Socata TBM-900

The commercial pilot and his wife departed New York in their turboprop airplane on a crosscountry flight to Florida. About 1 hour 40 minutes into the flight and while cruising at flight level (FL) 280, the pilot notified air traffic control (ATC) of an abnormal indication in the airplane and requested a descent to FL180. The responding controller instructed the pilot to descend to FL250 and turn left 30°, and the pilot acknowledged and complied with the instruction; he then again requested a lower altitude. Although the pilot declined emergency handling and did not specify the nature of the problem, the controller independently determined that the flight had encountered a pressurization issue and immediately coordinated with another ATC facility to clear nearby traffic. The controller then issued instructions to the pilot to descend to FL200 and change course; however, the pilot did not comply with the assignments despite acknowledging the instructions multiple times. The pilot's failure to comply with the controller's instructions, his long microphone pauses after concluding a statement over the radio, and his confusion were consistent with cognitive impairment due to hypoxia. Further, the pilot's transmissions to ATC indicated impairment within 2 minutes 30 seconds of reporting the abnormal indication, which is consistent with the Federal Aviation Administration's published time of useful consciousness/effective performance time ranges for the onset of hypoxia. Military airplanes were dispatched about 30 minutes after the pilot's final transmission to ATC to intercept and examine the airplane. The pilots of the military airplanes reported that the airplane appeared to be flying normally at FL250, that both occupants appeared to be asleep or unconscious, and that neither occupant was wearing an oxygen mask. Photographs taken from one of the military airplanes revealed that the airplane's emergency exit door was recessed into the fuselage frame, consistent with a depressurized cabin. The military airplanes escorted the airplane as it continued on a constant course and altitude until it approached Cuban airspace, at which point they discontinued their escort. Radar data indicated that the airplane continued on the same flight track until about 5 hours 48 minutes after takeoff, when it descended to impact in the Caribbean Sea north of Jamaica. The flight's duration was consistent with a departure with full fuel and normal cruise endurance. Some of the wreckage, including fuselage and engine components, was recovered from the ocean floor about 4 months after the accident. Data recovered from nonvolatile memory in the airplane's global air system controller (GASC) indicated that several fault codes associated with the cabin pressurization system were registered during the flight. These faults indicated that the overheat thermal switch (OTSW), which was associated with overheat protection, had activated, which resulted in a shutdown of the engine bleed air supply to the cabin pressurization system. Without a bleed air supply to maintain selected cabin pressure, the cabin altitude would have increased to the altitude of the outside environment over a period of about 4 minutes. The faults recorded by the GASC's nonvolatile memory and associated system alerts/warnings would have been displayed to the pilot, both as discrete system anomaly messages on the crew alerting system (CAS) and as master warning and/or master caution annunciations. A witness report indicated that the pilot was known to routinely monitor cabin altitude while flying in the airplane and in his previous pressurized airplanes. Based on his instrument scanning practices and the airplane's aural warning system, he likely would have observed any CAS message at or near its onset. Thus, the CAS messages and the associated alerts were likely the precipitating event for the pilot's call to ATC requesting a lower altitude. The pilot was likely not familiar with the physiological effects of hypoxia because he had not recently been in an altitude chamber for training, but he should have been familiar with the airplane's pressurization system emergency and oxygen mask donning procedures because he had recently attended a transition course for the accident airplane make and model that covered these procedures. However, the pressurization system training segment of the 5-day transition course comprised only about 90 minutes of about 36 total hours of training, and it is unknown if the pilot would have retained enough information to recognize the significance of the CAS messages as they appeared during the accident flight, much less recall the corresponding emergency procedures from memory. Coupled with the pilot's reported diligence in using checklists, this suggests that he would have attempted a physical review of the emergency procedures outlined in the Pilot's Operating Handbook (POH). A review of the 656-page POH for the airplane found that only one of the four emergency checklist procedures that corresponded to pressurization system-related CAS messages included a step to don an oxygen mask, and it was only a suggestion, not a mandatory step. The combined lack of emergency guidance to immediately don an oxygen mask and the rapid increase in the cabin altitude significantly increased the risk of hypoxia, a condition resistant to self-diagnosis, especially for a person who has not recently experienced its effects in a controlled environment such as an altitude chamber. Additionally, once the pilot reported the problem indication to ATC, he requested a descent to FL180 instead of 10,000 ft as prescribed by the POH. In a second transmission, he accepted FL250 and declined priority handling. These two separate errors were either early signs of cognitive dysfunction due to hypoxia or indications that the pilot did not interpret the CAS messages as a matter related to the pressurization system. Although the cabin bleed-down rate was 4 minutes, the pilot showed evidence of deteriorating cognitive abilities about 2 minutes 30 seconds after he initially reported the problem to ATC. Ultimately, the pilot had less than 4 minutes to detect the pressurization system failure CAS messages, report the problem to ATC, locate the proper procedures in a voluminous POH, and complete each procedure, all while suffering from an insidious and mentally impairing condition that decreased his cognitive performance over time. Following the accident, the airplane manufacturer revised the emergency procedures for newly manufactured airplanes to require flight crews to don their oxygen masks as the first checklist item in each of the relevant emergency checklists. Further, the manufacturer has stated that it plans to issue the same revisions for previous models in 2017. The airplane manufacturer previously documented numerous OTSW replacements that occurred between 2008 and after the date of the accident. Many of these units were removed after the GASC systems in their respective airplanes generated fault codes that showed an overheat of the bleed air system. Each of the OTSWs that were tested at the manufacturer's facility showed results that were consistent with normal operating units. Additionally, the OTSW from the accident airplane passed several of the manufacturer's functional tests despite the presence of internal corrosion from sea water. Further investigation determined that the pressurization system design forced the GASC to unnecessarily discontinue the flow of bleed air into the cabin if the bleed air temperature exceeded an initial threshold and did not subsequently fall below a secondary threshold within 30 seconds. According to the airplane manufacturer, the purpose of this design was to protect the structural integrity of the airplane, the system, and the passengers in case of overheat detection. As a result of this accident and the ensuing investigation, the manufacturer made changes to the programming of the GASC and to the airplane's wiring that are designed to reduce the potential for the GASC to shut off the flow of bleed air into the cabin and to maximize the bleed availability. Contrary to its normal position for flight, the cockpit oxygen switch was found in the "off" position, which prevents oxygen from flowing to the oxygen masks. A witness's description of the pilot's before starting engine procedure during a previous flight showed that he may not have precisely complied with the published procedure for turning on the oxygen switch and testing the oxygen masks. However, as the pilot reportedly was diligent in completing preflight inspections and checklists, the investigation could not determine why the cockpit oxygen switch was turned off. Further, because the oxygen masks were not observed on either occupant, the position of the oxygen switch would not have made a difference in this accident.