On 17 October 2019, a Saab 2000 (N686PA) being operated on a domestic passenger flight from Anchorage to Unalaska as PenAir flight 3296 overran the destination runway after touching down on destination runway 13 in the presence of a significant tailwind component following its second approach there in day VMC. The aircraft sustained substantial damage and one of the 42 occupants, a passenger, was killed. Nine other passengers were injured, one of them seriously.
The aircraft in its final resting position. [Reproduced from the Official Report]
An Investigation into the accident was carried out by the NTSB. The FDR and CVR were located and recovered and data from both were successfully downloaded and of assistance to the Investigation. Part of the overrun was also recorded on two off-airport security cameras.
The Flight Crew
The 56 year-old Captain was recorded as having accumulated a total of 14,761 flying hours experience which included 11,811 hours in command, most of the later being acquired whilst working for another Alaska regional airline which had ceased operations two years earlier. However, only 131 of these hours had been flying the Saab 2000, on which he had completed conversion training and been authorised to operate in command three months prior to the accident. Since completing his line training, he had operated into Unalaska four times in command having previously done so five times under supervision.
The 39 year-old First Officer had a total of 1447 flying hours experience which had been mostly obtained in light aircraft prior to being employed by PenAir five months prior to the accident and beginning to accumulate experience as a professional co-pilot on a multi engine aircraft. By the time of the accident, this totalled 138 hours including supervised type conversion training time - his final line check having been completed a little over two months prior to the accident. Since release to line flying, he had made 13 flights to Unalaska prior to the accident flight including one the day prior to the accident with the same Captain.
Post accident interviews with both pilots indicated that they considered that they had been working together effectively. There was no indication that fatigue had contributed to the accident in any way.
With the Captain acting as PF, the flight departed Anchorage in mid afternoon for a flight expected to take a little over two hours to the uncontrolled destination airport. En-route, the Captain gave a destination brief on the RNAV instrument approach procedure applicable to both ends of the single available runway based on a visual transitioning to runway 13 with the proviso that if the surface wind velocity changed such that runway 31 was more appropriate, then that runway would be used instead. The RNAV procedure MDA was 2000 feet and its termination point was northwest of the airport such that the (“front door”) transition to a 13 final approach was the shortest and required a left turn onto final approach whereas the (“back door”) transition to runway 31 required an initial left turn followed by later right turns onto final approach (see the illustration below). Both ends of the 30 metre-wide runway at Unalaska had a displaced landing threshold which left an LDA of 1180 metres with the Captain recorded prior to the approach as stating that the unfactored landing distance required was (equivalent to) 932 metres.
The Unalaska runway showing the “front door” and “back door” runway visual approaches. [Reproduced from the Official Report]
During descent, the Captain noted that the AWOS wind was being given as 310°/6 knots. Half an hour later, he noted that it was now being given as 310° / 11 knots and observed that “startin’ to favour the back door (i.e. runway 31) a little more”. Nine minutes later, and still with about 25 minutes to run, the First Officer contacted the airport weather observer and was told that the surface wind was 210° / 6 knots gusting to 14 knots. The Captain then remarked “pretty much a direct crosswind there” and the First Officer obtained clearance for the runway 13 approach from the Anchorage ACC controller. The Captain subsequently stated that if there were any major changes in the wind, “we’ll just call the controller back”.
CVR data indicated that five minutes after receiving the approach clearance, the crew would have been able to hear the pilot of a Beech 200 also inbound to Unalaska requesting a weather check from the observer there and being given 180°/7 knots with showers in the vicinity of the airport. By the time the approach was in progress, some 12 minutes later, the First Officer obtained a wind of 270°/10 knots. The landing checklist was then completed following which there was a brief discussion on which runway should now be used which concluded with the Captain deciding to continue for runway 13.
As the aircraft passed the procedure MAP located 4.7nm from the runway with the aircraft already below 950 feet agl and descending, the Captain called runway in sight and stated that if there was too much wind shear, the First Officer should just call a go around and “we’ll go out the back door”. Half a minute later, in response to the Captain’s “whad’ya think?”, the First Officer replied “go around” and this was commenced with the Captain asking the First Officer to announce that the aircraft was “coming around for a visual” which he did.
As the aircraft was positioning visually for a second approach, the observer reported that the wind was now 290°/16 knots gusting to 30 knots but this did not prompt any immediate discussion on the flight deck. However, about a minute later, after a further wind check of 300°/24 knots was received, there was a short discussion as to whether to continue with another approach to 13 or change to the “back door” approach to runway 31 which the Captain was clearly considering but when the First Officer appeared to favour a second approach onto runway 13, the Captain was recorded as saying “oh okay…sure…we’ll try again”. When the First Officer then asked the Captain if he was “okay” with a landing on runway 13, he responded “I was thinking about going the other way...shear” but did not change the plan.
A Beech 200 pilot was then recorded asking the observer about weather conditions for a landing on runway 31 and was told “there’s showers just moving through…right at the moment it is perfect for three one but I’m thinking that it might switch back…once this shower moves through”. It was not established whether the Saab crew picked up this exchange but on completion of the before landing checks, they requested a wind check and were told the midfield wind was 300°/24 knots following which both pilots expressed concerned surprise. The First Officer asked if the Captain wanted to break off and try again but the Captain responded with “keep talking to weather....last try” and continued positioning for runway 13.
As the aircraft descended through about 350 feet agl, it began the turn onto the runway 13 extended centreline, becoming established on it at around 100 feet as an EGPWS ‘SINK RATE’ Alert was activated with the rate of descent peaking at almost 1,300 fpm. The Captain began reducing the rate of descent from 90 feet agl with the airspeed close to the 136 knot VREF but with the recorded groundspeed representing the presence of a 14 knot tailwind component .Passing 60 feet agl, the EGPWS ‘SINK RATE’ Alert was briefly activated again.
Main gear touchdown on the reportedly dry runway was normal at 335 metres past the displaced runway threshold (see the annotated reconstruction of the landing roll below) with reverse propeller pitch selected once the nose gear was on the ground and the first few seconds of braking and resultant deceleration as normal. However, what appeared to be a puff of smoke recorded on a passenger video from close to the left main landing about 5 to 6 seconds after touchdown was found to have coincided with the bursting of the left outboard tyre and a sudden decrease in deceleration despite full brake pressure being maintained by the Captain and confirmed by the First Officer. As the First Officer called “80 knots” (with the ground speed around 100 knots), the Master Caution occurred accompanied by an antiskid inboard fault annunciation.
The aircraft deviated to the right as it exited the end of the runway, crossed the 90 metre-long RESA and the adjacent blast pad before continuing through the metre-high chain-link perimeter fence leaving evidence of left propeller contact. It then successively crossed a ditch, hit a large rock and crossed a public road before coming to a stop on the shoreline. In the vicinity of the road, the aircraft left wing or left propeller struck a 4 to 5 feet high post and the left propeller struck a 2.5 metre high yellow diamond shaped road sign. There were also strike marks consistent with the right engine propeller tips contacting the ground near where the aircraft stopped.
The Captain then shut down both engines and made a PA to order an emergency evacuation from the right side of the aircraft after both pilots had seen a fire warning illuminated for the left engine as it was being shut down. He then called airport operations on the radio to advise that the aircraft was off the runway and request crash fire and rescue assistance. The sole staff member present then immediately donned protective gear and drove the RFFS vehicle to the scene, arriving just over a minute later and began to assist with the evacuation. It was noted that the aircraft operator’s procedures specified that in the event of a an “unplanned emergency situation”, the cabin crew should “not wait for a signal from the Captain to evacuate”.
Damage to the aircraft fuselage included a hole and impact damage to the left forward fuselage just forward of the propeller plane in the vicinity of seat 4A where virtually the complete length of one of the two detached left side propeller blades which had hit the fuselage had penetrated it completely and hit the passenger seated in 4A resulting in an immediately fatal injury. Internal damage to the passenger cabin was limited to the left side between rows 3 and 6 where the overhead stowage had become partially detached with associated debris hanging down into the seats or lying on the floor. Overall, the immediate response to the accident was judged by the Investigation to have been “timely and effective”.
Left side fuselage damage showing where one propeller blade entered the passenger cabin and another became embedded externally. [Reproduced from the Official Report]
An internal view forward from row 6 with the propeller blade which entered the cabin visible. [Reproduced from the Official Report]
Why it happened
The Investigation sought to establish both the reason for the apparent lack of the expected response to applied braking after touchdown and the extent to which the handling of the final stages of the flight may have contributed to the accident outcome.
It was established that the correctly inflated left outboard main gear tyre had deflated non-explosively shortly after touchdown as the direct result of the wheel skidding on the essentially dry runway surface. The adjacent inner wheel tyre was not similarly affected. No evidence that the deflation had originated from contact with runway debris was found, the deflation was solely attributable to the abrasion caused by the absence of rotation which was itself a direct result of the lack of anti skid system alleviation of the initial skid. It was noted that although it was not of direct significance to the tyre failure, the site of the skid-caused site of the tyre failure corresponded to a flat spot identified during the First Officer’s pre flight external inspection of the aircraft prior to departure from Anchorage which was then confirmed by the Captain as allowable for despatch as permitted by the aircraft operator since “no cord was showing”.
It was also found that the electrical wiring harnesses for the left MLG wheel speed transducer had been incorrectly routed in a way which resulted in the antiskid system responding to skidding of the left outboard tyre after it deflated by completely releasing the brake pressure to both the left and right MLG inboard wheels. Because the antiskid system could not therefore respond as intended to the left MLG outboard tyre skid, the tyre was subsequently subject to sufficient abrasion to cause it to deflate which resulted in a further loss of MLG wheel braking. This combined loss of both left and right inboard and left outboard MLG wheel braking made it impossible for the aircraft to be stopped on the runway. It was found that the CMM covering the wheel speed transducer system contained an error conducive to incorrect installation, although no direct link between this and the error made was established.
Of considerable importance, however, was the result of a detailed aircraft runway performance study. This concluded that whilst the aircraft as it had landed on the runway in the prevailing conditions could have then been stopped on the runway in the event of the complete failure of two out of the four available MLG brake units or the tyre failure alone, the combination of the two which resulted in only one functional brake unit remaining had both made this impossible and contributed to difficulty in maintaining the runway centreline prior to the overrun.
It was noted that incorrect wiring of the antiskid system as found did not in itself generate a fault. For such a maintenance error to be potentially detectable, it was concluded that based on the logic of the antiskid system’s operation, a significant skid event would have to occur for more than two seconds without being relieved before a fault message, which might (although would not automatically) prompt maintenance personnel to investigate further, would be generated. It was also noted that not only would the origin of the potential fault message be ambiguous, there were no documented troubleshooting procedures for it.
It was found that as a consequence of the aircraft operator’s various existential problems over a two year period prior to the accident, the accident aircraft had not returned to revenue service following an overhaul of the left MLG by the OEM in January 2017. Only in June 2019, just four months prior to the accident, had PenAir operated its first revenue flight. With no relevant subsequent maintenance having been carried out since, the cross wiring error could therefore be confidently assumed to have occurred during this overhaul. The OEM was noted as having accepted that the harness cross wiring could have occurred during their overhaul work and with unclear harness part numbers and failure to follow the applicable installation procedure correctly both having been potentially contributory.
A review of the handling of the aircraft prior to touchdown during the accident overrun concluded that the crew were aware that their decision to continue both approaches to runway 13 given the prevailing wind velocity conditions and their tailwind component implications was inappropriate but had been subject to plan continuation bias. The same motivation was considered to have led to the continuation of the unstable second approach which immediately preceded the overrun. The particular challenges of low aircraft type experience on the part of both pilots and the minimal public transport flying experience of the First Officer were assessed to have both been indirectly contributory to the flawed decision making which had occurred. However, since it was established that completion of a safe landing could have been achieved following the touchdown made in all the prevailing conditions except for a loss of wheel braking capability in excess of 50%, it was only the 75% loss of wheel braking capability which made this impossible.
It was considered that “a more robust design of the Saab 2000 wheel speed transducer wire harnesses could have mitigated the potential for the incorrect installation of the harnesses” and noted that the potential for such an error during installation or maintenance is present in the case of other aircraft types. The absence of any requirement for safety management systems to be in place at aircraft designers, manufacturers and maintenance facilities was considered to make it less likely that potential operational safety risks would be identified and effectively mitigated.
The Wider Context
The Investigation also examined the effect which relevant aircraft operator procedures and their application and the FAA regulatory oversight of the operator might have had on the accident outcome.
It was considered that during the course of the approaches to land at Unalaska, the Captain had “demonstrated inadequate aeronautical decision-making skills regarding which runway to use for landing” and that by continuing and completing an approach to a runway likely to involve a significant tailwind component for landing, he had also “demonstrated a lack of flight deck Leadership”.
It was also considered that “the Captain might not have fully understood the challenges associated with landing the Saab 2000 at Unalaska because he had not achieved the experience that the company-designated pilot-in-command airport qualification policy intended”. In this respect it was noted that aircraft operator PenAir’s decision to allow the Captain to operate at Unalaska Airport as an unsupervised Captain when he had yet to meet the applicable documented airport qualification criteria was directly contrary to the intent of this requirement to ensure the necessary skill and experience level to operate at the airport existed.
A wider examination of PenAir’s SMS as documented and applied identified both “hard” and “soft” deficiencies which significantly decreased its effectiveness and in particular had “resulted in reduced pilot feedback to management about safety concerns”.
FAA oversight of PenAir during a particularly challenging period in the 2½ years prior to the accident and especially during the restarting of scheduled passenger service operations was found to have been “insufficient to identify safety risks resulting from the company’s bankruptcy, reduced route structure, loss of experienced pilots, acquisition and merger”. It was also found that there was no evidence that the FAA had actively considered the dimensions of the Unalaska runway 13 RESA during the process which had led to issue of an approval for PenAir to operate the Saab 2000 to the airport and that such a consideration could help increase an aircraft’s margin of safety should a runway overrun occur.
The Probable Cause of the accident was determined as “the landing gear manufacturer’s incorrect wiring of the wheel speed transducer harnesses on the left main landing gear during overhaul (which) caused the antiskid system not to function as intended, resulting in the failure of the left outboard tyre and a significant loss of the aircraft’s braking ability which led to the runway overrun”.
Three Contributory Factors were also identified as:
- Saab’s design of the wheel speed transducer wire harnesses, which did not consider and protect against human error during maintenance;
- the Federal Aviation Administration’s lack of consideration of the runway safety area dimensions at Unalaska Airport during the authorisation process that allowed the Saab 2000 to operate at the airport;
- the flight crew’s inappropriate decision, due to their plan continuation bias, to land on a runway with a reported tailwind that exceeded the aircraft manufacturer’s limit.
It was also concluded that “the safety margin was further reduced because of PenAir’s failure to correctly apply its company-designated pilot-in-command Airport qualification policy” which had allowed the accident Captain to operate the Saab 2000 aircraft at one of the most challenging airports in their route system with limited experience of both the airport and the aircraft type.
A total of 10 Safety Recommendations were made as a result of the Investigation as follows:
- that the Federal Aviation Administration identify all currently certificated transport-category airplanes for which system safety assessments for landing gear systems did not consider human error that could lead to cross-wiring of antiskid brake system components, including the wheel speed transducers, and require manufacturers of transport-category airplanes without such assessments to perform the assessments and then implement mitigations to prevent cross-wiring of antiskid brake system components. [A-21-46]
- that the Federal Aviation Administration require the submission and consideration of system safety assessments addressing the landing gear antiskid system for the certification of future transport-category airplane designs. The certification should ensure that the system safety assessments are consistent with the intent of Advisory Circular 25.1309, System Design and Analysis, and that the assessments evaluate and mitigate the potential for human error that can lead to a cross-wiring error. [A-21-47]
- that the Federal Aviation Administration require organisations that design, manufacture and maintain aircraft to establish a safety management system. [A-21-48]
- that the Federal Aviation Administration notify Principal Operations Inspectors and frontline managers about the circumstances of this accident and emphasise the importance of existing Federal Aviation Administration guidance for detecting and mitigating the safety risks that can result when [aircraft operator] certificate holders experience significant organisational change, such as high personnel turnover, a reduction to route structures or flight schedules, bankruptcy, acquisition and merger. [A-21-49]
- that the Federal Aviation Administration revise Order 8900.1, Flight Standards Information Management System to include a formalised transition procedure to be used during a changeover of [an aircraft operator’s] certificate management team personnel responsible for overseeing a certificate holder that is undergoing significant organisational change (for a reason described in volume 6, chapter 2, section 18 of the Order) to ensure that incoming personnel are fully aware of potential [operational] safety risks. [A-21-50]
- that the Federal Aviation Administration include the runway design code for runways of intended use among the criteria assessed when authorising a scheduled air carrier to operate its aircraft on a regular basis at an airport certificated under Title 14 Code of Federal Regulations Part 139. [A-21-51]
- that the European Union Aviation Safety Agency identify all currently certificated transport-category aircraft for which system safety assessments for landing gear systems did not consider human error that could lead to cross-wiring of antiskid brake system components, including the wheel speed transducers, and require manufacturers of transport-category aircraft without such assessments to perform the assessments and then implement mitigations to prevent cross-wiring of antiskid brake system components. [A-21-52]
- that the European Union Aviation Safety Agency require the submission and consideration of system safety assessments addressing the landing gear antiskid system for the certification of future transport-category airplane designs. The certification should ensure that the system safety assessments are consistent with the intent of AMC 25.1309, Systems Design and Analysis and that the assessments evaluate and mitigate the potential for human error that can lead to a cross-wiring error. [A-21-53]
- that the European Union Aviation Safety Agency require organisations that design, manufacture, and maintain aircraft to establish a safety management system. [A-21-54]
- that the Saab Group redesign the wheel speed transducer wire harnesses for the Saab 2000 aircraft to prevent the harnesses from being installed incorrectly during maintenance and overhaul. [A-21-55]
The Final Report of the Investigation was dated 2 November 2021 and subsequently published.