Buffalo Icing Crash Raises Issues of Airplane Design & Crew Training

Tue, Feb 17, 2009 — David Evans

Articles, Featured

The February 12th fatal accident involving a Continental Connection Dash 8-Q400 is troubling because the emerging details are very much like icing-related crashes before; the aviation industry seems like a slow learner. The airplane plunged out of the night sky near Buffalo, New York, killing all 49 aboard plus one individual on the ground. The accident occurred about five miles from the runway threshold as the airplane was approaching to land.

The airplane may have lost the ability to stay airborne as a result of freezing drizzle. In this condition, near-freezing raindrops smack onto the cold aluminum and stick to the metal surface, turning to ice.

It is amazing how little ice is necessary to cause a total loss of wing lift. For a B747 jumbo jet, as little as a pencil-diameter ridge of ice running along the wingspan, from root to tip, is enough to disrupt the lift-giving airflow. On a smaller airplane like the Q400, an even tinier ridge of ice may suffice to cause the airplane to suddenly drop into a steep bank and pitch-down, careening into the ground before the surprised crew can recover the airplane. The pilot of another plane in the vicinity reported, “We’ve got about a half inch, about a quarter inch of ice from the descent.” That is a lot of ice and this pilot apparently did not realize the extreme danger he was in.

If one built an aircraft, putting different wings on each side, and asked any test pilot to fly it, they would doubtless reply that this is insanity. The fact that this is exactly what is happening in turboprop country is seemingly lost in the muddle of discussion of turboprop icing accidents. One factor common to all turboprop icing events is sudden wing drop. Why might that be?

Consider the seemingly pedestrian fact that both the left and right propellers rotate in the same direction. The significance of this that, due to the same helical airflow behind each prop, the wing icing is distributed differently spanwise along each wing (and also on the fuselage sides, engine nacelle and tail surfaces). The result is that each wing has different stalling characteristics, different stalling angles of attack and, as a result, quite dissimilar (and considerably increased) stall speeds.

The iced up aircraft becomes aerodynamically asymmetric. With a build-up of ice, once that higher stall speed is reached as the aircraft slows and configures on approach (dropping the landing gear, deploying flaps, etc.), the right wing will stall at a much higher airspeed than the left, leading to autorotation (a.k.a. flick roll). The terms are used to describe entry into a spin. When that one wing stalls first, the aircraft drops that wing, yaws toward it, and the nose drops into the spin spiral.

One should never attempt to pick up a dropped wing at the stall with aileron. But the pilot’s instinctive reaction for uncommanded roll is to instantly attempt to pick up that dropped wing, yet in doing so the pilot embeds that wing more steeply into its stalled condition and the spin develops more violently. The airplane rapidly becomes unrecoverable.

Another panic-stricken pilot reaction may be to increase power. The effect of aileron input and added power is to flatten the spin (i.e., make it less nose-down and disorienting faster around the spin’s yaw axis). This is exactly the attitude the NTSB says the accident aircraft struck the ground.

Compounding the asymmetric condition is the fact that, if on autopilot, the approaching loss of control is masked by the autopilot soaking up the ice-loads effects by insidiously auto-trimming the aircraft into a spin-prone condition – as seems likely in this accident. Pilots have been exhorted NOT to use autopilots in severe icing conditions because of this sneaky disguise of the approaching imminent “departure.”

Aboard the Continental Connection plane, Captain Marvin Renslow and First Officer Rebecca Shaw had turned on their de-icing equipment but – according to the cockpit voice recorder (CVR) retrieved from the wreckage – they were discussing the ice build-up on the wing and on their windscreen (which is heated to forestall precisely this eventuality). Exactly when de-icing was activated will be an important matter for investigators. Anti-ice needs to be turned on as soon as the airplane enters icing conditions, not after a certain ice buildup occurs.

Shortly after the discussion about ice on the windshield, the airplane entered a severe roll and pitch down, the signs of the airplane entering a stall. The crew may not have received an approach to stall warning (stick shaker). If the autopilot was on, the system will increase the angle of attack to maintain lift, but when the limit is reached, the autopilot will switch off and, in effect, hand the untenable situation to the surprised crew. This appears to be the case; the flight data recorder (FDR) pulled from the wreckage indicates that the autopilot was on at the time the airplane spun out of control.

The likely absence of stick shaker points to a design defect.

According to radar data, the airplane plummeted from 1,800 feet above sea level to 1,000 feet in just five seconds. This rate of descent suggests the airplane was spinning out of control.

The air traffic controller tried to contact the Delta Connection flight, without success. “We need to find out if anything is on the ground,” the controller said. “The aircraft was five miles out and all of a sudden there’s no response from the aircraft.”

The fatal crash from apparent freezing drizzle comes less than a month after an Empire Airlines-operated ATR-42 twin-turboprop cargo hauler crashed just short of the runway threshold at Lubbock, TX. In the Lubbock crash, the two pilots aboard fortunately survived to tell the tale. Even though a different airplane than the Dash 8-Q400, the ATR-42 is a twin-turboprop that, like the stretched ATR-72, has been significantly modified to improve the airplane’s resistance to the effects of icing. Specifically, the ATR-42s/72s have been fitted with larger pneumatic de-icing books on the leading edge of the wing. The boots expand and break off any ice that has stuck. The larger boots are the result of deadly experience. An American Eagle ATR-72 crashed in 1994 at Roselawn, IN, killing 68 people. Subsequent testing showed that the wing could be compromised by a ridge of ice accumulating on top of the wing behind the boot.

ATR-72. Length 89 feet; wing area 656 feet2; passengers 68

ATR-72. Length 89 feet; wing area 656 feet2; passengers 68








Dash 8-Q400. Length 107 feet; wing area 679 feet2, passengers 78.

Dash 8-Q400. Length 107 feet; wing area 679 feet2, passengers 78.













The boot was expanded to cover more of the wing chord, and all ATR-42s/72s were retrofitted with the improved design. Knock on wood; no ATR-72s loaded with passengers have been lost since due to icing, but the crash of the ATR-42 cargo plane at Lubbock, under investigation by the National Transportation Safety Board (NTSB), now takes on added import with the fatal crash of the Dash 8-Q400 near Buffalo. Both airplanes may have been in freezing drizzle conditions.

Aircraft are not certified to fly in conditions known technically as supercooled large droplet (SLD) icing conditions, where water droplets smack onto the wing leading edges and freeze. This condition (SLD) constitutes about 1% of all icing encounters, but airplanes are not tested for the ability to cope with it, nor are they certified for flight in this not-so-rare condition.

Yes, airplanes are tested and certified to cope with icing conditions. But large water droplets just above the freezing temperature that can hit a super-cold wing and flash freeze into a deadly layer of ice? Nope. Despite a longstanding NTSB recommendation that SLD be accounted for in approving an airplane design, the Federal Aviation Administration (FAA) has relegated the problem of SLD to the “too hard” stack of unresolved hazards.

To an unwary flight crew, SLD can be a real killer. The pilots of the Continental Connection plane may not have been aware of the great danger they were in. For one thing, they may not have been able to see clearly and completely the wing from the side windows in the cockpit. When an airplane is stretched, in this case from the Q300 to the Q400, the fuselage is lengthened both ahead of and behind the main wing. Thus, the cockpit is further in front of the wing leading edge and seeing ice accumulation from the cockpit, especially in periods of darkness and reduced visibility, is problematic.

At this early juncture, it seems fair to suggest that the NTSB will focus on the following:

Weather at the time of the accident, especially the altitude of cloud tops, the readouts from Doppler weather radar, and so forth – basically, a detailed review of prevailing icing or SLD conditions. Meteorological information available to the crew will be a vital area of inquiry, especially any warnings of ice or freezing rain. Was the airplane equipped with weather radar, and was it turned on during descent?

Pilot actions during descent. The crew was aware of the potential for icing, reportedly having turned on the de-icing equipment about 8 minutes after take off. And we know from the CVR transcript that Capt. Renslow and First Officer Shaw were discussing the icing situation. Were they aware of a drop-off in speed attendant to ice buildup?

If, as seems the case, they were on autopilot, the system would have masked the increasing angle-of-attack that would have been added automatically as ice accumulated on the airplane. When the autopilot reached its limits and snapped off, the airplane likely rolled and pitched nose-down into a stall, catching the pilots by surprise.

The flap extension on approach to landing may have suddenly exacerbated the differential between the left and right wing’s icing asymmetry (by rapidly changing each wing’s stalling angle of attack). In freezing rain, areas further back on each wing’s chord would be contaminated by varying and significant thicknesses of spanwise-ridged ice accretions. At lower approach speeds, the difference between the left and right wing’s elevated stalling speed would be even more critical. With flap extension pursuant to landing, those ice ridges would have compromised the aileron’s ability to control (or oppose) roll.

Additionally, there would be an increased likelihood that a large aileron deflection, attendant to turning onto the localizer, would be likely to stall the upgoing wing and induce autorotation. The slipstream effect of added engine power at lower speed (to compensate for drag due to gear/flap extension) would also accentuate the differing lift and drag coefficients between the two wings.

Sudden unexpected autorotative roll during a turn, at well above the normal stall speed, is highly likely to generate an instinctive pilot reaction to “hold in” opposite aileron. However, use of aileron to reinstate wings level at the stall will more deeply embed the aircraft in the autorotative condition. This is why, even for wing drop in a wings level stall, the only solution (while pushing the yoke forward to unstall the wings) is to use the rudder (i.e., roll) to prevent further wing drop. The use of rudder to stop roll has never been instinctive in an unexpected sudden wing-drop/uncommanded roll scenario.

If the pilot is unaware that the wing-drop is the result of one wing stalling, and he maintains a desperate wing-level aileron input, the result will be a flat spin. Use of increased engine power will also flatten the spin’s pitch attitude.

Eyewitness accounts suggest a classic stall/spin scenario. They state that the aircraft’s impact attitude was flat with roll and yaw – the classic flat spin attitude resulting from autorotation, the pilot’s natural reaction of immediate opposite aileron, and moderate to full power.

The crew’s training for stall avoidance and stall recovery will certainly be scrutinized.

Was the crew aware of cautions that supposedly were in the airplane flight manual (AFM)? The Procedures Section states:

“Do not extend flaps during extended operations in icing conditions. Operations with flaps extended can result in reduced wing angle-of-attack, with the possibility of ice forming on the upper surface further aft on the wing than normal, possibly aft of the protected area.”

And in the Limitations Section is this warning:

“Flight in freezing rain, freezing drizzle, or mixed icing conditions (supercooled liquid water and ice crystals) may result in ice build-up on protected surfaces exceeding the capability of the ice protection system, or may result in ice forming aft of the protected surfaces. This ice may not be shed icing the ice protection systems, and may seriously degrade the performance and controllability of the airplane.” [Emphasis added]

When it comes to airframe icing, the operative phrase “speed is life” takes on added importance. If the wing is contaminated by ice, it is critically necessary to add airspeed to account for the airplane’s higher stalling speed due to carrying a load of ice brought about by the freezing rain/drizzle conditions.

Normal threshold speed is 1.3 times the stall speed in the landing configuration, which applies to the Continental Connection airplane. But when the wing is contaminated, the stall speed goes up. When the iced-wing stall speed reaches 1.3 times the old clean wing speed, the loss of lift can be dramatic and sudden. The airplane will roll, pitch and lose altitude. A crew caught unawares must be quick on the controls to avert catastrophe.

Here’s betting that the pilots were right on the normal approach speed YET UNAWARE that their wing’s new stall speed (with the growing ice load on the wing, fuselage, tail and control surfaces) was about 1.3 times the old clean wing stall speed.

The airline. Continental Connection training and operational procedures for flight in icing conditions will certainly be documented in the investigation. Does the company emphasize airplane configuration (anti-icing activated, autopilot off) when icing conditions are encountered? Are flight crews exposed in simulator training to icing conditions, the need for extra speed and, if the airplane stalls, are they trained in the correct recovery technique?

If, as seems likely, the autopilot was engaged at the time of flap extension or while the crew was mentioning ice on the airplane, the airline training and awareness programs bear examination. There is a training deficiency if the autopilot was engaged.

Just this past January the Accident Investigation Board Norway (AIBN) released a report of an icing-related incident involving an ATR-42 en route to Oslo. The autopilot disconnected, and the airplane rolled 45 degrees to the right. “When the crew believed they had regained control, the airplane suddenly rolled uncommanded to the left in a similar manner,” the AIBN report said.

The AIBN report documented “serious deficiencies in the company’s quality system and flight safety program.” The crew, it turns out, was not attuned to the hazards associated with icing and the airline was deemed at fault. As the AIBN report said, “Within a company flying the ATR-42 in western Norway, the AIBN is of the opinion that it should be expected that airframe icing would be one of the focus areas of the mandatory flight safety work.”

“Deficiencies in the documentation, unsatisfactory quality systems and deficiencies in the flight safety program were all repeatedly pointed out by CAA-N [Civil Airworthiness Authority – Norway],” the AIBN observed, noting also that CAA-N was deficient in its follow-up, rule enforcement and oversight of the airline. For example, the AIBN found:

“During flight operations inspections, the CAA-N had frequently expressed concern and had issued findings and required corrective actions, but had not monitored whether the company had closed these in a satisfactory manner … The inspection reports do not contain any evaluation of the company’s level of safety or the ability to monitor or control its own safety development.”

Do not be surprised if similar findings are made by the NTSB concerning Continental Connection and the FAA.

The manufacturer. In an effort to create an airplane that could carry more passengers cheaply, Bombardier, which produces the Dash 8-Q400, stretched the Q300 model from a length of 84 feet to 107 feet to produce the Q400. Basically, a long, skinny airplane resulted; typically, performance margins decline in a stretched model. Wing loading may increase; stall speed may increase.

As a result of the stretch, the Q400 has a pretty narrow center of gravity (CofG) range. The airplane is trim sensitive due to its length. Both spin and spiral instability are adversely affected by an aft CofG, even if the airplane is within CofG limits. The NTSB will have to determine the extent to which any performance degradations in the design bear on this icing-related crash.

About 43% of the Dash 8-Q400’s wing is immersed in the propwash (see photo below). In certain icing conditions, the helical flow from the propeller may result in uneven ice formation on the wing aft of the de-ice boots. When engine power is reduced, the velocity of the propwash and the beneficial effects of the propeller flow will be reduced. If ice has caused a serious erosion of the normal safety margins, the result can be a lateral imbalance of lift that can contribute to a roll. This is one reason why pilots need to maintain or even increase airspeed.

The blue area in the photograph shows the area of the Dash 8-Q400 wing immersed in the propwash. At 43% of the wing area, it represents a substantial percent of the wing, so lift asymmetry due to ice formation in this area is worthy of careful consideration.

The blue area in the photograph shows the area of the Dash 8-Q400 wing immersed in the propwash. At 43% of the wing area, it represents a substantial percent of the wing, so lift asymmetry due to ice formation in this area is worthy of careful consideration.


















With the propellers rotating in the same direction, there can also be a significant speed differential between the port and starboard wings’ stalling speed. That is conducive to a very rapid snap-roll entry into an unrecoverable spin. Pilots will instinctively try to oppose roll with aileron. That input will merely embed the dropping wing into a stalled condition. Application of power will just flatten the spin. Spins entered on autopilot will have the added penalty of having been trimmed (pitch and roll) deeply into the condition, significantly complicating the pilot’s already near-impossible task of attempted recovery.

Having the propellers rotate in opposite direction may ameliorate the differential stalling speed and entry into snap-roll. The same-direction propeller rotation of each engine may contribute to the spanwise asymmetric icing situation that makes recovery from stall so difficult. While the NTSB has investigated numerous icing incidents and accidents, it has not – to this date – explored the effect of propellers spinning in the same direction, thereby contributing to the differential spanwise buildup of ice and the likelihood of one wing getting stalled.

Moreover, heated wings are deemed more effective than pneumatic rubber boots at ridding wings of unwanted ice. Was the heated wing technology avoided because it’s more expensive?

One doubts that it was more expensive than the statistical value of a life – variously estimated between $3 million and $5 million. Heated wing technology looks cheap, now, in light of a crash that could cost insurers upwards of $150 million.

The airplane flight manual (AFM) for the Dash 8 series was supposed to have been modified in the late 1990s to prohibit extension of flaps when operating for an extended period in icing conditions. Since the airplane was on descent to landing, the flaps were extended. The flight crew elected to stow the flaps in the moments before the airplane pitched into its fatal stall. What constitutes an “extended period” in icing when flaps should not be deployed will surely be an avenue probed by NTSB investigators.

The regulator. The airplane design was approved and certified by the FAA in 2000. Was the Dash 8-Q300’s performance in icing conditions used to certify the Dash 8-Q400? Or was performance in icing of the stretched Q400 in fact tested?

Was the airplane required to be equipped with an ice detector? If not, why not?

Did the FAA approve of the crew training for flight in icing conditions, and did FAA inspectors regularly examine the simulator training, the other instruction given flight crews, and the overall company program for conducting flight in icing conditions?

If SLD is suspected as the killer accumulation that brought down the airplane, the FAA is definitely guilty of dithering. The agency has been aware of the hazard associated with flight in SLD for at least a decade, but it has not updated its certification standards. Basically, an airplane can be routinely dispatched to operate in conditions in which it was not certified to fly safely. The fact that this is done on a routine basis is a tragedy – underscored now with 50 dead. Behind this latest death toll lurks a legacy of bureaucratic inertia. If the FAA had acted with alacrity after the ATR-72 crash at Roselawn in 1994, with a wire-brush scrub of all models of aircraft, not just the ATR-42/72, this crash at Buffalo might not have occurred.

From the pilots to the regulator, all aspects of the case will be examined. In its investigation of the ATR-42 icing incident, the AIBN said:

“The AIBN considers this occurrence as a typical organizational incident, where it is not sufficient to analyze the flight crew’s ‘active errors’ in order to explain why it happened. In his book ‘Managing the Risk of Organizational Accidents’ (1997), James Reason describes how latent conditions in complex systems can exist for years before combining with local conditions and active errors in such a way that barriers against accidents are penetrated. The famous ‘Swiss Cheese Model’ with several layers of defense barriers illustrates this problem. The AIBN applied the barrier model as a tool when analyzing how latest conditions and active errors combined and made it possible for this icing incident to occur,” (See illustration below)

Swiss Cheese Model Latent conditions and active errors that led to the icing incident in Norway

Swiss Cheese Model Latent conditions and active errors that led to the icing incident in Norway





















It should be noted that the NTSB has a number of safety recommendations submitted to the FAA and has lumped these initiatives into its “Most Wanted” list of safety improvements, to include research into “freezing rain and critical ice shapes.” This recommendation calls for research into SLD icing. The NTSB also recommended upgraded certification standards and operational procedures. The NTSB has color-coded the FAA’s inaction red, for “unacceptable response.”

The controller got no response from the Continental Connection flight, but the NTSB has gotten no positive response from the FAA about the need to certify airplanes for flight in SLD icing conditions.

Just as the airplane was downed by ice, the FAA apparently has been frozen in indifference.

Leave a Reply

Nolan Law Group