Imagine yourself at the peak of your profession, flying the highest tech aircraft of your career and on a trip with three passengers who have complete faith in your abilities. You have what you consider a stellar record and have been paired with a first officer who might be a little older and have a little more experience, but you are the Pilot in Command (PIC) and this is to be your leg. You are on top of the world, until you make a series of mistakes and one of your passengers dies as a result. This is the story of a Challenger 300 crew on March 3, 2023. The list of pilot errors is long, but it could have all been prevented several times. If only they had removed the pitot tube cover. If only they had consulted the aircraft’s go/no-go guidance. If only they had selected the correct checklist. If only.
— James Albright
Updated:
2025-01-15-
N300ER cockpit layout, ERA 23LA135, Operational Factors Specialist’s Factual Report, fig. 2.
Date & Time: March 3, 2023, 1600 Local
Aircraft: Bombardier Inc BD-100-1A10 (Challenger 300)
Registration: N300ER
Aircraft Fate: Minor damage
Injuries: 1 fatal of 2 crew 3 passengers
NTSB Accident Number: ERA23LA135
Source: NTSB Final Report, ERA 23LA135, p. 1
Most of what follows comes from the NTSB Aviation Investigation Final Accident Report and other docket evidence.
1
The pilots, the aircraft
The following was extracted from ERA 23LA135, Operational Factors Specialist’s Factual Report, pp. 7 -13.
Five months before the accident flight, both pilots completed ground and simulator training with CAE in Dallas, TX, and received their type ratings in the Challenger 300.
The PIC was 52 years old with type ratings in the BE-400, CE-650, DA-50, EMB-505, MU-300, before achieving his CL-30 rating. He held an Airline Transport Pilot (ATP) certificate with 5,061 total hours, of which 88 were in type.
The SIC was 56 years old with type ratings for BE-400, CE-500, CL-30, EMB-505, HS-125, IA-JET, MU-300. He held an ATP with 8,025 total hours, of which 78 were in type. His records include a Notice of Disapproval on an ATP 2021 for “Emergency Operations” with the comment: “maintain direction control and appropriate crosswind correction throughout the missed approach.”
The aircraft was a Bombardier BD-100-1A10 Challenger 300, built in 2013, that had accumulated 2,321 total hours and had recently complied with 14 CFR Part 135 inspection requirements.
2
The setup
The crew flew their passengers from Leesburg Executive Airport (JYO), Leesburg, Virginia to Dillant/Hopkins Airport (EEN) Keene, New Hampshire the day before the accident. Leesburg was their home airport, and they were returning on the accident flight. The SIC’s exterior preflight inspection was interrupted when a Fixed Base Operator employee brought ice to the airplane. The SIC resumed his exterior preflight at a point after where the right-side pitot tube cover should have been removed. The PIC did not notice the unremoved pitot cover. After the passengers arrived, the pilots started engines and taxied for takeoff. The PIC was in the left seat and was the Pilot Flying (PF). The SIC was in the right seat and was the Pilot Monitoring (PM).
Key point: The pitot cover did not have a “Remove Before Flight” streamer. I’ve flown aircraft that were so equipped and had an appropriate flag added. This is an easy fix. I’ve also been in the habit of counting covers after the preflight and presenting the other pilot with the covers and gear pins to ritualize the counting. “Eight covers, three pins, exterior preflight complete.” Once or twice, I was challenged. “Covers and pins?” I appreciated the challenge.
Key point: Distractions, even minor ones, can set you up to fail. There are many techniques to combat an interruption to a procedure, such as starting the checklist from the top or placing your thumb on the point of the checklist that was last completed. In the case of the ice man-interrupted exterior preflight inspection, you may be better off asking the FBO person to leave the ice at the foot of the stairs while you complete your task.
Key point: It appears that neither pilot gave the aircraft a “last chance” inspection. Prior to closing the main entrance door, I like to kneel in front of the aircraft and look from wingtip to wingtip to look for streamers, chocks, open compartments, or anything else that isn’t as it should be. Bombardier recommends this in a ROPAT (Recommended Operational Procedure and Technique), saying a “Last Chance Inspection” should be made to “ensure all service doors are latched, hoses and cables are removed, and the airplane is safe for flight.”
During the takeoff roll on runway 2, the SIC reported that the airplane accelerated normally; however, he observed that the right primary flight display (PFD) airspeed indicator failed to show an acceleration above 40 knots (kts), while the left airspeed indicator showed a normal acceleration. The crew rejected the takeoff, and the PIC slowed the airplane without issue and exited the runway onto a taxiway.
Source: NTSB Final Report, ERA 23LA135, p. 7
The report gives the crew too much credit. The Cockpit Voice Recorder (CVR) reveals a less than assertive callout discipline. CAM is the Cockpit Area Mike, HOT-1 is the PIC, and HOT-2 is the SIC.
15:26:15.8 / CAM: [increase in ambient engine noise]
15:26:21.1 / HOT-2 / power set.
15:26:23.9 / HOT-2 / I don't have airspeed.
15:26:25.1 / HOT-1 / you don't?
15:26:25.5 / HOT-2 / don't have airspeed.
15:26:27.8 / CAM / [decrease in ambient engine noise and pitch]
Source: ERA 23LA135, NTSB, Cockpit Voice Recorder, pp. 19 - 20
This “conversation” lacked almost all of the required callouts during takeoff and resulted in a top speed of 104 knots. While this wasn’t a factor in what happened next, it does reveal a lack of discipline in Crew Resource Management (CRM).
The SIC realized he never removed the right-side pitot cover, so they exited the runway, shut down the left engine, and the SIC deplaned to remove the cover.
While the SIC was retrieving the pitot probe cover, the PIC observed a Crew Alerting System (CAS) cyan advisory “RUDDER LIMITER FAULT” message. The PIC reported that he attempted two avionics stall tests (STALL/ RUD LIM test) to clear the message, as he had received this advisory message on previous flights in environments where the airplane was cold soaked; however, the tests did not clear the annunciation.
Source: NTSB Final Report, ERA 23LA135, p. 8
It appears the RUDDER LIMITER FAULT message was caused by the airspeed miscompare during takeoff, as reported by the non-volatile memory of the Horizontal Stabilizer Trim Electronic Control Unit (HSTECU). The HSTECU is responsible for Mach Trim and rudder travel limiting. Inputs to the HSTECU include both Air Data Computers which in turn use the pitot tubes as inputs. The fault is “latched” electronically by the system until the HSTECU power is cycled.
Flight crew troubleshooting did not include an HSTECU power cycle before the subsequent takeoff.
Source: ERA 23LA135, NTSB, Systems Group Chair’s Factual Report, p. 13
Key point: No matter how much experience you have in type, you cannot assume you understand the holistic nature of computerized aircraft. Everything – just about – is connected to everything else. Could you have guessed that the rudder is somehow connected to the pitot tube? Another way of saying “HSTECU power cycle” is “reboot.” In computerized aircraft we often talk about having to “Control-Alt-Delete” or reboot an aircraft to clear system faults.
The cockpit voice recorder (CVR) captured the flight crew discussing the Rudder Limiter Fault message and that the flight director was in pitch mode. After the SIC observed the Rudder Limiter Fault CAS message, he stated, “I’ll call ‘em,” and the PIC responded with, “who you calling?” The SIC stated, “do you want to take off with a rudder limiter fault?” The PIC responded with “it’s advisory only.” Their discussions continued briefly and eventually both agreed to continue the flight with the advisory message displayed.
Source: NTSB Final Report, ERA 23LA135, p. 8
Key point: The color coding and importance of CAS messages varies with some manufacturers, but the Bombardier methodology appears fairly standard. From the aircraft’s Quick Reference Handbook (QRH), Volume 2, INTRO-1:
Warning messages − Are associated with emergency conditions that require immediate crew awareness and rapid corrective or compensatory action as soon as the situation safely permits.
Caution messages − Are associated with serious system malfunctions that require immediate crew awareness and subsequent action when time and conditions permit.
Advisory messages − Are associated with a loss of system redundancy that requires crew awareness and where subsequent action may be needed.
Source: ERA 23LA135, Operational Factors Specialist’s Factual Report, p. 16
Notice that a cyan message is indeed called “advisory,” but that doesn’t mean the message can be discounted without further action. There is no indication in the CVR that the pilots discussed any abnormal checklist. In a post-accident interview, it appeared the PIC was aware of the Rudder Limiter Fault QRH checklist:
It would be easy to read this QRH checklist and not understand the problem rules out a subsequent takeoff. But even if the pilots were aware of the checklist and decided it doesn’t rule out a takeoff, they didn’t consider the aircraft’s Go/No-Go QRH Guidance:
Key point: You cannot assume “how it has always been done” in past aircraft in your experience will be appropriate in other aircraft. Some checklists clearly spell out when a malfunction rules out a takeoff, but others don’t. The Challenger 300’s Rudder Limiter Fault QRH procedure is poorly written, and the pilots could argue it led them to believe their decision to takeoff with the CAS message was appropriate. But the Go/No-Go QRH Guidance left no doubt. Pilots need to understand the shortcomings of their manuals and when their decision tree needs to consider more than the most obvious checklists.
3
Takeoff
The crew again taxied for takeoff, entered runway 2, and began the takeoff roll. According to the PIC, the flight director command bars on the attitude pitch indicator would not appear after pressing the takeoff button, but he elected to continue with the takeoff. According to the SIC, about 80 kts, he noticed that there were no V-speed bugs displayed on the airspeed indicator, but he remembered from their previous takeoff attempt that the V1 (decision) speed was 116 kts. The SIC announced “V1” about 116 knots, followed by “rotate.” The airplane became airborne at 1535:27.
Source: NTSB Final Report, ERA 23LA135, p. 8
Key point: Taking off with missing V-speeds might be appropriate under some circumstances but when there are other problems of unknown origin, it might be better to take it back to the chocks and start over. I’ve been in this situation, but more on that at the end.
The PIC reported that the autopilot was engaged during the initial climb and the turn onto course, and the crew continued a climb to 6,000 ft mean sea level (msl). During the climb, the flight crew observed multiple CAS caution messages. The crew recalled messages of “MACH TRIM FAIL,” “AP STAB TRIM FAIL” [Autopilot Stabilizer Trim Failure], and “AP HOLDING NOSE DOWN.” Neither crewmember could recall exactly what order the CAS messages were presented throughout the climb, or whether other messages were displayed.
Source: NTSB Final Report, ERA 23LA135, p. 8
The FDR reported, and post-accident simulator tests confirmed that during takeoff they would have had the cyan RUDDER LIMITER FAULT message, followed by the amber MACH TRIM FAIL at about 400 feet radio altitude. Both messages would persist for the remainder of the flight. After the autopilot was engaged, the amber AP STAB TRIM FAIL message would appear and remain on until the autopilot was disengaged.
CAS messages after autopilot engagement during simulator test duplicating accident aircraft conditions, ERA 23LA135, NTSB, Flight Testing, p. 12
4
Autopilot engaged
During the climb, the FDR data showed that the autopilot had been engaged and disengaged three separate instances. With each autopilot engagement, an immediate master caution was annunciated.
The autopilot disconnected in the first two instances after the pilot pitch trim rocker switch was activated and small pitch oscillations were observed after the disengagement. The autopilot was reengaged for the final time at 6,230 ft msl and remained on until reaching 22,780 ft msl. The airplane’s airspeed increased from 238 kts to 274 kts in this segment of the climb.
Source: NTSB Final Report, ERA 23LA135, p. 10
Simulator flight tests showed that once the aircraft accelerated above 182 knots, the AP HOLDING NOSE DOWN caution CAS message would post until the speed dropped below 182 knots.
CAS messages after AP HOLDING NOSE DOWN appeared during simulator test duplicating accident aircraft conditions, ERA 23LA135, NTSB, Flight Testing, p. 15
5
"Get the checklist"
About 1536:11, the flight was cleared by air traffic control to climb to FL230 (23,000 ft msl). According to the CVR, at 1536:28, the SIC asked the PIC if he wanted a lower altitude, and the PIC responded with, “no … get the checklist.” The SIC subsequently attempted to re-input the V speeds into the flight management system (FMS) and stated, “I think it’s a configuration issue from the beginning.”
Source: NTSB Final Report, ERA 23LA135, p. 8
Key point: The PIC’s unassertive “get the checklist” order gave the SIC latitude to attempt another idea which might or might not have cured the problem. The AP HOLDING NOSE DOWN message should have alerted both pilots that control of the aircraft might be compromised. Given the three amber CAS messages, they had a problem that needed to be addressed with a greater sense of urgency. We often look to the bottom of the highest priority stack for a place to start. In this case, there were no red messages, so we look to the first amber message to have occurred, MACH TRIM FAIL. But of the three, the AP HOLDING NOSE DOWN trim should have suggested the autopilot was struggling to keep the aircraft flying. In my view, the PIC should have specified that checklist as a starting point and to review the other two as well.
The SIC continued to work the V-speed issue for the next six minutes before starting the checklist. The aircraft had presumably accelerated to 250 knots, well above the point at which the AP HOLDING NOSE DOWN trim was triggered at 182 knots. I conclude the aircraft was trimmed for 182 knots and the autopilot was holding down elevator pressure to maintain the target speed.
The SIC, via an electronic flight bag (EFB), located the quick reference card and the PRI STAB TRIM FAIL [Primary Stabilizer Trim Failure] checklist. The SIC reported in a post accident interview that he selected the PRI STAB TRIM FAIL checklist because, “…it’s the only trim fail checklist in the quick reference [card] and it seemed to be the root cause of our problem.” The SIC reported that he visually showed the PIC the checklist on the EFB, and they agreed to execute the checklist.
Source: NTSB Final Report, ERA 23LA135, p. 9
The PRI STAB TRIM FAIL checklist has one step and that is to turn the stab trim switch off. There are no warnings about disengaging the autopilot or assuming a firm grip of the aircraft pitch before doing that.
Key point: When dealing with a flight control problem, if time permits, it may be wise to take a wider view of what is happening, why, and the ramifications of any actions. At the very least, this crew should have looked at the three amber CAS messages and consider which would cause the most harm and consider reviewing the other checklists first.
The SIC chose a checklist that had a similar name to the correct checklist but was the wrong checklist that would lead them to turning the STAB TRIM switch off. The correct checklist was the AP STAB TRIM FAIL, which was in the same section of the QRH. That checklist had a revision to it:
The revision reversed steps 3 and 4. The original or revised checklists would have prevented what was to happen.
The crew would have also been better off had they selected the top CAS message that was presented, AP HOLDING NOSE DOWN:
6
Inflight upset
The first action on the [wrongly selected] checklist was to move the stabilizer trim switch (STAB TRIM), located on the center console, from “PRI” (Primary) to “OFF.” The SIC read the checklist item aloud and subsequently moved the switch to the off position. As soon as the switch position was moved, the autopilot disconnected, and with the autopilot no longer holding nose-down force on the elevator control surface, the elevator rapidly moved to neutral. Subsequently, the airplane rapidly pitched up, the PIC input nose-down column force, and the airplane pitched back down. The airplane pitched up again and the stall protection system activated. The PIC described during post-accident interviews that, “I did not expect it to pitch as rapidly as it did in either direction.” The PIC also reported that, immediately before the pitch oscillations, his left hand was on the flight controls and his right hand was guarding the right side of the flight controls.
Source: NTSB Final Report, ERA 23LA135, p. 9
The NTSB used FDR and ADS-B data to reconstruct aircraft pitch, and normal acceleration (g forces). The initial pitch up resulted in acceleration of over positive 4 Gs and was followed by the pilot’s pitch over which resulted in negative 2.3 Gs.
Airplane pitch, column position, and elevator deflection versus time and normal acceleration for event. The dots on each trace show each sample of the FDR channel, NTSB Final Report, ERA 23LA135, Figure 1
Moments after the in-flight upset, the flight crew were alerted by one of the passengers that another passenger had been seriously injured. The SIC exited the flight deck to check on the passenger and to provide medical attention. He subsequently returned to his seat and informed the PIC that there was a medical emergency and that they needed to land.
Source: NTSB Final Report, ERA 23LA135, p. 9
When the SIC returned to the cockpit he had to convince the PIC to land. “we need to descend she’s . . .” “get us on the ground!” “. . . has a serious cut . . . at the top of her head.” “very serious.” To all this, the PIC finally responded “’kay.”
Source: ERA 23LA135, NTSB, Cockpit Voice Recorder, pp. 40 - 41
The passenger was bleeding profusely and was unconscious. Her husband treated the wound with towels as best he could. While on approach:
15:50:44.8 APR (Bradley Approach Control): uhh where would you like the umm medical to meet you uhh right now tower’s just having them meet you at the runway...is there a better spot uhh for them to meet you?
15:50:53.5 RDO-1: I’d say Signature.
15:50:56.7: APR: roger that thank you very much.
Source: ERA 23LA135, NTSB, Cockpit Voice Recorder, p. 47
The flight crew informed air traffic control of the medical emergency and began a diversion to Bradley International Airport (BDL), Windsor Locks, Connecticut. The PIC did not reengage the autopilot for the remainder of the flight and landed about 17 minutes after the in-flight upset. After landing, the airplane taxied to the ramp, where an ambulance was waiting. Paramedics entered the airplane and subsequently transported the injured passenger to a nearby hospital, where she succumbed to her injuries later in the day.
Source: NTSB Final Report, ERA 23LA135, p. 10
Damaged paneling above No. 2 passenger seat, NTSB Investigation Photographs, ERA 23LA135, Photograph 7
Key point: With an injury on the airplane, time is of the essence. We can assume the passenger was alive when met by the paramedics and, as the report states, died later in the day. Could meeting the paramedics at the runway (six or so minutes earlier) have changed the outcome? We don’t know, but when in doubt, sooner is better.
7
Probable cause and more
The National Transportation Safety Board determines the probable cause(s) of this accident to be:
The flight crew’s failure to remove the right side pitot probe cover before flight, their decision to depart with a No-Go advisory message following an aborted takeoff, and their selection of the incorrect non-normal checklist in flight, which resulted in an in-flight upset that exceeded the maneuvering load factor limitations of the airplane and resulted in fatal injuries to a passenger whose seatbelt was not fastened. Contributing to the severity of the in-flight upset were the pilot-in-command’s (PIC) decision to continue the climb and use the autopilot while troubleshooting the non-normal situation, and the PIC’s pilot-induced oscillations following the autopilot disconnecting from the out-of-trim condition. Also contributing to the accident was the crew’s inadequate crew resource management.
Source: NTSB Final Report, ERA 23LA135, p. 5
The NTSB report is well written but misses an important point. The pilots failed to notice the pitot cover was still installed prior to flight, failed to realize their malfunction was a “no-go” condition, selected the wrong checklist, and failed to control the aircraft during the in-flight upset. That is what happened. But why?
The root cause
The pilots were trained by CAE Dallas in what I would suggest is a “Type Rating Mill.” The objective is to churn out type rated pilots in minimum time so they can return as customers for recurrent training. In this case, two pilots were produced who failed to understand their flight control system, the proper way to problem solve, the relationship of the aircraft’s QRH checklist and Go/No-Go Guidance, and how to go from multiple CAS messages to a plan of action. We should not finish this Aviation Investigation Final Report and feel that we have solved the problem. What we have done is unearthed a problem. To solve the issue, we need to dive into CAE’s Challenger 300 training program and perhaps their entire training philosophy.
A word or two about the seat belt sign
The fatality would not have happened had the passenger had her seat belt sign on but that wasn’t the problem. The seat belt sign was always on.
The Seatbelt Fasten sign was on the entire flight and it is my habit to brief the passenger that they should fasten their seat belt whenever they are seated.
Source: PIC Written Statement, Operational Factors, ERA232LA135, p. 4
Key point: When you leave the seat belt sign on for the entire flight, you are leaving passenger safety at their discretion. The problem is they don’t have the information needed to judge whether it is safe or unsafe to leave their seats. Leaving the seat belt sign on for the duration of flight is an abdication of your responsibilities as the Pilot in Command.
A word or two about pilot confidence and humility
Assuming the Challenger 300 was the most sophisticated aircraft either pilot had ever flown, five months might not be enough time to master everything needed to fly competently. We in small flight departments are at a disadvantage when our companies upgrade aircraft and expect us to immediately upgrade as well. I’ve been in this situation twice and whenever something off script happened, I picked up the phone and called the manufacturer’s “hotline.” The last time this happened was with the Gulfstream GVII which had only recently been certified. Sitting on the runway after a local pattern flight, we were able to get valid V-speeds for our flight home, but the performance numbers wouldn’t allow flight above a few thousand feet. A call to the GVII Chief Test Pilot revealed he was stumped. We fully shut down the aircraft, got valid numbers, and flew home. In the next two months we isolated the cause, and a software fix was issued fleetwide. Could we have flown with the bad performance numbers? Sure. But with less than a few hours in type, I needed to talk to someone with more experience. In the next year, we called Gulfstream frequently.
Key point: Never be afraid to say you don’t know the answer or that you don’t even know what the right question is.
References
(Source material)
ERA 23LA135, NTSB Aviation Investigation Final Report, Bombardier Inc BD-100-1A10, N300ER, Loss of control in flight, March 3, 2023, 16:00 Local
ERA 23LA135, NTSB, Cockpit Voice Recorder, October 23, 2023
ERA 23LA135, NTSB, Flight Testing, May 14, 2024
ERA 23LA135, NTSB, Investigation Photographs, undated
ERA 23LA135, NTSB, Operational Factors Specialist’s Factual Report, April 28, 2023
ERA 23LA135, NTSB, Systems Group Chair’s Factual Report, August 19, 2024