Unlikely failures

In his memoir Fighting the Flying Circus, World War I ace Eddie Rickenbacker recalled choosing to dispense with the safeguard of dual ignition systems and take off with one bad magneto. The rationales—or rationalizations—for such compromises are rarely as urgent as the duty to fly a combat mission. The decision typically rests on weighing a risk perceived as low against consequences that could be dire. Both history and psychological research have shown that most people don’t naturally do that well.

When it can’t be conclusively determined how an apparent system failure brought down a sophisticated aircraft flown by an expert pilot, we’re left to wonder: Was it the incredibly bad luck of multiple layers of safeguards malfunctioning independently? Or did that pilot knowingly relinquish some of the margins designed into the aircraft?

On the morning of June 4, 2023, a Cessna 560 flew from its base in Melbourne, Florida (MLB) to Elizabethton, Tennessee (0A9) to pick up three passengers. The 69-year-old solo pilot was exceptionally well qualified. A retired airline captain, he’d listed 34,500 hours of flight time that included 29,000 as pilot-in-command, 28,000 in multiengine airplanes, and 450 hours in the past year on the insurance application he’d filed a month earlier. He held type ratings for the Boeing 737, three Cessna Citation models, and two regional airliners. On April 15, he completed a flight review and instrument proficiency check in a Cessna 560 Ultra, receiving his single-pilot waiver the same day.

The aircraft was refueled and the passengers boarded: the daughter and granddaughter of the jet’s new owners and the granddaughter’s nanny. They took off at 1:13 p.m. local time, cleared as filed to the Long Island Macarthur Airport (ISP). At 1:21, level at FL230, the Citation was handed off to a different sector within Atlanta Center. The pilot read back clearances to climb to FL290, then, at 1:25:47, to FL340.

Less than three minutes later, at 1:28:30, the controller directed the pilot to stop at FL330 for crossing traffic. There was no reply. The Citation continued to climb, levelling off at FL340. Repeated attempts to reestablish radio contact on both Center and guard frequencies were unsuccessful. The jet continued along its filed route, maintaining FL340 as it crossed over Long Island at 2:32 p.m. and turned southwest on a heading of about 240 degrees—back toward Elizabethton.

Two Air Force F–16 fighters dispatched to intercept the Cessna reached it at about 3:20. Their pilots saw “no holes in the aircraft, windows missing, nor doors missing…no smoke or vapor trailing the airplane….There was no frost observed on the cockpit windscreens, nor…frost observed on the passenger windows. The cockpit appeared to be clear inside and no smoke was observed inside the aircraft.” Although the shades were up, no one could be seen through the cabin windows. The only person visible was in the cockpit’s left seat, “laying and slumped completely over into the right seat.” The fighter pilots couldn’t see whether this person—presumably the pilot—was wearing either an oxygen mask or a headset, or whether any warning lights were “flashing” in the cockpit.

The pilot remained unresponsive throughout radio calls, intercept maneuvers, and flare deployment. After about two minutes the Citation “began a slow roll to the right” that steepened into a spiral dive. Its rate of descent passed 6,000 feet per minute before it entered an undercast at 7,000 feet; “an area of gray smoke was observed” shortly afterwards. Searchers found a small debris field of extensively fragmented wreckage further damaged by fire on a mountainside near the Montebello VOR. Damage to the surrounding trees indicated a near-vertical descent.

The NTSB concluded that the pilot had succumbed to hypoxia after a loss of cabin pressure but could not tell whether the depressurization was gradual or sudden. Almost no components of either the cabin pressurization or emergency oxygen systems could be identified in the wreckage. Scrutiny of the airplane’s maintenance records and interviews with mechanics who had serviced the aircraft, however, turned up some troubling details.

The 1990-model airplane had been exported to Venezuela in 2015 and reimported in 2023. Its airworthiness certificate was reissued on February 3 with all items on its Conformity Inspection Record (FAA Form 8100-1) marked “satisfactory.” Installation of a new Garmin avionics suite was completed on April 11, and it was registered to its new owners on April 28. The accident pilot subsequently advised the owners that the new avionics would shut off after a few hours of operation and radio function was intermittent. On May 11, he brought the airplane to a shop in Brookville, Florida, where the technicians conducted a walk-around inspection. They did not remove any panels or other components.

The pilot and mechanic who’d helped facilitate the sale told investigators that the day before the crash, the accident pilot had told him that “everything was great with the airplane,” adding, “I love it.” The mechanics in Brookville, however, said that on May 11, the pilot expressed “a lot of concerns” about the prepurchase inspection and wanted a second opinion. Their walk-around produced a list of 26 discrepancies including “major fuel leaks” on the bottoms of both wings, a protruding seal around the emergency exit door, and a disconnected aspirator line between the pressurization system’s air cycle machine (ACM) and humidity regulator (which would not have directly compromised cabin pressurization). The pilot advised the new owners but said he believed correcting these conditions was the seller’s responsibility.

On June 2, the Citation returned to Brookville to address the avionics problems. The mechanic who entered the cockpit found “the Garmin displays were so hot, he could not touch them,” according to the NTSB report. Remedying this would require reconfiguring the panel to reinstall the cooling fan, a two-week job they scheduled to begin on June 12. In the meantime, none of the discrepancies observed three weeks earlier were corrected. The mechanic also noticed that the pilot’s-side oxygen mask was missing and the emergency oxygen supply was down to its minimum serviceable level.

According to the airplane’s continuous airworthiness maintenance program, the co-pilot’s mask had been due for inspection by May 31. There is no record of that inspection having been performed or the oxygen bottle serviced before the accident, and it’s not known whether the pilot had removed his mask before the avionics inspection or had flown to Brookville without it.

It is perhaps equally difficult to believe that a pilot of his experience would have knowingly departed on a high-altitude flight without a quick-donning mask or usable oxygen supply, or that the cabin pressurization and emergency oxygen systems failed on the same flight. The cabin pressure warning would have alerted once cabin altitude exceeded 10,000 feet, suggesting pressure was maintained until around the time of his last radio transmission. Whether you think a high-time pilot might have been willing to chance climbing into the mid-thirties without backup oxygen probably depends on your view of human nature. The broader accident record is not encouraging.

David Jack Kenny is a former statistician for the AOPA Air Safety Institute. He owns a 1967 Piper Arrow and has flown 265 dogs on rescue flights for Pilots N Paws.