag and adds a winglet which further reduces induced drag.
These modifications also increase the Wing bending Moment.
With the increased Wing bending moment, possibly some gust loads at maximum load conditions would exceed the load capabilities of the existing wing structure.
As a mitigation, Tamarack incorporated a active load alleviation system , which consists of added active tip surfaces in the wing extensions. With vertical gusts, the active surfaces deflect upward, thus reducing the wing bending moment to normal levels. Tamarack calls the system "Active Technology Load Alleviation System" (ATLAS)
In above picture the added active load alleviation surfaces can be seen in red on the aircraft.
In below picture, one can see a close up of the same load alleviation surface, called a "Tamarack Active Camber Surface" (TACS)
Load alleviation systems are not new; all Airbus models, Boeing new generation aircraft like 787 have it, as well as many smaller aircraft form the Bombardier and Dassault product line. They al operate the same way; when a vertical gust exceeds a certain limit, the outboard ailerons deflect upward symmetrically to reduce wing bending thus not affecting normal control of the aircraft. In larger modern airliners and corporate aircraft, this is incorporated into the flight control software, using the ailerons and the load alleviation system has the same redundancy as the other elements of the flight control system.
On the Cessna 525, this system has been retrofitted by a SB issued by Tamarack and certified as Supplemental Type Certificate (STC).
Below is the EASA STC list where the modification is indicated
The certification basis for the modification is indicated as follows:
"The Certification Basis for the original product as amended by the following
additional or alternative airworthiness requirements:- Special Condition(s):C525 . CRI A-08 Team Involvement· . CRI B-01 Handling Requirements for CS-23 High
PerformanceAeroplanes· . CRI B-02 High Speed Characteristic..."
This indicates that the system has been certified against CS-23 (normal category aircraft) with a number of CRI's (Certification Review Items). These CRI's are not publicly accessible but the titles indicate that special emphasis has been put on Aircraft handling and high speed characteristics (flutter).
An STC holder (the organisation that designed and sold the product) not only has the responsibility for initial airworthiness compliance but also for continuous product safety assessment and continuous airworthiness. Very much the same as TC (Type Certificate) holders or aircraft manufacturers.
Part of this responsibility is a safety assessment of the design in terms of failure mode and effect analysis. In other words how can the system fail and how are the effects mitigated..
Notice that the Cessna 525 is a CS-23 / FAR-23 certified aircraft. These are less stringent certification requirements than for large aircraft in terms of System Safety Assessment.
Put a pin on this.
On 13 April 2019, a Cessna Citation equipped with above described system departed and had a failure of the ATLAS system.
Fortunately the flight landed safely and the incident could be analysed by the British Air Accident Investigation Branch (AAIB), one of the worlds most capable and independent aviation investigatory entities. AAIB report for your convenient download;
An abbreviated description of the flight;
History of the flight
Shortly after departure from Bournemouth airport the aircraft violently rolled left. Controlled flight could then only maintained by the pilot by applying full Right hand aileron and keep it fully deflected and applying full right rudder to regain control fo the aircraft. During the remainder of the flight, the full right aileron had to be maintained but the amount of right rudder could be modulated to maintain controlled flight.
During interviews with the pilot, he stated that an earlier event occurred on the same aircraft but cleared itself and never re-occurred until the aforementioned event.
The AAIB report comprehensively describes the event, the certification activities, system operation description and analysis of the individual components post removal from the aircraft.
The report contains many elements contributing to the event but we discuss in this blog the airworthiness elements;
The system was designed in the USA but due to the shorter certification lead times it was decided to apply for initial certification in the UK through an EASA Part21 (design) organisation.
The STC holder flight tested the following failure modes;
Maximun symetric deflection
Maximum dual asymmetric deflection (left up, right down)
Maximum dual asymmetric deflection (right up, left down)
HoweverEASA indicated that individual failures were tested as dual simultaneous failures were "extremely improbable" due to the predicted failure rates of the individual components.
Failure flight tests were conducted maintaining standard reaction times of three seconds.
The flight tests reports indicated that the handling characteristics as a result of these failures were benign and easily controllable, however the Aircraft Flight Manual Supplement (AFMS) specifies a very particular recovery technique that needs to be familiar with and should be subject to training.
During the investigation, it appeared that there had been four similar events of in flight system failures which had been recovered by the pilots safely.
The ATLAS system operates independent of all other aircraft systems.
On each wing there is a TACS, operated by an electromechanical actuator, called TACS Control Unit (TCU) which actuate the deflection of the TACS surfaces through a mechanical linkage. Both TACS surfaces are not mechanically linked
Both TCU's are controlled by a single ATLAS Control Unit (ACU), mounted near the centre of gravity of the aircraft. In the ACU are a couple of accelerometers; when a vertical acceleration is measured, exceeding trigger values, the TCU's receive signals from the ACU to operate in the desired direction (within 0.1 second). Remember; this should always be symmetrical!
When the TCU's are de-powered, they can be back driven by hand.
There is also a fault warning system in the form of a lighted button on the left hand instrument panel, containing the text "ATLAS INOP". When a faulty in the system is detected by the ACU, the button illuminates.
When pressed once, the fault is cleared from the ACU and the system resets and the light will extinguish.
When pressed three times within three seconds, the system will initiate a self test sequence.
The system has three circuit breakers that can de power the system. If that is done in flight, the TACS surfaces are floating and can get stuck in a fully extended position due to the position of the mechanical hinge aft of the aerodynamic centre of the TACS.
During post event analysis one TCU failed tests and technicians noticed something rattling in the unit. Upon opening of the unit, a printed circuit board (PCB) attachment screw was found dislodges and rattling around in the unit, landing on the circuit board, causing random and intermittent short circuits on the board, among which the surface hardover could have been caused.
Further investigation, removed the circuit board and installed it in another TCU. Upon power up, that TCU immediately moved to its hard stop. Subsequently, the individual components from this circuit board were tested individually and damage was found to a chip caused by the loose screw. In addition the manufacturer of the unit and it was found that a short in the connector head of the unit could cause the TACS to move to the mechanical stop during de powering (by pulling the circuit breaker in flight). As the TACS is back drivable and not fairing under aerodynamic load, this will result in a fully extended TACS for the remainder of the flight.
Fatal Accident in Indiana
BEFORE above accident, 30-Nov-2018, a fatal accident occurred in Indiana with a Cessna 525 Citation, killing the pilot and his two passengers. The NTSB report was released 1-November-2021. Nearly three years after the event, during which time the UK incident occurred.
Interestingly, the NTSB report does not contain any safety recommendation
Below is the NTSB report for your convenient download
The aircraft was equipped with the Tamarack ATLAS Advanced Technology Load Alleviation System.
The aircraft was subject to a rolling moment while climbing out at 240 knots
The rolling moment was not stopped and the aircraft dove into the ground at very high speed, destroying the aircraft and killing all aboard.
The investigation revealed that the left TCU was on its hard stop, trailing edge up on impact.
The left TACS surface showed signs of over travel.
The pilot had the clarity of mind to make a radio call just before his death, stating that he was unable to regain control of the aircraft.
The NTSB report content is disputed by Tamarack.
EASA issued an emergency AD 2019-0086E on 19-April-2019, which was later amended into AD 2019-0086R1 dated 9-Aug-2019.
The AD tells operators to:
Deactivate the ATLAS system and mechanically lock the TACS surfaces in the faired position and fly the aircraft with limitations.
There is a 100 Flight Hour interval reinspection of this mechanical lock
Optionally the system can be reactivated after modification of the system
Below the EASA AD
FAA issued AD 2019-08-13 on 20-May-2019, grounding all Tamarack ATLAS equipped Citations.following Mandatory Continuing Airworthiness Information (MCAI) 'By another country". This is supposedly the UK following the safety recommendations from the AAIB report.
28-December-2020, FAA issued AD 2020-24-06, superseding AD 2019-08-13
The current AD 2020-24-06 content is different from the EASA AD, addressing the same unsafe condition.
It stipulates to:
Replace affected TCU's
Determine whether TACS centering strips have been installed and if not, to modify the installation.
In the preamble section of the FAA AD, there is a fair bit of text indicating pushback from STC holder, Tamarack. See text below copied from the AD preamble:
Tamarack requested the FAA correct a statement in the preamble of the NPRM that the April 13, 2019 incident exposed a failure mode of the ATLAS that was not anticipated during certification:
"Tamarack commented this statement in the NPRM implies that only the worst case condition was tested while other less critical conditions were not. The commenter further stated that the failure mode that occurred on April 13, 2019 was tested during certification and shown to be recoverable. The commenter discussed the investigations and flights tests conducted by EASA and stated this data was reviewed and validated by the FAA before the FAA issued AD 2019-08-13.
The FAA partially agrees. The FAA issued AD 2019-08-13 on May 20, 2019. The FAA had
received flight path data for the UK incident aircraft; however, this data did not provide any information about the operation of the ATLAS system during the incident. Therefore, it was not considered in the development of the FAA AD. No other information about the operation of the ATLAS system during this incident has been provided to the FAA."
"The FAA received the root cause report mentioned by the commenter on April 22, 2019, which deemed further investigation was warranted to determine if the actions specified in Cranfield's service bulletin mitigated the unsafe condition. Many discussions between the FAA and EASA occurred before and after the issuance of AD 2019-08-13. Given that the Cranfield service bulletin did not contain adequate instructions for the use of “speed tape” to prevent the TACS from floating, the FAA found it unacceptable for correcting the unsafe condition. Instead of delaying action to address the unsafe condition to wait for testing of the “speed tape,” the FAA issued AD 2019-08-13 to ground the affected airplanes, knowing that operators could request an alternative method of compliance when substantiating data became available or when the investigation was complete.
The FAA did not make changes to this AD based on this comment."
Below the FAA AD
In both events the pilot was completely surprised by the ATLAS system failure and reacted intuitively, but not in accordance with the published supplemental AFM procedure, thus unwillingly exacerbating the emergency
The AFM supplement stipulates a very specific recovery technique, one of which is to chop the throttles and reduce speed to 140 knots. On the aircraft, a normal climb out speed is around 250 knots. The speed reduction moves the aircraft into a speed regime where the upset is manageable, however it is way slower than normal operating speeds. It begs the question, how realistic the recovery is for a normally dormant flight control subsystem malfunction
Part of an inflight failure recovery is pressing the lighted button in order to reset the system. The pilot in the survivable (UK) event was not familiar with this and the above bullet point. Additional flight training would be the prudent thing to mandate
The extremely delayed NTSB report was most likely caused by disagreements from the STC holder who obviously tried to dispute findings and conclusions from the NTSB and water down the proposed airworthiness measures. This has no doubt a negative effect on product safety.
Clearly, the complexity of the ATLAS system and its potential effect on flight handling (absent on the standard type) is underestimated by operators and pilots.
Lastly; it would be in the interest of flight safety if the organisation in the hot seat would just cooperate with an independent investigation and not try to contest conclusions