On the 21st of January 2019, a Piper Malibu crashed into the English Channel near the island of Guernsey, killing both the pilot and the passenger on impact. Technically, this accident should have been investigated by the NTSB as the aircraft was registered in the US as N264DB. However, in this case, the NTSB delegated the investigation to the AAIB, as the operator of the aircraft was registered in the UK and it seemed very quickly clear that there were operational issues with this flight and the aircraft. The NTSB was still involved in the investigation as the state of the design and manufacture of the aircraft. The BEA was included as France had been supporting the search activities and the JIAAC appointed an expert as Argentina was representing the state of the nationality of the passenger. Both EASA and the UK CAA assisted the investigation.

Let’s deal with the aircraft first. The Piper PA-46-310P Malibu is a low-wing pressurised aircraft certified for flight up to 25,000 feet. The accident aircraft was owned by a US Citizen Corporate Trust. This trust was represented in the UK by a limited company of the same name. The “trustor” or beneficial owner was a British company who was responsible for the operation of the aircraft. This company hired a third-party company to deal with the day-to-day management of the aircraft, including maintenance. The oversight of the maintenance is the state of registration, in this case the US, even though the aircraft was operating in the UK.

The Piper Malibu was equipped with a Teledyne Continental TSIO-520-BE six-cylinder engine. The twin-turbocharged air-cooled engine was built in 1998 and had been fitted to another aircraft. In 2004, the engine was fitted to N264DB. As of the annual maintenance done at the end of November, two months and 11 flying hours before the accident, the engine had used up 1,195 hours of its 1,400-hour overhaul life.

The aircraft was operating under Part 91, which is private use only, rather than Part 121 for commercial flights. This means that the aircraft is only permitted to operate for non-commercial purposes. The aircraft was operated by the beneficial owner and managed by a third party; neither of these had an Air Operator’s Certificate and at no time was permission sought to allow the aircraft to be operated on a commercial basis. For private flying, the aircraft commander is trusted to consider faults and deficiencies before flying. Obviously the rules are quite a bit stricter for commercial flights.

Air Taxi or Air Charter flights are commercial operations, and regulatory safety standards are more stringent than for private flights. These standards include: more highly qualified pilots whose competence is checked more frequently; more stringent airworthiness requirements for aircraft; and more operational and engineering procedures to support operations.

A pilot flying for an airline (an AOC holder) is assessed every six months either in the air or in a simulator. To compare, pilots holding a private pilot’s licence generally only need to renew their flying ratings every 24 months.

The pilot and the passenger, an Argentine football player who had just signed with Cardiff City Football Club, met on Saturday, the 19th of January, at Cardiff Airport.

The passenger wished to spend the weekend in Nantes, where he had been living, returning to Cardiff on Monday ready for training to start. Cardiff City FC originally offered to purchase tickets for the footballer on a commercial flight but in the end, an agent who was involved with the deal organised the flight for the footballer to Nantes and back. This flight was in exchange for payment.

The pilot was very experienced with 3,500 hours flying time. Most of his flying experience was dropping parachutists from single and twin-engine aircraft. He had a valid Instrument Rating (restricted) which allowed him limited rights for flying in instrument meteorological (non-visual) conditions within the UK but there was no evidence that he’d been training or practising for IMC flight since he renewed the rating in May 2017. He was not a commercial pilot which means that he was banned from “carrying a passenger for reward.” He had only 30 hours on this type of aircraft. He held both FAA and UK-EASA private pilot licences and had gone through a “differences training” which allowed him to fly the Piper Malibu PA-46 based on his Single Engine Piston rating, however, the Single Engine Piston rating had expired in November 2018, a few months before the flight.

This means that the pilot was not only illegally flying a commercial flight, he was not actually legal to fly the Piper Malibu at all.

Of course the passenger knew none of this: it is unreasonable to expect passengers to understand the regulatory aspects of aviation. He was not involved with booking the flight or any of the aspects other than specifying what time that he wanted to leave Nantes on Monday. He did not contribute to the cost of the flight (this was covered by another party). The passenger and the pilot did not have any language in common and communicated primarily through hand gestures.

The pilot submitted a flight plan for the outbound flight and for the return flight from Nantes to Cardiff for Monday morning with a departure time of 0900 hours. They departed Cardiff for the two hour flight to Nantes.

At some point during the flight, the pilot heard a loud bang or boom and saw a low-level mist at the bottom of the aircraft. He pushed the throttle, mixture and propeller control levers forward. The engine parameters were all within normal limits and he continued the flight. Then, in the last ten minutes of the flight, the stall warning sounded and continued to sound during landing and taxi, until the pilot pulled the circuit breaker to the stall warner.

After landing, the pilot told a person identified only as “Witness A” that they’d experienced some trouble during the flight. He told Witness A about the loud sound and the mist, which he said that he’d experienced before. He contacted the person who managed the aircraft in the UK to report this and also that he’d experienced a loss of pressure in the left brake pedal while taxiing on the runway. He was told to contact the mechanic at the maintenance organisation who had done the annual inspection on the aircraft in November. The mechanic that he spoke to held an FAA inspection authorisation and was able to approve repairs and alterations on aircraft which are registered in the US. The pilot told the FAA IA inspector about the issues; however this time he described the sound as a “muffled thud” and did not mention the mist The FAA IA inspector told him to get engineering advice in Nantes before flying the aircraft home.

On Sunday, the pilot removed the engine cowlings to examine the engine and carry out an engine ground run. All of the engine pressures and temperatures were within limits and he was unable to find any problem with the engine. He noticed what he thought might be a small oil leak from the top of the oil accumulator. He sent photographs to the person who managed the aircraft, who then forwarded the photographs to the FAA IA inspector.

The engine oil leak was assessed as being no more than a “weep” from the top of the air/oil separator and there was no sign of a loss of engine oil.

The pilot also arranged for a mechanic to check on the brakes on Monday before the flight home. Over the weekend, he refiled the flight plan repeatedly delaying the departure time. It isn’t clear why the departure was delayed but the emails from the handling agents shows that the pilot was aware of the night-time return by Sunday afternoon. The final flight plan was filed for a departure of 18:30.

On Monday, the pilot arrived in the afternoon to refuel the aircraft and prepare for the flight. He met the local mechanic. The mechanic said that they communicated in French and that he understood that he was being asked to check the brakes. He said that he was satisfied that the brakes were fine, although the right pedal felt slightly firmer than the left. The pilot did not mention any other issues and the mechanic did not fill in any documentation and was not paid for his advice.

The aircraft had a GARMIN unit which combined radio communications and GPS navigation. The pilot used a flight planning and navigation software application on his tablet to plan and file his flight plan. He planned the flight at 6,000 feet with a direct track of 265 nautical miles from Nantes to Cardiff, passing over Guernsey. The application could be used to display aircraft position and the planned route overlaid onto a moving map, but as the tablet was not recovered, there’s no way to know if the pilot had it with him or if he was using the application during the flight.

The handling agent at Nantes gave the pilot a pack with the reported and forecast weather charts for the route. The Jersey Meteorological Department had issued a forecast which showed a cold front moving in from the northwest, preceded by scattered and heavy showers.

The passenger arrived in the early evening. He took a seat in a rear, forward-facing passenger seat. There was no written safety brief in any of the languages that the passenger spoke and it seems unlikely that the pilot was able to give him a verbal safety brief that the passenger might understand. As the aircraft taxied to the runway, the passenger sent a voice WhatsApp message.

I am now on board a plane that seems like it is falling to pieces…if you do not have any more news in an hour and a half, I don’t know if they need to send someone to find me. I am getting scared.

At 19:06 UTC, the Piper Malibu departed Nantes Airport from runway 03 and flew north towards Guernsey and Cardiff. They climbed to 5,500 feet above mean sea level with an average groundspeed of 170 knots. The wind was coming from 250° at 25 knots, making for an estimated airspeed of 160 knots.

About 20 nautical miles south of Jersey, the pilot changed frequencies to Jersey air traffic control. The aircraft was cleared to enter controlled airspace and maintain FL55 (5,500 feet). A band of showers was passing over the English Channel with other pilots in the area reporting cumulonimbus (CB) cells and rain at lower levels. Although it was a full moon, it was obscured by high-level cloud at 11,000-13,000 feet with further layers of cloud at 4,000-6,000 feet and 1,500-3,000 feet. Aware of this, the controller asked the pilot to advise them if he wasn’t able to maintain VMC (Visual Meteorological Conditions).

I mentioned earlier that the pilot had two private pilot licences, one issued in the UK (EASA) and one issued in the US (FAA). The FAA licence includes the right to fly at night as the PPL training in the US includes a few hours of night flying. The EASA licence does not and pilots must do specific training in order to receive a night rating. The pilot had never done any night flying training and the pilot’s IR(R) training did not include any night flying nor the right to fly at night. His CAA licence was based (piggybacked on) his EASA licence. As a result, the FAA licence did not qualify the pilot to fly at night.

However, the pilot may have felt pressured by the commercial nature of the flight and not felt that it was reasonable to refuse to do the return flight once it was pushed to the evening. Additionally, an instructor who signed off the pilot made a note in his logbook as qualified pilot-in-command day and night. The FAA licence didn’t reference the day-only restriction and the instructor must have assumed that the pilot was allowed to fly at night. The pilot may have assumed that the note meant that he was qualified to fly at night, even though he had never been trained to do so.

As the pilot passed Jersey, 13 nautical miles south of Guernsey, the pilot asked to descend in order to maintain VMC , that is, in order to stay clear of cloud and remain in visual flying conditions. The controller cleared the aircraft to descend to FL50 and asked the pilot to advise if he needed a further descent. The rainfall radar picture at this time showed variable showers, some heavy, passing through the area.

The Piper Malibu began to descend and made a right turn with a bank angle of 22°. The precision of the turn and the bank angle point to a turn done using the autopilot. Indeed, up until this point, the flight’s heading and altitude were maintained so accurately that it seems the pilot must have been using the autopilot for the flight to this point.

The thing is, a few years previous, the autopilot and flight director system were documented as having a fault in which the autopilot would suddenly disconnect for no apparently reason. In July 2017, the autopilot and flight director system were placarded as inoperable, which is a way of ensuring that anyone using the aircraft can immediately see that they don’t work, rather than having to remove the instrument panel and all of the inoperable systems. There’s no record of the fault being rectified. It isn’t clear if the placard was still in place; the maintenance organisation had no record of this although the mechanic believed that there was one.

Based on the radar data, the pilot was certainly using the autopilot with the heading and altitude modes selected.

After turning right, the Piper Malibu turned left at a steeper bank angle which exceeded the autopilot’s maximum bank angle, and then the course and altitude stabilised. This seems like the autopilot disconnected or was disengaged and then connected again. The airspeed varied between 150 knots indicated airspeed and 200 knots indicated airspeed. The aircraft levelled out overhead Guernsey, now flying parallel to his original course, displaced by about 1.5 nautical miles.

The controller called the pilot to ask if he needed a further descent.

The pilot responded, “Negative, just avoided a patch there but back on heading, five thousand feet.”

As the aircraft passed Guernsey, there would be little or no visual references for the pilot, even out of cloud. The only lights below would be ships in the channel. The lights on south coast of England, 43 nautical miles away, were unlikely to be visible in the rain and the mist. Pilots flying in the area at the time said that there was little or no horizon between the cloud layers.

About ten minutes later, eleven miles north of Guernsey, the pilot contacted the controller and requested a further descent to maintain VMC; he needed to descend to stay clear of cloud. The controller cleared the pilot to descend at his discretion, which is to say, the pilot could now climb and descend without asking the controller for clearance.

The pilot acknowledged the call. This was the last radio contact with the flight.

The Piper Malibu did not have a flight data recorder or a cockpit voice recorder installed, nor was it required to. The final moments of the flight are based on primary and secondary radar information captured from radar stations in Guernsey, Jersey and France. The overlapping information from these three stations were within less than 100 metres of each other, and thus effectively verified by each other.

The Piper Malibu began descending gradually and turned onto a track of about 060° for about 30 seconds and then turned left to about 305°. While turning, the aircraft descended from 4,800 feet to 4,300 feet and then climbed to 5,000 feet before descending again to 3,900 feet. Then the aircraft climbed to 4,200 feet on a track nearly parallel to his planned course and levelled out, travelling at about 168 knots indicated air speed.

After levelling out, the aircraft started another turn to the left followed by a right turn of approximately 180°, that is the aircraft turned sharply enough to be flying south. During the turn, the aircraft descended from 4,100 feet to 1,600 feet. As the aircraft descended, the airspeed and the descent rate increased. The aircraft appeared to be descending at about 13,000 feet per minute and travelling at higher than 220 knots indicated airspeed when it disappeared from secondary radar. The Piper Malibu has a V_NE speed, that is, a Never Exceed speed, of 203 knots indicated airspeed.

Guernsey radar picked up two more primary radar returns and the aircraft wreckage was found within one nautical mile of the final radar return, so although it’s not possible to have absolute confidence in the primary radar information, it seems likely that these returns were valid.

Both the AAIB and the NTSB analysed the final manoeuvres of the aircraft.

The aircraft commenced the final turn from an altitude of 4,100 ft and a calculated airspeed of approximately 180 KIAS. As it entered the turn, the roll attitude progressively increased at an average rate of about 5° per second and the airspeed increased at about 1.4 kt per second. When the right bank reached about 30°, both simulations indicated that there was a slight pause of a few seconds before the roll angle began to increase again. When the aircraft was at 3,700 ft, the roll attitude had reached about 60°, the pitch attitude was about 10° nose down, and the calculated airspeed was about 200 KIAS. There was another brief pause at this bank angle before it started to increase again. As the aircraft descended through 2,700 ft, the right bank had increased to about 90°, the pitch attitude was 30° nose down, and the estimated airspeed had increased to about 235 KIAS.

It is clear that during that final descending turn, with a bank angle of 90° and an airspeed of 235 knots, the pilot had lost control of his aircraft. Although it is hard to prove exactly what happened, based on the simulations, the aircraft started to roll towards wings level, as if someone were still at the controls and attempting to recover. The transponder reported a brief climb to 2,300 feet which could mean one of two things.

• The aircraft suffered an in-flight break-up, which cased the transponder to report an incorrect altitude.
• The pilot managed to pitch the aircraft into a climb which would have exceeded the structural limits of the aircraft, causing an in-flight break-up.

The AAIB concluded that although the left roll could have been caused by the pilot slumping over the control wheel, the pitch up could not, as that required the control wheel to be pulled back quickly. Thus, the pilot had “at least some level of function”. If he had some level of situational awareness and tried to recover the situation, the roll and pitch make sense. Unfortunately, the aircraft was diving towards the sea and travelling much too fast for the pilot to be able to recover.

All US-registered general aviation aircraft must carry an emergency locator transmitter and Piper Malibu was fitted with one but it was not designed to transmit under water. The crash site was not found until a few weeks later. The remains of the Malibu were found about 22 nautical miles north-north-west of Guernsey, resting at a depth of 68 meters. A remotely-operated vehicle was used to survey the scene.

The wreckage was split into three parts, held together by electrical wiring and control cables. The engine was lying nearby. The ends of the wings and the horizontal stabiliser on the tail had been ripped off.  The instrument panel was smashed so that it was impossible to tell the position of controls or switches. The propeller and the front of the aircraft showed very little damage but there was extensive damage on the upper surfaces of the wings and the fuselage: the aircraft was upside down when it struck the water.

Outer sections of the wings and empennage were missing, evidence of a structural, in-flight break-up. This, along with the fact that the aircraft had not travelled far in its descent, supports the idea that the aircraft broke up in the air rather than as a result of the impact. The damage and missing parts were consistent with the effects of an abrupt nose-up control input while the aircraft was travelling faster than it was capable of manoeuvring.

The passenger’s body was recovered three days later. The pathologist found that the passenger had died in the impact but, more interestingly, his tests also showed a COHb (carboxyhaemoglobin) level of 58%.

COHb is formed when carbon monoxide (CO) binds with haemoglobin in the blood. Haemoglobin is the oxygen-carrying molecule in red blood cells. CO is a colourless, odourless, tasteless gas, which is slightly lighter than air, and is a by-product of the incomplete combustion of carbon-containing materials. When inhaled, CO is easily absorbed into the bloodstream where it attaches itself to haemoglobin and has a direct effect on the performance of those parts of human physiology that rely on oxygen for proper functioning. CO inhalation can lead to damage to the brain, heart and nervous system, and this is known as CO poisoning.

In other words, the passenger was suffering from severe carbon monoxide poisoning. He didn’t show any symptoms of carbon monoxide poisoning in the video footage from security at Nantes Airport and no one who interacted with him noticed anything strange, so it seems that he was poisoned during the flight. There were no signs of a fire before impact which makes the most likely source of carbon monoxide to be exhaust gasses from the engine entering the cabin.

The pathologist said that the passenger would almost certainly have been “deeply unconscious” at the time of impact.

The pilot’s body was never recovered but as the Piper Malibu’s cockpit and cabin are a single space, the pilot must also have been exposed to some level of carbon monoxide. Four minutes before the accident, the pilot was speaking clearly and lucidly to the air traffic control so at this stage, at least, he was not suffering from extreme poisoning. However, his flying became very erratic over the next few minutes, with high angles of bank and a number of altitude changes.

There are four scenarios that could explain his final manoeuvres:

• The pilot reacted strongly to the weather and intentionally entered the deep turns with abrupt climbs and descents in an attempt to avoid flying into the clouds or to regain visual conditions having flown into the clouds
• The pilot was reacting to the weather and became disoriented in the night conditions, leading him to fly erratically as the result of visual or vestibular illusions
• The pilot was beginning to suffer from the symptoms of carbon monoxide poisoning which made it difficult to control the aircraft and led to more and more erratic manoeuvres
• A combination of some or all of the above

My money is on “all of the above”

The final turn, specifically, was so extreme that it was more dangerous than the weather he was flying to avoid. The high bank angle and speed in the turn were such that it seems likely that he’d lost control of the aircraft by then.

From the AAIB report:

Causal factors

1. The pilot lost control of the aircraft during a manually-flown turn, which was probably initiated to remain in or regain VMC.
2. The aircraft subsequently suffered an in-flight break-up while manoeuvring at an airspeed significantly in excess of its design manoeuvring speed.
3. The pilot was probably affected by CO poisoning.

Contributory factors

1. A loss of control was made more likely because the flight was not conducted in accordance with safety standards applicable to commercial operations. This manifested itself in the flight being operated under VFR at night in poor weather conditions despite the pilot having no training in night flying and a lack of recent practice in instrument flying.
2. In-service inspections of exhaust systems do not eliminate the risk of CO poisoning.
3. There was no CO detector with an active warning in the aircraft which might have alerted the pilot to the presence of CO in time for him to take mitigating action.

I have some issues with the report’s conclusion and I’d like to spend some more time on the engine and maintenance of the aircraft but this has gone long enough already. Next week, let’s look at the causal and contributory factors in more detail.

Part two is here! Causal Factors